@descope/web-js-sdk 1.50.6 → 1.51.1

package/dist/cjs/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},T=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},C="DS",A="DSR",E="DSI",R="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),u=N(o);a.default.set(e,t,{path:i,domain:u?o:void 0,expires:c,sameSite:r,secure:l})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const P=e=>(null==e?void 0:e.cookieName)||C,J=e=>(null==e?void 0:e.cookieName)||A;function L(e="",t){return a.default.get(J(t))||O(`${e}${A}`)||""}function q(e="",t){return a.default.get(P(t))||O(`${e}${C}`)||""}function K(e=""){return O(`${e}${E}`)||""}function V(e="",t,n,o){x(`${e}${A}`),x(`${e}${C}`),x(`${e}${E}`),x(`${e}${R}`);const i=P(t);a.default.remove(i,null==o?void 0:o.session);const r=J(n);a.default.remove(r,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${R}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",W="vsid",H="vrid",B="fp",z=(e=!1)=>{const t=O(B);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},G=async(e,t=M)=>{try{if(z())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),u=((e,t)=>({[W]:e,[H]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(B,JSON.stringify(t))})(u)}catch(e){console.warn("Could not load fingerprint",e)}},X=e=>{const t=z(!0);return t&&e.body&&(e.body.fpData=t),e},Z="descopeFlowNonce",Y="X-Descope-Flow-Nonce",Q="/v1/flow/start",ee="/v1/flow/next",te=(e,t=Z)=>`${t}${e}`,ne=(e,t=Z)=>{try{const n=te(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},oe=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},ie=e=>{var t;return e.path===ee&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?oe(e.body.executionId):null},re="dls_last_user_login_id",se="dls_last_user_display_name",ae=e=>I(re,e),le=()=>O(re),ce=()=>O(se),ue=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ce();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},de=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(re),x(se)),o},pe="DSLI",fe=e=>async(...t)=>{const n=await e(...t);return x(pe),n};function ge(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const ve=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function he(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),n.publicKey.user.id=_e(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Ie(n.rawId),type:n.type,response:{attestationObject:Ie(n.response.attestationObject),clientDataJSON:Ie(n.response.clientDataJSON)}})}catch(e){throw await ye(e,t,!0)}var n}async function we(e){const t=ke(e);try{return Se(await navigator.credentials.get(t))}catch(e){throw await ye(e,t,!1)}}async function me(e,t){const n=ke(e);n.signal=t.signal,n.mediation="conditional";try{return Se(await navigator.credentials.get(n))}catch(e){throw await ye(e,n,!1)}}async function ye(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await be())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await be(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function be(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function ke(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}function Se(e){return JSON.stringify({id:e.id,rawId:Ie(e.rawId),type:e.type,response:{authenticatorData:Ie(e.response.authenticatorData),clientDataJSON:Ie(e.response.clientDataJSON),signature:Ie(e.response.signature),userHandle:e.response.userHandle?Ie(e.response.userHandle):void 0}})}function _e(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Ie(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var Oe,xe=(Oe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await we(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await we(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:he,get:we,isSupported:be,conditional:me}}),(...e)=>{const t=Oe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const je={config:"/fedcm/config"},De=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Te(e,t){var n;try{await Ue(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ue(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=De(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Ce=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await be(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Ae=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const Re=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Re(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const $e=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return Re([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:l}},Ne=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await $e(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Ae())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&G(o).catch((()=>null)),t(y(r,{beforeRequest:X}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.50.6"},t.baseHeaders)}))),(e=>t=>{const o=ge(),i=ge(),r=ge(),s=ge(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Z}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Z)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==Q&&e.path!