@auth0/auth0-react 2.10.0 → 2.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/dist/auth0-context.d.ts +11 -0
  2. package/dist/auth0-context.d.ts.map +1 -1
  3. package/dist/auth0-provider.d.ts.map +1 -1
  4. package/dist/auth0-react.cjs.js +19 -17
  5. package/dist/auth0-react.cjs.js.map +1 -1
  6. package/dist/auth0-react.esm.js +9 -7
  7. package/dist/auth0-react.esm.js.map +1 -1
  8. package/dist/auth0-react.js +19 -17
  9. package/dist/auth0-react.js.map +1 -1
  10. package/dist/auth0-react.min.js +1 -1
  11. package/dist/auth0-react.min.js.map +1 -1
  12. package/dist/index.d.ts +1 -1
  13. package/dist/index.d.ts.map +1 -1
  14. package/package.json +8 -8
  15. package/src/auth0-context.tsx +13 -1
  16. package/src/auth0-provider.tsx +7 -0
  17. package/src/index.tsx +2 -1
package/dist/auth0-react.min.js CHANGED
@@ -1,2 +1,2 @@
1
- !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,(function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var i in t=arguments[n])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},o.apply(this,arguments)};function i(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var i=0;for(o=Object.getOwnPropertySymbols(e);i<o.length;i++)t.indexOf(o[i])<0&&Object.prototype.propertyIsEnumerable.call(e,o[i])&&(n[o[i]]=e[o[i]])}return n}function r(e,t,n,o){return new(n||(n=Promise))((function(i,r){function s(e){try{c(o.next(e))}catch(e){r(e)}}function a(e){try{c(o.throw(e))}catch(e){r(e)}}function c(e){var t;e.done?i(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(s,a)}c((o=o.apply(e,t||[])).next())}))}function s(e,t){var n,o,i,r={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]},s=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),"function"==typeof Symbol&&(s[Symbol.iterator]=function(){return this}),s;function a(a){return function(c){return function(a){if(n)throw new TypeError("Generator is already executing.");for(;s&&(s=0,a[0]&&(r=0)),r;)try{if(n=1,o&&(i=2&a[0]?o.return:a[0]?o.throw||((i=o.return)&&i.call(o),0):o.next)&&!(i=i.call(o,a[1])).done)return i;switch(o=0,i&&(a=[2&a[0],i.value]),a[0]){case 0:case 1:i=a;break;case 4:return r.label++,{value:a[1],done:!1};case 5:r.label++,o=a[1],a=[0];continue;case 7:a=r.ops.pop(),r.trys.pop();continue;default:if(!(i=r.trys,(i=i.length>0&&i[i.length-1])||6!==a[0]&&2!==a[0])){r=0;continue}if(3===a[0]&&(!i||a[1]>i[0]&&a[1]<i[3])){r.label=a[1];break}if(6===a[0]&&r.label<i[1]){r.label=i[1],i=a;break}if(i&&r.label<i[2]){r.label=i[2],r.ops.push(a);break}i[2]&&r.ops.pop(),r.trys.pop();continue}a=t.call(e,r)}catch(e){a=[6,e],o=0}finally{n=i=0}if(5&a[0])throw a[1];return{value:a[0]?a[1]:void 0,done:!0}}([a,c])}}}function a(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var i=0;for(o=Object.getOwnPropertySymbols(e);i<o.length;i++)t.indexOf(o[i])<0&&Object.prototype.propertyIsEnumerable.call(e,o[i])&&(n[o[i]]=e[o[i]])}return n}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError;var c="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function u(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function d(e,t){return e(t={exports:{}},t.exports),t.exports}var l=d((function(e,t){Object.defineProperty(t,"__esModule",{value:!0});var n=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise((function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())}))},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();t.default=function(){return n.getInstance()}}));u(l);var h=u(d((function(e,t){var n=c&&c.__awaiter||function(e,t,n,o){return new(n||(n=Promise))((function(i,r){function s(e){try{c(o.next(e))}catch(e){r(e)}}function a(e){try{c(o.throw(e))}catch(e){r(e)}}function c(e){e.done?i(e.value):new n((function(t){t(e.value)})).then(s,a)}c((o=o.apply(e,t||[])).next())}))},o=c&&c.__generator||function(e,t){var n,o,i,r,s={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return r={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(r[Symbol.iterator]=function(){return this}),r;function a(r){return function(a){return function(r){if(n)throw new TypeError("Generator is already executing.");for(;s;)try{if(n=1,o&&(i=2&r[0]?o.return:r[0]?o.throw||((i=o.return)&&i.call(o),0):o.next)&&!(i=i.call(o,r[1])).done)return i;switch(o=0,i&&(r=[2&r[0],i.value]),r[0]){case 0:case 1:i=r;break;case 4:return s.label++,{value:r[1],done:!1};case 5:s.label++,o=r[1],r=[0];continue;case 7:r=s.ops.pop(),s.trys.pop();continue;default:if(!((i=(i=s.trys).length>0&&i[i.length-1])||6!==r[0]&&2!==r[0])){s=0;continue}if(3===r[0]&&(!i||r[1]>i[0]&&r[1]<i[3])){s.label=r[1];break}if(6===r[0]&&s.label<i[1]){s.label=i[1],i=r;break}if(i&&s.label<i[2]){s.label=i[2],s.ops.push(r);break}i[2]&&s.ops.pop(),s.trys.pop();continue}r=t.call(e,s)}catch(e){r=[6,e],o=0}finally{n=i=0}if(5&r[0])throw r[1];return{value:r[0]?r[1]:void 0,done:!0}}([r,a])}}},i=c;Object.defineProperty(t,"__esModule",{value:!0});var r="browser-tabs-lock-key",s={key:function(e){return n(i,void 0,void 0,(function(){return o(this,(function(e){throw new Error("Unsupported")}))}))},getItem:function(e){return n(i,void 0,void 0,(function(){return o(this,(function(e){throw new Error("Unsupported")}))}))},clear:function(){return n(i,void 0,void 0,(function(){return o(this,(function(e){return[2,window.localStorage.clear()]}))}))},removeItem:function(e){return n(i,void 0,void 0,(function(){return o(this,(function(e){throw new Error("Unsupported")}))}))},setItem:function(e,t){return n(i,void 0,void 0,(function(){return o(this,(function(e){throw new Error("Unsupported")}))}))},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function a(e){return new Promise((function(t){return setTimeout(t,e)}))}function u(e){for(var t="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz",n="",o=0;o<e;o++)n+=t[Math.floor(61*Math.random())];return n}var d=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+u(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,i){return void 0===i&&(i=5e3),n(this,void 0,void 0,(function(){var n,c,d,l,h,p,f;return o(this,(function(o){switch(o.label){case 0:n=Date.now()+u(4),c=Date.now()+i,d=r+"-"+t,l=void 0===this.storageHandler?s:this.storageHandler,o.label=1;case 1:return Date.now()<c?[4,a(30)]:[3,8];case 2:return o.sent(),null!==l.getItemSync(d)?[3,5]:(h=this.id+"-"+t+"-"+n,[4,a(Math.floor(25*Math.random()))]);case 3:return o.sent(),l.setItemSync(d,JSON.stringify({id:this.id,iat:n,timeoutKey:h,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,a(30)];case 4:return o.sent(),null!==(p=l.getItemSync(d))&&(f=JSON.parse(p)).id===this.id&&f.iat===n?(this.acquiredIatSet.add(n),this.refreshLockWhileAcquired(d,n),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?s:this.storageHandler),[4,this.waitForSomethingToChange(c)];case 6:o.sent(),o.label=7;case 7:return n=Date.now()+u(4),[3,1];case 8:return[2,!1]}}))}))},e.prototype.refreshLockWhileAcquired=function(e,t){return n(this,void 0,void 0,(function(){var i=this;return o(this,(function(r){return setTimeout((function(){return n(i,void 0,void 0,(function(){var n,i,r;return o(this,(function(o){switch(o.label){case 0:return[4,l.default().lock(t)];case 1:return o.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?s:this.storageHandler,null===(i=n.getItemSync(e))?(l.default().unlock(t),[2]):((r=JSON.parse(i)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),l.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(l.default().unlock(t),[2])}}))}))}),1e3),[2]}))}))},e.prototype.waitForSomethingToChange=function(t){return n(this,void 0,void 0,(function(){return o(this,(function(n){switch(n.label){case 0:return[4,new Promise((function(n){var o=!1,i=Date.now(),r=!1;function s(){if(r||(window.removeEventListener("storage",s),e.removeFromWaiting(s),clearTimeout(a),r=!0),!o){o=!0;var t=50-(Date.now()-i);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",s),e.addToWaiting(s);var a=setTimeout(s,Math.max(0,t-Date.now()))}))];case 1:return n.sent(),[2]}}))}))},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter((function(e){return e!==t})))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach((function(e){return e()}))},e.prototype.releaseLock=function(e){return n(this,void 0,void 0,(function(){return o(this,(function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}}))}))},e.prototype.releaseLock__private__=function(t){return n(this,void 0,void 0,(function(){var n,i,a,c;return o(this,(function(o){switch(o.label){case 0:return n=void 0===this.storageHandler?s:this.storageHandler,i=r+"-"+t,null===(a=n.getItemSync(i))?[2]:(c=JSON.parse(a)).id!==this.id?[3,2]:[4,l.default().lock(c.iat)];case 1:o.sent(),this.acquiredIatSet.delete(c.iat),n.removeItemSync(i),l.default().unlock(c.iat),e.notifyWaiters(),o.label=2;case 2:return[2]}}))}))},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,i=[],s=0;;){var a=o.keySync(s);if(null===a)break;i.push(a),s++}for(var c=!1,u=0;u<i.length;u++){var d=i[u];if(d.includes(r)){var l=o.getItemSync(d);if(null!==l){var h=JSON.parse(l);(void 0===h.timeRefreshed&&h.timeAcquired<n||void 0!==h.timeRefreshed&&h.timeRefreshed<n)&&(o.removeItemSync(d),c=!0)}}}c&&e.notifyWaiters()},e.waiters=void 0,e}();t.default=d})));const p={timeoutInSeconds:60},f={name:"auth0-spa-js",version:"2.9.1"},m=()=>Date.now();class y extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,y.prototype)}static fromPayload({error:e,error_description:t}){return new y(e,t)}}class g extends y{constructor(e,t,n,o=null){super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,g.prototype)}}class w extends y{constructor(e,t,n,o,i=null){super(e,t),this.connection=n,this.state=o,this.appState=i,Object.setPrototypeOf(this,w.prototype)}}class b extends y{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,b.prototype)}}class v extends b{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,v.prototype)}}class k extends y{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,k.prototype)}}class _ extends y{constructor(e,t,n){super(e,t),this.mfa_token=n,Object.setPrototypeOf(this,_.prototype)}}class S extends y{constructor(e,t){super("missing_refresh_token",`Missing Refresh Token (audience: '${P(e,["default"])}', scope: '${P(t)}')`),this.audience=e,this.scope=t,Object.setPrototypeOf(this,S.prototype)}}class I extends y{constructor(e,t){super("missing_scopes",`Missing requested scopes after refresh (audience: '${P(e,["default"])}', missing scope: '${P(t)}')`),this.audience=e,this.scope=t,Object.setPrototypeOf(this,I.prototype)}}class T extends y{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,T.prototype)}}function P(e,t=[]){return e&&!t.includes(e)?e:""}const O=()=>window.crypto,C=()=>{const e="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~.";let t="";return Array.from(O().getRandomValues(new Uint8Array(43))).forEach((n=>t+=e[n%66])),t},E=e=>btoa(e),j=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],x=e=>Object.keys(e).reduce(((t,n)=>{const o=j.find((e=>e.key===n));return o&&o.type.includes(typeof e[n])&&(t[n]=e[n]),t}),{}),R=e=>{var{clientId:t}=e,n=a(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter((t=>void 0!==e[t])).reduce(((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]})),{}))(Object.assign({client_id:t},n))).toString()},z=async e=>{const t=O().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},K=e=>(e=>decodeURIComponent(atob(e).split("").map((e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2))).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),N=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,(e=>t[e]))})(window.btoa(String.fromCharCode(...Array.from(t))))},A=new TextEncoder,U=new TextDecoder;function D(e){return"string"==typeof e?A.encode(e):U.decode(e)}function L(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new G(`${e.name} modulusLength must be at least 2048 bits`)}let Z;if(Uint8Array.prototype.toBase64)Z=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Z=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function W(e){return Z(e)}class H extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class G extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function J(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new H("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new H("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new H("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new H("unsupported CryptoKey algorithm name")}}function X(e){return e instanceof CryptoKey}function F(e){return X(e)&&"public"===e.type}async function M(e,t,n,o,i,r){const s=null==e?void 0:e.privateKey,a=null==e?void 0:e.publicKey;if(!X(c=s)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!F(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==a.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==i&&"string"!=typeof i)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==r&&("object"!=typeof r||null===r||Array.isArray(r)))throw new TypeError('"additional" must be an object');return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${W(D(JSON.stringify(e)))}.${W(D(JSON.stringify(t)))}`;return`${o}.${W(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return L(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return L(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new H}(n),n,D(o)))}`}({alg:J(s),typ:"dpop+jwt",jwk:await V(a)},Object.assign(Object.assign({},r),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:i?W(await crypto.subtle.digest("SHA-256",D(i))):void 0}),s)}async function V(e){const{kty:t,e:n,n:o,x:i,y:r,crv:s}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:s,e:n,n:o,x:i,y:r}}const Y=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange"];const $=async(e,t)=>{const n=await fetch(e,t);return{ok:n.ok,json:await n.json(),headers:(o=n.headers,[...o].reduce(((e,[t,n])=>(e[t]=n,e)),{}))};var o},B=async(e,t,n,o,i,r,s=1e4,a)=>i?(async(e,t,n,o,i,r,s,a)=>{return c={auth:{audience:t,scope:n},timeout:i,fetchUrl:e,fetchOptions:o,useFormData:s,useMrrt:a},u=r,new Promise((function(e,t){const n=new MessageChannel;n.port1.onmessage=function(o){o.data.error?t(new Error(o.data.error)):e(o.data),n.port1.close()},u.postMessage(c,[n.port2])}));var c,u})(e,t,n,o,s,i,r,a):(async(e,t,n)=>{const o=new AbortController;let i;return t.signal=o.signal,Promise.race([$(e,t),new Promise(((e,t)=>{i=setTimeout((()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))}),n)}))]).finally((()=>{clearTimeout(i)}))})(e,o,s);async function q(e,t,n,o,i,r,s,c,u,d){if(u){const t=await u.generateProof({url:e,method:i.method||"GET",nonce:await u.getNonce()});i.headers=Object.assign(Object.assign({},i.headers),{dpop:t})}let l,h=null;for(let a=0;a<3;a++)try{l=await B(e,n,o,i,r,s,t,c),h=null;break}catch(e){h=e}if(h)throw h;const p=l.json,{error:f,error_description:m}=p,g=a(p,["error","error_description"]),{headers:w,ok:b}=l;let v;if(u&&(v=w["dpop-nonce"],v&&await u.setNonce(v)),!b){const a=m||`HTTP error. Unable to fetch ${e}`;if("mfa_required"===f)throw new _(f,a,g.mfa_token);if("missing_refresh_token"===f)throw new S(n,o);if("use_dpop_nonce"===f){if(!u||!v||d)throw new T(v);return q(e,t,n,o,i,r,s,c,u,!0)}throw new y(f||"request_error",a)}return g}async function Q(e,t){var{baseUrl:n,timeout:o,audience:i,scope:r,auth0Client:s,useFormData:c,useMrrt:u,dpop:d}=e,l=a(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop"]);const h="urn:ietf:params:oauth:grant-type:token-exchange"===l.grant_type,p="refresh_token"===l.grant_type&&u,m=Object.assign(Object.assign(Object.assign(Object.assign({},l),h&&i&&{audience:i}),h&&r&&{scope:r}),p&&{audience:i,scope:r}),y=c?R(m):JSON.stringify(m),g=(w=l.grant_type,Y.includes(w));var w;return await q(`${n}/oauth/token`,o,i||"default",r,{method:"POST",body:y,headers:{"Content-Type":c?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(x(s||f)))}},t,c,u,g?d:void 0)}const ee=(...e)=>{return(t=e.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(t))).join(" ");var t},te=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e.default),ee(o,t)};class ne{constructor(e,t="@@auth0spajs@@",n){this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const[t,n,o,i]=e.split("::");return new ne({clientId:n,scope:i,audience:o},t)}static fromCacheEntry(e){const{scope:t,audience:n,client_id:o}=e;return new ne({scope:t,audience:n,clientId:o})}}class oe{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter((e=>e.startsWith("@@auth0spajs@@")))}}class ie{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class re{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||m}async setIdToken(e,t,n){var o;const i=this.getIdTokenCacheKey(e);await this.cache.set(i,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(i))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e,t=0,n=!1,o){var i;let r=await this.cache.get(e.toKey());if(!r){const t=await this.getCacheKeys();if(!t)return;const i=this.matchExistingCacheKey(e,t);if(i&&(r=await this.cache.get(i)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!r)return;const s=await this.nowProvider(),a=Math.floor(s/1e3);return r.expiresAt-t<a?r.body.refresh_token?this.modifiedCachedEntry(r,e):(await this.cache.remove(e.toKey()),void await(null===(i=this.keyManifest)||void 0===i?void 0:i.remove(e.toKey()))):r.body}async modifiedCachedEntry(e,t){return e.body={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},await this.cache.set(t.toKey(),e),{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}async set(e){var t;const n=new ne({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new ne({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter((t=>!e||t.includes(e))).reduce((async(e,t)=>{await e,await this.cache.remove(t)}),Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new ne({clientId:e},"@@auth0spajs@@","@@user@@").toKey()}matchExistingCacheKey(e,t){return t.filter((t=>{var n;const o=ne.fromKey(t),i=new Set(o.scope&&o.scope.split(" ")),r=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],s=o.scope&&r.reduce(((e,t)=>e&&i.has(t)),!0);return"@@auth0spajs@@"===o.prefix&&o.clientId===e.clientId&&o.audience===e.audience&&s}))[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=ne.fromKey(o);if("@@auth0spajs@@"===t.prefix&&t.clientId===e.clientId){const t=await this.cache.get(o);if(null===(n=null==t?void 0:t.body)||void 0===n?void 0:n.refresh_token)return this.modifiedCachedEntry(t,e)}}}async updateEntry(e,t){var n;const o=await this.getCacheKeys();if(o)for(const i of o){const o=await this.cache.get(i);if((null===(n=null==o?void 0:o.body)||void 0===n?void 0:n.refresh_token)===e){const e=Object.assign(Object.assign({},o.body),{refresh_token:t});await this.set(e)}}}}class se{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey=`a0.spajs.txs.${this.clientId}`}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const ae=e=>"number"==typeof e,ce=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var ue=d((function(e,t){var n=c&&c.__assign||function(){return n=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var i in t=arguments[n])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},n.apply(this,arguments)};function o(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}function i(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return o("Expires",e.expires?e.expires.toUTCString():"")+o("Domain",e.domain)+o("Path",e.path)+o("Secure",e.secure)+o("SameSite",e.sameSite)}(n)}function r(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,i=0;i<n.length;i++){var r=n[i].split("="),s=r.slice(1).join("=");'"'===s.charAt(0)&&(s=s.slice(1,-1));try{t[r[0].replace(o,decodeURIComponent)]=s.replace(o,decodeURIComponent)}catch(e){}}return t}function s(){return r(document.cookie)}function a(e,t,o){document.cookie=i(e,t,n({path:"/"},o))}t.__esModule=!0,t.encode=i,t.parse=r,t.getAll=s,t.get=function(e){return s()[e]},t.set=a,t.remove=function(e,t){a(e,"",n(n({},t),{expires:-1}))}}));u(ue),ue.encode,ue.parse,ue.getAll;var de=ue.get,le=ue.set,he=ue.remove;const pe={get(e){const t=de(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),le(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),he(e,n)}},fe={get:e=>pe.get(e)||pe.get(`_legacy_${e}`),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),le(`_legacy_${e}`,JSON.stringify(t),o),pe.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),he(e,n),pe.remove(e,t),pe.remove(`_legacy_${e}`,t)}},me={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var ye,ge=function(e){return ye=ye||function(e,t,n){var o=void 0===t?null:t,i=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),i=0,r=n.length;i<r;++i)o[i]=n.charCodeAt(i);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),r=i.indexOf("\n",10)+1,s=i.substring(r)+(o?"