@auth0/auth0-spa-js 2.4.1 → 2.6.0

package/dist/lib/auth0-spa-js.cjs.js

@@ -550,7 +550,7 @@ var browserTabsLock = createCommonjsModule((function(module, exports) {
 
 var Lock = unwrapExports(browserTabsLock);
 
-var version = "2.4.1";
+var version = "2.6.0";
 
 const DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS = 60;
 
@@ -602,6 +602,16 @@ class AuthenticationError extends GenericError {
     }
 }
 
+class ConnectError extends GenericError {
+    constructor(error, error_description, connection, state, appState = null) {
+        super(error, error_description);
+        this.connection = connection;
+        this.state = state;
+        this.appState = appState;
+        Object.setPrototypeOf(this, ConnectError.prototype);
+    }
+}
+
 class TimeoutError extends GenericError {
     constructor() {
         super("timeout", "Timeout");
@@ -662,6 +672,7 @@ const parseAuthenticationResult = queryString => {
     return {
         state: searchParams.get("state"),
         code: searchParams.get("code") || undefined,
+        connect_code: searchParams.get("connect_code") || undefined,
         error: searchParams.get("error") || undefined,
         error_description: searchParams.get("error_description") || undefined
     };
@@ -1200,7 +1211,7 @@ const fetchWithoutWorker = async (fetchUrl, fetchOptions, timeout) => {
     }));
 };
 
-const fetchWithWorker = async (fetchUrl, audience, scope, fetchOptions, timeout, worker, useFormData) => sendMessage({
+const fetchWithWorker = async (fetchUrl, audience, scope, fetchOptions, timeout, worker, useFormData, useMrrt) => sendMessage({
     auth: {
         audience: audience,
         scope: scope
@@ -1208,18 +1219,19 @@ const fetchWithWorker = async (fetchUrl, audience, scope, fetchOptions, timeout,
     timeout: timeout,
     fetchUrl: fetchUrl,
     fetchOptions: fetchOptions,
-    useFormData: useFormData
+    useFormData: useFormData,
+    useMrrt: useMrrt
 }, worker);
 
-const switchFetch = async (fetchUrl, audience, scope, fetchOptions, worker, useFormData, timeout = DEFAULT_FETCH_TIMEOUT_MS) => {
+const switchFetch = async (fetchUrl, audience, scope, fetchOptions, worker, useFormData, timeout = DEFAULT_FETCH_TIMEOUT_MS, useMrrt) => {
     if (worker) {
-        return fetchWithWorker(fetchUrl, audience, scope, fetchOptions, timeout, worker, useFormData);
+        return fetchWithWorker(fetchUrl, audience, scope, fetchOptions, timeout, worker, useFormData, useMrrt);
     } else {
         return fetchWithoutWorker(fetchUrl, fetchOptions, timeout);
     }
 };
 
-async function getJSON(url, timeout, audience, scope, options, worker, useFormData, dpop, isDpopRetry) {
+async function getJSON(url, timeout, audience, scope, options, worker, useFormData, useMrrt, dpop, isDpopRetry) {
     if (dpop) {
         const dpopProof = await dpop.generateProof({
             url: url,
@@ -1234,7 +1246,7 @@ async function getJSON(url, timeout, audience, scope, options, worker, useFormDa
     let response;
     for (let i = 0; i < DEFAULT_SILENT_TOKEN_RETRY_COUNT; i++) {
         try {
-            response = await switchFetch(url, audience, scope, options, worker, useFormData, timeout);
+            response = await switchFetch(url, audience, scope, options, worker, useFormData, timeout, useMrrt);
             fetchError = null;
             break;
         } catch (e) {
@@ -1264,7 +1276,7 @@ async function getJSON(url, timeout, audience, scope, options, worker, useFormDa
             if (!dpop || !newDpopNonce || isDpopRetry) {
                 throw new UseDpopNonceError(newDpopNonce);
             }
-            return getJSON(url, timeout, audience, scope, options, worker, useFormData, dpop, true);
+            return getJSON(url, timeout, audience, scope, options, worker, useFormData, useMrrt, dpop, true);
         }
         throw new GenericError(error || "request_error", errorMessage);
     }
@@ -1272,12 +1284,16 @@ async function getJSON(url, timeout, audience, scope, options, worker, useFormDa
 }
 
 async function oauthToken(_a, worker) {
-    var {baseUrl: baseUrl, timeout: timeout, audience: audience, scope: scope, auth0Client: auth0Client, useFormData: useFormData, dpop: dpop} = _a, options = __rest(_a, [ "baseUrl", "timeout", "audience", "scope", "auth0Client", "useFormData", "dpop" ]);
+    var {baseUrl: baseUrl, timeout: timeout, audience: audience, scope: scope, auth0Client: auth0Client, useFormData: useFormData, useMrrt: useMrrt, dpop: dpop} = _a, options = __rest(_a, [ "baseUrl", "timeout", "audience", "scope", "auth0Client", "useFormData", "useMrrt", "dpop" ]);
     const isTokenExchange = options.grant_type === "urn:ietf:params:oauth:grant-type:token-exchange";
-    const allParams = Object.assign(Object.assign(Object.assign({}, options), isTokenExchange && audience && {
+    const refreshWithMrrt = options.grant_type === "refresh_token" && useMrrt;
+    const allParams = Object.assign(Object.assign(Object.assign(Object.assign({}, options), isTokenExchange && audience && {
         audience: audience
     }), isTokenExchange && scope && {
         scope: scope
+    }), refreshWithMrrt && {
+        audience: audience,
+        scope: scope
     });
     const body = useFormData ? createQueryParams(allParams) : JSON.stringify(allParams);
     const isDpopSupported = isGrantTypeSupported(options.grant_type);
@@ -1288,7 +1304,7 @@ async function oauthToken(_a, worker) {
             "Content-Type": useFormData ? "application/x-www-form-urlencoded" : "application/json",
             "Auth0-Client": btoa(JSON.stringify(auth0Client || DEFAULT_AUTH0_CLIENT))
         }
-    }, worker, useFormData, isDpopSupported ? dpop : undefined);
+    }, worker, useFormData, useMrrt, isDpopSupported ? dpop : undefined);
 }
 
 const dedupe = arr => Array.from(new Set(arr));
@@ -1416,7 +1432,7 @@ class CacheManager {
             decodedToken: entry.decodedToken
         };
     }
-    async get(cacheKey, expiryAdjustmentSeconds = DEFAULT_EXPIRY_ADJUSTMENT_SECONDS) {
+    async get(cacheKey, expiryAdjustmentSeconds = DEFAULT_EXPIRY_ADJUSTMENT_SECONDS, useMrrt = false, cacheMode) {
         var _a;
         let wrappedEntry = await this.cache.get(cacheKey.toKey());
         if (!wrappedEntry) {
@@ -1426,6 +1442,9 @@ class CacheManager {
             if (matchedKey) {
                 wrappedEntry = await this.cache.get(matchedKey);
             }
+            if (!matchedKey && useMrrt && cacheMode !== "cache-only") {
+                return this.getEntryWithRefreshToken(cacheKey, keys);
+            }
         }
         if (!wrappedEntry) {
             return;
@@ -1434,11 +1453,7 @@ class CacheManager {
         const nowSeconds = Math.floor(now / 1e3);
         if (wrappedEntry.expiresAt - expiryAdjustmentSeconds < nowSeconds) {
             if (wrappedEntry.body.refresh_token) {
-                wrappedEntry.body = {
-                    refresh_token: wrappedEntry.body.refresh_token
-                };
-                await this.cache.set(cacheKey.toKey(), wrappedEntry);
-                return wrappedEntry.body;
+                return this.modifiedCachedEntry(wrappedEntry, cacheKey);
             }
             await this.cache.remove(cacheKey.toKey());
             await ((_a = this.keyManifest) === null || _a === void 0 ? void 0 : _a.remove(cacheKey.toKey()));
@@ -1446,6 +1461,19 @@ class CacheManager {
         }
         return wrappedEntry.body;
     }
+    async modifiedCachedEntry(wrappedEntry, cacheKey) {
+        wrappedEntry.body = {
+            refresh_token: wrappedEntry.body.refresh_token,
+            audience: wrappedEntry.body.audience,
+            scope: wrappedEntry.body.scope
+        };
+        await this.cache.set(cacheKey.toKey(), wrappedEntry);
+        return {
+            refresh_token: wrappedEntry.body.refresh_token,
+            audience: wrappedEntry.body.audience,
+            scope: wrappedEntry.body.scope
+        };
+    }
     async set(entry) {
         var _a;
         const cacheKey = new CacheKey({
@@ -1498,6 +1526,33 @@ class CacheManager {
             return cacheKey.prefix === CACHE_KEY_PREFIX && cacheKey.clientId === keyToMatch.clientId && cacheKey.audience === keyToMatch.audience && hasAllScopes;
         }))[0];
     }
+    async getEntryWithRefreshToken(keyToMatch, allKeys) {
+        var _a;
+        for (const key of allKeys) {
+            const cacheKey = CacheKey.fromKey(key);
+            if (cacheKey.prefix === CACHE_KEY_PREFIX && cacheKey.clientId === keyToMatch.clientId) {
+                const cachedEntry = await this.cache.get(key);
+                if ((_a = cachedEntry === null || cachedEntry === void 0 ? void 0 : cachedEntry.body) === null || _a === void 0 ? void 0 : _a.refresh_token) {
+                    return this.modifiedCachedEntry(cachedEntry, keyToMatch);
+                }
+            }
+        }
+        return undefined;
+    }
+    async updateEntry(oldRefreshToken, newRefreshToken) {
+        var _a;
+        const allKeys = await this.getCacheKeys();
+        if (!allKeys) return;
+        for (const key of allKeys) {
+            const entry = await this.cache.get(key);
+            if (((_a = entry === null || entry === void 0 ? void 0 : entry.body) === null || _a === void 0 ? void 0 : _a.refresh_token) === oldRefreshToken) {
+                const cacheEntry = Object.assign(Object.assign({}, entry.body), {
+                    refresh_token: newRefreshToken
+                });
+                await this.set(cacheEntry);
+            }
+        }
+    }
 }
 