==ee)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=ie(e)),{nonce:n,executionId:oe(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Z)=>{try{const i=te(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===Q,r)}},beforeRequest:e=>{if(e.path===ee){const t=ie(e);if(t){const n=((e,t=Z)=>{try{const n=te(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(ne(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(pe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(pe,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],fe)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{T("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;l&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(c&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(n.wrapWith(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{T("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ce});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ae(r),(e=>{I(se,e)})(s)):(null==i?void 0:i.loginId)&&ae(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],ue);return l=n.wrapWith(l,["logout","logoutAll"],de(r)),Object.assign(l,{getLastUserLoginId:le,getLastUserDisplayName:ce})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:u}=o,d=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(l,s,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${R}`,e.cookieName):e.refreshJwt&&x(`${l||""}${R}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${A}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=J(o);s&&"https:"!==window.location.protocol&&T("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});$(l,u,c);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:d?a:void 0}})}else{const e=J(o);a.default.remove(e),I(`${n}${A}`,u)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=P(t);o&&"https:"!==window.location.protocol&&T("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,c,a);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:u?i:void 0}})}else I(`${n}${C}`,c);return e.idToken&&I(`${n}${E}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,r,l,s);n&&(p=n)}}})),g=n.wrapWith(f,["logout","logoutAll","oidc.logout"],ve(l,r,s,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(l,s),getSessionToken:()=>q(l,r),getIdToken:()=>K(l)})}))((e=>{const t=s.default(e),n=Ne(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(pe)&&!O(re)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:Ce(t),webauthn:xe(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Te(o,e)},requestAuthentication(e){Te(o,e)}},async oneTap(e,t,n,i,r){await Ue(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+je.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+je.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=A,exports.SESSION_TOKEN_KEY=C,exports.clearFingerprintData=()=>{x(B)},exports.createSdk=Pe,exports.default=Pe,exports.ensureFingerprintIds=G,exports.getSessionToken=q,exports.hasOidcParamsInUrl=Ae;
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},T=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},C="DS",A="DSR",E="DSI",R="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),u=N(o);a.default.set(e,t,{path:i,domain:u?o:void 0,expires:c,sameSite:r,secure:l})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const P=e=>(null==e?void 0:e.cookieName)||C,J=e=>(null==e?void 0:e.cookieName)||A;function L(e="",t){return a.default.get(J(t))||O(`${e}${A}`)||""}function q(e="",t){return a.default.get(P(t))||O(`${e}${C}`)||""}function K(e=""){return O(`${e}${E}`)||""}function V(e="",t,n,o){x(`${e}${A}`),x(`${e}${C}`),x(`${e}${E}`),x(`${e}${R}`);const i=P(t);a.default.remove(i,null==o?void 0:o.session);const r=J(n);a.default.remove(r,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${R}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",W="vsid",H="vrid",B="fp",z=(e=!1)=>{const t=O(B);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},G=async(e,t=M)=>{try{if(z())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),u=((e,t)=>({[W]:e,[H]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(B,JSON.stringify(t))})(u)}catch(e){console.warn("Could not load fingerprint",e)}},X=e=>{const t=z(!0);return t&&e.body&&(e.body.fpData=t),e},Z="descopeFlowNonce",Y="X-Descope-Flow-Nonce",Q="/v1/flow/start",ee="/v1/flow/next",te=(e,t=Z)=>`${t}${e}`,ne=(e,t=Z)=>{try{const n=te(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},oe=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},ie=e=>{var t;return e.path===ee&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?oe(e.body.executionId):null},re="dls_last_user_login_id",se="dls_last_user_display_name",ae=e=>I(re,e),le=()=>O(re),ce=()=>O(se),ue=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ce();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},de=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(re),x(se)),o},pe="DSLI",fe=e=>async(...t)=>{const n=await e(...t);return x(pe),n};function ge(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const ve=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function he(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),n.publicKey.user.id=_e(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Ie(n.rawId),type:n.type,response:{attestationObject:Ie(n.response.attestationObject),clientDataJSON:Ie(n.response.clientDataJSON)}})}catch(e){throw await ye(e,t,!0)}var n}async function we(e){const t=ke(e);try{return Se(await navigator.credentials.get(t))}catch(e){throw await ye(e,t,!1)}}async function me(e,t){const n=ke(e);n.signal=t.signal,n.mediation="conditional";try{return Se(await navigator.credentials.get(n))}catch(e){throw await ye(e,n,!1)}}async function ye(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await be())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await be(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function be(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function ke(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}function Se(e){return JSON.stringify({id:e.id,rawId:Ie(e.rawId),type:e.type,response:{authenticatorData:Ie(e.response.authenticatorData),clientDataJSON:Ie(e.response.clientDataJSON),signature:Ie(e.response.signature),userHandle:e.response.userHandle?Ie(e.response.userHandle):void 