//# sourceMappingURL="+o:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7Y2xhc3MgZSBleHRlbmRzIEVycm9ye2NvbnN0cnVjdG9yKHQscil7c3VwZXIociksdGhpcy5lcnJvcj10LHRoaXMuZXJyb3JfZGVzY3JpcHRpb249cixPYmplY3Quc2V0UHJvdG90eXBlT2YodGhpcyxlLnByb3RvdHlwZSl9c3RhdGljIGZyb21QYXlsb2FkKHtlcnJvcjp0LGVycm9yX2Rlc2NyaXB0aW9uOnJ9KXtyZXR1cm4gbmV3IGUodCxyKX19Y2xhc3MgdCBleHRlbmRzIGV7Y29uc3RydWN0b3IoZSxzKXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIixgTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyR7cihlLFsiZGVmYXVsdCJdKX0nLCBzY29wZTogJyR7cihzKX0nKWApLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXMsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsdC5wcm90b3R5cGUpfX1mdW5jdGlvbiByKGUsdD1bXSl7cmV0dXJuIGUmJiF0LmluY2x1ZGVzKGUpP2U6IiJ9ImZ1bmN0aW9uIj09dHlwZW9mIFN1cHByZXNzZWRFcnJvciYmU3VwcHJlc3NlZEVycm9yO2NvbnN0IHM9ZT0+e3ZhcntjbGllbnRJZDp0fT1lLHI9ZnVuY3Rpb24oZSx0KXt2YXIgcj17fTtmb3IodmFyIHMgaW4gZSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoZSxzKSYmdC5pbmRleE9mKHMpPDAmJihyW3NdPWVbc10pO2lmKG51bGwhPWUmJiJmdW5jdGlvbiI9PXR5cGVvZiBPYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKXt2YXIgbz0wO2ZvcihzPU9iamVjdC5nZXRPd25Qcm9wZXJ0eVN5bWJvbHMoZSk7bzxzLmxlbmd0aDtvKyspdC5pbmRleE9mKHNbb10pPDAmJk9iamVjdC5wcm90b3R5cGUucHJvcGVydHlJc0VudW1lcmFibGUuY2FsbChlLHNbb10pJiYocltzW29dXT1lW3Nbb11dKX1yZXR1cm4gcn0oZSxbImNsaWVudElkIl0pO3JldHVybiBuZXcgVVJMU2VhcmNoUGFyYW1zKChlPT5PYmplY3Qua2V5cyhlKS5maWx0ZXIoKHQ9PnZvaWQgMCE9PWVbdF0pKS5yZWR1Y2UoKCh0LHIpPT5PYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sdCkse1tyXTplW3JdfSkpLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IG89e307Y29uc3Qgbj0oZSx0KT0+YCR7ZX18JHt0fWA7YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsKGFzeW5jKHtkYXRhOnt0aW1lb3V0OmUsYXV0aDpyLGZldGNoVXJsOmksZmV0Y2hPcHRpb25zOmMsdXNlRm9ybURhdGE6YSx1c2VNcnJ0OmZ9LHBvcnRzOltwXX0pPT57bGV0IGgsdSxsPXt9O2NvbnN0e2F1ZGllbmNlOmQsc2NvcGU6eX09cnx8e307dHJ5e2NvbnN0IHI9YT8oZT0+e2NvbnN0IHQ9bmV3IFVSTFNlYXJjaFBhcmFtcyhlKSxyPXt9O3JldHVybiB0LmZvckVhY2goKChlLHQpPT57clt0XT1lfSkpLHJ9KShjLmJvZHkpOkpTT04ucGFyc2UoYy5ib2R5KTtpZighci5yZWZyZXNoX3Rva2VuJiYicmVmcmVzaF90b2tlbiI9PT1yLmdyYW50X3R5cGUpe2lmKHU9KChlLHQpPT5vW24oZSx0KV0pKGQseSksIXUmJmYpe2NvbnN0IGU9by5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+e2NvbnN0IHI9T2JqZWN0LmtleXMobykuZmluZCgocj0+e2lmKCJsYXRlc3RfcmVmcmVzaF90b2tlbiIhPT1yKXtjb25zdCBzPSgoZSx0KT0+dC5zdGFydHNXaXRoKGAke2V9fGApKSh0LHIpLG89ci5zcGxpdCgifCIpWzFdLnNwbGl0KCIgIiksbj1lLnNwbGl0KCIgIikuZXZlcnkoKGU9Pm8uaW5jbHVkZXMoZSkpKTtyZXR1cm4gcyYmbn19KSk7cmV0dXJuISFyfSkoeSxkKTtlJiYhdCYmKHU9ZSl9aWYoIXUpdGhyb3cgbmV3IHQoZCx5KTtjLmJvZHk9YT9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7cmVmcmVzaF90b2tlbjp1fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7cmVmcmVzaF90b2tlbjp1fSkpfWxldCBqLGs7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGo9bmV3IEFib3J0Q29udHJvbGxlcixjLnNpZ25hbD1qLnNpZ25hbCk7dHJ5e2s9YXdhaXQgUHJvbWlzZS5yYWNlKFsoXz1lLG5ldyBQcm9taXNlKChlPT5zZXRUaW1lb3V0KGUsXykpKSksZmV0Y2goaSxPYmplY3QuYXNzaWduKHt9LGMpKV0pfWNhdGNoKGUpe3JldHVybiB2b2lkIHAucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZX0pfWlmKCFrKXJldHVybiBqJiZqLmFib3J0KCksdm9pZCBwLnBvc3RNZXNzYWdlKHtlcnJvcjoiVGltZW91dCB3aGVuIGV4ZWN1dGluZyAnZmV0Y2gnIn0pO2c9ay5oZWFkZXJzLGw9Wy4uLmddLnJlZHVjZSgoKGUsW3Qscl0pPT4oZVt0XT1yLGUpKSx7fSksaD1hd2FpdCBrLmpzb24oKSxoLnJlZnJlc2hfdG9rZW4/KGYmJihvLmxhdGVzdF9yZWZyZXNoX3Rva2VuPWgucmVmcmVzaF90b2tlbixPPXUsYj1oLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMobykuZm9yRWFjaCgoKFtlLHRdKT0+e3Q9PT1PJiYob1tlXT1iKX0pKSksKChlLHQscik9PntvW24odCxyKV09ZX0pKGgucmVmcmVzaF90b2tlbixkLHkpLGRlbGV0ZSBoLnJlZnJlc2hfdG9rZW4pOigoZSx0KT0+e2RlbGV0ZSBvW24oZSx0KV19KShkLHkpLHAucG9zdE1lc3NhZ2Uoe29rOmsub2ssanNvbjpoLGhlYWRlcnM6bH0pfWNhdGNoKGUpe3AucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOmx9KX12YXIgTyxiLGcsX30pKX0oKTsKCg==",null,false),new Worker(ye,e)};const we={};class be{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return`@@auth0spajs@@::${e}`}}const ve={memory:()=>(new ie).enclosedCache,localstorage:()=>new oe},ke=e=>ve[e],_e=e=>{const{openUrl:t,onRedirect:n}=e,o=a(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},Se=(e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every((e=>n.includes(e)))},Ie={NONCE:"nonce",KEYPAIR:"keypair"};class Te{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise(((t,n)=>{e.onupgradeneeded=()=>Object.values(Ie).forEach((t=>e.result.createObjectStore(t))),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)}))}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise(((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)}))}buildKey(e){const t=e?`_${e}`:"auth0";return`${this.clientId}::${t}`}setNonce(e,t){return this.save(Ie.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(Ie.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",(e=>e.put(n,t)))}findNonce(e){return this.find(Ie.NONCE,this.buildKey(e))}findKeyPair(){return this.find(Ie.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",(e=>e.get(t)))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",(e=>e.getAllKeys()));null==n||n.filter(t).map((t=>this.executeDbRequest(e,"readwrite",(e=>e.delete(t)))))}deleteByClientId(e,t){return this.deleteBy(e,(e=>"string"==typeof e&&e.startsWith(`${t}::`)))}clearNonces(){return this.deleteByClientId(Ie.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(Ie.KEYPAIR,this.clientId)}}class Pe{constructor(e){this.storage=new Te(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function({keyPair:e,url:t,method:n,nonce:o,accessToken:i}){const r=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(t);return M(e,r,n,o,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!F(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await V(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new H("unsupported JWK kty")}return W(await crypto.subtle.digest({name:"SHA-256"},D(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var Oe;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(Oe||(Oe={}));class Ce{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return`${e.replace(/\/?\/$/,"")}/${t.replace(/^\/+/,"")}`}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t,n=Oe.Bearer){e.headers.set("authorization",`${n} ${t}`)}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);let o,i;"string"==typeof n?(o=this.config.dpopNonceId?Oe.DPoP:Oe.Bearer,i=n):(o=n.token_type,i=n.access_token),this.setAuthorizationHeader(e,i,o),o===Oe.DPoP&&await this.setDpopProofHeader(e,i)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,"dpop-nonce");if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new T(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const i=this.buildBaseRequest(e,t);await this.prepareRequest(i,o);const r=await this.config.fetch(i);return this.handleResponse(r,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class Ee{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth(`${this.apiBase}v1/connected-accounts/connect`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth(`${this.apiBase}v1/connected-accounts/complete`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(t)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new je({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new je(t)}}class je extends Error{constructor({type:e,status:t,title:n,detail:o,validation_errors:i}){super(o),this.name="MyAccountApiError",this.type=e,this.status=t,this.title=n,this.detail=o,this.validation_errors=i,Object.setPrototypeOf(this,je.prototype)}}const xe=new h;class Re{constructor(e){let t,n;if(this.userCache=(new ie).enclosedCache,this.activeLockKeys=new Set,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0},this._releaseLockOnPageHide=async()=>{const e=Array.from(this.activeLockKeys);for(const t of e)await xe.releaseLock(t);this.activeLockKeys.clear(),window.removeEventListener("pagehide",this._releaseLockOnPageHide)},this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!O())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===O().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||"memory",!ke(t))throw new Error(`Invalid cache location "${t}"`);n=ke(t)()}this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:1e4,this.cookieStorage=!1===e.legacySameSiteCookie?pe:fe,this.orgHintCookieName=`auth0.${this.options.clientId}.organization_hint`,this.isAuthenticatedCookieName=(()=>`auth0.${this.options.clientId}.is.authenticated`)(),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const o=e.useCookiesForTransactions?this.cookieStorage:me;var i;this.scope=((e,t,...n)=>{if("object"!=typeof e)return{default:ee(t,e,...n)};let o={default:ee(t,...n)};return Object.keys(e).forEach((i=>{const r=e[i];o[i]=ee(t,r,...n)})),o})(this.options.authorizationParams.scope,"openid",this.options.useRefreshTokens?"offline_access":""),this.transactionManager=new se(o,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||m,this.cacheManager=new re(n,n.allKeys?void 0:new be(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new Pe(this.options.clientId):void 0,this.domainUrl=(i=this.options.domain,/^https?:\/\//.test(i)?i:`https://${i}`),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:`https://${e}/`:`${t}/`)(this.options.issuer,this.domainUrl);const r=`${this.domainUrl}/me/`,s=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:()=>this.getTokenSilently({authorizationParams:{scope:"create:me:connected_accounts",audience:r},detailedResponse:!0})}));this.myAccountApi=new Ee(s,r),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&"memory"===t&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new ge)}_url(e){const t=encodeURIComponent(btoa(JSON.stringify(this.options.auth0Client||f)));return`${this.domainUrl}${e}&auth0Client=${t}`}_authorizeUrl(e){return this._url(`/authorize?${R(e)}`)}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),[n,o,i]=t;if(3!==t.length||!n||!o||!i)throw new Error("ID token could not be decoded");const r=JSON.parse(K(o)),s={__raw:e},a={};return Object.keys(r).forEach((e=>{s[e]=r[e],ce.includes(e)||(a[e]=r[e])})),{encoded:{header:n,payload:o,signature:i},header:JSON.parse(K(n)),claims:s,user:a}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error(`Issuer (iss) claim mismatch in the ID token; expected "${e.iss}", found "${t.claims.iss}"`);if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error(`Signature algorithm of "${t.header.alg}" is not supported. Expected the ID token to be signed with "RS256".`);if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error(`Audience (aud) claim mismatch in the ID token; expected "${e.aud}" but was not one of "${t.claims.aud.join(", ")}"`);if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error(`Authorized Party (azp) claim mismatch in the ID token; expected "${e.aud}", found "${t.claims.azp}"`)}}else if(t.claims.aud!==e.aud)throw new Error(`Audience (aud) claim mismatch in the ID token; expected "${e.aud}" but found "${t.claims.aud}"`);if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error(`Nonce (nonce) claim mismatch in the ID token; expected "${e.nonce}", found "${t.claims.nonce}"`)}if(e.max_age&&!ae(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!ae(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!ae(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),i=new Date(0);if(i.setUTCSeconds(t.claims.exp+n),o>i)throw new Error(`Expiration Time (exp) claim error in the ID token; current time (${o}) is after expiration time (${i})`);if(null!=t.claims.nbf&&ae(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error(`Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (${o}) is before ${e}`)}if(null!=t.claims.auth_time&&ae(t.claims.auth_time)){const i=new Date(0);if(i.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>i)throw new Error(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (${o}) is after last auth at ${i}`)}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error(`Organization ID (org_id) claim mismatch in the ID token; expected "${e}", found "${t.claims.org_id}"`)}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error(`Organization Name (org_name) claim mismatch in the ID token; expected "${e}", found "${t.claims.org_name}"`)}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(i=this.options.authorizationParams.max_age,"string"!=typeof i?i:parseInt(i,10)||void 0),now:o});var i}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}async _prepareAuthorizeUrl(e,t,n){var o;const i=E(C()),r=E(C()),s=C(),a=await z(s),c=N(a),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),d=((e,t,n,o,i,r,s,a,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:te(t,n.scope,n.audience),response_type:"code",response_mode:a||"query",state:o,nonce:i,redirect_uri:s||e.authorizationParams.redirect_uri,code_challenge:r,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,i,r,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),l=this._authorizeUrl(d);return{nonce:r,code_verifier:s,scope:d.scope,audience:d.audience||"default",redirect_uri:d.redirect_uri,state:i,url:l}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup",`left=${e},top=${t},width=400,height=600,resizable,scrollbars=yes,status=1`)})(),!t.popup))throw new Error("Unable to open a popup for loginWithPopup - window.open returned `null`");const o=await this._prepareAuthorizeUrl(e.authorizationParams||{},{response_mode:"web_message"},window.location.origin);t.popup.location.href=o.url;const i=await(e=>new Promise(((t,n)=>{let o;const i=setInterval((()=>{e.popup&&e.popup.closed&&(clearInterval(i),clearTimeout(r),window.removeEventListener("message",o,!1),n(new k(e.popup)))}),1e3),r=setTimeout((()=>{clearInterval(i),n(new v(e.popup)),window.removeEventListener("message",o,!1)}),1e3*(e.timeoutInSeconds||60));o=function(s){if(s.data&&"authorization_response"===s.data.type){if(clearTimeout(r),clearInterval(i),window.removeEventListener("message",o,!1),e.popup.close(),s.data.response.error)return n(y.fromPayload(s.data.response));t(s.data.response)}},window.addEventListener("message",o)})))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}));if(o.state!==i.state)throw new y("state_mismatch","Invalid state");const r=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:o.audience,scope:o.scope,code_verifier:o.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:o.redirect_uri},{nonceIn:o.nonce,organization:r})}async getUser(){var e;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(t={}){var n;const o=_e(t),{openUrl:i,fragment:r,appState:s}=o,c=a(o,["openUrl","fragment","appState"]),u=(null===(n=c.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization,d=await this._prepareAuthorizeUrl(c.authorizationParams||{}),{url:l}=d,h=a(d,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},h),{appState:s,response_type:e.ResponseType.Code}),u&&{organization:u}));const p=r?`${l}#${r}`:l;i?await i(p):window.location.assign(p)}async handleRedirectCallback(t=window.location.href){const n=t.split("?").slice(1);if(0===n.length)throw new Error("There are no query params available for parsing.");const o=this.transactionManager.get();if(!o)throw new y("missing_transaction","Invalid state");this.transactionManager.remove();const i=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(n.join(""));return o.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(i,o):this._handleLoginRedirectCallback(i,o)}async _handleLoginRedirectCallback(t,n){const{code:o,state:i,error:r,error_description:s}=t;if(r)throw new g(r,s||r,i,n.appState);if(!n.code_verifier||n.state&&n.state!==i)throw new y("state_mismatch","Invalid state");const a=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:a}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const{connect_code:o,state:i,error:r,error_description:s}=t;if(r)throw new w(r,s||r,n.connection,i,n.appState);if(!o)throw new y("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===i))throw new y("state_mismatch","Invalid state");const a=await this.myAccountApi.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},a),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get("auth0.is.authenticated"))return;this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove("auth0.is.authenticated")}try{await this.getTokenSilently(e)}catch(e){}}async getTokenSilently(e={}){var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:te(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),i=await((e,t)=>{let n=we[t];return n||(n=e().finally((()=>{delete we[t],n=null})),we[t]=n),n})((()=>this._getTokenSilently(o)),`${this.options.clientId}::${o.authorizationParams.audience}::${o.authorizationParams.scope}`);return e.detailedResponse?i:null==i?void 0:i.access_token}async _getTokenSilently(e){const{cacheMode:t}=e,n=a(e,["cacheMode"]);if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||"default",clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=`auth0.lock.getTokenSilently.${this.options.clientId}.${n.authorizationParams.audience||"default"}`;if(!await(async(e,t=3)=>{for(let n=0;n<t;n++)if(await e())return!0;return!1})((()=>xe.acquireLock(o,5e3)),10))throw new b;this.activeLockKeys.add(o),1===this.activeLockKeys.size&&window.addEventListener("pagehide",this._releaseLockOnPageHide);try{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||"default",clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),{id_token:o,token_type:i,access_token:r,oauthTokenScope:s,expires_in:a}=e;return Object.assign(Object.assign({id_token:o,token_type:i,access_token:r},s?{scope:s}:null),{expires_in:a})}finally{await xe.releaseLock(o),this.activeLockKeys.delete(o),0===this.activeLockKeys.size&&window.removeEventListener("pagehide",this._releaseLockOnPageHide)}}async getTokenWithPopup(e={},t={}){var n,o;const i=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:te(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},p),t),await this.loginWithPopup(i,t),(await this.cacheManager.get(new ne({scope:i.authorizationParams.scope,audience:i.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},{federated:n}=t,o=a(t,["federated"]),i=n?"&federated":"";return this._url(`/v2/logout?${R(Object.assign({clientId:e.clientId},o))}`)+i}async logout(e={}){var t;const n=_e(e),{openUrl:o}=n,i=a(n,["openUrl"]);null===e.clientId?await this.cacheManager.clear():await this.cacheManager.clear(e.clientId||this.options.clientId),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove("@@user@@"),await(null===(t=this.dpop)||void 0===t?void 0:t.clear());const r=this._buildLogoutUrl(i);o?await o(r):!1!==o&&window.location.assign(r)}async _getTokenFromIFrame(e){const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const{url:o,state:i,nonce:r,code_verifier:s,redirect_uri:a,scope:c,audience:u}=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin);try{if(window.crossOriginIsolated)throw new y("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const n=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let d;try{d=new URL(this.domainUrl).origin}catch(e){d=this.domainUrl}const l=await((e,t,n=60)=>new Promise(((o,i)=>{const r=window.document.createElement("iframe");r.setAttribute("width","0"),r.setAttribute("height","0"),r.style.display="none";const s=()=>{window.document.body.contains(r)&&(window.document.body.removeChild(r),window.removeEventListener("message",a,!1))};let a;const c=setTimeout((()=>{i(new b),s()}),1e3*n);a=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?i(y.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",a,!1),setTimeout(s,2e3)},window.addEventListener("message",a,!1),window.document.body.appendChild(r),r.setAttribute("src",e)})))(o,d,n);if(i!==l.state)throw new y("state_mismatch","Invalid state");const h=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:s,code:l.code,grant_type:"authorization_code",redirect_uri:a,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:r,organization:t.organization});return Object.assign(Object.assign({},h),{scope:c,oauthTokenScope:h.scope,audience:u})}catch(e){throw"login_required"===e.error&&this.logout({openUrl:!1}),e}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new ne({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new S(e.authorizationParams.audience||"default",e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,i=((e,t,n,o)=>{var i;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),r=(null===(i=t.scope)||void 0===i?void 0:i.split(" "))||[],s=r.every((t=>e.includes(t)));return e.length>=r.length&&s?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:i});if(u.refresh_token&&this.options.useMrrt&&(null==t?void 0:t.refresh_token)&&await this.cacheManager.updateEntry(t.refresh_token,u.refresh_token),this.options.useMrrt&&!(r=null==t?void 0:t.audience,s=null==t?void 0:t.scope,a=e.authorizationParams.audience,c=e.authorizationParams.scope,r===a&&Se(c,s)||Se(i,u.scope))){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope);const t=((e,t)=>{const n=(null==e?void 0:e.split(" "))||[],o=(null==t?void 0:t.split(" "))||[];return n.filter((e=>-1==o.indexOf(e))).join(",")})(i,u.scope);throw new I(e.authorizationParams.audience||"default",t)}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||"default"})}catch(t){if((t.message.indexOf("Missing Refresh Token")>-1||t.message&&t.message.indexOf("invalid refresh token")>-1)&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw t}var r,s,a,c}async _saveEntryInCache(e){const{id_token:t,decodedToken:n}=e,o=a(e,["id_token","decodedToken"]);this.userCache.set("@@user@@",{id_token:t,decodedToken:n}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(o)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||"default",t=this.scope[e],n=await this.cacheManager.getIdToken(new ne({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get("@@user@@");return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set("@@user@@",n),n)}async _getEntryFromCache({scope:e,audience:t,clientId:n,cacheMode:o}){const i=await this.cacheManager.get(new ne({scope:e,audience:t,clientId:n}),60,this.options.useMrrt,o);if(i&&i.access_token){const{token_type:e,access_token:t,oauthTokenScope:n,expires_in:o}=i,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}async _requestToken(e,t){const{nonceIn:n,organization:o,scopesToRequest:i}=t||{},r=await Q(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop},e),{scope:i||e.scope}),this.worker),s=await this._verifyIdToken(r.id_token,n,o);return await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},r),{decodedToken:s,scope:e.scope,audience:e.audience||"default"}),r.scope?{oauthTokenScope:r.