@eventuras/fides-auth 0.4.0 → 0.6.0

package/dist/build-nL2--iMi.js

@@ -0,0 +1,1014 @@
+//#region ../../node_modules/.pnpm/oauth4webapi@3.8.5/node_modules/oauth4webapi/build/index.js
+var e;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (e = "oauth4webapi/v3.8.5");
+function t(e, t) {
+	if (e == null) return !1;
+	try {
+		return e instanceof t || Object.getPrototypeOf(e)[Symbol.toStringTag] === t.prototype[Symbol.toStringTag];
+	} catch {
+		return !1;
+	}
+}
+var n = "ERR_INVALID_ARG_VALUE", r = "ERR_INVALID_ARG_TYPE";
+function i(e, t, n) {
+	let r = TypeError(e, { cause: n });
+	return Object.assign(r, { code: t }), r;
+}
+var a = Symbol(), o = Symbol(), s = Symbol(), c = Symbol(), l = Symbol(), u = new TextEncoder(), d = new TextDecoder();
+function f(e) {
+	return typeof e == "string" ? u.encode(e) : d.decode(e);
+}
+var p;
+if (Uint8Array.prototype.toBase64) p = (e) => (e instanceof ArrayBuffer && (e = new Uint8Array(e)), e.toBase64({
+	alphabet: "base64url",
+	omitPadding: !0
+}));
+else {
+	let e = 32768;
+	p = (t) => {
+		t instanceof ArrayBuffer && (t = new Uint8Array(t));
+		let n = [];
+		for (let r = 0; r < t.byteLength; r += e) n.push(String.fromCharCode.apply(null, t.subarray(r, r + e)));
+		return btoa(n.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+	};
+}
+var m = Uint8Array.fromBase64 ? (e) => {
+	try {
+		return Uint8Array.fromBase64(e, { alphabet: "base64url" });
+	} catch (e) {
+		throw i("The input to be decoded is not correctly encoded.", n, e);
+	}
+} : (e) => {
+	try {
+		let t = atob(e.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "")), n = new Uint8Array(t.length);
+		for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
+		return n;
+	} catch (e) {
+		throw i("The input to be decoded is not correctly encoded.", n, e);
+	}
+};
+function h(e) {
+	return typeof e == "string" ? m(e) : p(e);
+}
+var g = class extends Error {
+	code;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, this.code = tt, Error.captureStackTrace?.(this, this.constructor);
+	}
+}, _ = class extends Error {
+	code;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, t?.code && (this.code = t?.code), Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+function v(e, t, n) {
+	return new _(e, {
+		code: t,
+		cause: n
+	});
+}
+function y(e) {
+	return !(typeof e != "object" || !e || Array.isArray(e));
+}
+function b(r) {
+	t(r, Headers) && (r = Object.fromEntries(r.entries()));
+	let a = new Headers(r ?? {});
+	if (e && !a.has("user-agent") && a.set("user-agent", e), a.has("authorization")) throw i("\"options.headers\" must not include the \"authorization\" header name", n);
+	return a;
+}
+function x(e, t) {
+	if (t !== void 0) {
+		if (typeof t == "function" && (t = t(e.href)), !(t instanceof AbortSignal)) throw i("\"options.signal\" must return or be an instance of AbortSignal", r);
+		return t;
+	}
+}
+function S(e) {
+	return e.includes("//") ? e.replace("//", "/") : e;
+}
+function C(e, t, n = !1) {
+	return e.pathname === "/" ? e.pathname = t : e.pathname = S(`${t}/${n ? e.pathname : e.pathname.replace(/(\/)$/, "")}`), e;
+}
+function ee(e, t) {
+	return e.pathname = S(`${e.pathname}/${t}`), e;
+}
+async function te(e, t, n, o) {
+	if (!(e instanceof URL)) throw i(`"${t}" must be an instance of URL`, r);
+	k(e, o?.[a] !== !0);