0}})}function _e(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Ie(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var Oe,xe=(Oe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await we(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await we(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:he,get:we,isSupported:be,conditional:me}}),(...e)=>{const t=Oe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const je={config:"/fedcm/config"},De=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Te(e,t){var n;try{await Ue(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ue(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=De(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Ce=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await be(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Ae=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const Re=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Re(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const $e=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return Re([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:l}},Ne=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await $e(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Ae())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&G(o).catch((()=>null)),t(y(r,{beforeRequest:X}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.1"},t.baseHeaders)}))),(e=>t=>{const o=ge(),i=ge(),r=ge(),s=ge(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Z}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Z)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==Q&&e.path!==ee)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=ie(e)),{nonce:n,executionId:oe(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Z)=>{try{const i=te(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===Q,r)}},beforeRequest:e=>{if(e.path===ee){const t=ie(e);if(t){const n=((e,t=Z)=>{try{const n=te(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(ne(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(pe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(pe,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],fe)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{T("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;l&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(c&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(n.wrapWith(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{T("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ce});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ae(r),(e=>{I(se,e)})(s)):(null==i?void 0:i.loginId)&&ae(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],ue);return l=n.wrapWith(l,["logout","logoutAll"],de(r)),Object.assign(l,{getLastUserLoginId:le,getLastUserDisplayName:ce})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:u}=o,d=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(l,s,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${R}`,e.cookieName):e.refreshJwt&&x(`${l||""}${R}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${A}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=J(o);s&&"https:"!==window.location.protocol&&T("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});$(l,u,c);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:d?a:void 0}})}else{const e=J(o);a.default.remove(e),I(`${n}${A}`,u)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=P(t);o&&"https:"!==window.location.protocol&&T("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,c,a);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:u?i:void 0}})}else I(`${n}${C}`,c);return e.idToken&&I(`${n}${E}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,r,l,s);n&&(p=n)}}})),g=n.wrapWith(f,["logout","logoutAll","oidc.logout"],ve(l,r,s,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(l,s),getSessionToken:()=>q(l,r),getIdToken:()=>K(l)})}))((e=>{const t=s.default(e),n=Ne(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(pe)&&!O(re)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:Ce(t),webauthn:xe(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Te(o,e)},requestAuthentication(e){Te(o,e)}},async oneTap(e,t,n,i,r){await Ue(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+je.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+je.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=A,exports.SESSION_TOKEN_KEY=C,exports.clearFingerprintData=()=>{x(B)},exports.createSdk=Pe,exports.default=Pe,exports.ensureFingerprintIds=G,exports.getSessionToken=q,exports.hasOidcParamsInUrl=Ae;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.d.ts

@@ -168,7 +168,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -205,7 +205,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -241,13 +241,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -790,6 +794,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -922,7 +930,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -959,7 +967,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -995,13 +1003,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -1544,6 +1556,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -1676,7 +1692,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -1713,7 +1729,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -1749,13 +1765,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -2298,6 +2318,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -2440,7 +2464,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -2477,7 +2501,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -2513,13 +2537,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -3062,6 +3090,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -3194,7 +3226,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -3231,7 +3263,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -3267,13 +3299,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -3816,6 +3852,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -3948,7 +3988,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 webAuthnSupport?: boolean;
