@axa-fr/oidc-client-service-worker 7.29.8 → 7.30.0

package/dist/OidcServiceWorker.js

@@ -1,819 +1,1049 @@
-//#region src/constants.ts
-var scriptFilename = "OidcTrustedDomains.js";
-var TOKEN = {
-	REFRESH_TOKEN: "REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
-	ACCESS_TOKEN: "ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
-	NONCE_TOKEN: "NONCE_SECURED_BY_OIDC_SERVICE_WORKER",
-	CODE_VERIFIER: "CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER"
-};
-var TokenRenewMode = {
-	access_token_or_id_token_invalid: "access_token_or_id_token_invalid",
-	access_token_invalid: "access_token_invalid",
-	id_token_invalid: "id_token_invalid"
-};
-//#endregion
-//#region src/jwt.ts
-function strToUint8(str) {
-	return new TextEncoder().encode(str);
-}
-function binToUrlBase64(bin) {
-	return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+/g, "");
-}
-function utf8ToBinaryString(str) {
-	return encodeURIComponent(str).replace(/%([0-9A-F]{2})/g, function(match, p1) {
-		return String.fromCharCode(parseInt(p1, 16));
-	});
-}
-var uint8ToUrlBase64 = (uint8) => {
-	let bin = "";
-	uint8.forEach(function(code) {
-		bin += String.fromCharCode(code);
-	});
-	return binToUrlBase64(bin);
-};
-function strToUrlBase64(str) {
-	return binToUrlBase64(utf8ToBinaryString(str));
-}
-var defaultDemonstratingProofOfPossessionConfiguration = {
-	importKeyAlgorithm: {
-		name: "ECDSA",
-		namedCurve: "P-256",
-		hash: { name: "ES256" }
-	},
-	signAlgorithm: {
-		name: "ECDSA",
-		hash: { name: "SHA-256" }
-	},
-	generateKeyAlgorithm: {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	},
-	digestAlgorithm: { name: "SHA-256" },
-	jwtHeaderAlgorithm: "ES256"
-};
-var sign = (w) => async (jwk, headers, claims, demonstratingProofOfPossessionConfiguration, jwtHeaderType = "dpop+jwt") => {
-	jwk = Object.assign({}, jwk);
-	headers.typ = jwtHeaderType;
-	headers.alg = demonstratingProofOfPossessionConfiguration.jwtHeaderAlgorithm;
-	switch (headers.alg) {
-		case "ES256":
-			headers.jwk = {
-				kty: jwk.kty,
-				crv: jwk.crv,
-				x: jwk.x,
-				y: jwk.y
-			};
-			break;
-		case "RS256":
-			headers.jwk = {
-				kty: jwk.kty,
-				n: jwk.n,
-				e: jwk.e,
-				kid: headers.kid
-			};
-			break;
-		default: throw new Error("Unknown or not implemented JWS algorithm");
+(function() {
+	//#region src/constants.ts
+	var scriptFilename = "OidcTrustedDomains.js";
+	var TOKEN = {
+		REFRESH_TOKEN: "REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
+		ACCESS_TOKEN: "ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
+		NONCE_TOKEN: "NONCE_SECURED_BY_OIDC_SERVICE_WORKER",
+		CODE_VERIFIER: "CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER"
+	};
+	var TokenRenewMode = {
+		access_token_or_id_token_invalid: "access_token_or_id_token_invalid",
+		access_token_invalid: "access_token_invalid",
+		id_token_invalid: "id_token_invalid"
+	};
+	//#endregion
+	//#region src/jwt.ts
+	function strToUint8(str) {
+		return new TextEncoder().encode(str);
 	}
-	const jws = {
-		protected: strToUrlBase64(JSON.stringify(headers)),
-		payload: strToUrlBase64(JSON.stringify(claims))
-	};
-	const keyType = demonstratingProofOfPossessionConfiguration.importKeyAlgorithm;
-	const privateKey = await w.crypto.subtle.importKey("jwk", jwk, keyType, true, ["sign"]);
-	const data = strToUint8(`${jws.protected}.${jws.payload}`);
-	const signatureType = demonstratingProofOfPossessionConfiguration.signAlgorithm;
-	const signature = await w.crypto.subtle.sign(signatureType, privateKey, data);
-	jws.signature = uint8ToUrlBase64(new Uint8Array(signature));
-	return `${jws.protected}.${jws.payload}.${jws.signature}`;
-};
-var JWT = { sign };
-var generate = (w) => async (generateKeyAlgorithm) => {
-	const keyType = generateKeyAlgorithm;
-	const key = await w.crypto.subtle.generateKey(keyType, true, ["sign", "verify"]);
-	return await w.crypto.subtle.exportKey("jwk", key.privateKey);
-};
-var neuter = (jwk) => {
-	const copy = Object.assign({}, jwk);
-	delete copy.d;
-	copy.key_ops = ["verify"];
-	return copy;
-};
-var EC = {
-	generate,
-	neuter
-};
-var thumbprint = (w) => async (jwk, digestAlgorithm) => {
-	let sortedPub;
-	switch (jwk.kty) {
-		case "EC":
-			sortedPub = "{\"crv\":\"CRV\",\"kty\":\"EC\",\"x\":\"X\",\"y\":\"Y\"}".replace("CRV", jwk.crv).replace("X", jwk.x).replace("Y", jwk.y);
-			break;
-		case "RSA":
-			sortedPub = "{\"e\":\"E\",\"kty\":\"RSA\",\"n\":\"N\"}".replace("E", jwk.e).replace("N", jwk.n);
-			break;
-		default: throw new Error("Unknown or not implemented JWK type");
+	function binToUrlBase64(bin) {
+		return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+/g, "");
 	}
-	const hash = await w.crypto.subtle.digest(digestAlgorithm, strToUint8(sortedPub));
-	return uint8ToUrlBase64(new Uint8Array(hash));
-};
-var JWK = { thumbprint };
-var generateJwkAsync = (w) => async (generateKeyAlgorithm) => {
-	return await EC.generate(w)(generateKeyAlgorithm);
-};
-var generateJwtDemonstratingProofOfPossessionAsync = (w) => (demonstratingProofOfPossessionConfiguration) => async (jwk, method = "POST", url, extrasClaims = {}) => {
-	const claims = {
-		jti: btoa(w.crypto.randomUUID()),
-		htm: method,
-		htu: url,
-		iat: Math.round(Date.now() / 1e3),
-		...extrasClaims
-	};
-	const kid = await JWK.thumbprint(w)(jwk, demonstratingProofOfPossessionConfiguration.digestAlgorithm);
-	return await JWT.sign(w)(jwk, { kid }, claims, demonstratingProofOfPossessionConfiguration);
-};
-//#endregion
-//#region src/crypto.ts
-function textEncodeLite(str) {
-	const buf = new ArrayBuffer(str.length);
-	const bufView = new Uint8Array(buf);
-	for (let i = 0; i < str.length; i++) bufView[i] = str.charCodeAt(i);
-	return bufView;
-}
-function base64urlOfHashOfASCIIEncodingAsync(code) {
-	return new Promise((resolve, reject) => {
-		crypto.subtle.digest("SHA-256", textEncodeLite(code)).then((buffer) => {
-			return resolve(uint8ToUrlBase64(new Uint8Array(buffer)));
-		}, (error) => reject(error));
-	});
-}
-//#endregion
-//#region src/dpop.ts
-var isDpop = (trustedDomain) => {
-	if (Array.isArray(trustedDomain)) return false;
-	return trustedDomain.demonstratingProofOfPossession ?? false;
-};
-var getDpopConfiguration = (trustedDomain) => {
-	if (!isDpop(trustedDomain)) return null;
-	if (Array.isArray(trustedDomain)) return null;
-	return trustedDomain.demonstratingProofOfPossessionConfiguration ?? defaultDemonstratingProofOfPossessionConfiguration;
-};
-var getDpopOnlyWhenDpopHeaderPresent = (trustedDomain) => {
-	if (!isDpop(trustedDomain)) return null;
-	if (Array.isArray(trustedDomain)) return null;
-	return trustedDomain.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ?? true;
-};
-//#endregion
-//#region src/utils/normalizeUrl.ts
-function normalizeUrl(url) {
-	try {
-		return new URL(url).toString();
-	} catch (error) {
-		console.error(`Failed to normalize url: ${url}`, error);
-		return url;
+	function utf8ToBinaryString(str) {
+		return encodeURIComponent(str).replace(/%([0-9A-F]{2})/g, function(match, p1) {
+			return String.fromCharCode(parseInt(p1, 16));
+		});
+	}
+	var uint8ToUrlBase64 = (uint8) => {
+		let bin = "";
+		uint8.forEach(function(code) {
+			bin += String.fromCharCode(code);
+		});
+		return binToUrlBase64(bin);
+	};
+	function strToUrlBase64(str) {
+		return binToUrlBase64(utf8ToBinaryString(str));
 	}
-}
-//#endregion
-//#region src/utils/domains.ts
-function checkDomain(domains, endpoint) {
-	if (!endpoint) return;
-	if (!domains.find((domain) => {
-		let testable;
-		if (typeof domain === "string") testable = new RegExp(`^${domain}`);
-		else testable = domain;
-		return testable.test?.(endpoint);
-	})) throw new Error("Domain " + endpoint + " is not trusted, please add domain in " + scriptFilename);
-}
-var getDomains = (trustedDomain, type) => {
-	if (Array.isArray(trustedDomain)) return trustedDomain;
-	return trustedDomain[`${type}Domains`] ?? trustedDomain.domains ?? [];
-};
-var getCurrentDatabaseDomain = (database, url, trustedDomains) => {
-	if (url.endsWith("/.well-known/openid-configuration")) return null;
-	const datatases = [];
-	for (const [key, currentDatabase] of Object.entries(database)) {
-		const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;
-		if (!oidcServerConfiguration) continue;
-		if (oidcServerConfiguration.tokenEndpoint && url === normalizeUrl(oidcServerConfiguration.tokenEndpoint)) continue;
-		if (oidcServerConfiguration.revocationEndpoint && url === normalizeUrl(oidcServerConfiguration.revocationEndpoint)) continue;
-		const domains = getDomains(trustedDomains == null ? [] : trustedDomains[key.split("#")[0]], "accessToken");
-		const domainsToSendTokens = oidcServerConfiguration.userInfoEndpoint ? [normalizeUrl(oidcServerConfiguration.userInfoEndpoint), ...domains] : [...domains];
-		let hasToSendToken = false;
-		if (domainsToSendTokens.find((f) => f === "*")) hasToSendToken = true;
-		else for (let i = 0; i < domainsToSendTokens.length; i++) {
-			let domain = domainsToSendTokens[i];
-			if (typeof domain === "string") domain = new RegExp(`^${domain}`);
-			if (domain.test?.(url)) {
-				hasToSendToken = true;
+	var defaultDemonstratingProofOfPossessionConfiguration = {
+		importKeyAlgorithm: {
+			name: "ECDSA",
+			namedCurve: "P-256",
+			hash: { name: "ES256" }
+		},
+		signAlgorithm: {
+			name: "ECDSA",
+			hash: { name: "SHA-256" }
+		},
+		generateKeyAlgorithm: {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		},
+		digestAlgorithm: { name: "SHA-256" },
+		jwtHeaderAlgorithm: "ES256"
+	};
+	var sign = (w) => async (jwk, headers, claims, demonstratingProofOfPossessionConfiguration, jwtHeaderType = "dpop+jwt") => {
+		jwk = Object.assign({}, jwk);
+		headers.typ = jwtHeaderType;
+		headers.alg = demonstratingProofOfPossessionConfiguration.jwtHeaderAlgorithm;
+		switch (headers.alg) {
+			case "ES256":
+				headers.jwk = {
+					kty: jwk.kty,
+					crv: jwk.crv,
+					x: jwk.x,
+					y: jwk.y
+				};
 				break;
-			}
+			case "RS256":
+				headers.jwk = {
+					kty: jwk.kty,
+					n: jwk.n,
+					e: jwk.e,
+					kid: headers.kid
+				};
+				break;
+			default: throw new Error("Unknown or not implemented JWS algorithm");
 		}
-		if (hasToSendToken) {
-			if (currentDatabase.tokens) datatases.push(currentDatabase);
+		const jws = {
+			protected: strToUrlBase64(JSON.stringify(headers)),
+			payload: strToUrlBase64(JSON.stringify(claims))
+		};
+		const keyType = demonstratingProofOfPossessionConfiguration.importKeyAlgorithm;
+		const privateKey = await w.crypto.subtle.importKey("jwk", jwk, keyType, true, ["sign"]);
+		const data = strToUint8(`${jws.protected}.${jws.payload}`);
+		const signatureType = demonstratingProofOfPossessionConfiguration.signAlgorithm;
+		const signature = await w.crypto.subtle.sign(signatureType, privateKey, data);
+		jws.signature = uint8ToUrlBase64(new Uint8Array(signature));
+		return `${jws.protected}.${jws.payload}.${jws.signature}`;
+	};
+	var JWT = { sign };
+	var generate = (w) => async (generateKeyAlgorithm) => {
+		const keyType = generateKeyAlgorithm;
+		const key = await w.crypto.subtle.generateKey(keyType, true, ["sign", "verify"]);
+		return await w.crypto.subtle.exportKey("jwk", key.privateKey);
+	};
+	var neuter = (jwk) => {
+		const copy = Object.assign({}, jwk);
+		delete copy.d;
+		copy.key_ops = ["verify"];
+		return copy;
+	};
+	var EC = {
+		generate,
+		neuter
+	};
+	var thumbprint = (w) => async (jwk, digestAlgorithm) => {
+		let sortedPub;
+		switch (jwk.kty) {
+			case "EC":
+				sortedPub = "{\"crv\":\"CRV\",\"kty\":\"EC\",\"x\":\"X\",\"y\":\"Y\"}".replace("CRV", jwk.crv).replace("X", jwk.x).replace("Y", jwk.y);
+				break;
+			case "RSA":
+				sortedPub = "{\"e\":\"E\",\"kty\":\"RSA\",\"n\":\"N\"}".replace("E", jwk.e).replace("N", jwk.n);