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(o||s.claims.org_id),Object.assign(Object.assign({},r),{decodedToken:s})}async exchangeToken(e){return this._requestToken({grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type,scope:te(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience})}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(e={}){return new Ce(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const{openUrl:n,appState:o,connection:i,scopes:r,authorization_params:s,redirectUri:a=this.options.authorizationParams.redirect_uri||window.location.origin}=t;if(!i)throw new Error("connection is required");const c=E(C()),u=C(),d=await z(u),l=N(d),{connect_uri:h,connect_params:p,auth_session:f}=await this.myAccountApi.connectAccount({connection:i,scopes:r,redirect_uri:a,state:c,code_challenge:l,code_challenge_method:"S256",authorization_params:s});this.transactionManager.create({state:c,code_verifier:u,auth_session:f,redirect_uri:a,appState:o,connection:i,response_type:e.ResponseType.ConnectCode});const m=new URL(h);m.searchParams.set("ticket",p.ticket),n?await n(m.toString()):window.location.assign(m)}}var ze={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},Ke=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},Ne=o(o({},ze),{buildAuthorizeUrl:Ke,buildLogoutUrl:Ke,getAccessTokenSilently:Ke,getAccessTokenWithPopup:Ke,getIdTokenClaims:Ke,exchangeToken:Ke,loginWithRedirect:Ke,loginWithPopup:Ke,connectAccountWithRedirect:Ke,logout:Ke,handleRedirectCallback:Ke,getDpopNonce:Ke,setDpopNonce:Ke,generateDpopProof:Ke,createFetcher:Ke}),Ae=t.createContext(Ne),Ue=function(e){function t(n,o){var i=e.call(this,null!=o?o:n)||this;return i.error=n,i.error_description=o,Object.setPrototypeOf(i,t.prototype),i}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),De=/[?&](?:connect_)?code=[^&]+/,Le=/[?&]state=[^&]+/,Ze=/[?&]error=[^&]+/,We=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new Ue(n.error,n.error_description)}return new Ue(t.error)}return new Error(e)}},He=We("Login failed"),Ge=We("Get access token failed"),Je=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},Xe=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},Fe=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},Me=function(e){return void 0===e&&(e=Ae),t.useContext(e)},Ve=function(){return t.createElement(t.Fragment,null)},Ye=function(){return r(void 0,void 0,void 0,(function(){return s(this,(function(e){return[2]}))}))},$e=function(){return"".concat(window.location.pathname).concat(window.location.search)};e.Auth0Context=Ae,e.Auth0Provider=function(n){var a=n.children,c=n.skipRedirectCallback,u=n.onRedirectCallback,d=void 0===u?Fe:u,l=n.context,h=void 0===l?Ae:l,p=i(n,["children","skipRedirectCallback","onRedirectCallback","context"]),f=t.useState((function(){return new Re(function(e){return Je(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.10.0"}})}(p))}))[0],m=t.useReducer(Xe,ze),y=m[0],g=m[1],w=t.useRef(!1),b=t.useCallback((function(e){return g({type:"ERROR",error:e}),e}),[]);t.useEffect((function(){w.current||(w.current=!0,r(void 0,void 0,void 0,(function(){var t,n,o,r,a,u,l;return s(this,(function(s){switch(s.label){case 0:return s.trys.push([0,7,,8]),t=void 0,void 0===h&&(h=window.location.search),!De.test(h)&&!Ze.test(h)||!Le.test(h)||c?[3,3]:[4,f.handleRedirectCallback()];case 1:return n=s.sent(),o=n.appState,r=void 0===o?{}:o,a=n.response_type,u=i(n,["appState","response_type"]),[4,f.getUser()];case 2:return t=s.sent(),r.response_type=a,a===e.ResponseType.ConnectCode&&(r.connectedAccount=u),d(r,t),[3,6];case 3:return[4,f.checkSession()];case 4:return s.sent(),[4,f.getUser()];case 5:t=s.sent(),s.label=6;case 6:return g({type:"INITIALISED",user:t}),[3,8];case 7:return l=s.sent(),b(He(l)),[3,8];case 8:return[2]}var h}))})))}),[f,d,c,b]);var v=t.useCallback((function(e){return Je(e),f.loginWithRedirect(e)}),[f]),k=t.useCallback((function(e,t){return r(void 0,void 0,void 0,(function(){var n,o;return s(this,(function(i){switch(i.label){case 0:g({type:"LOGIN_POPUP_STARTED"}),i.label=1;case 1:return i.trys.push([1,3,,4]),[4,f.loginWithPopup(e,t)];case 2:return i.sent(),[3,4];case 3:return n=i.sent(),b(He(n)),[2];case 4:return[4,f.getUser()];case 5:return o=i.sent(),g({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}}))}))}),[f,b]),_=t.useCallback((function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return r(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,i=0,r=t.length;i<r;i++)!o&&i in t||(o||(o=Array.prototype.slice.call(t,0,i)),o[i]=t[i]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,(function(e){return void 0===e&&(e={}),s(this,(function(t){switch(t.label){case 0:return[4,f.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&g({type:"LOGOUT"}),[2]}}))}))}),[f]),S=t.useCallback((function(e){return r(void 0,void 0,void 0,(function(){var t,n,o,i;return s(this,(function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,f.getTokenSilently(e)];case 1:return t=r.sent(),[3,5];case 2:throw n=r.sent(),Ge(n);case 3:return o=g,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return o.apply(void 0,[(i.user=r.sent(),i)]),[7];case 5:return[2,t]}}))}))}),[f]),I=t.useCallback((function(e,t){return r(void 0,void 0,void 0,(function(){var n,o,i,r;return s(this,(function(s){switch(s.label){case 0:return s.trys.push([0,2,3,5]),[4,f.getTokenWithPopup(e,t)];case 1:return n=s.sent(),[3,5];case 2:throw o=s.sent(),Ge(o);case 3:return i=g,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return i.apply(void 0,[(r.user=s.sent(),r)]),[7];case 5:return[2,n]}}))}))}),[f]),T=t.useCallback((function(e){return f.connectAccountWithRedirect(e)}),[f]),P=t.useCallback((function(){return f.getIdTokenClaims()}),[f]),O=t.useCallback((function(e){return r(void 0,void 0,void 0,(function(){var t,n,o,i;return s(this,(function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,f.exchangeToken(e)];case 1:return t=r.sent(),[3,5];case 2:throw n=r.sent(),Ge(n);case 3:return o=g,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return o.apply(void 0,[(i.user=r.sent(),i)]),[7];case 5:return[2,t]}}))}))}),[f]),C=t.useCallback((function(e){return r(void 0,void 0,void 0,(function(){var t,n,o;return s(this,(function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,f.handleRedirectCallback(e)];case 1:return[2,i.sent()];case 2:throw t=i.sent(),Ge(t);case 3:return n=g,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,f.getUser()];case 4:return n.apply(void 0,[(o.user=i.sent(),o)]),[7];case 5:return[2]}}))}))}),[f]),E=t.useCallback((function(e){return f.getDpopNonce(e)}),[f]),j=t.useCallback((function(e,t){return f.setDpopNonce(e,t)}),[f]),x=t.useCallback((function(e){return f.generateDpopProof(e)}),[f]),R=t.useCallback((function(e){return f.createFetcher(e)}),[f]),z=t.useMemo((function(){return o(o({},y),{getAccessTokenSilently:S,getAccessTokenWithPopup:I,getIdTokenClaims:P,exchangeToken:O,loginWithRedirect:v,loginWithPopup:k,connectAccountWithRedirect:T,logout:_,handleRedirectCallback:C,getDpopNonce:E,setDpopNonce:j,generateDpopProof:x,createFetcher:R})}),[y,S,I,P,O,v,k,T,_,C,E,j,x,R]);return t.createElement(h.Provider,{value:z},a)},e.AuthenticationError=g,e.ConnectError=w,e.GenericError=y,e.InMemoryCache=ie,e.LocalStorageCache=oe,e.MfaRequiredError=_,e.MissingRefreshTokenError=S,e.OAuthError=Ue,e.PopupCancelledError=k,e.PopupTimeoutError=v,e.TimeoutError=b,e.UseDpopNonceError=T,e.User=class{},e.initialContext=Ne,e.useAuth0=Me,e.withAuth0=function(e,n){return void 0===n&&(n=Ae),function(i){return t.createElement(n.Consumer,null,(function(n){return t.createElement(e,o({},i,{auth0:n}))}))}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(i){var a=this,c=n.returnTo,u=void 0===c?$e:c,d=n.onRedirecting,l=void 0===d?Ve:d,h=n.onBeforeAuthentication,p=void 0===h?Ye:h,f=n.loginOptions,m=n.context,y=Me(void 0===m?Ae:m),g=y.isAuthenticated,w=y.isLoading,b=y.loginWithRedirect;return t.useEffect((function(){if(!w&&!g){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});r(a,void 0,void 0,(function(){return s(this,(function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,b(e)];case 2:return t.sent(),[2]}}))}))}}),[w,g,b,p,f,u]),g?t.createElement(e,o({},i)):l()}}}));
1
+ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,(function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},o.apply(this,arguments)};function r(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function i(e,t,n,o){return new(n||(n=Promise))((function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(a,s)}c((o=o.apply(e,t||[])).next())}))}function a(e,t){var n,o,r,i={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return a.next=s(0),a.throw=s(1),a.return=s(2),"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function s(s){return function(c){return function(s){if(n)throw new TypeError("Generator is already executing.");for(;a&&(a=0,s[0]&&(i=0)),i;)try{if(n=1,o&&(r=2&s[0]?o.return:s[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,s[1])).done)return r;switch(o=0,r&&(s=[2&s[0],r.value]),s[0]){case 0:case 1:r=s;break;case 4:return i.label++,{value:s[1],done:!1};case 5:i.label++,o=s[1],s=[0];continue;case 7:s=i.ops.pop(),i.trys.pop();continue;default:if(!(r=i.trys,(r=r.length>0&&r[r.length-1])||6!==s[0]&&2!==s[0])){i=0;continue}if(3===s[0]&&(!r||s[1]>r[0]&&s[1]<r[3])){i.label=s[1];break}if(6===s[0]&&i.label<r[1]){i.label=r[1],r=s;break}if(r&&i.label<r[2]){i.label=r[2],i.ops.push(s);break}r[2]&&i.ops.pop(),i.trys.pop();continue}s=t.call(e,i)}catch(e){s=[6,e],o=0}finally{n=r=0}if(5&s[0])throw s[1];return{value:s[0]?s[1]:void 0,done:!0}}([s,c])}}}function s(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError;var c="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},u={},l={};Object.defineProperty(l,"__esModule",{value:!0});var d=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise((function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())}))},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();l.default=function(){return d.getInstance()};var h=c&&c.__awaiter||function(e,t,n,o){return new(n||(n=Promise))((function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){e.done?r(e.value):new n((function(t){t(e.value)})).then(a,s)}c((o=o.apply(e,t||[])).next())}))},p=c&&c.__generator||function(e,t){var n,o,r,i,a={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:s(0),throw:s(1),return:s(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function s(i){return function(s){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;a;)try{if(n=1,o&&(r=2&i[0]?o.return:i[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,i[1])).done)return r;switch(o=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return a.label++,{value:i[1],done:!1};case 5:a.label++,o=i[1],i=[0];continue;case 7:i=a.ops.pop(),a.trys.pop();continue;default:if(!((r=(r=a.trys).length>0&&r[r.length-1])||6!==i[0]&&2!==i[0])){a=0;continue}if(3===i[0]&&(!r||i[1]>r[0]&&i[1]<r[3])){a.label=i[1];break}if(6===i[0]&&a.label<r[1]){a.label=r[1],r=i;break}if(r&&a.label<r[2]){a.label=r[2],a.ops.push(i);break}r[2]&&a.ops.pop(),a.trys.pop();continue}i=t.call(e,a)}catch(e){i=[6,e],o=0}finally{n=r=0}if(5&i[0])throw i[1];return{value:i[0]?i[1]:void 0,done:!0}}([i,s])}}},f=c;Object.defineProperty(u,"__esModule",{value:!0});var m=l,y={key:function(e){return h(f,void 0,void 0,(function(){return p(this,(function(e){throw new Error("Unsupported")}))}))},getItem:function(e){return h(f,void 0,void 0,(function(){return p(this,(function(e){throw new Error("Unsupported")}))}))},clear:function(){return h(f,void 0,void 0,(function(){return p(this,(function(e){return[2,window.localStorage.clear()]}))}))},removeItem:function(e){return h(f,void 0,void 0,(function(){return p(this,(function(e){throw new Error("Unsupported")}))}))},setItem:function(e,t){return h(f,void 0,void 0,(function(){return p(this,(function(e){throw new Error("Unsupported")}))}))},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function w(e){return new Promise((function(t){return setTimeout(t,e)}))}function g(e){for(var t="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz",n="",o=0;o<e;o++)n+=t[Math.floor(61*Math.random())];return n}var v=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+g(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),h(this,void 0,void 0,(function(){var o,r,i,a,s,c,u;return p(this,(function(l){switch(l.label){case 0:o=Date.now()+g(4),r=Date.now()+n,i="browser-tabs-lock-key-"+t,a=void 0===this.storageHandler?y:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,w(30)]:[3,8];case 2:return l.sent(),null!==a.getItemSync(i)?[3,5]:(s=this.id+"-"+t+"-"+o,[4,w(Math.floor(25*Math.random()))]);case 3:return l.sent(),a.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:s,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,w(30)];case 4:return l.sent(),null!==(c=a.getItemSync(i))&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?y:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+g(4),[3,1];case 8:return[2,!1]}}))}))},e.prototype.refreshLockWhileAcquired=function(e,t){return h(this,void 0,void 0,(function(){var n=this;return p(this,(function(o){return setTimeout((function(){return h(n,void 0,void 0,(function(){var n,o,r;return p(this,(function(i){switch(i.label){case 0:return[4,m.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?y:this.storageHandler,null===(o=n.getItemSync(e))?(m.default().unlock(t),[2]):((r=JSON.parse(o)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),m.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(m.default().unlock(t),[2])}}))}))}),1e3),[2]}))}))},e.prototype.waitForSomethingToChange=function(t){return h(this,void 0,void 0,(function(){return p(this,(function(n){switch(n.label){case 0:return[4,new Promise((function(n){var o=!1,r=Date.now(),i=!1;function a(){if(i||(window.removeEventListener("storage",a),e.removeFromWaiting(a),clearTimeout(s),i=!0),!o){o=!0;var t=50-(Date.now()-r);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",a),e.addToWaiting(a);var s=setTimeout(a,Math.max(0,t-Date.now()))}))];case 1:return n.sent(),[2]}}))}))},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter((function(e){return e!==t})))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach((function(e){return e()}))},e.prototype.releaseLock=function(e){return h(this,void 0,void 0,(function(){return p(this,(function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}}))}))},e.prototype.releaseLock__private__=function(t){return h(this,void 0,void 0,(function(){var n,o,r,i;return p(this,(function(a){switch(a.label){case 0:return n=void 0===this.storageHandler?y:this.storageHandler,o="browser-tabs-lock-key-"+t,null===(r=n.getItemSync(o))?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,m.default().lock(i.iat)];case 1:a.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),m.default().unlock(i.iat),e.notifyWaiters(),a.label=2;case 2:return[2]}}))}))},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,r=[],i=0;;){var a=o.keySync(i);if(null===a)break;r.push(a),i++}for(var s=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes("browser-tabs-lock-key")){var l=o.getItemSync(u);if(null!==l){var d=JSON.parse(l);(void 0===d.timeRefreshed&&d.timeAcquired<n||void 0!==d.timeRefreshed&&d.timeRefreshed<n)&&(o.removeItemSync(u),s=!0)}}}s&&e.notifyWaiters()},e.waiters=void 0,e}(),b=u.default=v;const _={timeoutInSeconds:60},k={name:"auth0-spa-js",version:"2.12.0"},S=()=>Date.now();class E extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,E.prototype)}static fromPayload(e){let{error:t,error_description:n}=e;return new E(t,n)}}class T extends E{constructor(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,T.prototype)}}class A extends E{constructor(e,t,n,o){let r=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=r,Object.setPrototypeOf(this,A.prototype)}}class P extends E{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,P.prototype)}}class R extends P{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,R.prototype)}}class I extends E{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,I.prototype)}}class O extends E{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,O.prototype)}}class C extends E{constructor(e,t,n){super(e,t),this.mfa_token=n,Object.setPrototypeOf(this,C.prototype)}}class x extends E{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(L(e,["default"]),"', scope: '").concat(L(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,x.prototype)}}class j extends E{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(L(e,["default"]),"', missing scope: '").concat(L(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,j.prototype)}}class D extends E{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,D.prototype)}}function L(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}const U=()=>window.crypto,K=()=>{const e="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~.";let t="";return Array.from(U().getRandomValues(new Uint8Array(43))).forEach((n=>t+=e[n%66])),t},N=e=>btoa(e),W=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],z=e=>Object.keys(e).reduce(((t,n)=>{const o=W.find((e=>e.key===n));return o&&o.type.includes(typeof e[n])&&(t[n]=e[n]),t}),{}),H=e=>{var{clientId:t}=e,n=s(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter((t=>void 0!==e[t])).reduce(((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]})),{}))(Object.assign({client_id:t},n))).toString()},J=async e=>{const t=U().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},M=e=>(e=>decodeURIComponent(atob(e).split("").map((e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2))).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),V=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,(e=>t[e]))})(window.btoa(String.fromCharCode(...Array.from(t))))},G=new TextEncoder,F=new TextDecoder;function Z(e){return"string"==typeof e?G.encode(e):F.decode(e)}function q(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new Q(`${e.name} modulusLength must be at least 2048 bits`)}let B;if(Uint8Array.prototype.toBase64)B=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;B=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function X(e){return B(e)}class Y extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class Q extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function $(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new Y("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new Y("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new Y("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new Y("unsupported CryptoKey algorithm name")}}function ee(e){return e instanceof CryptoKey}function te(e){return ee(e)&&"public"===e.type}async function ne(e,t,n,o,r,i){const a=null==e?void 0:e.privateKey,s=null==e?void 0:e.publicKey;if(!ee(c=a)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!te(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==s.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==r&&"string"!=typeof r)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==i&&("object"!=typeof i||null===i||Array.isArray(i)))throw new TypeError('"additional" must be an object');return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${X(Z(JSON.stringify(e)))}.${X(Z(JSON.stringify(t)))}`;return`${o}.${X(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return q(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return q(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new Y}(n),n,Z(o)))}`}({alg:$(a),typ:"dpop+jwt",jwk:await oe(s)},Object.assign(Object.assign({},i),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:r?X(await crypto.subtle.digest("SHA-256",Z(r))):void 0}),a)}async function oe(e){const{kty:t,e:n,n:o,x:r,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:a,e:n,n:o,x:r,y:i}}const re=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange"];const ie=async(e,t)=>{const n=await fetch(e,t);return{ok:n.ok,json:await n.json(),headers:(o=n.headers,[...o].reduce(((e,t)=>{let[n,o]=t;return e[n]=o,e}),{}))};var o},ae=async function(e,t,n,o,r,i){let a=arguments.length>6&&void 0!==arguments[6]?arguments[6]:1e4;return r?(async(e,t,n,o,r,i,a,s)=>((e,t)=>new Promise((function(n,o){const r=new MessageChannel;r.port1.onmessage=function(e){e.data.error?o(new Error(e.data.error)):n(e.data),r.port1.close()},t.postMessage(e,[r.port2])})))({auth:{audience:t,scope:n},timeout:r,fetchUrl:e,fetchOptions:o,useFormData:a,useMrrt:s},i))(e,t,n,o,a,r,i,arguments.length>7?arguments[7]:void 0):(async(e,t,n)=>{const o=new AbortController;let r;return t.signal=o.signal,Promise.race([ie(e,t),new Promise(((e,t)=>{r=setTimeout((()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))}),n)}))]).finally((()=>{clearTimeout(r)}))})(e,o,a)};async function se(e,t,n,o,r,i,a,c,u,l){if(u){const t=await u.generateProof({url:e,method:r.method||"GET",nonce:await u.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:t})}let d,h=null;for(let s=0;s<3;s++)try{d=await ae(e,n,o,r,i,a,t,c),h=null;break}catch(e){h=e}if(h)throw h;const p=d.json,{error:f,error_description:m}=p,y=s(p,["error","error_description"]),{headers:w,ok:g}=d;let v;if(u&&(v=w["dpop-nonce"],v&&await u.setNonce(v)),!g){const s=m||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===f)throw new C(f,s,y.mfa_token);if("missing_refresh_token"===f)throw new x(n,o);if("use_dpop_nonce"===f){if(!u||!v||l)throw new D(v);return se(e,t,n,o,r,i,a,c,u,!0)}throw new E(f||"request_error",s)}return y}async function ce(e,t){var{baseUrl:n,timeout:o,audience:r,scope:i,auth0Client:a,useFormData:c,useMrrt:u,dpop:l}=e,d=s(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop"]);const h="urn:ietf:params:oauth:grant-type:token-exchange"===d.grant_type,p="refresh_token"===d.grant_type&&u,f=Object.assign(Object.assign(Object.assign(Object.assign({},d),h&&r&&{audience:r}),h&&i&&{scope:i}),p&&{audience:r,scope:i}),m=c?H(f):JSON.stringify(f),y=(w=d.grant_type,re.includes(w));var w;return await se("".concat(n,"/oauth/token"),o,r||"default",i,{method:"POST",body:m,headers:{"Content-Type":c?