+	let s = n(new URL(e.href)), l = b(o?.headers);
+	return l.set("accept", "application/json"), (o?.[c] || fetch)(s.href, {
+		body: void 0,
+		headers: Object.fromEntries(l.entries()),
+		method: "GET",
+		redirect: "manual",
+		signal: x(s, o?.signal)
+	});
+}
+async function ne(e, t) {
+	return te(e, "issuerIdentifier", (e) => {
+		switch (t?.algorithm) {
+			case void 0:
+			case "oidc":
+				ee(e, ".well-known/openid-configuration");
+				break;
+			case "oauth2":
+				C(e, ".well-known/oauth-authorization-server");
+				break;
+			default: throw i("\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"", n);
+		}
+		return e;
+	}, t);
+}
+function w(e, t, a, o, s) {
+	try {
+		if (typeof e != "number" || !Number.isFinite(e)) throw i(`${a} must be a number`, r, s);
+		if (e > 0) return;
+		if (t) {
+			if (e !== 0) throw i(`${a} must be a non-negative number`, n, s);
+			return;
+		}
+		throw i(`${a} must be a positive number`, n, s);
+	} catch (e) {
+		throw o ? v(e.message, o, s) : e;
+	}
+}
+function T(e, t, a, o) {
+	try {
+		if (typeof e != "string") throw i(`${t} must be a string`, r, o);
+		if (e.length === 0) throw i(`${t} must not be empty`, n, o);
+	} catch (e) {
+		throw a ? v(e.message, a, o) : e;
+	}
+}
+async function re(e, n) {
+	let a = e;
+	if (!(a instanceof URL) && a !== vt) throw i("\"expectedIssuerIdentifier\" must be an instance of URL", r);
+	if (!t(n, Response)) throw i("\"response\" must be an instance of Response", r);
+	if (n.status !== 200) throw v("\"response\" is not a conform Authorization Server Metadata response (unexpected HTTP status code)", it, n);
+	B(n);
+	let o = await _t(n);
+	if (T(o.issuer, "\"response\" body \"issuer\" property", L, { body: o }), a !== vt && new URL(o.issuer).href !== a.href) throw v("\"response\" body \"issuer\" property does not match the expected value", st, {
+		expected: a.href,
+		body: o,
+		attribute: "issuer"
+	});
+	return o;
+}
+function ie(e) {
+	oe(e, "application/json");
+}
+function ae(e, ...t) {
+	let n = "\"response\" content-type must be ";
+	if (t.length > 2) {
+		let e = t.pop();
+		n += `${t.join(", ")}, or ${e}`;
+	} else t.length === 2 ? n += `${t[0]} or ${t[1]}` : n += t[0];
+	return v(n, rt, e);
+}
+function oe(e, t) {
+	if (Me(e) !== t) throw ae(e, t);
+}
+function se() {
+	return h(crypto.getRandomValues(new Uint8Array(32)));
+}
+function ce() {
+	return se();
+}
+function le() {
+	return se();
+}
+async function ue(e) {
+	return T(e, "codeVerifier"), h(await crypto.subtle.digest("SHA-256", f(e)));
+}
+function de(e) {
+	let t = e?.[o];
+	return typeof t == "number" && Number.isFinite(t) ? t : 0;
+}
+function fe(e) {
+	let t = e?.[s];
+	return typeof t == "number" && Number.isFinite(t) && Math.sign(t) !== -1 ? t : 30;
+}
+function E() {
+	return Math.floor(Date.now() / 1e3);
+}
+function D(e) {
+	if (typeof e != "object" || !e) throw i("\"as\" must be an object", r);
+	T(e.issuer, "\"as.issuer\"");
+}
+function O(e) {
+	if (typeof e != "object" || !e) throw i("\"client\" must be an object", r);
+	T(e.client_id, "\"client.client_id\"");
+}
+function pe(e) {
+	return T(e, "\"clientSecret\""), (t, n, r, i) => {
+		r.set("client_id", n.client_id), r.set("client_secret", e);
+	};
+}
+function me() {
+	return (e, t, n, r) => {
+		n.set("client_id", t.client_id);
+	};
+}