 const TRANSACTION_STORAGE_KEY_PREFIX = "a0.spajs.txs";
@@ -1829,6 +1884,15 @@ const SessionStorage = {
     }
 };
 
+exports.ResponseType = void 0;
+
+(function(ResponseType) {
+    ResponseType["Code"] = "code";
+    ResponseType["ConnectCode"] = "connect_code";
+})(exports.ResponseType || (exports.ResponseType = {}));
+
+class User {}
+
 function decodeBase64(base64, enableUnicode) {
     var binaryString = atob(base64);
     if (enableUnicode) {
@@ -1861,7 +1925,7 @@ function createBase64WorkerFactory(base64, sourcemapArg, enableUnicodeArg) {
     };
 }
 
-var WorkerFactory = createBase64WorkerFactory("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwooZnVuY3Rpb24oKSB7CiAgICAidXNlIHN0cmljdCI7CiAgICBjbGFzcyBHZW5lcmljRXJyb3IgZXh0ZW5kcyBFcnJvciB7CiAgICAgICAgY29uc3RydWN0b3IoZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uKSB7CiAgICAgICAgICAgIHN1cGVyKGVycm9yX2Rlc2NyaXB0aW9uKTsKICAgICAgICAgICAgdGhpcy5lcnJvciA9IGVycm9yOwogICAgICAgICAgICB0aGlzLmVycm9yX2Rlc2NyaXB0aW9uID0gZXJyb3JfZGVzY3JpcHRpb247CiAgICAgICAgICAgIE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLCBHZW5lcmljRXJyb3IucHJvdG90eXBlKTsKICAgICAgICB9CiAgICAgICAgc3RhdGljIGZyb21QYXlsb2FkKHtlcnJvcjogZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uOiBlcnJvcl9kZXNjcmlwdGlvbn0pIHsKICAgICAgICAgICAgcmV0dXJuIG5ldyBHZW5lcmljRXJyb3IoZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uKTsKICAgICAgICB9CiAgICB9CiAgICBjbGFzcyBNaXNzaW5nUmVmcmVzaFRva2VuRXJyb3IgZXh0ZW5kcyBHZW5lcmljRXJyb3IgewogICAgICAgIGNvbnN0cnVjdG9yKGF1ZGllbmNlLCBzY29wZSkgewogICAgICAgICAgICBzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwgYE1pc3NpbmcgUmVmcmVzaCBUb2tlbiAoYXVkaWVuY2U6ICcke3ZhbHVlT3JFbXB0eVN0cmluZyhhdWRpZW5jZSwgWyAiZGVmYXVsdCIgXSl9Jywgc2NvcGU6ICcke3ZhbHVlT3JFbXB0eVN0cmluZyhzY29wZSl9JylgKTsKICAgICAgICAgICAgdGhpcy5hdWRpZW5jZSA9IGF1ZGllbmNlOwogICAgICAgICAgICB0aGlzLnNjb3BlID0gc2NvcGU7CiAgICAgICAgICAgIE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLCBNaXNzaW5nUmVmcmVzaFRva2VuRXJyb3IucHJvdG90eXBlKTsKICAgICAgICB9CiAgICB9CiAgICBmdW5jdGlvbiB2YWx1ZU9yRW1wdHlTdHJpbmcodmFsdWUsIGV4Y2x1ZGUgPSBbXSkgewogICAgICAgIHJldHVybiB2YWx1ZSAmJiAhZXhjbHVkZS5pbmNsdWRlcyh2YWx1ZSkgPyB2YWx1ZSA6ICIiOwogICAgfQogICAgZnVuY3Rpb24gX19yZXN0KHMsIGUpIHsKICAgICAgICB2YXIgdCA9IHt9OwogICAgICAgIGZvciAodmFyIHAgaW4gcykgaWYgKE9iamVjdC5wcm90b3R5cGUuaGFzT3duUHJvcGVydHkuY2FsbChzLCBwKSAmJiBlLmluZGV4T2YocCkgPCAwKSB0W3BdID0gc1twXTsKICAgICAgICBpZiAocyAhPSBudWxsICYmIHR5cGVvZiBPYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzID09PSAiZnVuY3Rpb24iKSBmb3IgKHZhciBpID0gMCwgcCA9IE9iamVjdC5nZXRPd25Qcm9wZXJ0eVN5bWJvbHMocyk7IGkgPCBwLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgICAgIGlmIChlLmluZGV4T2YocFtpXSkgPCAwICYmIE9iamVjdC5wcm90b3R5cGUucHJvcGVydHlJc0VudW1lcmFibGUuY2FsbChzLCBwW2ldKSkgdFtwW2ldXSA9IHNbcFtpXV07CiAgICAgICAgfQogICAgICAgIHJldHVybiB0OwogICAgfQogICAgdHlwZW9mIFN1cHByZXNzZWRFcnJvciA9PT0gImZ1bmN0aW9uIiA/IFN1cHByZXNzZWRFcnJvciA6IGZ1bmN0aW9uKGVycm9yLCBzdXBwcmVzc2VkLCBtZXNzYWdlKSB7CiAgICAgICAgdmFyIGUgPSBuZXcgRXJyb3IobWVzc2FnZSk7CiAgICAgICAgcmV0dXJuIGUubmFtZSA9ICJTdXBwcmVzc2VkRXJyb3IiLCBlLmVycm9yID0gZXJyb3IsIGUuc3VwcHJlc3NlZCA9IHN1cHByZXNzZWQsIGU7CiAgICB9OwogICAgY29uc3Qgc3RyaXBVbmRlZmluZWQgPSBwYXJhbXMgPT4gT2JqZWN0LmtleXMocGFyYW1zKS5maWx0ZXIoKGsgPT4gdHlwZW9mIHBhcmFtc1trXSAhPT0gInVuZGVmaW5lZCIpKS5yZWR1Y2UoKChhY2MsIGtleSkgPT4gT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LCBhY2MpLCB7CiAgICAgICAgW2tleV06IHBhcmFtc1trZXldCiAgICB9KSksIHt9KTsKICAgIGNvbnN0IGNyZWF0ZVF1ZXJ5UGFyYW1zID0gX2EgPT4gewogICAgICAgIHZhciB7Y2xpZW50SWQ6IGNsaWVudF9pZH0gPSBfYSwgcGFyYW1zID0gX19yZXN0KF9hLCBbICJjbGllbnRJZCIgXSk7CiAgICAgICAgcmV0dXJuIG5ldyBVUkxTZWFyY2hQYXJhbXMoc3RyaXBVbmRlZmluZWQoT2JqZWN0LmFzc2lnbih7CiAgICAgICAgICAgIGNsaWVudF9pZDogY2xpZW50X2lkCiAgICAgICAgfSwgcGFyYW1zKSkpLnRvU3RyaW5nKCk7CiAgICB9OwogICAgY29uc3QgZnJvbUVudHJpZXMgPSBpdGVyYWJsZSA9PiBbIC4uLml0ZXJhYmxlIF0ucmVkdWNlKCgob2JqLCBba2V5LCB2YWxdKSA9PiB7CiAgICAgICAgb2JqW2tleV0gPSB2YWw7CiAgICAgICAgcmV0dXJuIG9iajsKICAgIH0pLCB7fSk7CiAgICBsZXQgcmVmcmVzaFRva2VucyA9IHt9OwogICAgY29uc3QgY2FjaGVLZXkgPSAoYXVkaWVuY2UsIHNjb3BlKSA9PiBgJHthdWRpZW5jZX18JHtzY29wZX1gOwogICAgY29uc3QgZ2V0UmVmcmVzaFRva2VuID0gKGF1ZGllbmNlLCBzY29wZSkgPT4gcmVmcmVzaFRva2Vuc1tjYWNoZUtleShhdWRpZW5jZSwgc2NvcGUpXTsKICAgIGNvbnN0IHNldFJlZnJlc2hUb2tlbiA9IChyZWZyZXNoVG9rZW4sIGF1ZGllbmNlLCBzY29wZSkgPT4gcmVmcmVzaFRva2Vuc1tjYWNoZUtleShhdWRpZW5jZSwgc2NvcGUpXSA9IHJlZnJlc2hUb2tlbjsKICAgIGNvbnN0IGRlbGV0ZVJlZnJlc2hUb2tlbiA9IChhdWRpZW5jZSwgc2NvcGUpID0+IGRlbGV0ZSByZWZyZXNoVG9rZW5zW2NhY2hlS2V5KGF1ZGllbmNlLCBzY29wZSldOwogICAgY29uc3Qgd2FpdCA9IHRpbWUgPT4gbmV3IFByb21pc2UoKHJlc29sdmUgPT4gc2V0VGltZW91dChyZXNvbHZlLCB0aW1lKSkpOwogICAgY29uc3QgZm9ybURhdGFUb09iamVjdCA9IGZvcm1EYXRhID0+IHsKICAgICAgICBjb25zdCBxdWVyeVBhcmFtcyA9IG5ldyBVUkxTZWFyY2hQYXJhbXMoZm9ybURhdGEpOwogICAgICAgIGNvbnN0IHBhcnNlZFF1ZXJ5ID0ge307CiAgICAgICAgcXVlcnlQYXJhbXMuZm9yRWFjaCgoKHZhbCwga2V5KSA9PiB7CiAgICAgICAgICAgIHBhcnNlZFF1ZXJ5W2tleV0gPSB2YWw7CiAgICAgICAgfSkpOwogICAgICAgIHJldHVybiBwYXJzZWRRdWVyeTsKICAgIH07CiAgICBjb25zdCBtZXNzYWdlSGFuZGxlciA9IGFzeW5jICh7ZGF0YToge3RpbWVvdXQ6IHRpbWVvdXQsIGF1dGg6IGF1dGgsIGZldGNoVXJsOiBmZXRjaFVybCwgZmV0Y2hPcHRpb25zOiBmZXRjaE9wdGlvbnMsIHVzZUZvcm1EYXRhOiB1c2VGb3JtRGF0YX0sIHBvcnRzOiBbcG9ydF19KSA9PiB7CiAgICAgICAgbGV0IGhlYWRlcnMgPSB7fTsKICAgICAgICBsZXQganNvbjsKICAgICAgICBjb25zdCB7YXVkaWVuY2U6IGF1ZGllbmNlLCBzY29wZTogc2NvcGV9ID0gYXV0aCB8fCB7fTsKICAgICAgICB0cnkgewogICAgICAgICAgICBjb25zdCBib2R5ID0gdXNlRm9ybURhdGEgPyBmb3JtRGF0YVRvT2JqZWN0KGZldGNoT3B0aW9ucy5ib2R5KSA6IEpTT04ucGFyc2UoZmV0Y2hPcHRpb25zLmJvZHkpOwogICAgICAgICAgICBpZiAoIWJvZHkucmVmcmVzaF90b2tlbiAmJiBib2R5LmdyYW50X3R5cGUgPT09ICJyZWZyZXNoX3Rva2VuIikgewogICAgICAgICAgICAgICAgY29uc3QgcmVmcmVzaFRva2VuID0gZ2V0UmVmcmVzaFRva2VuKGF1ZGllbmNlLCBzY29wZSk7CiAgICAgICAgICAgICAgICBpZiAoIXJlZnJlc2hUb2tlbikgewogICAgICAgICAgICAgICAgICAgIHRocm93IG5ldyBNaXNzaW5nUmVmcmVzaFRva2VuRXJyb3IoYXVkaWVuY2UsIHNjb3BlKTsKICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIGZldGNoT3B0aW9ucy5ib2R5ID0gdXNlRm9ybURhdGEgPyBjcmVhdGVRdWVyeVBhcmFtcyhPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sIGJvZHkpLCB7CiAgICAgICAgICAgICAgICAgICAgcmVmcmVzaF90b2tlbjogcmVmcmVzaFRva2VuCiAgICAgICAgICAgICAgICB9KSkgOiBKU09OLnN0cmluZ2lmeShPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sIGJvZHkpLCB7CiAgICAgICAgICAgICAgICAgICAgcmVmcmVzaF90b2tlbjogcmVmcmVzaFRva2VuCiAgICAgICAgICAgICAgICB9KSk7CiAgICAgICAgICAgIH0KICAgICAgICAgICAgbGV0IGFib3J0Q29udHJvbGxlcjsKICAgICAgICAgICAgaWYgKHR5cGVvZiBBYm9ydENvbnRyb2xsZXIgPT09ICJmdW5jdGlvbiIpIHsKICAgICAgICAgICAgICAgIGFib3J0Q29udHJvbGxlciA9IG5ldyBBYm9ydENvbnRyb2xsZXI7CiAgICAgICAgICAgICAgICBmZXRjaE9wdGlvbnMuc2lnbmFsID0gYWJvcnRDb250cm9sbGVyLnNpZ25hbDsKICAgICAgICAgICAgfQogICAgICAgICAgICBsZXQgcmVzcG9uc2U7CiAgICAgICAgICAgIHRyeSB7CiAgICAgICAgICAgICAgICByZXNwb25zZSA9IGF3YWl0IFByb21pc2UucmFjZShbIHdhaXQodGltZW91dCksIGZldGNoKGZldGNoVXJsLCBPYmplY3QuYXNzaWduKHt9LCBmZXRjaE9wdGlvbnMpKSBdKTsKICAgICAgICAgICAgfSBjYXRjaCAoZXJyb3IpIHsKICAgICAgICAgICAgICAgIHBvcnQucG9zdE1lc3NhZ2UoewogICAgICAgICAgICAgICAgICAgIGVycm9yOiBlcnJvci5tZXNzYWdlCiAgICAgICAgICAgICAgICB9KTsKICAgICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgICAgfQogICAgICAgICAgICBpZiAoIXJlc3BvbnNlKSB7CiAgICAgICAgICAgICAgICBpZiAoYWJvcnRDb250cm9sbGVyKSBhYm9ydENvbnRyb2xsZXIuYWJvcnQoKTsKICAgICAgICAgICAgICAgIHBvcnQucG9zdE1lc3NhZ2UoewogICAgICAgICAgICAgICAgICAgIGVycm9yOiAiVGltZW91dCB3aGVuIGV4ZWN1dGluZyAnZmV0Y2gnIgogICAgICAgICAgICAgICAgfSk7CiAgICAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgICAgIH0KICAgICAgICAgICAgaGVhZGVycyA9IGZyb21FbnRyaWVzKHJlc3BvbnNlLmhlYWRlcnMpOwogICAgICAgICAgICBqc29uID0gYXdhaXQgcmVzcG9uc2UuanNvbigpOwogICAgICAgICAgICBpZiAoanNvbi5yZWZyZXNoX3Rva2VuKSB7CiAgICAgICAgICAgICAgICBzZXRSZWZyZXNoVG9rZW4oanNvbi5yZWZyZXNoX3Rva2VuLCBhdWRpZW5jZSwgc2NvcGUpOwogICAgICAgICAgICAgICAgZGVsZXRlIGpzb24ucmVmcmVzaF90b2tlbjsKICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgIGRlbGV0ZVJlZnJlc2hUb2tlbihhdWRpZW5jZSwgc2NvcGUpOwogICAgICAgICAgICB9CiAgICAgICAgICAgIHBvcnQucG9zdE1lc3NhZ2UoewogICAgICAgICAgICAgICAgb2s6IHJlc3BvbnNlLm9rLAogICAgICAgICAgICAgICAganNvbjoganNvbiwKICAgICAgICAgICAgICAgIGhlYWRlcnM6IGhlYWRlcnMKICAgICAgICAgICAgfSk7CiAgICAgICAgfSBjYXRjaCAoZXJyb3IpIHsKICAgICAgICAgICAgcG9ydC5wb3N0TWVzc2FnZSh7CiAgICAgICAgICAgICAgICBvazogZmFsc2UsCiAgICAgICAgICAgICAgICBqc29uOiB7CiAgICAgICAgICAgICAgICAgICAgZXJyb3I6IGVycm9yLmVycm9yLAogICAgICAgICAgICAgICAgICAgIGVycm9yX2Rlc2NyaXB0aW9uOiBlcnJvci5tZXNzYWdlCiAgICAgICAgICAgICAgICB9LAogICAgICAgICAgICAgICAgaGVhZGVyczogaGVhZGVycwogICAgICAgICAgICB9KTsKICAgICAgICB9CiAgICB9OwogICAgewogICAgICAgIGFkZEV2ZW50TGlzdGVuZXIoIm1lc3NhZ2UiLCBtZXNzYWdlSGFuZGxlcik7CiAgICB9Cn0pKCk7Cgo=", null, false);
+var WorkerFactory = createBase64WorkerFactory("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwooZnVuY3Rpb24oKSB7CiAgICAidXNlIHN0cmljdCI7CiAgICBjbGFzcyBHZW5lcmljRXJyb3IgZXh0ZW5kcyBFcnJvciB7CiAgICAgICAgY29uc3RydWN0b3IoZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uKSB7CiAgICAgICAgICAgIHN1cGVyKGVycm9yX2Rlc2NyaXB0aW9uKTsKICAgICAgICAgICAgdGhpcy5lcnJvciA9IGVycm9yOwogICAgICAgICAgICB0aGlzLmVycm9yX2Rlc2NyaXB0aW9uID0gZXJyb3JfZGVzY3JpcHRpb247CiAgICAgICAgICAgIE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLCBHZW5lcmljRXJyb3IucHJvdG90eXBlKTsKICAgICAgICB9CiAgICAgICAgc3RhdGljIGZyb21QYXlsb2FkKHtlcnJvcjogZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uOiBlcnJvcl9kZXNjcmlwdGlvbn0pIHsKICAgICAgICAgICAgcmV0dXJuIG5ldyBHZW5lcmljRXJyb3IoZXJyb3IsIGVycm9yX2Rlc2NyaXB0aW9uKTsKICAgICAgICB9CiAgICB9CiAgICBjbGFzcyBNaXNzaW5nUmVmcmVzaFRva2VuRXJyb3IgZXh0ZW5kcyBHZW5lcmljRXJyb3IgewogICAgICAgIGNvbnN0cnVjdG9yKGF1ZGllbmNlLCBzY29wZSkgewogICAgICAgICAgICBzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwgYE1pc3NpbmcgUmVmcmVzaCBUb2tlbiAoYXVkaWVuY2U6ICcke3ZhbHVlT3JFbXB0eVN0cmluZyhhdWRpZW5jZSwgWyAiZGVmYXVsdCIgXSl9Jywgc2NvcGU6ICcke3ZhbHVlT3JFbXB0eVN0cmluZyhzY29wZSl9JylgKTsKICAgICAgICAgICAgdGhpcy5hdWRpZW5jZSA9IGF1ZGllbmNlOwogICAgICAgICAgICB0aGlzLnNjb3BlID0gc2NvcGU7CiAgICAgICAgICAgIE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLCBNaXNzaW5nUmVmcmVzaFRva2VuRXJyb3IucHJvdG90eXBlKTsKICAgICAgICB9CiAgICB9CiAgICBmdW5jdGlvbiB2YWx1ZU9yRW1wdHlTdHJpbmcodmFsdWUsIGV4Y2x1ZGUgPSBbXSkgewogICAgICAgIHJldHVybiB2YWx1ZSAmJiAhZXhjbHVkZS5pbmNsdWRlcyh2YWx1ZSkgPyB2YWx1ZSA6ICIiOwogICAgfQogICAgZnVuY3Rpb24gX19yZXN0KHMsIGUpIHsKICAgICAgICB2YXIgdCA9IHt9OwogICAgICAgIGZvciAodmFyIHAgaW4gcykgaWYgKE9iamVjdC5wcm90b3R5cGUuaGFzT3duUHJvcGVydHkuY2FsbChzLCBwKSAmJiBlLmluZGV4T2YocCkgPCAwKSB0W3BdID0gc1twXTsKICAgICAgICBpZiAocyAhPSBudWxsICYmIHR5cGVvZiBPYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzID09PSAiZnVuY3Rpb24iKSBmb3IgKHZhciBpID0gMCwgcCA9IE9iamVjdC5nZXRPd25Qcm9wZXJ0eVN5bWJvbHMocyk7IGkgPCBwLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgICAgIGlmIChlLmluZGV4T2YocFtpXSkgPCAwICYmIE9iamVjdC5wcm90b3R5cGUucHJvcGVydHlJc0VudW1lcmFibGUuY2FsbChzLCBwW2ldKSkgdFtwW2ldXSA9IHNbcFtpXV07CiAgICAgICAgfQogICAgICAgIHJldHVybiB0OwogICAgfQogICAgdHlwZW9mIFN1cHByZXNzZWRFcnJvciA9PT0gImZ1bmN0aW9uIiA/IFN1cHByZXNzZWRFcnJvciA6IGZ1bmN0aW9uKGVycm9yLCBzdXBwcmVzc2VkLCBtZXNzYWdlKSB7CiAgICAgICAgdmFyIGUgPSBuZXcgRXJyb3IobWVzc2FnZSk7CiAgICAgICAgcmV0dXJuIGUubmFtZSA9ICJTdXBwcmVzc2VkRXJyb3IiLCBlLmVycm9yID0gZXJyb3IsIGUuc3VwcHJlc3NlZCA9IHN1cHByZXNzZWQsIGU7CiAgICB9OwogICAgY29uc3Qgc3RyaXBVbmRlZmluZWQgPSBwYXJhbXMgPT4gT2JqZWN0LmtleXMocGFyYW1zKS5maWx0ZXIoKGsgPT4gdHlwZW9mIHBhcmFtc1trXSAhPT0gInVuZGVmaW5lZCIpKS5yZWR1Y2UoKChhY2MsIGtleSkgPT4gT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LCBhY2MpLCB7CiAgICAgICAgW2tleV06IHBhcmFtc1trZXldCiAgICB9KSksIHt9KTsKICAgIGNvbnN0IGNyZWF0ZVF1ZXJ5UGFyYW1zID0gX2EgPT4gewogICAgICAgIHZhciB7Y2xpZW50SWQ6IGNsaWVudF9pZH0gPSBfYSwgcGFyYW1zID0gX19yZXN0KF9hLCBbICJjbGllbnRJZCIgXSk7CiAgICAgICAgcmV0dXJuIG5ldyBVUkxTZWFyY2hQYXJhbXMoc3RyaXBVbmRlZmluZWQoT2JqZWN0LmFzc2lnbih7CiAgICAgICAgICAgIGNsaWVudF9pZDogY2xpZW50X2lkCiAgICAgICAgfSwgcGFyYW1zKSkpLnRvU3RyaW5nKCk7CiAgICB9OwogICAgY29uc3QgZnJvbUVudHJpZXMgPSBpdGVyYWJsZSA9PiBbIC4uLml0ZXJhYmxlIF0ucmVkdWNlKCgob2JqLCBba2V5LCB2YWxdKSA9PiB7CiAgICAgICAgb2JqW2tleV0gPSB2YWw7CiAgICAgICAgcmV0dXJuIG9iajsKICAgIH0pLCB7fSk7CiAgICBsZXQgcmVmcmVzaFRva2VucyA9IHt9OwogICAgY29uc3QgY2FjaGVLZXkgPSAoYXVkaWVuY2UsIHNjb3BlKSA9PiBgJHthdWRpZW5jZX18JHtzY29wZX1gOwogICAgY29uc3QgY2FjaGVLZXlDb250YWluc0F1ZGllbmNlID0gKGF1ZGllbmNlLCBjYWNoZUtleSkgPT4gY2FjaGVLZXkuc3RhcnRzV2l0aChgJHthdWRpZW5jZX18YCk7CiAgICBjb25zdCBnZXRSZWZyZXNoVG9rZW4gPSAoYXVkaWVuY2UsIHNjb3BlKSA9PiByZWZyZXNoVG9rZW5zW2NhY2hlS2V5KGF1ZGllbmNlLCBzY29wZSldOwogICAgY29uc3Qgc2V0UmVmcmVzaFRva2VuID0gKHJlZnJlc2hUb2tlbiwgYXVkaWVuY2UsIHNjb3BlKSA9PiByZWZyZXNoVG9rZW5zW2NhY2hlS2V5KGF1ZGllbmNlLCBzY29wZSldID0gcmVmcmVzaFRva2VuOwogICAgY29uc3QgZGVsZXRlUmVmcmVzaFRva2VuID0gKGF1ZGllbmNlLCBzY29wZSkgPT4gZGVsZXRlIHJlZnJlc2hUb2tlbnNbY2FjaGVLZXkoYXVkaWVuY2UsIHNjb3BlKV07CiAgICBjb25zdCB3YWl0ID0gdGltZSA9PiBuZXcgUHJvbWlzZSgocmVzb2x2ZSA9PiBzZXRUaW1lb3V0KHJlc29sdmUsIHRpbWUpKSk7CiAgICBjb25zdCBmb3JtRGF0YVRvT2JqZWN0ID0gZm9ybURhdGEgPT4gewogICAgICAgIGNvbnN0IHF1ZXJ5UGFyYW1zID0gbmV3IFVSTFNlYXJjaFBhcmFtcyhmb3JtRGF0YSk7CiAgICAgICAgY29uc3QgcGFyc2VkUXVlcnkgPSB7fTsKICAgICAgICBxdWVyeVBhcmFtcy5mb3JFYWNoKCgodmFsLCBrZXkpID0+IHsKICAgICAgICAgICAgcGFyc2VkUXVlcnlba2V5XSA9IHZhbDsKICAgICAgICB9KSk7CiAgICAgICAgcmV0dXJuIHBhcnNlZFF1ZXJ5OwogICAgfTsKICAgIGNvbnN0IHVwZGF0ZVJlZnJlc2hUb2tlbnMgPSAob2xkUmVmcmVzaFRva2VuLCBuZXdSZWZyZXNoVG9rZW4pID0+IHsKICAgICAgICBPYmplY3QuZW50cmllcyhyZWZyZXNoVG9rZW5zKS5mb3JFYWNoKCgoW2tleSwgdG9rZW5dKSA9PiB7CiAgICAgICAgICAgIGlmICh0b2tlbiA9PT0gb2xkUmVmcmVzaFRva2VuKSB7CiAgICAgICAgICAgICAgICByZWZyZXNoVG9rZW5zW2tleV0gPSBuZXdSZWZyZXNoVG9rZW47CiAgICAgICAgICAgIH0KICAgICAgICB9KSk7CiAgICB9OwogICAgY29uc3QgY2hlY2tEb3duc2NvcGluZyA9IChzY29wZSwgYXVkaWVuY2UpID0+IHsKICAgICAgICBjb25zdCBmaW5kQ29pbmNpZGVuY2UgPSBPYmplY3Qua2V5cyhyZWZyZXNoVG9rZW5zKS5maW5kKChrZXkgPT4gewogICAgICAgICAgICBpZiAoa2V5ICE9PSAibGF0ZXN0X3JlZnJlc2hfdG9rZW4iKSB7CiAgICAgICAgICAgICAgICBjb25zdCBpc1NhbWVBdWRpZW5jZSA9IGNhY2hlS2V5Q29udGFpbnNBdWRpZW5jZShhdWRpZW5jZSwga2V5KTsKICAgICAgICAgICAgICAgIGNvbnN0IHNjb3Blc0tleSA9IGtleS5zcGxpdCgifCIpWzFdLnNwbGl0KCIgIik7CiAgICAgICAgICAgICAgICBjb25zdCByZXF1ZXN0ZWRTY29wZXMgPSBzY29wZS5zcGxpdCgiICIpOwogICAgICAgICAgICAgICAgY29uc3Qgc2NvcGVzQXJlSW5jbHVkZWQgPSByZXF1ZXN0ZWRTY29wZXMuZXZlcnkoKGtleSA9PiBzY