+				break;
+			default: throw new Error("Unknown or not implemented JWK type");
 		}
+		const hash = await w.crypto.subtle.digest(digestAlgorithm, strToUint8(sortedPub));
+		return uint8ToUrlBase64(new Uint8Array(hash));
+	};
+	var JWK = { thumbprint };
+	var generateJwkAsync = (w) => async (generateKeyAlgorithm) => {
+		return await EC.generate(w)(generateKeyAlgorithm);
+	};
+	var generateJwtDemonstratingProofOfPossessionAsync = (w) => (demonstratingProofOfPossessionConfiguration) => async (jwk, method = "POST", url, extrasClaims = {}) => {
+		const target = new URL(url, w.location?.href);
+		target.search = "";
+		target.hash = "";
+		const claims = {
+			jti: btoa(w.crypto.randomUUID()),
+			htm: method,
+			htu: target.href,
+			iat: Math.round(Date.now() / 1e3),
+			...extrasClaims
+		};
+		const kid = await JWK.thumbprint(w)(jwk, demonstratingProofOfPossessionConfiguration.digestAlgorithm);
+		return await JWT.sign(w)(jwk, { kid }, claims, demonstratingProofOfPossessionConfiguration);
+	};
+	//#endregion
+	//#region src/crypto.ts
+	function textEncodeLite(str) {
+		const buf = new ArrayBuffer(str.length);
+		const bufView = new Uint8Array(buf);
+		for (let i = 0; i < str.length; i++) bufView[i] = str.charCodeAt(i);
+		return bufView;
 	}
-	return datatases;
-};
-//#endregion
-//#region src/utils/serializeHeaders.ts
-function serializeHeaders(headers) {
-	const headersObj = {};
-	for (const key of headers.keys()) {
-		const value = headers.get(key);
-		if (value !== null) headersObj[key] = value;
-	}
-	return headersObj;
-}
-//#endregion
-//#region src/utils/shouldBypassDestination.ts
-var bypassedDestinations = [
-	"image",
-	"font",
-	"media",
-	"document",
-	"iframe",
-	"script"
-];
-/**
-* Determines whether a fetch event should be bypassed (not intercepted by the service worker).
-* Navigation requests (mode === 'navigate') are never bypassed, even when their destination
-* is in the bypassed list, so that access tokens can be injected into new-tab navigations.
-*/
-var shouldBypassDestination = (destination, mode) => {
-	return bypassedDestinations.includes(destination) && mode !== "navigate";
-};
-//#endregion
-//#region src/utils/sleep.ts
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-//#endregion
-//#region src/utils/tokens.ts
-var parseJwt = (payload) => {
-	return JSON.parse(b64DecodeUnicode(payload.replaceAll(/-/g, "+").replaceAll(/_/g, "/")));
-};
-function b64DecodeUnicode(str) {
-	return decodeURIComponent(Array.prototype.map.call(atob(str), (c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join(""));
-}
-function computeTimeLeft(refreshTimeBeforeTokensExpirationInSecond, expiresAt) {
-	const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
-	return Math.round(expiresAt - refreshTimeBeforeTokensExpirationInSecond - currentTimeUnixSecond);
-}
-function isTokensValid(tokens) {
-	if (!tokens) return false;
-	return computeTimeLeft(0, tokens.expiresAt) > 0;
-}
-var extractTokenPayload = (token) => {
-	try {
-		if (!token) return null;
-		const parts = token.split(".");
-		return parts.length === 3 ? parseJwt(parts[1]) : null;
-	} catch (e) {
-		console.warn(e);
+	function base64urlOfHashOfASCIIEncodingAsync(code) {
+		return new Promise((resolve, reject) => {
+			crypto.subtle.digest("SHA-256", textEncodeLite(code)).then((buffer) => {
+				return resolve(uint8ToUrlBase64(new Uint8Array(buffer)));
+			}, (error) => reject(error));
+		});
 	}
-	return null;
-};
-var isTokensOidcValid = (tokens, nonce, oidcServerConfiguration) => {
-	if (tokens.idTokenPayload) {
-		const idTokenPayload = tokens.idTokenPayload;
-		if (idTokenPayload && oidcServerConfiguration.issuer !== idTokenPayload.iss) return {
-			isValid: false,
-			reason: `Issuer does not match (oidcServerConfiguration issuer) ${oidcServerConfiguration.issuer} !== (idTokenPayload issuer) ${idTokenPayload.iss}`
+	//#endregion
+	//#region src/dpop.ts
+	var isDpop = (trustedDomain) => {
+		if (Array.isArray(trustedDomain)) return false;
+		return trustedDomain.demonstratingProofOfPossession ?? false;
+	};
+	var getDpopConfiguration = (trustedDomain) => {
+		if (!isDpop(trustedDomain)) return null;
+		if (Array.isArray(trustedDomain)) return null;
+		return trustedDomain.demonstratingProofOfPossessionConfiguration ?? defaultDemonstratingProofOfPossessionConfiguration;
+	};
+	var getDpopOnlyWhenDpopHeaderPresent = (trustedDomain) => {
+		if (!isDpop(trustedDomain)) return null;
+		if (Array.isArray(trustedDomain)) return null;
+		return trustedDomain.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent ?? true;
+	};
+	//#endregion
+	//#region src/resource.ts
+	/** Worker-only resource refresh routing hint, removed before the provider request. */
+	var RESOURCE_TOKEN_REQUEST_HEADER = "x-oidc-resource";
+	/** Builds an isolated storage/worker context without creating another OIDC client. */
+	var getResourceContextName = (configurationName, resource) => `${configurationName}#resource=${encodeURIComponent(resource)}`;
+	/** Reads the exact resource identifier from an isolated context name. */
+	var getContextResource = (configurationName) => {
+		const index = configurationName.indexOf("#resource=");
+		return index < 0 ? void 0 : decodeURIComponent(configurationName.slice(index + 10));
+	};
+	/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */
+	var validateResourceIdentifier = (resource) => {
+		if (typeof resource !== "string" || !/^[a-z][a-z\d+.-]*:/i.test(resource) || resource.includes("#") || /\s/.test(resource)) throw new Error("A resource must be an absolute URI without whitespace or a fragment.");
+		new URL(resource);
+	};
+	var getApiUrl = (value) => {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash || /%2f|%5c/i.test(url.pathname)) throw new Error("API destinations must be HTTP(S) URLs without credentials, fragments, or encoded separators.");
+		return url;
+	};
+	var getApiPrefixUrl = (value) => {
+		const prefix = getApiUrl(value);
+		if (prefix.search) throw new Error("An API URL prefix must not contain a query.");
+		return prefix;
+	};
+	/** Prevents default-token fallback anywhere on an explicitly managed API origin. */
+	var isResourceOriginManaged = (configurations, destination) => {
+		const origin = getApiUrl(destination).origin;
+		return configurations?.some((configuration) => configuration.allowedUrlPrefixes.some((value) => getApiPrefixUrl(value).origin === origin)) ?? false;
+	};
+	/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */
+	var isResourceUrlAllowed = (configuration, destination) => {
+		const url = getApiUrl(destination);
+		return configuration.allowedUrlPrefixes.some((value) => {
+			const prefix = getApiPrefixUrl(value);
+			const path = prefix.pathname.replace(/\/+$/, "");
+			return url.origin === prefix.origin && (path === "" || url.pathname === path || url.pathname.startsWith(`${path}/`));
+		});
+	};
+	/** Validates and retrieves an explicitly registered resource. */
+	var getResourceConfiguration = (configurations, resource) => {
+		validateResourceIdentifier(resource);
+		const matches = configurations?.filter((configuration) => configuration.resource === resource) ?? [];
+		if (matches.length !== 1 || matches[0].allowedUrlPrefixes.length === 0) throw new Error("The resource must be registered exactly once with permitted API URL prefixes.");
+		for (const prefix of matches[0].allowedUrlPrefixes) isResourceUrlAllowed(matches[0], prefix);
+		return matches[0];
+	};
+	//#endregion
+	//#region src/tokenContexts.ts
+	var getTokenContextEntries = (database) => Object.entries(database).flatMap(([key, configuration]) => [[key, configuration], ...Object.entries(configuration.resourceEntries ?? {})]);
+	var getTokenContexts = (database) => getTokenContextEntries(database).map(([, configuration]) => configuration);
+	var getOrCreateResourceContext = (configuration, resource) => {
+		getResourceConfiguration(configuration.oidcConfiguration?.resources, resource);
+		configuration.resourceEntries ??= {};
+		const name = getResourceContextName(configuration.configurationName, resource);
+		configuration.resourceEntries[name] ??= {
+			...configuration,
+			configurationName: name,
+			resource,
+			parentConfiguration: configuration,
+			resourceEntries: void 0,
+			authorizationScope: void 0,
+			requestedScope: void 0,
+			demonstratingProofOfPossessionApiNonce: null,
+			refreshGrant: void 0,
+			tokens: null,
+			state: null,
+			codeVerifier: null,
+			nonce: null,
+			status: null,
+			hideAccessToken: true,
+			generation: 0
 		};
+		return configuration.resourceEntries[name];
+	};
+	//#endregion
+	//#region src/utils/normalizeUrl.ts
+	function normalizeUrl(url) {
+		try {
+			return new URL(url).toString();
+		} catch (error) {
+			console.error(`Failed to normalize url: ${url}`, error);
+			return url;
+		}
+	}
+	//#endregion
+	//#region src/utils/domains.ts
+	function checkDomain(domains, endpoint) {
+		if (!endpoint) return;
+		if (!domains.find((domain) => {
+			let testable;
+			if (typeof domain === "string") testable = new RegExp(`^${domain}`);
+			else testable = domain;
+			return testable.test?.(endpoint);
+		})) throw new Error("Domain " + endpoint + " is not trusted, please add domain in " + scriptFilename);
+	}
+	var getDomains = (trustedDomain, type) => {
+		if (Array.isArray(trustedDomain)) return trustedDomain;
+		return trustedDomain[`${type}Domains`] ?? trustedDomain.domains ?? [];
+	};
+	var getCurrentDatabaseDomain = (database, url, trustedDomains) => {
+		if (url.endsWith("/.well-known/openid-configuration")) return null;
+		const datatases = [];
+		for (const [key, currentDatabase] of getTokenContextEntries(database)) {
+			const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;
+			const resources = currentDatabase.oidcConfiguration?.resources;
+			if (currentDatabase.resource) {
+				if (!isResourceUrlAllowed(getResourceConfiguration(resources, currentDatabase.resource), url)) continue;
+			} else if (resources?.length && (!oidcServerConfiguration?.userInfoEndpoint || url !== normalizeUrl(oidcServerConfiguration.userInfoEndpoint)) && isResourceOriginManaged(resources, url)) continue;
+			if (!oidcServerConfiguration) continue;
+			if (oidcServerConfiguration.tokenEndpoint && url === normalizeUrl(oidcServerConfiguration.tokenEndpoint)) continue;
+			if (oidcServerConfiguration.revocationEndpoint && url === normalizeUrl(oidcServerConfiguration.revocationEndpoint)) continue;
+			const domains = getDomains(trustedDomains == null ? [] : trustedDomains[key.split("#")[0]], "accessToken");
+			const domainsToSendTokens = oidcServerConfiguration.userInfoEndpoint ? [normalizeUrl(oidcServerConfiguration.userInfoEndpoint), ...domains] : [...domains];
+			let hasToSendToken = false;
+			if (domainsToSendTokens.find((f) => f === "*")) hasToSendToken = true;
+			else for (let i = 0; i < domainsToSendTokens.length; i++) {
+				let domain = domainsToSendTokens[i];
+				if (typeof domain === "string") domain = new RegExp(`^${domain}`);
+				if (domain.test?.(url)) {
+					hasToSendToken = true;
+					break;
+				}
+			}
+			if (hasToSendToken) {
+				if (currentDatabase.tokens) datatases.push(currentDatabase);
+			}
+		}
+		return datatases;
+	};
+	//#endregion
+	//#region src/utils/serializeHeaders.ts
+	function serializeHeaders(headers) {
+		const headersObj = {};
+		for (const key of headers.keys()) {
+			const value = headers.get(key);
+			if (value !== null) headersObj[key] = value;
+		}
+		return headersObj;
+	}
+	//#endregion
+	//#region src/utils/shouldBypassDestination.ts
+	var bypassedDestinations = [
+		"image",
+		"font",
+		"media",
+		"document",
+		"iframe",
+		"script"
+	];
+	/**
+	* Determines whether a fetch event should be bypassed (not intercepted by the service worker).