             };
             lastAuth?: {
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -3985,7 +4025,7 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             outboundAppScopes?: string[];
         }, "tenant" | "redirectUrl" | "redirectAuth" | "oidcIdpStateId" | "samlIdpStateId" | "wsfedIdpStateId" | "samlIdpUsername" | "ssoAppId" | "thirdPartyAppId" | "oidcLoginHint" | "preview" | "abTestingKey" | "client" | "locale" | "oidcPrompt" | "oidcErrorRedirectUri" | "oidcResource" | "nativeOptions" | "thirdPartyAppStateId" | "applicationScopes" | "outboundAppId" | "outboundAppScopes"> & {
             lastAuth?: Omit<{
-                authMethod?: "webauthn" | "otp" | "oauth" | "saml" | "totp" | "magiclink" | "enchantedlink";
+                authMethod?: "webauthn" | "otp" | "oauth" | "sso" | "saml" | "totp" | "magiclink" | "enchantedlink";
                 oauthProvider?: string;
                 name?: string;
                 loginId?: string;
@@ -4021,13 +4061,17 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
                 create: boolean;
             }>>;
         };
-        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<{
+        update: ((identifier: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData> | _descope_core_js_sdk.SdkResponse<{
+            jwt?: _descope_core_js_sdk.JWTResponse;
+        }>>) & {
+            start: (loginId: string, origin: string, token?: string, passkeyOptions?: _descope_core_js_sdk.PasskeyOptions, mfa?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<{
                 transactionId: string;
                 options: string;
                 create: boolean;
             }>>;
-            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finish: (transactionId: string, response: string) => Promise<_descope_core_js_sdk.SdkResponse<{
+                jwt?: _descope_core_js_sdk.JWTResponse;
+            }>>;
         };
         helpers: {
             create: (options: string) => Promise<string>;
@@ -4570,6 +4614,10 @@ declare const decoratedCreateSdk: <A extends CookieConfig>({ persistTokens: isPe
             externalIdentifier?: string;
         }, token?: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
     };
+    sso: {
+        start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
+        exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;
+    };
     saml: {
         start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string, ssoId?: string, forceAuthn?: boolean, loginHint?: string, enforceInitiatedEmail?: boolean) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.URLResponse>>;
         exchange: (code: string) => Promise<_descope_core_js_sdk.SdkResponse<_descope_core_js_sdk.JWTResponse>>;

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import{jwtDecode as t}from"jwt-decode";import n,{wrapWith as o}from"@descope/core-js-sdk";import i from"js-cookie";import{load as r,defaultEndpoint as s,defaultScriptUrlPattern as a}from"@fingerprintjs/fingerprintjs-pro";const c="3.2.0",l="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${c}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${c}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>l&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||l&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||l&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||l&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||l&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:l&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},C=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},A="DS",T="DSR",R="DSI",E="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:r,cookieSameSite:s,cookieExpiration:a,cookieSecure:c}=n,l=new Date(1e3*a),u=N(o);i.set(e,t,{path:r,domain:u?o:void 0,expires:l,sameSite:s,secure:c})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const J=e=>(null==e?void 0:e.cookieName)||A,P=e=>(null==e?void 0:e.cookieName)||T;function L(e="",t){return i.get(P(t))||O(`${e}${T}`)||""}function q(e="",t){return i.get(J(t))||O(`${e}${A}`)||""}function K(e=""){return O(`${e}${R}`)||""}function V(e="",t,n,o){x(`${e}${T}`),x(`${e}${A}`),x(`${e}${R}`),x(`${e}${E}`);const r=J(t);i.remove(r,null==o?void 0:o.session);const s=P(n);i.remove(s,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${E}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=l&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",H="vsid",B="vrid",z="fp",G=(e=!1)=>{const t=O(z);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},W=async(e,t=M)=>{try{if(G())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const i=new URL(t);i.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const c=i.