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(z(a||k)))}},t,c,u,y?l:void 0)}const ue=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return(e=>Array.from(new Set(e)))(t.filter(Boolean).join(" ").trim().split(/\s+/)).join(" ")},le=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e.default),ue(o,t)};class de{constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"@@auth0spajs@@",n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const[t,n,o,r]=e.split("::");return new de({clientId:n,scope:r,audience:o},t)}static fromCacheEntry(e){const{scope:t,audience:n,client_id:o}=e;return new de({scope:t,audience:n,clientId:o})}}class he{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter((e=>e.startsWith("@@auth0spajs@@")))}}class pe{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class fe{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||S}async setIdToken(e,t,n){var o;const r=this.getIdTokenCacheKey(e);await this.cache.set(r,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(r))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var r;let i=await this.cache.get(e.toKey());if(!i){const t=await this.getCacheKeys();if(!t)return;const r=this.matchExistingCacheKey(e,t);if(r&&(i=await this.cache.get(r)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;const a=await this.nowProvider(),s=Math.floor(a/1e3);return i.expiresAt-t<s?i.body.refresh_token?this.modifiedCachedEntry(i,e):(await this.cache.remove(e.toKey()),void await(null===(r=this.keyManifest)||void 0===r?void 0:r.remove(e.toKey()))):i.body}async modifiedCachedEntry(e,t){return e.body={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},await this.cache.set(t.toKey(),e),{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}async set(e){var t;const n=new de({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new de({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter((t=>!e||t.includes(e))).reduce((async(e,t)=>{await e,await this.cache.remove(t)}),Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new de({clientId:e},"@@auth0spajs@@","@@user@@").toKey()}matchExistingCacheKey(e,t){return t.filter((t=>{var n;const o=de.fromKey(t),r=new Set(o.scope&&o.scope.split(" ")),i=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],a=o.scope&&i.reduce(((e,t)=>e&&r.has(t)),!0);return"@@auth0spajs@@"===o.prefix&&o.clientId===e.clientId&&o.audience===e.audience&&a}))[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=de.fromKey(o);if("@@auth0spajs@@"===t.prefix&&t.clientId===e.clientId){const t=await this.cache.get(o);if(null===(n=null==t?void 0:t.body)||void 0===n?void 0:n.refresh_token)return this.modifiedCachedEntry(t,e)}}}async updateEntry(e,t){var n;const o=await this.getCacheKeys();if(o)for(const r of o){const o=await this.cache.get(r);if((null===(n=null==o?void 0:o.body)||void 0===n?void 0:n.refresh_token)===e){const e=Object.assign(Object.assign({},o.body),{refresh_token:t});await this.set(e)}}}}class me{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const ye=e=>"number"==typeof e,we=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var ge=c&&c.__assign||function(){return ge=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},ge.apply(this,arguments)};function ve(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}var be=function(e){return function(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),a=i.slice(1).join("=");'"'===a.charAt(0)&&(a=a.slice(1,-1));try{t[i[0].replace(o,decodeURIComponent)]=a.replace(o,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e]};function _e(e,t,n){document.cookie=function(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return ve("Expires",e.expires?e.expires.toUTCString():"")+ve("Domain",e.domain)+ve("Path",e.path)+ve("Secure",e.secure)+ve("SameSite",e.sameSite)}(n)}(e,t,ge({path:"/"},n))}var ke=_e,Se=function(e,t){_e(e,"",ge(ge({},t),{expires:-1}))};const Ee={get(e){const t=be(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),ke(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),Se(e,n)}},Te={get:e=>Ee.get(e)||Ee.get("".concat("_legacy_").concat(e)),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),ke("".concat("_legacy_").concat(e),JSON.stringify(t),o),Ee.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),Se(e,n),Ee.remove(e,t),Ee.remove("".concat("_legacy_").concat(e),t)}},Ae={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var Pe,Re=function(e){return Pe=Pe||function(e,t,n){var o=void 0===t?null:t,r=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),r=0,i=n.length;r<i;++r)o[r]=n.charCodeAt(r);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),i=r.indexOf("\n",10)+1,a=r.substring(i)+(o?"//# sourceMappingURL="+o:""),s=new Blob([a],{type:"application/javascript"});return URL.createObjectURL(s)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7Y2xhc3MgZSBleHRlbmRzIEVycm9ye2NvbnN0cnVjdG9yKHQscil7c3VwZXIociksdGhpcy5lcnJvcj10LHRoaXMuZXJyb3JfZGVzY3JpcHRpb249cixPYmplY3Quc2V0UHJvdG90eXBlT2YodGhpcyxlLnByb3RvdHlwZSl9c3RhdGljIGZyb21QYXlsb2FkKHQpe2xldHtlcnJvcjpyLGVycm9yX2Rlc2NyaXB0aW9uOnN9PXQ7cmV0dXJuIG5ldyBlKHIscyl9fWNsYXNzIHQgZXh0ZW5kcyBle2NvbnN0cnVjdG9yKGUscyl7c3VwZXIoIm1pc3NpbmdfcmVmcmVzaF90b2tlbiIsIk1pc3NpbmcgUmVmcmVzaCBUb2tlbiAoYXVkaWVuY2U6ICciLmNvbmNhdChyKGUsWyJkZWZhdWx0Il0pLCInLCBzY29wZTogJyIpLmNvbmNhdChyKHMpLCInKSIpKSx0aGlzLmF1ZGllbmNlPWUsdGhpcy5zY29wZT1zLE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLHQucHJvdG90eXBlKX19ZnVuY3Rpb24gcihlKXtsZXQgdD1hcmd1bWVudHMubGVuZ3RoPjEmJnZvaWQgMCE9PWFyZ3VtZW50c1sxXT9hcmd1bWVudHNbMV06W107cmV0dXJuIGUmJiF0LmluY2x1ZGVzKGUpP2U6IiJ9ImZ1bmN0aW9uIj09dHlwZW9mIFN1cHByZXNzZWRFcnJvciYmU3VwcHJlc3NlZEVycm9yO2NvbnN0IHM9ZT0+e3ZhcntjbGllbnRJZDp0fT1lLHI9ZnVuY3Rpb24oZSx0KXt2YXIgcj17fTtmb3IodmFyIHMgaW4gZSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoZSxzKSYmdC5pbmRleE9mKHMpPDAmJihyW3NdPWVbc10pO2lmKG51bGwhPWUmJiJmdW5jdGlvbiI9PXR5cGVvZiBPYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKXt2YXIgbz0wO2ZvcihzPU9iamVjdC5nZXRPd25Qcm9wZXJ0eVN5bWJvbHMoZSk7bzxzLmxlbmd0aDtvKyspdC5pbmRleE9mKHNbb10pPDAmJk9iamVjdC5wcm90b3R5cGUucHJvcGVydHlJc0VudW1lcmFibGUuY2FsbChlLHNbb10pJiYocltzW29dXT1lW3Nbb11dKX1yZXR1cm4gcn0oZSxbImNsaWVudElkIl0pO3JldHVybiBuZXcgVVJMU2VhcmNoUGFyYW1zKChlPT5PYmplY3Qua2V5cyhlKS5maWx0ZXIoKHQ9PnZvaWQgMCE9PWVbdF0pKS5yZWR1Y2UoKCh0LHIpPT5PYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sdCkse1tyXTplW3JdfSkpLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IG89e307Y29uc3Qgbj0oZSx0KT0+IiIuY29uY2F0KGUsInwiKS5jb25jYXQodCk7YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsKGFzeW5jIGU9PntsZXQgcixjLHtkYXRhOnt0aW1lb3V0OmksYXV0aDphLGZldGNoVXJsOmYsZmV0Y2hPcHRpb25zOmwsdXNlRm9ybURhdGE6cCx1c2VNcnJ0Omh9LHBvcnRzOlt1XX09ZSxkPXt9O2NvbnN0e2F1ZGllbmNlOmcsc2NvcGU6eX09YXx8e307dHJ5e2NvbnN0IGU9cD8oZT0+e2NvbnN0IHQ9bmV3IFVSTFNlYXJjaFBhcmFtcyhlKSxyPXt9O3JldHVybiB0LmZvckVhY2goKChlLHQpPT57clt0XT1lfSkpLHJ9KShsLmJvZHkpOkpTT04ucGFyc2UobC5ib2R5KTtpZighZS5yZWZyZXNoX3Rva2VuJiYicmVmcmVzaF90b2tlbiI9PT1lLmdyYW50X3R5cGUpe2lmKGM9KChlLHQpPT5vW24oZSx0KV0pKGcseSksIWMmJmgpe2NvbnN0IGU9by5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+e2NvbnN0IHI9T2JqZWN0LmtleXMobykuZmluZCgocj0+e2lmKCJsYXRlc3RfcmVmcmVzaF90b2tlbiIhPT1yKXtjb25zdCBzPSgoZSx0KT0+dC5zdGFydHNXaXRoKCIiLmNvbmNhdChlLCJ8IikpKSh0LHIpLG89ci5zcGxpdCgifCIpWzFdLnNwbGl0KCIgIiksbj1lLnNwbGl0KCIgIikuZXZlcnkoKGU9Pm8uaW5jbHVkZXMoZSkpKTtyZXR1cm4gcyYmbn19KSk7cmV0dXJuISFyfSkoeSxnKTtlJiYhdCYmKGM9ZSl9aWYoIWMpdGhyb3cgbmV3IHQoZyx5KTtsLmJvZHk9cD9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpjfSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpjfSkpfWxldCBhLGs7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGE9bmV3IEFib3J0Q29udHJvbGxlcixsLnNpZ25hbD1hLnNpZ25hbCk7dHJ5e2s9YXdhaXQgUHJvbWlzZS5yYWNlKFsoaj1pLG5ldyBQcm9taXNlKChlPT5zZXRUaW1lb3V0KGUsaikpKSksZmV0Y2goZixPYmplY3QuYXNzaWduKHt9LGwpKV0pfWNhdGNoKGUpe3JldHVybiB2b2lkIHUucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZX0pfWlmKCFrKXJldHVybiBhJiZhLmFib3J0KCksdm9pZCB1LnBvc3RNZXNzYWdlKHtlcnJvcjoiVGltZW91dCB3aGVuIGV4ZWN1dGluZyAnZmV0Y2gnIn0pO189ay5oZWFkZXJzLGQ9Wy4uLl9dLnJlZHVjZSgoKGUsdCk9PntsZXRbcixzXT10O3JldHVybiBlW3JdPXMsZX0pLHt9KSxyPWF3YWl0IGsuanNvbigpLHIucmVmcmVzaF90b2tlbj8oaCYmKG8ubGF0ZXN0X3JlZnJlc2hfdG9rZW49ci5yZWZyZXNoX3Rva2VuLE89YyxiPXIucmVmcmVzaF90b2tlbixPYmplY3QuZW50cmllcyhvKS5mb3JFYWNoKChlPT57bGV0W3Qscl09ZTtyPT09TyYmKG9bdF09Yil9KSkpLCgoZSx0LHIpPT57b1tuKHQscildPWV9KShyLnJlZnJlc2hfdG9rZW4sZyx5KSxkZWxldGUgci5yZWZyZXNoX3Rva2VuKTooKGUsdCk9PntkZWxldGUgb1tuKGUsdCldfSkoZyx5KSx1LnBvc3RNZXNzYWdlKHtvazprLm9rLGpzb246cixoZWFkZXJzOmR9KX1jYXRjaChlKXt1LnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjplLmVycm9yLGVycm9yX2Rlc2NyaXB0aW9uOmUubWVzc2FnZX0saGVhZGVyczpkfSl9dmFyIE8sYixfLGp9KSl9KCk7Cgo=",null,false),new Worker(Pe,e)};const Ie={},Oe=async function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:3;for(let n=0;n<t;n++)if(await e())return!0;return!1};class Ce{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat("@@auth0spajs@@","::").concat(e)}}const xe={memory:()=>(new pe).enclosedCache,localstorage:()=>new he},je=e=>xe[e],De=e=>{const{openUrl:t,onRedirect:n}=e,o=s(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},Le=(e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every((e=>n.includes(e)))},Ue={NONCE:"nonce",KEYPAIR:"keypair"};class Ke{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise(((t,n)=>{e.onupgradeneeded=()=>Object.values(Ue).forEach((t=>e.result.createObjectStore(t))),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)}))}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise(((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)}))}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(Ue.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(Ue.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",(e=>e.put(n,t)))}findNonce(e){return this.find(Ue.NONCE,this.buildKey(e))}findKeyPair(){return this.find(Ue.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",(e=>e.get(t)))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",(e=>e.getAllKeys()));null==n||n.filter(t).map((t=>this.executeDbRequest(e,"readwrite",(e=>e.delete(t)))))}deleteByClientId(e,t){return this.deleteBy(e,(e=>"string"==typeof e&&e.startsWith("".concat(t,"::"))))}clearNonces(){return this.deleteByClientId(Ue.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(Ue.KEYPAIR,this.clientId)}}class Ne{constructor(e){this.storage=new Ke(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function(e){let{keyPair:t,url:n,method:o,nonce:r,accessToken:i}=e;const a=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(n);return ne(t,a,o,r,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!te(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await oe(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new Y("unsupported JWK kty")}return X(await crypto.subtle.digest({name:"SHA-256"},Z(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var We,ze,He;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(We||(We={}));class Je{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:We.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);let o,r;"string"==typeof n?(o=this.config.dpopNonceId?We.DPoP:We.Bearer,r=n):(o=n.token_type,r=n.access_token),this.setAuthorizationHeader(e,r,o),o===We.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,"dpop-nonce");if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new D(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const r=this.buildBaseRequest(e,t);await this.prepareRequest(r,o);const i=await this.config.fetch(r);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class Me{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(t)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new Ve({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new Ve(t)}}class Ve extends Error{constructor(e){let{type:t,status:n,title:o,detail:r,validation_errors:i}=e;super(r),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=r,this.validation_errors=i,Object.setPrototypeOf(this,Ve.prototype)}}function Ge(e,t){this.v=e,this.k=t}function Fe(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function Ze(e){return new Ge(e,0)}function qe(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function Be(e,t){return e.get(Fe(e,t))}function Xe(e,t,n){qe(e,t),t.set(e,n)}function Ye(e,t,n){return e.set(Fe(e,t),n),n}function Qe(e,t,n){return(t=function(e){var t=function(e){if("object"!=typeof e||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function $e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,o)}return n}function et(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?$e(Object(n),!0).forEach((function(t){Qe(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):$e(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function tt(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n={};for(var o in e)if({}.hasOwnProperty.call(e,o)){if(-1!==t.indexOf(o))continue;n[o]=e[o]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],-1===t.indexOf(n)&&{}.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}function nt(e){var t,n;function o(t,n){try{var i=e[t](n),a=i.value,s=a instanceof Ge;Promise.resolve(s?a.v:a).then((function(n){if(s){var c="return"===t?"return":"next";if(!a.k||n.done)return o(c,n);n=e[c](n).value}r(i.done?"return":"normal",n)}),(function(e){o("throw",e)}))}catch(e){r("throw",e)}}function r(e,r){switch(e){case"return":t.resolve({value:r,done:!0});break;case"throw":t.reject(r);break;default:t.resolve({value:r,done:!1})}(t=t.next)?o(t.key,t.arg):n=null}this._invoke=function(e,r){return new Promise((function(i,a){var s={key:e,arg:r,resolve:i,reject:a,next:null};n?n=n.next=s:(t=n=s,o(e,r))}))},"function"!=typeof e.return&&(this.return=void 0)}let ot;if(nt.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},nt.prototype.next=function(e){return this._invoke("next",e)},nt.prototype.throw=function(e){return this._invoke("throw",e)},nt.prototype.return=function(e){return this._invoke("return",e)},"undefined"==typeof navigator||null===(ze=navigator.userAgent)||void 0===ze||null===(He=ze.startsWith)||void 0===He||!He.call(ze,"Mozilla/5.0 ")){const e="v3.8.3";ot="".concat("oauth4webapi","/").concat(e)}function rt(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}function it(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}const at=Symbol(),st=Symbol(),ct=Symbol(),ut=Symbol(),lt=Symbol(),dt=Symbol(),ht=new TextEncoder,pt=new TextDecoder;function ft(e){return"string"==typeof e?ht.encode(e):pt.decode(e)}let mt,yt;if(Uint8Array.prototype.toBase64)mt=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;mt=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function wt(e){return"string"==typeof e?yt(e):mt(e)}yt=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw it("The input to be decoded is not correctly encoded.","ERR_INVALID_ARG_VALUE",e)}}:e=>{try{const t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw it("The input to be decoded is not correctly encoded.","ERR_INVALID_ARG_VALUE",e)}};class gt extends Error{constructor(e,t){var n;super(e,t),Qe(this,"code",void 0),this.name=this.constructor.name,this.code=fn,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class vt extends Error{constructor(e,t){var n;super(e,t),Qe(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function bt(e,t,n){return new vt(e,{code:t,cause:n})}function _t(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function kt(e){rt(e,Headers)&&(e=Object.fromEntries(e.entries()));const t=new Headers(null!=e?e:{});if(ot&&!t.has("user-agent")&&t.set("user-agent",ot),t.has("authorization"))throw it('"options.headers" must not include the "authorization" header name',"ERR_INVALID_ARG_VALUE");return t}function St(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw it('"options.signal" must return or be an instance of AbortSignal',"ERR_INVALID_ARG_TYPE");return t}}function Et(e){return e.includes("//")?e.replace("//","/"):e}function Tt(e,t,n,o,r){try{if("number"!=typeof e||!Number.isFinite(e))throw it("".concat(n," must be a number"),"ERR_INVALID_ARG_TYPE",r);if(e>0)return;if(t){if(0!==e)throw it("".concat(n," must be a non-negative number"),"ERR_INVALID_ARG_VALUE",r);return}throw it("".concat(n," must be a positive number"),"ERR_INVALID_ARG_VALUE",r)}catch(e){if(o)throw bt(e.message,o,r);throw e}}function At(e,t,n,o){try{if("string"!=typeof e)throw it("".concat(t," must be a string"),"ERR_INVALID_ARG_TYPE",o);if(0===e.length)throw it("".concat(t," must not be empty"),"ERR_INVALID_ARG_VALUE",o)}catch(e){if(n)throw bt(e.message,n,o);throw e}}function Pt(e){!function(e,t){if(Xt(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];if(o.length>2){const e=o.pop();t+="".concat(o.join(", "),", or ").concat(e)}else 2===o.length?t+="".concat(o[0]," or ").concat(o[1]):t+=o[0];return bt(t,gn,e)}(e,t)}(e,"application/json")}function Rt(){return wt(crypto.getRandomValues(new Uint8Array(32)))}function It(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new gt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"RSASSA-PKCS1-v1_5":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new gt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"ECDSA":return function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new gt("unsupported EcKeyAlgorithm namedCurve",{cause:e})}}(e);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new gt("unsupported CryptoKey algorithm name",{cause:e})}}function Ot(e){const t=null==e?void 0:e[st];return"number"==typeof t&&Number.isFinite(t)?t:0}function Ct(e){const t=null==e?void 0:e[ct];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function xt(){return Math.floor(Date.now()/1e3)}function jt(e){if("object"!=typeof e||null===e)throw it('"as" must be an object',"ERR_INVALID_ARG_TYPE");At(e.issuer,'"as.issuer"')}function Dt(e){if("object"!=typeof e||null===e)throw it('"client" must be an object',"ERR_INVALID_ARG_TYPE");At(e.client_id,'"client.client_id"')}function Lt(e){return At(e,'"clientSecret"'),(t,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",e)}}function Ut(e,t){const{key:n,kid:o}=(r=e)instanceof CryptoKey?{key:r}:(null==r?void 0:r.key)instanceof CryptoKey?(void 0!==r.kid&&At(r.kid,'"kid"'),{key:r.key,kid:r.kid}):{};var r;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw it("".concat(t," must be a CryptoKey"),"ERR_INVALID_ARG_TYPE")}(e,t),"private"!==e.type)throw it("".concat(t," must be a private CryptoKey"),"ERR_INVALID_ARG_VALUE")}(n,'"clientPrivateKey.key"'),async(e,r,i,a)=>{var s;const c={alg:It(n),kid:o},u=function(e,t){const n=xt()+Ot(t);return{jti:Rt(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,r);null==t||null===(s=t[lt])||void 0===s||s.call(t,c,u),i.set("client_id",r.client_id),i.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),i.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw it('CryptoKey instances used for signing assertions must include "sign" in their "usages"',"ERR_INVALID_ARG_VALUE");const o="".concat(wt(ft(JSON.stringify(e))),".").concat(wt(ft(JSON.stringify(t)))),r=wt(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:In(e)};case"RSA-PSS":switch(Rn(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new gt("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return Rn(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new gt("unsupported CryptoKey algorithm name",{cause:e})}(n),n,ft(o)));return"".concat(o,".").concat(r)}(c,u,n))}}const Kt=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function Nt(e,t){if(t&&"https:"!==e.protocol)throw bt("only requests to HTTPS are allowed",bn,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw bt("only HTTP and HTTPS requests are allowed",_n,e)}function Wt(e,t,n,o){let r;if("string"!=typeof e||!(r=Kt(e)))throw bt("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?Tn:An,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return Nt(r,o),r}function zt(e,t,n,o){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?Wt(e.mtls_endpoint_aliases[t],t,n,o):Wt(e[t],t,n,o)}class Ht extends Error{constructor(e,t){var n;super(e,t),Qe(this,"cause",void 0),Qe(this,"code",void 0),Qe(this,"error",void 0),Qe(this,"status",void 0),Qe(this,"error_description",void 0),Qe(this,"response",void 0),this.name=this.constructor.name,this.code=pn,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class Jt extends Error{constructor(e,t){var n,o;super(e,t),Qe(this,"cause",void 0),Qe(this,"code",void 0),Qe(this,"error",void 0),Qe(this,"error_description",void 0),this.name=this.constructor.name,this.code=mn,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!==(n=t.cause.get("error_description"))&&void 0!==n?n:void 0,null===(o=Error.captureStackTrace)||void 0===o||o.call(Error,this,this.constructor)}}class Mt extends Error{constructor(e,t){var n;super(e,t),Qe(this,"cause",void 0),Qe(this,"code",void 0),Qe(this,"response",void 0),Qe(this,"status",void 0),this.name=this.constructor.name,this.code=hn,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}const Vt=new RegExp("^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)"),Gt=new RegExp('^[,\\s]*([a-zA-Z0-9!#$%&\\\'\\*\\+\\-\\.\\^_`\\|~]+)\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"[,\\s]*(.*)'),Ft=new RegExp("^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)[,\\s]*(.*)"),Zt=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function qt(e,t,n){if(e.status!==t){let t;var o;if(function(e){let t;if(t=function(e){if(!rt(e,Response))throw it('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");const t=e.headers.get("www-authenticate");if(null===t)return;const n=[];let o=t;for(;o;){var r;let t=o.match(Vt);const i=null===(r=t)||void 0===r?void 0:r[1].toLowerCase();if(!i)return;const a=o.substring(t[0].length);if(a&&!a.match(/^[\s,]/))return;const s=a.match(/^\s+(.*)$/),c=!!s;o=s?s[1]:void 0;const u={};let l;if(c)for(;o;){let n,r;if(t=o.match(Gt)){if([,n,r,o]=t,r.includes("\\"))try{r=JSON.parse('"'.concat(r,'"'))}catch(e){}u[n.toLowerCase()]=r}else{if(!