+	* Navigation requests (mode === 'navigate') are never bypassed, even when their destination
+	* is in the bypassed list, so that access tokens can be injected into new-tab navigations.
+	*/
+	var shouldBypassDestination = (destination, mode) => {
+		return bypassedDestinations.includes(destination) && mode !== "navigate";
+	};
+	//#endregion
+	//#region src/utils/sleep.ts
+	var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+	//#endregion
+	//#region src/utils/tokens.ts
+	var parseJwt = (payload) => {
+		return JSON.parse(b64DecodeUnicode(payload.replaceAll(/-/g, "+").replaceAll(/_/g, "/")));
+	};
+	function b64DecodeUnicode(str) {
+		return decodeURIComponent(Array.prototype.map.call(atob(str), (c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join(""));
+	}
+	function computeTimeLeft(refreshTimeBeforeTokensExpirationInSecond, expiresAt) {
 		const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
-		if (idTokenPayload && idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) return {
-			isValid: false,
-			reason: `Token expired at (idTokenPayload exp) ${idTokenPayload.exp} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`
-		};
-		const timeInSevenDays = 604800;
-		if (idTokenPayload && idTokenPayload.iat && idTokenPayload.iat + timeInSevenDays < currentTimeUnixSecond) return {
-			isValid: false,
-			reason: `Token is used from too long time (idTokenPayload iat + timeInSevenDays) ${idTokenPayload.iat + timeInSevenDays} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`
-		};
-		if (idTokenPayload && nonce && idTokenPayload.nonce && idTokenPayload.nonce !== nonce) return {
-			isValid: false,
-			reason: `Nonce does not match (nonce) ${nonce} !== (idTokenPayload nonce) ${idTokenPayload.nonce}`
-		};
+		return Math.round(expiresAt - refreshTimeBeforeTokensExpirationInSecond - currentTimeUnixSecond);
 	}
-	return {
-		isValid: true,
-		reason: ""
-	};
-};
-function extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload) {
-	if (!tokens.issued_at) {
-		if (accessTokenPayload && accessTokenPayload.iat) return accessTokenPayload.iat;
-		else if (_idTokenPayload && _idTokenPayload.iat) return _idTokenPayload.iat;
-		else return (/* @__PURE__ */ new Date()).getTime() / 1e3;
-	} else if (typeof tokens.issued_at == "string") return parseInt(tokens.issued_at, 10);
-	return tokens.issued_at;
-}
-function _hideTokens(tokens, currentDatabaseElement, configurationName) {
-	if (!tokens.issued_at) tokens.issued_at = (/* @__PURE__ */ new Date()).getTime() / 1e3;
-	else if (typeof tokens.issued_at == "string") tokens.issued_at = parseInt(tokens.issued_at, 10);
-	const accessTokenPayload = extractTokenPayload(tokens.access_token);
-	const secureTokens = {
-		...tokens,
-		accessTokenPayload
-	};
-	if (currentDatabaseElement.hideAccessToken) secureTokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}`;
-	tokens.accessTokenPayload = accessTokenPayload;
-	const oldTokens = currentDatabaseElement.tokens;
-	let id_token;
-	if (oldTokens != null && "id_token" in oldTokens && !("id_token" in tokens)) id_token = oldTokens.id_token;
-	else id_token = tokens.id_token;
-	tokens.id_token = id_token;
-	let _idTokenPayload = null;
-	if (id_token) {
-		_idTokenPayload = extractTokenPayload(id_token);
-		tokens.idTokenPayload = _idTokenPayload != null ? { ..._idTokenPayload } : null;
-		if (_idTokenPayload && _idTokenPayload.nonce && currentDatabaseElement.nonce != null) {
-			const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabaseElement.configurationName}`;
-			_idTokenPayload.nonce = keyNonce;
+	function isTokensValid(tokens) {
+		if (!tokens) return false;
+		return computeTimeLeft(0, tokens.expiresAt) > 0;
+	}
+	var extractTokenPayload = (token) => {
+		try {
+			if (!token) return null;
+			const parts = token.split(".");
+			return parts.length === 3 ? parseJwt(parts[1]) : null;
+		} catch (e) {
+			console.warn(e);
 		}
-		secureTokens.idTokenPayload = _idTokenPayload;
+		return null;
+	};
+	var isTokensOidcValid = (tokens, nonce, oidcServerConfiguration) => {
+		if (tokens.idTokenPayload) {
+			const idTokenPayload = tokens.idTokenPayload;
+			if (idTokenPayload && oidcServerConfiguration.issuer !== idTokenPayload.iss) return {
+				isValid: false,
+				reason: `Issuer does not match (oidcServerConfiguration issuer) ${oidcServerConfiguration.issuer} !== (idTokenPayload issuer) ${idTokenPayload.iss}`
+			};
+			const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
+			if (idTokenPayload && idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) return {
+				isValid: false,
+				reason: `Token expired at (idTokenPayload exp) ${idTokenPayload.exp} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`
+			};
+			const timeInSevenDays = 604800;
+			if (idTokenPayload && idTokenPayload.iat && idTokenPayload.iat + timeInSevenDays < currentTimeUnixSecond) return {
+				isValid: false,
+				reason: `Token is used from too long time (idTokenPayload iat + timeInSevenDays) ${idTokenPayload.iat + timeInSevenDays} < (currentTimeUnixSecond) ${currentTimeUnixSecond}`
+			};
+			if (idTokenPayload && nonce && idTokenPayload.nonce && idTokenPayload.nonce !== nonce) return {
+				isValid: false,
+				reason: `Nonce does not match (nonce) ${nonce} !== (idTokenPayload nonce) ${idTokenPayload.nonce}`
+			};
+		}
+		return {
+			isValid: true,
+			reason: ""
+		};
+	};
+	function extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload) {
+		if (!tokens.issued_at) {
+			if (accessTokenPayload && accessTokenPayload.iat) return accessTokenPayload.iat;
+			else if (_idTokenPayload && _idTokenPayload.iat) return _idTokenPayload.iat;
+			else return (/* @__PURE__ */ new Date()).getTime() / 1e3;
+		} else if (typeof tokens.issued_at == "string") return parseInt(tokens.issued_at, 10);
+		return tokens.issued_at;
 	}
-	if (tokens.refresh_token) secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${configurationName}`;
-	tokens.issued_at = extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload);
-	const expireIn = typeof tokens.expires_in == "string" ? parseInt(tokens.expires_in, 10) : tokens.expires_in;
-	const idTokenExpiresAt = _idTokenPayload && _idTokenPayload.exp ? _idTokenPayload.exp : Number.MAX_VALUE;
-	const accessTokenExpiresAt = accessTokenPayload && accessTokenPayload.exp ? accessTokenPayload.exp : tokens.issued_at + expireIn;
-	let expiresAt;
-	const tokenRenewMode = currentDatabaseElement.oidcConfiguration.token_renew_mode;
-	if (tokenRenewMode === TokenRenewMode.access_token_invalid) expiresAt = accessTokenExpiresAt;
-	else if (tokenRenewMode === TokenRenewMode.id_token_invalid) expiresAt = idTokenExpiresAt;
-	else expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;
-	secureTokens.expiresAt = expiresAt;
-	tokens.expiresAt = expiresAt;
-	const { isValid, reason } = isTokensOidcValid(tokens, currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null, currentDatabaseElement.oidcServerConfiguration);
-	if (!isValid) throw Error(`Tokens are not OpenID valid, reason: ${reason}`);
-	if (oldTokens != null && "refresh_token" in oldTokens && !("refresh_token" in tokens)) {
-		const refreshToken = oldTokens.refresh_token;
-		currentDatabaseElement.tokens = {
+	function _hideTokens(tokens, currentDatabaseElement, configurationName, isAuthorizationCode = false) {
+		const hasNewIdToken = typeof tokens.id_token === "string" && tokens.id_token.length > 0;
+		const parent = currentDatabaseElement.parentConfiguration;
+		if (currentDatabaseElement.resource && currentDatabaseElement.refreshGrant === currentDatabaseElement && tokens.refresh_token && tokens.refresh_token === parent?.tokens?.refresh_token) throw new Error("The provider reused a refresh token across separate authorization transactions; use a multi-resource authorization grant instead.");
+		if (!tokens.issued_at) tokens.issued_at = (/* @__PURE__ */ new Date()).getTime() / 1e3;
+		else if (typeof tokens.issued_at == "string") tokens.issued_at = parseInt(tokens.issued_at, 10);
+		const accessTokenPayload = extractTokenPayload(tokens.access_token);
+		if (currentDatabaseElement.resource || currentDatabaseElement.oidcConfiguration?.resources?.length) tokens.scope ??= currentDatabaseElement.requestedScope ?? currentDatabaseElement.tokens?.scope ?? currentDatabaseElement.oidcConfiguration?.scope;
+		const secureTokens = {
 			...tokens,
-			refresh_token: refreshToken
+			accessTokenPayload
 		};
-	} else currentDatabaseElement.tokens = tokens;
-	currentDatabaseElement.status = "LOGGED_IN";
-	return secureTokens;
-}
-var demonstratingProofOfPossessionNonceResponseHeader = "DPoP-Nonce";
-function hideTokens(currentDatabaseElement) {
-	const configurationName = currentDatabaseElement.configurationName;
-	return (response) => {
-		if (response.status !== 200) return response;
-		const newHeaders = new Headers(response.headers);
-		if (response.headers.has(demonstratingProofOfPossessionNonceResponseHeader)) {
-			currentDatabaseElement.demonstratingProofOfPossessionNonce = response.headers.get(demonstratingProofOfPossessionNonceResponseHeader);
-			newHeaders.delete(demonstratingProofOfPossessionNonceResponseHeader);
+		if (currentDatabaseElement.hideAccessToken) secureTokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}`;
+		tokens.accessTokenPayload = accessTokenPayload;
+		const oldTokens = currentDatabaseElement.tokens;
+		let id_token;
