@axa-fr/oidc-client-service-worker 7.29.7 → 7.30.0

package/dist/OidcServiceWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"OidcServiceWorker.js","names":["getCurrentDatabasesTokenEndpoint"],"sources":["../src/constants.ts","../src/jwt.ts","../src/crypto.ts","../src/dpop.ts","../src/utils/normalizeUrl.ts","../src/utils/domains.ts","../src/utils/serializeHeaders.ts","../src/utils/shouldBypassDestination.ts","../src/utils/sleep.ts","../src/utils/tokens.ts","../src/utils/waitForValidTokens.ts","../src/oidcConfig.ts","../src/utils/codeVerifier.ts","../src/version.ts","../src/OidcServiceWorker.ts"],"sourcesContent":["const scriptFilename = 'OidcTrustedDomains.js';\nconst acceptAnyDomainToken = '*';\n\ntype TokenType = {\n  readonly REFRESH_TOKEN: string;\n  readonly ACCESS_TOKEN: string;\n  readonly NONCE_TOKEN: string;\n  readonly CODE_VERIFIER: string;\n};\n\nconst TOKEN: TokenType = {\n  REFRESH_TOKEN: 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  ACCESS_TOKEN: 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  NONCE_TOKEN: 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER',\n  CODE_VERIFIER: 'CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER',\n};\n\ntype TokenRenewModeType = {\n  readonly access_token_or_id_token_invalid: string;\n  readonly access_token_invalid: string;\n  readonly id_token_invalid: string;\n};\n\nconst TokenRenewMode: TokenRenewModeType = {\n  access_token_or_id_token_invalid: 'access_token_or_id_token_invalid',\n  access_token_invalid: 'access_token_invalid',\n  id_token_invalid: 'id_token_invalid',\n};\n\nconst openidWellknownUrlEndWith = '/.well-known/openid-configuration';\n\nexport { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename, TOKEN, TokenRenewMode };\n","// code base on https://coolaj86.com/articles/sign-jwt-webcrypto-vanilla-js/\n\n// String (UCS-2) to Uint8Array\n//\n// because... JavaScript, Strings, and Buffers\n// @ts-ignore\nimport { DemonstratingProofOfPossessionConfiguration } from './types';\n\nfunction strToUint8(str: string) {\n  return new TextEncoder().encode(str);\n}\n\n// Binary String to URL-Safe Base64\n//\n// btoa (Binary-to-Ascii) means \"binary string\" to base64\n// @ts-ignore\nfunction binToUrlBase64(bin) {\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+/g, '');\n}\n\n// UTF-8 to Binary String\n//\n// Because JavaScript has a strange relationship with strings\n// https://coolaj86.com/articles/base64-unicode-utf-8-javascript-and-you/\n// @ts-ignore\nfunction utf8ToBinaryString(str) {\n  const escstr = encodeURIComponent(str);\n  // replaces any uri escape sequence, such as %0A,\n  // with binary escape, such as 0x0A\n  // @ts-ignore\n  return escstr.replace(/%([0-9A-F]{2})/g, function (match: string, p1) {\n    return String.fromCharCode(parseInt(p1, 16));\n  });\n}\n\n// Uint8Array to URL Safe Base64\n//\n// the shortest distant between two encodings... binary string\n// @ts-ignore\nexport const uint8ToUrlBase64 = (uint8: Uint8Array) => {\n  let bin = '';\n  // @ts-ignore\n  uint8.forEach(function (code) {\n    bin += String.fromCharCode(code);\n  });\n  return binToUrlBase64(bin);\n};\n\n// UCS-2 String to URL-Safe Base64\n//\n// btoa doesn't work on UTF-8 strings\n// @ts-ignore\nfunction strToUrlBase64(str) {\n  return binToUrlBase64(utf8ToBinaryString(str));\n}\n\nexport const defaultDemonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration =\n  {\n    importKeyAlgorithm: {\n      name: 'ECDSA',\n      namedCurve: 'P-256',\n      hash: { name: 'ES256' },\n    },\n    signAlgorithm: { name: 'ECDSA', hash: { name: 'SHA-256' } },\n    generateKeyAlgorithm: {\n      name: 'ECDSA',\n      namedCurve: 'P-256',\n    },\n    digestAlgorithm: { name: 'SHA-256' },\n    jwtHeaderAlgorithm: 'ES256',\n  };\n\n// @ts-ignore\nconst sign =\n  (w: any) =>\n  async (\n    jwk: any,\n    headers: any,\n    claims: any,\n    demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration,\n    jwtHeaderType = 'dpop+jwt',\n  ) => {\n    // Make a shallow copy of the key\n    // (to set ext if it wasn't already set)\n    jwk = Object.assign({}, jwk);\n\n    // The headers should probably be empty\n    headers.typ = jwtHeaderType;\n    headers.alg = demonstratingProofOfPossessionConfiguration.jwtHeaderAlgorithm;\n    switch (headers.alg) {\n      case 'ES256': //if (!headers.kid) {\n        // alternate: see thumbprint function below\n        headers.jwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };\n        //}\n        break;\n      case 'RS256':\n        headers.jwk = { kty: jwk.kty, n: jwk.n, e: jwk.e, kid: headers.kid };\n        break;\n      default:\n        throw new Error('Unknown or not implemented JWS algorithm');\n    }\n\n    const jws = {\n      // @ts-ignore\n      // JWT \"headers\" really means JWS \"protected headers\"\n      protected: strToUrlBase64(JSON.stringify(headers)),\n      // @ts-ignore\n      // JWT \"claims\" are really a JSON-defined JWS \"payload\"\n      payload: strToUrlBase64(JSON.stringify(claims)),\n    };\n\n    // To import as EC (ECDSA, P-256, SHA-256, ES256)\n    const keyType = demonstratingProofOfPossessionConfiguration.importKeyAlgorithm;\n\n    // To make re-exportable as JSON (or DER/PEM)\n    const exportable = true;\n\n    // Import as a private key that isn't black-listed from signing\n    const privileges = ['sign'];\n\n    // Actually do the import, which comes out as an abstract key type\n    // @ts-ignore\n    const privateKey = await w.crypto.subtle.importKey('jwk', jwk, keyType, exportable, privileges);\n    // Convert UTF-8 to Uint8Array ArrayBuffer\n    // @ts-ignore\n    const data = strToUint8(`${jws.protected}.${jws.payload}`);\n\n    // The signature and hash should match the bit-entropy of the key\n    // https://tools.ietf.org/html/rfc7518#section-3\n    const signatureType = demonstratingProofOfPossessionConfiguration.signAlgorithm;\n\n    const signature = await w.crypto.subtle.sign(signatureType, privateKey, data);\n    // returns an ArrayBuffer containing a JOSE (not X509) signature,\n    // which must be converted to Uint8 to be useful\n    // @ts-ignore\n    jws.signature = uint8ToUrlBase64(new Uint8Array(signature));\n    // JWT is just a \"compressed\", \"protected\" JWS\n    // @ts-ignore\n    return `${jws.protected}.${jws.payload}.${jws.signature}`;\n  };\n\nexport const JWT = { sign };\n\n// @ts-ignore\nconst generate =\n  (w: any) => async (generateKeyAlgorithm: RsaHashedKeyGenParams | EcKeyGenParams) => {\n    const keyType = generateKeyAlgorithm;\n    const exportable = true;\n    const privileges = ['sign', 'verify'];\n    // @ts-ignore\n    const key = await w.crypto.subtle.generateKey(keyType, exportable, privileges);\n    // returns an abstract and opaque WebCrypto object,\n    // which in most cases you'll want to export as JSON to be able to save\n    return await w.crypto.subtle.exportKey('jwk', key.privateKey);\n  };\n\n// Create a Public Key from a Private Key\n//\n// chops off the private parts\n// @ts-ignore\nconst neuter = jwk => {\n  const copy = Object.assign({}, jwk);\n  delete copy.d;\n  copy.key_ops = ['verify'];\n  return copy;\n};\n\nconst EC = {\n  generate,\n  neuter,\n};\n// @ts-ignore\nconst thumbprint = (w: any) => async (jwk, digestAlgorithm: AlgorithmIdentifier) => {\n  let sortedPub;\n  // lexigraphically sorted, no spaces\n  switch (jwk.kty) {\n    case 'EC':\n      sortedPub = '{\"crv\":\"CRV\",\"kty\":\"EC\",\"x\":\"X\",\"y\":\"Y\"}'\n        .replace('CRV', jwk.crv)\n        .replace('X', jwk.x)\n        .replace('Y', jwk.y);\n      break;\n    case 'RSA':\n      sortedPub = '{\"e\":\"E\",\"kty\":\"RSA\",\"n\":\"N\"}'.replace('E', jwk.e).replace('N', jwk.n);\n      break;\n    default:\n      throw new Error('Unknown or not implemented JWK type');\n  }\n  // The hash should match the size of the key,\n  // but we're only dealing with P-256\n  const hash = await w.crypto.subtle.digest(digestAlgorithm, strToUint8(sortedPub));\n  return uint8ToUrlBase64(new Uint8Array(hash));\n};\n\nexport const JWK = { thumbprint };\n\nexport const generateJwkAsync =\n  (w: any) => async (generateKeyAlgorithm: RsaHashedKeyGenParams | EcKeyGenParams) => {\n    // @ts-ignore\n    const jwk = await EC.generate(w)(generateKeyAlgorithm);\n    // console.info('Private Key:', JSON.stringify(jwk));\n    // @ts-ignore\n    // console.info('Public Key:', JSON.stringify(EC.neuter(jwk)));\n    return jwk;\n  };\n\nexport const generateJwtDemonstratingProofOfPossessionAsync =\n  (w: any) =>\n  (demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration) =>\n  async (jwk: any, method = 'POST', url: string, extrasClaims = {}) => {\n    const claims = {\n      // https://www.rfc-editor.org/rfc/rfc9449.html#name-concept\n      jti: btoa(w.crypto.randomUUID()),\n      htm: method,\n      htu: url,\n      iat: Math.round(Date.now() / 1000),\n      ...extrasClaims,\n    };\n    // @ts-ignore\n    const kid = await JWK.thumbprint(w)(\n      jwk,\n      demonstratingProofOfPossessionConfiguration.digestAlgorithm,\n    );\n    // @ts-ignore\n    const jwt = await JWT.sign(w)(\n      jwk,\n      { kid: kid },\n      claims,\n      demonstratingProofOfPossessionConfiguration,\n    );\n    // console.info('JWT:', jwt);\n    return jwt;\n  };\n","import { uint8ToUrlBase64 } from './jwt';\n\nexport function textEncodeLite(str: string) {\n  const buf = new ArrayBuffer(str.length);\n  const bufView = new Uint8Array(buf);\n\n  for (let i = 0; i < str.length; i++) {\n    bufView[i] = str.charCodeAt(i);\n  }\n  return bufView;\n}\n\nexport function base64urlOfHashOfASCIIEncodingAsync(code: string): Promise<string> {\n  return new Promise((resolve, reject) => {\n    crypto.subtle.digest('SHA-256', textEncodeLite(code)).then(\n      buffer => {\n        return resolve(uint8ToUrlBase64(new Uint8Array(buffer)));\n      },\n      error => reject(error),\n    );\n  });\n}\n","import { defaultDemonstratingProofOfPossessionConfiguration } from './jwt';\nimport { Domain, DomainDetails } from './types.js';\n\nconst isDpop = (trustedDomain: Domain[] | DomainDetails): boolean => {\n  if (Array.isArray(trustedDomain)) {\n    return false;\n  }\n  return trustedDomain.demonstratingProofOfPossession ?? false;\n};\n\nexport const getDpopConfiguration = (trustedDomain: Domain[] | DomainDetails) => {\n  if (!isDpop(trustedDomain)) {\n    return null;\n  }\n\n  if (Array.isArray(trustedDomain)) {\n    return null;\n  }\n\n  return (\n    trustedDomain.demonstratingProofOfPossessionConfiguration ??\n    defaultDemonstratingProofOfPossessionConfiguration\n  );\n};\n\nexport const getDpopOnlyWhenDpopHeaderPresent = (trustedDomain: Domain[] | DomainDetails) => {\n  if (!isDpop(trustedDomain)) {\n    return null;\n  }\n\n  if (Array.isArray(trustedDomain)) {\n    return null;\n  }\n\n  return trustedDomain.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ?? true;\n};\n","export function normalizeUrl(url: string) {\n  try {\n    return new URL(url).toString();\n  } catch (error) {\n    console.error(`Failed to normalize url: ${url}`, error);\n    return url;\n  }\n}\n","import { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename } from '../constants';\nimport { Database, Domain, DomainDetails, OidcConfig, TrustedDomains } from '../types';\nimport { normalizeUrl } from './normalizeUrl';\n\nexport function checkDomain(domains: Domain[], endpoint: string) {\n  if (!endpoint) {\n    return;\n  }\n\n  const domain = domains.find(domain => {\n    let testable: RegExp;\n\n    if (typeof domain === 'string') {\n      testable = new RegExp(`^${domain}`);\n    } else {\n      testable = domain;\n    }\n\n    return testable.test?.(endpoint);\n  });\n  if (!domain) {\n    throw new Error(\n      'Domain ' + endpoint + ' is not trusted, please add domain in ' + scriptFilename,\n    );\n  }\n}\n\nexport const getDomains = (\n  trustedDomain: Domain[] | DomainDetails,\n  type: 'oidc' | 'accessToken',\n) => {\n  if (Array.isArray(trustedDomain)) {\n    return trustedDomain;\n  }\n\n  return trustedDomain[`${type}Domains`] ?? trustedDomain.domains ?? [];\n};\n\nexport const getCurrentDatabaseDomain = (\n  database: Database,\n  url: string,\n  trustedDomains: TrustedDomains,\n) => {\n  if (url.endsWith(openidWellknownUrlEndWith)) {\n    return null;\n  }\n  const datatases = [];\n  for (const [key, currentDatabase] of Object.entries<OidcConfig>(database)) {\n    const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;\n\n    if (!oidcServerConfiguration) {\n      continue;\n    }\n\n    if (\n      oidcServerConfiguration.tokenEndpoint &&\n      url === normalizeUrl(oidcServerConfiguration.tokenEndpoint)\n    ) {\n      continue;\n    }\n    if (\n      oidcServerConfiguration.revocationEndpoint &&\n      url === normalizeUrl(oidcServerConfiguration.revocationEndpoint)\n    ) {\n      continue;\n    }\n    const trustedDomain = trustedDomains == null ? [] : trustedDomains[key.split('#')[0]];\n\n    const domains = getDomains(trustedDomain, 'accessToken');\n    const domainsToSendTokens = oidcServerConfiguration.userInfoEndpoint\n      ? [normalizeUrl(oidcServerConfiguration.userInfoEndpoint), ...domains]\n      : [...domains];\n\n    let hasToSendToken = false;\n    if (domainsToSendTokens.find(f => f === acceptAnyDomainToken)) {\n      hasToSendToken = true;\n    } else {\n      for (let i = 0; i < domainsToSendTokens.length; i++) {\n        let domain = domainsToSendTokens[i];\n\n        if (typeof domain === 'string') {\n          domain = new RegExp(`^${domain}`);\n        }\n\n        if (domain.test?.(url)) {\n          hasToSendToken = true;\n          break;\n        }\n      }\n    }\n\n    if (hasToSendToken) {\n      if (currentDatabase.tokens) {\n        datatases.push(currentDatabase);\n      }\n    }\n  }\n  return datatases;\n};\n","function serializeHeaders(headers: Headers): Record<string, string> {\n  const headersObj: Record<string, string> = {};\n  for (const key of headers.keys()) {\n    const value = headers.get(key);\n    if (value !== null) {\n      headersObj[key] = value;\n    }\n  }\n  return headersObj;\n}\nexport { serializeHeaders };\n","const bypassedDestinations = ['image', 'font', 'media', 'document', 'iframe', 'script'];\n\n/**\n * Determines whether a fetch event should be bypassed (not intercepted by the service worker).\n * Navigation requests (mode === 'navigate') are never bypassed, even when their destination\n * is in the bypassed list, so that access tokens can be injected into new-tab navigations.\n */\nexport const shouldBypassDestination = (destination: string, mode: string): boolean => {\n  return bypassedDestinations.includes(destination) && mode !== 'navigate';\n};\n","const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));\nexport { sleep };\n","/* eslint-disable simple-import-sort/exports */\nimport { TOKEN, TokenRenewMode } from '../constants';\nimport {\n  AccessTokenPayload,\n  IdTokenPayload,\n  OidcConfig,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Tokens,\n} from '../types';\n\nexport const parseJwt = (payload: string) => {\n  return JSON.parse(b64DecodeUnicode(payload.replaceAll(/-/g, '+').replaceAll(/_/g, '/')));\n};\nfunction b64DecodeUnicode(str: string) {\n  return decodeURIComponent(\n    Array.prototype.map\n      .call(atob(str), c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n      .join(''),\n  );\n}\n\nfunction computeTimeLeft(refreshTimeBeforeTokensExpirationInSecond: number, expiresAt: number) {\n  const currentTimeUnixSecond = new Date().getTime() / 1000;\n  return Math.round(expiresAt - refreshTimeBeforeTokensExpirationInSecond - currentTimeUnixSecond);\n}\n\nfunction isTokensValid(tokens: Tokens | null) {\n  if (!tokens) {\n    return false;\n  }\n  return computeTimeLeft(0, tokens.expiresAt) > 0;\n}\n\nconst extractTokenPayload = (token?: string) => {\n  try {\n    if (!token) {\n      return null;\n    }\n    const parts = token.split('.');\n    return parts.length === 3 ? parseJwt(parts[1]) : null;\n  } catch (e) {\n    console.warn(e);\n  }\n  return null;\n};\n\n// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).\n// https://github.com/openid/AppAuth-JS/issues/65\nconst isTokensOidcValid = (\n  tokens: Tokens,\n  nonce: string | null,\n  oidcServerConfiguration: OidcServerConfiguration,\n): { isValid: boolean; reason: string } => {\n  if (tokens.idTokenPayload) {\n    const idTokenPayload = tokens.idTokenPayload;\n    // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.\n    if (idTokenPayload && oidcServerConfiguration.issuer !== idTokenPayload.iss) {\n      return {\n        isValid: false,\n        reason: `Issuer does not match (oidcServerConfiguration issuer) ${oidcServerConfiguration.issuer} !== (idTokenPayload issuer) ${idTokenPayload.iss}`,\n      };\n    }\n    // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.\n\n    // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.\n\n    // 9: The current time MUST be before the time represented by the exp Claim.\n    const currentTimeUnixSecond = new Date().getTime() / 1000;\n    if (idTokenPayload && idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {\n      return {\n        isValid: false,\n        reason: `Token expired at (idTokenPayload exp) ${idTokenPayload.exp} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`,\n      };\n    }\n    // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.\n    const timeInSevenDays = 60 * 60 * 24 * 7;\n    if (\n      idTokenPayload &&\n      idTokenPayload.iat &&\n      idTokenPayload.iat + timeInSevenDays < currentTimeUnixSecond\n    ) {\n      return {\n        isValid: false,\n        reason: `Token is used from too long time (idTokenPayload iat + timeInSevenDays) ${idTokenPayload.iat + timeInSevenDays} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`,\n      };\n    }\n    // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.\n    if (idTokenPayload && nonce && idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {\n      return {\n        isValid: false,\n        reason: `Nonce does not match (nonce) ${nonce} !== (idTokenPayload nonce) ${idTokenPayload.nonce}`,\n      };\n    }\n  }\n  return { isValid: true, reason: '' };\n};\n\nfunction extractedIssueAt(\n  tokens: Tokens,\n  accessTokenPayload: AccessTokenPayload | null,\n  _idTokenPayload: IdTokenPayload,\n) {\n  if (!tokens.issued_at) {\n    if (accessTokenPayload && accessTokenPayload.iat) {\n      return accessTokenPayload.iat;\n    } else if (_idTokenPayload && _idTokenPayload.iat) {\n      return _idTokenPayload.iat;\n    } else {\n      const currentTimeUnixSecond = new Date().getTime() / 1000;\n      return currentTimeUnixSecond;\n    }\n  } else if (typeof tokens.issued_at == 'string') {\n    return parseInt(tokens.issued_at, 10);\n  }\n  return tokens.issued_at;\n}\n\nfunction _hideTokens(\n  tokens: Tokens,\n  currentDatabaseElement: OidcConfig,\n  configurationName: string,\n) {\n  if (!tokens.issued_at) {\n    const currentTimeUnixSecond = new Date().getTime() / 1000;\n    tokens.issued_at = currentTimeUnixSecond;\n  } else if (typeof tokens.issued_at == 'string') {\n    tokens.issued_at = parseInt(tokens.issued_at, 10);\n  }\n\n  const accessTokenPayload = extractTokenPayload(tokens.access_token);\n  const secureTokens = {\n    ...tokens,\n    accessTokenPayload,\n  };\n  if (currentDatabaseElement.hideAccessToken) {\n    secureTokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}`;\n  }\n  tokens.accessTokenPayload = accessTokenPayload;\n\n  // When id_token is not rotated we reuse old id_token\n  const oldTokens = currentDatabaseElement.tokens;\n  let id_token: string | null;\n  if (oldTokens != null && 'id_token' in oldTokens && !('id_token' in tokens)) {\n    id_token = oldTokens.id_token;\n  } else {\n    id_token = tokens.id_token;\n  }\n  tokens.id_token = id_token;\n\n  let _idTokenPayload = null;\n  if (id_token) {\n    _idTokenPayload = extractTokenPayload(id_token);\n    tokens.idTokenPayload = _idTokenPayload != null ? { ..._idTokenPayload } : null;\n    if (_idTokenPayload && _idTokenPayload.nonce && currentDatabaseElement.nonce != null) {\n      const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabaseElement.configurationName}`;\n      _idTokenPayload.nonce = keyNonce;\n    }\n    secureTokens.idTokenPayload = _idTokenPayload;\n  }\n  if (tokens.refresh_token) {\n    secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${configurationName}`;\n  }\n\n  tokens.issued_at = extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload);\n\n  const expireIn =\n    typeof tokens.expires_in == 'string' ? parseInt(tokens.expires_in, 10) : tokens.expires_in;\n\n  const idTokenExpiresAt =\n    _idTokenPayload && _idTokenPayload.exp ? _idTokenPayload.exp : Number.MAX_VALUE;\n  const accessTokenExpiresAt =\n    accessTokenPayload && accessTokenPayload.exp\n      ? accessTokenPayload.exp\n      : tokens.issued_at + expireIn;\n\n  let expiresAt: number;\n  const tokenRenewMode = (currentDatabaseElement.oidcConfiguration as OidcConfiguration)\n    .token_renew_mode;\n  if (tokenRenewMode === TokenRenewMode.access_token_invalid) {\n    expiresAt = accessTokenExpiresAt;\n  } else if (tokenRenewMode === TokenRenewMode.id_token_invalid) {\n    expiresAt = idTokenExpiresAt;\n  } else {\n    expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;\n  }\n  secureTokens.expiresAt = expiresAt;\n\n  tokens.expiresAt = expiresAt;\n  const nonce = currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null;\n  const { isValid, reason } = isTokensOidcValid(\n    tokens,\n    nonce as string,\n    currentDatabaseElement.oidcServerConfiguration as OidcServerConfiguration,\n  ); // TODO: Type assertion, could be null.\n  if (!isValid) {\n    throw Error(`Tokens are not OpenID valid, reason: ${reason}`);\n  }\n\n  // When refresh_token is not rotated we reuse old refresh_token\n  if (oldTokens != null && 'refresh_token' in oldTokens && !('refresh_token' in tokens)) {\n    const refreshToken = oldTokens.refresh_token;\n\n    currentDatabaseElement.tokens = {\n      ...tokens,\n      refresh_token: refreshToken,\n    };\n  } else {\n    currentDatabaseElement.tokens = tokens;\n  }\n\n  currentDatabaseElement.status = 'LOGGED_IN';\n  return secureTokens;\n}\n\nconst demonstratingProofOfPossessionNonceResponseHeader = 'DPoP-Nonce';\nfunction hideTokens(currentDatabaseElement: OidcConfig) {\n  const configurationName = currentDatabaseElement.configurationName;\n  return (response: Response) => {\n    if (response.status !== 200) {\n      return response;\n    }\n    const newHeaders = new Headers(response.headers);\n    if (response.headers.has(demonstratingProofOfPossessionNonceResponseHeader)) {\n      currentDatabaseElement.demonstratingProofOfPossessionNonce = response.headers.get(\n        demonstratingProofOfPossessionNonceResponseHeader,\n      );\n      newHeaders.delete(demonstratingProofOfPossessionNonceResponseHeader);\n    }\n\n    return response.json().then<Response>((tokens: Tokens) => {\n      const secureTokens = _hideTokens(tokens, currentDatabaseElement, configurationName);\n      const body = JSON.stringify(secureTokens);\n      return new Response(body, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: newHeaders,\n      });\n    });\n  };\n}\n\nexport {\n  b64DecodeUnicode,\n  computeTimeLeft,\n  isTokensValid,\n  extractTokenPayload,\n  isTokensOidcValid,\n  hideTokens,\n  _hideTokens,\n};\n","import { OidcConfig } from '../types';\nimport { sleep } from './sleep';\nimport { isTokensValid } from './tokens';\n\nexport const TOKEN_RENEWAL_TIMEOUT_MS = 5000;\nexport const TOKEN_RENEWAL_POLL_INTERVAL_MS = 200;\n\n/**\n * Polls until the tokens in the given config are valid, or until a timeout elapses.