@authme/util 2.8.45 → 2.8.46

package/index.cjs.js

@@ -25,8 +25,10 @@ require('core-js/modules/es.typed-array.to-locale-string.js');
 require('core-js/modules/es.typed-array.to-reversed.js');
 require('core-js/modules/es.typed-array.to-sorted.js');
 require('core-js/modules/es.typed-array.with.js');
-require('core-js/modules/esnext.uint8-array.to-base64.js');
-require('core-js/modules/esnext.uint8-array.to-hex.js');
+require('core-js/modules/es.uint8-array.set-from-base64.js');
+require('core-js/modules/es.uint8-array.set-from-hex.js');
+require('core-js/modules/es.uint8-array.to-base64.js');
+require('core-js/modules/es.uint8-array.to-hex.js');
 require('core-js/modules/web.atob.js');
 require('core-js/modules/web.dom-collections.iterator.js');
 require('core-js/modules/web.dom-exception.constructor.js');
@@ -35,12 +37,12 @@ require('core-js/modules/web.dom-exception.to-string-tag.js');
 require('core-js/modules/es.array.push.js');
 require('core-js/modules/es.error.cause.js');
 require('core-js/modules/es.array.includes.js');
+require('core-js/modules/es.iterator.constructor.js');
+require('core-js/modules/es.iterator.for-each.js');
+require('core-js/modules/es.json.parse.js');
 require('core-js/modules/es.json.stringify.js');
 require('core-js/modules/es.string.search.js');
 require('core-js/modules/es.typed-array.uint32-array.js');
-require('core-js/modules/esnext.iterator.constructor.js');
-require('core-js/modules/esnext.iterator.for-each.js');
-require('core-js/modules/esnext.json.parse.js');
 require('core-js/modules/web.url-search-params.js');
 require('core-js/modules/web.url-search-params.delete.js');
 require('core-js/modules/web.url-search-params.has.js');
@@ -49,13 +51,13 @@ var require$$0 = require('stream');
 var require$$2 = require('events');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
+require('core-js/modules/es.iterator.map.js');
 require('core-js/modules/es.parse-int.js');
-require('core-js/modules/esnext.iterator.map.js');
 require('core-js/modules/es.array.sort.js');
 require('core-js/modules/es.global-this.js');
+require('core-js/modules/es.iterator.filter.js');
 require('core-js/modules/es.number.to-fixed.js');
 require('core-js/modules/es.string.includes.js');
-require('core-js/modules/esnext.iterator.filter.js');
 require('core-js/modules/es.string.starts-with.js');
 require('core-js/modules/es.string.trim.js');
 
@@ -327,10 +329,66 @@ const verificationErrorMessages = code => {
   }
 };
 
-function e(e){this.message=e;}e.prototype=new Error,e.prototype.name="InvalidCharacterError";var r="undefined"!=typeof window&&window.atob&&window.atob.bind(window)||function(r){var t=String(r).replace(/=+$/,"");if(t.length%4==1)throw new e("'atob' failed: The string to be decoded is not correctly encoded.");for(var n,o,a=0,i=0,c="";o=t.charAt(i++);~o&&(n=a%4?64*n+o:o,a++%4)?c+=String.fromCharCode(255&n>>(-2*a&6)):0)o="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(o);return c};function t(e){var t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw "Illegal base64url string!"}try{return function(e){return decodeURIComponent(r(e).replace(/(.)/g,(function(e,r){var t=r.charCodeAt(0).toString(16).toUpperCase();return t.length<2&&(t="0"+t),"%"+t})))}(t)}catch(e){return r(t)}}function n(e){this.message=e;}function o(e,r){if("string"!=typeof e)throw new n("Invalid token specified");var o=true===(r=r||{}).header?0:1;try{return JSON.parse(t(e.split(".")[o]))}catch(e){throw new n("Invalid token specified: "+e.message)}}n.prototype=new Error,n.prototype.name="InvalidTokenError";
+class InvalidTokenError extends Error {
+}
+InvalidTokenError.prototype.name = "InvalidTokenError";
+function b64DecodeUnicode(str) {
+    return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {
+        let code = p.charCodeAt(0).toString(16).toUpperCase();
+        if (code.length < 2) {
+            code = "0" + code;
+        }
+        return "%" + code;
+    }));
+}
+function base64UrlDecode(str) {
+    let output = str.replace(/-/g, "+").replace(/_/g, "/");
+    switch (output.length % 4) {
+        case 0:
+            break;
+        case 2:
+            output += "==";
+            break;
+        case 3:
+            output += "=";
+            break;
+        default:
+            throw new Error("base64 string is not of the correct length");
+    }
+    try {
+        return b64DecodeUnicode(output);
+    }
+    catch (err) {
+        return atob(output);
+    }
+}
+function jwtDecode(token, options) {
+    if (typeof token !== "string") {
+        throw new InvalidTokenError("Invalid token specified: must be a string");
+    }
+    options || (options = {});
+    const pos = options.header === true ? 0 : 1;
+    const part = token.split(".")[pos];
+    if (typeof part !== "string") {
+        throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);
+    }
+    let decoded;
+    try {
+        decoded = base64UrlDecode(part);
+    }
+    catch (e) {
+        throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);
+    }
+    try {
+        return JSON.parse(decoded);
+    }
+    catch (e) {
+        throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);
+    }
+}
 