+		if (oldTokens != null && "id_token" in oldTokens && !("id_token" in tokens)) id_token = oldTokens.id_token;
+		else id_token = tokens.id_token;
+		tokens.id_token = id_token;
+		let _idTokenPayload = null;
+		if (id_token) {
+			_idTokenPayload = extractTokenPayload(id_token);
+			tokens.idTokenPayload = _idTokenPayload != null ? { ..._idTokenPayload } : null;
+			if (_idTokenPayload && _idTokenPayload.nonce && currentDatabaseElement.nonce != null) {
+				const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabaseElement.configurationName}`;
+				_idTokenPayload.nonce = keyNonce;
+			}
+			secureTokens.idTokenPayload = currentDatabaseElement.resource && !hasNewIdToken ? null : _idTokenPayload;
+		}
+		if (currentDatabaseElement.resource && isAuthorizationCode && (!hasNewIdToken || typeof tokens.idTokenPayload?.sub !== "string" || !tokens.idTokenPayload.sub || currentDatabaseElement.nonce && tokens.idTokenPayload.nonce !== currentDatabaseElement.nonce.nonce)) throw new Error("Resource authorization requires a fresh ID token with the expected subject and nonce.");
+		if (tokens.refresh_token) secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${(currentDatabaseElement.refreshGrant ?? currentDatabaseElement).configurationName}`;
+		tokens.issued_at = extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload);
+		const expireIn = typeof tokens.expires_in == "string" ? parseInt(tokens.expires_in, 10) : tokens.expires_in;
+		const idTokenExpiresAt = _idTokenPayload && _idTokenPayload.exp ? _idTokenPayload.exp : Number.MAX_VALUE;
+		const accessTokenExpiresAt = accessTokenPayload && accessTokenPayload.exp ? accessTokenPayload.exp : tokens.issued_at + expireIn;
+		let expiresAt;
+		const tokenRenewMode = currentDatabaseElement.resource ? TokenRenewMode.access_token_invalid : currentDatabaseElement.oidcConfiguration.token_renew_mode;
+		if (tokenRenewMode === TokenRenewMode.access_token_invalid) expiresAt = accessTokenExpiresAt;
+		else if (tokenRenewMode === TokenRenewMode.id_token_invalid) expiresAt = idTokenExpiresAt;
+		else expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;
+		secureTokens.expiresAt = expiresAt;
+		tokens.expiresAt = expiresAt;
+		const nonce = currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null;
+		const { isValid, reason } = isTokensOidcValid(currentDatabaseElement.resource && !hasNewIdToken ? {
+			...tokens,
+			idTokenPayload: void 0
+		} : tokens, nonce, currentDatabaseElement.oidcServerConfiguration);
+		if (!isValid) throw Error(`Tokens are not OpenID valid, reason: ${reason}`);
+		if (currentDatabaseElement.resource) {
+			if (typeof tokens.access_token !== "string" || !tokens.access_token || !Number.isFinite(expiresAt) || !Number.isFinite(tokens.issued_at) || tokens.refresh_token != null && (typeof tokens.refresh_token !== "string" || !tokens.refresh_token)) throw new Error("The provider did not return a usable resource token response.");
+			const resource = getResourceConfiguration(currentDatabaseElement.oidcConfiguration?.resources, currentDatabaseElement.resource);
+			tokens.scope ??= currentDatabaseElement.requestedScope ?? resource.scope ?? currentDatabaseElement.oidcConfiguration?.scope;
+			secureTokens.scope = tokens.scope;
+			if (resource.scope && !resource.scope.split(/\s+/).filter(Boolean).every((scope) => (tokens.scope ?? "").split(/\s+/).includes(scope))) throw new Error("The provider did not grant the required resource scopes.");
+			const parentSubject = currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;
+			const subject = tokens.idTokenPayload?.sub ?? oldTokens?.idTokenPayload?.sub ?? parentSubject;
+			if (typeof parentSubject !== "string" || subject !== parentSubject) throw new Error("Resource authorization must preserve the authenticated subject.");
+			if (accessTokenPayload?.iss !== void 0 && accessTokenPayload.iss !== currentDatabaseElement.oidcServerConfiguration?.issuer || accessTokenPayload && resource.audiences && !resource.audiences.some((audience) => (typeof accessTokenPayload.aud === "string" ? [accessTokenPayload.aud] : accessTokenPayload.aud ?? []).includes(audience))) throw new Error("Resource token issuer or configured audience does not match.");
+		}
+		if (oldTokens != null && "refresh_token" in oldTokens && !("refresh_token" in tokens)) {
+			const refreshToken = oldTokens.refresh_token;
+			currentDatabaseElement.tokens = {
+				...tokens,
+				refresh_token: refreshToken
+			};
+		} else currentDatabaseElement.tokens = tokens;
+		currentDatabaseElement.status = "LOGGED_IN";
+		if (currentDatabaseElement.resource) {
+			const grant = currentDatabaseElement.refreshGrant ?? currentDatabaseElement;
+			const subject = tokens.idTokenPayload?.sub ?? grant.tokens?.idTokenPayload?.sub ?? currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;
+			if (typeof subject !== "string") throw new Error("Resource tokens require an authenticated OIDC subject.");
+			if (grant !== currentDatabaseElement && tokens.refresh_token && grant.tokens) grant.tokens.refresh_token = tokens.refresh_token;
+			const resourceContext = {
+				resource: currentDatabaseElement.resource,
+				issuer: currentDatabaseElement.oidcServerConfiguration.issuer,
+				clientId: currentDatabaseElement.oidcConfiguration.client_id,
+				configurationName: currentDatabaseElement.configurationName.split("#")[0],
+				subject,
+				grantResource: grant.resource ?? null
+			};
+			currentDatabaseElement.tokens.resourceContext = resourceContext;
+			secureTokens.resourceContext = resourceContext;
 		}
-		return response.json().then((tokens) => {
-			const secureTokens = _hideTokens(tokens, currentDatabaseElement, configurationName);
-			const body = JSON.stringify(secureTokens);
-			return new Response(body, {
-				status: response.status,
-				statusText: response.statusText,
-				headers: newHeaders
+		return secureTokens;
+	}
+	var demonstratingProofOfPossessionNonceResponseHeader = "DPoP-Nonce";
+	function hideTokens(currentDatabaseElement, isCurrent = () => true, isGrantCurrent = isCurrent, isAuthorizationCode = false) {
+		const configurationName = currentDatabaseElement.configurationName;
+		return (response) => {
+			if (response.status !== 200) return response;
+			const newHeaders = new Headers(response.headers);
+			if (response.headers.has(demonstratingProofOfPossessionNonceResponseHeader) && isGrantCurrent()) {
+				currentDatabaseElement.demonstratingProofOfPossessionNonce = response.headers.get(demonstratingProofOfPossessionNonceResponseHeader);
+				if (currentDatabaseElement.refreshGrant && currentDatabaseElement.refreshGrant !== currentDatabaseElement) currentDatabaseElement.refreshGrant.demonstratingProofOfPossessionNonce = currentDatabaseElement.demonstratingProofOfPossessionNonce;
+				newHeaders.delete(demonstratingProofOfPossessionNonceResponseHeader);
+			}
+			return response.json().then((tokens) => {
+				const grant = currentDatabaseElement.refreshGrant;
+				if (currentDatabaseElement.resource && grant && isGrantCurrent() && grant.tokens && typeof tokens.refresh_token === "string" && tokens.refresh_token && (grant !== currentDatabaseElement || tokens.refresh_token !== currentDatabaseElement.parentConfiguration?.tokens?.refresh_token)) grant.tokens.refresh_token = tokens.refresh_token;
+				if (!isCurrent()) throw new Error("The token transaction was cleared before its response.");
+				const secureTokens = _hideTokens(tokens, currentDatabaseElement, configurationName, isAuthorizationCode);
+				const body = JSON.stringify(secureTokens);
+				return new Response(body, {
+					status: response.status,
+					statusText: response.statusText,
+					headers: newHeaders
+				});
 			});
+		};
+	}
+	//#endregion
+	//#region src/utils/waitForValidTokens.ts
+	var TOKEN_RENEWAL_TIMEOUT_MS = 5e3;
+	/**
+	* Polls until the tokens in the given config are valid, or until a timeout elapses.
+	*
+	* @returns `null` when tokens become valid; a synthetic 401 `Response` on timeout or
+	*          when the tokens are cleared while waiting (e.g. due to a parallel logout).
+	*/
+	async function waitForValidTokens(config, maxWaitMs = TOKEN_RENEWAL_TIMEOUT_MS, pollIntervalMs = 200) {
+		const startTime = Date.now();
+		while (config.tokens && !isTokensValid(config.tokens)) {
+			if (Date.now() - startTime >= maxWaitMs) return new Response(null, {
+				status: 401,
+				statusText: "Token expired - service worker renewal timeout"
+			});
+			await sleep(pollIntervalMs);
+		}
+		if (!config.tokens?.access_token) return new Response(null, {
+			status: 401,
+			statusText: "Missing access token"
 		});
+		return null;
+	}
+	//#endregion
+	//#region src/oidcConfig.ts
+	var getOidcServerUrls = (oidcServerConfiguration) => {
+		return [
+			oidcServerConfiguration.issuer,
+			oidcServerConfiguration.authorizationEndpoint,
+			oidcServerConfiguration.tokenEndpoint,
+			oidcServerConfiguration.revocationEndpoint,
+			oidcServerConfiguration.userInfoEndpoint
+		].filter(Boolean).map(normalizeUrl);
 	};
-}
-//#endregion
-//#region src/utils/waitForValidTokens.ts
-var TOKEN_RENEWAL_TIMEOUT_MS = 5e3;
-/**
-* Polls until the tokens in the given config are valid, or until a timeout elapses.
-*
-* @returns `null` when tokens become valid; a synthetic 401 `Response` on timeout or
-*          when the tokens are cleared while waiting (e.g. due to a parallel logout).