29wZXNLZXkuaW5jbHVkZXMoa2V5KSkpOwogICAgICAgICAgICAgICAgcmV0dXJuIGlzU2FtZUF1ZGllbmNlICYmIHNjb3Blc0FyZUluY2x1ZGVkOwogICAgICAgICAgICB9CiAgICAgICAgfSkpOwogICAgICAgIHJldHVybiBmaW5kQ29pbmNpZGVuY2UgPyB0cnVlIDogZmFsc2U7CiAgICB9OwogICAgY29uc3QgbWVzc2FnZUhhbmRsZXIgPSBhc3luYyAoe2RhdGE6IHt0aW1lb3V0OiB0aW1lb3V0LCBhdXRoOiBhdXRoLCBmZXRjaFVybDogZmV0Y2hVcmwsIGZldGNoT3B0aW9uczogZmV0Y2hPcHRpb25zLCB1c2VGb3JtRGF0YTogdXNlRm9ybURhdGEsIHVzZU1ycnQ6IHVzZU1ycnR9LCBwb3J0czogW3BvcnRdfSkgPT4gewogICAgICAgIGxldCBoZWFkZXJzID0ge307CiAgICAgICAgbGV0IGpzb247CiAgICAgICAgbGV0IHJlZnJlc2hUb2tlbjsKICAgICAgICBjb25zdCB7YXVkaWVuY2U6IGF1ZGllbmNlLCBzY29wZTogc2NvcGV9ID0gYXV0aCB8fCB7fTsKICAgICAgICB0cnkgewogICAgICAgICAgICBjb25zdCBib2R5ID0gdXNlRm9ybURhdGEgPyBmb3JtRGF0YVRvT2JqZWN0KGZldGNoT3B0aW9ucy5ib2R5KSA6IEpTT04ucGFyc2UoZmV0Y2hPcHRpb25zLmJvZHkpOwogICAgICAgICAgICBpZiAoIWJvZHkucmVmcmVzaF90b2tlbiAmJiBib2R5LmdyYW50X3R5cGUgPT09ICJyZWZyZXNoX3Rva2VuIikgewogICAgICAgICAgICAgICAgcmVmcmVzaFRva2VuID0gZ2V0UmVmcmVzaFRva2VuKGF1ZGllbmNlLCBzY29wZSk7CiAgICAgICAgICAgICAgICBpZiAoIXJlZnJlc2hUb2tlbiAmJiB1c2VNcnJ0KSB7CiAgICAgICAgICAgICAgICAgICAgY29uc3QgbGF0ZXN0UmVmcmVzaFRva2VuID0gcmVmcmVzaFRva2Vuc1sibGF0ZXN0X3JlZnJlc2hfdG9rZW4iXTsKICAgICAgICAgICAgICAgICAgICBjb25zdCBpc0Rvd25zY29waW5nID0gY2hlY2tEb3duc2NvcGluZyhzY29wZSwgYXVkaWVuY2UpOwogICAgICAgICAgICAgICAgICAgIGlmIChsYXRlc3RSZWZyZXNoVG9rZW4gJiYgIWlzRG93bnNjb3BpbmcpIHsKICAgICAgICAgICAgICAgICAgICAgICAgcmVmcmVzaFRva2VuID0gbGF0ZXN0UmVmcmVzaFRva2VuOwogICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIGlmICghcmVmcmVzaFRva2VuKSB7CiAgICAgICAgICAgICAgICAgICAgdGhyb3cgbmV3IE1pc3NpbmdSZWZyZXNoVG9rZW5FcnJvcihhdWRpZW5jZSwgc2NvcGUpOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgZmV0Y2hPcHRpb25zLmJvZHkgPSB1c2VGb3JtRGF0YSA/IGNyZWF0ZVF1ZXJ5UGFyYW1zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSwgYm9keSksIHsKICAgICAgICAgICAgICAgICAgICByZWZyZXNoX3Rva2VuOiByZWZyZXNoVG9rZW4KICAgICAgICAgICAgICAgIH0pKSA6IEpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSwgYm9keSksIHsKICAgICAgICAgICAgICAgICAgICByZWZyZXNoX3Rva2VuOiByZWZyZXNoVG9rZW4KICAgICAgICAgICAgICAgIH0pKTsKICAgICAgICAgICAgfQogICAgICAgICAgICBsZXQgYWJvcnRDb250cm9sbGVyOwogICAgICAgICAgICBpZiAodHlwZW9mIEFib3J0Q29udHJvbGxlciA9PT0gImZ1bmN0aW9uIikgewogICAgICAgICAgICAgICAgYWJvcnRDb250cm9sbGVyID0gbmV3IEFib3J0Q29udHJvbGxlcjsKICAgICAgICAgICAgICAgIGZldGNoT3B0aW9ucy5zaWduYWwgPSBhYm9ydENvbnRyb2xsZXIuc2lnbmFsOwogICAgICAgICAgICB9CiAgICAgICAgICAgIGxldCByZXNwb25zZTsKICAgICAgICAgICAgdHJ5IHsKICAgICAgICAgICAgICAgIHJlc3BvbnNlID0gYXdhaXQgUHJvbWlzZS5yYWNlKFsgd2FpdCh0aW1lb3V0KSwgZmV0Y2goZmV0Y2hVcmwsIE9iamVjdC5hc3NpZ24oe30sIGZldGNoT3B0aW9ucykpIF0pOwogICAgICAgICAgICB9IGNhdGNoIChlcnJvcikgewogICAgICAgICAgICAgICAgcG9ydC5wb3N0TWVzc2FnZSh7CiAgICAgICAgICAgICAgICAgICAgZXJyb3I6IGVycm9yLm1lc3NhZ2UKICAgICAgICAgICAgICAgIH0pOwogICAgICAgICAgICAgICAgcmV0dXJuOwogICAgICAgICAgICB9CiAgICAgICAgICAgIGlmICghcmVzcG9uc2UpIHsKICAgICAgICAgICAgICAgIGlmIChhYm9ydENvbnRyb2xsZXIpIGFib3J0Q29udHJvbGxlci5hYm9ydCgpOwogICAgICAgICAgICAgICAgcG9ydC5wb3N0TWVzc2FnZSh7CiAgICAgICAgICAgICAgICAgICAgZXJyb3I6ICJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCciCiAgICAgICAgICAgICAgICB9KTsKICAgICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgICAgfQogICAgICAgICAgICBoZWFkZXJzID0gZnJvbUVudHJpZXMocmVzcG9uc2UuaGVhZGVycyk7CiAgICAgICAgICAgIGpzb24gPSBhd2FpdCByZXNwb25zZS5qc29uKCk7CiAgICAgICAgICAgIGlmIChqc29uLnJlZnJlc2hfdG9rZW4pIHsKICAgICAgICAgICAgICAgIGlmICh1c2VNcnJ0ICYmIGF1ZGllbmNlICE9PSAiZGVmYXVsdCIpIHsKICAgICAgICAgICAgICAgICAgICByZWZyZXNoVG9rZW5zWyJsYXRlc3RfcmVmcmVzaF90b2tlbiJdID0ganNvbi5yZWZyZXNoX3Rva2VuOwogICAgICAgICAgICAgICAgICAgIHVwZGF0ZVJlZnJlc2hUb2tlbnMocmVmcmVzaFRva2VuLCBqc29uLnJlZnJlc2hfdG9rZW4pOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgc2V0UmVmcmVzaFRva2VuKGpzb24ucmVmcmVzaF90b2tlbiwgYXVkaWVuY2UsIHNjb3BlKTsKICAgICAgICAgICAgICAgIGRlbGV0ZSBqc29uLnJlZnJlc2hfdG9rZW47CiAgICAgICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICAgICBkZWxldGVSZWZyZXNoVG9rZW4oYXVkaWVuY2UsIHNjb3BlKTsKICAgICAgICAgICAgfQogICAgICAgICAgICBwb3J0LnBvc3RNZXNzYWdlKHsKICAgICAgICAgICAgICAgIG9rOiByZXNwb25zZS5vaywKICAgICAgICAgICAgICAgIGpzb246IGpzb24sCiAgICAgICAgICAgICAgICBoZWFkZXJzOiBoZWFkZXJzCiAgICAgICAgICAgIH0pOwogICAgICAgIH0gY2F0Y2ggKGVycm9yKSB7CiAgICAgICAgICAgIHBvcnQucG9zdE1lc3NhZ2UoewogICAgICAgICAgICAgICAgb2s6IGZhbHNlLAogICAgICAgICAgICAgICAganNvbjogewogICAgICAgICAgICAgICAgICAgIGVycm9yOiBlcnJvci5lcnJvciwKICAgICAgICAgICAgICAgICAgICBlcnJvcl9kZXNjcmlwdGlvbjogZXJyb3IubWVzc2FnZQogICAgICAgICAgICAgICAgfSwKICAgICAgICAgICAgICAgIGhlYWRlcnM6IGhlYWRlcnMKICAgICAgICAgICAgfSk7CiAgICAgICAgfQogICAgfTsKICAgIHsKICAgICAgICBhZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgbWVzc2FnZUhhbmRsZXIpOwogICAgfQp9KSgpOwoK", null, false);
 