+var he = URL.parse ? (e, t) => URL.parse(e, t) : (e, t) => {
+	try {
+		return new URL(e, t);
+	} catch {
+		return null;
+	}
+};
+function k(e, t) {
+	if (t && e.protocol !== "https:") throw v("only requests to HTTPS are allowed", at, e);
+	if (e.protocol !== "https:" && e.protocol !== "http:") throw v("only HTTP and HTTPS requests are allowed", ot, e);
+}
+function ge(e, t, n, r) {
+	let i;
+	if (typeof e != "string" || !(i = he(e))) throw v(`authorization server metadata does not contain a valid ${n ? `"as.mtls_endpoint_aliases.${t}"` : `"as.${t}"`}`, e === void 0 ? ct : lt, { attribute: n ? `mtls_endpoint_aliases.${t}` : t });
+	return k(i, r), i;
+}
+function A(e, t, n, r) {
+	return n && e.mtls_endpoint_aliases && t in e.mtls_endpoint_aliases ? ge(e.mtls_endpoint_aliases[t], t, n, r) : ge(e[t], t, n, r);
+}
+async function _e(e, t, n, r, i) {
+	D(e), O(t);
+	let o = A(e, "pushed_authorization_request_endpoint", t.use_mtls_endpoint_aliases, i?.[a] !== !0), s = new URLSearchParams(r);
+	s.set("client_id", t.client_id);
+	let c = b(i?.headers);
+	c.set("accept", "application/json"), i?.DPoP !== void 0 && (je(i.DPoP), await i.DPoP.addProof(o, c, "POST"));
+	let l = await Ne(e, t, n, o, s, c, i);
+	return i?.DPoP?.cacheNonce(l, o), l;
+}
+function ve(e) {
+	if (e instanceof M) {
+		let { 0: t, length: n } = e.cause;
+		return n === 1 && t.scheme === "dpop" && t.parameters.error === "use_dpop_nonce";
+	}
+	return e instanceof j ? e.error === "use_dpop_nonce" : !1;
+}
+var j = class extends Error {
+	cause;
+	code;
+	error;
+	status;
+	error_description;
+	response;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, this.code = et, this.cause = t.cause, this.error = t.cause.error, this.status = t.response.status, this.error_description = t.cause.error_description, Object.defineProperty(this, "response", {
+			enumerable: !1,
+			value: t.response
+		}), Error.captureStackTrace?.(this, this.constructor);
+	}
+}, ye = class extends Error {
+	cause;
+	code;
+	error;
+	error_description;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, this.code = nt, this.cause = t.cause, this.error = t.cause.get("error"), this.error_description = t.cause.get("error_description") ?? void 0, Error.captureStackTrace?.(this, this.constructor);
+	}
+}, M = class extends Error {
+	cause;
+	code;
+	response;
+	status;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, this.code = $e, this.cause = t.cause, this.status = t.response.status, this.response = t.response, Object.defineProperty(this, "response", { enumerable: !1 }), Error.captureStackTrace?.(this, this.constructor);
+	}
+}, N = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+", be = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}", xe = "(" + N + ")\\s*=\\s*\"((?:[^\"\\\\]|\\\\[\\s\\S])*)\"", Se = "(" + N + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)", Ce = RegExp("^[,\\s]*(" + N + ")"), we = RegExp("^[,\\s]*" + xe + "[,\\s]*(.*)"), Te = RegExp("^[,\\s]*" + Se + "[,\\s]*(.*)"), Ee = RegExp("^(" + be + ")(?:$|[,\\s])(.*)");
+function De(e) {
+	if (!t(e, Response)) throw i("\"response\" must be an instance of Response", r);
+	let n = e.headers.get("www-authenticate");
+	if (n === null) return;
+	let a = [], o = n;
+	for (; o;) {
+		let e = o.match(Ce), t = e?.["1"].toLowerCase();
+		if (!t) return;
+		let n = o.substring(e[0].length);