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",l=r({apiKey:e,endpoint:[o.toString(),s],scriptUrlPattern:[c,a]}),u=await l,{requestId:d}=await u.get({linkedId:n}),p=((e,t)=>({[H]:e,[B]:t}))(n,d);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(z,JSON.stringify(t))})(p)}catch(e){console.warn("Could not load fingerprint",e)}},X=()=>{x(z)},Z=e=>{const t=G(!0);return t&&e.body&&(e.body.fpData=t),e},Q="descopeFlowNonce",Y="X-Descope-Flow-Nonce",ee="/v1/flow/start",te="/v1/flow/next",ne=(e,t=Q)=>`${t}${e}`,oe=(e,t=Q)=>{try{const n=ne(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},ie=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},re=e=>{var t;return e.path===te&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?ie(e.body.executionId):null},se="dls_last_user_login_id",ae="dls_last_user_display_name",ce=e=>I(se,e),le=()=>O(se),ue=()=>O(ae),de=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ue();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},pe=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(se),x(ae)),o},fe="DSLI",ge=e=>async(...t)=>{const n=await e(...t);return x(fe),n};function ve(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const he=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function we(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Ie(n.publicKey.challenge),n.publicKey.user.id=Ie(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=Ie(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Oe(n.rawId),type:n.type,response:{attestationObject:Oe(n.response.attestationObject),clientDataJSON:Oe(n.response.clientDataJSON)}})}catch(e){throw await be(e,t,!0)}var n}async function me(e){const t=Se(e);try{return _e(await navigator.credentials.get(t))}catch(e){throw await be(e,t,!1)}}async function ye(e,t){const n=Se(e);n.signal=t.signal,n.mediation="conditional";try{return _e(await navigator.credentials.get(n))}catch(e){throw await be(e,n,!1)}}async function be(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await ke())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await ke(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function ke(e=!1){var t,n;if(!l)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function Se(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Ie(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=Ie(e.id)})),n}function _e(e){return JSON.stringify({id:e.id,rawId:Oe(e.rawId),type:e.type,response:{authenticatorData:Oe(e.response.authenticatorData),clientDataJSON:Oe(e.response.clientDataJSON),signature:Oe(e.response.signature),userHandle:e.response.userHandle?Oe(e.response.userHandle):void 0}})}function Ie(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Oe(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var xe,je=(xe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await we(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await me(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await we(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await me(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await we(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:we,get:me,isSupported:ke,conditional:ye}}),(...e)=>{const t=xe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const De={config:"/fedcm/config"},Ce=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Ue(e,t){var n;try{await Ae(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ae(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=Ce(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const c=a.data.clientId;return new Promise((e=>{var a,l;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(l=null==n?void 0:n.use_fedcm_for_prompt)||void 0===l||l,client_id:c,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Te=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await ke(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Re=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const $e=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{$e(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const Ne=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return $e([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,c,l;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,c=`${a}_user`,l="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,c=`${a}_user`,l="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,c=`${a}_user`,l="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||l,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:c}},Je=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await Ne(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Re())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const c=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(c)))),c},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e(n,["fpKey","fpLoad"]);return l?(o&&i&&W(o).catch((()=>null)),t(y(r,{beforeRequest:Z}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.50.6"},t.baseHeaders)}))),(e=>t=>{const n=ve(),i=ve(),r=ve(),s=ve(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),n.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:o,sessionExpiration:a,claims:c}=await b(t);o&&i.pub(o),c&&s.pub(c),(a||o)&&n.pub(a||42)}}})),c=o(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const o=await e(...t);return i.pub(null),r.pub(null),n.pub(null),s.pub(null),o}));return Object.assign(c,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>n.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Q}=n,s=e(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Q)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:l&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==ee&&e.path!