 function decodeToken(token) {
-  const decoded = o(token);
+  const decoded = jwtDecode(token);
   const {
     exp,
     iat
@@ -656,7 +714,7 @@ function getDefaultExportFromCjs (x) {
 
 var FileSaver_min = {exports: {}};
 
-(function (module, exports) {
+(function (module, exports$1) {
 	(function(a,b){b();})(commonjsGlobal,function(){function b(a,b){return "undefined"==typeof b?b={autoBom:false}:"object"!=typeof b&&(console.warn("Deprecated: Expected third argument to be a object"),b={autoBom:!b}),b.autoBom&&/^\s*(?:text\/\S*|application\/xml|\S*\/\S*\+xml)\s*;.*charset\s*=\s*utf-8/i.test(a.type)?new Blob(["\uFEFF",a],{type:a.type}):a}function c(a,b,c){var d=new XMLHttpRequest;d.open("GET",a),d.responseType="blob",d.onload=function(){g(d.response,b,c);},d.onerror=function(){console.error("could not download file");},d.send();}function d(a){var b=new XMLHttpRequest;b.open("HEAD",a,false);try{b.send();}catch(a){}return 200<=b.status&&299>=b.status}function e(a){try{a.dispatchEvent(new MouseEvent("click"));}catch(c){var b=document.createEvent("MouseEvents");b.initMouseEvent("click",true,true,window,0,0,0,80,20,false,false,false,false,0,null),a.dispatchEvent(b);}}var f="object"==typeof window&&window.window===window?window:"object"==typeof self&&self.self===self?self:"object"==typeof commonjsGlobal&&commonjsGlobal.global===commonjsGlobal?commonjsGlobal:void 0,a=f.navigator&&/Macintosh/.test(navigator.userAgent)&&/AppleWebKit/.test(navigator.userAgent)&&!/Safari/.test(navigator.userAgent),g=f.saveAs||("object"!=typeof window||window!==f?function(){}:"download"in HTMLAnchorElement.prototype&&!a?function(b,g,h){var i=f.URL||f.webkitURL,j=document.createElement("a");g=g||b.name||"download",j.download=g,j.rel="noopener","string"==typeof b?(j.href=b,j.origin===location.origin?e(j):d(j.href)?c(b,g,h):e(j,j.target="_blank")):(j.href=i.createObjectURL(b),setTimeout(function(){i.revokeObjectURL(j.href);},4E4),setTimeout(function(){e(j);},0));}:"msSaveOrOpenBlob"in navigator?function(f,g,h){if(g=g||f.name||"download","string"!=typeof f)navigator.msSaveOrOpenBlob(b(f,h),g);else if(d(f))c(f,g,h);else {var i=document.createElement("a");i.href=f,i.target="_blank",setTimeout(function(){e(i);});}}:function(b,d,e,g){if(g=g||open("","_blank"),g&&(g.document.title=g.document.body.innerText="downloading..."),"string"==typeof b)return c(b,d,e);var h="application/octet-stream"===b.type,i=/constructor/i.test(f.HTMLElement)||f.safari,j=/CriOS\/[\d]+/.test(navigator.userAgent);if((j||h&&i||a)&&"undefined"!=typeof FileReader){var k=new FileReader;k.onloadend=function(){var a=k.result;a=j?a:a.replace(/^data:[^;]*;/,"data:attachment/file;"),g?g.location.href=a:location=a,g=null;},k.readAsDataURL(b);}else {var l=f.URL||f.webkitURL,m=l.createObjectURL(b);g?g.location=m:location.href=m,g=null,setTimeout(function(){l.revokeObjectURL(m);},4E4);}});f.saveAs=g.saveAs=g,(module.exports=g);});
 