 const singlePromiseMap = {};
 
@@ -1961,6 +2025,33 @@ const patchOpenUrlWithOnRedirect = options => {
     return result;
 };
 
+const allScopesAreIncluded = (scopeToInclude, scopes) => {
+    const scopeGroup = (scopes === null || scopes === void 0 ? void 0 : scopes.split(" ")) || [];
+    const scopesToInclude = (scopeToInclude === null || scopeToInclude === void 0 ? void 0 : scopeToInclude.split(" ")) || [];
+    return scopesToInclude.every((key => scopeGroup.includes(key)));
+};
+
+const getScopeToRequest = (useMrrt, authorizationParams, cachedAudience, cachedScope) => {
+    var _a;
+    if (useMrrt && cachedAudience && cachedScope) {
+        if (authorizationParams.audience !== cachedAudience) {
+            return authorizationParams.scope;
+        }
+        const cachedScopes = cachedScope.split(" ");
+        const newScopes = ((_a = authorizationParams.scope) === null || _a === void 0 ? void 0 : _a.split(" ")) || [];
+        const newScopesAreIncluded = newScopes.every((scope => cachedScopes.includes(scope)));
+        return cachedScopes.length >= newScopes.length && newScopesAreIncluded ? cachedScope : authorizationParams.scope;
+    }
+    return authorizationParams.scope;
+};
+
+const isRefreshWithMrrt = (cachedAudience, cachedScope, requestAudience, requestScope) => {
+    if (cachedAudience !== requestAudience) {
+        return true;
+    }
+    return !allScopesAreIncluded(requestScope, cachedScope);
+};
+
 const VERSION = 1;
 