==te)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=re(e)),{nonce:n,executionId:ie(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Q)=>{try{const i=ne(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===ee,r)}},beforeRequest:e=>{if(e.path===te){const t=re(e);if(t){const n=((e,t=Q)=>{try{const n=ne(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(oe(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const n=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(fe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(fe,String(n.sessionExpiration))}}));return o(n,["logout","logoutAll","oidc.logout"],ge)}),(n=>i=>{var{autoRefresh:r}=i,s=e(i,["autoRefresh"]);const a=!!r,c="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(n(s),{markUserActive:()=>{C("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;c&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),l&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=n(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(l&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(o(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{C("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>n=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=n,s=e(n,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ue});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ce(r),(e=>{I(ae,e)})(s)):(null==i?void 0:i.loginId)&&ce(i.loginId)}}));let c=o(a,["flow.start"],de);return c=o(c,["logout","logoutAll"],pe(r)),Object.assign(c,{getLastUserLoginId:le,getLastUserDisplayName:ue})}),(t=>n=>{var{persistTokens:r,sessionTokenViaCookie:s,refreshTokenViaCookie:a,storagePrefix:c,refreshCookieName:u}=n,d=e(n,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!r||!l)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(c,a,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(c,s,a,p);else{const e=await b(t);e.cookieName?I(`${c||""}${E}`,e.cookieName):e.refreshJwt&&x(`${c||""}${E}`);const n=((e={},t=!1,n="",o=!1)=>{var r,s,a,c;const{sessionJwt:l,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${T}`);const t=o.sameSite||"Strict",i=null===(r=o.secure)||void 0===r||r,a=null!==(s=o.domain)&&void 0!==s?s:e.cookieDomain,c=P(o);i&&"https:"!==window.location.protocol&&C("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const l=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:i,cookieDomain:a});$(c,u,l);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:l.cookiePath,domain:d?a:void 0}})}else{const e=P(o);i.remove(e),I(`${n}${T}`,u)}if(l)if(t){const n=t.sameSite||"Strict",o=null===(a=t.secure)||void 0===a||a,i=null!==(c=t.domain)&&void 0!==c?c:e.cookieDomain,r=J(t);o&&"https:"!==window.location.protocol&&C("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const s=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,l,s);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:s.cookiePath,domain:u?i:void 0}})}else I(`${n}${A}`,l);return e.idToken&&I(`${n}${R}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,s,c,a);n&&(p=n)}}})),g=o(f,["logout","logoutAll","oidc.logout"],he(c,s,a,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(c,a),getSessionToken:()=>q(c,s),getIdToken:()=>K(c)})}))((e=>{const t=n(e),o=Je(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(n,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await o.refreshToken(n),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(fe)&&!O(se)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let c="";if(e.getExternalToken)try{c=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(n,{dcs:s?"t":"f",dcr:a?"t":"f"},c,i)},logout:async n=>{if(e.oidcConfig)try{return await o.logout({id_token_hint:n}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(n)},flow:Te(t),webauthn:je(t),fedcm:(i=t,r=e.projectId,{onetap:{requestExchangeCode(e){Ue(i,e)},requestAuthentication(e){Ue(i,e)}},async oneTap(e,t,n,o,r){await Ae(i,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:o,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:i.httpClient.buildUrl(r+De.config),clientId:r}]}},o=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return i.refresh(o.token)},isSupported:()=>l&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=i.httpClient.buildUrl(r+De.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:r}]}},i=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!i&&!!i.token}catch(e){return!1}}}),oidc:o});var i,r}));export{T as REFRESH_TOKEN_KEY,A as SESSION_TOKEN_KEY,X as clearFingerprintData,Pe as createSdk,Pe as default,W as ensureFingerprintIds,q as getSessionToken,Re as hasOidcParamsInUrl};
+import{__rest as e}from"tslib";import{jwtDecode as t}from"jwt-decode";import n,{wrapWith as o}from"@descope/core-js-sdk";import i from"js-cookie";import{load as r,defaultEndpoint as s,defaultScriptUrlPattern as a}from"@fingerprintjs/fingerprintjs-pro";const c="3.2.0",l="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${c}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${c}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>l&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||l&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||l&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||l&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||l&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:l&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},C=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},A="DS",T="DSR",R="DSI",E="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:r,cookieSameSite:s,cookieExpiration:a,cookieSecure:c}=n,l=new Date(1e3*a),u=N(o);i.set(e,t,{path:r,domain:u?o:void 0,expires:l,sameSite:s,secure:c})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const J=e=>(null==e?void 0:e.cookieName)||A,P=e=>(null==e?void 0:e.cookieName)||T;function L(e="",t){return i.get(P(t))||O(`${e}${T}`)||""}function q(e="",t){return i.get(J(t))||O(`${e}${A}`)||""}function K(e=""){return O(`${e}${R}`)||""}function V(e="",t,n,o){x(`${e}${T}`),x(`${e}${A}`),x(`${e}${R}`),x(`${e}${E}`);const r=J(t);i.remove(r,null==o?void 0:o.session);const s=P(n);i.remove(s,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${E}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=l&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",H="vsid",B="vrid",z="fp",G=(e=!1)=>{const t=O(z);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},W=async(e,t=M)=>{try{if(G())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const i=new URL(t);i.