+		if (n && !n.match(/^[\s,]/)) return;
+		let r = n.match(/^\s+(.*)$/), i = !!r;
+		o = r ? r[1] : void 0;
+		let s = {}, c;
+		if (i) for (; o;) {
+			let t, n;
+			if (e = o.match(we)) {
+				if ([, t, n, o] = e, n.includes("\\")) try {
+					n = JSON.parse(`"${n}"`);
+				} catch {}
+				s[t.toLowerCase()] = n;
+				continue;
+			}
+			if (e = o.match(Te)) {
+				[, t, n, o] = e, s[t.toLowerCase()] = n;
+				continue;
+			}
+			if (e = o.match(Ee)) {
+				if (Object.keys(s).length) break;
+				[, c, o] = e;
+				break;
+			}
+			return;
+		}
+		else o = n || void 0;
+		let l = {
+			scheme: t,
+			parameters: s
+		};
+		c && (l.token68 = c), a.push(l);
+	}
+	if (a.length) return a;
+}
+async function Oe(e, n, a) {
+	if (D(e), O(n), !t(a, Response)) throw i("\"response\" must be an instance of Response", r);
+	await Ae(a, 201, "Pushed Authorization Request Endpoint"), B(a);
+	let o = await _t(a);
+	T(o.request_uri, "\"response\" body \"request_uri\" property", L, { body: o });
+	let s = typeof o.expires_in == "number" ? o.expires_in : parseFloat(o.expires_in);
+	return w(s, !0, "\"response\" body \"expires_in\" property", L, { body: o }), o.expires_in = s, o;
+}
+async function ke(e) {
+	if (e.status > 399 && e.status < 500) {
+		B(e), ie(e);
+		try {
+			let t = await e.clone().json();
+			if (y(t) && typeof t.error == "string" && t.error.length) return t;
+		} catch {}
+	}
+}
+async function Ae(e, t, n) {
+	if (e.status !== t) {
+		Re(e);
+		let t;
+		throw (t = await ke(e)) ? (await e.body?.cancel(), new j("server responded with an error in the response body", {
+			cause: t,
+			response: e
+		})) : v(`"response" is not a conform ${n} response (unexpected HTTP status code)`, it, e);
+	}
+}
+function je(e) {
+	if (!He.has(e)) throw i("\"options.DPoP\" is not a valid DPoPHandle", n);
+}
+function Me(e) {
+	return e.headers.get("content-type")?.split(";")[0];
+}
+async function Ne(e, t, n, r, i, a, o) {
+	return await n(e, t, i, a), a.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8"), (o?.[c] || fetch)(r.href, {
+		body: i,
+		headers: Object.fromEntries(a.entries()),
+		method: "POST",
+		redirect: "manual",
+		signal: x(r, o?.signal)
+	});
+}
+async function Pe(e, t, n, r, i, o) {
+	let s = A(e, "token_endpoint", t.use_mtls_endpoint_aliases, o?.[a] !== !0);
+	i.set("grant_type", r);
+	let c = b(o?.headers);
+	c.set("accept", "application/json"), o?.DPoP !== void 0 && (je(o.DPoP), await o.DPoP.addProof(s, c, "POST"));
+	let l = await Ne(e, t, n, s, i, c, o);
+	return o?.DPoP?.cacheNonce(l, s), l;
+}
+async function Fe(e, t, n, r, i) {
+	D(e), O(t), T(r, "\"refreshToken\"");
+	let a = new URLSearchParams(i?.additionalParameters);
+	return a.set("refresh_token", r), Pe(e, t, n, "refresh_token", a, i);
+}
+var Ie = /* @__PURE__ */ new WeakMap(), Le = /* @__PURE__ */ new WeakMap();
+function P(e) {
+	if (!e.id_token) return;
+	let t = Ie.get(e);
+	if (!t) throw i("\"ref\" was already garbage collected or did not resolve from the proper sources", n);
+	return t;
+}
+async function F(e, n, a, o, s, c) {
+	if (D(e), O(n), !t(a, Response)) throw i("\"response\" must be an instance of Response", r);
+	await Ae(a, 200, "Token Endpoint"), B(a);
+	let l = await _t(a);