-*/
-async function waitForValidTokens(config, maxWaitMs = TOKEN_RENEWAL_TIMEOUT_MS, pollIntervalMs = 200) {
-	const startTime = Date.now();
-	while (config.tokens && !isTokensValid(config.tokens)) {
-		if (Date.now() - startTime >= maxWaitMs) return new Response(null, {
-			status: 401,
-			statusText: "Token expired - service worker renewal timeout"
+	var isOidcServerRequest = (database, normalizedUrl) => {
+		return Object.values(database).some((config) => {
+			const { oidcServerConfiguration } = config || {};
+			if (!oidcServerConfiguration) return false;
+			return getOidcServerUrls(oidcServerConfiguration).some((oidcUrl) => normalizedUrl.startsWith(oidcUrl));
+		});
+	};
+	var isDomainMatchingUrl = (domain, normalizedUrl) => {
+		if (typeof domain === "string") domain = new RegExp(`^${domain}`);
+		return domain.test?.(normalizedUrl) ?? false;
+	};
+	var isAccessTokenDomainRequest = (database, normalizedUrl, trustedDomains) => {
+		return Object.entries(database).some(([key, currentDatabase]) => {
+			if (!currentDatabase.oidcServerConfiguration) return false;
+			const domains = getDomains(trustedDomains?.[key.split("#")[0]] ?? [], "accessToken");
+			if (domains.some((domain) => domain === "*")) return true;
+			return domains.some((domain) => isDomainMatchingUrl(domain, normalizedUrl));
 		});
-		await sleep(pollIntervalMs);
+	};
+	var shouldBypassNonOidcRequest = (database, normalizedUrl, trustedDomains) => {
+		const configurations = Object.values(database);
+		if (configurations.length === 0) return false;
+		if (!configurations.every((config) => config.bypassAllNonOidcRequests)) return false;
+		if (!configurations.every((config) => config.oidcServerConfiguration != null)) return false;
+		return !isOidcServerRequest(database, normalizedUrl) && !isAccessTokenDomainRequest(database, normalizedUrl, trustedDomains);
+	};
+	var getMatchingOidcConfigurations = (database, url) => {
+		const normalizedUrl = normalizeUrl(url);
+		return getTokenContexts(database).filter((config) => {
+			const { oidcServerConfiguration } = config || {};
+			const { tokenEndpoint, revocationEndpoint } = oidcServerConfiguration || {};
+			return tokenEndpoint && normalizedUrl.startsWith(normalizeUrl(tokenEndpoint)) || revocationEndpoint && normalizedUrl.startsWith(normalizeUrl(revocationEndpoint));
+		});
+	};
+	//#endregion
+	//#region src/utils/codeVerifier.ts
+	function replaceCodeVerifier(codeVerifier, newCodeVerifier) {
+		return codeVerifier.replace(/[?&]code_verifier=([^&]+)/i, `&code_verifier=${newCodeVerifier}`);
 	}
-	if (!config.tokens?.access_token) return new Response(null, {
-		status: 401,
-		statusText: "Missing access token"
-	});
-	return null;
-}
-//#endregion
-//#region src/oidcConfig.ts
-var getOidcServerUrls = (oidcServerConfiguration) => {
-	return [
-		oidcServerConfiguration.issuer,
-		oidcServerConfiguration.authorizationEndpoint,
-		oidcServerConfiguration.tokenEndpoint,
-		oidcServerConfiguration.revocationEndpoint,
-		oidcServerConfiguration.userInfoEndpoint
-	].filter(Boolean).map(normalizeUrl);
-};
-var isOidcServerRequest = (database, normalizedUrl) => {
-	return Object.values(database).some((config) => {
-		const { oidcServerConfiguration } = config || {};
-		if (!oidcServerConfiguration) return false;
-		return getOidcServerUrls(oidcServerConfiguration).some((oidcUrl) => normalizedUrl.startsWith(oidcUrl));
-	});
-};
-var isDomainMatchingUrl = (domain, normalizedUrl) => {
-	if (typeof domain === "string") domain = new RegExp(`^${domain}`);
-	return domain.test?.(normalizedUrl) ?? false;
-};
-var isAccessTokenDomainRequest = (database, normalizedUrl, trustedDomains) => {
-	return Object.entries(database).some(([key, currentDatabase]) => {
-		if (!currentDatabase.oidcServerConfiguration) return false;
-		const domains = getDomains(trustedDomains?.[key.split("#")[0]] ?? [], "accessToken");
-		if (domains.some((domain) => domain === "*")) return true;
-		return domains.some((domain) => isDomainMatchingUrl(domain, normalizedUrl));
-	});
-};
-var shouldBypassNonOidcRequest = (database, normalizedUrl, trustedDomains) => {
-	const configurations = Object.values(database);
-	if (configurations.length === 0) return false;
-	if (!configurations.every((config) => config.bypassAllNonOidcRequests)) return false;
-	if (!configurations.every((config) => config.oidcServerConfiguration != null)) return false;
-	return !isOidcServerRequest(database, normalizedUrl) && !isAccessTokenDomainRequest(database, normalizedUrl, trustedDomains);
-};
-var getMatchingOidcConfigurations = (database, url) => {
-	const normalizedUrl = normalizeUrl(url);
-	return Object.values(database).filter((config) => {
-		const { oidcServerConfiguration } = config || {};
-		const { tokenEndpoint, revocationEndpoint } = oidcServerConfiguration || {};
-		return tokenEndpoint && normalizedUrl.startsWith(normalizeUrl(tokenEndpoint)) || revocationEndpoint && normalizedUrl.startsWith(normalizeUrl(revocationEndpoint));
-	});
-};
-//#endregion
-//#region src/utils/codeVerifier.ts
-function replaceCodeVerifier(codeVerifier, newCodeVerifier) {
-	return codeVerifier.replace(/[?&]code_verifier=([^&]+)/i, `&code_verifier=${newCodeVerifier}`);
-}
-var extractConfigurationNameFromCodeVerifier = (body) => {
-	const match = body.match(/[?&]code_verifier=CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER_([^&]+)/);
-	return match ? decodeURIComponent(match[1]) : "";
-};
-//#endregion
-//#region src/version.ts
-var version_default = "7.29.8";
-//#endregion
-//#region src/OidcServiceWorker.ts
-if (typeof trustedTypes !== "undefined" && typeof trustedTypes.createPolicy === "function") trustedTypes.createPolicy("default", { createScriptURL: function(url) {
-	if (url === "OidcTrustedDomains.js") return url;
-	else throw new Error("Untrusted script URL blocked: " + url);
-} });
-var _self = self;
-_self.importScripts(scriptFilename);
-var id = Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3).toString();
-console.log("init service worker with id", id);
-var keepAliveJsonFilename = "OidcKeepAliveServiceWorker.json";
-var database = {};
-/**
-* Keeps the service worker alive by responding with a cached response after a sleep.
-*/
-var keepAliveAsync = async (event) => {
-	const originalRequest = event.request;
-	const isFromVanilla = originalRequest.headers.has("oidc-vanilla");
-	const response = new Response("{}", {
-		status: 200,
-		statusText: "oidc-service-worker"
-	});
-	if (!isFromVanilla) {
-		const originalRequestUrl = new URL(originalRequest.url);
-		const minSleepSeconds = Number(originalRequestUrl.searchParams.get("minSleepSeconds")) || 240;
-		for (let i = 0; i < minSleepSeconds; i++) {
-			await sleep(1e3 + Math.floor(Math.random() * 1e3));
-			await (await caches.open("oidc_dummy_cache")).put(event.request, response.clone());
+	var extractConfigurationNameFromCodeVerifier = (body) => {
+		const match = body.match(/[?&]code_verifier=CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER_([^&]+)/);
+		return match ? decodeURIComponent(match[1]) : "";
+	};
+	//#endregion
+	//#region src/version.ts
+	var version_default = "7.30.0";
+	//#endregion
+	//#region src/OidcServiceWorker.ts
+	if (typeof trustedTypes !== "undefined" && typeof trustedTypes.createPolicy === "function") trustedTypes.createPolicy("default", { createScriptURL: function(url) {
+		if (url === "OidcTrustedDomains.js") return url;
+		else throw new Error("Untrusted script URL blocked: " + url);
+	} });
+	var _self = self;
+	_self.importScripts(scriptFilename);
+	var id = Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3).toString();
+	console.log("init service worker with id", id);
+	var keepAliveJsonFilename = "OidcKeepAliveServiceWorker.json";
+	var database = {};
+	/**
+	* Keeps the service worker alive by responding with a cached response after a sleep.
+	*/
+	var keepAliveAsync = async (event) => {
+		const originalRequest = event.request;
+		const isFromVanilla = originalRequest.headers.has("oidc-vanilla");
+		const response = new Response("{}", {
+			status: 200,
+			statusText: "oidc-service-worker"
+		});
+		if (!isFromVanilla) {
+			const originalRequestUrl = new URL(originalRequest.url);
+			const minSleepSeconds = Number(originalRequestUrl.searchParams.get("minSleepSeconds")) || 240;
+			for (let i = 0; i < minSleepSeconds; i++) {
+				await sleep(1e3 + Math.floor(Math.random() * 1e3));
+				await (await caches.open("oidc_dummy_cache")).put(event.request, response.clone());
+			}
 		}
+		return response;
+	};
+	/**
+	* Generates DPoP headers when a DPoP configuration is present.
+	*/
+	async function generateDpopAsync(originalRequest, currentDatabase, url, extrasClaims = {}) {
+		const headersExtras = serializeHeaders(originalRequest.headers);
+		if (currentDatabase?.demonstratingProofOfPossessionConfiguration && currentDatabase.demonstratingProofOfPossessionJwkJson && (!currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent || currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent && headersExtras.dpop)) {
+			const dpopConfiguration = currentDatabase.demonstratingProofOfPossessionConfiguration;
+			const jwk = currentDatabase.demonstratingProofOfPossessionJwkJson;
+			const method = originalRequest.method;
+			const resourceNonce = currentDatabase.resource ? url === normalizeUrl(currentDatabase.oidcServerConfiguration.tokenEndpoint) ? currentDatabase.demonstratingProofOfPossessionNonce : currentDatabase.demonstratingProofOfPossessionApiNonce : void 0;
+			headersExtras.dpop = await generateJwtDemonstratingProofOfPossessionAsync(self)(dpopConfiguration)(jwk, method, url, {
+				...extrasClaims,
+				...resourceNonce ? { nonce: resourceNonce } : {}
+			});
+			const nonceHeader = resourceNonce ?? (!currentDatabase.resource ? currentDatabase.demonstratingProofOfPossessionNonce : void 0);
+			if (nonceHeader) headersExtras.nonce = nonceHeader;
+		}
+		return headersExtras;
 	}
-	return response;
-};
-/**
-* Generates DPoP headers when a DPoP configuration is present.
-*/
-async function generateDpopAsync(originalRequest, currentDatabase, url, extrasClaims = {}) {
-	const headersExtras = serializeHeaders(originalRequest.headers);
-	if (currentDatabase?.demonstratingProofOfPossessionConfiguration && currentDatabase.demonstratingProofOfPossessionJwkJson && (!currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent || currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent && headersExtras.dpop)) {
-		const dpopConfiguration = currentDatabase.demonstratingProofOfPossessionConfiguration;
-		const jwk = currentDatabase.demonstratingProofOfPossessionJwkJson;
-		const method = originalRequest.method;
-		headersExtras.dpop = await generateJwtDemonstratingProofOfPossessionAsync(self)(dpopConfiguration)(jwk, method, url, extrasClaims);
-		if (currentDatabase.demonstratingProofOfPossessionNonce != null) headersExtras.nonce = currentDatabase.demonstratingProofOfPossessionNonce;
-	}
-	return headersExtras;
-}
-/**
-* Intercepts fetch requests to inject access tokens and handle token endpoints.
-*/
-var handleFetch = (event) => {
 	/**
-	* Exit early for requests that do not need to have an auth token attached.
+	* Intercepts fetch requests to inject access tokens and handle token endpoints.