 	
@@ -749,16 +807,16 @@ function requireStream () {
 	return stream$1;
 }
 
-var safeBuffer$1 = {exports: {}};
+var safeBuffer = {exports: {}};
 
 /* eslint-disable node/no-deprecated-api */
 
-var hasRequiredSafeBuffer$1;
+var hasRequiredSafeBuffer;
 
-function requireSafeBuffer$1 () {
-	if (hasRequiredSafeBuffer$1) return safeBuffer$1.exports;
-	hasRequiredSafeBuffer$1 = 1;
-	(function (module, exports) {
+function requireSafeBuffer () {
+	if (hasRequiredSafeBuffer) return safeBuffer.exports;
+	hasRequiredSafeBuffer = 1;
+	(function (module, exports$1) {
 		var buffer = require$$0$1;
 		var Buffer = buffer.Buffer;
 
@@ -772,8 +830,8 @@ function requireSafeBuffer$1 () {
 		  module.exports = buffer;
 		} else {
 		  // Copy properties from require('buffer')
-		  copyProps(buffer, exports);
-		  exports.Buffer = SafeBuffer;
+		  copyProps(buffer, exports$1);
+		  exports$1.Buffer = SafeBuffer;
 		}
 
 		function SafeBuffer (arg, encodingOrOffset, length) {
@@ -820,8 +878,8 @@ function requireSafeBuffer$1 () {
 		  }
 		  return buffer.SlowBuffer(size)
 		}; 
-	} (safeBuffer$1, safeBuffer$1.exports));
-	return safeBuffer$1.exports;
+	} (safeBuffer, safeBuffer.exports));
+	return safeBuffer.exports;
 }
 
 var util = {};
@@ -1008,7 +1066,7 @@ function requireBufferList () {
 
 		function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
 
-		var Buffer = requireSafeBuffer$1().Buffer;
+		var Buffer = requireSafeBuffer().Buffer;
 		var util = require$$1;
 
 		function copyBuffer(src, target, offset) {
@@ -1246,7 +1304,7 @@ function require_stream_writable () {
 
 	/*<replacement>*/
 
-	var Buffer = requireSafeBuffer$1().Buffer;
+	var Buffer = requireSafeBuffer().Buffer;
 	var OurUint8Array = (typeof commonjsGlobal !== 'undefined' ? commonjsGlobal : typeof window !== 'undefined' ? window : typeof self !== 'undefined' ? self : {}).Uint8Array || function () {};
 	function _uint8ArrayToBuffer(chunk) {
 	  return Buffer.from(chunk);
@@ -1967,81 +2025,6 @@ function require_stream_duplex () {
 
 var string_decoder = {};
 
-var safeBuffer = {exports: {}};
-
-/* eslint-disable node/no-deprecated-api */
-
-var hasRequiredSafeBuffer;
-
-function requireSafeBuffer () {
-	if (hasRequiredSafeBuffer) return safeBuffer.exports;
-	hasRequiredSafeBuffer = 1;
-	(function (module, exports) {
-		var buffer = require$$0$1;
-		var Buffer = buffer.Buffer;
-
-		// alternative to using Object.keys for old browsers
-		function copyProps (src, dst) {
-		  for (var key in src) {
-		    dst[key] = src[key];
-		  }
-		}
-		if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
-		  module.exports = buffer;
-		} else {
-		  // Copy properties from require('buffer')
-		  copyProps(buffer, exports);
-		  exports.Buffer = SafeBuffer;
-		}
-
-		function SafeBuffer (arg, encodingOrOffset, length) {
-		  return Buffer(arg, encodingOrOffset, length)
-		}
-
-		// Copy static methods from Buffer
-		copyProps(Buffer, SafeBuffer);
-
-		SafeBuffer.from = function (arg, encodingOrOffset, length) {
-		  if (typeof arg === 'number') {
-		    throw new TypeError('Argument must not be a number')
-		  }
-		  return Buffer(arg, encodingOrOffset, length)
-		};
-
-		SafeBuffer.alloc = function (size, fill, encoding) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  var buf = Buffer(size);
-		  if (fill !== undefined) {
-		    if (typeof encoding === 'string') {
-		      buf.fill(fill, encoding);
-		    } else {
-		      buf.fill(fill);
-		    }
-		  } else {
-		    buf.fill(0);
-		  }
-		  return buf
-		};
-
-		SafeBuffer.allocUnsafe = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return Buffer(size)
-		};
-
-		SafeBuffer.allocUnsafeSlow = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return buffer.SlowBuffer(size)
-		}; 
-	} (safeBuffer, safeBuffer.exports));
-	return safeBuffer.exports;
-}
-
 var hasRequiredString_decoder;
 