+	if (T(l.access_token, "\"response\" body \"access_token\" property", L, { body: l }), T(l.token_type, "\"response\" body \"token_type\" property", L, { body: l }), l.token_type = l.token_type.toLowerCase(), l.expires_in !== void 0) {
+		let e = typeof l.expires_in == "number" ? l.expires_in : parseFloat(l.expires_in);
+		w(e, !0, "\"response\" body \"expires_in\" property", L, { body: l }), l.expires_in = e;
+	}
+	if (l.refresh_token !== void 0 && T(l.refresh_token, "\"response\" body \"refresh_token\" property", L, { body: l }), l.scope !== void 0 && typeof l.scope != "string") throw v("\"response\" body \"scope\" property must be a string", L, { body: l });
+	if (l.id_token !== void 0) {
+		T(l.id_token, "\"response\" body \"id_token\" property", L, { body: l });
+		let t = [
+			"aud",
+			"exp",
+			"iat",
+			"iss",
+			"sub"
+		];
+		n.require_auth_time === !0 && t.push("auth_time"), n.default_max_age !== void 0 && (w(n.default_max_age, !0, "\"client.default_max_age\""), t.push("auth_time")), o?.length && t.push(...o);
+		let { claims: r, jwt: i } = await ut(l.id_token, pt.bind(void 0, n.id_token_signed_response_alg, e.id_token_signing_alg_values_supported, "RS256"), de(n), fe(n), s).then(qe.bind(void 0, t)).then(Ve.bind(void 0, e)).then(Be.bind(void 0, n.client_id));
+		if (Array.isArray(r.aud) && r.aud.length !== 1) {
+			if (r.azp === void 0) throw v("ID Token \"aud\" (audience) claim includes additional untrusted audiences", z, {
+				claims: r,
+				claim: "aud"
+			});
+			if (r.azp !== n.client_id) throw v("unexpected ID Token \"azp\" (authorized party) claim value", z, {
+				expected: n.client_id,
+				claims: r,
+				claim: "azp"
+			});
+		}
+		r.auth_time !== void 0 && w(r.auth_time, !0, "ID Token \"auth_time\" (authentication time)", L, { claims: r }), Le.set(a, i), Ie.set(l, r);
+	}
+	if (c?.[l.token_type] !== void 0) c[l.token_type](a, l);
+	else if (l.token_type !== "dpop" && l.token_type !== "bearer") throw new g("unsupported `token_type` value", { cause: { body: l } });
+	return l;
+}
+function Re(e) {
+	let t;
+	if (t = De(e)) throw new M("server responded with a challenge in the WWW-Authenticate HTTP Header", {
+		cause: t,
+		response: e
+	});
+}
+async function ze(e, t, n, r) {
+	return F(e, t, n, void 0, r?.[l], r?.recognizedTokenTypes);
+}
+function Be(e, t) {
+	if (Array.isArray(t.claims.aud)) {
+		if (!t.claims.aud.includes(e)) throw v("unexpected JWT \"aud\" (audience) claim value", z, {
+			expected: e,
+			claims: t.claims,
+			claim: "aud"
+		});
+	} else if (t.claims.aud !== e) throw v("unexpected JWT \"aud\" (audience) claim value", z, {
+		expected: e,
+		claims: t.claims,
+		claim: "aud"
+	});
+	return t;
+}
+function Ve(e, t) {
+	let n = e[yt]?.(t) ?? e.issuer;
+	if (t.claims.iss !== n) throw v("unexpected JWT \"iss\" (issuer) claim value", z, {
+		expected: n,
+		claims: t.claims,
+		claim: "iss"
+	});
+	return t;
+}
+var He = /* @__PURE__ */ new WeakSet();
+function Ue(e) {
+	return He.add(e), e;
+}
+var We = Symbol();
+async function Ge(e, t, r, a, o, s, c) {
+	if (D(e), O(t), !He.has(a)) throw i("\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()", n);
+	T(o, "\"redirectUri\"");
+	let l = V(a, "code");
+	if (!l) throw v("no authorization code in \"callbackParameters\"", L);
+	let u = new URLSearchParams(c?.additionalParameters);