 	*/
-	if (shouldBypassDestination(event.request.destination, event.request.mode)) return;
-	const normalizedUrl = normalizeUrl(event.request.url);
-	if (!normalizedUrl.includes(keepAliveJsonFilename) && shouldBypassNonOidcRequest(database, normalizedUrl, trustedDomains)) return;
-	event.respondWith((async () => {
-		try {
-			const originalRequest = event.request;
-			const url = normalizedUrl;
-			if (url.includes(keepAliveJsonFilename)) return keepAliveAsync(event);
-			const currentDatabasesForRequestAccessToken = getCurrentDatabaseDomain(database, url, trustedDomains);
-			const authorization = originalRequest.headers.get("authorization");
-			let authenticationMode = "Bearer";
-			let key = "default";
-			if (authorization) {
-				const split = authorization.split(" ");
-				authenticationMode = split[0];
-				if (split[1]?.includes("ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_")) key = split[1].split("ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_")[1];
-			}
-			const currentDatabaseForRequestAccessToken = currentDatabasesForRequestAccessToken?.find((c) => c.configurationName.endsWith(key));
-			if (currentDatabaseForRequestAccessToken?.tokens?.access_token) {
-				const tokenError = await waitForValidTokens(currentDatabaseForRequestAccessToken);
-				if (tokenError) return tokenError;
-				let requestMode = originalRequest.mode;
-				if (originalRequest.mode !== "navigate" && currentDatabaseForRequestAccessToken.convertAllRequestsToCorsExceptNavigate) requestMode = "cors";
-				let headers;
-				if (originalRequest.mode === "navigate" && !currentDatabaseForRequestAccessToken.setAccessTokenToNavigateRequests) headers = { ...serializeHeaders(originalRequest.headers) };
-				else if (authenticationMode.toLowerCase() === "dpop" || !currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent && currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionConfiguration) headers = {
-					...await generateDpopAsync(originalRequest, currentDatabaseForRequestAccessToken, url, { ath: await base64urlOfHashOfASCIIEncodingAsync(currentDatabaseForRequestAccessToken.tokens.access_token) }),
-					authorization: `DPoP ${currentDatabaseForRequestAccessToken.tokens.access_token}`
-				};
-				else headers = {
-					...serializeHeaders(originalRequest.headers),
-					authorization: `${authenticationMode} ${currentDatabaseForRequestAccessToken.tokens.access_token}`
-				};
-				let init;
-				if (originalRequest.mode === "navigate") init = { headers };
-				else init = {
-					headers,
-					mode: requestMode
-				};
-				const newRequest = new Request(originalRequest, init);
-				return fetch(newRequest);
-			}
-			if (event.request.method !== "POST") return fetch(originalRequest);
-			const currentDatabases = getMatchingOidcConfigurations(database, url);
-			const numberDatabase = currentDatabases.length;
-			if (numberDatabase > 0) return new Promise((resolve, reject) => {
-				const clonedRequest = originalRequest.clone();
-				clonedRequest.text().then(async (actualBody) => {
-					let currentDatabase = null;
-					try {
-						if (actualBody.includes(TOKEN.REFRESH_TOKEN) || actualBody.includes(TOKEN.ACCESS_TOKEN)) {
-							let headers = serializeHeaders(originalRequest.headers);
-							let newBody = actualBody;
-							for (let i = 0; i < numberDatabase; i++) {
-								const currentDb = currentDatabases[i];
-								if (currentDb?.tokens) {
-									const claimsExtras = { ath: await base64urlOfHashOfASCIIEncodingAsync(currentDb.tokens.access_token) };
-									headers = await generateDpopAsync(originalRequest, currentDb, url, claimsExtras);
-									const keyRefreshToken = encodeURIComponent(`${TOKEN.REFRESH_TOKEN}_${currentDb.configurationName}`);
-									if (actualBody.includes(keyRefreshToken)) {
-										newBody = newBody.replace(keyRefreshToken, encodeURIComponent(currentDb.tokens.refresh_token));
-										currentDatabase = currentDb;
-										break;
-									}
-									const keyAccessToken = encodeURIComponent(`${TOKEN.ACCESS_TOKEN}_${currentDb.configurationName}`);
-									if (actualBody.includes(keyAccessToken)) {
-										newBody = newBody.replace(keyAccessToken, encodeURIComponent(currentDb.tokens.access_token));
-										currentDatabase = currentDb;
-										break;
+	var handleFetch = (event) => {
+		/**
+		* Exit early for requests that do not need to have an auth token attached.
+		*/
+		if (shouldBypassDestination(event.request.destination, event.request.mode)) return;
+		const normalizedUrl = normalizeUrl(event.request.url);
+		if (!normalizedUrl.includes(keepAliveJsonFilename) && shouldBypassNonOidcRequest(database, normalizedUrl, trustedDomains)) return;
+		event.respondWith((async () => {
+			try {
+				const originalRequest = event.request;
+				const url = normalizedUrl;
+				if (url.includes(keepAliveJsonFilename)) return keepAliveAsync(event);
+				const currentDatabasesForRequestAccessToken = getCurrentDatabaseDomain(database, url, trustedDomains);
+				const authorization = originalRequest.headers.get("authorization");
+				let authenticationMode = "Bearer";
+				let key = "default";
+				if (authorization) {
+					const split = authorization.split(" ");
+					authenticationMode = split[0];
+					if (split[1]?.includes("ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_")) key = split[1].split("ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER_")[1];
+				}
+				const currentDatabaseForRequestAccessToken = currentDatabasesForRequestAccessToken?.find((c) => key.includes("#resource=") ? c.configurationName === key : !c.resource && c.configurationName.endsWith(key));
+				if (key.includes("#resource=") && !currentDatabaseForRequestAccessToken) {
+					console.error("[OidcServiceWorker] Resource token destination or context is not permitted.");
+					return new Response("Resource token destination or context is not permitted.", { status: 403 });
+				}
+				if (currentDatabaseForRequestAccessToken?.tokens?.access_token) {
+					const tokenError = await waitForValidTokens(currentDatabaseForRequestAccessToken);
+					if (tokenError) return tokenError;
+					const accessToken = currentDatabaseForRequestAccessToken.tokens.access_token;
+					const generation = currentDatabaseForRequestAccessToken.generation;
+					const parentGeneration = currentDatabaseForRequestAccessToken.parentConfiguration?.generation;
+					let requestMode = originalRequest.mode;
+					if (originalRequest.mode !== "navigate" && currentDatabaseForRequestAccessToken.convertAllRequestsToCorsExceptNavigate) requestMode = "cors";
+					let headers;
+					if (originalRequest.mode === "navigate" && !currentDatabaseForRequestAccessToken.setAccessTokenToNavigateRequests) headers = { ...serializeHeaders(originalRequest.headers) };
+					else if (authenticationMode.toLowerCase() === "dpop" || !currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent && currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionConfiguration) headers = {
+						...await generateDpopAsync(originalRequest, currentDatabaseForRequestAccessToken, url, { ath: await base64urlOfHashOfASCIIEncodingAsync(accessToken) }),
+						authorization: `DPoP ${accessToken}`
+					};
+					else headers = {
+						...serializeHeaders(originalRequest.headers),
+						authorization: `${authenticationMode} ${accessToken}`
+					};
+					let init;
+					if (originalRequest.mode === "navigate") init = { headers };
+					else init = {
+						headers,
+						mode: requestMode
+					};
+					const newRequest = new Request(originalRequest, init);
+					if (currentDatabaseForRequestAccessToken.resource && (currentDatabaseForRequestAccessToken.generation !== generation || currentDatabaseForRequestAccessToken.parentConfiguration?.generation !== parentGeneration || currentDatabaseForRequestAccessToken.tokens?.access_token !== accessToken)) {
+						console.error("[OidcServiceWorker] The resource token changed before dispatch.");
+						return new Response("The resource token changed before dispatch.", { status: 403 });
+					}
+					const response = await fetch(newRequest, currentDatabaseForRequestAccessToken.resource ? { redirect: "error" } : void 0);
+					if (currentDatabaseForRequestAccessToken.resource && currentDatabaseForRequestAccessToken.generation === generation && currentDatabaseForRequestAccessToken.parentConfiguration?.generation === parentGeneration && response.headers.has("DPoP-Nonce")) currentDatabaseForRequestAccessToken.demonstratingProofOfPossessionApiNonce = response.headers.get("DPoP-Nonce");
+					return response;
+				}
+				if (event.request.method !== "POST") return fetch(originalRequest);
+				const currentDatabases = getMatchingOidcConfigurations(database, url);
+				const numberDatabase = currentDatabases.length;
+				if (numberDatabase > 0) return await new Promise((resolve, reject) => {
+					const clonedRequest = originalRequest.clone();
+					clonedRequest.text().then(async (actualBody) => {
+						let currentDatabase = null;
+						try {
+							if (actualBody.includes(TOKEN.REFRESH_TOKEN) || actualBody.includes(TOKEN.ACCESS_TOKEN)) {
+								let headers = serializeHeaders(originalRequest.headers);
+								let newBody = actualBody;
+								for (let i = 0; i < numberDatabase; i++) {
+									const currentDb = currentDatabases[i];
+									if (currentDb?.tokens) {
+										const claimsExtras = { ath: await base64urlOfHashOfASCIIEncodingAsync(currentDb.tokens.access_token) };
+										const keyRefreshToken = encodeURIComponent(`${TOKEN.REFRESH_TOKEN}_${currentDb.configurationName}`);
+										if ([new URLSearchParams(actualBody).get("refresh_token"), new URLSearchParams(actualBody).get("token")].includes(decodeURIComponent(keyRefreshToken))) {
+											const form = new URLSearchParams(actualBody);
+											const selected = form.getAll("resource");
+											const resourceHeader = originalRequest.headers.get(RESOURCE_TOKEN_REQUEST_HEADER);
+											if (currentDb.oidcServerConfiguration?.revocationEndpoint && url === normalizeUrl(currentDb.oidcServerConfiguration.revocationEndpoint) && form.has("token")) currentDatabase = currentDb;
+											else if (resourceHeader !== null) {
+												const resource = decodeURIComponent(resourceHeader);
+												if (selected.length !== 1 || selected[0] !== resource) throw new Error("The resource routing hint must match the request.");
+												if (!currentDb.oidcConfiguration) throw new Error("The resource grant configuration is unavailable.");
+												const resourceConfiguration = getResourceConfiguration(currentDb.oidcConfiguration.resources, resource);
+												const grantedScope = currentDb.tokens.scope ?? currentDb.authorizationScope ?? currentDb.oidcConfiguration.scope;
+												if ([form.get("scope"), resourceConfiguration.scope].filter((scope) => typeof scope === "string").some((scope) => !scope.split(/\s+/).filter(Boolean).every((value) => grantedScope?.split(/\s+/).includes(value)))) throw new Error("The resource scope is outside this refresh grant.");
+												if (currentDb.resource !== void 0 ? currentDb.resource !== resource : !(typeof currentDb.oidcConfiguration.resource === "string" ? [currentDb.oidcConfiguration.resource] : currentDb.oidcConfiguration.resource ?? []).includes(resource)) throw new Error("The resource is outside this refresh grant.");
+												currentDatabase = currentDb.resource ? currentDb : getOrCreateResourceContext(currentDb, resource);
+												currentDatabase.refreshGrant = currentDb;
+												currentDatabase.requestedScope = form.get("scope") ?? grantedScope;
+												currentDatabase.nonce = currentDb.nonce;
+												currentDatabase.demonstratingProofOfPossessionJwkJson = currentDb.demonstratingProofOfPossessionJwkJson;
+												currentDatabase.demonstratingProofOfPossessionConfiguration = currentDb.demonstratingProofOfPossessionConfiguration;
+												currentDatabase.demonstratingProofOfPossessionNonce = currentDb.demonstratingProofOfPossessionNonce;
+											} else if (currentDb.resource) throw new Error("A resource refresh must select exactly its own resource.");
+											else {
+												currentDatabase = currentDb;