 const NAME = "auth0-spa-js";
@@ -2094,8 +2185,8 @@ class Fetcher {
         }
         throw new TypeError("`url` must be absolute or `baseUrl` non-empty.");
     }
-    getAccessToken() {
-        return this.config.getAccessToken ? this.config.getAccessToken() : this.hooks.getAccessToken();
+    getAccessToken(authParams) {
+        return this.config.getAccessToken ? this.config.getAccessToken(authParams) : this.hooks.getAccessToken(authParams);
     }
     buildBaseRequest(info, init) {
         const request = new Request(info, init);
@@ -2104,7 +2195,7 @@ class Fetcher {
         }
         return new Request(this.buildUrl(this.config.baseUrl, request.url), request);
     }
-    async setAuthorizationHeader(request, accessToken) {
+    setAuthorizationHeader(request, accessToken) {
         request.headers.set("authorization", `${this.config.dpopNonceId ? "DPoP" : "Bearer"} ${accessToken}`);
     }
     async setDpopProofHeader(request, accessToken) {
@@ -2120,8 +2211,8 @@ class Fetcher {
         });
         request.headers.set("dpop", dpopProof);
     }
-    async prepareRequest(request) {
-        const accessToken = await this.getAccessToken();
+    async prepareRequest(request, authParams) {
+        const accessToken = await this.getAccessToken(authParams);
         this.setAuthorizationHeader(request, accessToken);
         await this.setDpopProofHeader(request, accessToken);
     }
@@ -2154,19 +2245,78 @@ class Fetcher {
         }
         return callbacks.onUseDpopNonceError();
     }
-    async internalFetchWithAuth(info, init, callbacks) {
+    async internalFetchWithAuth(info, init, callbacks, authParams) {
         const request = this.buildBaseRequest(info, init);
-        await this.prepareRequest(request);
+        await this.prepareRequest(request, authParams);
         const response = await this.config.fetch(request);
         return this.handleResponse(response, callbacks);
     }
-    fetchWithAuth(info, init) {
+    fetchWithAuth(info, init, authParams) {
         const callbacks = {
             onUseDpopNonceError: () => this.internalFetchWithAuth(info, init, Object.assign(Object.assign({}, callbacks), {
                 onUseDpopNonceError: undefined
-            }))
+            }), authParams)
         };
-        return this.internalFetchWithAuth(info, init, callbacks);
+        return this.internalFetchWithAuth(info, init, callbacks, authParams);
+    }
+}
+
+class MyAccountApiClient {
+    constructor(myAccountFetcher, apiBase) {
+        this.myAccountFetcher = myAccountFetcher;
+        this.apiBase = apiBase;
+    }
+    async connectAccount(params) {
+        const res = await this.myAccountFetcher.fetchWithAuth(`${this.apiBase}v1/connected-accounts/connect`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(params)
+        });
+        return this._handleResponse(res);
+    }
+    async completeAccount(params) {
+        const res = await this.myAccountFetcher.fetchWithAuth(`${this.apiBase}v1/connected-accounts/complete`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(params)
+        });
+        return this._handleResponse(res);
+    }
+    async _handleResponse(res) {
+        let body;
+        try {
+            body = await res.text();
+            body = JSON.parse(body);
+        } catch (err) {
+            throw new MyAccountApiError({
+                type: "invalid_json",
+                status: res.status,
+                title: "Invalid JSON response",
+                detail: body || String(err)
+            });
+        }
+        if (res.ok) {
+            return body;
+        } else {
+            throw new MyAccountApiError(body);
+        }
+    }
+}
+
+class MyAccountApiError extends Error {
+    constructor({type: type, status: status, title: title, detail: detail, validation_errors: validation_errors}) {
+        super(detail);
+        this.name = "MyAccountApiError";
+        this.type = type;
+        this.status = status;
+        this.title = title;
+        this.detail = detail;
+        this.validation_errors = validation_errors;
+        Object.setPrototypeOf(this, MyAccountApiError.prototype);
     }
 }
 