(t=o.match(Ft))){if(t=o.match(Zt)){if(Object.keys(u).length)break;[,l,o]=t;break}return}[,n,r,o]=t,u[n.toLowerCase()]=r}}else o=a||void 0;const d={scheme:i,parameters:u};l&&(d.token68=l),n.push(d)}return n.length?n:void 0}(e))throw new Mt("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}(e),t=await async function(e){if(e.status>399&&e.status<500){Pn(e),Pt(e);try{const t=await e.clone().json();if(_t(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await(null===(o=e.body)||void 0===o?void 0:o.cancel()),new Ht("server responded with an error in the response body",{cause:t,response:e});throw bt('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),vn,e)}}function Bt(e){if(!an.has(e))throw it('"options.DPoP" is not a valid DPoPHandle',"ERR_INVALID_ARG_VALUE")}function Xt(e){var t;return null===(t=e.headers.get("content-type"))||void 0===t?void 0:t.split(";")[0]}async function Yt(e,t,n,o,r,i,a){return await n(e,t,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==a?void 0:a[ut])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:St(o,null==a?void 0:a.signal)})}async function Qt(e,t,n,o,r,i){var a;const s=zt(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[at]));r.set("grant_type",o);const c=kt(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(Bt(i.DPoP),await i.DPoP.addProof(s,c,"POST"));const u=await Yt(e,t,n,s,r,c,i);return null==i||null===(a=i.DPoP)||void 0===a||a.cacheNonce(u,s),u}const $t=new WeakMap,en=new WeakMap;function tn(e){if(!e.id_token)return;const t=$t.get(e);if(!t)throw it('"ref" was already garbage collected or did not resolve from the proper sources',"ERR_INVALID_ARG_VALUE");return t}async function nn(e,t,n,o,r,i){if(jt(e),Dt(t),!rt(n,Response))throw it('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await qt(n,200,"Token Endpoint"),Pn(n);const a=await Dn(n);if(At(a.access_token,'"response" body "access_token" property',wn,{body:a}),At(a.token_type,'"response" body "token_type" property',wn,{body:a}),a.token_type=a.token_type.toLowerCase(),void 0!==a.expires_in){let e="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;Tt(e,!0,'"response" body "expires_in" property',wn,{body:a}),a.expires_in=e}if(void 0!==a.refresh_token&&At(a.refresh_token,'"response" body "refresh_token" property',wn,{body:a}),void 0!==a.scope&&"string"!=typeof a.scope)throw bt('"response" body "scope" property must be a string',wn,{body:a});if(void 0!==a.id_token){At(a.id_token,'"response" body "id_token" property',wn,{body:a});const i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(Tt(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=o&&o.length&&i.push(...o);const{claims:s,jwt:c}=await async function(e,t,n,o,r){let i,a,{0:s,1:c,length:u}=e.split(".");if(5===u){if(void 0===r)throw new gt("JWE decryption is not configured",{cause:e});e=await r(e),({0:s,1:c,length:u}=e.split("."))}if(3!==u)throw bt("Invalid JWT",wn,e);try{i=JSON.parse(ft(wt(s)))}catch(e){throw bt("failed to parse JWT Header body as base64url encoded JSON",yn,e)}if(!_t(i))throw bt("JWT Header must be a top level object",wn,e);if(t(i),void 0!==i.crit)throw new gt('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{a=JSON.parse(ft(wt(c)))}catch(e){throw bt("failed to parse JWT Payload body as base64url encoded JSON",yn,e)}if(!_t(a))throw bt("JWT Payload must be a top level object",wn,e);const l=xt()+n;if(void 0!==a.exp){if("number"!=typeof a.exp)throw bt('unexpected JWT "exp" (expiration time) claim type',wn,{claims:a});if(a.exp<=l-o)throw bt('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',kn,{claims:a,now:l,tolerance:o,claim:"exp"})}if(void 0!==a.iat&&"number"!=typeof a.iat)throw bt('unexpected JWT "iat" (issued at) claim type',wn,{claims:a});if(void 0!==a.iss&&"string"!=typeof a.iss)throw bt('unexpected JWT "iss" (issuer) claim type',wn,{claims:a});if(void 0!==a.nbf){if("number"!=typeof a.nbf)throw bt('unexpected JWT "nbf" (not before) claim type',wn,{claims:a});if(a.nbf>l+o)throw bt('unexpected JWT "nbf" (not before) claim value',kn,{claims:a,now:l,tolerance:o,claim:"nbf"})}if(void 0!==a.aud&&"string"!=typeof a.aud&&!Array.isArray(a.aud))throw bt('unexpected JWT "aud" (audience) claim type',wn,{claims:a});return{header:i,claims:a,jwt:e}}(a.id_token,On.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),Ot(t),Ct(t),r).then(un.bind(void 0,i)).then(rn.bind(void 0,e)).then(on.bind(void 0,t.client_id));if(Array.isArray(s.aud)&&1!==s.aud.length){if(void 0===s.azp)throw bt('ID Token "aud" (audience) claim includes additional untrusted audiences',Sn,{claims:s,claim:"aud"});if(s.azp!==t.client_id)throw bt('unexpected ID Token "azp" (authorized party) claim value',Sn,{expected:t.client_id,claims:s,claim:"azp"})}void 0!==s.auth_time&&Tt(s.auth_time,!0,'ID Token "auth_time" (authentication time)',wn,{claims:s}),en.set(n,c),$t.set(a,s)}if(void 0!==(null==i?void 0:i[a.token_type]))i[a.token_type](n,a);else if("dpop"!==a.token_type&&"bearer"!==a.token_type)throw new gt("unsupported `token_type` value",{cause:{body:a}});return a}function on(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw bt('unexpected JWT "aud" (audience) claim value',Sn,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw bt('unexpected JWT "aud" (audience) claim value',Sn,{expected:e,claims:t.claims,claim:"aud"});return t}function rn(e,t){var n,o;const r=null!==(n=null===(o=e[Un])||void 0===o?void 0:o.call(e,t))&&void 0!==n?n:e.issuer;if(t.claims.iss!==r)throw bt('unexpected JWT "iss" (issuer) claim value',Sn,{expected:r,claims:t.claims,claim:"iss"});return t}const an=new WeakSet,sn=Symbol(),cn={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function un(e,t){for(const n of e)if(void 0===t.claims[n])throw bt('JWT "'.concat(n,'" (').concat(cn[n],") claim missing"),wn,{claims:t.claims});return t}const ln=Symbol(),dn=Symbol();const hn="OAUTH_WWW_AUTHENTICATE_CHALLENGE",pn="OAUTH_RESPONSE_BODY_ERROR",fn="OAUTH_UNSUPPORTED_OPERATION",mn="OAUTH_AUTHORIZATION_RESPONSE_ERROR",yn="OAUTH_PARSE_ERROR",wn="OAUTH_INVALID_RESPONSE",gn="OAUTH_RESPONSE_IS_NOT_JSON",vn="OAUTH_RESPONSE_IS_NOT_CONFORM",bn="OAUTH_HTTP_REQUEST_FORBIDDEN",_n="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",kn="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",Sn="OAUTH_JWT_CLAIM_COMPARISON_FAILED",En="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",Tn="OAUTH_MISSING_SERVER_METADATA",An="OAUTH_INVALID_SERVER_METADATA";function Pn(e){if(e.bodyUsed)throw it('"response" body has been used already',"ERR_INVALID_ARG_VALUE")}function Rn(e){const{algorithm:t}=e;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new gt("unsupported ".concat(t.name," modulusLength"),{cause:e})}function In(e){const{algorithm:t}=e;switch(t.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new gt("unsupported ECDSA namedCurve",{cause:e})}}function On(e,t,n,o){if(void 0===e)if(Array.isArray(t)){if(!t.includes(o.alg))throw bt('unexpected JWT "alg" header parameter',wn,{header:o,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw bt('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?o.alg!==n:"function"==typeof n?!n(o.alg):!n.includes(o.alg))throw bt('unexpected JWT "alg" header parameter',wn,{header:o,expected:n,reason:"default value"})}else if("string"==typeof e?o.alg!==e:!e.includes(o.alg))throw bt('unexpected JWT "alg" header parameter',wn,{header:o,expected:e,reason:"client configuration"})}function Cn(e,t){const{0:n,length:o}=e.getAll(t);if(o>1)throw bt('"'.concat(t,'" parameter must be provided only once'),wn);return n}const xn=Symbol(),jn=Symbol();async function Dn(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Pt;try{t=await e.json()}catch(t){throw n(e),bt('failed to parse "response" body as JSON',yn,t)}if(!_t(t))throw bt('"response" body must be a top level object',wn,{body:t});return t}const Ln=Symbol(),Un=Symbol(),Kn=new TextEncoder,Nn=new TextDecoder;function Wn(e){const t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){const o=e.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");t[n]=o}return t}function zn(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);const t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}function Hn(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64("string"==typeof e?e:Nn.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=Nn.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/");try{return zn(t)}catch(e){throw new TypeError("The input to be decoded is not correctly encoded.")}}class Jn extends Error{constructor(e,t){var n;super(e,t),Qe(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}Qe(Jn,"code","ERR_JOSE_GENERIC");class Mn extends Jn{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),Qe(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),Qe(this,"claim",void 0),Qe(this,"reason",void 0),Qe(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}Qe(Mn,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class Vn extends Jn{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),Qe(this,"code","ERR_JWT_EXPIRED"),Qe(this,"claim",void 0),Qe(this,"reason",void 0),Qe(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}Qe(Vn,"code","ERR_JWT_EXPIRED");class Gn extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}Qe(Gn,"code","ERR_JOSE_ALG_NOT_ALLOWED");class Fn extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JOSE_NOT_SUPPORTED")}}Qe(Fn,"code","ERR_JOSE_NOT_SUPPORTED"),Qe(class extends Jn{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),Qe(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),Qe(class extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class Zn extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JWS_INVALID")}}Qe(Zn,"code","ERR_JWS_INVALID");class qn extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JWT_INVALID")}}Qe(qn,"code","ERR_JWT_INVALID"),Qe(class extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Bn extends Jn{constructor(){super(...arguments),Qe(this,"code","ERR_JWKS_INVALID")}}Qe(Bn,"code","ERR_JWKS_INVALID");class Xn extends Jn{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),Qe(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}Qe(Xn,"code","ERR_JWKS_NO_MATCHING_KEY");class Yn extends Jn{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),Qe(this,Symbol.asyncIterator,void 0),Qe(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}Qe(Yn,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class Qn extends Jn{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),Qe(this,"code","ERR_JWKS_TIMEOUT")}}Qe(Qn,"code","ERR_JWKS_TIMEOUT");class $n extends Jn{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),Qe(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}Qe($n,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const eo=function(e){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))},to=(e,t)=>e.name===t;function no(e){return parseInt(e.name.slice(4),10)}function oo(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if((o=o.filter(Boolean)).length>2){const t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");if(null==t)e+=" Received ".concat(t);else if("function"==typeof t&&t.name)e+=" Received function ".concat(t.name);else if("object"==typeof t&&null!=t){var i;null!==(i=t.constructor)&&void 0!==i&&i.name&&(e+=" Received an instance of ".concat(t.constructor.name))}return e}const ro=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return oo("Key for the ".concat(e," algorithm must be "),t,...o)},io=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}},ao=e=>"KeyObject"===(null==e?void 0:e[Symbol.toStringTag]),so=e=>io(e)||ao(e);function co(e){if("object"!=typeof(t=e)||null===t||"[object Object]"!==Object.prototype.toString.call(e))return!1;var t;if(null===Object.getPrototypeOf(e))return!0;let n=e;for(;null!==Object.getPrototypeOf(n);)n=Object.getPrototypeOf(n);return Object.getPrototypeOf(e)===n}const uo=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},lo=e=>{const t=e.data[e.pos++];if(128&t){const n=127&t;let o=0;for(let t=0;t<n;t++)o=o<<8|e.data[e.pos++];return o}return t},ho=(e,t,n)=>{if(e.data[e.pos++]!==t)throw new Error(n)},po=(e,t)=>{const n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},fo=(e,t,n)=>{var o;const r=(e=>zn(e.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"")))(e);let i=n;return null!=t&&null!==(o=t.startsWith)&&void 0!==o&&o.call(t,"ECDH-ES")&&(i||(i={}),i.getNamedCurve=e=>{const t={data:e,pos:0};return function(e){ho(e,48,"Invalid PKCS#8 structure"),lo(e),ho(e,2,"Expected version field");const t=lo(e);e.pos+=t,ho(e,48,"Expected algorithm identifier"),lo(e),e.pos}(t),(e=>{const t=(e=>{ho(e,6,"Expected algorithm OID");const t=lo(e);return po(e,t)})(e);if(uo(t,[43,101,110]))return"X25519";if(!uo(t,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");ho(e,6,"Expected curve OID");const n=lo(e),o=po(e,n);for(const{name:e,oid:t}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(uo(o,t))return e;throw new Error("Unsupported named curve")})(t)}),(async(e,t,n,o)=>{var r;let i,a;const s="spki"===e,c=()=>s?["verify"]:["sign"];switch(n){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(n.slice(-3),10)||1)},a=s?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[n]},a=c();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{const e=o.getNamedCurve(t);i="X25519"===e?{name:"X25519"}:{name:"ECDH",namedCurve:e}}catch(e){throw new Fn("Invalid or unsupported key format")}a=s?[]:["deriveBits"];break;case"Ed25519":case"EdDSA":i={name:"Ed25519"},a=c();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:n},a=c();break;default:throw new Fn('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(e,t,i,null!==(r=null==o?void 0:o.extractable)&&void 0!==r?r:!!s,a)})("pkcs8",r,t,i)};async function mo(e){var t,n;if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const{algorithm:o,keyUsages:r}=function(e){let t,n;switch(e.kty){case"AKP":switch(e.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":t={name:e.alg},n=e.priv?["sign"]:["verify"];break;default:throw new Fn('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(e.alg.slice(-3),10)||1)},n=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new Fn('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"EC":switch(e.alg){case"ES256":t={name:"ECDSA",namedCurve:"P-256"},n=e.d?["sign"]:["verify"];break;case"ES384":t={name:"ECDSA",namedCurve:"P-384"},n=e.d?["sign"]:["verify"];break;case"ES512":t={name:"ECDSA",namedCurve:"P-521"},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new Fn('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"OKP":switch(e.alg){case"Ed25519":case"EdDSA":t={name:"Ed25519"},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new Fn('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;default:throw new Fn('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:n}}(e),i=et({},e);return"AKP"!==i.kty&&delete i.alg,delete i.use,crypto.subtle.importKey("jwk",i,o,null!==(t=e.ext)&&void 0!==t?t:!e.d&&!e.priv,null!==(n=e.key_ops)&&void 0!==n?n:r)}const yo=e=>co(e)&&"string"==typeof e.kty;let wo;const go=async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];wo||(wo=new WeakMap);let r=wo.get(e);if(null!=r&&r[n])return r[n];const i=await mo(et(et({},t),{},{alg:n}));return o&&Object.freeze(e),r?r[n]=i:wo.set(e,{[n]:i}),i};const vo=e=>null==e?void 0:e[Symbol.toStringTag],bo=(e,t,n)=>{if(void 0!==t.use){let e;switch(n){case"sign":case"verify":e="sig";break;case"encrypt":case"decrypt":e="enc"}if(t.use!==e)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==e)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(e,'" when present'));if(Array.isArray(t.key_ops)){var o,r;let i;switch(!0){case"sign"===n||"verify"===n:case"dir"===e:case e.includes("CBC-HS"):i=n;break;case e.startsWith("PBES2"):i="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(e):i=!e.includes("GCM")&&e.endsWith("KW")?"encrypt"===n?"wrapKey":"unwrapKey":n;break;case"encrypt"===n&&e.startsWith("RSA"):i="wrapKey";break;case"decrypt"===n:i=e.startsWith("RSA")?"unwrapKey":"deriveBits"}if(i&&!1===(null===(o=t.key_ops)||void 0===o||null===(r=o.includes)||void 0===r?void 0:r.call(o,i)))throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(i,'" when present'))}return!0};var _o,ko;let So,Eo;if("undefined"==typeof navigator||null===(_o=navigator.userAgent)||void 0===_o||null===(ko=_o.startsWith)||void 0===ko||!ko.call(_o,"Mozilla/5.0 ")){const e="v6.8.1";Eo="".concat("openid-client","/").concat(e),So={"user-agent":Eo}}const To=e=>Ao.get(e);let Ao,Po;function Ro(e){return void 0!==e?Lt(e):(Po||(Po=new WeakMap),(e,t,n,o)=>{let r;return(r=Po.get(t))||(function(e,t){if("string"!=typeof e)throw xo("".concat(t," must be a string"),Co);if(0===e.length)throw xo("".concat(t," must not be empty"),Oo)}(t.client_secret,'"metadata.client_secret"'),r=Lt(t.client_secret),Po.set(t,r)),r(e,t,n,o)})}const Io=ut,Oo="ERR_INVALID_ARG_VALUE",Co="ERR_INVALID_ARG_TYPE";function xo(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}class jo extends Error{constructor(e,t){var n;super(e,t),Qe(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function Do(e,t,n){return new jo(e,{cause:t,code:n})}function Lo(e){if(e instanceof TypeError||e instanceof jo||e instanceof Ht||e instanceof Jt||e instanceof Mt)throw e;if(e instanceof vt)switch(e.code){case bn:throw Do("only requests to HTTPS are allowed",e,e.code);case _n:throw Do("only requests to HTTP or HTTPS are allowed",e,e.code);case vn:throw Do("unexpected HTTP response status code",e.cause,e.code);case gn:throw Do("unexpected response content-type",e.cause,e.code);case yn:throw Do("parsing error occured",e,e.code);case wn:throw Do("invalid response encountered",e,e.code);case Sn:throw Do("unexpected JWT claim value encountered",e,e.code);case En:throw Do("unexpected JSON attribute value encountered",e,e.code);case kn:throw Do("JWT timestamp claim value failed validation",e,e.code);default:throw Do(e.message,e,e.code)}if(e instanceof gt)throw Do("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw Do("runtime operation error",e,fn);case"NotSupportedError":throw Do("runtime unsupported operation",e,fn);case"TimeoutError":throw Do("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw Do("operation aborted",e,"OAUTH_ABORT")}throw new jo("something went wrong",{cause:e})}async function Uo(e,t,n,o,r){const i=await async function(e,t){var n,o;if(!(e instanceof URL))throw xo('"server" must be an instance of URL',Co);const r=!e.href.includes("/.well-known/"),i=null!==(n=null==t?void 0:t.timeout)&&void 0!==n?n:30,a=AbortSignal.timeout(1e3*i),s=await(r?async function(e,t){return async function(e,t,n,o){if(!(e instanceof URL))throw it('"'.concat("issuerIdentifier",'" must be an instance of URL'),"ERR_INVALID_ARG_TYPE");Nt(e,!0!==(null==o?void 0:o[at]));const r=n(new URL(e.href)),i=kt(null==o?void 0:o.headers);return i.set("accept","application/json"),((null==o?void 0:o[ut])||fetch)(r.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:St(r,null==o?void 0:o.signal)})}(e,0,(e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":!function(e){e.pathname=Et("".concat(e.pathname,"/").concat(".well-known/openid-configuration"))}(e);break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=Et("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw it('"options.algorithm" must be "oidc" (default), or "oauth2"',"ERR_INVALID_ARG_VALUE")}return e}),t)}(e,{algorithm:null==t?void 0:t.algorithm,[ut]:null==t?void 0:t[Io],[at]:null==t||null===(o=t.execute)||void 0===o?void 0:o.includes(Vo),signal:a,headers:new Headers(So)}):((null==t?void 0:t[Io])||fetch)((Nt(e,null==t||null===(c=t.execute)||void 0===c||!c.includes(Vo)),e.href),{headers:Object.fromEntries(new Headers(et({accept:"application/json"},So)).entries()),body:void 0,method:"GET",redirect:"manual",signal:a})).then((e=>async function(e,t){const n=e;if(!(n instanceof URL)&&n!==Ln)throw it('"expectedIssuerIdentifier" must be an instance of URL',"ERR_INVALID_ARG_TYPE");if(!rt(t,Response))throw it('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");if(200!==t.status)throw bt('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',vn,t);Pn(t);const o=await Dn(t);if(At(o.issuer,'"response" body "issuer" property',wn,{body:o}),n!==Ln&&new URL(o.issuer).href!==n.href)throw bt('"response" body "issuer" property does not match the expected value',En,{expected:n.href,body:o,attribute:"issuer"});return o}(Ln,e))).catch(Lo);var c;return r&&new URL(s.issuer).href!==e.href&&(function(e,t,n){return!("https://login.microsoftonline.com"!==e.origin||null!=n&&n.algorithm&&"oidc"!==n.algorithm||(t[Ko]=!0,0))}(e,s,t)||function(e,t){return!(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)}(e,t)||(()=>{throw new jo("discovered metadata issuer does not match the expected issuer",{code:En,cause:{expected:e.href,body:s,attribute:"issuer"}})})()),s}(e,r),a=new No(i,t,n,o);let s=To(a);if(null!=r&&r[Io]&&(s.fetch=r[Io]),null!=r&&r.timeout&&(s.timeout=r.timeout),null!=r&&r.execute)for(const e of r.execute)e(a);return a}new TextDecoder;const Ko=Symbol();class No{constructor(e,t,n,o){var r,i,a,s,c;if("string"!=typeof t||!t.length)throw xo('"clientId" must be a non-empty string',Co);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null===(r=n)||void 0===r?void 0:r.client_id)&&t!==n.client_id)throw xo('"clientId" and "metadata.client_id" must be the same',Oo);const u=et(et({},structuredClone(n)),{},{client_id:t});let l;u[st]=null!==(i=null===(a=n)||void 0===a?void 0:a[st])&&void 0!==i?i:0,u[ct]=null!==(s=null===(c=n)||void 0===c?void 0:c[ct])&&void 0!==s?s:30,l=o||("string"==typeof u.client_secret&&u.client_secret.length?Ro(u.client_secret):(e,t,n,o)=>{n.set("client_id",t.client_id)});let d=Object.freeze(u);const h=structuredClone(e);Ko in e&&(h[Un]=t=>{let{claims:{tid:n}}=t;return e.issuer.replace("{tenantid}",n)});let p=Object.freeze(h);Ao||(Ao=new WeakMap),Ao.set(this,{__proto__:null,as:p,c:d,auth:l,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(To(this).as);return function(e){Object.defineProperties(e,function(e){return{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null===(t=e.code_challenge_methods_supported)||void 0===t?void 0:t.includes(n))}}}}(e))}(e),e}clientMetadata(){return structuredClone(To(this).c)}get timeout(){return To(this).timeout}set timeout(e){To(this).timeout=e}get[Io](){return To(this).fetch}set[Io](e){To(this).fetch=e}}function Wo(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return tn(this)}catch(e){return}}}}}(e))}async function zo(e,t,n){var o;let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const i=null===(o=e.headers.get("retry-after"))||void 0===o?void 0:o.trim();if(void 0===i)return;let a;if(/^\d+$/.test(i))a=parseInt(i,10);else{const e=new Date(i);if(Number.isFinite(e.getTime())){const t=new Date,n=e.getTime()-t.getTime();n>0&&(a=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(a))throw new vt("invalid Retry-After header value",{cause:e});a>t&&await Ho(a-t,n)}function Ho(e,t){return new Promise(((n,o)=>{const r=e=>{try{t.throwIfAborted()}catch(e){return void o(e)}if(e<=0)return void n();const i=Math.min(e,5);setTimeout((()=>r(e-i)),1e3*i)};r(e)}))}async function Jo(e,t){Xo(e);const{as:n,c:o,auth:r,fetch:i,tlsOnly:a,timeout:s}=To(e);return async function(e,t,n,o,r){jt(e),Dt(t);const i=zt(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[at])),a=new URLSearchParams(o);a.set("client_id",t.client_id);const s=kt(null==r?void 0:r.headers);return s.set("accept","application/json"),Yt(e,t,n,i,a,s,r)}(n,o,r,t,{[ut]:i,[at]:!a,headers:new Headers(So),signal:Yo(s)}).then((e=>async function(e,t,n){if(jt(e),Dt(t),!rt(n,Response))throw it('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await qt(n,200,"Backchannel Authentication Endpoint"),Pn(n);const o=await Dn(n);At(o.auth_req_id,'"response" body "auth_req_id" property',wn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Tt(r,!0,'"response" body "expires_in" property',wn,{body:o}),o.expires_in=r,void 0!==o.interval&&Tt(o.interval,!1,'"response" body "interval" property',wn,{body:o}),o}(n,o,e))).catch(Lo)}async function Mo(e,t,n,o){var r,i;Xo(e),n=new URLSearchParams(n);let a=null!==(r=t.interval)&&void 0!==r?r:5;const s=null!==(i=null==o?void 0:o.signal)&&void 0!==i?i:AbortSignal.timeout(1e3*t.expires_in);try{await Ho(a,s)}catch(e){Lo(e)}const{as:c,c:u,auth:l,fetch:d,tlsOnly:h,nonRepudiation:p,timeout:f,decrypt:m}=To(e),y=(r,i)=>Mo(e,et(et({},t),{},{interval:r}),n,et(et({},o),{},{signal:s,flag:i})),w=await async function(e,t,n,o,r){jt(e),Dt(t),At(o,'"authReqId"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("auth_req_id",o),Qt(e,t,n,"urn:openid:params:grant-type:ciba",i,r)}(c,u,l,t.auth_req_id,{[ut]:d,[at]:!h,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(So),signal:s.aborted?s:Yo(f)}).catch(Lo);var g;if(503===w.status&&w.headers.has("retry-after"))return await zo(w,a,s,!0),await(null===(g=w.body)||void 0===g?void 0:g.cancel()),y(a);const v=async function(e,t,n,o){return nn(e,t,n,void 0,null==o?void 0:o[dt],null==o?void 0:o.recognizedTokenTypes)}(c,u,w,{[dt]:m});let b;try{b=await v}catch(e){if(Qo(e,o))return y(a,$o);if(e instanceof Ht)switch(e.error){case"slow_down":a+=5;case"authorization_pending":return await zo(e.response,a,s),y(a)}Lo(e)}return b.id_token&&await(null==p?void 0:p(w)),Wo(b),b}function Vo(e){To(e).tlsOnly=!1}async function Go(e,t,n,o,r){if(Xo(e),!((null==r?void 0:r.flag)===$o||t instanceof URL||function(e){try{return"Request"===Object.getPrototypeOf(e)[Symbol.toStringTag]}catch(e){return!1}}(t)))throw xo('"currentUrl" must be an instance of URL, or Request',Co);let i,a;const{as:s,c:c,auth:u,fetch:l,tlsOnly:d,jarm:h,hybrid:p,nonRepudiation:f,timeout:m,decrypt:y,implicit:w}=To(e);if((null==r?void 0:r.flag)===$o)i=r.authResponse,a=r.redirectUri;else{if(!(t instanceof URL)){const e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":const n=new URLSearchParams(await async function(e){if("POST"!==e.method)throw it("form_post responses are expected to use the POST method","ERR_INVALID_ARG_VALUE",{cause:e});if("application/x-www-form-urlencoded"!==Xt(e))throw it("form_post responses are expected to use the application/x-www-form-urlencoded content-type","ERR_INVALID_ARG_VALUE",{cause:e});return async function(e){if(e.bodyUsed)throw it("form_post Request instances must contain a readable body","ERR_INVALID_ARG_VALUE",{cause:e});return e.text()}(e)}(e));if(p)t.hash=n.toString();else for(const[e,o]of n.entries())t.searchParams.append(e,o);break;default:throw xo("unexpected Request HTTP method",Oo)}}switch(a=function(e){return(e=new URL(e)).search="",e.hash="",e.href}(t),!0){case!!h:i=await h(t,null==n?void 0:n.expectedState);break;case!!p:i=await p(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!w:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,o){if(jt(e),Dt(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw it('"parameters" must be an instance of URLSearchParams, or URL',"ERR_INVALID_ARG_TYPE");if(Cn(n,"response"))throw bt('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',wn,{parameters:n});const r=Cn(n,"iss"),i=Cn(n,"state");if(!r&&e.authorization_response_iss_parameter_supported)throw bt('response parameter "iss" (issuer) missing',wn,{parameters:n});if(r&&r!==e.issuer)throw bt('unexpected "iss" (issuer) response parameter value',wn,{expected:e.issuer,parameters:n});switch(o){case void 0:case jn:if(void 0!==i)throw bt('unexpected "state" response parameter encountered',wn,{expected:void 0,parameters:n});break;case xn:break;default:if(At(o,'"expectedState" argument'),i!==o)throw bt(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',wn,{expected:o,parameters:n})}if(Cn(n,"error"))throw new Jt("authorization response from the server is an error",{cause:n});const a=Cn(n,"id_token"),s=Cn(n,"token");if(void 0!==a||void 0!==s)throw new gt("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),an.add(c),c;var c}(s,c,t.searchParams,null==n?void 0:n.expectedState)}catch(e){Lo(e)}}}const g=await async function(e,t,n,o,r,i,a){if(jt(e),Dt(t),!an.has(o))throw it('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',"ERR_INVALID_ARG_VALUE");At(r,'"redirectUri"');const s=Cn(o,"code");if(!s)throw bt('no authorization code in "callbackParameters"',wn);const c=new URLSearchParams(null==a?void 0:a.additionalParameters);return c.set("redirect_uri",r),c.set("code",s),i!==sn&&(At(i,'"codeVerifier"'),c.set("code_verifier",i)),Qt(e,t,n,"authorization_code",c,a)}(s,c,u,i,a,(null==n?void 0:n.pkceCodeVerifier)||sn,{additionalParameters:o,[ut]:l,[at]:!d,DPoP:null==r?void 0:r.DPoP,headers:new Headers(So),signal:Yo(m)}).catch(Lo);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);const v=async function(e,t,n,o){return"string"==typeof(null==o?void 0:o.expectedNonce)||"number"==typeof(null==o?void 0:o.maxAge)||null!=o&&o.requireIdToken?async function(e,t,n,o,r,i,a){const s=[];switch(o){case void 0:o=ln;break;case ln:break;default:At(o,'"expectedNonce" argument'),s.push("nonce")}switch(null!=r||(r=t.default_max_age),r){case void 0:r=dn;break;case dn:break;default:Tt(r,!0,'"maxAge" argument'),s.push("auth_time")}const c=await nn(e,t,n,s,i,a);At(c.id_token,'"response" body "id_token" property',wn,{body:c});const u=tn(c);if(r!==dn){const e=xt()+Ot(t),n=Ct(t);if(u.auth_time+r<e-n)throw bt("too much time has elapsed since the last End-User authentication",kn,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(o===ln){if(void 0!==u.nonce)throw bt('unexpected ID Token "nonce" claim value',Sn,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==o)throw bt('unexpected ID Token "nonce" claim value',Sn,{expected:o,claims:u,claim:"nonce"});return c}(e,t,n,o.expectedNonce,o.maxAge,o[dt],o.recognizedTokenTypes):async function(e,t,n,o,r){const i=await nn(e,t,n,void 0,o,r),a=tn(i);if(a){if(void 0!==t.default_max_age){Tt(t.default_max_age,!0,'"client.default_max_age"');const e=xt()+Ot(t),n=Ct(t);if(a.auth_time+t.default_max_age<e-n)throw bt("too much time has elapsed since the last End-User authentication",kn,{claims:a,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==a.nonce)throw bt('unexpected ID Token "nonce" claim value',Sn,{expected:void 0,claims:a,claim:"nonce"})}return i}(e,t,n,null==o?void 0:o[dt],null==o?void 0:o.recognizedTokenTypes)}(s,c,g,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[dt]:y});let b;try{b=await v}catch(t){if(Qo(t,r))return Go(e,void 0,n,o,et(et({},r),{},{flag:$o,authResponse:i,redirectUri:a}));Lo(t)}return b.id_token&&await(null==f?void 0:f(g)),Wo(b),b}async function Fo(e,t,n,o){Xo(e),n=new URLSearchParams(n);const{as:r,c:i,auth:a,fetch:s,tlsOnly:c,nonRepudiation:u,timeout:l,decrypt:d}=To(e),h=await async function(e,t,n,o,r){jt(e),Dt(t),At(o,'"refreshToken"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("refresh_token",o),Qt(e,t,n,"refresh_token",i,r)}(r,i,a,t,{[ut]:s,[at]:!c,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(So),signal:Yo(l)}).catch(Lo),p=async function(e,t,n,o){return nn(e,t,n,void 0,null==o?void 0:o[dt],null==o?void 0:o.recognizedTokenTypes)}(r,i,h,{[dt]:d});let f;try{f=await p}catch(r){if(Qo(r,o))return Fo(e,t,n,et(et({},o),{},{flag:$o}));Lo(r)}return f.id_token&&await(null==u?void 0:u(h)),Wo(f),f}async function Zo(e,t,n){Xo(e),t=new URLSearchParams(t);const{as:o,c:r,auth:i,fetch:a,tlsOnly:s,timeout:c}=To(e),u=await async function(e,t,n,o,r){return jt(e),Dt(t),Qt(e,t,n,"client_credentials",new URLSearchParams(o),r)}(o,r,i,t,{[ut]:a,[at]:!s,DPoP:null==n?void 0:n.DPoP,headers:new Headers(So),signal:Yo(c)}).catch(Lo),l=async function(e,t,n){return nn(e,t,n,void 0,void 0,void 0)}(o,r,u);let d;try{d=await l}catch(o){if(Qo(o,n))return Zo(e,t,et(et({},n),{},{flag:$o}));Lo(o)}return Wo(d),d}function qo(e,t){Xo(e);const{as:n,c:o,tlsOnly:r,hybrid:i,jarm:a,implicit:s}=To(e),c=zt(n,"authorization_endpoint",!1,r);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",o.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",i?"code id_token":s?"id_token":"code"),s&&!t.has("nonce"))throw xo("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",Oo);a&&t.set("response_mode","jwt")}for(const[e,n]of t.entries())c.searchParams.append(e,n);return c}async function Bo(e,t,n){Xo(e);const o=qo(e,t),{as:r,c:i,auth:a,fetch:s,tlsOnly:c,timeout:u}=To(e),l=await async function(e,t,n,o,r){var i;jt(e),Dt(t);const a=zt(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[at])),s=new URLSearchParams(o);s.set("client_id",t.client_id);const c=kt(null==r?void 0:r.headers);c.set("accept","application/json"),void 0!==(null==r?void 0:r.DPoP)&&(Bt(r.DPoP),await r.DPoP.addProof(a,c,"POST"));const u=await Yt(e,t,n,a,s,c,r);return null==r||null===(i=r.DPoP)||void 0===i||i.cacheNonce(u,a),u}(r,i,a,o.searchParams,{[ut]:s,[at]:!c,DPoP:null==n?void 0:n.DPoP,headers:new Headers(So),signal:Yo(u)}).catch(Lo),d=async function(e,t,n){if(jt(e),Dt(t),!rt(n,Response))throw it('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await qt(n,201,"Pushed Authorization Request Endpoint"),Pn(n);const o=await Dn(n);At(o.request_uri,'"response" body "request_uri" property',wn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Tt(r,!0,'"response" body "expires_in" property',wn,{body:o}),o.expires_in=r,o}(r,i,l);let h;try{h=await d}catch(o){if(Qo(o,n))return Bo(e,t,et(et({},n),{},{flag:$o}));Lo(o)}return qo(e,{request_uri:h.request_uri})}function Xo(e){if(!(e instanceof No))throw xo('"config" must be an instance of Configuration',Co);if(Object.getPrototypeOf(e)!==No.prototype)throw xo("subclassing Configuration is not allowed",Oo)}function Yo(e){return e?AbortSignal.timeout(1e3*e):void 0}function Qo(e,t){return!(null==t||!t.DPoP||t.flag===$o)&&function(e){if(e instanceof Mt){const{0:t,length:n}=e.cause;return 1===n&&"dpop"===t.scheme&&"use_dpop_nonce"===t.parameters.error}return e instanceof Ht&&"use_dpop_nonce"===e.error}(e)}Object.freeze(No.prototype);const $o=Symbol();async function er(e,t,n,o){Xo(e);const{as:r,c:i,auth:a,fetch:s,tlsOnly:c,timeout:u,decrypt:l}=To(e),d=await async function(e,t,n,o,r,i){return jt(e),Dt(t),At(o,'"grantType"'),Qt(e,t,n,o,new URLSearchParams(r),i)}(r,i,a,t,new URLSearchParams(n),{[ut]:s,[at]:!c,DPoP:null==o?void 0:o.DPoP,headers:new Headers(So),signal:Yo(u)}).then((e=>{let n;return"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(n={n_a:()=>{}}),async function(e,t,n,o){return nn(e,t,n,void 0,null==o?void 0:o[dt],null==o?void 0:o.recognizedTokenTypes)}(r,i,e,{[dt]:l,recognizedTokenTypes:n})})).catch(Lo);return Wo(d),d}async function tr(e,t,n){if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o<t;o++)n[o-1]=arguments[o];return oo("Key must be ",e,...n)}(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:"SHA-".concat(e.slice(-3)),name:"HMAC"},!1,[n])}return function(e,t,n){switch(t){case"HS256":case"HS384":case"HS512":{if(!to(e.algorithm,"HMAC"))throw eo("HMAC");const n=parseInt(t.slice(2),10);if(no(e.algorithm.hash)!==n)throw eo("SHA-".concat(n),"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!to(e.algorithm,"RSASSA-PKCS1-v1_5"))throw eo("RSASSA-PKCS1-v1_5");const n=parseInt(t.slice(2),10);if(no(e.algorithm.hash)!==n)throw eo("SHA-".concat(n),"algorithm.hash");break}case"PS256":case"PS384":case"PS512":{if(!to(e.algorithm,"RSA-PSS"))throw eo("RSA-PSS");const n=parseInt(t.slice(2),10);if(no(e.algorithm.hash)!==n)throw eo("SHA-".concat(n),"algorithm.hash");break}case"Ed25519":case"EdDSA":if(!to(e.algorithm,"Ed25519"))throw eo("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":if(!to(e.algorithm,t))throw eo(t);break;case"ES256":case"ES384":case"ES512":{if(!to(e.algorithm,"ECDSA"))throw eo("ECDSA");const n=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}(t);if(e.algorithm.namedCurve!==n)throw eo(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(t,"."))}(e,n)}(t,e,n),t}async function nr(e,t,n){if(!co(e))throw new Zn("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new Zn('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new Zn("JWS Protected Header incorrect type");if(void 0===e.payload)throw new Zn("JWS Payload missing");if("string"!=typeof e.signature)throw new Zn("JWS Signature missing or incorrect type");if(void 0!==e.header&&!co(e.header))throw new Zn("JWS Unprotected Header incorrect type");let o={};if(e.protected)try{const t=Hn(e.protected);o=JSON.parse(Nn.decode(t))}catch(e){throw new Zn("JWS Protected Header is invalid")}if(!function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.filter(Boolean);if(0===o.length||1===o.length)return!0;let r;for(const e of o){const t=Object.keys(e);if(r&&0!==r.size)for(const e of t){if(r.has(e))return!1;r.add(e)}else r=new Set(t)}return!0}(o,e.header))throw new Zn("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const r=et(et({},o),e.header),i=function(e,t,n,o,r){if(void 0!==r.crit&&void 0===(null==o?void 0:o.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!o||void 0===o.crit)return new Set;if(!Array.isArray(o.crit)||0===o.crit.length||o.crit.some((e=>"string"!=typeof e||0===e.length)))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i;i=void 0!==n?new Map([...Object.entries(n),...t.entries()]):t;for(const t of o.crit){if(!i.has(t))throw new Fn('Extension Header Parameter "'.concat(t,'" is not recognized'));if(void 0===r[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i.get(t)&&void 0===o[t])throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return new Set(o.crit)}(Zn,new Map([["b64",!0]]),null==n?void 0:n.crit,o,r);let a=!0;if(i.has("b64")&&(a=o.b64,"boolean"!=typeof a))throw new Zn('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:s}=r;if("string"!=typeof s||!s)throw new Zn('JWS "alg" (Algorithm) Header Parameter missing or invalid');const c=n&&function(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some((e=>"string"!=typeof e))))throw new TypeError('"'.concat("algorithms",'" option must be an array of strings'));if(t)return new Set(t)}(0,n.algorithms);if(c&&!c.has(s))throw new Gn('"alg" (Algorithm) Header Parameter value not allowed');if(a){if("string"!=typeof e.payload)throw new Zn("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new Zn("JWS Payload must be a string or an Uint8Array instance");let u=!1;"function"==typeof t&&(t=await t(o,e),u=!0),function(e,t,n){switch(e.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((e,t,n)=>{if(!(t instanceof Uint8Array)){if(yo(t)){if((e=>"oct"===e.kty&&"string"==typeof e.k)(t)&&bo(e,t,n))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!so(t))throw new TypeError(ro(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if("secret"!==t.type)throw new TypeError("".concat(vo(t),' instances for symmetric algorithms must be of type "secret"'))}})(e,t,n);break;default:((e,t,n)=>{if(yo(t))switch(n){case"decrypt":case"sign":if((e=>"oct"!==e.kty&&("AKP"===e.kty&&"string"==typeof e.priv||"string"==typeof e.d))(t)&&bo(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if((e=>"oct"!==e.kty&&void 0===e.d&&void 0===e.priv)(t)&&bo(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!so(t))throw new TypeError(ro(e,t,"CryptoKey","KeyObject","JSON Web Key"));if("secret"===t.type)throw new TypeError("".concat(vo(t),' instances for asymmetric algorithms must not be of type "secret"'));if("public"===t.type)switch(n){case"sign":throw new TypeError("".concat(vo(t),' instances for asymmetric algorithm signing must be of type "private"'));case"decrypt":throw new TypeError("".concat(vo(t),' instances for asymmetric algorithm decryption must be of type "private"'))}if("private"===t.type)switch(n){case"verify":throw new TypeError("".concat(vo(t),' instances for asymmetric algorithm verifying must be of type "public"'));case"encrypt":throw new TypeError("".concat(vo(t),' instances for asymmetric algorithm encryption must be of type "public"'))}})(e,t,n)}}(s,t,"verify");const l=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.reduce(((e,t)=>{let{length:n}=t;return e+n}),0),r=new Uint8Array(o);let i=0;for(const e of t)r.set(e,i),i+=e.length;return r}(void 0!==e.protected?Wn(e.protected):new Uint8Array,Wn("."),"string"==typeof e.payload?a?Wn(e.payload):Kn.encode(e.payload):e.payload);let d;try{d=Hn(e.signature)}catch(e){throw new Zn("Failed to base64url decode the signature")}const h=await async function(e,t){if(e instanceof Uint8Array)return e;if(io(e))return e;if(ao(e)){if("secret"===e.type)return e.export();if("toCryptoKey"in e&&"function"==typeof e.toCryptoKey)try{return((e,t)=>{wo||(wo=new WeakMap);let n=wo.get(e);if(null!=n&&n[t])return n[t];const o="public"===e.type,r=!!o;let i;if("x25519"===e.asymmetricKeyType){switch(t){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}i=e.toCryptoKey(e.asymmetricKeyType,r,o?[]:["deriveBits"])}if("ed25519"===e.asymmetricKeyType){if("EdDSA"!==t&&"Ed25519"!==t)throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}switch(e.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}if("rsa"===e.asymmetricKeyType){let n;switch(t){case"RSA-OAEP":n="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":n="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":n="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":n="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:n},r,o?["encrypt"]:["decrypt"]);i=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:n},r,[o?"verify":"sign"])}if("ec"===e.asymmetricKeyType){var a;const n=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(null===(a=e.asymmetricKeyDetails)||void 0===a?void 0:a.namedCurve);if(!n)throw new TypeError("given KeyObject instance cannot be used for this algorithm");"ES256"===t&&"P-256"===n&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:n},r,[o?"verify":"sign"])),"ES384"===t&&"P-384"===n&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:n},r,[o?"verify":"sign"])),"ES512"===t&&"P-521"===n&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:n},r,[o?"verify":"sign"])),t.startsWith("ECDH-ES")&&(i=e.toCryptoKey({name:"ECDH",namedCurve:n},r,o?[]:["deriveBits"]))}if(!i)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return n?n[t]=i:wo.set(e,{[t]:i}),i})(e,t)}catch(e){if(e instanceof TypeError)throw e}let n=e.export({format:"jwk"});return go(e,n,t)}if(yo(e))return e.k?Hn(e.k):go(e,e,t,!0);throw new Error("unreachable")}(t,s);if(!await async function(e,t,n,o){const r=await tr(e,t,"verify");!function(e,t){if(e.startsWith("RS")||e.startsWith("PS")){const{modulusLength:n}=t.algorithm;if("number"!=typeof n||n<2048)throw new TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}}(e,r);const i=function(e,t){const n="SHA-".concat(e.slice(-3));switch(e){case"HS256":case"HS384":case"HS512":return{hash:n,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:n,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:n,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:n,name:"ECDSA",namedCurve:t.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:e};default:throw new Fn("alg ".concat(e," is not supported either by JOSE or your javascript runtime"))}}(e,r.algorithm);try{return await crypto.subtle.verify(i,r,n,o)}catch(e){return!1}}(s,h,d,l))throw new $n;let p;if(a)try{p=Hn(e.payload)}catch(e){throw new Zn("Failed to base64url decode the payload")}else p="string"==typeof e.payload?Kn.encode(e.payload):e.payload;const f={payload:p};return void 0!==e.protected&&(f.protectedHeader=o),void 0!==e.header&&(f.unprotectedHeader=e.header),u?et(et({},f),{},{key:h}):f}const or=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function rr(e){const t=or.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");const n=parseFloat(t[2]);let o;switch(t[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":o=Math.round(n);break;case"minute":case"minutes":case"min":case"mins":case"m":o=Math.round(60*n);break;case"hour":case"hours":case"hr":case"hrs":case"h":o=Math.round(3600*n);break;case"day":case"days":case"d":o=Math.round(86400*n);break;case"week":case"weeks":case"w":o=Math.round(604800*n);break;default:o=Math.round(31557600*n)}return"-"===t[1]||"ago"===t[4]?-o:o}const ir=e=>e.includes("/")?e.toLowerCase():"application/".concat(e.toLowerCase());async function ar(e,t,n){var o;const r=await async function(e,t,n){if(e instanceof Uint8Array&&(e=Nn.decode(e)),"string"!=typeof e)throw new Zn("Compact JWS must be a string or Uint8Array");const{0:o,1:r,2:i,length:a}=e.split(".");if(3!==a)throw new Zn("Invalid Compact JWS");const s=await nr({payload:r,protected:o,signature:i},t,n),c={payload:s.payload,protectedHeader:s.protectedHeader};return"function"==typeof t?et(et({},c),{},{key:s.key}):c}(e,t,n);if(null!==(o=r.protectedHeader.crit)&&void 0!