+												currentDatabase.requestedScope = form.get("scope") ?? currentDb.tokens.scope;
+											}
+											headers = await generateDpopAsync(originalRequest, currentDatabase, url, claimsExtras);
+											newBody = newBody.replace(keyRefreshToken, encodeURIComponent(currentDb.tokens.refresh_token));
+											break;
+										}
+										const keyAccessToken = encodeURIComponent(`${TOKEN.ACCESS_TOKEN}_${currentDb.configurationName}`);
+										if (new URLSearchParams(actualBody).get("token") === decodeURIComponent(keyAccessToken)) {
+											headers = await generateDpopAsync(originalRequest, currentDb, url, claimsExtras);
+											newBody = newBody.replace(keyAccessToken, encodeURIComponent(currentDb.tokens.access_token));
+											currentDatabase = currentDb;
+											break;
+										}
 									}
 								}
+								if (!currentDatabase) throw new Error("The token placeholder does not identify an available grant.");
+								delete headers[RESOURCE_TOKEN_REQUEST_HEADER];
+								const generation = currentDatabase.generation;
+								const grant = currentDatabase.refreshGrant ?? currentDatabase;
+								const grantGeneration = grant.generation;
+								if (currentDatabase.resource && url !== normalizeUrl(currentDatabase.oidcServerConfiguration.tokenEndpoint) && url !== normalizeUrl(currentDatabase.oidcServerConfiguration.revocationEndpoint)) throw new Error("Resource tokens may only be sent to their exact token endpoint.");
+								const fetchPromise = fetch(originalRequest, {
+									body: newBody,
+									method: clonedRequest.method,
+									headers,
+									mode: clonedRequest.mode,
+									cache: clonedRequest.cache,
+									redirect: clonedRequest.redirect,
+									referrer: clonedRequest.referrer,
+									credentials: clonedRequest.credentials,
+									integrity: clonedRequest.integrity
+								});
+								if (currentDatabase?.oidcServerConfiguration?.revocationEndpoint && url.startsWith(normalizeUrl(currentDatabase.oidcServerConfiguration.revocationEndpoint))) {
+									const resp = await fetchPromise;
+									const txt = await resp.text();
+									resolve(new Response(txt, resp));
+									return;
+								}
+								resolve(await fetchPromise.then(hideTokens(currentDatabase, () => currentDatabase.generation === generation && grant.generation === grantGeneration, () => grant.generation === grantGeneration)));
+								return;
 							}
-							const fetchPromise = fetch(originalRequest, {
-								body: newBody,
-								method: clonedRequest.method,
-								headers,
-								mode: clonedRequest.mode,
-								cache: clonedRequest.cache,
-								redirect: clonedRequest.redirect,
-								referrer: clonedRequest.referrer,
-								credentials: clonedRequest.credentials,
-								integrity: clonedRequest.integrity
-							});
-							if (currentDatabase?.oidcServerConfiguration?.revocationEndpoint && url.startsWith(normalizeUrl(currentDatabase.oidcServerConfiguration.revocationEndpoint))) {
-								const resp = await fetchPromise;
-								const txt = await resp.text();
-								resolve(new Response(txt, resp));
+							if (actualBody.includes("code_verifier=")) {
+								const currentLoginCallbackConfigurationName = extractConfigurationNameFromCodeVerifier(actualBody);
+								if (!currentLoginCallbackConfigurationName || currentLoginCallbackConfigurationName === "") throw new Error("No configuration name found in code_verifier");
+								currentDatabase = getTokenContexts(database).find((context) => context.configurationName === currentLoginCallbackConfigurationName) ?? null;
+								if (!currentDatabase) throw new Error("No available authorization transaction matches the code verifier.");
+								if (currentDatabase.resource) {
+									const selected = new URLSearchParams(actualBody).getAll("resource");
+									if (selected.length !== 1 || selected[0] !== currentDatabase.resource) throw new Error("Authorization resource mismatch.");
+									if (url !== normalizeUrl(currentDatabase.oidcServerConfiguration.tokenEndpoint)) throw new Error("Invalid resource token endpoint.");
+									currentDatabase.refreshGrant = currentDatabase;
+								}
+								currentDatabase.requestedScope = currentDatabase.authorizationScope ?? (currentDatabase.resource ? getResourceConfiguration(currentDatabase.oidcConfiguration?.resources, currentDatabase.resource).scope : currentDatabase.oidcConfiguration?.scope);
+								const generation = currentDatabase.generation;
+								let newBody = actualBody;
+								const codeVerifier = currentDatabase.codeVerifier;
+								if (codeVerifier != null) newBody = replaceCodeVerifier(newBody, codeVerifier);
+								const headersExtras = await generateDpopAsync(originalRequest, currentDatabase, url);
+								const resp = await fetch(originalRequest, {
+									body: newBody,
+									method: clonedRequest.method,
+									headers: headersExtras,
+									mode: clonedRequest.mode,
+									cache: clonedRequest.cache,
+									redirect: clonedRequest.redirect,
+									referrer: clonedRequest.referrer,
+									credentials: clonedRequest.credentials,
+									integrity: clonedRequest.integrity
+								});
+								resolve(await hideTokens(currentDatabase, () => currentDatabase.generation === generation, void 0, true)(resp));
 								return;
 							}
-							resolve(await fetchPromise.then(hideTokens(currentDatabase)));
-							return;
-						}
-						if (actualBody.includes("code_verifier=")) {
-							const currentLoginCallbackConfigurationName = extractConfigurationNameFromCodeVerifier(actualBody);
-							if (!currentLoginCallbackConfigurationName || currentLoginCallbackConfigurationName === "") throw new Error("No configuration name found in code_verifier");
-							currentDatabase = database[currentLoginCallbackConfigurationName];
-							let newBody = actualBody;
-							const codeVerifier = currentDatabase.codeVerifier;
-							if (codeVerifier != null) newBody = replaceCodeVerifier(newBody, codeVerifier);
-							const headersExtras = await generateDpopAsync(originalRequest, currentDatabase, url);
-							const resp = await fetch(originalRequest, {
-								body: newBody,
+							resolve(await fetch(originalRequest, {
+								body: actualBody,
 								method: clonedRequest.method,
-								headers: headersExtras,
+								headers: serializeHeaders(originalRequest.headers),
 								mode: clonedRequest.mode,
 								cache: clonedRequest.cache,
 								redirect: clonedRequest.redirect,
 								referrer: clonedRequest.referrer,
 								credentials: clonedRequest.credentials,
 								integrity: clonedRequest.integrity
-							});
-							resolve(await hideTokens(currentDatabase)(resp));
-							return;
+							}));
+						} catch (err) {
+							reject(err);
 						}
-						resolve(await fetch(originalRequest, {
-							body: actualBody,
-							method: clonedRequest.method,
-							headers: serializeHeaders(originalRequest.headers),
-							mode: clonedRequest.mode,
-							cache: clonedRequest.cache,
-							redirect: clonedRequest.redirect,
-							referrer: clonedRequest.referrer,
-							credentials: clonedRequest.credentials,
-							integrity: clonedRequest.integrity
-						}));
-					} catch (err) {
-						reject(err);
-					}
-				}).catch(reject);
-			});
-			return fetch(originalRequest);
-		} catch (err) {
-			console.error("[OidcServiceWorker] handleFetch error:", err);
-			return new Response("Service Worker Error", { status: 500 });
-		}
-	})());
-};
-var handleMessage = async (event) => {
-	const port = event.ports[0];
-	const data = event.data;
-	if (event.data?.type === "SKIP_WAITING") {
-		await _self.skipWaiting();
-		port?.postMessage?.({});
-		return;
-	} else if (event.data.type === "claim") {
-		_self.clients.claim().then(() => port.postMessage({}));
-		return;
-	}
-	const configurationName = data.configurationName.split("#")[0];
-	if (trustedDomains == null) trustedDomains = {};
-	const trustedDomain = trustedDomains[configurationName];
-	const allowMultiTabLogin = Array.isArray(trustedDomain) ? false : trustedDomain.allowMultiTabLogin;
-	const tabId = allowMultiTabLogin ? data.tabId : "default";
-	const configurationNameWithTabId = `${configurationName}#tabId=${tabId}`;
-	let currentDatabase = database[configurationNameWithTabId];
-	if (!currentDatabase) {
-		const showAccessToken = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;
-		const doNotSetAccessTokenToNavigateRequests = Array.isArray(trustedDomain) ? true : trustedDomain.setAccessTokenToNavigateRequests;
-		const convertAllRequestsToCorsExceptNavigate = Array.isArray(trustedDomain) ? false : trustedDomain.convertAllRequestsToCorsExceptNavigate;
-		const bypassAllNonOidcRequests = Array.isArray(trustedDomain) ? false : trustedDomain.bypassAllNonOidcRequests;
-		database[configurationNameWithTabId] = {
-			tokens: null,
-			state: null,
-			codeVerifier: null,
-			oidcServerConfiguration: null,
-			oidcConfiguration: void 0,
-			nonce: null,
-			status: null,
-			configurationName: configurationNameWithTabId,
-			hideAccessToken: !showAccessToken,
-			setAccessTokenToNavigateRequests: doNotSetAccessTokenToNavigateRequests ?? true,
-			convertAllRequestsToCorsExceptNavigate: convertAllRequestsToCorsExceptNavigate ?? false,
-			demonstratingProofOfPossessionNonce: null,
-			demonstratingProofOfPossessionJwkJson: null,
-			demonstratingProofOfPossessionConfiguration: null,
-			demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,
-			allowMultiTabLogin: allowMultiTabLogin ?? false,
-			bypassAllNonOidcRequests: bypassAllNonOidcRequests ?? false
-		};
-		currentDatabase = database[configurationNameWithTabId];
-		if (!trustedDomains[configurationName]) trustedDomains[configurationName] = [];
-	}
-	switch (data.type) {
-		case "clear":
-			currentDatabase.tokens = null;
-			currentDatabase.state = null;
-			currentDatabase.codeVerifier = null;
-			currentDatabase.nonce = null;
-			currentDatabase.demonstratingProofOfPossessionNonce = null;
-			currentDatabase.demonstratingProofOfPossessionJwkJson = null;
-			currentDatabase.demonstratingProofOfPossessionConfiguration = null;
-			currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = false;
-			currentDatabase.status = data.data.status;
-			port.postMessage({ configurationName });
-			return;
-		case "init": {
-			const oidcServerConfiguration = data.data.oidcServerConfiguration;
-			const domains = getDomains(trustedDomain, "oidc");
-			if (!domains.some((domain) => domain === "*")) [
-				oidcServerConfiguration.tokenEndpoint,
-				oidcServerConfiguration.revocationEndpoint,
-				oidcServerConfiguration.userInfoEndpoint,
-				oidcServerConfiguration.issuer
-			].forEach((u) => {
-				checkDomain(domains, u);
-			});
-			currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
-			currentDatabase.oidcConfiguration = data.data.oidcConfiguration;
-			if (currentDatabase.demonstratingProofOfPossessionConfiguration == null) {
-				const demonstratingProofOfPossessionConfiguration = getDpopConfiguration(trustedDomain);
-				if (demonstratingProofOfPossessionConfiguration != null) {
-					if (currentDatabase.oidcConfiguration.demonstrating_proof_of_possession) console.warn("In service worker, demonstrating_proof_of_possession must be configured from trustedDomains file");
-					currentDatabase.demonstratingProofOfPossessionConfiguration = demonstratingProofOfPossessionConfiguration;
-					currentDatabase.demonstratingProofOfPossessionJwkJson = await generateJwkAsync(self)(demonstratingProofOfPossessionConfiguration.generateKeyAlgorithm);
-					currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = getDpopOnlyWhenDpopHeaderPresent(trustedDomain) ?? false;
-				}
-			}
-			if (!currentDatabase.tokens) port.postMessage({
-				tokens: null,
-				status: currentDatabase.status,
-				configurationName,
-				version: version_default
-			});
-			else {
-				const tokens = { ...currentDatabase.tokens };
-				if (currentDatabase.hideAccessToken) tokens.access_token = `${TOKEN.ACCESS_TOKEN}_${configurationName}#tabId=${tabId}`;
-				if (tokens.refresh_token) tokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${configurationName}#tabId=${tabId}`;