\n *\n * @returns `null` when tokens become valid; a synthetic 401 `Response` on timeout or\n *          when the tokens are cleared while waiting (e.g. due to a parallel logout).\n */\nexport async function waitForValidTokens(\n  config: OidcConfig,\n  maxWaitMs = TOKEN_RENEWAL_TIMEOUT_MS,\n  pollIntervalMs = TOKEN_RENEWAL_POLL_INTERVAL_MS,\n): Promise<Response | null> {\n  const startTime = Date.now();\n  while (config.tokens && !isTokensValid(config.tokens)) {\n    if (Date.now() - startTime >= maxWaitMs) {\n      return new Response(null, {\n        status: 401,\n        statusText: 'Token expired - service worker renewal timeout',\n      });\n    }\n    await sleep(pollIntervalMs);\n  }\n\n  if (!config.tokens?.access_token) {\n    return new Response(null, {\n      status: 401,\n      statusText: 'Missing access token',\n    });\n  }\n\n  return null;\n}\n","import { acceptAnyDomainToken } from './constants';\nimport { Database, Domain, OidcConfig, OidcServerConfiguration, TrustedDomains } from './types';\nimport { getDomains, normalizeUrl } from './utils';\n\nconst getOidcServerUrls = (oidcServerConfiguration: OidcServerConfiguration): string[] => {\n  return [\n    oidcServerConfiguration.issuer,\n    oidcServerConfiguration.authorizationEndpoint,\n    oidcServerConfiguration.tokenEndpoint,\n    oidcServerConfiguration.revocationEndpoint,\n    oidcServerConfiguration.userInfoEndpoint,\n  ]\n    .filter(Boolean)\n    .map(normalizeUrl);\n};\n\nconst isOidcServerRequest = (database: Database, normalizedUrl: string): boolean => {\n  return Object.values(database).some(config => {\n    const { oidcServerConfiguration } = config || {};\n    if (!oidcServerConfiguration) {\n      return false;\n    }\n\n    return getOidcServerUrls(oidcServerConfiguration).some(oidcUrl =>\n      normalizedUrl.startsWith(oidcUrl),\n    );\n  });\n};\n\nconst isDomainMatchingUrl = (domain: Domain, normalizedUrl: string): boolean => {\n  if (typeof domain === 'string') {\n    domain = new RegExp(`^${domain}`);\n  }\n\n  return domain.test?.(normalizedUrl) ?? false;\n};\n\nconst isAccessTokenDomainRequest = (\n  database: Database,\n  normalizedUrl: string,\n  trustedDomains: TrustedDomains,\n): boolean => {\n  return Object.entries(database).some(([key, currentDatabase]) => {\n    if (!currentDatabase.oidcServerConfiguration) {\n      return false;\n    }\n\n    const trustedDomain = trustedDomains?.[key.split('#')[0]] ?? [];\n    const domains = getDomains(trustedDomain, 'accessToken');\n\n    if (domains.some(domain => domain === acceptAnyDomainToken)) {\n      return true;\n    }\n\n    return domains.some(domain => isDomainMatchingUrl(domain, normalizedUrl));\n  });\n};\n\nconst shouldBypassNonOidcRequest = (\n  database: Database,\n  normalizedUrl: string,\n  trustedDomains: TrustedDomains,\n): boolean => {\n  const configurations = Object.values(database);\n\n  if (configurations.length === 0) {\n    return false;\n  }\n\n  if (!configurations.every(config => config.bypassAllNonOidcRequests)) {\n    return false;\n  }\n\n  if (!configurations.every(config => config.oidcServerConfiguration != null)) {\n    return false;\n  }\n\n  return (\n    !isOidcServerRequest(database, normalizedUrl) &&\n    !isAccessTokenDomainRequest(database, normalizedUrl, trustedDomains)\n  );\n};\n\nconst getMatchingOidcConfigurations = (database: Database, url: string): OidcConfig[] => {\n  const normalizedUrl = normalizeUrl(url);\n  return Object.values(database).filter(config => {\n    const { oidcServerConfiguration } = config || {};\n    const { tokenEndpoint, revocationEndpoint } = oidcServerConfiguration || {};\n\n    return (\n      (tokenEndpoint && normalizedUrl.startsWith(normalizeUrl(tokenEndpoint))) ||\n      (revocationEndpoint && normalizedUrl.startsWith(normalizeUrl(revocationEndpoint)))\n    );\n  });\n};\n\nexport {\n  getMatchingOidcConfigurations as getCurrentDatabasesTokenEndpoint,\n  isAccessTokenDomainRequest,\n  isOidcServerRequest,\n  shouldBypassNonOidcRequest,\n};\n","export function replaceCodeVerifier(codeVerifier: string, newCodeVerifier: string): string {\n  const regex = /[?&]code_verifier=([^&]+)/i;\n  return codeVerifier.replace(regex, `&code_verifier=${newCodeVerifier}`);\n}\n\nexport const extractConfigurationNameFromCodeVerifier = (body: string): string => {\n  const regex = /[?&]code_verifier=CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER_([^&]+)/;\n  const match = body.match(regex);\n\n  return match ? decodeURIComponent(match[1]) : '';\n};\n","export default '7.29.7';\n","import { acceptAnyDomainToken, scriptFilename, TOKEN } from './constants';\nimport { base64urlOfHashOfASCIIEncodingAsync } from './crypto';\nimport { getDpopConfiguration, getDpopOnlyWhenDpopHeaderPresent } from './dpop';\nimport { generateJwkAsync, generateJwtDemonstratingProofOfPossessionAsync } from './jwt';\nimport { getCurrentDatabasesTokenEndpoint, shouldBypassNonOidcRequest } from './oidcConfig';\nimport { Database, MessageEventData, OidcConfig, TrustedDomains } from './types';\nimport {\n  checkDomain,\n  getCurrentDatabaseDomain,\n  getDomains,\n  hideTokens,\n  normalizeUrl,\n  serializeHeaders,\n  shouldBypassDestination,\n  sleep,\n  waitForValidTokens,\n} from './utils';\nimport {\n  extractConfigurationNameFromCodeVerifier,\n  replaceCodeVerifier,\n} from './utils/codeVerifier';\nimport version from './version';\n\n// @ts-ignore\nif (typeof trustedTypes !== 'undefined' && typeof trustedTypes.createPolicy === 'function') {\n  // @ts-ignore\n  trustedTypes.createPolicy('default', {\n    createScriptURL: function (url: string) {\n      if (url === scriptFilename) {\n        return url;\n      } else {\n        throw new Error('Untrusted script URL blocked: ' + url);\n      }\n    },\n  });\n}\n\nconst _self = self as ServiceWorkerGlobalScope & typeof globalThis;\n\n// `trustedDomains` is declared in the externally loaded script (OidcTrustedDomains.js)\ndeclare let trustedDomains: TrustedDomains;\n\n_self.importScripts(scriptFilename);\n\nconst id = Math.round(new Date().getTime() / 1000).toString();\nconsole.log('init service worker with id', id);\nconst keepAliveJsonFilename = 'OidcKeepAliveServiceWorker.json';\nconst database: Database = {};\n\n/**\n * Keeps the service worker alive by responding with a cached response after a sleep.\n */\nconst keepAliveAsync = async (event: FetchEvent) => {\n  const originalRequest = event.request;\n  const isFromVanilla = originalRequest.headers.has('oidc-vanilla');\n  const init = { status: 200, statusText: 'oidc-service-worker' };\n  const response = new Response('{}', init);\n\n  if (!isFromVanilla) {\n    const originalRequestUrl = new URL(originalRequest.url);\n    const minSleepSeconds = Number(originalRequestUrl.searchParams.get('minSleepSeconds')) || 240;\n    for (let i = 0; i < minSleepSeconds; i++) {\n      await sleep(1000 + Math.floor(Math.random() * 1000));\n      const cache = await caches.open('oidc_dummy_cache');\n      await cache.put(event.request, response.clone());\n    }\n  }\n  return response;\n};\n\n/**\n * Generates DPoP headers when a DPoP configuration is present.\n */\nasync function generateDpopAsync(\n  originalRequest: Request,\n  currentDatabase: OidcConfig | null,\n  url: string,\n  extrasClaims = {},\n) {\n  const headersExtras = serializeHeaders(originalRequest.headers);\n  if (\n    currentDatabase?.demonstratingProofOfPossessionConfiguration &&\n    currentDatabase.demonstratingProofOfPossessionJwkJson &&\n    (!currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ||\n      (currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent &&\n        headersExtras.dpop))\n  ) {\n    const dpopConfiguration = currentDatabase.demonstratingProofOfPossessionConfiguration;\n    const jwk = currentDatabase.demonstratingProofOfPossessionJwkJson;\n    const method = originalRequest.method;\n    const dpop = await generateJwtDemonstratingProofOfPossessionAsync(self)(dpopConfiguration)(\n      jwk,\n      method,\n      url,\n      extrasClaims,\n    );\n\n    headersExtras.dpop = dpop;\n    if (currentDatabase.demonstratingProofOfPossessionNonce != null) {\n      headersExtras.nonce = currentDatabase.demonstratingProofOfPossessionNonce;\n    }\n  }\n  return headersExtras;\n}\n\n/**\n * Intercepts fetch requests to inject access tokens and handle token endpoints.\n */\nconst handleFetch = (event: FetchEvent): void => {\n  /**\n   * Exit early for requests that do not need to have an auth token attached.\n   */\n  if (shouldBypassDestination(event.request.destination, event.request.mode)) {\n    return; // Don't call event.respondWith() - let browser handle naturally\n  }\n\n  const normalizedUrl = normalizeUrl(event.request.url);\n  if (\n    !normalizedUrl.includes(keepAliveJsonFilename) &&\n    shouldBypassNonOidcRequest(database, normalizedUrl, trustedDomains)\n  ) {\n    return; // Don't call event.respondWith() - let browser handle naturally\n  }\n\n  event.respondWith(\n    (async (): Promise<Response> => {\n      try {\n        const originalRequest = event.request;\n        const url = normalizedUrl;\n\n        // 1) Handle keep-alive requests\n        if (url.includes(keepAliveJsonFilename)) {\n          return keepAliveAsync(event);\n        }\n\n        // Check if an access token is available for this request\n        const currentDatabasesForRequestAccessToken = getCurrentDatabaseDomain(\n          database,\n          url,\n          trustedDomains,\n        );\n\n        const authorization = originalRequest.headers.get('authorization');\n        let authenticationMode = 'Bearer';\n        let key = 'default';\n\n        if (authorization) {\n          const split = authorization.split(' ');\n          authenticationMode = split[0];\n          if (split[1]?.includes('ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_')) {\n            key = split[1].split('ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_')[1];\n          }\n        }\n\n        const currentDatabaseForRequestAccessToken = currentDatabasesForRequestAccessToken?.find(\n          c => c.configurationName.endsWith(key),\n        );\n\n        // Inject the access token into the request if one is available\n        if (currentDatabaseForRequestAccessToken?.tokens?.access_token) {\n          // Wait for token to become valid (a parallel refresh may be in progress)\n          const tokenError = await waitForValidTokens(currentDatabaseForRequestAccessToken);\n          if (tokenError) {\n            return tokenError;\n          }\n\n          // Adjust request mode for CORS if configured\n          let requestMode = originalRequest.mode;\n          if (\n            originalRequest.mode !== 'navigate' &&\n            currentDatabaseForRequestAccessToken.convertAllRequestsToCorsExceptNavigate\n          ) {\n            requestMode = 'cors';\n          }\n\n          // Build request headers\n          let headers: { [p: string]: string };\n\n          // Skip the access token for navigate requests when setAccessTokenToNavigateRequests is false\n          if (\n            originalRequest.mode === 'navigate' &&\n            !currentDatabaseForRequestAccessToken.setAccessTokenToNavigateRequests\n          ) {\n            headers = {\n              ...serializeHeaders(originalRequest.headers),\n            };\n          } else {\n            if (\n              authenticationMode.toLowerCase() === 'dpop' ||\n              (!currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent &&\n                currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionConfiguration)\n            ) {\n              // DPoP mode\n              const claimsExtras = {\n                ath: await base64urlOfHashOfASCIIEncodingAsync(\n                  currentDatabaseForRequestAccessToken.tokens.access_token,\n                ),\n              };\n              const dpopHeaders = await generateDpopAsync(\n                originalRequest,\n                currentDatabaseForRequestAccessToken,\n                url,\n                claimsExtras,\n              );\n              headers = {\n                ...dpopHeaders,\n                authorization: `DPoP ${currentDatabaseForRequestAccessToken.tokens.access_token}`,\n              };\n            } else {\n              // Bearer mode\n              headers = {\n                ...serializeHeaders(originalRequest.headers),\n                authorization: `${authenticationMode} ${currentDatabaseForRequestAccessToken.tokens.access_token}`,\n              };\n            }\n          }\n\n          let init: RequestInit;\n          if (originalRequest.mode === 'navigate') {\n            init = {\n              headers: headers,\n            };\n          } else {\n            init = {\n              headers: headers,\n              mode: requestMode,\n            };\n          }\n\n          const newRequest = new Request(originalRequest, init);\n          return fetch(newRequest);\n        }\n\n        // Pass through non-POST requests without modification\n        if (event.request.method !== 'POST') {\n          return fetch(originalRequest);\n        }\n\n        // Handle POST requests to known token/revocation endpoints\n        const currentDatabases = getCurrentDatabasesTokenEndpoint(database, url);\n        const numberDatabase = currentDatabases.length;\n\n        if (numberDatabase > 0) {\n          const responsePromise = new Promise<Response>((resolve, reject) => {\n            const clonedRequest = originalRequest.clone();\n            clonedRequest\n              .text()\n              .then(async actualBody => {\n                let currentDatabase: OidcConfig | null = null;\n                try {\n                  // Replace hidden token placeholders with the real token values\n                  if (\n                    actualBody.includes(TOKEN.REFRESH_TOKEN) ||\n                    actualBody.includes(TOKEN.ACCESS_TOKEN)\n                  ) {\n                    let headers = serializeHeaders(originalRequest.headers);\n                    let newBody = actualBody;\n\n                    for (let i = 0; i < numberDatabase; i++) {\n                      const currentDb = currentDatabases[i];\n                      if (currentDb?.tokens) {\n                        const claimsExtras = {\n                          ath: await base64urlOfHashOfASCIIEncodingAsync(\n                            currentDb.tokens.access_token,\n                          ),\n                        };\n                        headers = await generateDpopAsync(\n                          originalRequest,\n                          currentDb,\n                          url,\n                          claimsExtras,\n                        );\n\n                        const keyRefreshToken = encodeURIComponent(\n                          `${TOKEN.REFRESH_TOKEN}_${currentDb.configurationName}`,\n                        );\n                        if (actualBody.includes(keyRefreshToken)) {\n                          newBody = newBody.replace(\n                            keyRefreshToken,\n                            encodeURIComponent(currentDb.tokens.refresh_token as string),\n                          );\n                          currentDatabase = currentDb;\n                          break;\n                        }\n\n                        const keyAccessToken = encodeURIComponent(\n                          `${TOKEN.ACCESS_TOKEN}_${currentDb.configurationName}`,\n                        );\n                        if (actualBody.includes(keyAccessToken)) {\n                          newBody = newBody.replace(\n                            keyAccessToken,\n                            encodeURIComponent(currentDb.tokens.access_token),\n                          );\n                          currentDatabase = currentDb;\n                          break;\n                        }\n                      }\n                    }\n\n                    const fetchPromise = fetch(originalRequest, {\n                      body: newBody,\n                      method: clonedRequest.method,\n                      headers,\n                      mode: clonedRequest.mode,\n                      cache: clonedRequest.cache,\n                      redirect: clonedRequest.redirect,\n                      referrer: clonedRequest.referrer,\n                      credentials: clonedRequest.credentials,\n                      integrity: clonedRequest.integrity,\n                    });\n\n                    // Forward revocation requests without modifying the response body\n                    if (\n                      currentDatabase?.oidcServerConfiguration?.revocationEndpoint &&\n                      url.startsWith(\n                        normalizeUrl(currentDatabase.oidcServerConfiguration.revocationEndpoint),\n                      )\n                    ) {\n                      const resp = await fetchPromise;\n                      const txt = await resp.text();\n                      resolve(new Response(txt, resp));\n                      return;\n                    }\n\n                    // Hide real token values in the response\n                    const hidden = await fetchPromise.then(\n                      hideTokens(currentDatabase as OidcConfig),\n                    );\n                    resolve(hidden);\n                    return;\n                  }\n\n                  // Handle authorization code exchange: replace the PKCE code_verifier placeholder\n                  const isCodeVerifier = actualBody.includes('code_verifier=');\n                  if (isCodeVerifier) {\n                    const currentLoginCallbackConfigurationName =\n                      extractConfigurationNameFromCodeVerifier(actualBody);\n                    if (\n                      !currentLoginCallbackConfigurationName ||\n                      currentLoginCallbackConfigurationName === ''\n                    ) {\n                      throw new Error('No configuration name found in code_verifier');\n                    }\n                    currentDatabase = database[currentLoginCallbackConfigurationName];\n                    let newBody = actualBody;\n                    const codeVerifier = currentDatabase.codeVerifier;\n                    if (codeVerifier != null) {\n                      newBody = replaceCodeVerifier(newBody, codeVerifier);\n                    }\n\n                    const headersExtras = await generateDpopAsync(\n                      originalRequest,\n                      currentDatabase,\n                      url,\n                    );\n                    const resp = await fetch(originalRequest, {\n                      body: newBody,\n                      method: clonedRequest.method,\n                      headers: headersExtras,\n                      mode: clonedRequest.mode,\n                      cache: clonedRequest.cache,\n                      redirect: clonedRequest.redirect,\n                      referrer: clonedRequest.referrer,\n                      credentials: clonedRequest.credentials,\n                      integrity: clonedRequest.integrity,\n                    });\n                    const hidden = await hideTokens(currentDatabase)(resp);\n                    resolve(hidden);\n                    return;\n                  }\n\n                  // Pass through all other POST requests unchanged\n                  const normalResp = await fetch(originalRequest, {\n                    body: actualBody,\n                    method: clonedRequest.method,\n                    headers: serializeHeaders(originalRequest.headers),\n                    mode: clonedRequest.mode,\n                    cache: clonedRequest.cache,\n                    redirect: clonedRequest.redirect,\n                    referrer: clonedRequest.referrer,\n                    credentials: clonedRequest.credentials,\n                    integrity: clonedRequest.integrity,\n                  });\n                  resolve(normalResp);\n                } catch (err) {\n                  reject(err);\n                }\n              })\n              .catch(reject);\n          });\n\n          return responsePromise;\n        }\n\n        // Default: pass through the request unchanged\n        return fetch(originalRequest);\n      } catch (err) {\n        // Surface unexpected errors as a 500 rather than silently hanging\n        console.error('[OidcServiceWorker] handleFetch error:', err);\n        return new Response('Service Worker Error', { status: 500 });\n      }\n    })(),\n  );\n};\n\nconst handleMessage = async (event: ExtendableMessageEvent) => {\n  const port = event.ports[0];\n  const data = event.data as MessageEventData;\n\n  if (event.data?.type === 'SKIP_WAITING') {\n    await _self.skipWaiting();\n    port?.postMessage?.