@@ -2217,6 +2367,18 @@ class Auth0Client {
         this.dpop = this.options.useDpop ? new Dpop(this.options.clientId) : undefined;
         this.domainUrl = getDomain(this.options.domain);
         this.tokenIssuer = getTokenIssuer(this.options.issuer, this.domainUrl);
+        const myAccountApiIdentifier = `${this.domainUrl}/me/`;
+        const myAccountFetcher = this.createFetcher(Object.assign(Object.assign({}, this.options.useDpop && {
+            dpopNonceId: "__auth0_my_account_api__"
+        }), {
+            getAccessToken: () => this.getTokenSilently({
+                authorizationParams: {
+                    scope: "create:me:connected_accounts",
+                    audience: myAccountApiIdentifier
+                }
+            })
+        }));
+        this.myAccountApi = new MyAccountApiClient(myAccountFetcher, myAccountApiIdentifier);
         if (typeof window !== "undefined" && window.Worker && this.options.useRefreshTokens && cacheLocation === CACHE_LOCATION_MEMORY) {
             if (this.options.workerUrl) {
                 this.worker = new Worker(this.options.workerUrl);
@@ -2326,7 +2488,8 @@ class Auth0Client {
         const organization = ((_a = urlOptions.authorizationParams) === null || _a === void 0 ? void 0 : _a.organization) || this.options.authorizationParams.organization;
         const _c = await this._prepareAuthorizeUrl(urlOptions.authorizationParams || {}), {url: url} = _c, transaction = __rest(_c, [ "url" ]);
         this.transactionManager.create(Object.assign(Object.assign(Object.assign({}, transaction), {
-            appState: appState
+            appState: appState,
+            response_type: exports.ResponseType.Code
         }), organization && {
             organization: organization
         }));
@@ -2342,12 +2505,19 @@ class Auth0Client {
         if (queryStringFragments.length === 0) {
             throw new Error("There are no query params available for parsing.");
         }
-        const {state: state, code: code, error: error, error_description: error_description} = parseAuthenticationResult(queryStringFragments.join(""));
         const transaction = this.transactionManager.get();
         if (!transaction) {
             throw new GenericError("missing_transaction", "Invalid state");
         }
         this.transactionManager.remove();
+        const authenticationResult = parseAuthenticationResult(queryStringFragments.join(""));
+        if (transaction.response_type === exports.ResponseType.ConnectCode) {
+            return this._handleConnectAccountRedirectCallback(authenticationResult, transaction);
+        }
+        return this._handleLoginRedirectCallback(authenticationResult, transaction);
+    }
+    async _handleLoginRedirectCallback(authenticationResult, transaction) {
+        const {code: code, state: state, error: error, error_description: error_description} = authenticationResult;
         if (error) {
             throw new AuthenticationError(error, error_description || error, state, transaction.appState);
         }
@@ -2370,9 +2540,32 @@ class Auth0Client {
             organization: organization
         });
         return {
-            appState: transaction.appState
+            appState: transaction.appState,
+            response_type: exports.ResponseType.Code
         };
     }
+    async _handleConnectAccountRedirectCallback(connectResult, transaction) {
+        const {connect_code: connect_code, state: state, error: error, error_description: error_description} = connectResult;
+        if (error) {
+            throw new ConnectError(error, error_description || error, transaction.connection, state, transaction.appState);
+        }
+        if (!connect_code) {
+            throw new GenericError("missing_connect_code", "Missing connect code");
+        }
+        if (!transaction.code_verifier || !transaction.state || !transaction.auth_session || !transaction.redirect_uri || transaction.state !== state) {
+            throw new GenericError("state_mismatch", "Invalid state");
+        }
+        const data = await this.myAccountApi.completeAccount({
+            auth_session: transaction.auth_session,
+            connect_code: connect_code,
+            redirect_uri: transaction.redirect_uri,
+            code_verifier: transaction.code_verifier
+        });
+        return Object.assign(Object.assign({}, data), {
+            appState: transaction.appState,
+            response_type: exports.ResponseType.ConnectCode
+        });
+    }
     async checkSession(options) {
         if (!this.cookieStorage.get(this.isAuthenticatedCookieName)) {
             if (!this.cookieStorage.get(OLD_IS_AUTHENTICATED_COOKIE_NAME)) {
@@ -2407,7 +2600,8 @@ class Auth0Client {
             const entry = await this._getEntryFromCache({
                 scope: getTokenOptions.authorizationParams.scope,
                 audience: getTokenOptions.authorizationParams.audience || "default",
-                clientId: this.options.clientId
+                clientId: this.options.clientId,
+                cacheMode: cacheMode
             });
             if (entry) {
                 return entry;
@@ -2461,7 +2655,7 @@ class Auth0Client {
             scope: localOptions.authorizationParams.scope,
             audience: localOptions.authorizationParams.audience || "default",
             clientId: this.options.clientId
-        }));
+        }), undefined, this.options.useMrrt);
         return cache.access_token;
     }
     async isAuthenticated() {
@@ -2559,7 +2753,7 @@ class Auth0Client {
             scope: options.authorizationParams.scope,
             audience: options.authorizationParams.audience || "default",
             clientId: this.options.clientId
-        }));
+        }), undefined, this.options.useMrrt);
         if ((!cache || !cache.refresh_token) && !this.worker) {
             if (this.options.useRefreshTokensFallback) {
                 return await this._getTokenFromIFrame(options);
@@ -2568,6 +2762,7 @@ class Auth0Client {
         }
         const redirect_uri = options.authorizationParams.redirect_uri || this.options.authorizationParams.redirect_uri || window.location.origin;
         const timeout = typeof options.timeoutInSeconds === "number" ? options.timeoutInSeconds * 1e3 : null;
+        const scopesToRequest = getScopeToRequest(this.options.useMrrt, options.authorizationParams, cache === null || cache === void 0 ? void 0 : cache.audience, cache === null || cache === void 0 ? void 0 : cache.scope);
         try {
             const tokenResult = await this._requestToken(Object.assign(Object.assign(Object.assign({}, options.authorizationParams), {
                 grant_type: "refresh_token",
@@ -2575,7 +2770,24 @@ class Auth0Client {
                 redirect_uri: redirect_uri
             }), timeout && {
                 timeout: timeout
-            }));
+            }), {
+                scopesToRequest: scopesToRequest
+            });
+            if (tokenResult.refresh_token && this.options.useMrrt && (cache === null || cache === void 0 ? void 0 : cache.refresh_token)) {
+                await this.cacheManager.updateEntry(cache.refresh_token, tokenResult.refresh_token);
+            }
+            if (this.options.useMrrt) {
+                const isRefreshMrrt = isRefreshWithMrrt(cache === null || cache === void 0 ? void 0 : cache.audience, cache === null || cache === void 0 ? void 0 : cache.scope, options.authorizationParams.audience, options.authorizationParams.scope);
+                if (isRefreshMrrt) {
+                    const tokenHasAllScopes = allScopesAreIncluded(scopesToRequest, tokenResult.scope);
+                    if (!tokenHasAllScopes) {
+                        if (this.options.useRefreshTokensFallback) {
+                            return await this._getTokenFromIFrame(options);
+                        }
+                        throw new MissingRefreshTokenError(options.authorizationParams.audience || "default", options.authorizationParams.scope);
+                    }
+                }
+            }
             return Object.assign(Object.assign({}, tokenResult), {
                 scope: options.authorizationParams.scope,
                 oauthTokenScope: tokenResult.scope,
@@ -2611,12 +2823,12 @@ class Auth0Client {
         this.userCache.set(CACHE_KEY_ID_TOKEN_SUFFIX, cache);
         return cache;
     }
-    async _getEntryFromCache({scope: scope, audience: audience, clientId: clientId}) {
+    async _getEntryFromCache({scope: scope, audience: audience, clientId: clientId, cacheMode: cacheMode}) {
         const entry = await this.cacheManager.get(new CacheKey({
             scope: scope,
             audience: audience,
             clientId: clientId
-        }), 60);
+        }), 60, this.options.useMrrt, cacheMode);
         if (entry && entry.access_token) {
             const {token_type: token_type, access_token: access_token, oauthTokenScope: oauthTokenScope, expires_in: expires_in} = entry;
             const cache = await this._getIdTokenFromCache();
@@ -2632,15 +2844,18 @@ class Auth0Client {
         }
     }
     async _requestToken(options, additionalParameters) {
-        const {nonceIn: nonceIn, organization: organization} = additionalParameters || {};
-        const authResult = await oauthToken(Object.assign({
+        const {nonceIn: nonceIn, organization: organization, scopesToRequest: scopesToRequest} = additionalParameters || {};
+        const authResult = await oauthToken(Object.assign(Object.assign({
             baseUrl: this.domainUrl,
             client_id: this.options.clientId,
             auth0Client: this.options.auth0Client,
             useFormData: this.options.useFormData,
             timeout: this.httpTimeoutMs,
+            useMrrt: this.options.useMrrt,
             dpop: this.dpop
-        }, options), this.worker);
+        }, options), {
+            scope: scopesToRequest || options.scope
+        }), this.worker);
         const decodedToken = await this._verifyIdToken(authResult.id_token, nonceIn, organization);
         await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({}, authResult), {
             decodedToken: decodedToken,
@@ -2692,16 +2907,62 @@ class Auth0Client {
         }
         return new Fetcher(config, {
             isDpopEnabled: () => !!this.options.useDpop,
-            getAccessToken: () => this.getTokenSilently(),
+            getAccessToken: authParams => {
+                var _a;
+                return this.getTokenSilently({
+                    authorizationParams: {
+                        scope: (_a = authParams === null || authParams === void 0 ? void 0 : authParams.scope) === null || _a === void 0 ? void 0 : _a.join(" "),
+                        audience: authParams === null || authParams === void 0 ? void 0 : authParams.audience
+                    }
+                });
+            },
             getDpopNonce: () => this.getDpopNonce(config.dpopNonceId),
-            setDpopNonce: nonce => this.setDpopNonce(nonce),
+            setDpopNonce: nonce => this.setDpopNonce(nonce, config.dpopNonceId),
             generateDpopProof: params => this.generateDpopProof(params)
         });
     }
+    async connectAccountWithRedirect(options) {
+        if (!this.options.useDpop) {
+            throw new Error("`useDpop` option must be enabled before using connectAccountWithRedirect.");
+        }
+        if (!this.options.useMrrt) {
+            throw new Error("`useMrrt` option must be enabled before using connectAccountWithRedirect.");
+        }
+        const {openUrl: openUrl, appState: appState, connection: connection, authorization_params: authorization_params, redirectUri: redirectUri = this.options.authorizationParams.redirect_uri || window.location.origin} = options;
+        if (!connection) {
+            throw new Error("connection is required");
+        }
+        const state = encode(createRandomString());
+        const code_verifier = createRandomString();
+        const code_challengeBuffer = await sha256(code_verifier);
+        const code_challenge = bufferToBase64UrlEncoded(code_challengeBuffer);
+        const {connect_uri: connect_uri, connect_params: connect_params, auth_session: auth_session} = await this.myAccountApi.connectAccount({
+            connection: connection,
+            redirect_uri: redirectUri,
+            state: state,
+            code_challenge: code_challenge,
+            code_challenge_method: "S256",
+            authorization_params: authorization_params
+        });
+        this.transactionManager.create({
+            state: state,
+            code_verifier: code_verifier,
+            auth_session: auth_session,
+            redirect_uri: redirectUri,
+            appState: appState,
+            connection: connection,
+            response_type: exports.ResponseType.ConnectCode
+        });
+        const url = new URL(connect_uri);
+        url.searchParams.set("ticket", connect_params.ticket);
+        if (openUrl) {
+            await openUrl(url.toString());
+        } else {
+            window.location.assign(url);
+        }
+    }
 }
 
-class User {}
-
 async function createAuth0Client(options) {
     const auth0 = new Auth0Client(options);
     await auth0.checkSession();
@@ -2714,6 +2975,8 @@ exports.AuthenticationError = AuthenticationError;
 
 exports.CacheKey = CacheKey;
 
+exports.ConnectError = ConnectError;
+
 exports.GenericError = GenericError;
 
 exports.InMemoryCache = InMemoryCache;
@@ -2724,6 +2987,8 @@ exports.MfaRequiredError = MfaRequiredError;
 
 exports.MissingRefreshTokenError = MissingRefreshTokenError;
 
+exports.MyAccountApiError = MyAccountApiError;
+
 exports.PopupCancelledError = PopupCancelledError;
 
 exports.PopupTimeoutError = PopupTimeoutError;