-				if (tokens?.idTokenPayload?.nonce && currentDatabase.nonce != null) tokens.idTokenPayload.nonce = `${TOKEN.NONCE_TOKEN}_${configurationName}#tabId=${tabId}`;
-				port.postMessage({
-					tokens,
-					status: currentDatabase.status,
-					configurationName,
-					version: version_default
+					}).catch(reject);
 				});
+				return fetch(originalRequest);
+			} catch (err) {
+				console.error("[OidcServiceWorker] handleFetch error:", err);
+				return new Response("Service Worker Error", { status: 500 });
 			}
+		})());
+	};
+	var handleMessageAsync = async (event) => {
+		const port = event.ports[0];
+		const data = event.data;
+		if (event.data?.type === "SKIP_WAITING") {
+			await _self.skipWaiting();
+			port?.postMessage?.({});
 			return;
-		}
-		case "setDemonstratingProofOfPossessionNonce":
-			currentDatabase.demonstratingProofOfPossessionNonce = data.data.demonstratingProofOfPossessionNonce;
-			port.postMessage({ configurationName });
-			return;
-		case "getDemonstratingProofOfPossessionNonce": {
-			const demonstratingProofOfPossessionNonce = currentDatabase.demonstratingProofOfPossessionNonce;
-			port.postMessage({
-				configurationName,
-				demonstratingProofOfPossessionNonce
-			});
-			return;
-		}
-		case "setState":
-			currentDatabase.state = data.data.state;
-			port.postMessage({ configurationName });
-			return;
-		case "getState": {
-			const state = currentDatabase.state;
-			port.postMessage({
-				configurationName,
-				state
-			});
+		} else if (event.data.type === "claim") {
+			_self.clients.claim().then(() => port.postMessage({}));
 			return;
 		}
-		case "setCodeVerifier":
-			currentDatabase.codeVerifier = data.data.codeVerifier;
-			port.postMessage({ configurationName });
-			return;
-		case "getCodeVerifier": {
-			const codeVerifier = currentDatabase.codeVerifier != null ? `${TOKEN.CODE_VERIFIER}_${configurationName}#tabId=${tabId}` : null;
-			port.postMessage({
-				configurationName,
-				codeVerifier
-			});
-			return;
+		const configurationName = data.configurationName.split("#")[0];
+		const resource = getContextResource(data.configurationName);
+		if (trustedDomains == null) trustedDomains = {};
+		const trustedDomain = trustedDomains[configurationName];
+		const allowMultiTabLogin = Array.isArray(trustedDomain) ? false : trustedDomain.allowMultiTabLogin;
+		const configurationNameWithTabId = `${configurationName}#tabId=${allowMultiTabLogin ? data.tabId : "default"}`;
+		let currentDatabase = database[configurationNameWithTabId];
+		if (!currentDatabase) {
+			const showAccessToken = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;
+			const doNotSetAccessTokenToNavigateRequests = Array.isArray(trustedDomain) ? true : trustedDomain.setAccessTokenToNavigateRequests;
+			const convertAllRequestsToCorsExceptNavigate = Array.isArray(trustedDomain) ? false : trustedDomain.convertAllRequestsToCorsExceptNavigate;
+			const bypassAllNonOidcRequests = Array.isArray(trustedDomain) ? false : trustedDomain.bypassAllNonOidcRequests;
+			database[configurationNameWithTabId] = {
+				tokens: null,
+				state: null,
+				codeVerifier: null,
+				oidcServerConfiguration: null,
+				oidcConfiguration: void 0,
+				nonce: null,
+				status: null,
+				configurationName: configurationNameWithTabId,
+				hideAccessToken: !showAccessToken,
+				setAccessTokenToNavigateRequests: doNotSetAccessTokenToNavigateRequests ?? true,
+				convertAllRequestsToCorsExceptNavigate: convertAllRequestsToCorsExceptNavigate ?? false,
+				demonstratingProofOfPossessionNonce: null,
+				demonstratingProofOfPossessionJwkJson: null,
+				demonstratingProofOfPossessionConfiguration: null,
+				demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,
+				allowMultiTabLogin: allowMultiTabLogin ?? false,
+				bypassAllNonOidcRequests: bypassAllNonOidcRequests ?? false
+			};
+			currentDatabase = database[configurationNameWithTabId];
+			if (!trustedDomains[configurationName]) trustedDomains[configurationName] = [];
 		}
-		case "setSessionState":
-			currentDatabase.sessionState = data.data.sessionState;
-			port.postMessage({ configurationName });
-			return;
-		case "getSessionState": {
-			const sessionState = currentDatabase.sessionState;
+		if (resource !== void 0) try {
+			currentDatabase = getOrCreateResourceContext(currentDatabase, resource);
+		} catch (error) {
+			console.error("[OidcServiceWorker] Invalid resource context:", error);
 			port.postMessage({
 				configurationName,
-				sessionState
+				error: "The resource is not registered."
 			});
 			return;
 		}
-		case "setNonce": {
-			const nonce = data.data.nonce;
-			if (nonce) currentDatabase.nonce = nonce;
-			port.postMessage({ configurationName });
-			return;
+		switch (data.type) {
+			case "clear":
+				currentDatabase.generation = (currentDatabase.generation ?? 0) + 1;
+				for (const entry of Object.values(currentDatabase.resourceEntries ?? {})) entry.generation = (entry.generation ?? 0) + 1;
+				currentDatabase.resourceEntries = void 0;
+				currentDatabase.tokens = null;
+				currentDatabase.state = null;
+				currentDatabase.codeVerifier = null;
+				currentDatabase.nonce = null;
+				currentDatabase.demonstratingProofOfPossessionNonce = null;
+				currentDatabase.demonstratingProofOfPossessionJwkJson = null;
+				currentDatabase.demonstratingProofOfPossessionConfiguration = null;
+				currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = false;
+				currentDatabase.authorizationScope = void 0;
+				currentDatabase.requestedScope = void 0;
+				currentDatabase.demonstratingProofOfPossessionApiNonce = null;
+				currentDatabase.status = data.data.status;
+				port.postMessage({ configurationName });
+				return;
+			case "init": {
+				const oidcServerConfiguration = data.data.oidcServerConfiguration;
+				const domains = getDomains(trustedDomain, "oidc");
+				if (!domains.some((domain) => domain === "*")) [
+					oidcServerConfiguration.tokenEndpoint,
+					oidcServerConfiguration.revocationEndpoint,
+					oidcServerConfiguration.userInfoEndpoint,
+					oidcServerConfiguration.issuer
+				].forEach((u) => {
+					checkDomain(domains, u);
+				});
+				currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
+				currentDatabase.oidcConfiguration = data.data.oidcConfiguration;
+				if (data.data.where === "loginAsync") currentDatabase.authorizationScope = currentDatabase.oidcConfiguration.scope;
+				if (resource !== void 0) getResourceConfiguration(currentDatabase.oidcConfiguration.resources, resource);
+				if (currentDatabase.demonstratingProofOfPossessionConfiguration == null) {
+					const parent = currentDatabase.parentConfiguration;
+					if (parent?.demonstratingProofOfPossessionJwkJson) {
+						currentDatabase.demonstratingProofOfPossessionJwkJson = parent.demonstratingProofOfPossessionJwkJson;
+						currentDatabase.demonstratingProofOfPossessionConfiguration = parent.demonstratingProofOfPossessionConfiguration;
+					}
+					const demonstratingProofOfPossessionConfiguration = getDpopConfiguration(trustedDomain);
+					if (demonstratingProofOfPossessionConfiguration != null && currentDatabase.demonstratingProofOfPossessionConfiguration == null) {
+						if (currentDatabase.oidcConfiguration.demonstrating_proof_of_possession) console.warn("In service worker, demonstrating_proof_of_possession must be configured from trustedDomains file");
+						currentDatabase.demonstratingProofOfPossessionConfiguration = demonstratingProofOfPossessionConfiguration;
+						currentDatabase.demonstratingProofOfPossessionJwkJson = await generateJwkAsync(self)(demonstratingProofOfPossessionConfiguration.generateKeyAlgorithm);
+						currentDatabase.demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent = getDpopOnlyWhenDpopHeaderPresent(trustedDomain) ?? false;
+					}
+				}
+				if (!currentDatabase.tokens) port.postMessage({
+					tokens: null,
+					status: currentDatabase.status,
+					configurationName,
+					version: version_default,
+					resourceTokenManagement: true,
+					resourceContexts: Object.keys(currentDatabase.resourceEntries ?? {})
+				});
+				else {
+					const tokens = {
+						...currentDatabase.tokens,
+						idTokenPayload: currentDatabase.tokens.idTokenPayload ? { ...currentDatabase.tokens.idTokenPayload } : void 0
+					};
+					if (currentDatabase.hideAccessToken) tokens.access_token = `${TOKEN.ACCESS_TOKEN}_${currentDatabase.configurationName}`;
+					if (tokens.refresh_token) tokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${(currentDatabase.refreshGrant ?? currentDatabase).configurationName}`;
+					if (tokens?.idTokenPayload?.nonce && currentDatabase.nonce != null) tokens.idTokenPayload.nonce = `${TOKEN.NONCE_TOKEN}_${currentDatabase.configurationName}`;
+					port.postMessage({
+						tokens,
+						status: currentDatabase.status,
+						configurationName,
+						version: version_default,
+						resourceTokenManagement: true,
+						resourceContexts: Object.keys(currentDatabase.resourceEntries ?? {})
+					});
+				}
+				return;
+			}
+			case "setDemonstratingProofOfPossessionNonce":
+				currentDatabase.demonstratingProofOfPossessionNonce = data.data.demonstratingProofOfPossessionNonce;
+				port.postMessage({ configurationName });
+				return;
+			case "getDemonstratingProofOfPossessionNonce": {
+				const demonstratingProofOfPossessionNonce = currentDatabase.demonstratingProofOfPossessionNonce;
+				port.postMessage({
+					configurationName,
+					demonstratingProofOfPossessionNonce
+				});
+				return;
+			}
+			case "setState":
+				currentDatabase.state = data.data.state;
+				port.postMessage({ configurationName });
+				return;
+			case "getState": {
+				const state = currentDatabase.state;
+				port.postMessage({
+					configurationName,
+					state
+				});
+				return;
+			}
+			case "setCodeVerifier":
+				currentDatabase.codeVerifier = data.data.codeVerifier;
+				port.postMessage({ configurationName });
+				return;
+			case "getCodeVerifier": {
+				const codeVerifier = currentDatabase.codeVerifier != null ? `${TOKEN.CODE_VERIFIER}_${currentDatabase.configurationName}` : null;
+				port.postMessage({
+					configurationName,
+					codeVerifier
+				});
+				return;
+			}
+			case "setSessionState":
+				currentDatabase.sessionState = data.data.sessionState;
+				port.postMessage({ configurationName });
+				return;
+			case "getSessionState": {
+				const sessionState = currentDatabase.sessionState;
+				port.postMessage({
+					configurationName,
+					sessionState
+				});
+				return;
+			}
+			case "setNonce": {
+				const nonce = data.data.nonce;
+				if (nonce) {
+					if (!currentDatabase.resource && currentDatabase.nonce && nonce.nonce !== currentDatabase.nonce.nonce) {
+						currentDatabase.generation = (currentDatabase.generation ?? 0) + 1;
+						for (const entry of Object.values(currentDatabase.resourceEntries ?? {})) entry.generation = (entry.generation ?? 0) + 1;
+						currentDatabase.resourceEntries = void 0;
+					}
+					currentDatabase.nonce = nonce;
+				}
+				port.postMessage({ configurationName });
+				return;
+			}
+			case "getNonce": {
+				const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabase.configurationName}`;
+				const nonce = currentDatabase.nonce ? keyNonce : null;
+				port.postMessage({
+					configurationName,
+					nonce
+				});
+				return;
+			}
+			default: return;
 		}
-		case "getNonce": {
-			const keyNonce = `${TOKEN.NONCE_TOKEN}_${configurationName}#tabId=${tabId}`;
-			const nonce = currentDatabase.nonce ? keyNonce : null;
-			port.postMessage({
-				configurationName,
-				nonce
+	};
+	var handleMessage = async (event) => {
+		try {
+			await handleMessageAsync(event);
+		} catch (error) {
+			console.error("[OidcServiceWorker] Message failed:", error);
+			event.ports?.[0]?.postMessage({
+				configurationName: event.data?.configurationName,
+				error: error instanceof Error ? error.message : "The worker could not process this message."
 			});
-			return;
 		}
-		default: return;
-	}
-};
-_self.addEventListener("fetch", handleFetch);
-_self.addEventListener("message", handleMessage);
-//#endregion
+	};
+	_self.addEventListener("fetch", handleFetch);
+	_self.addEventListener("message", handleMessage);
+	//#endregion
+})();
 
 //# sourceMappingURL=OidcServiceWorker.js.map