+	return u.set("redirect_uri", o), u.set("code", l), s !== We && (T(s, "\"codeVerifier\""), u.set("code_verifier", s)), Pe(e, t, r, "authorization_code", u, c);
+}
+var Ke = {
+	aud: "audience",
+	c_hash: "code hash",
+	client_id: "client id",
+	exp: "expiration time",
+	iat: "issued at",
+	iss: "issuer",
+	jti: "jwt id",
+	nonce: "nonce",
+	s_hash: "state hash",
+	sub: "subject",
+	ath: "access token hash",
+	htm: "http method",
+	htu: "http uri",
+	cnf: "confirmation",
+	auth_time: "authentication time"
+};
+function qe(e, t) {
+	for (let n of e) if (t.claims[n] === void 0) throw v(`JWT "${n}" (${Ke[n]}) claim missing`, L, { claims: t.claims });
+	return t;
+}
+var Je = Symbol(), Ye = Symbol();
+async function Xe(e, t, n, r) {
+	return typeof r?.expectedNonce == "string" || typeof r?.maxAge == "number" || r?.requireIdToken ? Ze(e, t, n, r.expectedNonce, r.maxAge, r[l], r.recognizedTokenTypes) : Qe(e, t, n, r?.[l], r?.recognizedTokenTypes);
+}
+async function Ze(e, t, n, r, i, a, o) {
+	let s = [];
+	switch (r) {
+		case void 0:
+			r = Je;
+			break;
+		case Je: break;
+		default: T(r, "\"expectedNonce\" argument"), s.push("nonce");
+	}
+	switch (i ??= t.default_max_age, i) {
+		case void 0:
+			i = Ye;
+			break;
+		case Ye: break;
+		default: w(i, !0, "\"maxAge\" argument"), s.push("auth_time");
+	}
+	let c = await F(e, t, n, s, a, o);
+	T(c.id_token, "\"response\" body \"id_token\" property", L, { body: c });
+	let l = P(c);
+	if (i !== Ye) {
+		let e = E() + de(t), n = fe(t);
+		if (l.auth_time + i < e - n) throw v("too much time has elapsed since the last End-User authentication", R, {
+			claims: l,
+			now: e,
+			tolerance: n,
+			claim: "auth_time"
+		});
+	}
+	if (r === Je) {
+		if (l.nonce !== void 0) throw v("unexpected ID Token \"nonce\" claim value", z, {
+			expected: void 0,
+			claims: l,
+			claim: "nonce"
+		});
+	} else if (l.nonce !== r) throw v("unexpected ID Token \"nonce\" claim value", z, {
+		expected: r,
+		claims: l,
+		claim: "nonce"
+	});
+	return c;
+}
+async function Qe(e, t, n, r, i) {
+	let a = await F(e, t, n, void 0, r, i), o = P(a);
+	if (o) {
+		if (t.default_max_age !== void 0) {
+			w(t.default_max_age, !0, "\"client.default_max_age\"");
+			let e = E() + de(t), n = fe(t);
+			if (o.auth_time + t.default_max_age < e - n) throw v("too much time has elapsed since the last End-User authentication", R, {
+				claims: o,
+				now: e,
+				tolerance: n,
+				claim: "auth_time"
+			});
+		}
+		if (o.nonce !== void 0) throw v("unexpected ID Token \"nonce\" claim value", z, {
+			expected: void 0,
+			claims: o,
+			claim: "nonce"
+		});
+	}
+	return a;
+}
+var $e = "OAUTH_WWW_AUTHENTICATE_CHALLENGE", et = "OAUTH_RESPONSE_BODY_ERROR", tt = "OAUTH_UNSUPPORTED_OPERATION", nt = "OAUTH_AUTHORIZATION_RESPONSE_ERROR", I = "OAUTH_PARSE_ERROR", L = "OAUTH_INVALID_RESPONSE", rt = "OAUTH_RESPONSE_IS_NOT_JSON", it = "OAUTH_RESPONSE_IS_NOT_CONFORM", at = "OAUTH_HTTP_REQUEST_FORBIDDEN", ot = "OAUTH_REQUEST_PROTOCOL_FORBIDDEN", R = "OAUTH_JWT_TIMESTAMP_CHECK_FAILED", z = "OAUTH_JWT_CLAIM_COMPARISON_FAILED", st = "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED", ct = "OAUTH_MISSING_SERVER_METADATA", lt = "OAUTH_INVALID_SERVER_METADATA";
+function B(e) {
+	if (e.bodyUsed) throw i("\"response\" body has been used already", n);
+}
+async function ut(e, t, n, r, i) {
+	let { 0: a, 1: o, length: s } = e.split(".");