({});\n    return;\n  } else if (event.data.type === 'claim') {\n    _self.clients.claim().then(() => port.postMessage({}));\n    return;\n  }\n\n  const configurationName = data.configurationName.split('#')[0];\n\n  if (trustedDomains == null) {\n    trustedDomains = {};\n  }\n\n  const trustedDomain = trustedDomains[configurationName];\n  const allowMultiTabLogin = Array.isArray(trustedDomain)\n    ? false\n    : trustedDomain.allowMultiTabLogin;\n\n  const tabId = allowMultiTabLogin ? data.tabId : 'default';\n  const configurationNameWithTabId = `${configurationName}#tabId=${tabId}`;\n\n  let currentDatabase = database[configurationNameWithTabId];\n  if (!currentDatabase) {\n    const showAccessToken = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;\n    const doNotSetAccessTokenToNavigateRequests = Array.isArray(trustedDomain)\n      ? true\n      : trustedDomain.setAccessTokenToNavigateRequests;\n    const convertAllRequestsToCorsExceptNavigate = Array.isArray(trustedDomain)\n      ? false\n      : trustedDomain.convertAllRequestsToCorsExceptNavigate;\n    const bypassAllNonOidcRequests = Array.isArray(trustedDomain)\n      ? false\n      : trustedDomain.bypassAllNonOidcRequests;\n\n    database[configurationNameWithTabId] = {\n      tokens: null,\n      state: null,\n      codeVerifier: null,\n      oidcServerConfiguration: null,\n      oidcConfiguration: undefined,\n      nonce: null,\n      status: null,\n      configurationName: configurationNameWithTabId,\n      hideAccessToken: !showAccessToken,\n      setAccessTokenToNavigateRequests: doNotSetAccessTokenToNavigateRequests ?? true,\n      convertAllRequestsToCorsExceptNavigate: convertAllRequestsToCorsExceptNavigate ?? false,\n      demonstratingProofOfPossessionNonce: null,\n      demonstratingProofOfPossessionJwkJson: null,\n      demonstratingProofOfPossessionConfiguration: null,\n      demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,\n      allowMultiTabLogin: allowMultiTabLogin ?? false,\n      bypassAllNonOidcRequests: bypassAllNonOidcRequests ?? false,\n    };\n    currentDatabase = database[configurationNameWithTabId];\n\n    if (!trustedDomains[configurationName]) {\n      trustedDomains[configurationName] = [];\n    }\n  }\n\n  switch (data.type) {\n    case 'clear':\n      currentDatabase.tokens = null;\n      currentDatabase.state = null;\n      currentDatabase.codeVerifier = null;\n      currentDatabase.nonce = null;\n      currentDatabase.demonstratingProofOfPossessionNonce = null;\n      currentDatabase.demonstratingProofOfPossessionJwkJson = null;\n      currentDatabase.demonstratingProofOfPossessionConfiguration = null;\n      currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = false;\n      currentDatabase.status = data.data.status;\n      port.postMessage({ configurationName });\n      return;\n\n    case 'init': {\n      const oidcServerConfiguration = data.data.oidcServerConfiguration;\n      const domains = getDomains(trustedDomain, 'oidc');\n\n      if (!domains.some(domain => domain === acceptAnyDomainToken)) {\n        [\n          oidcServerConfiguration.tokenEndpoint,\n          oidcServerConfiguration.revocationEndpoint,\n          oidcServerConfiguration.userInfoEndpoint,\n          oidcServerConfiguration.issuer,\n        ].forEach(u => {\n          checkDomain(domains, u);\n        });\n      }\n\n      currentDatabase.oidcServerConfiguration = oidcServerConfiguration;\n      currentDatabase.oidcConfiguration = data.data.oidcConfiguration;\n\n      if (currentDatabase.demonstratingProofOfPossessionConfiguration == null) {\n        const demonstratingProofOfPossessionConfiguration = getDpopConfiguration(trustedDomain);\n        if (demonstratingProofOfPossessionConfiguration != null) {\n          if (currentDatabase.oidcConfiguration.demonstrating_proof_of_possession) {\n            console.warn(\n              'In service worker, demonstrating_proof_of_possession must be configured from trustedDomains file',\n            );\n          }\n          currentDatabase.demonstratingProofOfPossessionConfiguration =\n            demonstratingProofOfPossessionConfiguration;\n          currentDatabase.demonstratingProofOfPossessionJwkJson = await generateJwkAsync(self)(\n            demonstratingProofOfPossessionConfiguration.generateKeyAlgorithm,\n          );\n          currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent =\n            getDpopOnlyWhenDpopHeaderPresent(trustedDomain) ?? false;\n        }\n      }\n\n      if (!currentDatabase.tokens) {\n        port.postMessage({\n          tokens: null,\n          status: currentDatabase.status,\n          configurationName,\n          version,\n        });\n      } else {\n        const tokens = { ...currentDatabase.tokens };\n        if (currentDatabase.hideAccessToken) {\n          tokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}#tabId=${tabId}`;\n        }\n        if (tokens.refresh_token) {\n          tokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${configurationName}#tabId=${tabId}`;\n        }\n        if (tokens?.idTokenPayload?.nonce && currentDatabase.nonce != null) {\n          tokens.idTokenPayload.nonce = `${TOKEN.NONCE_TOKEN}_${configurationName}#tabId=${tabId}`;\n        }\n        port.postMessage({\n          tokens,\n          status: currentDatabase.status,\n          configurationName,\n          version,\n        });\n      }\n      return;\n    }\n\n    case 'setDemonstratingProofOfPossessionNonce': {\n      currentDatabase.demonstratingProofOfPossessionNonce =\n        data.data.demonstratingProofOfPossessionNonce;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getDemonstratingProofOfPossessionNonce': {\n      const demonstratingProofOfPossessionNonce =\n        currentDatabase.demonstratingProofOfPossessionNonce;\n      port.postMessage({\n        configurationName,\n        demonstratingProofOfPossessionNonce,\n      });\n      return;\n    }\n\n    case 'setState': {\n      currentDatabase.state = data.data.state;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getState': {\n      const state = currentDatabase.state;\n      port.postMessage({ configurationName, state });\n      return;\n    }\n\n    case 'setCodeVerifier': {\n      currentDatabase.codeVerifier = data.data.codeVerifier;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getCodeVerifier': {\n      const codeVerifier =\n        currentDatabase.codeVerifier != null\n          ? `${TOKEN.CODE_VERIFIER}_${configurationName}#tabId=${tabId}`\n          : null;\n      port.postMessage({\n        configurationName,\n        codeVerifier,\n      });\n      return;\n    }\n\n    case 'setSessionState': {\n      currentDatabase.sessionState = data.data.sessionState;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getSessionState': {\n      const sessionState = currentDatabase.sessionState;\n      port.postMessage({ configurationName, sessionState });\n      return;\n    }\n\n    case 'setNonce': {\n      const nonce = data.data.nonce;\n      if (nonce) {\n        currentDatabase.nonce = nonce;\n      }\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getNonce': {\n      const keyNonce = `${TOKEN.NONCE_TOKEN}_${configurationName}#tabId=${tabId}`;\n      const nonce = currentDatabase.nonce ? keyNonce : null;\n      port.postMessage({ configurationName, nonce });\n      return;\n    }\n\n    default:\n      return;\n  }\n};\n\n// Event listeners\n_self.addEventListener('fetch', handleFetch);\n_self.addEventListener('message', handleMessage);\n"],"mappings":";AAAA,IAAM,iBAAiB;AAUvB,IAAM,QAAmB;CACvB,eAAe;CACf,cAAc;CACd,aAAa;CACb,eAAe;AACjB;AAQA,IAAM,iBAAqC;CACzC,kCAAkC;CAClC,sBAAsB;CACtB,kBAAkB;AACpB;;;ACnBA,SAAS,WAAW,KAAa;CAC/B,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;AACrC;AAMA,SAAS,eAAe,KAAK;CAC3B,OAAO,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC5E;AAOA,SAAS,mBAAmB,KAAK;CAK/B,OAJe,mBAAmB,GAI3B,CAAA,CAAO,QAAQ,mBAAmB,SAAU,OAAe,IAAI;EACpE,OAAO,OAAO,aAAa,SAAS,IAAI,EAAE,CAAC;CAC7C,CAAC;AACH;AAMA,IAAa,oBAAoB,UAAsB;CACrD,IAAI,MAAM;CAEV,MAAM,QAAQ,SAAU,MAAM;EAC5B,OAAO,OAAO,aAAa,IAAI;CACjC,CAAC;CACD,OAAO,eAAe,GAAG;AAC3B;AAMA,SAAS,eAAe,KAAK;CAC3B,OAAO,eAAe,mBAAmB,GAAG,CAAC;AAC/C;AAEA,IAAa,qDACX;CACE,oBAAoB;EAClB,MAAM;EACN,YAAY;EACZ,MAAM,EAAE,MAAM,QAAQ;CACxB;CACA,eAAe;EAAE,MAAM;EAAS,MAAM,EAAE,MAAM,UAAU;CAAE;CAC1D,sBAAsB;EACpB,MAAM;EACN,YAAY;CACd;CACA,iBAAiB,EAAE,MAAM,UAAU;CACnC,oBAAoB;AACtB;AAGF,IAAM,QACH,MACD,OACE,KACA,SACA,QACA,6CACA,gBAAgB,eACb;CAGH,MAAM,OAAO,OAAO,CAAC,GAAG,GAAG;CAG3B,QAAQ,MAAM;CACd,QAAQ,MAAM,4CAA4C;CAC1D,QAAQ,QAAQ,KAAhB;EACE,KAAK;GAEH,QAAQ,MAAM;IAAE,KAAK,IAAI;IAAK,KAAK,IAAI;IAAK,GAAG,IAAI;IAAG,GAAG,IAAI;GAAE;GAE/D;EACF,KAAK;GACH,QAAQ,MAAM;IAAE,KAAK,IAAI;IAAK,GAAG,IAAI;IAAG,GAAG,IAAI;IAAG,KAAK,QAAQ;GAAI;GACnE;EACF,SACE,MAAM,IAAI,MAAM,0CAA0C;CAC9D;CAEA,MAAM,MAAM;EAGV,WAAW,eAAe,KAAK,UAAU,OAAO,CAAC;EAGjD,SAAS,eAAe,KAAK,UAAU,MAAM,CAAC;CAChD;CAGA,MAAM,UAAU,4CAA4C;CAU5D,MAAM,aAAa,MAAM,EAAE,OAAO,OAAO,UAAU,OAAO,KAAK,SAAS,MAAY,CAJhE,MAIgE,CAAU;CAG9F,MAAM,OAAO,WAAW,GAAG,IAAI,UAAU,GAAG,IAAI,SAAS;CAIzD,MAAM,gBAAgB,4CAA4C;CAElE,MAAM,YAAY,MAAM,EAAE,OAAO,OAAO,KAAK,eAAe,YAAY,IAAI;CAI5E,IAAI,YAAY,iBAAiB,IAAI,WAAW,SAAS,CAAC;CAG1D,OAAO,GAAG,IAAI,UAAU,GAAG,IAAI,QAAQ,GAAG,IAAI;AAChD;AAEF,IAAa,MAAM,EAAE,KAAK;AAG1B,IAAM,YACH,MAAW,OAAO,yBAAiE;CAClF,MAAM,UAAU;CAIhB,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,YAAY,SAAS,MAAY,CAF/C,QAAQ,QAEuC,CAAU;CAG7E,OAAO,MAAM,EAAE,OAAO,OAAO,UAAU,OAAO,IAAI,UAAU;AAC9D;AAMF,IAAM,UAAS,QAAO;CACpB,MAAM,OAAO,OAAO,OAAO,CAAC,GAAG,GAAG;CAClC,OAAO,KAAK;CACZ,KAAK,UAAU,CAAC,QAAQ;CACxB,OAAO;AACT;AAEA,IAAM,KAAK;CACT;CACA;AACF;AAEA,IAAM,cAAc,MAAW,OAAO,KAAK,oBAAyC;CAClF,IAAI;CAEJ,QAAQ,IAAI,KAAZ;EACE,KAAK;GACH,YAAY,2DACT,QAAQ,OAAO,IAAI,GAAG,CAAC,CACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CACnB,QAAQ,KAAK,IAAI,CAAC;GACrB;EACF,KAAK;GACH,YAAY,4CAAgC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;GAClF;EACF,SACE,MAAM,IAAI,MAAM,qCAAqC;CACzD;CAGA,MAAM,OAAO,MAAM,EAAE,OAAO,OAAO,OAAO,iBAAiB,WAAW,SAAS,CAAC;CAChF,OAAO,iBAAiB,IAAI,WAAW,IAAI,CAAC;AAC9C;AAEA,IAAa,MAAM,EAAE,WAAW;AAEhC,IAAa,oBACV,MAAW,OAAO,yBAAiE;CAMlF,OAAO,MAJW,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB;AAKvD;AAEF,IAAa,kDACV,OACA,gDACD,OAAO,KAAU,SAAS,QAAQ,KAAa,eAAe,CAAC,MAAM;CACnE,MAAM,SAAS;EAEb,KAAK,KAAK,EAAE,OAAO,WAAW,CAAC;EAC/B,KAAK;EACL,KAAK;EACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACjC,GAAG;CACL;CAEA,MAAM,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,CACjC,KACA,4CAA4C,eAC9C;CASA,OAAO,MAPW,IAAI,KAAK,CAAC,CAAC,CAC3B,KACA,EAAO,IAAI,GACX,QACA,2CACF;AAGF;;;ACtOF,SAAgB,eAAe,KAAa;CAC1C,MAAM,MAAM,IAAI,YAAY,IAAI,MAAM;CACtC,MAAM,UAAU,IAAI,WAAW,GAAG;CAElC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,QAAQ,KAAK,IAAI,WAAW,CAAC;CAE/B,OAAO;AACT;AAEA,SAAgB,oCAAoC,MAA+B;CACjF,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,OAAO,OAAO,OAAO,WAAW,eAAe,IAAI,CAAC,CAAC,CAAC,MACpD,WAAU;GACR,OAAO,QAAQ,iBAAiB,IAAI,WAAW,MAAM,CAAC,CAAC;EACzD,IACA,UAAS,OAAO,KAAK,CACvB;CACF,CAAC;AACH;;;AClBA,IAAM,UAAU,kBAAqD;CACnE,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;CAET,OAAO,cAAc,kCAAkC;AACzD;AAEA,IAAa,wBAAwB,kBAA4C;CAC/E,IAAI,CAAC,OAAO,aAAa,GACvB,OAAO;CAGT,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;CAGT,OACE,cAAc,+CACd;AAEJ;AAEA,IAAa,oCAAoC,kBAA4C;CAC3F,IAAI,CAAC,OAAO,aAAa,GACvB,OAAO;CAGT,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;CAGT,OAAO,cAAc,2DAA2D;AAClF;;;ACnCA,SAAgB,aAAa,KAAa;CACxC,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS;CAC/B,SAAS,OAAO;EACd,QAAQ,MAAM,4BAA4B,OAAO,KAAK;EACtD,OAAO;CACT;AACF;;;ACHA,SAAgB,YAAY,SAAmB,UAAkB;CAC/D,IAAI,CAAC,UACH;CAcF,IAAI,CAXW,QAAQ,MAAK,WAAU;EACpC,IAAI;EAEJ,IAAI,OAAO,WAAW,UACpB,WAAW,IAAI,OAAO,IAAI,QAAQ;OAElC,WAAW;EAGb,OAAO,SAAS,OAAO,QAAQ;CACjC,CACK,GACH,MAAM,IAAI,MACR,YAAY,WAAW,2CAA2C,cACpE;AAEJ;AAEA,IAAa,cACX,eACA,SACG;CACH,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;CAGT,OAAO,cAAc,GAAG,KAAK,aAAa,cAAc,WAAW,CAAC;AACtE;AAEA,IAAa,4BACX,UACA,KACA,mBACG;CACH,IAAI,IAAI,SAAA,mCAAkC,GACxC,OAAO;CAET,MAAM,YAAY,CAAC;CACnB,KAAK,MAAM,CAAC,KAAK,oBAAoB,OAAO,QAAoB,QAAQ,GAAG;EACzE,MAAM,0BAA0B,gBAAgB;EAEhD,IAAI,CAAC,yBACH;EAGF,IACE,wBAAwB,iBACxB,QAAQ,aAAa,wBAAwB,aAAa,GAE1D;EAEF,IACE,wBAAwB,sBACxB,QAAQ,aAAa,wBAAwB,kBAAkB,GAE/D;EAIF,MAAM,UAAU,WAFM,kBAAkB,OAAO,CAAC,IAAI,eAAe,IAAI,MAAM,GAAG,CAAC,CAAC,KAExC,aAAa;EACvD,MAAM,sBAAsB,wBAAwB,mBAChD,CAAC,aAAa,wBAAwB,gBAAgB,GAAG,GAAG,OAAO,IACnE,CAAC,GAAG,OAAO;EAEf,IAAI,iBAAiB;EACrB,IAAI,oBAAoB,MAAK,MAAK,MAAA,GAA0B,GAC1D,iBAAiB;OAEjB,KAAK,IAAI,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;GACnD,IAAI,SAAS,oBAAoB;GAEjC,IAAI,OAAO,WAAW,UACpB,SAAS,IAAI,OAAO,IAAI,QAAQ;GAGlC,IAAI,OAAO,OAAO,GAAG,GAAG;IACtB,iBAAiB;IACjB;GACF;EACF;EAGF,IAAI,gBACE;OAAA,gBAAgB,QAClB,UAAU,KAAK,eAAe;EAAA;CAGpC;CACA,OAAO;AACT;;;AClGA,SAAS,iBAAiB,SAA0C;CAClE,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG;EAChC,MAAM,QAAQ,QAAQ,IAAI,GAAG;EAC7B,IAAI,UAAU,MACZ,WAAW,OAAO;CAEtB;CACA,OAAO;AACT;;;ACTA,IAAM,uBAAuB;CAAC;CAAS;CAAQ;CAAS;CAAY;CAAU;AAAQ;;;;;;AAOtF,IAAa,2BAA2B,aAAqB,SAA0B;CACrF,OAAO,qBAAqB,SAAS,WAAW,KAAK,SAAS;AAChE;;;ACTA,IAAM,SAAS,OAAe,IAAI,SAAQ,YAAW,WAAW,SAAS,EAAE,CAAC;;;ACW5E,IAAa,YAAY,YAAoB;CAC3C,OAAO,KAAK,MAAM,iBAAiB,QAAQ,WAAW,MAAM,GAAG,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAC;AACzF;AACA,SAAS,iBAAiB,KAAa;CACrC,OAAO,mBACL,MAAM,UAAU,IACb,KAAK,KAAK,GAAG,IAAG,MAAK,OAAO,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,EAAA,CAAG,MAAM,EAAE,CAAC,CAAC,CAC3E,KAAK,EAAE,CACZ;AACF;AAEA,SAAS,gBAAgB,2CAAmD,WAAmB;CAC7F,MAAM,yCAAwB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;CACrD,OAAO,KAAK,MAAM,YAAY,4CAA4C,qBAAqB;AACjG;AAEA,SAAS,cAAc,QAAuB;CAC5C,IAAI,CAAC,QACH,OAAO;CAET,OAAO,gBAAgB,GAAG,OAAO,SAAS,IAAI;AAChD;AAEA,IAAM,uBAAuB,UAAmB;CAC9C,IAAI;EACF,IAAI,CAAC,OACH,OAAO;EAET,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,OAAO,MAAM,WAAW,IAAI,SAAS,MAAM,EAAE,IAAI;CACnD,SAAS,GAAG;EACV,QAAQ,KAAK,CAAC;CAChB;CACA,OAAO;AACT;AAIA,IAAM,qBACJ,QACA,OACA,4BACyC;CACzC,IAAI,OAAO,gBAAgB;EACzB,MAAM,iBAAiB,OAAO;EAE9B,IAAI,kBAAkB,wBAAwB,WAAW,eAAe,KACtE,OAAO;GACL,SAAS;GACT,QAAQ,0DAA0D,wBAAwB,OAAO,+BAA+B,eAAe;EACjJ;EAOF,MAAM,yCAAwB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;EACrD,IAAI,kBAAkB,eAAe,OAAO,eAAe,MAAM,uBAC/D,OAAO;GACL,SAAS;GACT,QAAQ,yCAAyC,eAAe,IAAI,6BAA6B;EACnG;EAGF,MAAM,kBAAkB;EACxB,IACE,kBACA,eAAe,OACf,eAAe,MAAM,kBAAkB,uBAEvC,OAAO;GACL,SAAS;GACT,QAAQ,2EAA2E,eAAe,MAAM,gBAAgB,6BAA6B;EACvJ;EAGF,IAAI,kBAAkB,SAAS,eAAe,SAAS,eAAe,UAAU,OAC9E,OAAO;GACL,SAAS;GACT,QAAQ,gCAAgC,MAAM,8BAA8B,eAAe;EAC7F;CAEJ;CACA,OAAO;EAAE,SAAS;EAAM,QAAQ;CAAG;AACrC;AAEA,SAAS,iBACP,QACA,oBACA,iBACA;CACA,IAAI,CAAC,OAAO,WAAW;EACrB,IAAI,sBAAsB,mBAAmB,KAC3C,OAAO,mBAAmB;OACrB,IAAI,mBAAmB,gBAAgB,KAC5C,OAAO,gBAAgB;OAGvB,wBAD8B,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;CAGzD,OAAO,IAAI,OAAO,OAAO,aAAa,UACpC,OAAO,SAAS,OAAO,WAAW,EAAE;CAEtC,OAAO,OAAO;AAChB;AAEA,SAAS,YACP,QACA,wBACA,mBACA;CACA,IAAI,CAAC,OAAO,WAEV,OAAO,6BADuB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;MAEhD,IAAI,OAAO,OAAO,aAAa,UACpC,OAAO,YAAY,SAAS,OAAO,WAAW,EAAE;CAGlD,MAAM,qBAAqB,oBAAoB,OAAO,YAAY;CAClE,MAAM,eAAe;EACnB,GAAG;EACH;CACF;CACA,IAAI,uBAAuB,iBACzB,aAAa,eAAe,GAAG,MAAM,aAAa,GAAG;CAEvD,OAAO,qBAAqB;CAG5B,MAAM,YAAY,uBAAuB;CACzC,IAAI;CACJ,IAAI,aAAa,QAAQ,cAAc,aAAa,EAAE,cAAc,SAClE,WAAW,UAAU;MAErB,WAAW,OAAO;CAEpB,OAAO,WAAW;CAElB,IAAI,kBAAkB;CACtB,IAAI,UAAU;EACZ,kBAAkB,oBAAoB,QAAQ;EAC9C,OAAO,iBAAiB,mBAAmB,OAAO,EAAE,GAAG,gBAAgB,IAAI;EAC3E,IAAI,mBAAmB,gBAAgB,SAAS,uBAAuB,SAAS,MAAM;GACpF,MAAM,WAAW,GAAG,MAAM,YAAY,GAAG,uBAAuB;GAChE,gBAAgB,QAAQ;EAC1B;EACA,aAAa,iBAAiB;CAChC;CACA,IAAI,OAAO,eACT,aAAa,gBAAgB,GAAG,MAAM,cAAc,GAAG;CAGzD,OAAO,YAAY,iBAAiB,QAAQ,oBAAoB,eAAe;CAE/E,MAAM,WACJ,OAAO,OAAO,cAAc,WAAW,SAAS,OAAO,YAAY,EAAE,IAAI,OAAO;CAElF,MAAM,mBACJ,mBAAmB,gBAAgB,MAAM,gBAAgB,MAAM,OAAO;CACxE,MAAM,uBACJ,sBAAsB,mBAAmB,MACrC,mBAAmB,MACnB,OAAO,YAAY;CAEzB,IAAI;CACJ,MAAM,iBAAkB,uBAAuB,kBAC5C;CACH,IAAI,mBAAmB,eAAe,sBACpC,YAAY;MACP,IAAI,mBAAmB,eAAe,kBAC3C,YAAY;MAEZ,YAAY,mBAAmB,uBAAuB,mBAAmB;CAE3E,aAAa,YAAY;CAEzB,OAAO,YAAY;CAEnB,MAAM,EAAE,SAAS,WAAW,kBAC1B,QAFY,uBAAuB,QAAQ,uBAAuB,MAAM,QAAQ,MAIhF,uBAAuB,uBACzB;CACA,IAAI,CAAC,SACH,MAAM,MAAM,wCAAwC,QAAQ;CAI9D,IAAI,aAAa,QAAQ,mBAAmB,aAAa,EAAE,mBAAmB,SAAS;EACrF,MAAM,eAAe,UAAU;EAE/B,uBAAuB,SAAS;GAC9B,GAAG;GACH,eAAe;EACjB;CACF,OACE,uBAAuB,SAAS;CAGlC,uBAAuB,SAAS;CAChC,OAAO;AACT;AAEA,IAAM,oDAAoD;AAC1D,SAAS,WAAW,wBAAoC;CACtD,MAAM,oBAAoB,uBAAuB;CACjD,QAAQ,aAAuB;EAC7B,IAAI,SAAS,WAAW,KACtB,OAAO;EAET,MAAM,aAAa,IAAI,QAAQ,SAAS,OAAO;EAC/C,IAAI,SAAS,QAAQ,IAAI,iDAAiD,GAAG;GAC3E,uBAAuB,sCAAsC,SAAS,QAAQ,IAC5E,iDACF;GACA,WAAW,OAAO,iDAAiD;EACrE;EAEA,OAAO,SAAS,KAAK,CAAC,CAAC,MAAgB,WAAmB;GACxD,MAAM,eAAe,YAAY,QAAQ,wBAAwB,iBAAiB;GAClF,MAAM,OAAO,KAAK,UAAU,YAAY;GACxC,OAAO,IAAI,SAAS,MAAM;IACxB,QAAQ,SAAS;IACjB,YAAY,SAAS;IACrB,SAAS;GACX,CAAC;EACH,CAAC;CACH;AACF;;;AC5OA,IAAa,2BAA2B;;;;;;;AASxC,eAAsB,mBACpB,QACA,YAAY,0BACZ,iBAAA,KAC0B;CAC1B,MAAM,YAAY,KAAK,IAAI;CAC3B,OAAO,OAAO,UAAU,CAAC,cAAc,OAAO,MAAM,GAAG;EACrD,IAAI,KAAK,IAAI,IAAI,aAAa,WAC5B,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;EACd,CAAC;EAEH,MAAM,MAAM,cAAc;CAC5B;CAEA,IAAI,CAAC,OAAO,QAAQ,cAClB,OAAO,IAAI,SAAS,MAAM;EACxB,QAAQ;EACR,YAAY;CACd,CAAC;CAGH,OAAO;AACT;;;ACjCA,IAAM,qBAAqB,4BAA+D;CACxF,OAAO;EACL,wBAAwB;EACxB,wBAAwB;EACxB,wBAAwB;EACxB,wBAAwB;EACxB,wBAAwB;CAC1B,CAAC,CACE,OAAO,OAAO,CAAC,CACf,IAAI,YAAY;AACrB;AAEA,IAAM,uBAAuB,UAAoB,kBAAmC;CAClF,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,MAAK,WAAU;EAC5C,MAAM,EAAE,4BAA4B,UAAU,CAAC;EAC/C,IAAI,CAAC,yBACH,OAAO;EAGT,OAAO,kBAAkB,uBAAuB,CAAC,CAAC,MAAK,YACrD,cAAc,WAAW,OAAO,CAClC;CACF,CAAC;AACH;AAEA,IAAM,uBAAuB,QAAgB,kBAAmC;CAC9E,IAAI,OAAO,WAAW,UACpB,SAAS,IAAI,OAAO,IAAI,QAAQ;CAGlC,OAAO,OAAO,OAAO,aAAa,KAAK;AACzC;AAEA,IAAM,8BACJ,UACA,eACA,mBACY;CACZ,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,qBAAqB;EAC/D,IAAI,CAAC,gBAAgB,yBACnB,OAAO;EAIT,MAAM,UAAU,WADM,iBAAiB,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,GACpB,aAAa;EAEvD,IAAI,QAAQ,MAAK,WAAU,WAAA,GAA+B,GACxD,OAAO;EAGT,OAAO,QAAQ,MAAK,WAAU,oBAAoB,QAAQ,aAAa,CAAC;CAC1E,CAAC;AACH;AAEA,IAAM,8BACJ,UACA,eACA,mBACY;CACZ,MAAM,iBAAiB,OAAO,OAAO,QAAQ;CAE7C,IAAI,eAAe,WAAW,GAC5B,OAAO;CAGT,IAAI,CAAC,eAAe,OAAM,WAAU,OAAO,wBAAwB,GACjE,OAAO;CAGT,IAAI,CAAC,eAAe,OAAM,WAAU,OAAO,2BAA2B,IAAI,GACxE,OAAO;CAGT,OACE,CAAC,oBAAoB,UAAU,aAAa,KAC5C,CAAC,2BAA2B,UAAU,eAAe,cAAc;AAEvE;AAEA,IAAM,iCAAiC,UAAoB,QAA8B;CACvF,MAAM,gBAAgB,aAAa,GAAG;CACtC,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,QAAO,WAAU;EAC9C,MAAM,EAAE,4BAA4B,UAAU,CAAC;EAC/C,MAAM,EAAE,eAAe,uBAAuB,2BAA2B,CAAC;EAE1E,OACG,iBAAiB,cAAc,WAAW,aAAa,aAAa,CAAC,KACrE,sBAAsB,cAAc,WAAW,aAAa,kBAAkB,CAAC;CAEpF,CAAC;AACH;;;AC9FA,SAAgB,oBAAoB,cAAsB,iBAAiC;CAEzF,OAAO,aAAa,QAAQ,8BAAO,kBAAkB,iBAAiB;AACxE;AAEA,IAAa,4CAA4C,SAAyB;CAEhF,MAAM,QAAQ,KAAK,MAAM,wEAAK;CAE9B,OAAO,QAAQ,mBAAmB,MAAM,EAAE,IAAI;AAChD;;;ACVA,IAAA,kBAAe;;;ACwBf,IAAI,OAAO,iBAAiB,eAAe,OAAO,aAAa,iBAAiB,YAE9E,aAAa,aAAa,WAAW,EACnC,iBAAiB,SAAU,KAAa;CACtC,IAAI,QAAA,yBACF,OAAO;MAEP,MAAM,IAAI,MAAM,mCAAmC,GAAG;AAE1D,EACF,CAAC;AAGH,IAAM,QAAQ;AAKd,MAAM,cAAc,cAAc;AAElC,IAAM,KAAK,KAAK,uBAAM,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI,GAAI,CAAC,CAAC,SAAS;AAC5D,QAAQ,IAAI,+BAA+B,EAAE;AAC7C,IAAM,wBAAwB;AAC9B,IAAM,WAAqB,CAAC;;;;AAK5B,IAAM,iBAAiB,OAAO,UAAsB;CAClD,MAAM,kBAAkB,MAAM;CAC9B,MAAM,gBAAgB,gBAAgB,QAAQ,IAAI,cAAc;CAEhE,MAAM,WAAW,IAAI,SAAS,MAAM;EADrB,QAAQ;EAAK,YAAY;CACJ,CAAI;CAExC,IAAI,CAAC,eAAe;EAClB,MAAM,qBAAqB,IAAI,IAAI,gBAAgB,GAAG;EACtD,MAAM,kBAAkB,OAAO,mBAAmB,aAAa,IAAI,iBAAiB,CAAC,KAAK;EAC1F,KAAK,IAAI,IAAI,GAAG,IAAI,iBAAiB,KAAK;GACxC,MAAM,MAAM,MAAO,KAAK,MAAM,KAAK,OAAO,IAAI,GAAI,CAAC;GAEnD,OAAM,MADc,OAAO,KAAK,kBAAkB,EAAA,CACtC,IAAI,MAAM,SAAS,SAAS,MAAM,CAAC;EACjD;CACF;CACA,OAAO;AACT;;;;AAKA,eAAe,kBACb,iBACA,iBACA,KACA,eAAe,CAAC,GAChB;CACA,MAAM,gBAAgB,iBAAiB,gBAAgB,OAAO;CAC9D,IACE,iBAAiB,+CACjB,gBAAgB,0CACf,CAAC,gBAAgB,2DACf,gBAAgB,2DACf,cAAc,OAClB;EACA,MAAM,oBAAoB,gBAAgB;EAC1C,MAAM,MAAM,gBAAgB;EAC5B,MAAM,SAAS,gBAAgB;EAQ/B,cAAc,OAAO,MAPF,+CAA+C,IAAI,CAAC,CAAC,iBAAiB,CAAC,CACxF,KACA,QACA,KACA,YACF;EAGA,IAAI,gBAAgB,uCAAuC,MACzD,cAAc,QAAQ,gBAAgB;CAE1C;CACA,OAAO;AACT;;;;AAKA,IAAM,eAAe,UAA4B;;;;CAI/C,IAAI,wBAAwB,MAAM,QAAQ,aAAa,MAAM,QAAQ,IAAI,GACvE;CAGF,MAAM,gBAAgB,aAAa,MAAM,QAAQ,GAAG;CACpD,IACE,CAAC,cAAc,SAAS,qBAAqB,KAC7C,2BAA2B,UAAU,eAAe,cAAc,GAElE;CAGF,MAAM,aACH,YAA+B;EAC9B,IAAI;GACF,MAAM,kBAAkB,MAAM;GAC9B,MAAM,MAAM;GAGZ,IAAI,IAAI,SAAS,qBAAqB,GACpC,OAAO,eAAe,KAAK;GAI7B,MAAM,wCAAwC,yBAC5C,UACA,KACA,cACF;GAEA,MAAM,gBAAgB,gBAAgB,QAAQ,IAAI,eAAe;GACjE,IAAI,qBAAqB;GACzB,IAAI,MAAM;GAEV,IAAI,eAAe;IACjB,MAAM,QAAQ,cAAc,MAAM,GAAG;IACrC,qBAAqB,MAAM;IAC3B,IAAI,MAAM,EAAE,EAAE,SAAS,8CAA8C,GACnE,MAAM,MAAM,EAAE,CAAC,MAAM,8CAA8C,CAAC,CAAC;GAEzE;GAEA,MAAM,uCAAuC,uCAAuC,MAClF,MAAK,EAAE,kBAAkB,SAAS,GAAG,CACvC;GAGA,IAAI,sCAAsC,QAAQ,cAAc;IAE9D,MAAM,aAAa,MAAM,mBAAmB,oCAAoC;IAChF,IAAI,YACF,OAAO;IAIT,IAAI,cAAc,gBAAgB;IAClC,IACE,gBAAgB,SAAS,cACzB,qCAAqC,wCAErC,cAAc;IAIhB,IAAI;IAGJ,IACE,gBAAgB,SAAS,cACzB,CAAC,qCAAqC,kCAEtC,UAAU,EACR,GAAG,iBAAiB,gBAAgB,OAAO,EAC7C;SAEA,IACE,mBAAmB,YAAY,MAAM,UACpC,CAAC,qCAAqC,2DACrC,qCAAqC,6CAcvC,UAAU;KACR,GAAG,MAPqB,kBACxB,iBACA,sCACA,KACA,EARA,KAAK,MAAM,oCACT,qCAAqC,OAAO,YAC9C,EAMA,CACF;KAGE,eAAe,QAAQ,qCAAqC,OAAO;IACrE;SAGA,UAAU;KACR,GAAG,iBAAiB,gBAAgB,OAAO;KAC3C,eAAe,GAAG,mBAAmB,GAAG,qCAAqC,OAAO;IACtF;IAIJ,IAAI;IACJ,IAAI,gBAAgB,SAAS,YAC3B,OAAO,EACI,QACX;SAEA,OAAO;KACI;KACT,MAAM;IACR;IAGF,MAAM,aAAa,IAAI,QAAQ,iBAAiB,IAAI;IACpD,OAAO,MAAM,UAAU;GACzB;GAGA,IAAI,MAAM,QAAQ,WAAW,QAC3B,OAAO,MAAM,eAAe;GAI9B,MAAM,mBAAmBA,8BAAiC,UAAU,GAAG;GACvE,MAAM,iBAAiB,iBAAiB;GAExC,IAAI,iBAAiB,GAqJnB,OAAO,IApJqB,SAAmB,SAAS,WAAW;IACjE,MAAM,gBAAgB,gBAAgB,MAAM;IAC5C,cACG,KAAK,CAAC,CACN,KAAK,OAAM,eAAc;KACxB,IAAI,kBAAqC;KACzC,IAAI;MAEF,IACE,WAAW,SAAS,MAAM,aAAa,KACvC,WAAW,SAAS,MAAM,YAAY,GACtC;OACA,IAAI,UAAU,iBAAiB,gBAAgB,OAAO;OACtD,IAAI,UAAU;OAEd,KAAK,IAAI,IAAI,GAAG,IAAI,gBAAgB,KAAK;QACvC,MAAM,YAAY,iBAAiB;QACnC,IAAI,WAAW,QAAQ;SACrB,MAAM,eAAe,EACnB,KAAK,MAAM,oCACT,UAAU,OAAO,YACnB,EACF;SACA,UAAU,MAAM,kBACd,iBACA,WACA,KACA,YACF;SAEA,MAAM,kBAAkB,mBACtB,GAAG,MAAM,cAAc,GAAG,UAAU,mBACtC;SACA,IAAI,WAAW,SAAS,eAAe,GAAG;UACxC,UAAU,QAAQ,QAChB,iBACA,mBAAmB,UAAU,OAAO,aAAuB,CAC7D;UACA,kBAAkB;UAClB;SACF;SAEA,MAAM,iBAAiB,mBACrB,GAAG,MAAM,aAAa,GAAG,UAAU,mBACrC;SACA,IAAI,WAAW,SAAS,cAAc,GAAG;UACvC,UAAU,QAAQ,QAChB,gBACA,mBAAmB,UAAU,OAAO,YAAY,CAClD;UACA,kBAAkB;UAClB;SACF;QACF;OACF;OAEA,MAAM,eAAe,MAAM,iBAAiB;QAC1C,MAAM;QACN,QAAQ,cAAc;QACtB;QACA,MAAM,cAAc;QACpB,OAAO,cAAc;QACrB,UAAU,cAAc;QACxB,UAAU,cAAc;QACxB,aAAa,cAAc;QAC3B,WAAW,cAAc;OAC3B,CAAC;OAGD,IACE,iBAAiB,yBAAyB,sBAC1C,IAAI,WACF,aAAa,gBAAgB,wBAAwB,kBAAkB,CACzE,GACA;QACA,MAAM,OAAO,MAAM;QACnB,MAAM,MAAM,MAAM,KAAK,KAAK;QAC5B,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC;QAC/B;OACF;OAMA,QAAQ,MAHa,aAAa,KAChC,WAAW,eAA6B,CAC1C,CACc;OACd;MACF;MAIA,IADuB,WAAW,SAAS,gBACvC,GAAgB;OAClB,MAAM,wCACJ,yCAAyC,UAAU;OACrD,IACE,CAAC,yCACD,0CAA0C,IAE1C,MAAM,IAAI,MAAM,8CAA8C;OAEhE,kBAAkB,SAAS;OAC3B,IAAI,UAAU;OACd,MAAM,eAAe,gBAAgB;OACrC,IAAI,gBAAgB,MAClB,UAAU,oBAAoB,SAAS,YAAY;OAGrD,MAAM,gBAAgB,MAAM,kBAC1B,iBACA,iBACA,GACF;OACA,MAAM,OAAO,MAAM,MAAM,iBAAiB;QACxC,MAAM;QACN,QAAQ,cAAc;QACtB,SAAS;QACT,MAAM,cAAc;QACpB,OAAO,cAAc;QACrB,UAAU,cAAc;QACxB,UAAU,cAAc;QACxB,aAAa,cAAc;QAC3B,WAAW,cAAc;OAC3B,CAAC;OAED,QAAQ,MADa,WAAW,eAAe,CAAC,CAAC,IAAI,CACvC;OACd;MACF;MAcA,QAAQ,MAXiB,MAAM,iBAAiB;OAC9C,MAAM;OACN,QAAQ,cAAc;OACtB,SAAS,iBAAiB,gBAAgB,OAAO;OACjD,MAAM,cAAc;OACpB,OAAO,cAAc;OACrB,UAAU,cAAc;OACxB,UAAU,cAAc;OACxB,aAAa,cAAc;OAC3B,WAAW,cAAc;MAC3B,CAAC,CACiB;KACpB,SAAS,KAAK;MACZ,OAAO,GAAG;KACZ;IACF,CAAC,CAAC,CACD,MAAM,MAAM;GACjB,CAEO;GAIT,OAAO,MAAM,eAAe;EAC9B,SAAS,KAAK;GAEZ,QAAQ,MAAM,0CAA0C,GAAG;GAC3D,OAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,IAAI,CAAC;EAC7D;CACF,EAAA,CAAG,CACL;AACF;AAEA,IAAM,gBAAgB,OAAO,UAAkC;CAC7D,MAAM,OAAO,MAAM,MAAM;CACzB,MAAM,OAAO,MAAM;CAEnB,IAAI,MAAM,MAAM,SAAS,gBAAgB;EACvC,MAAM,MAAM,YAAY;EACxB,MAAM,cAAc,CAAC,CAAC;EACtB;CACF,OAAO,IAAI,MAAM,KAAK,SAAS,SAAS;EACtC,MAAM,QAAQ,MAAM,CAAC,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC;EACrD;CACF;CAEA,MAAM,oBAAoB,KAAK,kBAAkB,MAAM,GAAG,CAAC,CAAC;CAE5D,IAAI,kBAAkB,MACpB,iBAAiB,CAAC;CAGpB,MAAM,gBAAgB,eAAe;CACrC,MAAM,qBAAqB,MAAM,QAAQ,aAAa,IAClD,QACA,cAAc;CAElB,MAAM,QAAQ,qBAAqB,KAAK,QAAQ;CAChD,MAAM,6BAA6B,GAAG,kBAAkB,SAAS;CAEjE,IAAI,kBAAkB,SAAS;CAC/B,IAAI,CAAC,iBAAiB;EACpB,MAAM,kBAAkB,MAAM,QAAQ,aAAa,IAAI,QAAQ,cAAc;EAC7E,MAAM,wCAAwC,MAAM,QAAQ,aAAa,IACrE,OACA,cAAc;EAClB,MAAM,yCAAyC,MAAM,QAAQ,aAAa,IACtE,QACA,cAAc;EAClB,MAAM,2BAA2B,MAAM,QAAQ,aAAa,IACxD,QACA,cAAc;EAElB,SAAS,8BAA8B;GACrC,QAAQ;GACR,OAAO;GACP,cAAc;GACd,yBAAyB;GACzB,mBAAmB,KAAA;GACnB,OAAO;GACP,QAAQ;GACR,mBAAmB;GACnB,iBAAiB,CAAC;GAClB,kCAAkC,yCAAyC;GAC3E,wCAAwC,0CAA0C;GAClF,qCAAqC;GACrC,uCAAuC;GACvC,6CAA6C;GAC7C,yDAAyD;GACzD,oBAAoB,sBAAsB;GAC1C,0BAA0B,4BAA4B;EACxD;EACA,kBAAkB,SAAS;EAE3B,IAAI,CAAC,eAAe,oBAClB,eAAe,qBAAqB,CAAC;CAEzC;CAEA,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,gBAAgB,SAAS;GACzB,gBAAgB,QAAQ;GACxB,gBAAgB,eAAe;GAC/B,gBAAgB,QAAQ;GACxB,gBAAgB,sCAAsC;GACtD,gBAAgB,wCAAwC;GACxD,gBAAgB,8CAA8C;GAC9D,gBAAgB,0DAA0D;GAC1E,gBAAgB,SAAS,KAAK,KAAK;GACnC,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EAEF,KAAK,QAAQ;GACX,MAAM,0BAA0B,KAAK,KAAK;GAC1C,MAAM,UAAU,WAAW,eAAe,MAAM;GAEhD,IAAI,CAAC,QAAQ,MAAK,WAAU,WAAA,GAA+B,GACzD;IACE,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;GAC1B,CAAC,CAAC,SAAQ,MAAK;IACb,YAAY,SAAS,CAAC;GACxB,CAAC;GAGH,gBAAgB,0BAA0B;GAC1C,gBAAgB,oBAAoB,KAAK,KAAK;GAE9C,IAAI,gBAAgB,+CAA+C,MAAM;IACvE,MAAM,8CAA8C,qBAAqB,aAAa;IACtF,IAAI,+CAA+C,MAAM;KACvD,IAAI,gBAAgB,kBAAkB,mCACpC,QAAQ,KACN,kGACF;KAEF,gBAAgB,8CACd;KACF,gBAAgB,wCAAwC,MAAM,iBAAiB,IAAI,CAAC,CAClF,4CAA4C,oBAC9C;KACA,gBAAgB,0DACd,iCAAiC,aAAa,KAAK;IACvD;GACF;GAEA,IAAI,CAAC,gBAAgB,QACnB,KAAK,YAAY;IACf,QAAQ;IACR,QAAQ,gBAAgB;IACxB;IACA,SAAA;GACF,CAAC;QACI;IACL,MAAM,SAAS,EAAE,GAAG,gBAAgB,OAAO;IAC3C,IAAI,gBAAgB,iBAClB,OAAO,eAAe,GAAG,MAAM,aAAa,GAAG,kBAAkB,SAAS;IAE5E,IAAI,OAAO,eACT,OAAO,gBAAgB,GAAG,MAAM,cAAc,GAAG,kBAAkB,SAAS;IAE9E,IAAI,QAAQ,gBAAgB,SAAS,gBAAgB,SAAS,MAC5D,OAAO,eAAe,QAAQ,GAAG,MAAM,YAAY,GAAG,kBAAkB,SAAS;IAEnF,KAAK,YAAY;KACf;KACA,QAAQ,gBAAgB;KACxB;KACA,SAAA;IACF,CAAC;GACH;GACA;EACF;EAEA,KAAK;GACH,gBAAgB,sCACd,KAAK,KAAK;GACZ,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EAGF,KAAK,0CAA0C;GAC7C,MAAM,sCACJ,gBAAgB;GAClB,KAAK,YAAY;IACf;IACA;GACF,CAAC;GACD;EACF;EAEA,KAAK;GACH,gBAAgB,QAAQ,KAAK,KAAK;GAClC,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EAGF,KAAK,YAAY;GACf,MAAM,QAAQ,gBAAgB;GAC9B,KAAK,YAAY;IAAE;IAAmB;GAAM,CAAC;GAC7C;EACF;EAEA,KAAK;GACH,gBAAgB,eAAe,KAAK,KAAK;GACzC,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EAGF,KAAK,mBAAmB;GACtB,MAAM,eACJ,gBAAgB,gBAAgB,OAC5B,GAAG,MAAM,cAAc,GAAG,kBAAkB,SAAS,UACrD;GACN,KAAK,YAAY;IACf;IACA;GACF,CAAC;GACD;EACF;EAEA,KAAK;GACH,gBAAgB,eAAe,KAAK,KAAK;GACzC,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EAGF,KAAK,mBAAmB;GACtB,MAAM,eAAe,gBAAgB;GACrC,KAAK,YAAY;IAAE;IAAmB;GAAa,CAAC;GACpD;EACF;EAEA,KAAK,YAAY;GACf,MAAM,QAAQ,KAAK,KAAK;GACxB,IAAI,OACF,gBAAgB,QAAQ;GAE1B,KAAK,YAAY,EAAE,kBAAkB,CAAC;GACtC;EACF;EAEA,KAAK,YAAY;GACf,MAAM,WAAW,GAAG,MAAM,YAAY,GAAG,kBAAkB,SAAS;GACpE,MAAM,QAAQ,gBAAgB,QAAQ,WAAW;GACjD,KAAK,YAAY;IAAE;IAAmB;GAAM,CAAC;GAC7C;EACF;EAEA,SACE;CACJ;AACF;AAGA,MAAM,iBAAiB,SAAS,WAAW;AAC3C,MAAM,iBAAiB,WAAW,aAAa"}