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const c=i.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",l=r({apiKey:e,endpoint:[o.toString(),s],scriptUrlPattern:[c,a]}),u=await l,{requestId:d}=await u.get({linkedId:n}),p=((e,t)=>({[H]:e,[B]:t}))(n,d);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(z,JSON.stringify(t))})(p)}catch(e){console.warn("Could not load fingerprint",e)}},X=()=>{x(z)},Z=e=>{const t=G(!0);return t&&e.body&&(e.body.fpData=t),e},Q="descopeFlowNonce",Y="X-Descope-Flow-Nonce",ee="/v1/flow/start",te="/v1/flow/next",ne=(e,t=Q)=>`${t}${e}`,oe=(e,t=Q)=>{try{const n=ne(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},ie=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},re=e=>{var t;return e.path===te&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?ie(e.body.executionId):null},se="dls_last_user_login_id",ae="dls_last_user_display_name",ce=e=>I(se,e),le=()=>O(se),ue=()=>O(ae),de=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ue();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},pe=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(se),x(ae)),o},fe="DSLI",ge=e=>async(...t)=>{const n=await e(...t);return x(fe),n};function ve(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const he=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function we(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Ie(n.publicKey.challenge),n.publicKey.user.id=Ie(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=Ie(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Oe(n.rawId),type:n.type,response:{attestationObject:Oe(n.response.attestationObject),clientDataJSON:Oe(n.response.clientDataJSON)}})}catch(e){throw await be(e,t,!0)}var n}async function me(e){const t=Se(e);try{return _e(await navigator.credentials.get(t))}catch(e){throw await be(e,t,!1)}}async function ye(e,t){const n=Se(e);n.signal=t.signal,n.mediation="conditional";try{return _e(await navigator.credentials.get(n))}catch(e){throw await be(e,n,!1)}}async function be(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await ke())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await ke(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function ke(e=!1){var t,n;if(!l)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function Se(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Ie(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=Ie(e.id)})),n}function _e(e){return JSON.stringify({id:e.id,rawId:Oe(e.rawId),type:e.type,response:{authenticatorData:Oe(e.response.authenticatorData),clientDataJSON:Oe(e.response.clientDataJSON),signature:Oe(e.response.signature),userHandle:e.response.userHandle?Oe(e.response.userHandle):void 0}})}function Ie(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Oe(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var xe,je=(xe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await we(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await me(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await we(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await me(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await we(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:we,get:me,isSupported:ke,conditional:ye}}),(...e)=>{const t=xe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const De={config:"/fedcm/config"},Ce=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Ue(e,t){var n;try{await Ae(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ae(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=Ce(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const c=a.data.clientId;return new Promise((e=>{var a,l;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(l=null==n?void 0:n.use_fedcm_for_prompt)||void 0===l||l,client_id:c,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Te=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await ke(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Re=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const $e=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{$e(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const Ne=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return $e([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,c,l;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,c=`${a}_user`,l="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,c=`${a}_user`,l="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,c=`${a}_user`,l="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||l,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:c}},Je=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await Ne(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Re())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const c=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(c)))),c},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e(n,["fpKey","fpLoad"]);return l?