==o&&o.includes("b64")&&!1===r.protectedHeader.b64)throw new qn("JWTs MUST NOT use unencoded payload");const i=function(e,t){let n,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{n=JSON.parse(Nn.decode(t))}catch(e){}if(!co(n))throw new qn("JWT Claims Set must be a top-level JSON object");const{typ:r}=o;if(r&&("string"!=typeof e.typ||ir(e.typ)!==ir(r)))throw new Mn('unexpected "typ" JWT header value',n,"typ","check_failed");const{requiredClaims:i=[],issuer:a,subject:s,audience:c,maxTokenAge:u}=o,l=[...i];void 0!==u&&l.push("iat"),void 0!==c&&l.push("aud"),void 0!==s&&l.push("sub"),void 0!==a&&l.push("iss");for(const e of new Set(l.reverse()))if(!(e in n))throw new Mn('missing required "'.concat(e,'" claim'),n,e,"missing");if(a&&!(Array.isArray(a)?a:[a]).includes(n.iss))throw new Mn('unexpected "iss" claim value',n,"iss","check_failed");if(s&&n.sub!==s)throw new Mn('unexpected "sub" claim value',n,"sub","check_failed");if(c&&!((e,t)=>"string"==typeof e?t.includes(e):!!Array.isArray(e)&&t.some(Set.prototype.has.bind(new Set(e))))(n.aud,"string"==typeof c?[c]:c))throw new Mn('unexpected "aud" claim value',n,"aud","check_failed");let d;switch(typeof o.clockTolerance){case"string":d=rr(o.clockTolerance);break;case"number":d=o.clockTolerance;break;case"undefined":d=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const{currentDate:h}=o,p=(e=>Math.floor(e.getTime()/1e3))(h||new Date);if((void 0!==n.iat||u)&&"number"!=typeof n.iat)throw new Mn('"iat" claim must be a number',n,"iat","invalid");if(void 0!==n.nbf){if("number"!=typeof n.nbf)throw new Mn('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>p+d)throw new Mn('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(void 0!==n.exp){if("number"!=typeof n.exp)throw new Mn('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=p-d)throw new Vn('"exp" claim timestamp check failed',n,"exp","check_failed")}if(u){const e=p-n.iat;if(e-d>("number"==typeof u?u:rr(u)))throw new Vn('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(e<0-d)throw new Mn('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}(r.protectedHeader,r.payload,n),a={payload:i,protectedHeader:r.protectedHeader};return"function"==typeof t?et(et({},a),{},{key:r.key}):a}function sr(e){return co(e)}var cr,ur,lr=new WeakMap,dr=new WeakMap;class hr{constructor(e){if(Xe(this,lr,void 0),Xe(this,dr,new WeakMap),!function(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(sr)}(e))throw new Bn("JSON Web Key Set malformed");Ye(lr,this,structuredClone(e))}jwks(){return Be(lr,this)}async getKey(e,t){const{alg:n,kid:o}=et(et({},e),null==t?void 0:t.header),r=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new Fn('Unsupported "alg" value for a JSON Web Key Set')}}(n),i=Be(lr,this).keys.filter((e=>{let t=r===e.kty;if(t&&"string"==typeof o&&(t=o===e.kid),!t||"string"!=typeof e.alg&&"AKP"!==r||(t=n===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t)switch(n){case"ES256":t="P-256"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv;break;case"Ed25519":case"EdDSA":t="Ed25519"===e.crv}return t})),{0:a,length:s}=i;if(0===s)throw new Xn;if(1!==s){const e=new Yn,t=Be(dr,this);throw e[Symbol.asyncIterator]=function(e){return function(){return new nt(e.apply(this,arguments))}}((function*(){for(const e of i)try{yield yield Ze(pr(t,e,n))}catch(e){}})),e}return pr(Be(dr,this),a,n)}}async function pr(e,t,n){const o=e.get(t)||e.set(t,{}).get(t);if(void 0===o[n]){const e=await async function(e,t){if(!co(e))throw new TypeError("JWK must be an object");let n;switch(null!=t||(t=e.alg),null!=n||(n=e.ext),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw new TypeError('missing "k" (Key Value) Parameter value');return Hn(e.k);case"RSA":if("oth"in e&&void 0!==e.oth)throw new Fn('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return mo(et(et({},e),{},{alg:t,ext:n}));case"AKP":if("string"!=typeof e.alg||!e.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(void 0!==t&&t!==e.alg)throw new TypeError("JWK alg and alg option value mismatch");return mo(et(et({},e),{},{ext:n}));case"EC":case"OKP":return mo(et(et({},e),{},{alg:t,ext:n}));default:throw new Fn('Unsupported "kty" (Key Type) Parameter value')}}(et(et({},t),{},{ext:!0}),n);if(e instanceof Uint8Array||"public"!==e.type)throw new Bn("JSON Web Key Set members must be public keys");o[n]=e}return o[n]}function fr(e){const t=new hr(e),n=async(e,n)=>t.getKey(e,n);return Object.defineProperties(n,{jwks:{value:()=>structuredClone(t.jwks()),enumerable:!1,configurable:!1,writable:!1}}),n}let mr;if("undefined"==typeof navigator||null===(cr=navigator.userAgent)||void 0===cr||null===(ur=cr.startsWith)||void 0===ur||!ur.call(cr,"Mozilla/5.0 ")){const e="v6.1.3";mr="".concat("jose","/").concat(e)}const yr=Symbol(),wr=Symbol();var gr=new WeakMap,vr=new WeakMap,br=new WeakMap,_r=new WeakMap,kr=new WeakMap,Sr=new WeakMap,Er=new WeakMap,Tr=new WeakMap,Ar=new WeakMap,Pr=new WeakMap;class Rr{constructor(e,t){if(Xe(this,gr,void 0),Xe(this,vr,void 0),Xe(this,br,void 0),Xe(this,_r,void 0),Xe(this,kr,void 0),Xe(this,Sr,void 0),Xe(this,Er,void 0),Xe(this,Tr,void 0),Xe(this,Ar,void 0),Xe(this,Pr,void 0),!(e instanceof URL))throw new TypeError("url must be an instance of URL");var n,o;Ye(gr,this,new URL(e.href)),Ye(vr,this,"number"==typeof(null==t?void 0:t.timeoutDuration)?null==t?void 0:t.timeoutDuration:5e3),Ye(br,this,"number"==typeof(null==t?void 0:t.cooldownDuration)?null==t?void 0:t.cooldownDuration:3e4),Ye(_r,this,"number"==typeof(null==t?void 0:t.cacheMaxAge)?null==t?void 0:t.cacheMaxAge:6e5),Ye(Er,this,new Headers(null==t?void 0:t.headers)),mr&&!Be(Er,this).has("User-Agent")&&Be(Er,this).set("User-Agent",mr),Be(Er,this).has("accept")||(Be(Er,this).set("accept","application/json"),Be(Er,this).append("accept","application/jwk-set+json")),Ye(Tr,this,null==t?void 0:t[yr]),void 0!==(null==t?void 0:t[wr])&&(Ye(Pr,this,null==t?void 0:t[wr]),n=null==t?void 0:t[wr],o=Be(_r,this),"object"==typeof n&&null!==n&&"uat"in n&&"number"==typeof n.uat&&!(Date.now()-n.uat>=o)&&"jwks"in n&&co(n.jwks)&&Array.isArray(n.jwks.keys)&&Array.prototype.every.call(n.jwks.keys,co)&&(Ye(kr,this,Be(Pr,this).uat),Ye(Ar,this,fr(Be(Pr,this).jwks))))}pendingFetch(){return!!Be(Sr,this)}coolingDown(){return"number"==typeof Be(kr,this)&&Date.now()<Be(kr,this)+Be(br,this)}fresh(){return"number"==typeof Be(kr,this)&&Date.now()<Be(kr,this)+Be(_r,this)}jwks(){var e;return null===(e=Be(Ar,this))||void 0===e?void 0:e.jwks()}async getKey(e,t){Be(Ar,this)&&this.fresh()||await this.reload();try{return await Be(Ar,this).call(this,e,t)}catch(n){if(n instanceof Xn&&!1===this.coolingDown())return await this.reload(),Be(Ar,this).call(this,e,t);throw n}}async reload(){Be(Sr,this)&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&Ye(Sr,this,void 0),Be(Sr,this)||Ye(Sr,this,async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch;const r=await o(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch((e=>{if("TimeoutError"===e.name)throw new Qn;throw e}));if(200!==r.status)throw new Jn("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await r.json()}catch(e){throw new Jn("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(Be(gr,this).href,Be(Er,this),AbortSignal.timeout(Be(vr,this)),Be(Tr,this)).then((e=>{Ye(Ar,this,fr(e)),Be(Pr,this)&&(Be(Pr,this).uat=Date.now(),Be(Pr,this).jwks=e),Ye(kr,this,Date.now()),Ye(Sr,this,void 0)})).catch((e=>{throw Ye(Sr,this,void 0),e}))),await Be(Sr,this)}}const Ir=["mfaToken"],Or=["mfaToken"];var Cr,xr,jr,Dr,Lr,Ur,Kr,Nr,Wr=class extends Error{constructor(e,t){super(t),Qe(this,"code",void 0),this.name="NotSupportedError",this.code=e}},zr=class extends Error{constructor(e,t,n){super(t),Qe(this,"cause",void 0),Qe(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},Hr=class extends zr{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},Jr=class extends zr{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},Mr=class extends zr{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},Vr=class extends zr{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},Gr=class extends zr{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},Fr=class extends Error{constructor(e){super(e),Qe(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},Zr=class extends zr{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),Qe(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},qr=class extends zr{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},Br=class extends zr{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},Xr=class extends zr{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},Yr=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),Qe(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}};function Qr(e){return Object.entries(e).filter((e=>{let[,t]=e;return void 0!==t})).reduce(((e,t)=>et(et({},e),{},{[t[0]]:t[1]})),{})}var $r=class extends Error{constructor(e,t,n){super(t),Qe(this,"cause",void 0),Qe(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},ei=class extends $r{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},ti=class extends $r{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},ni=class extends $r{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},oi=class extends $r{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}};function ri(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var ii=(Cr=new WeakMap,xr=new WeakMap,jr=new WeakMap,class{constructor(e){var t;Xe(this,Cr,void 0),Xe(this,xr,void 0),Xe(this,jr,void 0),Ye(Cr,this,"https://".concat(e.domain)),Ye(xr,this,e.clientId),Ye(jr,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)})}async listAuthenticators(e){const t="".concat(Be(Cr,this),"/mfa/authenticators"),{mfaToken:n}=e,o=await Be(jr,this).call(this,t,{method:"GET",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!o.ok){const e=await o.json();throw new ei(e.error_description||"Failed to list authenticators",e)}return(await o.json()).map(ri)}async enrollAuthenticator(e){const t="".concat(Be(Cr,this),"/mfa/associate"),{mfaToken:n}=e,o=tt(e,Ir),r={authenticator_types:o.authenticatorTypes};"oobChannels"in o&&(r.oob_channels=o.oobChannels),"phoneNumber"in o&&o.phoneNumber&&(r.phone_number=o.phoneNumber),"email"in o&&o.email&&(r.email=o.email);const i=await Be(jr,this).call(this,t,{method:"POST",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const e=await i.json();throw new ti(e.error_description||"Failed to enroll authenticator",e)}return function(e){if("otp"===e.authenticator_type)return{authenticatorType:"otp",secret:e.secret,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes,id:e.id};if("oob"===e.authenticator_type)return{authenticatorType:"oob",oobChannel:e.oob_channel,oobCode:e.oob_code,bindingMethod:e.binding_method,id:e.id};throw new Error("Unexpected authenticator type: ".concat(e.authenticator_type))}(await i.json())}async deleteAuthenticator(e){const{authenticatorId:t,mfaToken:n}=e,o="".concat(Be(Cr,this),"/mfa/authenticators/").concat(encodeURIComponent(t)),r=await Be(jr,this).call(this,o,{method:"DELETE",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!r.ok){const e=await r.json();throw new ni(e.error_description||"Failed to delete authenticator",e)}}async challengeAuthenticator(e){const t="".concat(Be(Cr,this),"/mfa/challenge"),{mfaToken:n}=e,o=tt(e,Or),r={mfa_token:n,client_id:Be(xr,this),challenge_type:o.challengeType};o.authenticatorId&&(r.authenticator_id=o.authenticatorId);const i=await Be(jr,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const e=await i.json();throw new oi(e.error_description||"Failed to challenge authenticator",e)}return function(e){const t={challengeType:e.challenge_type};return void 0!==e.oob_code&&(t.oobCode=e.oob_code),void 0!==e.binding_method&&(t.bindingMethod=e.binding_method),t}(await i.json())}}),ai=class e{constructor(e,t,n,o,r,i,a){Qe(this,"accessToken",void 0),Qe(this,"idToken",void 0),Qe(this,"refreshToken",void 0),Qe(this,"expiresAt",void 0),Qe(this,"scope",void 0),Qe(this,"claims",void 0),Qe(this,"authorizationDetails",void 0),Qe(this,"tokenType",void 0),Qe(this,"issuedTokenType",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=r,this.claims=i,this.authorizationDetails=a}static fromTokenEndpointResponse(t){const n=t.id_token?t.claims():void 0,o=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return o.tokenType=t.token_type,o.issuedTokenType=t.issued_token_type,o}},si="openid profile email offline_access",ci=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function ui(e){if(null==e)throw new Gr("subject_token is required");if("string"!=typeof e)throw new Gr("subject_token must be a string");if(0===e.trim().length)throw new Gr("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new Gr("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new Gr("subject_token must not include the 'Bearer ' prefix")}function li(e,t){if(t)for(const[n,o]of Object.entries(t))if(!ci.has(n))if(Array.isArray(o)){if(o.length>20)throw new Gr("Parameter '".concat(n,"' exceeds maximum array size of ").concat(20));o.forEach((t=>{e.append(n,t)}))}else e.append(n,o)}var di=(Dr=new WeakMap,Lr=new WeakMap,Ur=new WeakMap,Kr=new WeakMap,Nr=new WeakSet,class{constructor(e){if(function(e,t){qe(e,t),t.add(e)}(this,Nr),Xe(this,Dr,void 0),Xe(this,Lr,void 0),Xe(this,Ur,void 0),Xe(this,Kr,void 0),Qe(this,"mfa",void 0),Ye(Ur,this,e),e.useMtls&&!e.customFetch)throw new Wr("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");this.mfa=new ii({domain:Be(Ur,this).domain,clientId:Be(Ur,this).clientId,customFetch:Be(Ur,this).customFetch})}async buildAuthorizationUrl(e){const{serverMetadata:t}=await Fe(Nr,this,hi).call(this);if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new Wr("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await Fe(Nr,this,yi).call(this,e)}catch(e){throw new qr(e)}}async buildLinkUserUrl(e){try{const t=await Fe(Nr,this,yi).call(this,{authorizationParams:et(et({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new Br(e)}}async buildUnlinkUserUrl(e){try{const t=await Fe(Nr,this,yi).call(this,{authorizationParams:et(et({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new Xr(e)}}async backchannelAuthentication(e){const{configuration:t,serverMetadata:n}=await Fe(Nr,this,hi).call(this),o=Qr(et(et({},Be(Ur,this).authorizationParams),null==e?void 0:e.authorizationParams)),r=new URLSearchParams(et(et({scope:si},o),{},{client_id:Be(Ur,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&r.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&r.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Jo(t,r),n=await Mo(t,e);return ai.fromTokenEndpointResponse(n)}catch(e){throw new Zr(e)}}async initiateBackchannelAuthentication(e){const{configuration:t,serverMetadata:n}=await Fe(Nr,this,hi).call(this),o=Qr(et(et({},Be(Ur,this).authorizationParams),null==e?void 0:e.authorizationParams)),r=new URLSearchParams(et(et({scope:si},o),{},{client_id:Be(Ur,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&r.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&r.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Jo(t,r);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(e){throw new Zr(e)}}async backchannelAuthenticationGrant(e){let{authReqId:t}=e;const{configuration:n}=await Fe(Nr,this,hi).call(this),o=new URLSearchParams({auth_req_id:t});try{const e=await er(n,"urn:openid:params:grant-type:ciba",o);return ai.fromTokenEndpointResponse(e)}catch(e){throw new Zr(e)}}async getTokenForConnection(e){var t;if(e.refreshToken&&e.accessToken)throw new Vr("Either a refresh or access token should be specified, but not both.");const n=null!==(t=e.accessToken)&&void 0!==t?t:e.refreshToken;if(!n)throw new Vr("Either a refresh or access token must be specified.");try{return await this.exchangeToken({connection:e.connection,subjectToken:n,subjectTokenType:e.accessToken?"urn:ietf:params:oauth:token-type:access_token":"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint})}catch(e){if(e instanceof Gr)throw new Vr(e.message,e.cause);throw e}}async exchangeToken(e){return"connection"in e?Fe(Nr,this,pi).call(this,e):Fe(Nr,this,fi).call(this,e)}async getTokenByCode(e,t){const{configuration:n}=await Fe(Nr,this,hi).call(this);try{const o=await Go(n,e,{pkceCodeVerifier:t.codeVerifier});return ai.fromTokenEndpointResponse(o)}catch(e){throw new Hr("There was an error while trying to request a token.",e)}}async getTokenByRefreshToken(e){const{configuration:t}=await Fe(Nr,this,hi).call(this);try{const n=await Fo(t,e.refreshToken);return ai.fromTokenEndpointResponse(n)}catch(e){throw new Mr("The access token has expired and there was an error while trying to refresh it.",e)}}async getTokenByClientCredentials(e){const{configuration:t}=await Fe(Nr,this,hi).call(this);try{const n=new URLSearchParams({audience:e.audience});e.organization&&n.append("organization",e.organization);const o=await Zo(t,n);return ai.fromTokenEndpointResponse(o)}catch(e){throw new Jr("There was an error while trying to request a token.",e)}}async buildLogoutUrl(e){const{configuration:t,serverMetadata:n}=await Fe(Nr,this,hi).call(this);if(!n.end_session_endpoint){const t=new URL("https://".concat(Be(Ur,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",Be(Ur,this).clientId),t}return function(e,t){Xo(e);const{as:n,c:o,tlsOnly:r}=To(e),i=zt(n,"end_session_endpoint",!1,r);(t=new URLSearchParams(t)).has("client_id")||t.set("client_id",o.client_id);for(const[e,n]of t.entries())i.searchParams.append(e,n);return i}(t,{post_logout_redirect_uri:e.returnTo})}async verifyLogoutToken(e){const{serverMetadata:t}=await Fe(Nr,this,hi).call(this);Be(Kr,this)||Ye(Kr,this,function(e,t){const n=new Rr(e,t),o=async(e,t)=>n.getKey(e,t);return Object.defineProperties(o,{coolingDown:{get:()=>n.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>n.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>n.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>n.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>n.jwks(),enumerable:!0,configurable:!1,writable:!1}}),o}(new URL(t.jwks_uri),{[yr]:Be(Ur,this).customFetch}));const{payload:n}=await ar(e.logoutToken,Be(Kr,this),{issuer:t.issuer,audience:Be(Ur,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]});if(!("sid"in n)&&!("sub"in n))throw new Fr('either "sid" or "sub" (or both) claims must be present');if("sid"in n&&"string"!=typeof n.sid)throw new Fr('"sid" claim must be a string');if("sub"in n&&"string"!=typeof n.sub)throw new Fr('"sub" claim must be a string');if("nonce"in n)throw new Fr('"nonce" claim is prohibited');if(!("events"in n))throw new Fr('"events" claim is missing');if("object"!=typeof n.events||null===n.events)throw new Fr('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in n.events))throw new Fr('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof n.events["http://schemas.openid.net/event/backchannel-logout"])throw new Fr('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:n.sid,sub:n.sub}}});async function hi(){if(Be(Dr,this)&&Be(Lr,this))return{configuration:Be(Dr,this),serverMetadata:Be(Lr,this)};const e=await Fe(Nr,this,mi).call(this);return Ye(Dr,this,await Uo(new URL("https://".concat(Be(Ur,this).domain)),Be(Ur,this).clientId,{use_mtls_endpoint_aliases:Be(Ur,this).useMtls},e,{[Io]:Be(Ur,this).customFetch})),Ye(Lr,this,Be(Dr,this).serverMetadata()),Be(Dr,this)[Io]=Be(Ur,this).customFetch||fetch,{configuration:Be(Dr,this),serverMetadata:Be(Lr,this)}}async function pi(e){var t,n;const{configuration:o}=await Fe(Nr,this,hi).call(this);if("audience"in e||"resource"in e)throw new Gr("audience and resource parameters are not supported for Token Vault exchanges");ui(e.subjectToken);const r=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!==(t=e.subjectTokenType)&&void 0!==t?t:"urn:ietf:params:oauth:token-type:access_token",requested_token_type:null!==(n=e.requestedTokenType)&&void 0!==n?n:"http://auth0.com/oauth/token-type/federated-connection-access-token"});e.loginHint&&r.append("login_hint",e.loginHint),e.scope&&r.append("scope",e.scope),li(r,e.extra);try{const e=await er(o,"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",r);return ai.fromTokenEndpointResponse(e)}catch(t){throw new Gr("Failed to exchange token for connection '".concat(e.connection,"'."),t)}}async function fi(e){const{configuration:t}=await Fe(Nr,this,hi).call(this);ui(e.subjectToken);const n=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),e.requestedTokenType&&n.append("requested_token_type",e.requestedTokenType),e.organization&&n.append("organization",e.organization),li(n,e.extra);try{const e=await er(t,"urn:ietf:params:oauth:grant-type:token-exchange",n);return ai.fromTokenEndpointResponse(e)}catch(t){throw new Gr("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),t)}}async function mi(){if(!Be(Ur,this).clientSecret&&!Be(Ur,this).clientAssertionSigningKey&&!Be(Ur,this).useMtls)throw new Yr;if(Be(Ur,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let e=Be(Ur,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await async function(e,t){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return fo(e,t,void 0)}(e,Be(Ur,this).clientAssertionSigningAlg||"RS256")),e?function(e){return Ut(e,void 0)}(e):Ro(Be(Ur,this).clientSecret)}async function yi(e){const{configuration:t}=await Fe(Nr,this,hi).call(this),n=Rt(),o=await function(e){return async function(e){return At(e,"codeVerifier"),wt(await crypto.subtle.digest("SHA-256",ft(e)))}(e)}(n),r=Qr(et(et({},Be(Ur,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(et(et({scope:si},r),{},{client_id:Be(Ur,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await Bo(t,i):await qo(t,i),codeVerifier:n}}const wi=new b;class gi{constructor(e){let t,n;if(this.userCache=(new pe).enclosedCache,this.activeLockKeys=new Set,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0},this._releaseLockOnPageHide=async()=>{const e=Array.from(this.activeLockKeys);for(const t of e)await wi.releaseLock(t);this.activeLockKeys.clear(),window.removeEventListener("pagehide",this._releaseLockOnPageHide)},this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!U())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===U().