+{"version":3,"file":"OidcServiceWorker.js","names":["getCurrentDatabasesTokenEndpoint"],"sources":["../src/constants.ts","../src/jwt.ts","../src/crypto.ts","../src/dpop.ts","../src/resource.ts","../src/tokenContexts.ts","../src/utils/normalizeUrl.ts","../src/utils/domains.ts","../src/utils/serializeHeaders.ts","../src/utils/shouldBypassDestination.ts","../src/utils/sleep.ts","../src/utils/tokens.ts","../src/utils/waitForValidTokens.ts","../src/oidcConfig.ts","../src/utils/codeVerifier.ts","../src/version.ts","../src/OidcServiceWorker.ts"],"sourcesContent":["const scriptFilename = 'OidcTrustedDomains.js';\nconst acceptAnyDomainToken = '*';\n\ntype TokenType = {\n  readonly REFRESH_TOKEN: string;\n  readonly ACCESS_TOKEN: string;\n  readonly NONCE_TOKEN: string;\n  readonly CODE_VERIFIER: string;\n};\n\nconst TOKEN: TokenType = {\n  REFRESH_TOKEN: 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  ACCESS_TOKEN: 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  NONCE_TOKEN: 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER',\n  CODE_VERIFIER: 'CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER',\n};\n\ntype TokenRenewModeType = {\n  readonly access_token_or_id_token_invalid: string;\n  readonly access_token_invalid: string;\n  readonly id_token_invalid: string;\n};\n\nconst TokenRenewMode: TokenRenewModeType = {\n  access_token_or_id_token_invalid: 'access_token_or_id_token_invalid',\n  access_token_invalid: 'access_token_invalid',\n  id_token_invalid: 'id_token_invalid',\n};\n\nconst openidWellknownUrlEndWith = '/.well-known/openid-configuration';\n\nexport { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename, TOKEN, TokenRenewMode };\n","// code base on https://coolaj86.com/articles/sign-jwt-webcrypto-vanilla-js/\n\n// String (UCS-2) to Uint8Array\n//\n// because... JavaScript, Strings, and Buffers\n// @ts-ignore\nimport { DemonstratingProofOfPossessionConfiguration } from './types';\n\nfunction strToUint8(str: string) {\n  return new TextEncoder().encode(str);\n}\n\n// Binary String to URL-Safe Base64\n//\n// btoa (Binary-to-Ascii) means \"binary string\" to base64\n// @ts-ignore\nfunction binToUrlBase64(bin) {\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+/g, '');\n}\n\n// UTF-8 to Binary String\n//\n// Because JavaScript has a strange relationship with strings\n// https://coolaj86.com/articles/base64-unicode-utf-8-javascript-and-you/\n// @ts-ignore\nfunction utf8ToBinaryString(str) {\n  const escstr = encodeURIComponent(str);\n  // replaces any uri escape sequence, such as %0A,\n  // with binary escape, such as 0x0A\n  // @ts-ignore\n  return escstr.replace(/%([0-9A-F]{2})/g, function (match: string, p1) {\n    return String.fromCharCode(parseInt(p1, 16));\n  });\n}\n\n// Uint8Array to URL Safe Base64\n//\n// the shortest distant between two encodings... binary string\n// @ts-ignore\nexport const uint8ToUrlBase64 = (uint8: Uint8Array) => {\n  let bin = '';\n  // @ts-ignore\n  uint8.forEach(function (code) {\n    bin += String.fromCharCode(code);\n  });\n  return binToUrlBase64(bin);\n};\n\n// UCS-2 String to URL-Safe Base64\n//\n// btoa doesn't work on UTF-8 strings\n// @ts-ignore\nfunction strToUrlBase64(str) {\n  return binToUrlBase64(utf8ToBinaryString(str));\n}\n\nexport const defaultDemonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration =\n  {\n    importKeyAlgorithm: {\n      name: 'ECDSA',\n      namedCurve: 'P-256',\n      hash: { name: 'ES256' },\n    },\n    signAlgorithm: { name: 'ECDSA', hash: { name: 'SHA-256' } },\n    generateKeyAlgorithm: {\n      name: 'ECDSA',\n      namedCurve: 'P-256',\n    },\n    digestAlgorithm: { name: 'SHA-256' },\n    jwtHeaderAlgorithm: 'ES256',\n  };\n\n// @ts-ignore\nconst sign =\n  (w: any) =>\n  async (\n    jwk: any,\n    headers: any,\n    claims: any,\n    demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration,\n    jwtHeaderType = 'dpop+jwt',\n  ) => {\n    // Make a shallow copy of the key\n    // (to set ext if it wasn't already set)\n    jwk = Object.assign({}, jwk);\n\n    // The headers should probably be empty\n    headers.typ = jwtHeaderType;\n    headers.alg = demonstratingProofOfPossessionConfiguration.jwtHeaderAlgorithm;\n    switch (headers.alg) {\n      case 'ES256': //if (!headers.kid) {\n        // alternate: see thumbprint function below\n        headers.jwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };\n        //}\n        break;\n      case 'RS256':\n        headers.jwk = { kty: jwk.kty, n: jwk.n, e: jwk.e, kid: headers.kid };\n        break;\n      default:\n        throw new Error('Unknown or not implemented JWS algorithm');\n    }\n\n    const jws = {\n      // @ts-ignore\n      // JWT \"headers\" really means JWS \"protected headers\"\n      protected: strToUrlBase64(JSON.stringify(headers)),\n      // @ts-ignore\n      // JWT \"claims\" are really a JSON-defined JWS \"payload\"\n      payload: strToUrlBase64(JSON.stringify(claims)),\n    };\n\n    // To import as EC (ECDSA, P-256, SHA-256, ES256)\n    const keyType = demonstratingProofOfPossessionConfiguration.importKeyAlgorithm;\n\n    // To make re-exportable as JSON (or DER/PEM)\n    const exportable = true;\n\n    // Import as a private key that isn't black-listed from signing\n    const privileges = ['sign'];\n\n    // Actually do the import, which comes out as an abstract key type\n    // @ts-ignore\n    const privateKey = await w.crypto.subtle.importKey('jwk', jwk, keyType, exportable, privileges);\n    // Convert UTF-8 to Uint8Array ArrayBuffer\n    // @ts-ignore\n    const data = strToUint8(`${jws.protected}.${jws.payload}`);\n\n    // The signature and hash should match the bit-entropy of the key\n    // https://tools.ietf.org/html/rfc7518#section-3\n    const signatureType = demonstratingProofOfPossessionConfiguration.signAlgorithm;\n\n    const signature = await w.crypto.subtle.sign(signatureType, privateKey, data);\n    // returns an ArrayBuffer containing a JOSE (not X509) signature,\n    // which must be converted to Uint8 to be useful\n    // @ts-ignore\n    jws.signature = uint8ToUrlBase64(new Uint8Array(signature));\n    // JWT is just a \"compressed\", \"protected\" JWS\n    // @ts-ignore\n    return `${jws.protected}.${jws.payload}.${jws.signature}`;\n  };\n\nexport const JWT = { sign };\n\n// @ts-ignore\nconst generate =\n  (w: any) => async (generateKeyAlgorithm: RsaHashedKeyGenParams | EcKeyGenParams) => {\n    const keyType = generateKeyAlgorithm;\n    const exportable = true;\n    const privileges = ['sign', 'verify'];\n    // @ts-ignore\n    const key = await w.crypto.subtle.generateKey(keyType, exportable, privileges);\n    // returns an abstract and opaque WebCrypto object,\n    // which in most cases you'll want to export as JSON to be able to save\n    return await w.crypto.subtle.exportKey('jwk', key.privateKey);\n  };\n\n// Create a Public Key from a Private Key\n//\n// chops off the private parts\n// @ts-ignore\nconst neuter = jwk => {\n  const copy = Object.assign({}, jwk);\n  delete copy.d;\n  copy.key_ops = ['verify'];\n  return copy;\n};\n\nconst EC = {\n  generate,\n  neuter,\n};\n// @ts-ignore\nconst thumbprint = (w: any) => async (jwk, digestAlgorithm: AlgorithmIdentifier) => {\n  let sortedPub;\n  // lexigraphically sorted, no spaces\n  switch (jwk.kty) {\n    case 'EC':\n      sortedPub = '{\"crv\":\"CRV\",\"kty\":\"EC\",\"x\":\"X\",\"y\":\"Y\"}'\n        .replace('CRV', jwk.crv)\n        .replace('X', jwk.x)\n        .replace('Y', jwk.y);\n      break;\n    case 'RSA':\n      sortedPub = '{\"e\":\"E\",\"kty\":\"RSA\",\"n\":\"N\"}'.replace('E', jwk.e).replace('N', jwk.n);\n      break;\n    default:\n      throw new Error('Unknown or not implemented JWK type');\n  }\n  // The hash should match the size of the key,\n  // but we're only dealing with P-256\n  const hash = await w.crypto.subtle.digest(digestAlgorithm, strToUint8(sortedPub));\n  return uint8ToUrlBase64(new Uint8Array(hash));\n};\n\nexport const JWK = { thumbprint };\n\nexport const generateJwkAsync =\n  (w: any) => async (generateKeyAlgorithm: RsaHashedKeyGenParams | EcKeyGenParams) => {\n    // @ts-ignore\n    const jwk = await EC.generate(w)(generateKeyAlgorithm);\n    // console.info('Private Key:', JSON.stringify(jwk));\n    // @ts-ignore\n    // console.info('Public Key:', JSON.stringify(EC.neuter(jwk)));\n    return jwk;\n  };\n\nexport const generateJwtDemonstratingProofOfPossessionAsync =\n  (w: any) =>\n  (demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration) =>\n  async (jwk: any, method = 'POST', url: string, extrasClaims = {}) => {\n    const target = new URL(url, w.location?.href);\n    target.search = '';\n    target.hash = '';\n    const claims = {\n      // https://www.rfc-editor.org/rfc/rfc9449.html#name-concept\n      jti: btoa(w.crypto.randomUUID()),\n      htm: method,\n      htu: target.href,\n      iat: Math.round(Date.now() / 1000),\n      ...extrasClaims,\n    };\n    // @ts-ignore\n    const kid = await JWK.thumbprint(w)(\n      jwk,\n      demonstratingProofOfPossessionConfiguration.digestAlgorithm,\n    );\n    // @ts-ignore\n    const jwt = await JWT.sign(w)(\n      jwk,\n      { kid: kid },\n      claims,\n      demonstratingProofOfPossessionConfiguration,\n    );\n    // console.info('JWT:', jwt);\n    return jwt;\n  };\n","import { uint8ToUrlBase64 } from './jwt';\n\nexport function textEncodeLite(str: string) {\n  const buf = new ArrayBuffer(str.length);\n  const bufView = new Uint8Array(buf);\n\n  for (let i = 0; i < str.length; i++) {\n    bufView[i] = str.charCodeAt(i);\n  }\n  return bufView;\n}\n\nexport function base64urlOfHashOfASCIIEncodingAsync(code: string): Promise<string> {\n  return new Promise((resolve, reject) => {\n    crypto.subtle.digest('SHA-256', textEncodeLite(code)).then(\n      buffer => {\n        return resolve(uint8ToUrlBase64(new Uint8Array(buffer)));\n      },\n      error => reject(error),\n    );\n  });\n}\n","import { defaultDemonstratingProofOfPossessionConfiguration } from './jwt';\nimport { Domain, DomainDetails } from './types.js';\n\nconst isDpop = (trustedDomain: Domain[] | DomainDetails): boolean => {\n  if (Array.isArray(trustedDomain)) {\n    return false;\n  }\n  return trustedDomain.demonstratingProofOfPossession ?? false;\n};\n\nexport const getDpopConfiguration = (trustedDomain: Domain[] | DomainDetails) => {\n  if (!isDpop(trustedDomain)) {\n    return null;\n  }\n\n  if (Array.isArray(trustedDomain)) {\n    return null;\n  }\n\n  return (\n    trustedDomain.demonstratingProofOfPossessionConfiguration ??\n    defaultDemonstratingProofOfPossessionConfiguration\n  );\n};\n\nexport const getDpopOnlyWhenDpopHeaderPresent = (trustedDomain: Domain[] | DomainDetails) => {\n  if (!isDpop(trustedDomain)) {\n    return null;\n  }\n\n  if (Array.isArray(trustedDomain)) {\n    return null;\n  }\n\n  return trustedDomain.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ?? true;\n};\n","/** An explicitly permitted OAuth resource and its API destinations. */\nexport interface OidcResourceConfiguration {\n  resource: string;\n  allowedUrlPrefixes: readonly string[];\n  scope?: string;\n  audiences?: readonly string[];\n}\n\n/** Worker-only resource refresh routing hint, removed before the provider request. */\nexport const RESOURCE_TOKEN_REQUEST_HEADER = 'x-oidc-resource';\n\n/** Builds an isolated storage/worker context without creating another OIDC client. */\nexport const getResourceContextName = (configurationName: string, resource: string): string =>\n  `${configurationName}#resource=${encodeURIComponent(resource)}`;\n\n/** Reads the exact resource identifier from an isolated context name. */\nexport const getContextResource = (configurationName: string): string | undefined => {\n  const marker = '#resource=';\n  const index = configurationName.indexOf(marker);\n  return index < 0 ? undefined : decodeURIComponent(configurationName.slice(index + marker.length));\n};\n\n/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */\nexport const validateResourceIdentifier = (resource: string): void => {\n  if (\n    typeof resource !== 'string' ||\n    !/^[a-z][a-z\\d+.-]*:/i.test(resource) ||\n    resource.includes('#') ||\n    /\\s/.test(resource)\n  ) {\n    throw new Error('A resource must be an absolute URI without whitespace or a fragment.');\n  }\n  new URL(resource);\n};\n\nconst getApiUrl = (value: string): URL => {\n  const url = new URL(value);\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:') ||\n    url.username ||\n    url.password ||\n    url.hash ||\n    /%2f|%5c/i.test(url.pathname)\n  ) {\n    throw new Error(\n      'API destinations must be HTTP(S) URLs without credentials, fragments, or encoded separators.',\n    );\n  }\n  return url;\n};\n\nconst getApiPrefixUrl = (value: string): URL => {\n  const prefix = getApiUrl(value);\n  if (prefix.search) throw new Error('An API URL prefix must not contain a query.');\n  return prefix;\n};\n\n/** Prevents default-token fallback anywhere on an explicitly managed API origin. */\nexport const isResourceOriginManaged = (\n  configurations: readonly OidcResourceConfiguration[] | undefined,\n  destination: string,\n): boolean => {\n  const origin = getApiUrl(destination).origin;\n  return (\n    configurations?.some(configuration =>\n      configuration.allowedUrlPrefixes.some(value => getApiPrefixUrl(value).origin === origin),\n    ) ?? false\n  );\n};\n\n/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */\nexport const isResourceUrlAllowed = (\n  configuration: OidcResourceConfiguration,\n  destination: string,\n): boolean => {\n  const url = getApiUrl(destination);\n  return configuration.allowedUrlPrefixes.some(value => {\n    const prefix = getApiPrefixUrl(value);\n    const path = prefix.pathname.replace(/\\/+$/, '');\n    return (\n      url.origin === prefix.origin &&\n      (path === '' || url.pathname === path || url.pathname.startsWith(`${path}/`))\n    );\n  });\n};\n\n/** Validates and retrieves an explicitly registered resource. */\nexport const getResourceConfiguration = (\n  configurations: readonly OidcResourceConfiguration[] | undefined,\n  resource: string,\n): OidcResourceConfiguration => {\n  validateResourceIdentifier(resource);\n  const matches =\n    configurations?.filter(configuration => configuration.resource === resource) ?? [];\n  if (matches.length !== 1 || matches[0].allowedUrlPrefixes.length === 0) {\n    throw new Error(\n      'The resource must be registered exactly once with permitted API URL prefixes.',\n    );\n  }\n  for (const prefix of matches[0].allowedUrlPrefixes) {\n    isResourceUrlAllowed(matches[0], prefix);\n  }\n  return matches[0];\n};\n","import { getResourceConfiguration, getResourceContextName } from './resource';\nimport type { Database, OidcConfig } from './types';\n\nexport const getTokenContextEntries = (database: Database): Array<[string, OidcConfig]> =>\n  Object.entries(database).flatMap(([key, configuration]): Array<[string, OidcConfig]> => [\n    [key, configuration],\n    ...Object.entries(configuration.resourceEntries ?? {}),\n  ]);\n\nexport const getTokenContexts = (database: Database): OidcConfig[] =>\n  getTokenContextEntries(database).map(([, configuration]) => configuration);\n\nexport const getOrCreateResourceContext = (\n  configuration: OidcConfig,\n  resource: string,\n): OidcConfig => {\n  getResourceConfiguration(configuration.oidcConfiguration?.resources, resource);\n  configuration.resourceEntries ??= {};\n  const name = getResourceContextName(configuration.configurationName, resource);\n  configuration.resourceEntries[name] ??= {\n    ...configuration,\n    configurationName: name,\n    resource,\n    parentConfiguration: configuration,\n    resourceEntries: undefined,\n    authorizationScope: undefined,\n    requestedScope: undefined,\n    demonstratingProofOfPossessionApiNonce: null,\n    refreshGrant: undefined,\n    tokens: null,\n    state: null,\n    codeVerifier: null,\n    nonce: null,\n    status: null,\n    hideAccessToken: true,\n    generation: 0,\n  };\n  return configuration.resourceEntries[name];\n};\n","export function normalizeUrl(url: string) {\n  try {\n    return new URL(url).toString();\n  } catch (error) {\n    console.error(`Failed to normalize url: ${url}`, error);\n    return url;\n  }\n}\n","import { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename } from '../constants';\nimport {\n  getResourceConfiguration,\n  isResourceOriginManaged,\n  isResourceUrlAllowed,\n} from '../resource';\nimport { getTokenContextEntries } from '../tokenContexts';\nimport { Database, Domain, DomainDetails, TrustedDomains } from '../types';\nimport { normalizeUrl } from './normalizeUrl';\n\nexport function checkDomain(domains: Domain[], endpoint: string) {\n  if (!endpoint) {\n    return;\n  }\n\n  const domain = domains.find(domain => {\n    let testable: RegExp;\n\n    if (typeof domain === 'string') {\n      testable = new RegExp(`^${domain}`);\n    } else {\n      testable = domain;\n    }\n\n    return testable.test?.(endpoint);\n  });\n  if (!domain) {\n    throw new Error(\n      'Domain ' + endpoint + ' is not trusted, please add domain in ' + scriptFilename,\n    );\n  }\n}\n\nexport const getDomains = (\n  trustedDomain: Domain[] | DomainDetails,\n  type: 'oidc' | 'accessToken',\n) => {\n  if (Array.isArray(trustedDomain)) {\n    return trustedDomain;\n  }\n\n  return trustedDomain[`${type}Domains`] ?? trustedDomain.domains ?? [];\n};\n\nexport const getCurrentDatabaseDomain = (\n  database: Database,\n  url: string,\n  trustedDomains: TrustedDomains,\n) => {\n  if (url.endsWith(openidWellknownUrlEndWith)) {\n    return null;\n  }\n  const datatases = [];\n  for (const [key, currentDatabase] of getTokenContextEntries(database)) {\n    const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;\n    const resources = currentDatabase.oidcConfiguration?.resources;\n    if (currentDatabase.resource) {\n      if (!isResourceUrlAllowed(getResourceConfiguration(resources, currentDatabase.resource), url))\n        continue;\n    } else if (\n      resources?.length &&\n      (!oidcServerConfiguration?.userInfoEndpoint ||\n        url !== normalizeUrl(oidcServerConfiguration.userInfoEndpoint)) &&\n      isResourceOriginManaged(resources, url)\n    ) {\n      continue;\n    }\n\n    if (!oidcServerConfiguration) {\n      continue;\n    }\n\n    if (\n      oidcServerConfiguration.tokenEndpoint &&\n      url === normalizeUrl(oidcServerConfiguration.tokenEndpoint)\n    ) {\n      continue;\n    }\n    if (\n      oidcServerConfiguration.revocationEndpoint &&\n      url === normalizeUrl(oidcServerConfiguration.revocationEndpoint)\n    ) {\n      continue;\n    }\n    const trustedDomain = trustedDomains == null ? [] : trustedDomains[key.split('#')[0]];\n\n    const domains = getDomains(trustedDomain, 'accessToken');\n    const domainsToSendTokens = oidcServerConfiguration.userInfoEndpoint\n      ? [normalizeUrl(oidcServerConfiguration.userInfoEndpoint), ...domains]\n      : [...domains];\n\n    let hasToSendToken = false;\n    if (domainsToSendTokens.find(f => f === acceptAnyDomainToken)) {\n      hasToSendToken = true;\n    } else {\n      for (let i = 0; i < domainsToSendTokens.length; i++) {\n        let domain = domainsToSendTokens[i];\n\n        if (typeof domain === 'string') {\n          domain = new RegExp(`^${domain}`);\n        }\n\n        if (domain.test?.(url)) {\n          hasToSendToken = true;\n          break;\n        }\n      }\n    }\n\n    if (hasToSendToken) {\n      if (currentDatabase.tokens) {\n        datatases.push(currentDatabase);\n      }\n    }\n  }\n  return datatases;\n};\n","function serializeHeaders(headers: Headers): Record<string, string> {\n  const headersObj: Record<string, string> = {};\n  for (const key of headers.keys()) {\n    const value = headers.get(key);\n    if (value !== null) {\n      headersObj[key] = value;\n    }\n  }\n  return headersObj;\n}\nexport { serializeHeaders };\n","const bypassedDestinations = ['image', 'font', 'media', 'document', 'iframe', 'script'];\n\n/**\n * Determines whether a fetch event should be bypassed (not intercepted by the service worker).\n * Navigation requests (mode === 'navigate') are never bypassed, even when their destination\n * is in the bypassed list, so that access tokens can be injected into new-tab navigations.\n */\nexport const shouldBypassDestination = (destination: string, mode: string): boolean => {\n  return bypassedDestinations.includes(destination) && mode !== 'navigate';\n};\n","const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));\nexport { sleep };\n","/* eslint-disable simple-import-sort/exports */\nimport { TOKEN, TokenRenewMode } from '../constants';\nimport { getResourceConfiguration } from '../resource';\nimport {\n  AccessTokenPayload,\n  IdTokenPayload,\n  OidcConfig,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Tokens,\n} from '../types';\n\nexport const parseJwt = (payload: string) => {\n  return JSON.parse(b64DecodeUnicode(payload.replaceAll(/-/g, '+').replaceAll(/_/g, '/')));\n};\nfunction b64DecodeUnicode(str: string) {\n  return decodeURIComponent(\n    Array.prototype.map\n      .call(atob(str), c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n      .join(''),\n  );\n}\n\nfunction computeTimeLeft(refreshTimeBeforeTokensExpirationInSecond: number, expiresAt: number) {\n  const currentTimeUnixSecond = new Date().getTime() / 1000;\n  return Math.round(expiresAt - refreshTimeBeforeTokensExpirationInSecond - currentTimeUnixSecond);\n}\n\nfunction isTokensValid(tokens: Tokens | null) {\n  if (!tokens) {\n    return false;\n  }\n  return computeTimeLeft(0, tokens.expiresAt) > 0;\n}\n\nconst extractTokenPayload = (token?: string) => {\n  try {\n    if (!token) {\n      return null;\n    }\n    const parts = token.split('.');\n    return parts.length === 3 ? parseJwt(parts[1]) : null;\n  } catch (e) {\n    console.warn(e);\n  }\n  return null;\n};\n\n// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).\n// https://github.com/openid/AppAuth-JS/issues/65\nconst isTokensOidcValid = (\n  tokens: Tokens,\n  nonce: string | null,\n  oidcServerConfiguration: OidcServerConfiguration,\n): { isValid: boolean; reason: string } => {\n  if (tokens.idTokenPayload) {\n    const idTokenPayload = tokens.idTokenPayload;\n    // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.\n    if (idTokenPayload && oidcServerConfiguration.issuer !