(o&&i&&W(o).catch((()=>null)),t(y(r,{beforeRequest:Z}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.1"},t.baseHeaders)}))),(e=>t=>{const n=ve(),i=ve(),r=ve(),s=ve(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),n.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:o,sessionExpiration:a,claims:c}=await b(t);o&&i.pub(o),c&&s.pub(c),(a||o)&&n.pub(a||42)}}})),c=o(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const o=await e(...t);return i.pub(null),r.pub(null),n.pub(null),s.pub(null),o}));return Object.assign(c,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>n.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Q}=n,s=e(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Q)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:l&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==ee&&e.path!==te)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=re(e)),{nonce:n,executionId:ie(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Q)=>{try{const i=ne(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===ee,r)}},beforeRequest:e=>{if(e.path===te){const t=re(e);if(t){const n=((e,t=Q)=>{try{const n=ne(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(oe(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const n=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(fe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(fe,String(n.sessionExpiration))}}));return o(n,["logout","logoutAll","oidc.logout"],ge)}),(n=>i=>{var{autoRefresh:r}=i,s=e(i,["autoRefresh"]);const a=!!r,c="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(n(s),{markUserActive:()=>{C("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;c&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),l&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=n(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(l&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(o(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{C("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>n=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=n,s=e(n,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ue});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ce(r),(e=>{I(ae,e)})(s)):(null==i?void 0:i.loginId)&&ce(i.loginId)}}));let c=o(a,["flow.start"],de);return c=o(c,["logout","logoutAll"],pe(r)),Object.assign(c,{getLastUserLoginId:le,getLastUserDisplayName:ue})}),(t=>n=>{var{persistTokens:r,sessionTokenViaCookie:s,refreshTokenViaCookie:a,storagePrefix:c,refreshCookieName:u}=n,d=e(n,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!r||!l)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(c,a,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(c,s,a,p);else{const e=await b(t);e.cookieName?I(`${c||""}${E}`,e.cookieName):e.refreshJwt&&x(`${c||""}${E}`);const n=((e={},t=!1,n="",o=!1)=>{var r,s,a,c;const{sessionJwt:l,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${T}`);const t=o.sameSite||"Strict",i=null===(r=o.secure)||void 0===r||r,a=null!==(s=o.domain)&&void 0!==s?s:e.cookieDomain,c=P(o);i&&"https:"!==window.location.protocol&&C("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const l=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:i,cookieDomain:a});$(c,u,l);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:l.cookiePath,domain:d?a:void 0}})}else{const e=P(o);i.remove(e),I(`${n}${T}`,u)}if(l)if(t){const n=t.sameSite||"Strict",o=null===(a=t.secure)||void 0===a||a,i=null!==(c=t.domain)&&void 0!==c?c:e.cookieDomain,r=J(t);o&&"https:"!==window.location.protocol&&C("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const s=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,l,s);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:s.cookiePath,domain:u?i:void 0}})}else I(`${n}${A}`,l);return e.idToken&&I(`${n}${R}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,s,c,a);n&&(p=n)}}})),g=o(f,["logout","logoutAll","oidc.logout"],he(c,s,a,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(c,a),getSessionToken:()=>q(c,s),getIdToken:()=>K(c)})}))((e=>{const t=n(e),o=Je(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(n,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await o.refreshToken(n),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(fe)&&!O(se)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let c="";if(e.getExternalToken)try{c=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(n,{dcs:s?"t":"f",dcr:a?"t":"f"},c,i)},logout:async n=>{if(e.oidcConfig)try{return await o.logout({id_token_hint:n}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(n)},flow:Te(t),webauthn:je(t),fedcm:(i=t,r=e.projectId,{onetap:{requestExchangeCode(e){Ue(i,e)},requestAuthentication(e){Ue(i,e)}},async oneTap(e,t,n,o,r){await Ae(i,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:o,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:i.httpClient.buildUrl(r+De.config),clientId:r}]}},o=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return i.refresh(o.token)},isSupported:()=>l&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=i.httpClient.buildUrl(r+De.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:r}]}},i=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!i&&!!i.token}catch(e){return!1}}}),oidc:o});var i,r}));export{T as REFRESH_TOKEN_KEY,A as SESSION_TOKEN_KEY,X as clearFingerprintData,Pe as createSdk,Pe as default,W as ensureFingerprintIds,q as getSessionToken,Re as hasOidcParamsInUrl};
 //# sourceMappingURL=index.esm.js.map