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||"memory",!je(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=je(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:1e4,this.cookieStorage=!1===e.legacySameSiteCookie?Ee:Te,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieName=(e=>"auth0.".concat(e,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const r=e.useCookiesForTransactions?this.cookieStorage:Ae;var i;this.scope=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if("object"!=typeof e)return{default:ue(t,e,...o)};let i={default:ue(t,...o)};return Object.keys(e).forEach((n=>{const r=e[n];i[n]=ue(t,r,...o)})),i}(this.options.authorizationParams.scope,"openid",this.options.useRefreshTokens?"offline_access":""),this.transactionManager=new me(r,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||S,this.cacheManager=new fe(n,n.allKeys?void 0:new Ce(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new Ne(this.options.clientId):void 0,this.domainUrl=(i=this.options.domain,/^https?:\/\//.test(i)?i:"https://".concat(i)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);const a="".concat(this.domainUrl,"/me/"),s=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:()=>this.getTokenSilently({authorizationParams:{scope:"create:me:connected_accounts",audience:a},detailedResponse:!0})}));this.myAccountApi=new Me(s,a),this.authJsClient=new di({domain:this.options.domain,clientId:this.options.clientId}),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&"memory"===t&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new Re)}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const t=encodeURIComponent(btoa(JSON.stringify(this.options.auth0Client||k)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(t)}_authorizeUrl(e){return this._url("/authorize?".concat(H(e)))}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),[n,o,r]=t;if(3!==t.length||!n||!o||!r)throw new Error("ID token could not be decoded");const i=JSON.parse(M(o)),a={__raw:e},s={};return Object.keys(i).forEach((e=>{a[e]=i[e],we.includes(e)||(s[e]=i[e])})),{encoded:{header:n,payload:o,signature:r},header:JSON.parse(M(n)),claims:a,user:s}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&!ye(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!ye(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!ye(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(t.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(null!=t.claims.nbf&&ye(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(e))}if(null!=t.claims.auth_time&&ye(t.claims.auth_time)){const r=new Date(0);if(r.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>r)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(r))}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_id,'"'))}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(r=this.options.authorizationParams.max_age,"string"!=typeof r?r:parseInt(r,10)||void 0),now:o});var r}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}async _prepareAuthorizeUrl(e,t,n){var o;const r=N(K()),i=N(K()),a=K(),s=await J(a),c=V(s),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),l=((e,t,n,o,r,i,a,s,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:le(t,n.scope,n.audience),response_type:"code",response_mode:s||"query",state:o,nonce:r,redirect_uri:a||e.authorizationParams.redirect_uri,code_challenge:i,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,r,i,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),d=this._authorizeUrl(l);return{nonce:i,code_verifier:a,scope:l.scope,audience:l.audience||"default",redirect_uri:l.redirect_uri,state:r,url:d}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup","left=".concat(e,",top=").concat(t,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(),!t.popup))throw new O;const o=await this._prepareAuthorizeUrl(e.authorizationParams||{},{response_mode:"web_message"},window.location.origin);t.popup.location.href=o.url;const r=await(e=>new Promise(((t,n)=>{let o;const r=setInterval((()=>{e.popup&&e.popup.closed&&(clearInterval(r),clearTimeout(i),window.removeEventListener("message",o,!1),n(new I(e.popup)))}),1e3),i=setTimeout((()=>{clearInterval(r),n(new R(e.popup)),window.removeEventListener("message",o,!1)}),1e3*(e.timeoutInSeconds||60));o=function(a){if(a.data&&"authorization_response"===a.data.type){if(clearTimeout(i),clearInterval(r),window.removeEventListener("message",o,!1),!1!==e.closePopup&&e.popup.close(),a.data.response.error)return n(E.fromPayload(a.data.response));t(a.data.response)}},window.addEventListener("message",o)})))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}));if(o.state!==r.state)throw new E("state_mismatch","Invalid state");const i=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:o.audience,scope:o.scope,code_verifier:o.code_verifier,grant_type:"authorization_code",code:r.code,redirect_uri:o.redirect_uri},{nonceIn:o.nonce,organization:i})}async getUser(){var e;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(){var t;const n=De(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),{openUrl:o,fragment:r,appState:i}=n,a=s(n,["openUrl","fragment","appState"]),c=(null===(t=a.authorizationParams)||void 0===t?void 0:t.organization)||this.options.authorizationParams.organization,u=await this._prepareAuthorizeUrl(a.authorizationParams||{}),{url:l}=u,d=s(u,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},d),{appState:i,response_type:e.ResponseType.Code}),c&&{organization:c}));const h=r?"".concat(l,"#").concat(r):l;o?await o(h):window.location.assign(h)}async handleRedirectCallback(){const t=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===t.length)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new E("missing_transaction","Invalid state");this.transactionManager.remove();const o=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(t.join(""));return n.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(t,n){const{code:o,state:r,error:i,error_description:a}=t;if(i)throw new T(i,a||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new E("state_mismatch","Invalid state");const s=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:s}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const{connect_code:o,state:r,error:i,error_description:a}=t;if(i)throw new A(i,a||i,n.connection,r,n.appState);if(!o)throw new E("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new E("state_mismatch","Invalid state");const s=await this.myAccountApi.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},s),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get("auth0.is.authenticated"))return;this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove("auth0.is.authenticated")}try{await this.getTokenSilently(e)}catch(e){}}async getTokenSilently(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:le(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),r=await((e,t)=>{let n=Ie[t];return n||(n=e().finally((()=>{delete Ie[t],n=null})),Ie[t]=n),n})((()=>this._getTokenSilently(o)),"".concat(this.options.clientId,"::").concat(o.authorizationParams.audience,"::").concat(o.authorizationParams.scope));return e.detailedResponse?r:null==r?void 0:r.access_token}async _getTokenSilently(e){const{cacheMode:t}=e,n=s(e,["cacheMode"]);if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||"default",clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=(r=this.options.clientId,i=n.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(r,".").concat(i));var r,i;if(!await Oe((()=>wi.acquireLock(o,5e3)),10))throw new P;this.activeLockKeys.add(o),1===this.activeLockKeys.size&&window.addEventListener("pagehide",this._releaseLockOnPageHide);try{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||"default",clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),{id_token:o,token_type:r,access_token:i,oauthTokenScope:a,expires_in:s}=e;return Object.assign(Object.assign({id_token:o,token_type:r,access_token:i},a?{scope:a}:null),{expires_in:s})}finally{await wi.releaseLock(o),this.activeLockKeys.delete(o),0===this.activeLockKeys.size&&window.removeEventListener("pagehide",this._releaseLockOnPageHide)}}async getTokenWithPopup(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};var n,o;const r=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:le(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},_),t),await this.loginWithPopup(r,t),(await this.cacheManager.get(new de({scope:r.authorizationParams.scope,audience:r.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},{federated:n}=t,o=s(t,["federated"]),r=n?"&federated":"";return this._url("/v2/logout?".concat(H(Object.assign({clientId:e.clientId},o))))+r}async logout(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t;const n=De(e),{openUrl:o}=n,r=s(n,["openUrl"]);null===e.clientId?await this.cacheManager.clear():await this.cacheManager.clear(e.clientId||this.options.clientId),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove("@@user@@"),await(null===(t=this.dpop)||void 0===t?void 0:t.clear());const i=this._buildLogoutUrl(r);o?await o(i):!1!==o&&window.location.assign(i)}async _getTokenFromIFrame(e){const t=(n=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(n));var n;if(!await Oe((()=>wi.acquireLock(t,5e3)),10))throw new P;try{const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const{url:o,state:r,nonce:i,code_verifier:a,redirect_uri:s,scope:c,audience:u}=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin);if(window.crossOriginIsolated)throw new E("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const l=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let d;try{d=new URL(this.domainUrl).origin}catch(e){d=this.domainUrl}const h=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise(((o,r)=>{const i=window.document.createElement("iframe");i.setAttribute("width","0"),i.setAttribute("height","0"),i.style.display="none";const a=()=>{window.document.body.contains(i)&&(window.document.body.removeChild(i),window.removeEventListener("message",s,!1))};let s;const c=setTimeout((()=>{r(new P),a()}),1e3*n);s=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?r(E.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",s,!1),setTimeout(a,2e3)},window.addEventListener("message",s,!1),window.document.body.appendChild(i),i.setAttribute("src",e)}))}(o,d,l);if(r!==h.state)throw new E("state_mismatch","Invalid state");const p=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:a,code:h.code,grant_type:"authorization_code",redirect_uri:s,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:i,organization:t.organization});return Object.assign(Object.assign({},p),{scope:c,oauthTokenScope:p.scope,audience:u})}catch(e){throw"login_required"===e.error&&this.logout({openUrl:!1}),e}finally{await wi.releaseLock(t)}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new de({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new x(e.authorizationParams.audience||"default",e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,r=((e,t,n,o)=>{var r;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),i=(null===(r=t.scope)||void 0===r?void 0:r.split(" "))||[],a=i.every((t=>e.includes(t)));return e.length>=i.length&&a?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:r});if(u.refresh_token&&(null==t?void 0:t.refresh_token)&&await this.cacheManager.updateEntry(t.refresh_token,u.refresh_token),this.options.useMrrt&&!(i=null==t?void 0:t.audience,a=null==t?void 0:t.scope,s=e.authorizationParams.audience,c=e.authorizationParams.scope,i===s&&Le(c,a)||Le(r,u.scope))){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope);const t=((e,t)=>{const n=(null==e?void 0:e.split(" "))||[],o=(null==t?void 0:t.split(" "))||[];return n.filter((e=>-1==o.indexOf(e))).join(",")})(r,u.scope);throw new j(e.authorizationParams.audience||"default",t)}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||"default"})}catch(t){if((t.message.indexOf("Missing Refresh Token")>-1||t.message&&t.message.indexOf("invalid refresh token")>-1)&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw t}var i,a,s,c}async _saveEntryInCache(e){const{id_token:t,decodedToken:n}=e,o=s(e,["id_token","decodedToken"]);this.userCache.set("@@user@@",{id_token:t,decodedToken:n}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(o)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||"default",t=this.scope[e],n=await this.cacheManager.getIdToken(new de({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get("@@user@@");return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set("@@user@@",n),n)}async _getEntryFromCache(e){let{scope:t,audience:n,clientId:o,cacheMode:r}=e;const i=await this.cacheManager.get(new de({scope:t,audience:n,clientId:o}),60,this.options.useMrrt,r);if(i&&i.access_token){const{token_type:e,access_token:t,oauthTokenScope:n,expires_in:o}=i,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}async _requestToken(e,t){var n,o;const{nonceIn:r,organization:i,scopesToRequest:a}=t||{},s=await ce(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop},e),{scope:a||e.scope}),this.worker),c=await this._verifyIdToken(s.id_token,r,i);if("authorization_code"===e.grant_type){const e=await this._getIdTokenFromCache();(null===(o=null===(n=null==e?void 0:e.decodedToken)||void 0===n?void 0:n.claims)||void 0===o?void 0:o.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove("@@user@@"))}return await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},s),{decodedToken:c,scope:e.scope,audience:e.audience||"default"}),s.scope?{oauthTokenScope:s.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(i||c.claims.org_id),Object.assign(Object.assign({},s),{decodedToken:c})}async exchangeToken(e){return this._requestToken({grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type,scope:le(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new Je(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const{openUrl:n,appState:o,connection:r,scopes:i,authorization_params:a,redirectUri:s=this.options.authorizationParams.redirect_uri||window.location.origin}=t;if(!r)throw new Error("connection is required");const c=N(K()),u=K(),l=await J(u),d=V(l),{connect_uri:h,connect_params:p,auth_session:f}=await this.myAccountApi.connectAccount({connection:r,scopes:i,redirect_uri:s,state:c,code_challenge:d,code_challenge_method:"S256",authorization_params:a});this.transactionManager.create({state:c,code_verifier:u,auth_session:f,redirect_uri:s,appState:o,connection:r,response_type:e.ResponseType.ConnectCode});const m=new URL(h);m.searchParams.set("ticket",p.ticket),n?await n(m.toString()):window.location.assign(m)}}var vi={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},bi=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},_i=o(o({},vi),{buildAuthorizeUrl:bi,buildLogoutUrl:bi,getAccessTokenSilently:bi,getAccessTokenWithPopup:bi,getIdTokenClaims:bi,exchangeToken:bi,loginWithRedirect:bi,loginWithPopup:bi,connectAccountWithRedirect:bi,logout:bi,handleRedirectCallback:bi,getDpopNonce:bi,setDpopNonce:bi,generateDpopProof:bi,createFetcher:bi,getConfiguration:bi}),ki=t.createContext(_i),Si=function(e){function t(n,o){var r=e.call(this,null!=o?o:n)||this;return r.error=n,r.error_description=o,Object.setPrototypeOf(r,t.prototype),r}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),Ei=/[?&](?:connect_)?code=[^&]+/,Ti=/[?&]state=[^&]+/,Ai=/[?&]error=[^&]+/,Pi=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new Si(n.error,n.error_description)}return new Si(t.error)}return new Error(e)}},Ri=Pi("Login failed"),Ii=Pi("Get access token failed"),Oi=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},Ci=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},xi=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},ji=function(e){return void 0===e&&(e=ki),t.useContext(e)},Di=function(){return t.createElement(t.Fragment,null)},Li=function(){return i(void 0,void 0,void 0,(function(){return a(this,(function(e){return[2]}))}))},Ui=function(){return"".concat(window.location.pathname).concat(window.location.search)};e.Auth0Context=ki,e.Auth0Provider=function(n){var s=n.children,c=n.skipRedirectCallback,u=n.onRedirectCallback,l=void 0===u?xi:u,d=n.context,h=void 0===d?ki:d,p=r(n,["children","skipRedirectCallback","onRedirectCallback","context"]),f=t.useState((function(){return new gi(function(e){return Oi(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.12.0"}})}(p))}))[0],m=t.useReducer(Ci,vi),y=m[0],w=m[1],g=t.useRef(!1),v=t.useCallback((function(e){return w({type:"ERROR",error:e}),e}),[]);t.useEffect((function(){g.current||(g.current=!0,i(void 0,void 0,void 0,(function(){var t,n,o,i,s,u,d;return a(this,(function(a){switch(a.label){case 0:return a.trys.push([0,7,,8]),t=void 0,void 0===h&&(h=window.location.search),!Ei.test(h)&&!Ai.test(h)||!Ti.test(h)||c?[3,3]:[4,f.handleRedirectCallback()];case 1:return n=a.sent(),o=n.appState,i=void 0===o?{}:o,s=n.response_type,u=r(n,["appState","response_type"]),[4,f.getUser()];case 2:return t=a.sent(),i.response_type=s,s===e.ResponseType.ConnectCode&&(i.connectedAccount=u),l(i,t),[3,6];case 3:return[4,f.checkSession()];case 4:return a.sent(),[4,f.getUser()];case 5:t=a.sent(),a.label=6;case 6:return w({type:"INITIALISED",user:t}),[3,8];case 7:return d=a.sent(),v(Ri(d)),[3,8];case 8:return[2]}var h}))})))}),[f,l,c,v]);var b=t.useCallback((function(e){return Oi(e),f.loginWithRedirect(e)}),[f]),_=t.useCallback((function(e,t){return i(void 0,void 0,void 0,(function(){var n,o;return a(this,(function(r){switch(r.label){case 0:w({type:"LOGIN_POPUP_STARTED"}),r.label=1;case 1:return r.trys.push([1,3,,4]),[4,f.loginWithPopup(e,t)];case 2:return r.sent(),[3,4];case 3:return n=r.sent(),v(Ri(n)),[2];case 4:return[4,f.getUser()];case 5:return o=r.sent(),w({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}}))}))}),[f,v]),k=t.useCallback((function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return i(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,r=0,i=t.length;r<i;r++)!o&&r in t||(o||(o=Array.prototype.slice.call(t,0,r)),o[r]=t[r]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,(function(e){return void 0===e&&(e={}),a(this,(function(t){switch(t.label){case 0:return[4,f.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&w({type:"LOGOUT"}),[2]}}))}))}),[f]),S=t.useCallback((function(e){return i(void 0,void 0,void 0,(function(){var t,n,o,r;return a(this,(function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,f.getTokenSilently(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),Ii(n);case 3:return o=w,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}}))}))}),[f]),E=t.useCallback((function(e,t){return i(void 0,void 0,void 0,(function(){var n,o,r,i;return a(this,(function(a){switch(a.label){case 0:return a.trys.push([0,2,3,5]),[4,f.getTokenWithPopup(e,t)];case 1:return n=a.sent(),[3,5];case 2:throw o=a.sent(),Ii(o);case 3:return r=w,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return r.apply(void 0,[(i.user=a.sent(),i)]),[7];case 5:return[2,n]}}))}))}),[f]),T=t.useCallback((function(e){return f.connectAccountWithRedirect(e)}),[f]),A=t.useCallback((function(){return f.getIdTokenClaims()}),[f]),P=t.useCallback((function(e){return i(void 0,void 0,void 0,(function(){var t,n,o,r;return a(this,(function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,f.exchangeToken(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),Ii(n);case 3:return o=w,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,f.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}}))}))}),[f]),R=t.useCallback((function(e){return i(void 0,void 0,void 0,(function(){var t,n,o;return a(this,(function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,f.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw t=r.sent(),Ii(t);case 3:return n=w,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,f.getUser()];case 4:return n.apply(void 0,[(o.user=r.sent(),o)]),[7];case 5:return[2]}}))}))}),[f]),I=t.useCallback((function(e){return f.getDpopNonce(e)}),[f]),O=t.useCallback((function(e,t){return f.setDpopNonce(e,t)}),[f]),C=t.useCallback((function(e){return f.generateDpopProof(e)}),[f]),x=t.useCallback((function(e){return f.createFetcher(e)}),[f]),j=t.useCallback((function(){return f.getConfiguration()}),[f]),D=t.useMemo((function(){return o(o({},y),{getAccessTokenSilently:S,getAccessTokenWithPopup:E,getIdTokenClaims:A,exchangeToken:P,loginWithRedirect:b,loginWithPopup:_,connectAccountWithRedirect:T,logout:k,handleRedirectCallback:R,getDpopNonce:I,setDpopNonce:O,generateDpopProof:C,createFetcher:x,getConfiguration:j})}),[y,S,E,A,P,b,_,T,k,R,I,O,C,x,j]);return t.createElement(h.Provider,{value:D},s)},e.AuthenticationError=T,e.ConnectError=A,e.GenericError=E,e.InMemoryCache=pe,e.LocalStorageCache=he,e.MfaRequiredError=C,e.MissingRefreshTokenError=x,e.OAuthError=Si,e.PopupCancelledError=I,e.PopupTimeoutError=R,e.TimeoutError=P,e.UseDpopNonceError=D,e.User=class{},e.initialContext=_i,e.useAuth0=ji,e.withAuth0=function(e,n){return void 0===n&&(n=ki),function(r){return t.createElement(n.Consumer,null,(function(n){return t.createElement(e,o({},r,{auth0:n}))}))}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(r){var s=this,c=n.returnTo,u=void 0===c?Ui:c,l=n.onRedirecting,d=void 0===l?Di:l,h=n.onBeforeAuthentication,p=void 0===h?Li:h,f=n.loginOptions,m=n.context,y=ji(void 0===m?ki:m),w=y.isAuthenticated,g=y.isLoading,v=y.loginWithRedirect;return t.useEffect((function(){if(!g&&!w){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});i(s,void 0,void 0,(function(){return a(this,(function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,v(e)];case 2:return t.sent(),[2]}}))}))}}),[g,w,v,p,f,u]),w?t.createElement(e,o({},r)):d()}}}));
2
2
  //# sourceMappingURL=auth0-react.min.js.map