== idTokenPayload.iss) {\n      return {\n        isValid: false,\n        reason: `Issuer does not match (oidcServerConfiguration issuer) ${oidcServerConfiguration.issuer} !== (idTokenPayload issuer) ${idTokenPayload.iss}`,\n      };\n    }\n    // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.\n\n    // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.\n\n    // 9: The current time MUST be before the time represented by the exp Claim.\n    const currentTimeUnixSecond = new Date().getTime() / 1000;\n    if (idTokenPayload && idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {\n      return {\n        isValid: false,\n        reason: `Token expired at (idTokenPayload exp) ${idTokenPayload.exp} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`,\n      };\n    }\n    // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.\n    const timeInSevenDays = 60 * 60 * 24 * 7;\n    if (\n      idTokenPayload &&\n      idTokenPayload.iat &&\n      idTokenPayload.iat + timeInSevenDays < currentTimeUnixSecond\n    ) {\n      return {\n        isValid: false,\n        reason: `Token is used from too long time (idTokenPayload iat + timeInSevenDays) ${idTokenPayload.iat + timeInSevenDays} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`,\n      };\n    }\n    // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.\n    if (idTokenPayload && nonce && idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {\n      return {\n        isValid: false,\n        reason: `Nonce does not match (nonce) ${nonce} !== (idTokenPayload nonce) ${idTokenPayload.nonce}`,\n      };\n    }\n  }\n  return { isValid: true, reason: '' };\n};\n\nfunction extractedIssueAt(\n  tokens: Tokens,\n  accessTokenPayload: AccessTokenPayload | null,\n  _idTokenPayload: IdTokenPayload,\n) {\n  if (!tokens.issued_at) {\n    if (accessTokenPayload && accessTokenPayload.iat) {\n      return accessTokenPayload.iat;\n    } else if (_idTokenPayload && _idTokenPayload.iat) {\n      return _idTokenPayload.iat;\n    } else {\n      const currentTimeUnixSecond = new Date().getTime() / 1000;\n      return currentTimeUnixSecond;\n    }\n  } else if (typeof tokens.issued_at == 'string') {\n    return parseInt(tokens.issued_at, 10);\n  }\n  return tokens.issued_at;\n}\n\nfunction _hideTokens(\n  tokens: Tokens,\n  currentDatabaseElement: OidcConfig,\n  configurationName: string,\n  isAuthorizationCode = false,\n) {\n  const hasNewIdToken = typeof tokens.id_token === 'string' && tokens.id_token.length > 0;\n  const parent = currentDatabaseElement.parentConfiguration;\n  if (\n    currentDatabaseElement.resource &&\n    currentDatabaseElement.refreshGrant === currentDatabaseElement &&\n    tokens.refresh_token &&\n    tokens.refresh_token === parent?.tokens?.refresh_token\n  ) {\n    throw new Error(\n      'The provider reused a refresh token across separate authorization transactions; use a multi-resource authorization grant instead.',\n    );\n  }\n  if (!tokens.issued_at) {\n    const currentTimeUnixSecond = new Date().getTime() / 1000;\n    tokens.issued_at = currentTimeUnixSecond;\n  } else if (typeof tokens.issued_at == 'string') {\n    tokens.issued_at = parseInt(tokens.issued_at, 10);\n  }\n\n  const accessTokenPayload = extractTokenPayload(tokens.access_token);\n  if (\n    currentDatabaseElement.resource ||\n    currentDatabaseElement.oidcConfiguration?.resources?.length\n  ) {\n    tokens.scope ??=\n      currentDatabaseElement.requestedScope ??\n      currentDatabaseElement.tokens?.scope ??\n      currentDatabaseElement.oidcConfiguration?.scope;\n  }\n  const secureTokens = {\n    ...tokens,\n    accessTokenPayload,\n  };\n  if (currentDatabaseElement.hideAccessToken) {\n    secureTokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}`;\n  }\n  tokens.accessTokenPayload = accessTokenPayload;\n\n  // When id_token is not rotated we reuse old id_token\n  const oldTokens = currentDatabaseElement.tokens;\n  let id_token: string | null;\n  if (oldTokens != null && 'id_token' in oldTokens && !('id_token' in tokens)) {\n    id_token = oldTokens.id_token;\n  } else {\n    id_token = tokens.id_token;\n  }\n  tokens.id_token = id_token;\n\n  let _idTokenPayload = null;\n  if (id_token) {\n    _idTokenPayload = extractTokenPayload(id_token);\n    tokens.idTokenPayload = _idTokenPayload != null ? { ..._idTokenPayload } : null;\n    if (_idTokenPayload && _idTokenPayload.nonce && currentDatabaseElement.nonce != null) {\n      const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabaseElement.configurationName}`;\n      _idTokenPayload.nonce = keyNonce;\n    }\n    secureTokens.idTokenPayload =\n      currentDatabaseElement.resource && !hasNewIdToken ? null : _idTokenPayload;\n  }\n  if (\n    currentDatabaseElement.resource &&\n    isAuthorizationCode &&\n    (!hasNewIdToken ||\n      typeof tokens.idTokenPayload?.sub !== 'string' ||\n      !tokens.idTokenPayload.sub ||\n      (currentDatabaseElement.nonce &&\n        tokens.idTokenPayload.nonce !== currentDatabaseElement.nonce.nonce))\n  ) {\n    throw new Error(\n      'Resource authorization requires a fresh ID token with the expected subject and nonce.',\n    );\n  }\n  if (tokens.refresh_token) {\n    secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${(currentDatabaseElement.refreshGrant ?? currentDatabaseElement).configurationName}`;\n  }\n\n  tokens.issued_at = extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload);\n\n  const expireIn =\n    typeof tokens.expires_in == 'string' ? parseInt(tokens.expires_in, 10) : tokens.expires_in;\n\n  const idTokenExpiresAt =\n    _idTokenPayload && _idTokenPayload.exp ? _idTokenPayload.exp : Number.MAX_VALUE;\n  const accessTokenExpiresAt =\n    accessTokenPayload && accessTokenPayload.exp\n      ? accessTokenPayload.exp\n      : tokens.issued_at + expireIn;\n\n  let expiresAt: number;\n  const tokenRenewMode = currentDatabaseElement.resource\n    ? TokenRenewMode.access_token_invalid\n    : (currentDatabaseElement.oidcConfiguration as OidcConfiguration).token_renew_mode;\n  if (tokenRenewMode === TokenRenewMode.access_token_invalid) {\n    expiresAt = accessTokenExpiresAt;\n  } else if (tokenRenewMode === TokenRenewMode.id_token_invalid) {\n    expiresAt = idTokenExpiresAt;\n  } else {\n    expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;\n  }\n  secureTokens.expiresAt = expiresAt;\n\n  tokens.expiresAt = expiresAt;\n  const nonce = currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null;\n  const { isValid, reason } = isTokensOidcValid(\n    currentDatabaseElement.resource && !hasNewIdToken\n      ? { ...tokens, idTokenPayload: undefined }\n      : tokens,\n    nonce as string,\n    currentDatabaseElement.oidcServerConfiguration as OidcServerConfiguration,\n  ); // TODO: Type assertion, could be null.\n  if (!isValid) {\n    throw Error(`Tokens are not OpenID valid, reason: ${reason}`);\n  }\n  if (currentDatabaseElement.resource) {\n    if (\n      typeof tokens.access_token !== 'string' ||\n      !tokens.access_token ||\n      !Number.isFinite(expiresAt) ||\n      !Number.isFinite(tokens.issued_at) ||\n      (tokens.refresh_token != null &&\n        (typeof tokens.refresh_token !== 'string' || !tokens.refresh_token))\n    ) {\n      throw new Error('The provider did not return a usable resource token response.');\n    }\n    const resource = getResourceConfiguration(\n      currentDatabaseElement.oidcConfiguration?.resources,\n      currentDatabaseElement.resource,\n    );\n    tokens.scope ??=\n      currentDatabaseElement.requestedScope ??\n      resource.scope ??\n      currentDatabaseElement.oidcConfiguration?.scope;\n    secureTokens.scope = tokens.scope;\n    if (\n      resource.scope &&\n      !resource.scope\n        .split(/\\s+/)\n        .filter(Boolean)\n        .every(scope => (tokens.scope ?? '').split(/\\s+/).includes(scope))\n    ) {\n      throw new Error('The provider did not grant the required resource scopes.');\n    }\n    const parentSubject = currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;\n    const subject = tokens.idTokenPayload?.sub ?? oldTokens?.idTokenPayload?.sub ?? parentSubject;\n    if (typeof parentSubject !== 'string' || subject !== parentSubject) {\n      throw new Error('Resource authorization must preserve the authenticated subject.');\n    }\n    if (\n      (accessTokenPayload?.iss !== undefined &&\n        accessTokenPayload.iss !== currentDatabaseElement.oidcServerConfiguration?.issuer) ||\n      (accessTokenPayload &&\n        resource.audiences &&\n        !resource.audiences.some(audience =>\n          (typeof accessTokenPayload.aud === 'string'\n            ? [accessTokenPayload.aud]\n            : (accessTokenPayload.aud ?? [])\n          ).includes(audience),\n        ))\n    )\n      throw new Error('Resource token issuer or configured audience does not match.');\n  }\n\n  // When refresh_token is not rotated we reuse old refresh_token\n  if (oldTokens != null && 'refresh_token' in oldTokens && !('refresh_token' in tokens)) {\n    const refreshToken = oldTokens.refresh_token;\n\n    currentDatabaseElement.tokens = {\n      ...tokens,\n      refresh_token: refreshToken,\n    };\n  } else {\n    currentDatabaseElement.tokens = tokens;\n  }\n\n  currentDatabaseElement.status = 'LOGGED_IN';\n  if (currentDatabaseElement.resource) {\n    const grant = currentDatabaseElement.refreshGrant ?? currentDatabaseElement;\n    const subject =\n      tokens.idTokenPayload?.sub ??\n      grant.tokens?.idTokenPayload?.sub ??\n      currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;\n    if (typeof subject !== 'string')\n      throw new Error('Resource tokens require an authenticated OIDC subject.');\n    if (grant !== currentDatabaseElement && tokens.refresh_token && grant.tokens) {\n      grant.tokens.refresh_token = tokens.refresh_token;\n    }\n    const resourceContext = {\n      resource: currentDatabaseElement.resource,\n      issuer: currentDatabaseElement.oidcServerConfiguration!.issuer,\n      clientId: currentDatabaseElement.oidcConfiguration!.client_id!,\n      configurationName: currentDatabaseElement.configurationName.split('#')[0],\n      subject,\n      grantResource: grant.resource ?? null,\n    };\n    currentDatabaseElement.tokens!.resourceContext = resourceContext;\n    secureTokens.resourceContext = resourceContext;\n  }\n  return secureTokens;\n}\n\nconst demonstratingProofOfPossessionNonceResponseHeader = 'DPoP-Nonce';\nfunction hideTokens(\n  currentDatabaseElement: OidcConfig,\n  isCurrent: () => boolean = () => true,\n  isGrantCurrent: () => boolean = isCurrent,\n  isAuthorizationCode = false,\n) {\n  const configurationName = currentDatabaseElement.configurationName;\n  return (response: Response) => {\n    if (response.status !== 200) {\n      return response;\n    }\n    const newHeaders = new Headers(response.headers);\n    if (\n      response.headers.has(demonstratingProofOfPossessionNonceResponseHeader) &&\n      isGrantCurrent()\n    ) {\n      currentDatabaseElement.demonstratingProofOfPossessionNonce = response.headers.get(\n        demonstratingProofOfPossessionNonceResponseHeader,\n      );\n      if (\n        currentDatabaseElement.refreshGrant &&\n        currentDatabaseElement.refreshGrant !== currentDatabaseElement\n      ) {\n        currentDatabaseElement.refreshGrant.demonstratingProofOfPossessionNonce =\n          currentDatabaseElement.demonstratingProofOfPossessionNonce;\n      }\n      newHeaders.delete(demonstratingProofOfPossessionNonceResponseHeader);\n    }\n\n    return response.json().then<Response>((tokens: Tokens) => {\n      const grant = currentDatabaseElement.refreshGrant;\n      if (\n        currentDatabaseElement.resource &&\n        grant &&\n        isGrantCurrent() &&\n        grant.tokens &&\n        typeof tokens.refresh_token === 'string' &&\n        tokens.refresh_token &&\n        (grant !== currentDatabaseElement ||\n          tokens.refresh_token !==\n            currentDatabaseElement.parentConfiguration?.tokens?.refresh_token)\n      ) {\n        grant.tokens.refresh_token = tokens.refresh_token;\n      }\n      if (!isCurrent()) {\n        throw new Error('The token transaction was cleared before its response.');\n      }\n      const secureTokens = _hideTokens(\n        tokens,\n        currentDatabaseElement,\n        configurationName,\n        isAuthorizationCode,\n      );\n      const body = JSON.stringify(secureTokens);\n      return new Response(body, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: newHeaders,\n      });\n    });\n  };\n}\n\nexport {\n  b64DecodeUnicode,\n  computeTimeLeft,\n  isTokensValid,\n  extractTokenPayload,\n  isTokensOidcValid,\n  hideTokens,\n  _hideTokens,\n};\n","import { OidcConfig } from '../types';\nimport { sleep } from './sleep';\nimport { isTokensValid } from './tokens';\n\nexport const TOKEN_RENEWAL_TIMEOUT_MS = 5000;\nexport const TOKEN_RENEWAL_POLL_INTERVAL_MS = 200;\n\n/**\n * Polls until the tokens in the given config are valid, or until a timeout elapses.\n *\n * @returns `null` when tokens become valid; a synthetic 401 `Response` on timeout or\n *          when the tokens are cleared while waiting (e.g. due to a parallel logout).\n */\nexport async function waitForValidTokens(\n  config: OidcConfig,\n  maxWaitMs = TOKEN_RENEWAL_TIMEOUT_MS,\n  pollIntervalMs = TOKEN_RENEWAL_POLL_INTERVAL_MS,\n): Promise<Response | null> {\n  const startTime = Date.now();\n  while (config.tokens && !isTokensValid(config.tokens)) {\n    if (Date.now() - startTime >= maxWaitMs) {\n      return new Response(null, {\n        status: 401,\n        statusText: 'Token expired - service worker renewal timeout',\n      });\n    }\n    await sleep(pollIntervalMs);\n  }\n\n  if (!config.tokens?.access_token) {\n    return new Response(null, {\n      status: 401,\n      statusText: 'Missing access token',\n    });\n  }\n\n  return null;\n}\n","import { acceptAnyDomainToken } from './constants';\nimport { getTokenContexts } from './tokenContexts';\nimport { Database, Domain, OidcConfig, OidcServerConfiguration, TrustedDomains } from './types';\nimport { getDomains, normalizeUrl } from './utils';\n\nconst getOidcServerUrls = (oidcServerConfiguration: OidcServerConfiguration): string[] => {\n  return [\n    oidcServerConfiguration.issuer,\n    oidcServerConfiguration.authorizationEndpoint,\n    oidcServerConfiguration.tokenEndpoint,\n    oidcServerConfiguration.revocationEndpoint,\n    oidcServerConfiguration.userInfoEndpoint,\n  ]\n    .filter(Boolean)\n    .map(normalizeUrl);\n};\n\nconst isOidcServerRequest = (database: Database, normalizedUrl: string): boolean => {\n  return Object.values(database).some(config => {\n    const { oidcServerConfiguration } = config || {};\n    if (!oidcServerConfiguration) {\n      return false;\n    }\n\n    return getOidcServerUrls(oidcServerConfiguration).some(oidcUrl =>\n      normalizedUrl.startsWith(oidcUrl),\n    );\n  });\n};\n\nconst isDomainMatchingUrl = (domain: Domain, normalizedUrl: string): boolean => {\n  if (typeof domain === 'string') {\n    domain = new RegExp(`^${domain}`);\n  }\n\n  return domain.test?.(normalizedUrl) ?? false;\n};\n\nconst isAccessTokenDomainRequest = (\n  database: Database,\n  normalizedUrl: string,\n  trustedDomains: TrustedDomains,\n): boolean => {\n  return Object.entries(database).some(([key, currentDatabase]) => {\n    if (!currentDatabase.oidcServerConfiguration) {\n      return false;\n    }\n\n    const trustedDomain = trustedDomains?.[key.split('#')[0]] ?? [];\n    const domains = getDomains(trustedDomain, 'accessToken');\n\n    if (domains.some(domain => domain === acceptAnyDomainToken)) {\n      return true;\n    }\n\n    return domains.some(domain => isDomainMatchingUrl(domain, normalizedUrl));\n  });\n};\n\nconst shouldBypassNonOidcRequest = (\n  database: Database,\n  normalizedUrl: string,\n  trustedDomains: TrustedDomains,\n): boolean => {\n  const configurations = Object.values(database);\n\n  if (configurations.length === 0) {\n    return false;\n  }\n\n  if (!configurations.every(config => config.bypassAllNonOidcRequests)) {\n    return false;\n  }\n\n  if (!configurations.every(config => config.oidcServerConfiguration != null)) {\n    return false;\n  }\n\n  return (\n    !isOidcServerRequest(database, normalizedUrl) &&\n    !isAccessTokenDomainRequest(database, normalizedUrl, trustedDomains)\n  );\n};\n\nconst getMatchingOidcConfigurations = (database: Database, url: string): OidcConfig[] => {\n  const normalizedUrl = normalizeUrl(url);\n  return getTokenContexts(database).filter(config => {\n    const { oidcServerConfiguration } = config || {};\n    const { tokenEndpoint, revocationEndpoint } = oidcServerConfiguration || {};\n\n    return (\n      (tokenEndpoint && normalizedUrl.startsWith(normalizeUrl(tokenEndpoint))) ||\n      (revocationEndpoint && normalizedUrl.startsWith(normalizeUrl(revocationEndpoint)))\n    );\n  });\n};\n\nexport {\n  getMatchingOidcConfigurations as getCurrentDatabasesTokenEndpoint,\n  isAccessTokenDomainRequest,\n  isOidcServerRequest,\n  shouldBypassNonOidcRequest,\n};\n","export function replaceCodeVerifier(codeVerifier: string, newCodeVerifier: string): string {\n  const regex = /[?&]code_verifier=([^&]+)/i;\n  return codeVerifier.replace(regex, `&code_verifier=${newCodeVerifier}`);\n}\n\nexport const extractConfigurationNameFromCodeVerifier = (body: string): string => {\n  const regex = /[?&]code_verifier=CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER_([^&]+)/;\n  const match = body.match(regex);\n\n  return match ? decodeURIComponent(match[1]) : '';\n};\n","export default '7.30.0';\n","import { acceptAnyDomainToken, scriptFilename, TOKEN } from './constants';\nimport { base64urlOfHashOfASCIIEncodingAsync } from './crypto';\nimport { getDpopConfiguration, getDpopOnlyWhenDpopHeaderPresent } from './dpop';\nimport { generateJwkAsync, generateJwtDemonstratingProofOfPossessionAsync } from './jwt';\nimport { getCurrentDatabasesTokenEndpoint, shouldBypassNonOidcRequest } from './oidcConfig';\nimport {\n  getContextResource,\n  getResourceConfiguration,\n  RESOURCE_TOKEN_REQUEST_HEADER,\n} from './resource';\nimport { getOrCreateResourceContext, getTokenContexts } from './tokenContexts';\nimport { Database, MessageEventData, OidcConfig, TrustedDomains } from './types';\nimport {\n  checkDomain,\n  getCurrentDatabaseDomain,\n  getDomains,\n  hideTokens,\n  normalizeUrl,\n  serializeHeaders,\n  shouldBypassDestination,\n  sleep,\n  waitForValidTokens,\n} from './utils';\nimport {\n  extractConfigurationNameFromCodeVerifier,\n  replaceCodeVerifier,\n} from './utils/codeVerifier';\nimport version from './version';\n\n// @ts-ignore\nif (typeof trustedTypes !== 'undefined' && typeof trustedTypes.createPolicy === 'function') {\n  // @ts-ignore\n  trustedTypes.createPolicy('default', {\n    createScriptURL: function (url: string) {\n      if (url === scriptFilename) {\n        return url;\n      } else {\n        throw new Error('Untrusted script URL blocked: ' + url);\n      }\n    },\n  });\n}\n\nconst _self = self as ServiceWorkerGlobalScope & typeof globalThis;\n\n// `trustedDomains` is declared in the externally loaded script (OidcTrustedDomains.js)\ndeclare let trustedDomains: TrustedDomains;\n\n_self.importScripts(scriptFilename);\n\nconst id = Math.round(new Date().getTime() / 1000).toString();\nconsole.log('init service worker with id', id);\nconst keepAliveJsonFilename = 'OidcKeepAliveServiceWorker.json';\nconst database: Database = {};\n\n/**\n * Keeps the service worker alive by responding with a cached response after a sleep.\n */\nconst keepAliveAsync = async (event: FetchEvent) => {\n  const originalRequest = event.request;\n  const isFromVanilla = originalRequest.headers.has('oidc-vanilla');\n  const init = { status: 200, statusText: 'oidc-service-worker' };\n  const response = new Response('{}', init);\n\n  if (!isFromVanilla) {\n    const originalRequestUrl = new URL(originalRequest.url);\n    const minSleepSeconds = Number(originalRequestUrl.searchParams.get('minSleepSeconds')) || 240;\n    for (let i = 0; i < minSleepSeconds; i++) {\n      await sleep(1000 + Math.floor(Math.random() * 1000));\n      const cache = await caches.open('oidc_dummy_cache');\n      await cache.put(event.request, response.clone());\n    }\n  }\n  return response;\n};\n\n/**\n * Generates DPoP headers when a DPoP configuration is present.\n */\nasync function generateDpopAsync(\n  originalRequest: Request,\n  currentDatabase: OidcConfig | null,\n  url: string,\n  extrasClaims = {},\n) {\n  const headersExtras = serializeHeaders(originalRequest.headers);\n  if (\n    currentDatabase?.demonstratingProofOfPossessionConfiguration &&\n    currentDatabase.demonstratingProofOfPossessionJwkJson &&\n    (!currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ||\n      (currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent &&\n        headersExtras.dpop))\n  ) {\n    const dpopConfiguration = currentDatabase.demonstratingProofOfPossessionConfiguration;\n    const jwk = currentDatabase.demonstratingProofOfPossessionJwkJson;\n    const method = originalRequest.method;\n    const resourceNonce = currentDatabase.resource\n      ? url === normalizeUrl(currentDatabase.oidcServerConfiguration!.tokenEndpoint)\n        ? currentDatabase.demonstratingProofOfPossessionNonce\n        : currentDatabase.demonstratingProofOfPossessionApiNonce\n      : undefined;\n    const dpop = await generateJwtDemonstratingProofOfPossessionAsync(self)(dpopConfiguration)(\n      jwk,\n      method,\n      url,\n      {\n        ...extrasClaims,\n        ...(resourceNonce ? { nonce: resourceNonce } : {}),\n      },\n    );\n\n    headersExtras.dpop = dpop;\n    const nonceHeader =\n      resourceNonce ??\n      (!currentDatabase.resource ? currentDatabase.demonstratingProofOfPossessionNonce : undefined);\n    if (nonceHeader) headersExtras.nonce = nonceHeader;\n  }\n  return headersExtras;\n}\n\n/**\n * Intercepts fetch requests to inject access tokens and handle token endpoints.\n */\nconst handleFetch = (event: FetchEvent): void => {\n  /**\n   * Exit early for requests that do not need to have an auth token attached.