+	if (s === 5) if (i !== void 0) e = await i(e), {0: a, 1: o, length: s} = e.split(".");
+	else throw new g("JWE decryption is not configured", { cause: e });
+	if (s !== 3) throw v("Invalid JWT", L, e);
+	let c;
+	try {
+		c = JSON.parse(f(h(a)));
+	} catch (e) {
+		throw v("failed to parse JWT Header body as base64url encoded JSON", I, e);
+	}
+	if (!y(c)) throw v("JWT Header must be a top level object", L, e);
+	if (t(c), c.crit !== void 0) throw new g("no JWT \"crit\" header parameter extensions are supported", { cause: { header: c } });
+	let l;
+	try {
+		l = JSON.parse(f(h(o)));
+	} catch (e) {
+		throw v("failed to parse JWT Payload body as base64url encoded JSON", I, e);
+	}
+	if (!y(l)) throw v("JWT Payload must be a top level object", L, e);
+	let u = E() + n;
+	if (l.exp !== void 0) {
+		if (typeof l.exp != "number") throw v("unexpected JWT \"exp\" (expiration time) claim type", L, { claims: l });
+		if (l.exp <= u - r) throw v("unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp", R, {
+			claims: l,
+			now: u,
+			tolerance: r,
+			claim: "exp"
+		});
+	}
+	if (l.iat !== void 0 && typeof l.iat != "number") throw v("unexpected JWT \"iat\" (issued at) claim type", L, { claims: l });
+	if (l.iss !== void 0 && typeof l.iss != "string") throw v("unexpected JWT \"iss\" (issuer) claim type", L, { claims: l });
+	if (l.nbf !== void 0) {
+		if (typeof l.nbf != "number") throw v("unexpected JWT \"nbf\" (not before) claim type", L, { claims: l });
+		if (l.nbf > u + r) throw v("unexpected JWT \"nbf\" (not before) claim value", R, {
+			claims: l,
+			now: u,
+			tolerance: r,
+			claim: "nbf"
+		});
+	}
+	if (l.aud !== void 0 && typeof l.aud != "string" && !Array.isArray(l.aud)) throw v("unexpected JWT \"aud\" (audience) claim type", L, { claims: l });
+	return {
+		header: c,
+		claims: l,
+		jwt: e
+	};
+}
+async function dt(e) {
+	if (e.bodyUsed) throw i("form_post Request instances must contain a readable body", n, { cause: e });
+	return e.text();
+}
+async function ft(e) {
+	if (e.method !== "POST") throw i("form_post responses are expected to use the POST method", n, { cause: e });
+	if (Me(e) !== "application/x-www-form-urlencoded") throw i("form_post responses are expected to use the application/x-www-form-urlencoded content-type", n, { cause: e });
+	return dt(e);
+}
+function pt(e, t, n, r) {
+	if (e !== void 0) {
+		if (typeof e == "string" ? r.alg !== e : !e.includes(r.alg)) throw v("unexpected JWT \"alg\" header parameter", L, {
+			header: r,
+			expected: e,
+			reason: "client configuration"
+		});
+		return;
+	}
+	if (Array.isArray(t)) {
+		if (!t.includes(r.alg)) throw v("unexpected JWT \"alg\" header parameter", L, {
+			header: r,
+			expected: t,
+			reason: "authorization server metadata"
+		});
+		return;
+	}
+	if (n !== void 0) {
+		if (typeof n == "string" ? r.alg !== n : typeof n == "function" ? !n(r.alg) : !n.includes(r.alg)) throw v("unexpected JWT \"alg\" header parameter", L, {
+			header: r,
+			expected: n,
+			reason: "default value"
+		});
+		return;
+	}
+	throw v("missing client or server configuration to verify used JWT \"alg\" header parameter", void 0, {
+		client: e,
+		issuer: t,
+		fallback: n
+	});
+}
+function V(e, t) {
+	let { 0: n, length: r } = e.getAll(t);
+	if (r > 1) throw v(`"${t}" parameter must be provided only once`, L);