 function requireString_decoder () {
@@ -2361,7 +2344,7 @@ function require_stream_readable () {
 
 	/*<replacement>*/
 
-	var Buffer = requireSafeBuffer$1().Buffer;
+	var Buffer = requireSafeBuffer().Buffer;
 	var OurUint8Array = (typeof commonjsGlobal !== 'undefined' ? commonjsGlobal : typeof window !== 'undefined' ? window : typeof self !== 'undefined' ? self : {}).Uint8Array || function () {};
 	function _uint8ArrayToBuffer(chunk) {
 	  return Buffer.from(chunk);
@@ -3523,25 +3506,25 @@ var hasRequiredReadable;
 function requireReadable () {
 	if (hasRequiredReadable) return readable.exports;
 	hasRequiredReadable = 1;
-	(function (module, exports) {
+	(function (module, exports$1) {
 		var Stream = require$$0;
 		if (process.env.READABLE_STREAM === 'disable' && Stream) {
 		  module.exports = Stream;
-		  exports = module.exports = Stream.Readable;
-		  exports.Readable = Stream.Readable;
-		  exports.Writable = Stream.Writable;
-		  exports.Duplex = Stream.Duplex;
-		  exports.Transform = Stream.Transform;
-		  exports.PassThrough = Stream.PassThrough;
-		  exports.Stream = Stream;
+		  exports$1 = module.exports = Stream.Readable;
+		  exports$1.Readable = Stream.Readable;
+		  exports$1.Writable = Stream.Writable;
+		  exports$1.Duplex = Stream.Duplex;
+		  exports$1.Transform = Stream.Transform;
+		  exports$1.PassThrough = Stream.PassThrough;
+		  exports$1.Stream = Stream;
 		} else {
-		  exports = module.exports = require_stream_readable();
-		  exports.Stream = Stream || exports;
-		  exports.Readable = exports;
-		  exports.Writable = require_stream_writable();
-		  exports.Duplex = require_stream_duplex();
-		  exports.Transform = require_stream_transform();
-		  exports.PassThrough = require_stream_passthrough();
+		  exports$1 = module.exports = require_stream_readable();
+		  exports$1.Stream = Stream || exports$1;
+		  exports$1.Readable = exports$1;
+		  exports$1.Writable = require_stream_writable();
+		  exports$1.Duplex = require_stream_duplex();
+		  exports$1.Transform = require_stream_transform();
+		  exports$1.PassThrough = require_stream_passthrough();
 		} 
 	} (readable, readable.exports));
 	return readable.exports;
@@ -4353,7 +4336,7 @@ var hasRequiredUtils;
 function requireUtils () {
 	if (hasRequiredUtils) return utils$q;
 	hasRequiredUtils = 1;
-	(function (exports) {
+	(function (exports$1) {
 
 		var support = support$4;
 		var base64 = requireBase64();
@@ -4392,8 +4375,8 @@ function requireUtils () {
 		 * @param {String} type the mime type of the blob.
 		 * @return {Blob} the created blob.
 		 */
-		exports.newBlob = function(part, type) {
-		    exports.checkSupport("blob");
+		exports$1.newBlob = function(part, type) {
+		    exports$1.checkSupport("blob");
 
 		    try {
 		        // Blob constructor
@@ -4528,7 +4511,7 @@ function requireUtils () {
 		    // This code is inspired by http://jsperf.com/arraybuffer-to-string-apply-performance/2
 		    // TODO : we now have workers that split the work. Do we still need that ?
 		    var chunk = 65536,
-		        type = exports.getTypeOf(array),
+		        type = exports$1.getTypeOf(array),
 		        canUseApply = true;
 		    if (type === "uint8array") {
 		        canUseApply = arrayToStringHelper.applyCanBeUsed.uint8array;
@@ -4551,7 +4534,7 @@ function requireUtils () {
 		    return arrayToStringHelper.stringifyByChar(array);
 		}
 