\n   */\n  if (shouldBypassDestination(event.request.destination, event.request.mode)) {\n    return; // Don't call event.respondWith() - let browser handle naturally\n  }\n\n  const normalizedUrl = normalizeUrl(event.request.url);\n  if (\n    !normalizedUrl.includes(keepAliveJsonFilename) &&\n    shouldBypassNonOidcRequest(database, normalizedUrl, trustedDomains)\n  ) {\n    return; // Don't call event.respondWith() - let browser handle naturally\n  }\n\n  event.respondWith(\n    (async (): Promise<Response> => {\n      try {\n        const originalRequest = event.request;\n        const url = normalizedUrl;\n\n        // 1) Handle keep-alive requests\n        if (url.includes(keepAliveJsonFilename)) {\n          return keepAliveAsync(event);\n        }\n\n        // Check if an access token is available for this request\n        const currentDatabasesForRequestAccessToken = getCurrentDatabaseDomain(\n          database,\n          url,\n          trustedDomains,\n        );\n\n        const authorization = originalRequest.headers.get('authorization');\n        let authenticationMode = 'Bearer';\n        let key = 'default';\n\n        if (authorization) {\n          const split = authorization.split(' ');\n          authenticationMode = split[0];\n          if (split[1]?.includes('ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_')) {\n            key = split[1].split('ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_')[1];\n          }\n        }\n\n        const currentDatabaseForRequestAccessToken = currentDatabasesForRequestAccessToken?.find(\n          c =>\n            key.includes('#resource=')\n              ? c.configurationName === key\n              : !c.resource && c.configurationName.endsWith(key),\n        );\n        if (key.includes('#resource=') && !currentDatabaseForRequestAccessToken) {\n          console.error(\n            '[OidcServiceWorker] Resource token destination or context is not permitted.',\n          );\n          return new Response('Resource token destination or context is not permitted.', {\n            status: 403,\n          });\n        }\n\n        // Inject the access token into the request if one is available\n        if (currentDatabaseForRequestAccessToken?.tokens?.access_token) {\n          // Wait for token to become valid (a parallel refresh may be in progress)\n          const tokenError = await waitForValidTokens(currentDatabaseForRequestAccessToken);\n          if (tokenError) {\n            return tokenError;\n          }\n          const accessToken = currentDatabaseForRequestAccessToken.tokens!.access_token;\n          const generation = currentDatabaseForRequestAccessToken.generation;\n          const parentGeneration =\n            currentDatabaseForRequestAccessToken.parentConfiguration?.generation;\n\n          // Adjust request mode for CORS if configured\n          let requestMode = originalRequest.mode;\n          if (\n            originalRequest.mode !== 'navigate' &&\n            currentDatabaseForRequestAccessToken.convertAllRequestsToCorsExceptNavigate\n          ) {\n            requestMode = 'cors';\n          }\n\n          // Build request headers\n          let headers: { [p: string]: string };\n\n          // Skip the access token for navigate requests when setAccessTokenToNavigateRequests is false\n          if (\n            originalRequest.mode === 'navigate' &&\n            !currentDatabaseForRequestAccessToken.setAccessTokenToNavigateRequests\n          ) {\n            headers = {\n              ...serializeHeaders(originalRequest.headers),\n            };\n          } else {\n            if (\n              authenticationMode.toLowerCase() === 'dpop' ||\n              (!currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent &&\n                currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionConfiguration)\n            ) {\n              // DPoP mode\n              const claimsExtras = {\n                ath: await base64urlOfHashOfASCIIEncodingAsync(accessToken),\n              };\n              const dpopHeaders = await generateDpopAsync(\n                originalRequest,\n                currentDatabaseForRequestAccessToken,\n                url,\n                claimsExtras,\n              );\n              headers = {\n                ...dpopHeaders,\n                authorization: `DPoP ${accessToken}`,\n              };\n            } else {\n              // Bearer mode\n              headers = {\n                ...serializeHeaders(originalRequest.headers),\n                authorization: `${authenticationMode} ${accessToken}`,\n              };\n            }\n          }\n\n          let init: RequestInit;\n          if (originalRequest.mode === 'navigate') {\n            init = {\n              headers: headers,\n            };\n          } else {\n            init = {\n              headers: headers,\n              mode: requestMode,\n            };\n          }\n\n          const newRequest = new Request(originalRequest, init);\n          if (\n            currentDatabaseForRequestAccessToken.resource &&\n            (currentDatabaseForRequestAccessToken.generation !== generation ||\n              currentDatabaseForRequestAccessToken.parentConfiguration?.generation !==\n                parentGeneration ||\n              currentDatabaseForRequestAccessToken.tokens?.access_token !== accessToken)\n          ) {\n            console.error('[OidcServiceWorker] The resource token changed before dispatch.');\n            return new Response('The resource token changed before dispatch.', { status: 403 });\n          }\n          const response = await fetch(\n            newRequest,\n            currentDatabaseForRequestAccessToken.resource ? { redirect: 'error' } : undefined,\n          );\n          if (\n            currentDatabaseForRequestAccessToken.resource &&\n            currentDatabaseForRequestAccessToken.generation === generation &&\n            currentDatabaseForRequestAccessToken.parentConfiguration?.generation ===\n              parentGeneration &&\n            response.headers.has('DPoP-Nonce')\n          ) {\n            currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionApiNonce =\n              response.headers.get('DPoP-Nonce');\n          }\n          return response;\n        }\n\n        // Pass through non-POST requests without modification\n        if (event.request.method !== 'POST') {\n          return fetch(originalRequest);\n        }\n\n        // Handle POST requests to known token/revocation endpoints\n        const currentDatabases = getCurrentDatabasesTokenEndpoint(database, url);\n        const numberDatabase = currentDatabases.length;\n\n        if (numberDatabase > 0) {\n          const responsePromise = new Promise<Response>((resolve, reject) => {\n            const clonedRequest = originalRequest.clone();\n            clonedRequest\n              .text()\n              .then(async actualBody => {\n                let currentDatabase: OidcConfig | null = null;\n                try {\n                  // Replace hidden token placeholders with the real token values\n                  if (\n                    actualBody.includes(TOKEN.REFRESH_TOKEN) ||\n                    actualBody.includes(TOKEN.ACCESS_TOKEN)\n                  ) {\n                    let headers = serializeHeaders(originalRequest.headers);\n                    let newBody = actualBody;\n\n                    for (let i = 0; i < numberDatabase; i++) {\n                      const currentDb = currentDatabases[i];\n                      if (currentDb?.tokens) {\n                        const claimsExtras = {\n                          ath: await base64urlOfHashOfASCIIEncodingAsync(\n                            currentDb.tokens.access_token,\n                          ),\n                        };\n                        const keyRefreshToken = encodeURIComponent(\n                          `${TOKEN.REFRESH_TOKEN}_${currentDb.configurationName}`,\n                        );\n                        if (\n                          [\n                            new URLSearchParams(actualBody).get('refresh_token'),\n                            new URLSearchParams(actualBody).get('token'),\n                          ].includes(decodeURIComponent(keyRefreshToken))\n                        ) {\n                          const form = new URLSearchParams(actualBody);\n                          const selected = form.getAll('resource');\n                          const resourceHeader = originalRequest.headers.get(\n                            RESOURCE_TOKEN_REQUEST_HEADER,\n                          );\n                          const isRevocation =\n                            currentDb.oidcServerConfiguration?.revocationEndpoint &&\n                            url ===\n                              normalizeUrl(currentDb.oidcServerConfiguration.revocationEndpoint) &&\n                            form.has('token');\n                          if (isRevocation) {\n                            currentDatabase = currentDb;\n                          } else if (resourceHeader !== null) {\n                            const resource = decodeURIComponent(resourceHeader);\n                            if (selected.length !== 1 || selected[0] !== resource)\n                              throw new Error('The resource routing hint must match the request.');\n                            if (!currentDb.oidcConfiguration)\n                              throw new Error('The resource grant configuration is unavailable.');\n                            const resourceConfiguration = getResourceConfiguration(\n                              currentDb.oidcConfiguration.resources,\n                              resource,\n                            );\n                            const grantedScope =\n                              currentDb.tokens.scope ??\n                              currentDb.authorizationScope ??\n                              currentDb.oidcConfiguration.scope;\n                            const requestedScopes = [\n                              form.get('scope'),\n                              resourceConfiguration.scope,\n                            ].filter((scope): scope is string => typeof scope === 'string');\n                            if (\n                              requestedScopes.some(\n                                scope =>\n                                  !scope\n                                    .split(/\\s+/)\n                                    .filter(Boolean)\n                                    .every(value => grantedScope?.split(/\\s+/).includes(value)),\n                              )\n                            ) {\n                              throw new Error('The resource scope is outside this refresh grant.');\n                            }\n                            if (\n                              currentDb.resource !== undefined\n                                ? currentDb.resource !== resource\n                                : !(\n                                    typeof currentDb.oidcConfiguration.resource === 'string'\n                                      ? [currentDb.oidcConfiguration.resource]\n                                      : (currentDb.oidcConfiguration.resource ?? [])\n                                  ).includes(resource)\n                            )\n                              throw new Error('The resource is outside this refresh grant.');\n                            currentDatabase = currentDb.resource\n                              ? currentDb\n                              : getOrCreateResourceContext(currentDb, resource);\n                            currentDatabase.refreshGrant = currentDb;\n                            currentDatabase.requestedScope = form.get('scope') ?? grantedScope;\n                            currentDatabase.nonce = currentDb.nonce;\n                            currentDatabase.demonstratingProofOfPossessionJwkJson =\n                              currentDb.demonstratingProofOfPossessionJwkJson;\n                            currentDatabase.demonstratingProofOfPossessionConfiguration =\n                              currentDb.demonstratingProofOfPossessionConfiguration;\n                            currentDatabase.demonstratingProofOfPossessionNonce =\n                              currentDb.demonstratingProofOfPossessionNonce;\n                          } else if (currentDb.resource) {\n                            throw new Error(\n                              'A resource refresh must select exactly its own resource.',\n                            );\n                          } else {\n                            currentDatabase = currentDb;\n                            currentDatabase.requestedScope =\n                              form.get('scope') ?? currentDb.tokens.scope;\n                          }\n                          headers = await generateDpopAsync(\n                            originalRequest,\n                            currentDatabase,\n                            url,\n                            claimsExtras,\n                          );\n                          newBody = newBody.replace(\n                            keyRefreshToken,\n                            encodeURIComponent(currentDb.tokens.refresh_token as string),\n                          );\n                          break;\n                        }\n                        const keyAccessToken = encodeURIComponent(\n                          `${TOKEN.ACCESS_TOKEN}_${currentDb.configurationName}`,\n                        );\n                        if (\n                          new URLSearchParams(actualBody).get('token') ===\n                          decodeURIComponent(keyAccessToken)\n                        ) {\n                          headers = await generateDpopAsync(\n                            originalRequest,\n                            currentDb,\n                            url,\n                            claimsExtras,\n                          );\n                          newBody = newBody.replace(\n                            keyAccessToken,\n                            encodeURIComponent(currentDb.tokens.access_token),\n                          );\n                          currentDatabase = currentDb;\n                          break;\n                        }\n                      }\n                    }\n                    if (!currentDatabase)\n                      throw new Error(\n                        'The token placeholder does not identify an available grant.',\n                      );\n                    delete headers[RESOURCE_TOKEN_REQUEST_HEADER];\n                    const generation = currentDatabase.generation;\n                    const grant = currentDatabase.refreshGrant ?? currentDatabase;\n                    const grantGeneration = grant.generation;\n                    if (\n                      currentDatabase.resource &&\n                      url !==\n                        normalizeUrl(currentDatabase.oidcServerConfiguration!.tokenEndpoint) &&\n                      url !==\n                        normalizeUrl(currentDatabase.oidcServerConfiguration!.revocationEndpoint)\n                    ) {\n                      throw new Error(\n                        'Resource tokens may only be sent to their exact token endpoint.',\n                      );\n                    }\n\n                    const fetchPromise = fetch(originalRequest, {\n                      body: newBody,\n                      method: clonedRequest.method,\n                      headers,\n                      mode: clonedRequest.mode,\n                      cache: clonedRequest.cache,\n                      redirect: clonedRequest.redirect,\n                      referrer: clonedRequest.referrer,\n                      credentials: clonedRequest.credentials,\n                      integrity: clonedRequest.integrity,\n                    });\n\n                    // Forward revocation requests without modifying the response body\n                    if (\n                      currentDatabase?.oidcServerConfiguration?.revocationEndpoint &&\n                      url.startsWith(\n                        normalizeUrl(currentDatabase.oidcServerConfiguration.revocationEndpoint),\n                      )\n                    ) {\n                      const resp = await fetchPromise;\n                      const txt = await resp.text();\n                      resolve(new Response(txt, resp));\n                      return;\n                    }\n\n                    // Hide real token values in the response\n                    const hidden = await fetchPromise.then(\n                      hideTokens(\n                        currentDatabase,\n                        () =>\n                          currentDatabase!.generation === generation &&\n                          grant.generation === grantGeneration,\n                        () => grant.generation === grantGeneration,\n                      ),\n                    );\n                    resolve(hidden);\n                    return;\n                  }\n\n                  // Handle authorization code exchange: replace the PKCE code_verifier placeholder\n                  const isCodeVerifier = actualBody.includes('code_verifier=');\n                  if (isCodeVerifier) {\n                    const currentLoginCallbackConfigurationName =\n                      extractConfigurationNameFromCodeVerifier(actualBody);\n                    if (\n                      !currentLoginCallbackConfigurationName ||\n                      currentLoginCallbackConfigurationName === ''\n                    ) {\n                      throw new Error('No configuration name found in code_verifier');\n                    }\n                    currentDatabase =\n                      getTokenContexts(database).find(\n                        context =>\n                          context.configurationName === currentLoginCallbackConfigurationName,\n                      ) ?? null;\n                    if (!currentDatabase)\n                      throw new Error(\n                        'No available authorization transaction matches the code verifier.',\n                      );\n                    if (currentDatabase.resource) {\n                      const selected = new URLSearchParams(actualBody).getAll('resource');\n                      if (selected.length !== 1 || selected[0] !== currentDatabase.resource)\n                        throw new Error('Authorization resource mismatch.');\n                      if (\n                        url !== normalizeUrl(currentDatabase.oidcServerConfiguration!.tokenEndpoint)\n                      )\n                        throw new Error('Invalid resource token endpoint.');\n                      currentDatabase.refreshGrant = currentDatabase;\n                    }\n                    currentDatabase.requestedScope =\n                      currentDatabase.authorizationScope ??\n                      (currentDatabase.resource\n                        ? getResourceConfiguration(\n                            currentDatabase.oidcConfiguration?.resources,\n                            currentDatabase.resource,\n                          ).scope\n                        : currentDatabase.oidcConfiguration?.scope);\n                    const generation = currentDatabase.generation;\n                    let newBody = actualBody;\n                    const codeVerifier = currentDatabase.codeVerifier;\n                    if (codeVerifier != null) {\n                      newBody = replaceCodeVerifier(newBody, codeVerifier);\n                    }\n\n                    const headersExtras = await generateDpopAsync(\n                      originalRequest,\n                      currentDatabase,\n                      url,\n                    );\n                    const resp = await fetch(originalRequest, {\n                      body: newBody,\n                      method: clonedRequest.method,\n                      headers: headersExtras,\n                      mode: clonedRequest.mode,\n                      cache: clonedRequest.cache,\n                      redirect: clonedRequest.redirect,\n                      referrer: clonedRequest.referrer,\n                      credentials: clonedRequest.credentials,\n                      integrity: clonedRequest.integrity,\n                    });\n                    const hidden = await hideTokens(\n                      currentDatabase,\n                      () => currentDatabase!.generation === generation,\n                      undefined,\n                      true,\n                    )(resp);\n                    resolve(hidden);\n                    return;\n                  }\n\n                  // Pass through all other POST requests unchanged\n                  const normalResp = await fetch(originalRequest, {\n                    body: actualBody,\n                    method: clonedRequest.method,\n                    headers: serializeHeaders(originalRequest.headers),\n                    mode: clonedRequest.mode,\n                    cache: clonedRequest.cache,\n                    redirect: clonedRequest.redirect,\n                    referrer: clonedRequest.referrer,\n                    credentials: clonedRequest.credentials,\n                    integrity: clonedRequest.integrity,\n                  });\n                  resolve(normalResp);\n                } catch (err) {\n                  reject(err);\n                }\n              })\n              .catch(reject);\n          });\n\n          return await responsePromise;\n        }\n\n        // Default: pass through the request unchanged\n        return fetch(originalRequest);\n      } catch (err) {\n        // Surface unexpected errors as a 500 rather than silently hanging\n        console.error('[OidcServiceWorker] handleFetch error:', err);\n        return new Response('Service Worker Error', { status: 500 });\n      }\n    })(),\n  );\n};\n\nconst handleMessageAsync = async (event: ExtendableMessageEvent): Promise<void> => {\n  const port = event.ports[0];\n  const data = event.data as MessageEventData;\n\n  if (event.data?.type === 'SKIP_WAITING') {\n    await _self.skipWaiting();\n    port?.postMessage?.({});\n    return;\n  } else if (event.data.type === 'claim') {\n    _self.clients.claim().then(() => port.postMessage({}));\n    return;\n  }\n\n  const configurationName = data.configurationName.split('#')[0];\n  const resource = getContextResource(data.configurationName);\n\n  if (trustedDomains == null) {\n    trustedDomains = {};\n  }\n\n  const trustedDomain = trustedDomains[configurationName];\n  const allowMultiTabLogin = Array.isArray(trustedDomain)\n    ? false\n    : trustedDomain.allowMultiTabLogin;\n\n  const tabId = allowMultiTabLogin ? data.tabId : 'default';\n  const configurationNameWithTabId = `${configurationName}#tabId=${tabId}`;\n\n  let currentDatabase = database[configurationNameWithTabId];\n  if (!currentDatabase) {\n    const showAccessToken = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;\n    const doNotSetAccessTokenToNavigateRequests = Array.isArray(trustedDomain)\n      ? true\n      : trustedDomain.setAccessTokenToNavigateRequests;\n    const convertAllRequestsToCorsExceptNavigate = Array.isArray(trustedDomain)\n      ? false\n      : trustedDomain.convertAllRequestsToCorsExceptNavigate;\n    const bypassAllNonOidcRequests = Array.isArray(trustedDomain)\n      ? false\n      : trustedDomain.bypassAllNonOidcRequests;\n\n    database[configurationNameWithTabId] = {\n      tokens: null,\n      state: null,\n      codeVerifier: null,\n      oidcServerConfiguration: null,\n      oidcConfiguration: undefined,\n      nonce: null,\n      status: null,\n      configurationName: configurationNameWithTabId,\n      hideAccessToken: !showAccessToken,\n      setAccessTokenToNavigateRequests: doNotSetAccessTokenToNavigateRequests ?? true,\n      convertAllRequestsToCorsExceptNavigate: convertAllRequestsToCorsExceptNavigate ?? false,\n      demonstratingProofOfPossessionNonce: null,\n      demonstratingProofOfPossessionJwkJson: null,\n      demonstratingProofOfPossessionConfiguration: null,\n      demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,\n      allowMultiTabLogin: allowMultiTabLogin ?? false,\n      bypassAllNonOidcRequests: bypassAllNonOidcRequests ?? false,\n    };\n    currentDatabase = database[configurationNameWithTabId];\n\n    if (!trustedDomains[configurationName]) {\n      trustedDomains[configurationName] = [];\n    }\n  }\n  if (resource !