-		exports.applyFromCharCode = arrayLikeToString;
+		exports$1.applyFromCharCode = arrayLikeToString;
 
 
 		/**
@@ -4657,7 +4640,7 @@ function requireUtils () {
 		 * @param {String|Array|ArrayBuffer|Uint8Array|Buffer} input the input to convert.
 		 * @throws {Error} an Error if the browser doesn't support the requested output type.
 		 */
-		exports.transformTo = function(outputType, input) {
+		exports$1.transformTo = function(outputType, input) {
 		    if (!input) {
 		        // undefined, null, etc
 		        // an empty string won't harm.
@@ -4666,8 +4649,8 @@ function requireUtils () {
 		    if (!outputType) {
 		        return input;
 		    }
-		    exports.checkSupport(outputType);
-		    var inputType = exports.getTypeOf(input);
+		    exports$1.checkSupport(outputType);
+		    var inputType = exports$1.getTypeOf(input);
 		    var result = transform[inputType][outputType](input);
 		    return result;
 		};
@@ -4680,7 +4663,7 @@ function requireUtils () {
 		 * @param {string} path A path with / or \ separators
 		 * @returns {string} The path with all relative path components resolved.
 		 */
-		exports.resolve = function(path) {
+		exports$1.resolve = function(path) {
 		    var parts = path.split("/");
 		    var result = [];
 		    for (var index = 0; index < parts.length; index++) {
@@ -4703,7 +4686,7 @@ function requireUtils () {
 		 * @param {Object} input the input to identify.
 		 * @return {String} the (lowercase) type of the input.
 		 */
-		exports.getTypeOf = function(input) {
+		exports$1.getTypeOf = function(input) {
 		    if (typeof input === "string") {
 		        return "string";
 		    }
@@ -4726,22 +4709,22 @@ function requireUtils () {
 		 * @param {String} type the type to check.
 		 * @throws {Error} an Error if the browser doesn't support the requested type.
 		 */
-		exports.checkSupport = function(type) {
+		exports$1.checkSupport = function(type) {
 		    var supported = support[type.toLowerCase()];
 		    if (!supported) {
 		        throw new Error(type + " is not supported by this platform");
 		    }
 		};
 
-		exports.MAX_VALUE_16BITS = 65535;
-		exports.MAX_VALUE_32BITS = -1; // well, "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" is parsed as -1
+		exports$1.MAX_VALUE_16BITS = 65535;
+		exports$1.MAX_VALUE_32BITS = -1; // well, "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" is parsed as -1
 
 		/**
 		 * Prettify a string read as binary.
 		 * @param {string} str the string to prettify.
 		 * @return {string} a pretty string.
 		 */
-		exports.pretty = function(str) {
+		exports$1.pretty = function(str) {
 		    var res = "",
 		        code, i;
 		    for (i = 0; i < (str || "").length; i++) {
@@ -4756,7 +4739,7 @@ function requireUtils () {
 		 * @param {Function} callback the function to call asynchronously.
 		 * @param {Array} args the arguments to give to the callback.
 		 */
-		exports.delay = function(callback, args, self) {
+		exports$1.delay = function(callback, args, self) {
 		    setImmediate(function () {
 		        callback.apply(self || null, args || []);
 		    });
@@ -4768,7 +4751,7 @@ function requireUtils () {
 		 * @param {Function} ctor the constructor to augment
 		 * @param {Function} superCtor the parent constructor to use
 		 */
-		exports.inherits = function (ctor, superCtor) {
+		exports$1.inherits = function (ctor, superCtor) {
 		    var Obj = function() {};
 		    Obj.prototype = superCtor.prototype;
 		    ctor.prototype = new Obj();
@@ -4780,7 +4763,7 @@ function requireUtils () {
 		 * @param {...Object} var_args All objects to merge.
 		 * @return {Object} a new object with the data of the others.
 		 */
-		exports.extend = function() {
+		exports$1.extend = function() {
 		    var result = {}, i, attr;
 		    for (i = 0; i < arguments.length; i++) { // arguments is not enumerable in some browsers
 		        for (attr in arguments[i]) {
@@ -4801,7 +4784,7 @@ function requireUtils () {
 		 * @param {Boolean} isBase64 true if the string content is encoded with base64.
 		 * @return {Promise} a promise in a format usable by JSZip.
 		 */
-		exports.prepareContent = function(name, inputData, isBinary, isOptimizedBinaryString, isBase64) {
+		exports$1.prepareContent = function(name, inputData, isBinary, isOptimizedBinaryString, isBase64) {
 
 		    // if inputData is already a promise, this flatten it.
 		    var promise = external.Promise.resolve(inputData).then(function(data) {
@@ -4827,7 +4810,7 @@ function requireUtils () {
 		    });
 
 		    return promise.then(function(data) {
-		        var dataType = exports.getTypeOf(data);
+		        var dataType = exports$1.getTypeOf(data);
 
 		        if (!dataType) {
 		            return external.Promise.reject(
@@ -4837,7 +4820,7 @@ function requireUtils () {
 		        }
 		        // special case : it's way easier to work with Uint8Array than with ArrayBuffer
 		        if (dataType === "arraybuffer") {
-		            data = exports.transformTo("uint8array", data);
+		            data = exports$1.transformTo("uint8array", data);
 		        } else if (dataType === "string") {
 		            if (isBase64) {
 		                data = base64.decode(data);
@@ -5120,7 +5103,7 @@ GenericWorker$b.prototype = {
 
 var GenericWorker_1 = GenericWorker$b;
 
-(function (exports) {
+(function (exports$1) {
 
 	var utils = requireUtils();
 	var support = support$4;
@@ -5288,7 +5271,7 @@ var GenericWorker_1 = GenericWorker$b;
 	 * @param {String} str the string to encode
 	 * @return {Array|Uint8Array|Buffer} the UTF-8 encoded string.
 	 */
-	exports.utf8encode = function utf8encode(str) {
+	exports$1.utf8encode = function utf8encode(str) {
 	    if (support.nodebuffer) {
 	        return nodejsUtils.newBufferFrom(str, "utf-8");
 	    }
@@ -5303,7 +5286,7 @@ var GenericWorker_1 = GenericWorker$b;
 	 * @param {Array|Uint8Array|Buffer} buf the data de decode
 	 * @return {String} the decoded string.
 	 */
-	exports.utf8decode = function utf8decode(buf) {
+	exports$1.utf8decode = function utf8decode(buf) {
 	    if (support.nodebuffer) {
 	        return utils.transformTo("nodebuffer", buf).toString("utf-8");
 	    }
@@ -5357,7 +5340,7 @@ var GenericWorker_1 = GenericWorker$b;
 	    }
 
 	    this.push({
-	        data : exports.utf8decode(usableData),
+	        data : exports$1.utf8decode(usableData),
 	        meta : chunk.meta
 	    });
 	};
@@ -5368,13 +5351,13 @@ var GenericWorker_1 = GenericWorker$b;
 	Utf8DecodeWorker.prototype.flush = function () {
 	    if(this.leftOver && this.leftOver.length) {
 	        this.push({
-	            data : exports.utf8decode(this.leftOver),
+	            data : exports$1.utf8decode(this.leftOver),
 	            meta : {}
 	        });
 	        this.leftOver = null;
 	    }
 	};
-	exports.Utf8DecodeWorker = Utf8DecodeWorker;
+	exports$1.Utf8DecodeWorker = Utf8DecodeWorker;
 