== undefined) {\n    try {\n      currentDatabase = getOrCreateResourceContext(currentDatabase, resource);\n    } catch (error) {\n      console.error('[OidcServiceWorker] Invalid resource context:', error);\n      port.postMessage({ configurationName, error: 'The resource is not registered.' });\n      return;\n    }\n  }\n\n  switch (data.type) {\n    case 'clear':\n      currentDatabase.generation = (currentDatabase.generation ?? 0) + 1;\n      for (const entry of Object.values(currentDatabase.resourceEntries ?? {})) {\n        entry.generation = (entry.generation ?? 0) + 1;\n      }\n      currentDatabase.resourceEntries = undefined;\n      currentDatabase.tokens = null;\n      currentDatabase.state = null;\n      currentDatabase.codeVerifier = null;\n      currentDatabase.nonce = null;\n      currentDatabase.demonstratingProofOfPossessionNonce = null;\n      currentDatabase.demonstratingProofOfPossessionJwkJson = null;\n      currentDatabase.demonstratingProofOfPossessionConfiguration = null;\n      currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = false;\n      currentDatabase.authorizationScope = undefined;\n      currentDatabase.requestedScope = undefined;\n      currentDatabase.demonstratingProofOfPossessionApiNonce = null;\n      currentDatabase.status = data.data.status;\n      port.postMessage({ configurationName });\n      return;\n\n    case 'init': {\n      const oidcServerConfiguration = data.data.oidcServerConfiguration;\n      const domains = getDomains(trustedDomain, 'oidc');\n\n      if (!domains.some(domain => domain === acceptAnyDomainToken)) {\n        [\n          oidcServerConfiguration.tokenEndpoint,\n          oidcServerConfiguration.revocationEndpoint,\n          oidcServerConfiguration.userInfoEndpoint,\n          oidcServerConfiguration.issuer,\n        ].forEach(u => {\n          checkDomain(domains, u);\n        });\n      }\n\n      currentDatabase.oidcServerConfiguration = oidcServerConfiguration;\n      currentDatabase.oidcConfiguration = data.data.oidcConfiguration;\n      if (data.data.where === 'loginAsync')\n        currentDatabase.authorizationScope = currentDatabase.oidcConfiguration.scope;\n      if (resource !== undefined)\n        getResourceConfiguration(currentDatabase.oidcConfiguration.resources, resource);\n\n      if (currentDatabase.demonstratingProofOfPossessionConfiguration == null) {\n        const parent = currentDatabase.parentConfiguration;\n        if (parent?.demonstratingProofOfPossessionJwkJson) {\n          currentDatabase.demonstratingProofOfPossessionJwkJson =\n            parent.demonstratingProofOfPossessionJwkJson;\n          currentDatabase.demonstratingProofOfPossessionConfiguration =\n            parent.demonstratingProofOfPossessionConfiguration;\n        }\n        const demonstratingProofOfPossessionConfiguration = getDpopConfiguration(trustedDomain);\n        if (\n          demonstratingProofOfPossessionConfiguration != null &&\n          currentDatabase.demonstratingProofOfPossessionConfiguration == null\n        ) {\n          if (currentDatabase.oidcConfiguration.demonstrating_proof_of_possession) {\n            console.warn(\n              'In service worker, demonstrating_proof_of_possession must be configured from trustedDomains file',\n            );\n          }\n          currentDatabase.demonstratingProofOfPossessionConfiguration =\n            demonstratingProofOfPossessionConfiguration;\n          currentDatabase.demonstratingProofOfPossessionJwkJson = await generateJwkAsync(self)(\n            demonstratingProofOfPossessionConfiguration.generateKeyAlgorithm,\n          );\n          currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent =\n            getDpopOnlyWhenDpopHeaderPresent(trustedDomain) ?? false;\n        }\n      }\n\n      if (!currentDatabase.tokens) {\n        port.postMessage({\n          tokens: null,\n          status: currentDatabase.status,\n          configurationName,\n          version,\n          resourceTokenManagement: true,\n          resourceContexts: Object.keys(currentDatabase.resourceEntries ?? {}),\n        });\n      } else {\n        const tokens = {\n          ...currentDatabase.tokens,\n          idTokenPayload: currentDatabase.tokens.idTokenPayload\n            ? { ...currentDatabase.tokens.idTokenPayload }\n            : undefined,\n        };\n        if (currentDatabase.hideAccessToken) {\n          tokens.access_token = `${TOKEN.ACCESS_TOKEN}_${currentDatabase.configurationName}`;\n        }\n        if (tokens.refresh_token) {\n          tokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${(currentDatabase.refreshGrant ?? currentDatabase).configurationName}`;\n        }\n        if (tokens?.idTokenPayload?.nonce && currentDatabase.nonce != null) {\n          tokens.idTokenPayload.nonce = `${TOKEN.NONCE_TOKEN}_${currentDatabase.configurationName}`;\n        }\n        port.postMessage({\n          tokens,\n          status: currentDatabase.status,\n          configurationName,\n          version,\n          resourceTokenManagement: true,\n          resourceContexts: Object.keys(currentDatabase.resourceEntries ?? {}),\n        });\n      }\n      return;\n    }\n\n    case 'setDemonstratingProofOfPossessionNonce': {\n      currentDatabase.demonstratingProofOfPossessionNonce =\n        data.data.demonstratingProofOfPossessionNonce;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getDemonstratingProofOfPossessionNonce': {\n      const demonstratingProofOfPossessionNonce =\n        currentDatabase.demonstratingProofOfPossessionNonce;\n      port.postMessage({\n        configurationName,\n        demonstratingProofOfPossessionNonce,\n      });\n      return;\n    }\n\n    case 'setState': {\n      currentDatabase.state = data.data.state;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getState': {\n      const state = currentDatabase.state;\n      port.postMessage({ configurationName, state });\n      return;\n    }\n\n    case 'setCodeVerifier': {\n      currentDatabase.codeVerifier = data.data.codeVerifier;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getCodeVerifier': {\n      const codeVerifier =\n        currentDatabase.codeVerifier != null\n          ? `${TOKEN.CODE_VERIFIER}_${currentDatabase.configurationName}`\n          : null;\n      port.postMessage({\n        configurationName,\n        codeVerifier,\n      });\n      return;\n    }\n\n    case 'setSessionState': {\n      currentDatabase.sessionState = data.data.sessionState;\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getSessionState': {\n      const sessionState = currentDatabase.sessionState;\n      port.postMessage({ configurationName, sessionState });\n      return;\n    }\n\n    case 'setNonce': {\n      const nonce = data.data.nonce;\n      if (nonce) {\n        if (\n          !currentDatabase.resource &&\n          currentDatabase.nonce &&\n          nonce.nonce !== currentDatabase.nonce.nonce\n        ) {\n          currentDatabase.generation = (currentDatabase.generation ?? 0) + 1;\n          for (const entry of Object.values(currentDatabase.resourceEntries ?? {})) {\n            entry.generation = (entry.generation ?? 0) + 1;\n          }\n          currentDatabase.resourceEntries = undefined;\n        }\n        currentDatabase.nonce = nonce;\n      }\n      port.postMessage({ configurationName });\n      return;\n    }\n\n    case 'getNonce': {\n      const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabase.configurationName}`;\n      const nonce = currentDatabase.nonce ? keyNonce : null;\n      port.postMessage({ configurationName, nonce });\n      return;\n    }\n\n    default:\n      return;\n  }\n};\n\nconst handleMessage = async (event: ExtendableMessageEvent): Promise<void> => {\n  try {\n    await handleMessageAsync(event);\n  } catch (error) {\n    console.error('[OidcServiceWorker] Message failed:', error);\n    event.ports?.[0]?.postMessage({\n      configurationName: event.data?.configurationName,\n      error: error instanceof Error ? error.message : 'The worker could not process this message.',\n    });\n  }\n};\n\n// Event listeners\n_self.addEventListener('fetch', handleFetch);\n_self.addEventListener('message', handleMessage);\n"],"mappings":";;CAAA,IAAM,iBAAiB;CAUvB,IAAM,QAAmB;EACvB,eAAe;EACf,cAAc;EACd,aAAa;EACb,eAAe;CACjB;CAQA,IAAM,iBAAqC;EACzC,kCAAkC;EAClC,sBAAsB;EACtB,kBAAkB;CACpB;;;CCnBA,SAAS,WAAW,KAAa;EAC/B,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;CACrC;CAMA,SAAS,eAAe,KAAK;EAC3B,OAAO,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;CAC5E;CAOA,SAAS,mBAAmB,KAAK;EAK/B,OAJe,mBAAmB,GAI3B,CAAA,CAAO,QAAQ,mBAAmB,SAAU,OAAe,IAAI;GACpE,OAAO,OAAO,aAAa,SAAS,IAAI,EAAE,CAAC;EAC7C,CAAC;CACH;CAMA,IAAa,oBAAoB,UAAsB;EACrD,IAAI,MAAM;EAEV,MAAM,QAAQ,SAAU,MAAM;GAC5B,OAAO,OAAO,aAAa,IAAI;EACjC,CAAC;EACD,OAAO,eAAe,GAAG;CAC3B;CAMA,SAAS,eAAe,KAAK;EAC3B,OAAO,eAAe,mBAAmB,GAAG,CAAC;CAC/C;CAEA,IAAa,qDACX;EACE,oBAAoB;GAClB,MAAM;GACN,YAAY;GACZ,MAAM,EAAE,MAAM,QAAQ;EACxB;EACA,eAAe;GAAE,MAAM;GAAS,MAAM,EAAE,MAAM,UAAU;EAAE;EAC1D,sBAAsB;GACpB,MAAM;GACN,YAAY;EACd;EACA,iBAAiB,EAAE,MAAM,UAAU;EACnC,oBAAoB;CACtB;CAGF,IAAM,QACH,MACD,OACE,KACA,SACA,QACA,6CACA,gBAAgB,eACb;EAGH,MAAM,OAAO,OAAO,CAAC,GAAG,GAAG;EAG3B,QAAQ,MAAM;EACd,QAAQ,MAAM,4CAA4C;EAC1D,QAAQ,QAAQ,KAAhB;GACE,KAAK;IAEH,QAAQ,MAAM;KAAE,KAAK,IAAI;KAAK,KAAK,IAAI;KAAK,GAAG,IAAI;KAAG,GAAG,IAAI;IAAE;IAE/D;GACF,KAAK;IACH,QAAQ,MAAM;KAAE,KAAK,IAAI;KAAK,GAAG,IAAI;KAAG,GAAG,IAAI;KAAG,KAAK,QAAQ;IAAI;IACnE;GACF,SACE,MAAM,IAAI,MAAM,0CAA0C;EAC9D;EAEA,MAAM,MAAM;GAGV,WAAW,eAAe,KAAK,UAAU,OAAO,CAAC;GAGjD,SAAS,eAAe,KAAK,UAAU,MAAM,CAAC;EAChD;EAGA,MAAM,UAAU,4CAA4C;EAU5D,MAAM,aAAa,MAAM,EAAE,OAAO,OAAO,UAAU,OAAO,KAAK,SAAS,MAAY,CAJhE,MAIgE,CAAU;EAG9F,MAAM,OAAO,WAAW,GAAG,IAAI,UAAU,GAAG,IAAI,SAAS;EAIzD,MAAM,gBAAgB,4CAA4C;EAElE,MAAM,YAAY,MAAM,EAAE,OAAO,OAAO,KAAK,eAAe,YAAY,IAAI;EAI5E,IAAI,YAAY,iBAAiB,IAAI,WAAW,SAAS,CAAC;EAG1D,OAAO,GAAG,IAAI,UAAU,GAAG,IAAI,QAAQ,GAAG,IAAI;CAChD;CAEF,IAAa,MAAM,EAAE,KAAK;CAG1B,IAAM,YACH,MAAW,OAAO,yBAAiE;EAClF,MAAM,UAAU;EAIhB,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,YAAY,SAAS,MAAY,CAF/C,QAAQ,QAEuC,CAAU;EAG7E,OAAO,MAAM,EAAE,OAAO,OAAO,UAAU,OAAO,IAAI,UAAU;CAC9D;CAMF,IAAM,UAAS,QAAO;EACpB,MAAM,OAAO,OAAO,OAAO,CAAC,GAAG,GAAG;EAClC,OAAO,KAAK;EACZ,KAAK,UAAU,CAAC,QAAQ;EACxB,OAAO;CACT;CAEA,IAAM,KAAK;EACT;EACA;CACF;CAEA,IAAM,cAAc,MAAW,OAAO,KAAK,oBAAyC;EAClF,IAAI;EAEJ,QAAQ,IAAI,KAAZ;GACE,KAAK;IACH,YAAY,2DACT,QAAQ,OAAO,IAAI,GAAG,CAAC,CACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CACnB,QAAQ,KAAK,IAAI,CAAC;IACrB;GACF,KAAK;IACH,YAAY,4CAAgC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;IAClF;GACF,SACE,MAAM,IAAI,MAAM,qCAAqC;EACzD;EAGA,MAAM,OAAO,MAAM,EAAE,OAAO,OAAO,OAAO,iBAAiB,WAAW,SAAS,CAAC;EAChF,OAAO,iBAAiB,IAAI,WAAW,IAAI,CAAC;CAC9C;CAEA,IAAa,MAAM,EAAE,WAAW;CAEhC,IAAa,oBACV,MAAW,OAAO,yBAAiE;EAMlF,OAAO,MAJW,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB;CAKvD;CAEF,IAAa,kDACV,OACA,gDACD,OAAO,KAAU,SAAS,QAAQ,KAAa,eAAe,CAAC,MAAM;EACnE,MAAM,SAAS,IAAI,IAAI,KAAK,EAAE,UAAU,IAAI;EAC5C,OAAO,SAAS;EAChB,OAAO,OAAO;EACd,MAAM,SAAS;GAEb,KAAK,KAAK,EAAE,OAAO,WAAW,CAAC;GAC/B,KAAK;GACL,KAAK,OAAO;GACZ,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;GACjC,GAAG;EACL;EAEA,MAAM,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,CACjC,KACA,4CAA4C,eAC9C;EASA,OAAO,MAPW,IAAI,KAAK,CAAC,CAAC,CAC3B,KACA,EAAO,IAAI,GACX,QACA,2CACF;CAGF;;;CCzOF,SAAgB,eAAe,KAAa;EAC1C,MAAM,MAAM,IAAI,YAAY,IAAI,MAAM;EACtC,MAAM,UAAU,IAAI,WAAW,GAAG;EAElC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,QAAQ,KAAK,IAAI,WAAW,CAAC;EAE/B,OAAO;CACT;CAEA,SAAgB,oCAAoC,MAA+B;EACjF,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,OAAO,OAAO,OAAO,WAAW,eAAe,IAAI,CAAC,CAAC,CAAC,MACpD,WAAU;IACR,OAAO,QAAQ,iBAAiB,IAAI,WAAW,MAAM,CAAC,CAAC;GACzD,IACA,UAAS,OAAO,KAAK,CACvB;EACF,CAAC;CACH;;;CClBA,IAAM,UAAU,kBAAqD;EACnE,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;EAET,OAAO,cAAc,kCAAkC;CACzD;CAEA,IAAa,wBAAwB,kBAA4C;EAC/E,IAAI,CAAC,OAAO,aAAa,GACvB,OAAO;EAGT,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;EAGT,OACE,cAAc,+CACd;CAEJ;CAEA,IAAa,oCAAoC,kBAA4C;EAC3F,IAAI,CAAC,OAAO,aAAa,GACvB,OAAO;EAGT,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;EAGT,OAAO,cAAc,2DAA2D;CAClF;;;;CC1BA,IAAa,gCAAgC;;CAG7C,IAAa,0BAA0B,mBAA2B,aAChE,GAAG,kBAAkB,YAAY,mBAAmB,QAAQ;;CAG9D,IAAa,sBAAsB,sBAAkD;EAEnF,MAAM,QAAQ,kBAAkB,QAAQ,YAAM;EAC9C,OAAO,QAAQ,IAAI,KAAA,IAAY,mBAAmB,kBAAkB,MAAM,QAAQ,EAAa,CAAC;CAClG;;CAGA,IAAa,8BAA8B,aAA2B;EACpE,IACE,OAAO,aAAa,YACpB,CAAC,sBAAsB,KAAK,QAAQ,KACpC,SAAS,SAAS,GAAG,KACrB,KAAK,KAAK,QAAQ,GAElB,MAAM,IAAI,MAAM,sEAAsE;EAExF,IAAI,IAAI,QAAQ;CAClB;CAEA,IAAM,aAAa,UAAuB;EACxC,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,IACG,IAAI,aAAa,YAAY,IAAI,aAAa,WAC/C,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,WAAW,KAAK,IAAI,QAAQ,GAE5B,MAAM,IAAI,MACR,8FACF;EAEF,OAAO;CACT;CAEA,IAAM,mBAAmB,UAAuB;EAC9C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6CAA6C;EAChF,OAAO;CACT;;CAGA,IAAa,2BACX,gBACA,gBACY;EACZ,MAAM,SAAS,UAAU,WAAW,CAAC,CAAC;EACtC,OACE,gBAAgB,MAAK,kBACnB,cAAc,mBAAmB,MAAK,UAAS,gBAAgB,KAAK,CAAC,CAAC,WAAW,MAAM,CACzF,KAAK;CAET;;CAGA,IAAa,wBACX,eACA,gBACY;EACZ,MAAM,MAAM,UAAU,WAAW;EACjC,OAAO,cAAc,mBAAmB,MAAK,UAAS;GACpD,MAAM,SAAS,gBAAgB,KAAK;GACpC,MAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;GAC/C,OACE,IAAI,WAAW,OAAO,WACrB,SAAS,MAAM,IAAI,aAAa,QAAQ,IAAI,SAAS,WAAW,GAAG,KAAK,EAAE;EAE/E,CAAC;CACH;;CAGA,IAAa,4BACX,gBACA,aAC8B;EAC9B,2BAA2B,QAAQ;EACnC,MAAM,UACJ,gBAAgB,QAAO,kBAAiB,cAAc,aAAa,QAAQ,KAAK,CAAC;EACnF,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,CAAC,mBAAmB,WAAW,GACnE,MAAM,IAAI,MACR,+EACF;EAEF,KAAK,MAAM,UAAU,QAAQ,EAAE,CAAC,oBAC9B,qBAAqB,QAAQ,IAAI,MAAM;EAEzC,OAAO,QAAQ;CACjB;;;CCpGA,IAAa,0BAA0B,aACrC,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,mBAAgD,CACtF,CAAC,KAAK,aAAa,GACnB,GAAG,OAAO,QAAQ,cAAc,mBAAmB,CAAC,CAAC,CACvD,CAAC;CAEH,IAAa,oBAAoB,aAC/B,uBAAuB,QAAQ,CAAC,CAAC,KAAK,GAAG,mBAAmB,aAAa;CAE3E,IAAa,8BACX,eACA,aACe;EACf,yBAAyB,cAAc,mBAAmB,WAAW,QAAQ;EAC7E,cAAc,oBAAoB,CAAC;EACnC,MAAM,OAAO,uBAAuB,cAAc,mBAAmB,QAAQ;EAC7E,cAAc,gBAAgB,UAAU;GACtC,GAAG;GACH,mBAAmB;GACnB;GACA,qBAAqB;GACrB,iBAAiB,KAAA;GACjB,oBAAoB,KAAA;GACpB,gBAAgB,KAAA;GAChB,wCAAwC;GACxC,cAAc,KAAA;GACd,QAAQ;GACR,OAAO;GACP,cAAc;GACd,OAAO;GACP,QAAQ;GACR,iBAAiB;GACjB,YAAY;EACd;EACA,OAAO,cAAc,gBAAgB;CACvC;;;CCtCA,SAAgB,aAAa,KAAa;EACxC,IAAI;GACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS;EAC/B,SAAS,OAAO;GACd,QAAQ,MAAM,4BAA4B,OAAO,KAAK;GACtD,OAAO;EACT;CACF;;;CCGA,SAAgB,YAAY,SAAmB,UAAkB;EAC/D,IAAI,CAAC,UACH;EAcF,IAAI,CAXW,QAAQ,MAAK,WAAU;GACpC,IAAI;GAEJ,IAAI,OAAO,WAAW,UACpB,WAAW,IAAI,OAAO,IAAI,QAAQ;QAElC,WAAW;GAGb,OAAO,SAAS,OAAO,QAAQ;EACjC,CACK,GACH,MAAM,IAAI,MACR,YAAY,WAAW,2CAA2C,cACpE;CAEJ;CAEA,IAAa,cACX,eACA,SACG;EACH,IAAI,MAAM,QAAQ,aAAa,GAC7B,OAAO;EAGT,OAAO,cAAc,GAAG,KAAK,aAAa,cAAc,WAAW,CAAC;CACtE;CAEA,IAAa,4BACX,UACA,KACA,mBACG;EACH,IAAI,IAAI,SAAA,mCAAkC,GACxC,OAAO;EAET,MAAM,YAAY,CAAC;EACnB,KAAK,MAAM,CAAC,KAAK,oBAAoB,uBAAuB,QAAQ,GAAG;GACrE,MAAM,0BAA0B,gBAAgB;GAChD,MAAM,YAAY,gBAAgB,mBAAmB;GACrD,IAAI,gBAAgB,UACd;QAAA,CAAC,qBAAqB,yBAAyB,WAAW,gBAAgB,QAAQ,GAAG,GAAG,GAC1F;GAAA,OACG,IACL,WAAW,WACV,CAAC,yBAAyB,oBACzB,QAAQ,aAAa,wBAAwB,gBAAgB,MAC/D,wBAAwB,WAAW,GAAG,GAEtC;GAGF,IAAI,CAAC,yBACH;GAGF,IACE,wBAAwB,iBACxB,QAAQ,aAAa,wBAAwB,aAAa,GAE1D;GAEF,IACE,wBAAwB,sBACxB,QAAQ,aAAa,wBAAwB,kBAAkB,GAE/D;GAIF,MAAM,UAAU,WAFM,kBAAkB,OAAO,CAAC,IAAI,eAAe,IAAI,MAAM,GAAG,CAAC,CAAC,KAExC,aAAa;GACvD,MAAM,sBAAsB,wBAAwB,mBAChD,CAAC,aAAa,wBAAwB,gBAAgB,GAAG,GAAG,OAAO,IACnE,CAAC,GAAG,OAAO;GAEf,IAAI,iBAAiB;GACrB,IAAI,oBAAoB,MAAK,MAAK,MAAA,GAA0B,GAC1D,iBAAiB;QAEjB,KAAK,IAAI,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;IACnD,IAAI,SAAS,oBAAoB;IAEjC,IAAI,OAAO,WAAW,UACpB,SAAS,IAAI,OAAO,IAAI,QAAQ;IAGlC,IAAI,OAAO,OAAO,GAAG,GAAG;KACtB,iBAAiB;KACjB;IACF;GACF;GAGF,IAAI,gBACE;QAAA,gBAAgB,QAClB,UAAU,KAAK,eAAe;GAAA;EAGpC;EACA,OAAO;CACT;;;CCpHA,SAAS,iBAAiB,SAA0C;EAClE,MAAM,aAAqC,CAAC;EAC5C,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG;GAChC,MAAM,QAAQ,QAAQ,IAAI,GAAG;GAC7B,IAAI,UAAU,MACZ,WAAW,OAAO;EAEtB;EACA,OAAO;CACT;;;CCTA,IAAM,uBAAuB;EAAC;EAAS;EAAQ;EAAS;EAAY;EAAU;CAAQ;;;;;;CAOtF,IAAa,2BAA2B,aAAqB,SAA0B;EACrF,OAAO,qBAAqB,SAAS,WAAW,KAAK,SAAS;CAChE;;;CCTA,IAAM,SAAS,OAAe,IAAI,SAAQ,YAAW,WAAW,SAAS,EAAE,CAAC;;;CCY5E,IAAa,YAAY,YAAoB;EAC3C,OAAO,KAAK,MAAM,iBAAiB,QAAQ,WAAW,MAAM,GAAG,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAC;CACzF;CACA,SAAS,iBAAiB,KAAa;EACrC,OAAO,mBACL,MAAM,UAAU,IACb,KAAK,KAAK,GAAG,IAAG,MAAK,OAAO,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,EAAA,CAAG,MAAM,EAAE,CAAC,CAAC,CAC3E,KAAK,EAAE,CACZ;CACF;CAEA,SAAS,gBAAgB,2CAAmD,WAAmB;EAC7F,MAAM,yCAAwB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;EACrD,OAAO,KAAK,MAAM,YAAY,4CAA4C,qBAAqB;CACjG;CAEA,SAAS,cAAc,QAAuB;EAC5C,IAAI,CAAC,QACH,OAAO;EAET,OAAO,gBAAgB,GAAG,OAAO,SAAS,IAAI;CAChD;CAEA,IAAM,uBAAuB,UAAmB;EAC9C,IAAI;GACF,IAAI,CAAC,OACH,OAAO;GAET,MAAM,QAAQ,MAAM,MAAM,GAAG;GAC7B,OAAO,MAAM,WAAW,IAAI,SAAS,MAAM,EAAE,IAAI;EACnD,SAAS,GAAG;GACV,QAAQ,KAAK,CAAC;EAChB;EACA,OAAO;CACT;CAIA,IAAM,qBACJ,QACA,OACA,4BACyC;EACzC,IAAI,OAAO,gBAAgB;GACzB,MAAM,iBAAiB,OAAO;GAE9B,IAAI,kBAAkB,wBAAwB,WAAW,eAAe,KACtE,OAAO;IACL,SAAS;IACT,QAAQ,0DAA0D,wBAAwB,OAAO,+BAA+B,eAAe;GACjJ;GAOF,MAAM,yCAAwB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;GACrD,IAAI,kBAAkB,eAAe,OAAO,eAAe,MAAM,uBAC/D,OAAO;IACL,SAAS;IACT,QAAQ,yCAAyC,eAAe,IAAI,6BAA6B;GACnG;GAGF,MAAM,kBAAkB;GACxB,IACE,kBACA,eAAe,OACf,eAAe,MAAM,kBAAkB,uBAEvC,OAAO;IACL,SAAS;IACT,QAAQ,2EAA2E,eAAe,MAAM,gBAAgB,6BAA6B;GACvJ;GAGF,IAAI,kBAAkB,SAAS,eAAe,SAAS,eAAe,UAAU,OAC9E,OAAO;IACL,SAAS;IACT,QAAQ,gCAAgC,MAAM,8BAA8B,eAAe;GAC7F;EAEJ;EACA,OAAO;GAAE,SAAS;GAAM,QAAQ;EAAG;CACrC;CAEA,SAAS,iBACP,QACA,oBACA,iBACA;EACA,IAAI,CAAC,OAAO,WAAW;GACrB,IAAI,sBAAsB,mBAAmB,KAC3C,OAAO,mBAAmB;QACrB,IAAI,mBAAmB,gBAAgB,KAC5C,OAAO,gBAAgB;QAGvB,wBAD8B,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;EAGzD,OAAO,IAAI,OAAO,OAAO,aAAa,UACpC,OAAO,SAAS,OAAO,WAAW,EAAE;EAEtC,OAAO,OAAO;CAChB;CAEA,SAAS,YACP,QACA,wBACA,mBACA,sBAAsB,OACtB;EACA,MAAM,gBAAgB,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,SAAS;EACtF,MAAM,SAAS,uBAAuB;EACtC,IACE,uBAAuB,YACvB,uBAAuB,iBAAiB,0BACxC,OAAO,iBACP,OAAO,kBAAkB,QAAQ,QAAQ,eAEzC,MAAM,IAAI,MACR,mIACF;EAEF,IAAI,CAAC,OAAO,WAEV,OAAO,6BADuB,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI;OAEhD,IAAI,OAAO,OAAO,aAAa,UACpC,OAAO,YAAY,SAAS,OAAO,WAAW,EAAE;EAGlD,MAAM,qBAAqB,oBAAoB,OAAO,YAAY;EAClE,IACE,uBAAuB,YACvB,uBAAuB,mBAAmB,WAAW,QAErD,OAAO,UACL,uBAAuB,kBACvB,uBAAuB,QAAQ,SAC/B,uBAAuB,mBAAmB;EAE9C,MAAM,eAAe;GACnB,GAAG;GACH;EACF;EACA,IAAI,uBAAuB,iBACzB,aAAa,eAAe,GAAG,MAAM,aAAa,GAAG;EAEvD,OAAO,qBAAqB;EAG5B,MAAM,YAAY,uBAAuB;EACzC,IAAI;EACJ,IAAI,aAAa,QAAQ,cAAc,aAAa,EAAE,cAAc,SAClE,WAAW,UAAU;OAErB,WAAW,OAAO;EAEpB,OAAO,WAAW;EAElB,IAAI,kBAAkB;EACtB,IAAI,UAAU;GACZ,kBAAkB,oBAAoB,QAAQ;GAC9C,OAAO,iBAAiB,mBAAmB,OAAO,EAAE,GAAG,gBAAgB,IAAI;GAC3E,IAAI,mBAAmB,gBAAgB,SAAS,uBAAuB,SAAS,MAAM;IACpF,MAAM,WAAW,GAAG,MAAM,YAAY,GAAG,uBAAuB;IAChE,gBAAgB,QAAQ;GAC1B;GACA,aAAa,iBACX,uBAAuB,YAAY,CAAC,gBAAgB,OAAO;EAC/D;EACA,IACE,uBAAuB,YACvB,wBACC,CAAC,iBACA,OAAO,OAAO,gBAAgB,QAAQ,YACtC,CAAC,OAAO,eAAe,OACtB,uBAAuB,SACtB,OAAO,eAAe,UAAU,uBAAuB,MAAM,QAEjE,MAAM,IAAI,MACR,uFACF;EAEF,IAAI,OAAO,eACT,aAAa,gBAAgB,GAAG,MAAM,cAAc,IAAI,uBAAuB,gBAAgB,uBAAA,CAAwB;EAGzH,OAAO,YAAY,iBAAiB,QAAQ,oBAAoB,eAAe;EAE/E,MAAM,WACJ,OAAO,OAAO,cAAc,WAAW,SAAS,OAAO,YAAY,EAAE,IAAI,OAAO;EAElF,MAAM,mBACJ,mBAAmB,gBAAgB,MAAM,gBAAgB,MAAM,OAAO;EACxE,MAAM,uBACJ,sBAAsB,mBAAmB,MACrC,mBAAmB,MACnB,OAAO,YAAY;EAEzB,IAAI;EACJ,MAAM,iBAAiB,uBAAuB,WAC1C,eAAe,uBACd,uBAAuB,kBAAwC;EACpE,IAAI,mBAAmB,eAAe,sBACpC,YAAY;OACP,IAAI,mBAAmB,eAAe,kBAC3C,YAAY;OAEZ,YAAY,mBAAmB,uBAAuB,mBAAmB;EAE3E,aAAa,YAAY;EAEzB,OAAO,YAAY;EACnB,MAAM,QAAQ,uBAAuB,QAAQ,uBAAuB,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,WAAW,kBAC1B,uBAAuB,YAAY,CAAC,gBAChC;GAAE,GAAG;GAAQ,gBAAgB,KAAA;EAAU,IACvC,QACJ,OACA,uBAAuB,uBACzB;EACA,IAAI,CAAC,SACH,MAAM,MAAM,wCAAwC,QAAQ;EAE9D,IAAI,uBAAuB,UAAU;GACnC,IACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,gBACR,CAAC,OAAO,SAAS,SAAS,KAC1B,CAAC,OAAO,SAAS,OAAO,SAAS,KAChC,OAAO,iBAAiB,SACtB,OAAO,OAAO,kBAAkB,YAAY,CAAC,OAAO,gBAEvD,MAAM,IAAI,MAAM,+DAA+D;GAEjF,MAAM,WAAW,yBACf,uBAAuB,mBAAmB,WAC1C,uBAAuB,QACzB;GACA,OAAO,UACL,uBAAuB,kBACvB,SAAS,SACT,uBAAuB,mBAAmB;GAC5C,aAAa,QAAQ,OAAO;GAC5B,IACE,SAAS,SACT,CAAC,SAAS,MACP,MAAM,KAAK,CAAC,CACZ,OAAO,OAAO,CAAC,CACf,OAAM,WAAU,OAAO,SAAS,GAAA,CAAI,MAAM,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,GAEnE,MAAM,IAAI,MAAM,0DAA0D;GAE5E,MAAM,gBAAgB,uBAAuB,qBAAqB,QAAQ,gBAAgB;GAC1F,MAAM,UAAU,OAAO,gBAAgB,OAAO,WAAW,gBAAgB,OAAO;GAChF,IAAI,OAAO,kBAAkB,YAAY,YAAY,eACnD,MAAM,IAAI,MAAM,iEAAiE;GAEnF,IACG,oBAAoB,QAAQ,KAAA,KAC3B,mBAAmB,QAAQ,uBAAuB,yBAAyB,UAC5E,sBACC,SAAS,aACT,CAAC,SAAS,UAAU,MAAK,cACtB,OAAO,mBAAmB,QAAQ,WAC/B,CAAC,mBAAmB,GAAG,IACtB,mBAAmB,OAAO,CAAC,EAAA,CAC9B,SAAS,QAAQ,CACrB,GAEF,MAAM,IAAI,MAAM,8DAA8D;EAClF;EAGA,IAAI,aAAa,QAAQ,mBAAmB,aAAa,EAAE,mBAAmB,SAAS;GACrF,MAAM,eAAe,UAAU;GAE/B,uBAAuB,SAAS;IAC9B,GAAG;IACH,eAAe;GACjB;EACF,OACE,uBAAuB,SAAS;EAGlC,uBAAuB,SAAS;EAChC,IAAI,uBAAuB,UAAU;GACnC,MAAM,QAAQ,uBAAuB,gBAAgB;GACrD,MAAM,UACJ,OAAO,gBAAgB,OACvB,MAAM,QAAQ,gBAAgB,OAC9B,uBAAuB,qBAAqB,QAAQ,gBAAgB;GACtE,IAAI,OAAO,YAAY,UACrB,MAAM,IAAI,MAAM,wDAAwD;GAC1E,IAAI,UAAU,0BAA0B,OAAO,iBAAiB,MAAM,QACpE,MAAM,OAAO,gBAAgB,OAAO;GAEtC,MAAM,kBAAkB;IACtB,UAAU,uBAAuB;IACjC,QAAQ,uBAAuB,wBAAyB;IACxD,UAAU,uBAAuB,kBAAmB;IACpD,mBAAmB,uBAAuB,kBAAkB,MAAM,GAAG,CAAC,CAAC;IACvE;IACA,eAAe,MAAM,YAAY;GACnC;GACA,uBAAuB,OAAQ,kBAAkB;GACjD,aAAa,kBAAkB;EACjC;EACA,OAAO;CACT;CAEA,IAAM,oDAAoD;CAC1D,SAAS,WACP,wBACA,kBAAiC,MACjC,iBAAgC,WAChC,sBAAsB,OACtB;EACA,MAAM,oBAAoB,uBAAuB;EACjD,QAAQ,aAAuB;GAC7B,IAAI,SAAS,WAAW,KACtB,OAAO;GAET,MAAM,aAAa,IAAI,QAAQ,SAAS,OAAO;GAC/C,IACE,SAAS,QAAQ,IAAI,iDAAiD,KACtE,eAAe,GACf;IACA,uBAAuB,sCAAsC,SAAS,QAAQ,IAC5E,iDACF;IACA,IACE,uBAAuB,gBACvB,uBAAuB,iBAAiB,wBAExC,uBAAuB,aAAa,sCAClC,uBAAuB;IAE3B,WAAW,OAAO,iDAAiD;GACrE;GAEA,OAAO,SAAS,KAAK,CAAC,CAAC,MAAgB,WAAmB;IACxD,MAAM,QAAQ,uBAAuB;IACrC,IACE,uBAAuB,YACvB,SACA,eAAe,KACf,MAAM,UACN,OAAO,OAAO,kBAAkB,YAChC,OAAO,kBACN,UAAU,0BACT,OAAO,kBACL,uBAAuB,qBAAqB,QAAQ,gBAExD,MAAM,OAAO,gBAAgB,OAAO;IAEtC,IAAI,CAAC,UAAU,GACb,MAAM,IAAI,MAAM,wDAAwD;IAE1E,MAAM,eAAe,YACnB,QACA,wBACA,mBACA,mBACF;IACA,MAAM,OAAO,KAAK,UAAU,YAAY;IACxC,OAAO,IAAI,SAAS,MAAM;KACxB,QAAQ,SAAS;KACjB,YAAY,SAAS;KACrB,SAAS;IACX,CAAC;GACH,CAAC;EACH;CACF;;;CC/XA,IAAa,2BAA2B;;;;;;;CASxC,eAAsB,mBACpB,QACA,YAAY,0BACZ,iBAAA,KAC0B;EAC1B,MAAM,YAAY,KAAK,IAAI;EAC3B,OAAO,OAAO,UAAU,CAAC,cAAc,OAAO,MAAM,GAAG;GACrD,IAAI,KAAK,IAAI,IAAI,aAAa,WAC5B,OAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,YAAY;GACd,CAAC;GAEH,MAAM,MAAM,cAAc;EAC5B;EAEA,IAAI,CAAC,OAAO,QAAQ,cAClB,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;EACd,CAAC;EAGH,OAAO;CACT;;;CChCA,IAAM,qBAAqB,4BAA+D;EACxF,OAAO;GACL,wBAAwB;GACxB,wBAAwB;GACxB,wBAAwB;GACxB,wBAAwB;GACxB,wBAAwB;EAC1B,CAAC,CACE,OAAO,OAAO,CAAC,CACf,IAAI,YAAY;CACrB;CAEA,IAAM,uBAAuB,UAAoB,kBAAmC;EAClF,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,MAAK,WAAU;GAC5C,MAAM,EAAE,4BAA4B,UAAU,CAAC;GAC/C,IAAI,CAAC,yBACH,OAAO;GAGT,OAAO,kBAAkB,uBAAuB,CAAC,CAAC,MAAK,YACrD,cAAc,WAAW,OAAO,CAClC;EACF,CAAC;CACH;CAEA,IAAM,uBAAuB,QAAgB,kBAAmC;EAC9E,IAAI,OAAO,WAAW,UACpB,SAAS,IAAI,OAAO,IAAI,QAAQ;EAGlC,OAAO,OAAO,OAAO,aAAa,KAAK;CACzC;CAEA,IAAM,8BACJ,UACA,eACA,mBACY;EACZ,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,qBAAqB;GAC/D,IAAI,CAAC,gBAAgB,yBACnB,OAAO;GAIT,MAAM,UAAU,WADM,iBAAiB,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,GACpB,aAAa;GAEvD,IAAI,QAAQ,MAAK,WAAU,WAAA,GAA+B,GACxD,OAAO;GAGT,OAAO,QAAQ,MAAK,WAAU,oBAAoB,QAAQ,aAAa,CAAC;EAC1E,CAAC;CACH;CAEA,IAAM,8BACJ,UACA,eACA,mBACY;EACZ,MAAM,iBAAiB,OAAO,OAAO,QAAQ;EAE7C,IAAI,eAAe,WAAW,GAC5B,OAAO;EAGT,IAAI,CAAC,eAAe,OAAM,WAAU,OAAO,wBAAwB,GACjE,OAAO;EAGT,IAAI,CAAC,eAAe,OAAM,WAAU,OAAO,2BAA2B,IAAI,GACxE,OAAO;EAGT,OACE,CAAC,oBAAoB,UAAU,aAAa,KAC5C,CAAC,2BAA2B,UAAU,eAAe,cAAc;CAEvE;CAEA,IAAM,iCAAiC,UAAoB,QAA8B;EACvF,MAAM,gBAAgB,aAAa,GAAG;EACtC,OAAO,iBAAiB,QAAQ,CAAC,CAAC,QAAO,WAAU;GACjD,MAAM,EAAE,4BAA4B,UAAU,CAAC;GAC/C,MAAM,EAAE,eAAe,uBAAuB,2BAA2B,CAAC;GAE1E,OACG,iBAAiB,cAAc,WAAW,aAAa,aAAa,CAAC,KACrE,sBAAsB,cAAc,WAAW,aAAa,kBAAkB,CAAC;EAEpF,CAAC;CACH;;;CC/FA,SAAgB,oBAAoB,cAAsB,iBAAiC;EAEzF,OAAO,aAAa,QAAQ,8BAAO,kBAAkB,iBAAiB;CACxE;CAEA,IAAa,4CAA4C,SAAyB;EAEhF,MAAM,QAAQ,KAAK,MAAM,wEAAK;EAE9B,OAAO,QAAQ,mBAAmB,MAAM,EAAE,IAAI;CAChD;;;CCVA,IAAA,kBAAe;;;CC8Bf,IAAI,OAAO,iBAAiB,eAAe,OAAO,aAAa,iBAAiB,YAE9E,aAAa,aAAa,WAAW,EACnC,iBAAiB,SAAU,KAAa;EACtC,IAAI,QAAA,yBACF,OAAO;OAEP,MAAM,IAAI,MAAM,mCAAmC,GAAG;CAE1D,EACF,CAAC;CAGH,IAAM,QAAQ;CAKd,MAAM,cAAc,cAAc;CAElC,IAAM,KAAK,KAAK,uBAAM,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI,GAAI,CAAC,CAAC,SAAS;CAC5D,QAAQ,IAAI,+BAA+B,EAAE;CAC7C,IAAM,wBAAwB;CAC9B,IAAM,WAAqB,CAAC;;;;CAK5B,IAAM,iBAAiB,OAAO,UAAsB;EAClD,MAAM,kBAAkB,MAAM;EAC9B,MAAM,gBAAgB,gBAAgB,QAAQ,IAAI,cAAc;EAEhE,MAAM,WAAW,IAAI,SAAS,MAAM;GADrB,QAAQ;GAAK,YAAY;EACJ,CAAI;EAExC,IAAI,CAAC,eAAe;GAClB,MAAM,qBAAqB,IAAI,IAAI,gBAAgB,GAAG;GACtD,MAAM,kBAAkB,OAAO,mBAAmB,aAAa,IAAI,iBAAiB,CAAC,KAAK;GAC1F,KAAK,IAAI,IAAI,GAAG,IAAI,iBAAiB,KAAK;IACxC,MAAM,MAAM,MAAO,KAAK,MAAM,KAAK,OAAO,IAAI,GAAI,CAAC;IAEnD,OAAM,MADc,OAAO,KAAK,kBAAkB,EAAA,CACtC,IAAI,MAAM,SAAS,SAAS,MAAM,CAAC;GACjD;EACF;EACA,OAAO;CACT;;;;CAKA,eAAe,kBACb,iBACA,iBACA,KACA,eAAe,CAAC,GAChB;EACA,MAAM,gBAAgB,iBAAiB,gBAAgB,OAAO;EAC9D,IACE,iBAAiB,+CACjB,gBAAgB,0CACf,CAAC,gBAAgB,2DACf,gBAAgB,2DACf,cAAc,OAClB;GACA,MAAM,oBAAoB,gBAAgB;GAC1C,MAAM,MAAM,gBAAgB;GAC5B,MAAM,SAAS,gBAAgB;GAC/B,MAAM,gBAAgB,gBAAgB,WAClC,QAAQ,aAAa,gBAAgB,wBAAyB,aAAa,IACzE,gBAAgB,sCAChB,gBAAgB,yCAClB,KAAA;GAWJ,cAAc,OAAO,MAVF,+CAA+C,IAAI,CAAC,CAAC,iBAAiB,CAAC,CACxF,KACA,QACA,KACA;IACE,GAAG;IACH,GAAI,gBAAgB,EAAE,OAAO,cAAc,IAAI,CAAC;GAClD,CACF;GAGA,MAAM,cACJ,kBACC,CAAC,gBAAgB,WAAW,gBAAgB,sCAAsC,KAAA;GACrF,IAAI,aAAa,cAAc,QAAQ;EACzC;EACA,OAAO;CACT;;;;CAKA,IAAM,eAAe,UAA4B;;;;EAI/C,IAAI,wBAAwB,MAAM,QAAQ,aAAa,MAAM,QAAQ,IAAI,GACvE;EAGF,MAAM,gBAAgB,aAAa,MAAM,QAAQ,GAAG;EACpD,IACE,CAAC,cAAc,SAAS,qBAAqB,KAC7C,2BAA2B,UAAU,eAAe,cAAc,GAElE;EAGF,MAAM,aACH,YAA+B;GAC9B,IAAI;IACF,MAAM,kBAAkB,MAAM;IAC9B,MAAM,MAAM;IAGZ,IAAI,IAAI,SAAS,qBAAqB,GACpC,OAAO,eAAe,KAAK;IAI7B,MAAM,wCAAwC,yBAC5C,UACA,KACA,cACF;IAEA,MAAM,gBAAgB,gBAAgB,QAAQ,IAAI,eAAe;IACjE,IAAI,qBAAqB;IACzB,IAAI,MAAM;IAEV,IAAI,eAAe;KACjB,MAAM,QAAQ,cAAc,MAAM,GAAG;KACrC,qBAAqB,MAAM;KAC3B,IAAI,MAAM,EAAE,EAAE,SAAS,8CAA8C,GACnE,MAAM,MAAM,EAAE,CAAC,MAAM,8CAA8C,CAAC,CAAC;IAEzE;IAEA,MAAM,uCAAuC,uCAAuC,MAClF,MACE,IAAI,SAAS,YAAY,IACrB,EAAE,sBAAsB,MACxB,CAAC,EAAE,YAAY,EAAE,kBAAkB,SAAS,GAAG,CACvD;IACA,IAAI,IAAI,SAAS,YAAY,KAAK,CAAC,sCAAsC;KACvE,QAAQ,MACN,6EACF;KACA,OAAO,IAAI,SAAS,2DAA2D,EAC7E,QAAQ,IACV,CAAC;IACH;IAGA,IAAI,sCAAsC,QAAQ,cAAc;KAE9D,MAAM,aAAa,MAAM,mBAAmB,oCAAoC;KAChF,IAAI,YACF,OAAO;KAET,MAAM,cAAc,qCAAqC,OAAQ;KACjE,MAAM,aAAa,qCAAqC;KACxD,MAAM,mBACJ,qCAAqC,qBAAqB;KAG5D,IAAI,cAAc,gBAAgB;KAClC,IACE,gBAAgB,SAAS,cACzB,qCAAqC,wCAErC,cAAc;KAIhB,IAAI;KAGJ,IACE,gBAAgB,SAAS,cACzB,CAAC,qCAAqC,kCAEtC,UAAU,EACR,GAAG,iBAAiB,gBAAgB,OAAO,EAC7C;UAEA,IACE,mBAAmB,YAAY,MAAM,UACpC,CAAC,qCAAqC,2DACrC,qCAAqC,6CAYvC,UAAU;MACR,GAAG,MAPqB,kBACxB,iBACA,sCACA,KACA,EANA,KAAK,MAAM,oCAAoC,WAAW,EAM1D,CACF;MAGE,eAAe,QAAQ;KACzB;UAGA,UAAU;MACR,GAAG,iBAAiB,gBAAgB,OAAO;MAC3C,eAAe,GAAG,mBAAmB,GAAG;KAC1C;KAIJ,IAAI;KACJ,IAAI,gBAAgB,SAAS,YAC3B,OAAO,EACI,QACX;UAEA,OAAO;MACI;MACT,MAAM;KACR;KAGF,MAAM,aAAa,IAAI,QAAQ,iBAAiB,IAAI;KACpD,IACE,qCAAqC,aACpC,qCAAqC,eAAe,cACnD,qCAAqC,qBAAqB,eACxD,oBACF,qCAAqC,QAAQ,iBAAiB,cAChE;MACA,QAAQ,MAAM,iEAAiE;MAC/E,OAAO,IAAI,SAAS,+CAA+C,EAAE,QAAQ,IAAI,CAAC;KACpF;KACA,MAAM,WAAW,MAAM,MACrB,YACA,qCAAqC,WAAW,EAAE,UAAU,QAAQ,IAAI,KAAA,CAC1E;KACA,IACE,qCAAqC,YACrC,qCAAqC,eAAe,cACpD,qCAAqC,qBAAqB,eACxD,oBACF,SAAS,QAAQ,IAAI,YAAY,GAEjC,qCAAqC,yCACnC,SAAS,QAAQ,IAAI,YAAY;KAErC,OAAO;IACT;IAGA,IAAI,MAAM,QAAQ,WAAW,QAC3B,OAAO,MAAM,eAAe;IAI9B,MAAM,mBAAmBA,8BAAiC,UAAU,GAAG;IACvE,MAAM,iBAAiB,iBAAiB;IAExC,IAAI,iBAAiB,GAiSnB,OAAO,MAAM,IAhSe,SAAmB,SAAS,WAAW;KACjE,MAAM,gBAAgB,gBAAgB,MAAM;KAC5C,cACG,KAAK,CAAC,CACN,KAAK,OAAM,eAAc;MACxB,IAAI,kBAAqC;MACzC,IAAI;OAEF,IACE,WAAW,SAAS,MAAM,aAAa,KACvC,WAAW,SAAS,MAAM,YAAY,GACtC;QACA,IAAI,UAAU,iBAAiB,gBAAgB,OAAO;QACtD,IAAI,UAAU;QAEd,KAAK,IAAI,IAAI,GAAG,IAAI,gBAAgB,KAAK;SACvC,MAAM,YAAY,iBAAiB;SACnC,IAAI,WAAW,QAAQ;UACrB,MAAM,eAAe,EACnB,KAAK,MAAM,oCACT,UAAU,OAAO,YACnB,EACF;UACA,MAAM,kBAAkB,mBACtB,GAAG,MAAM,cAAc,GAAG,UAAU,mBACtC;UACA,IACE,CACE,IAAI,gBAAgB,UAAU,CAAC,CAAC,IAAI,eAAe,GACnD,IAAI,gBAAgB,UAAU,CAAC,CAAC,IAAI,OAAO,CAC7C,CAAC,CAAC,SAAS,mBAAmB,eAAe,CAAC,GAC9C;WACA,MAAM,OAAO,IAAI,gBAAgB,UAAU;WAC3C,MAAM,WAAW,KAAK,OAAO,UAAU;WACvC,MAAM,iBAAiB,gBAAgB,QAAQ,IAC7C,6BACF;WAMA,IAJE,UAAU,yBAAyB,sBACnC,QACE,aAAa,UAAU,wBAAwB,kBAAkB,KACnE,KAAK,IAAI,OAAO,GAEhB,kBAAkB;gBACb,IAAI,mBAAmB,MAAM;YAClC,MAAM,WAAW,mBAAmB,cAAc;YAClD,IAAI,SAAS,WAAW,KAAK,SAAS,OAAO,UAC3C,MAAM,IAAI,MAAM,mDAAmD;YACrE,IAAI,CAAC,UAAU,mBACb,MAAM,IAAI,MAAM,kDAAkD;YACpE,MAAM,wBAAwB,yBAC5B,UAAU,kBAAkB,WAC5B,QACF;YACA,MAAM,eACJ,UAAU,OAAO,SACjB,UAAU,sBACV,UAAU,kBAAkB;YAK9B,IAJwB,CACtB,KAAK,IAAI,OAAO,GAChB,sBAAsB,KACxB,CAAC,CAAC,QAAQ,UAA2B,OAAO,UAAU,QAEpD,CAAA,CAAgB,MACd,UACE,CAAC,MACE,MAAM,KAAK,CAAC,CACZ,OAAO,OAAO,CAAC,CACf,OAAM,UAAS,cAAc,MAAM,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAChE,GAEA,MAAM,IAAI,MAAM,mDAAmD;YAErE,IACE,UAAU,aAAa,KAAA,IACnB,UAAU,aAAa,WACvB,EACE,OAAO,UAAU,kBAAkB,aAAa,WAC5C,CAAC,UAAU,kBAAkB,QAAQ,IACpC,UAAU,kBAAkB,YAAY,CAAC,EAAA,CAC9C,SAAS,QAAQ,GAEvB,MAAM,IAAI,MAAM,6CAA6C;YAC/D,kBAAkB,UAAU,WACxB,YACA,2BAA2B,WAAW,QAAQ;YAClD,gBAAgB,eAAe;YAC/B,gBAAgB,iBAAiB,KAAK,IAAI,OAAO,KAAK;YACtD,gBAAgB,QAAQ,UAAU;YAClC,gBAAgB,wCACd,UAAU;YACZ,gBAAgB,8CACd,UAAU;YACZ,gBAAgB,sCACd,UAAU;WACd,OAAO,IAAI,UAAU,UACnB,MAAM,IAAI,MACR,0DACF;gBACK;YACL,kBAAkB;YAClB,gBAAgB,iBACd,KAAK,IAAI,OAAO,KAAK,UAAU,OAAO;WAC1C;WACA,UAAU,MAAM,kBACd,iBACA,iBACA,KACA,YACF;WACA,UAAU,QAAQ,QAChB,iBACA,mBAAmB,UAAU,OAAO,aAAuB,CAC7D;WACA;UACF;UACA,MAAM,iBAAiB,mBACrB,GAAG,MAAM,aAAa,GAAG,UAAU,mBACrC;UACA,IACE,IAAI,gBAAgB,UAAU,CAAC,CAAC,IAAI,OAAO,MAC3C,mBAAmB,cAAc,GACjC;WACA,UAAU,MAAM,kBACd,iBACA,WACA,KACA,YACF;WACA,UAAU,QAAQ,QAChB,gBACA,mBAAmB,UAAU,OAAO,YAAY,CAClD;WACA,kBAAkB;WAClB;UACF;SACF;QACF;QACA,IAAI,CAAC,iBACH,MAAM,IAAI,MACR,6DACF;QACF,OAAO,QAAQ;QACf,MAAM,aAAa,gBAAgB;QACnC,MAAM,QAAQ,gBAAgB,gBAAgB;QAC9C,MAAM,kBAAkB,MAAM;QAC9B,IACE,gBAAgB,YAChB,QACE,aAAa,gBAAgB,wBAAyB,aAAa,KACrE,QACE,aAAa,gBAAgB,wBAAyB,kBAAkB,GAE1E,MAAM,IAAI,MACR,iEACF;QAGF,MAAM,eAAe,MAAM,iBAAiB;SAC1C,MAAM;SACN,QAAQ,cAAc;SACtB;SACA,MAAM,cAAc;SACpB,OAAO,cAAc;SACrB,UAAU,cAAc;SACxB,UAAU,cAAc;SACxB,aAAa,cAAc;SAC3B,WAAW,cAAc;QAC3B,CAAC;QAGD,IACE,iBAAiB,yBAAyB,sBAC1C,IAAI,WACF,aAAa,gBAAgB,wBAAwB,kBAAkB,CACzE,GACA;SACA,MAAM,OAAO,MAAM;SACnB,MAAM,MAAM,MAAM,KAAK,KAAK;SAC5B,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC;SAC/B;QACF;QAYA,QAAQ,MATa,aAAa,KAChC,WACE,uBAEE,gBAAiB,eAAe,cAChC,MAAM,eAAe,uBACjB,MAAM,eAAe,eAC7B,CACF,CACc;QACd;OACF;OAIA,IADuB,WAAW,SAAS,gBACvC,GAAgB;QAClB,MAAM,wCACJ,yCAAyC,UAAU;QACrD,IACE,CAAC,yCACD,0CAA0C,IAE1C,MAAM,IAAI,MAAM,8CAA8C;QAEhE,kBACE,iBAAiB,QAAQ,CAAC,CAAC,MACzB,YACE,QAAQ,sBAAsB,qCAClC,KAAK;QACP,IAAI,CAAC,iBACH,MAAM,IAAI,MACR,mEACF;QACF,IAAI,gBAAgB,UAAU;SAC5B,MAAM,WAAW,IAAI,gBAAgB,UAAU,CAAC,CAAC,OAAO,UAAU;SAClE,IAAI,SAAS,WAAW,KAAK,SAAS,OAAO,gBAAgB,UAC3D,MAAM,IAAI,MAAM,kCAAkC;SACpD,IACE,QAAQ,aAAa,gBAAgB,wBAAyB,aAAa,GAE3E,MAAM,IAAI,MAAM,kCAAkC;SACpD,gBAAgB,eAAe;QACjC;QACA,gBAAgB,iBACd,gBAAgB,uBACf,gBAAgB,WACb,yBACE,gBAAgB,mBAAmB,WACnC,gBAAgB,QAClB,CAAC,CAAC,QACF,gBAAgB,mBAAmB;QACzC,MAAM,aAAa,gBAAgB;QACnC,IAAI,UAAU;QACd,MAAM,eAAe,gBAAgB;QACrC,IAAI,gBAAgB,MAClB,UAAU,oBAAoB,SAAS,YAAY;QAGrD,MAAM,gBAAgB,MAAM,kBAC1B,iBACA,iBACA,GACF;QACA,MAAM,OAAO,MAAM,MAAM,iBAAiB;SACxC,MAAM;SACN,QAAQ,cAAc;SACtB,SAAS;SACT,MAAM,cAAc;SACpB,OAAO,cAAc;SACrB,UAAU,cAAc;SACxB,UAAU,cAAc;SACxB,aAAa,cAAc;SAC3B,WAAW,cAAc;QAC3B,CAAC;QAOD,QAAQ,MANa,WACnB,uBACM,gBAAiB,eAAe,YACtC,KAAA,GACA,IACF,CAAC,CAAC,IAAI,CACQ;QACd;OACF;OAcA,QAAQ,MAXiB,MAAM,iBAAiB;QAC9C,MAAM;QACN,QAAQ,cAAc;QACtB,SAAS,iBAAiB,gBAAgB,OAAO;QACjD,MAAM,cAAc;QACpB,OAAO,cAAc;QACrB,UAAU,cAAc;QACxB,UAAU,cAAc;QACxB,aAAa,cAAc;QAC3B,WAAW,cAAc;OAC3B,CAAC,CACiB;MACpB,SAAS,KAAK;OACZ,OAAO,GAAG;MACZ;KACF,CAAC,CAAC,CACD,MAAM,MAAM;IACjB,CAEa;IAIf,OAAO,MAAM,eAAe;GAC9B,SAAS,KAAK;IAEZ,QAAQ,MAAM,0CAA0C,GAAG;IAC3D,OAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,IAAI,CAAC;GAC7D;EACF,EAAA,CAAG,CACL;CACF;CAEA,IAAM,qBAAqB,OAAO,UAAiD;EACjF,MAAM,OAAO,MAAM,MAAM;EACzB,MAAM,OAAO,MAAM;EAEnB,IAAI,MAAM,MAAM,SAAS,gBAAgB;GACvC,MAAM,MAAM,YAAY;GACxB,MAAM,cAAc,CAAC,CAAC;GACtB;EACF,OAAO,IAAI,MAAM,KAAK,SAAS,SAAS;GACtC,MAAM,QAAQ,MAAM,CAAC,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC;GACrD;EACF;EAEA,MAAM,oBAAoB,KAAK,kBAAkB,MAAM,GAAG,CAAC,CAAC;EAC5D,MAAM,WAAW,mBAAmB,KAAK,iBAAiB;EAE1D,IAAI,kBAAkB,MACpB,iBAAiB,CAAC;EAGpB,MAAM,gBAAgB,eAAe;EACrC,MAAM,qBAAqB,MAAM,QAAQ,aAAa,IAClD,QACA,cAAc;EAGlB,MAAM,6BAA6B,GAAG,kBAAkB,SAD1C,qBAAqB,KAAK,QAAQ;EAGhD,IAAI,kBAAkB,SAAS;EAC/B,IAAI,CAAC,iBAAiB;GACpB,MAAM,kBAAkB,MAAM,QAAQ,aAAa,IAAI,QAAQ,cAAc;GAC7E,MAAM,wCAAwC,MAAM,QAAQ,aAAa,IACrE,OACA,cAAc;GAClB,MAAM,yCAAyC,MAAM,QAAQ,aAAa,IACtE,QACA,cAAc;GAClB,MAAM,2BAA2B,MAAM,QAAQ,aAAa,IACxD,QACA,cAAc;GAElB,SAAS,8BAA8B;IACrC,QAAQ;IACR,OAAO;IACP,cAAc;IACd,yBAAyB;IACzB,mBAAmB,KAAA;IACnB,OAAO;IACP,QAAQ;IACR,mBAAmB;IACnB,iBAAiB,CAAC;IAClB,kCAAkC,yCAAyC;IAC3E,wCAAwC,0CAA0C;IAClF,qCAAqC;IACrC,uCAAuC;IACvC,6CAA6C;IAC7C,yDAAyD;IACzD,oBAAoB,sBAAsB;IAC1C,0BAA0B,4BAA4B;GACxD;GACA,kBAAkB,SAAS;GAE3B,IAAI,CAAC,eAAe,oBAClB,eAAe,qBAAqB,CAAC;EAEzC;EACA,IAAI,aAAa,KAAA,GACf,IAAI;GACF,kBAAkB,2BAA2B,iBAAiB,QAAQ;EACxE,SAAS,OAAO;GACd,QAAQ,MAAM,iDAAiD,KAAK;GACpE,KAAK,YAAY;IAAE;IAAmB,OAAO;GAAkC,CAAC;GAChF;EACF;EAGF,QAAQ,KAAK,MAAb;GACE,KAAK;IACH,gBAAgB,cAAc,gBAAgB,cAAc,KAAK;IACjE,KAAK,MAAM,SAAS,OAAO,OAAO,gBAAgB,mBAAmB,CAAC,CAAC,GACrE,MAAM,cAAc,MAAM,cAAc,KAAK;IAE/C,gBAAgB,kBAAkB,KAAA;IAClC,gBAAgB,SAAS;IACzB,gBAAgB,QAAQ;IACxB,gBAAgB,eAAe;IAC/B,gBAAgB,QAAQ;IACxB,gBAAgB,sCAAsC;IACtD,gBAAgB,wCAAwC;IACxD,gBAAgB,8CAA8C;IAC9D,gBAAgB,0DAA0D;IAC1E,gBAAgB,qBAAqB,KAAA;IACrC,gBAAgB,iBAAiB,KAAA;IACjC,gBAAgB,yCAAyC;IACzD,gBAAgB,SAAS,KAAK,KAAK;IACnC,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GAEF,KAAK,QAAQ;IACX,MAAM,0BAA0B,KAAK,KAAK;IAC1C,MAAM,UAAU,WAAW,eAAe,MAAM;IAEhD,IAAI,CAAC,QAAQ,MAAK,WAAU,WAAA,GAA+B,GACzD;KACE,wBAAwB;KACxB,wBAAwB;KACxB,wBAAwB;KACxB,wBAAwB;IAC1B,CAAC,CAAC,SAAQ,MAAK;KACb,YAAY,SAAS,CAAC;IACxB,CAAC;IAGH,gBAAgB,0BAA0B;IAC1C,gBAAgB,oBAAoB,KAAK,KAAK;IAC9C,IAAI,KAAK,KAAK,UAAU,cACtB,gBAAgB,qBAAqB,gBAAgB,kBAAkB;IACzE,IAAI,aAAa,KAAA,GACf,yBAAyB,gBAAgB,kBAAkB,WAAW,QAAQ;IAEhF,IAAI,gBAAgB,+CAA+C,MAAM;KACvE,MAAM,SAAS,gBAAgB;KAC/B,IAAI,QAAQ,uCAAuC;MACjD,gBAAgB,wCACd,OAAO;MACT,gBAAgB,8CACd,OAAO;KACX;KACA,MAAM,8CAA8C,qBAAqB,aAAa;KACtF,IACE,+CAA+C,QAC/C,gBAAgB,+CAA+C,MAC/D;MACA,IAAI,gBAAgB,kBAAkB,mCACpC,QAAQ,KACN,kGACF;MAEF,gBAAgB,8CACd;MACF,gBAAgB,wCAAwC,MAAM,iBAAiB,IAAI,CAAC,CAClF,4CAA4C,oBAC9C;MACA,gBAAgB,0DACd,iCAAiC,aAAa,KAAK;KACvD;IACF;IAEA,IAAI,CAAC,gBAAgB,QACnB,KAAK,YAAY;KACf,QAAQ;KACR,QAAQ,gBAAgB;KACxB;KACA,SAAA;KACA,yBAAyB;KACzB,kBAAkB,OAAO,KAAK,gBAAgB,mBAAmB,CAAC,CAAC;IACrE,CAAC;SACI;KACL,MAAM,SAAS;MACb,GAAG,gBAAgB;MACnB,gBAAgB,gBAAgB,OAAO,iBACnC,EAAE,GAAG,gBAAgB,OAAO,eAAe,IAC3C,KAAA;KACN;KACA,IAAI,gBAAgB,iBAClB,OAAO,eAAe,GAAG,MAAM,aAAa,GAAG,gBAAgB;KAEjE,IAAI,OAAO,eACT,OAAO,gBAAgB,GAAG,MAAM,cAAc,IAAI,gBAAgB,gBAAgB,gBAAA,CAAiB;KAErG,IAAI,QAAQ,gBAAgB,SAAS,gBAAgB,SAAS,MAC5D,OAAO,eAAe,QAAQ,GAAG,MAAM,YAAY,GAAG,gBAAgB;KAExE,KAAK,YAAY;MACf;MACA,QAAQ,gBAAgB;MACxB;MACA,SAAA;MACA,yBAAyB;MACzB,kBAAkB,OAAO,KAAK,gBAAgB,mBAAmB,CAAC,CAAC;KACrE,CAAC;IACH;IACA;GACF;GAEA,KAAK;IACH,gBAAgB,sCACd,KAAK,KAAK;IACZ,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GAGF,KAAK,0CAA0C;IAC7C,MAAM,sCACJ,gBAAgB;IAClB,KAAK,YAAY;KACf;KACA;IACF,CAAC;IACD;GACF;GAEA,KAAK;IACH,gBAAgB,QAAQ,KAAK,KAAK;IAClC,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GAGF,KAAK,YAAY;IACf,MAAM,QAAQ,gBAAgB;IAC9B,KAAK,YAAY;KAAE;KAAmB;IAAM,CAAC;IAC7C;GACF;GAEA,KAAK;IACH,gBAAgB,eAAe,KAAK,KAAK;IACzC,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GAGF,KAAK,mBAAmB;IACtB,MAAM,eACJ,gBAAgB,gBAAgB,OAC5B,GAAG,MAAM,cAAc,GAAG,gBAAgB,sBAC1C;IACN,KAAK,YAAY;KACf;KACA;IACF,CAAC;IACD;GACF;GAEA,KAAK;IACH,gBAAgB,eAAe,KAAK,KAAK;IACzC,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GAGF,KAAK,mBAAmB;IACtB,MAAM,eAAe,gBAAgB;IACrC,KAAK,YAAY;KAAE;KAAmB;IAAa,CAAC;IACpD;GACF;GAEA,KAAK,YAAY;IACf,MAAM,QAAQ,KAAK,KAAK;IACxB,IAAI,OAAO;KACT,IACE,CAAC,gBAAgB,YACjB,gBAAgB,SAChB,MAAM,UAAU,gBAAgB,MAAM,OACtC;MACA,gBAAgB,cAAc,gBAAgB,cAAc,KAAK;MACjE,KAAK,MAAM,SAAS,OAAO,OAAO,gBAAgB,mBAAmB,CAAC,CAAC,GACrE,MAAM,cAAc,MAAM,cAAc,KAAK;MAE/C,gBAAgB,kBAAkB,KAAA;KACpC;KACA,gBAAgB,QAAQ;IAC1B;IACA,KAAK,YAAY,EAAE,kBAAkB,CAAC;IACtC;GACF;GAEA,KAAK,YAAY;IACf,MAAM,WAAW,GAAG,MAAM,YAAY,GAAG,gBAAgB;IACzD,MAAM,QAAQ,gBAAgB,QAAQ,WAAW;IACjD,KAAK,YAAY;KAAE;KAAmB;IAAM,CAAC;IAC7C;GACF;GAEA,SACE;EACJ;CACF;CAEA,IAAM,gBAAgB,OAAO,UAAiD;EAC5E,IAAI;GACF,MAAM,mBAAmB,KAAK;EAChC,SAAS,OAAO;GACd,QAAQ,MAAM,uCAAuC,KAAK;GAC1D,MAAM,QAAQ,EAAE,EAAE,YAAY;IAC5B,mBAAmB,MAAM,MAAM;IAC/B,OAAO,iBAAiB,QAAQ,MAAM,UAAU;GAClD,CAAC;EACH;CACF;CAGA,MAAM,iBAAiB,SAAS,WAAW;CAC3C,MAAM,iBAAiB,WAAW,aAAa"}

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,cAAc,0BAA0B,CAAC;AAC/C,QAAA,MAAM,oBAAoB,MAAM,CAAC;AAEjC,KAAK,SAAS,GAAG;IACf,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,QAAA,MAAM,KAAK,EAAE,SAKZ,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF,QAAA,MAAM,cAAc,EAAE,kBAIrB,CAAC;AAEF,QAAA,MAAM,yBAAyB,sCAAsC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC"}

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,2BAQzC;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF"}

package/dist/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AASnD,eAAO,MAAM,oBAAoB,GAAI,eAAe,MAAM,EAAE,GAAG,aAAa,4EAa3E,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAAI,eAAe,MAAM,EAAE,GAAG,aAAa,mBAUvF,CAAC"}

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2CAA2C,EAAE,MAAM,SAAS,CAAC;AAiCtE,eAAO,MAAM,gBAAgB,GAAI,OAAO,UAAU,WAOjD,CAAC;AAUF,eAAO,MAAM,kDAAkD,EAAE,2CAc9D,CAAC;AAuEJ,eAAO,MAAM,GAAG;cAnEV,GAAG,MAEL,KAAK,GAAG,EACR,SAAS,GAAG,EACZ,QAAQ,GAAG,EACX,6CAA6C,2CAA2C,EACxF,sBAA0B;CA6DH,CAAC;AAqD5B,eAAO,MAAM,GAAG;oBAtBO,GAAG,MAAY,QAAG,EAAE,iBAAiB,mBAAmB;CAsB9C,CAAC;AAElC,eAAO,MAAM,gBAAgB,GAC1B,GAAG,GAAG,MAAY,sBAAsB,qBAAqB,GAAG,cAAc,iBAO9E,CAAC;AAEJ,eAAO,MAAM,8CAA8C,GACxD,GAAG,GAAG,MACN,6CAA6C,2CAA2C,MAClF,KAAK,GAAG,EAAE,0BAAe,EAAE,KAAK,MAAM,EAAE,iBAAiB,oBA0B/D,CAAC"}

package/dist/oidcConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcConfig.d.ts","sourceRoot":"","sources":["../src/oidcConfig.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAU,UAAU,EAA2B,cAAc,EAAE,MAAM,SAAS,CAAC;AAehG,QAAA,MAAM,mBAAmB,GAAI,UAAU,QAAQ,EAAE,eAAe,MAAM,KAAG,OAWxE,CAAC;AAUF,QAAA,MAAM,0BAA0B,GAC9B,UAAU,QAAQ,EAClB,eAAe,MAAM,EACrB,gBAAgB,cAAc,KAC7B,OAeF,CAAC;AAEF,QAAA,MAAM,0BAA0B,GAC9B,UAAU,QAAQ,EAClB,eAAe,MAAM,EACrB,gBAAgB,cAAc,KAC7B,OAmBF,CAAC;AAEF,QAAA,MAAM,6BAA6B,GAAI,UAAU,QAAQ,EAAE,KAAK,MAAM,KAAG,UAAU,EAWlF,CAAC;AAEF,OAAO,EACL,6BAA6B,IAAI,gCAAgC,EACjE,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,CAAC"}

package/dist/protocol.d.ts

@@ -1,2 +1,140 @@
-export * from './src/protocol.js'
-export {}
+import { MessageData, MessageEventData, MessageEventType, Nonce, OidcConfiguration, OidcServerConfiguration, Status } from './types';
+export type { MessageData, MessageEventData, MessageEventType, Nonce, OidcConfiguration, OidcServerConfiguration, Status, };
+/**
+ * Semver-protected version of the service worker `postMessage` protocol.
+ *
+ * - The `MAJOR` component changes only on a breaking change to any of the
+ *   exports in this module.
+ * - The `MINOR` component changes when new (additive) message types or
+ *   helpers are introduced.
+ * - The `PATCH` component changes for documentation or non-behavioural
+ *   tweaks.
+ */
+export declare const PROTOCOL_VERSION: "1.1.0";
+export type { OidcResourceConfiguration } from './resource';
+export { getContextResource, getResourceConfiguration, getResourceContextName, isResourceOriginManaged, isResourceUrlAllowed, RESOURCE_TOKEN_REQUEST_HEADER, validateResourceIdentifier, } from './resource';
+/**
+ * Every supported service worker message type.
+ *
+ * The values are also the literal string used on the wire as
+ * `MessageEventData.type` and must therefore remain stable across patch and
+ * minor versions of the protocol.
+ */
+export declare const ServiceWorkerMessageType: {
+    /** Lifecycle: tells the SW to skip the `waiting` state. */
+    readonly SKIP_WAITING: "SKIP_WAITING";
+    /** Lifecycle: asks the SW to claim the current page. */
+    readonly CLAIM: "claim";
+    /** Resets the session entry kept inside the SW for a configuration. */
+    readonly CLEAR: "clear";
+    /** Initialises a configuration entry inside the SW. */
+    readonly INIT: "init";
+    readonly SET_STATE: "setState";
+    readonly GET_STATE: "getState";
+    readonly SET_CODE_VERIFIER: "setCodeVerifier";
+    readonly GET_CODE_VERIFIER: "getCodeVerifier";
+    readonly SET_SESSION_STATE: "setSessionState";
+    readonly GET_SESSION_STATE: "getSessionState";
+    readonly SET_NONCE: "setNonce";
+    readonly GET_NONCE: "getNonce";
+    readonly SET_DPOP_NONCE: "setDemonstratingProofOfPossessionNonce";
+    readonly GET_DPOP_NONCE: "getDemonstratingProofOfPossessionNonce";
+    readonly SET_DPOP_JWK: "setDemonstratingProofOfPossessionJwk";
+    readonly GET_DPOP_JWK: "getDemonstratingProofOfPossessionJwk";
+};
+export type ServiceWorkerMessageTypeKey = keyof typeof ServiceWorkerMessageType;
+export type ServiceWorkerMessageTypeValue = (typeof ServiceWorkerMessageType)[ServiceWorkerMessageTypeKey];
+/**
+ * Structural shape of a message sent to the service worker. The shape is
+ * identical to {@link MessageEventData} but typed against the public
+ * {@link ServiceWorkerMessageTypeValue} union and with optional fields where
+ * the underlying SW tolerates them.
+ */
+export interface ServiceWorkerMessage<TData extends Partial<MessageData> | null = Partial<MessageData> | null> {
+    type: ServiceWorkerMessageTypeValue | 'SKIP_WAITING' | 'claim';
+    configurationName: string;
+    data: TData;
+    /**
+     * Optional tab identifier injected by the high-level helpers. Consumers
+     * sending raw messages can omit it; the SW falls back to `'default'`.
+     */
+    tabId?: string;
+}
+/**
+ * Generic envelope used by every response. Each individual message type may
+ * extend it with additional, well-known fields (see PROTOCOL.md).
+ */
+export interface ServiceWorkerResponse {
+    /** Resource isolation capability provided by protocol 1.1 workers. */
+    resourceTokenManagement?: boolean;
+    /** Worker-owned context names, without token or key material. */
+    resourceContexts?: string[];
+    configurationName?: string;
+    /** Set by the SW when it cannot service the request. */
+    error?: unknown;
+    [key: string]: unknown;
+}
+/**
+ * Stable internal token placeholders. They are returned by the service
+ * worker in lieu of secret values (access/refresh tokens, nonces and code
+ * verifier) so consumers never see the cleartext.
+ */
+export declare const TOKEN_PLACEHOLDERS: {
+    readonly ACCESS_TOKEN: "ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER";
+    readonly REFRESH_TOKEN: "REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER";
+    readonly NONCE_TOKEN: "NONCE_SECURED_BY_OIDC_SERVICE_WORKER";
+    readonly CODE_VERIFIER: "CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER";
+};
+/** Prefix used for every DPoP placeholder returned by the SW. */
+export declare const DPOP_TOKEN_PLACEHOLDER_PREFIX: "DPOP_SECURED_BY_OIDC_SERVICE_WORKER";
+/**
+ * Browser storage key conventions used by the OIDC client when no service
+ * worker is available, or as a fallback alongside the SW. They are exported
+ * so external integrations can read/clean up the same entries.
+ */
+export declare const STORAGE_KEY_PREFIX: {
+    /** sessionStorage – per-tab tab identifier (`oidc.tabId.<configurationName>`). */
+    readonly TAB_ID: "oidc.tabId.";
+    /** sessionStorage – `oidc.state.<configurationName>`. */
+    readonly STATE: "oidc.state.";
+    /** sessionStorage – `oidc.nonce.<configurationName>`. */
+    readonly NONCE: "oidc.nonce.";
+    /** sessionStorage – `oidc.code_verifier.<configurationName>`. */
+    readonly CODE_VERIFIER: "oidc.code_verifier.";
+    /** localStorage – `oidc.login.<configurationName>`. */
+    readonly LOGIN_PARAMS: "oidc.login.";
+    /** sessionStorage – `oidc.sw.version_mismatch_reload.<configurationName>`. */
+    readonly SW_VERSION_MISMATCH_RELOAD: "oidc.sw.version_mismatch_reload.";
+};
+/** sessionStorage key tracking the SW controllerchange reload counter. */
+export declare const SW_CONTROLLER_CHANGE_RELOAD_COUNT_KEY: "oidc.sw.controllerchange_reload_count";
+/**
+ * Builds a typed sessionStorage / localStorage key from one of the known
+ * prefixes and a configuration name. The function is intentionally
+ * single-purpose so we never lose the prefix-based stability guarantee.
+ */
+export declare const buildStorageKey: (prefix: (typeof STORAGE_KEY_PREFIX)[keyof typeof STORAGE_KEY_PREFIX], configurationName: string) => string;
+/**
+ * Builds the stable placeholder string the SW returns instead of an
+ * access/refresh/nonce/code-verifier secret. Useful for consumers that need
+ * to detect whether a value comes from the SW.
+ */
+export declare const buildSecuredTokenPlaceholder: (placeholder: (typeof TOKEN_PLACEHOLDERS)[keyof typeof TOKEN_PLACEHOLDERS], configurationName: string, tabId?: string) => string;
+/**
+ * Builds the placeholder returned for DPoP-secured access tokens
+ * (`DPOP_SECURED_BY_OIDC_SERVICE_WORKER_<config>#tabId=<tabId>`).
+ */
+export declare const buildDpopSecuredPlaceholder: (configurationName: string, tabId?: string) => string;
+/**
+ * Type guard returning `true` when the provided value is one of the
+ * supported, public service worker message types.
+ */
+export declare const isServiceWorkerMessageType: (value: unknown) => value is ServiceWorkerMessageTypeValue;
+/**
+ * Internal wire-level type, re-exported for legacy parity. New code should
+ * prefer {@link ServiceWorkerMessageTypeValue}.
+ *
+ * @internal
+ */
+export type ServiceWorkerMessageEventType = MessageEventType;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,EACP,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,GACP,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAG,OAAgB,CAAC;AAEjD,YAAY,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;IACnC,2DAA2D;;IAE3D,wDAAwD;;IAExD,uEAAuE;;IAEvE,uDAAuD;;;;;;;;;;;;;;CAc/C,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAChF,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,wBAAwB,CAAC,CAAC,2BAA2B,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CACnC,KAAK,SAAS,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI;IAEvE,IAAI,EAAE,6BAA6B,GAAG,cAAc,GAAG,OAAO,CAAC;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,KAAK,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,EAAG,qCAA8C,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;IAC7B,kFAAkF;;IAElF,yDAAyD;;IAEzD,yDAAyD;;IAEzD,iEAAiE;;IAEjE,uDAAuD;;IAEvD,8EAA8E;;CAEtE,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,qCAAqC,EAChD,uCAAgD,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,CAAC,OAAO,kBAAkB,EAAE,MAAM,OAAO,kBAAkB,CAAC,EACpE,mBAAmB,MAAM,KACxB,MAAyC,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,GACvC,aAAa,CAAC,OAAO,kBAAkB,EAAE,MAAM,OAAO,kBAAkB,CAAC,EACzE,mBAAmB,MAAM,EACzB,QAAO,MAAkB,KACxB,MAA8D,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,mBAAmB,MAAM,EACzB,QAAO,MAAkB,KACxB,MAAgF,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GACrC,OAAO,OAAO,KACb,KAAK,IAAI,6BAKX,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG,gBAAgB,CAAC"}