 	/**
 	 * A worker to endcode string chunks into utf8 encoded binary chunks.
@@ -5390,11 +5373,11 @@ var GenericWorker_1 = GenericWorker$b;
 	 */
 	Utf8EncodeWorker.prototype.processChunk = function (chunk) {
 	    this.push({
-	        data : exports.utf8encode(chunk.data),
+	        data : exports$1.utf8encode(chunk.data),
 	        meta : chunk.meta
 	    });
 	};
-	exports.Utf8EncodeWorker = Utf8EncodeWorker; 
+	exports$1.Utf8EncodeWorker = Utf8EncodeWorker; 
 } (utf8$5));
 
 var GenericWorker$a = GenericWorker_1;
@@ -6152,7 +6135,7 @@ var flate = {};
 
 var common = {};
 
-(function (exports) {
+(function (exports$1) {
 
 
 	var TYPED_OK =  (typeof Uint8Array !== 'undefined') &&
@@ -6163,7 +6146,7 @@ var common = {};
 	  return Object.prototype.hasOwnProperty.call(obj, key);
 	}
 
-	exports.assign = function (obj /*from1, from2, from3, ...*/) {
+	exports$1.assign = function (obj /*from1, from2, from3, ...*/) {
 	  var sources = Array.prototype.slice.call(arguments, 1);
 	  while (sources.length) {
 	    var source = sources.shift();
@@ -6185,7 +6168,7 @@ var common = {};
 
 
 	// reduce buffer size, avoiding mem copy
-	exports.shrinkBuf = function (buf, size) {
+	exports$1.shrinkBuf = function (buf, size) {
 	  if (buf.length === size) { return buf; }
 	  if (buf.subarray) { return buf.subarray(0, size); }
 	  buf.length = size;
@@ -6242,21 +6225,21 @@ var common = {};
 
 	// Enable/Disable typed arrays use, for testing
 	//
-	exports.setTyped = function (on) {
+	exports$1.setTyped = function (on) {
 	  if (on) {
-	    exports.Buf8  = Uint8Array;
-	    exports.Buf16 = Uint16Array;
-	    exports.Buf32 = Int32Array;
-	    exports.assign(exports, fnTyped);
+	    exports$1.Buf8  = Uint8Array;
+	    exports$1.Buf16 = Uint16Array;
+	    exports$1.Buf32 = Int32Array;
+	    exports$1.assign(exports$1, fnTyped);
 	  } else {
-	    exports.Buf8  = Array;
-	    exports.Buf16 = Array;
-	    exports.Buf32 = Array;
-	    exports.assign(exports, fnUntyped);
+	    exports$1.Buf8  = Array;
+	    exports$1.Buf16 = Array;
+	    exports$1.Buf32 = Array;
+	    exports$1.assign(exports$1, fnUntyped);
 	  }
 	};
 
-	exports.setTyped(TYPED_OK); 
+	exports$1.setTyped(TYPED_OK); 
 } (common));
 
 var deflate$4 = {};
@@ -14984,10 +14967,10 @@ var load = function (data, options) {
  * Representation a of zip file in js
  * @constructor
  */
-function JSZip() {
+function JSZip$1() {
     // if this constructor is used without `new`, it adds `new` before itself:
-    if(!(this instanceof JSZip)) {
-        return new JSZip();
+    if(!(this instanceof JSZip$1)) {
+        return new JSZip$1();
     }
 
     if(arguments.length) {
@@ -15009,7 +14992,7 @@ function JSZip() {
     // Where we are in the hierarchy
     this.root = "";
     this.clone = function() {
-        var newObj = new JSZip();
+        var newObj = new JSZip$1();
         for (var i in this) {
             if (typeof this[i] !== "function") {
                 newObj[i] = this[i];
@@ -15018,23 +15001,23 @@ function JSZip() {
         return newObj;
     };
 }
-JSZip.prototype = object;
-JSZip.prototype.loadAsync = load;
-JSZip.support = support$4;
-JSZip.defaults = defaults$1;
+JSZip$1.prototype = object;
+JSZip$1.prototype.loadAsync = load;
+JSZip$1.support = support$4;
+JSZip$1.defaults = defaults$1;
 
 // TODO find a better way to handle this version,
 // a require('package.json').version doesn't work with webpack, see #327
-JSZip.version = "3.10.1";
+JSZip$1.version = "3.10.1";
 
-JSZip.loadAsync = function (content, options) {
-    return new JSZip().loadAsync(content, options);
+JSZip$1.loadAsync = function (content, options) {
+    return new JSZip$1().loadAsync(content, options);
 };
 
-JSZip.external = external$3;
-var lib = JSZip;
+JSZip$1.external = external$3;
+var lib = JSZip$1;
 
-var JSZip$1 = /*@__PURE__*/getDefaultExportFromCjs(lib);
+var JSZip = /*@__PURE__*/getDefaultExportFromCjs(lib);
 
 function fileSaverService() {
   const filesQueue = [];
@@ -15045,7 +15028,7 @@ function fileSaverService() {
     filesQueue.splice(0, filesQueue.length);
   }
   async function saveFiles(fileName, json) {
-    const zip = new JSZip$1();
+    const zip = new JSZip();
     filesQueue.forEach(fileItem => {
       zip.file(fileItem.name, fileItem.file);
     });
@@ -15619,7 +15602,7 @@ const uiThemeSmallButton = (dom, buttonStyle) => {
 
 var lottie$1 = {exports: {}};
 
-(function (module, exports) {
+(function (module, exports$1) {
 	(typeof document !== "undefined") && (typeof navigator !== "undefined") && (function (global, factory) {
 	  module.exports = factory() ;
 	})(commonjsGlobal, (function () {
@@ -20046,7 +20029,7 @@ var lottie$1 = {exports: {}};
 
 	  // this adds bodymovin to the window object for backwards compatibility
 	  try {
-	    if (!(('object' === "undefined" ? "undefined" : _typeof$3(exports)) === 'object' && 'object' !== 'undefined') && !(typeof undefined === 'function' && undefined.amd) // eslint-disable-line no-undef
+	    if (!(('object' === "undefined" ? "undefined" : _typeof$3(exports$1)) === 'object' && 'object' !== 'undefined') && !(typeof undefined === 'function' && undefined.amd) // eslint-disable-line no-undef
 	    ) {
 	      window.bodymovin = lottie;
 	    }
@@ -34519,6 +34502,43 @@ window.ononline = () => {
   });
 };
 
+/**
+ * 將 API 回傳的主題配置與預設值進行深層合併。
+ * - 不會修改 themeConfigDefault
+ * - 巢狀物件會逐一屬性合併（API 只需提供要覆寫的屬性）
+ * - 自動過濾 null / undefined 值，避免覆蓋預設值
+ */
+function mergeThemeConfig(apiConfig) {
+  const result = {};
+  for (const key of Object.keys(themeConfigDefault)) {
+    const defaultVal = themeConfigDefault[key];
+    const apiVal = apiConfig == null ? void 0 : apiConfig[key];
+    if (defaultVal != null && typeof defaultVal === 'object' && !Array.isArray(defaultVal)) {
+      // 巢狀物件：逐一屬性合併，過濾 null/undefined
+      const merged = Object.assign({}, defaultVal);
+      if (apiVal != null && typeof apiVal === 'object') {
+        for (const [k, v] of Object.entries(apiVal)) {
+          if (v != null) {
+            merged[k] = v;
+          }
+        }
+      }
+      result[key] = merged;
+    } else {
+      // 純值：API 有提供且非 null/undefined 才覆寫
+      result[key] = apiVal != null ? apiVal : defaultVal;
+    }
+  }
+  // 保留 API 回傳但預設值沒有的新屬性
+  if (apiConfig != null && typeof apiConfig === 'object') {
+    for (const key of Object.keys(apiConfig)) {
+      if (!(key in result) && apiConfig[key] != null) {
+        result[key] = apiConfig[key];
+      }
+    }
+  }
+  return result;
+}
 const themeConfigDefault = {
   isFraudAnimationLoadingPageEnabled: true,
   isStatementEnabled: true,
@@ -34880,7 +34900,7 @@ const themeConfigDefault = {
 };
 
 var name = "authme/sdk";
-var version$1 = "2.8.45";
+var version$1 = "2.8.46";
 var packageInfo = {
 	name: name,
 	version: version$1};
@@ -34922,6 +34942,7 @@ exports.hidePopup = hidePopup;
 exports.isIphone14proOrProMax = isIphone14proOrProMax;
 exports.isMobile = isMobile;
 exports.isMobileOrTablet = isMobileOrTablet$1;
+exports.mergeThemeConfig = mergeThemeConfig;
 exports.osVersion = osVersion;
 exports.requestCamera = requestCamera;
 exports.resize = resize;