+	return n;
+}
+var mt = Symbol(), ht = Symbol();
+function gt(e, t, n, a) {
+	if (D(e), O(t), n instanceof URL && (n = n.searchParams), !(n instanceof URLSearchParams)) throw i("\"parameters\" must be an instance of URLSearchParams, or URL", r);
+	if (V(n, "response")) throw v("\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()", L, { parameters: n });
+	let o = V(n, "iss"), s = V(n, "state");
+	if (!o && e.authorization_response_iss_parameter_supported) throw v("response parameter \"iss\" (issuer) missing", L, { parameters: n });
+	if (o && o !== e.issuer) throw v("unexpected \"iss\" (issuer) response parameter value", L, {
+		expected: e.issuer,
+		parameters: n
+	});
+	switch (a) {
+		case void 0:
+		case ht:
+			if (s !== void 0) throw v("unexpected \"state\" response parameter encountered", L, {
+				expected: void 0,
+				parameters: n
+			});
+			break;
+		case mt: break;
+		default: if (T(a, "\"expectedState\" argument"), s !== a) throw v(s === void 0 ? "response parameter \"state\" missing" : "unexpected \"state\" response parameter value", L, {
+			expected: a,
+			parameters: n
+		});
+	}
+	if (V(n, "error")) throw new ye("authorization response from the server is an error", { cause: n });
+	let c = V(n, "id_token"), l = V(n, "token");
+	if (c !== void 0 || l !== void 0) throw new g("implicit and hybrid flows are not supported");
+	return Ue(new URLSearchParams(n));
+}
+async function _t(e, t = ie) {
+	let n;
+	try {
+		n = await e.json();
+	} catch (n) {
+		throw t(e), v("failed to parse \"response\" body as JSON", I, n);
+	}
+	if (!y(n)) throw v("\"response\" body must be a top level object", L, { body: n });
+	return n;
+}
+var vt = Symbol(), yt = Symbol(), H, bt;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (bt = "openid-client/v6.8.3", H = { "user-agent": bt });
+var U = (e) => xt.get(e), xt, St;
+function Ct(e) {
+	return e === void 0 ? (St ||= /* @__PURE__ */ new WeakMap(), (e, t, n, r) => {
+		let i;
+		return (i = St.get(t)) || (wt(t.client_secret, "\"metadata.client_secret\""), i = pe(t.client_secret), St.set(t, i)), i(e, t, n, r);
+	}) : pe(e);
+}
+function wt(e, t) {
+	if (typeof e != "string") throw q(`${t} must be a string`, K);
+	if (e.length === 0) throw q(`${t} must not be empty`, G);
+}
+function Tt() {
+	return me();
+}
+var W = c, G = "ERR_INVALID_ARG_VALUE", K = "ERR_INVALID_ARG_TYPE";
+function q(e, t, n) {
+	let r = TypeError(e, { cause: n });
+	return Object.assign(r, { code: t }), r;
+}
+function Et(e) {
+	return ue(e);
+}
+function Dt() {
+	return ce();
+}
+function Ot() {
+	return le();
+}
+var J = class extends Error {
+	code;
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, this.code = t?.code, Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+new TextDecoder();
+function Y(e, t, n) {
+	return new J(e, {
+		cause: t,
+		code: n
+	});
+}
+function X(e) {
+	if (e instanceof TypeError || e instanceof J || e instanceof j || e instanceof ye || e instanceof M) throw e;
+	if (e instanceof _) switch (e.code) {
+		case at: throw Y("only requests to HTTPS are allowed", e, e.code);
+		case ot: throw Y("only requests to HTTP or HTTPS are allowed", e, e.code);
+		case it: throw Y("unexpected HTTP response status code", e.cause, e.code);
+		case rt: throw Y("unexpected response content-type", e.cause, e.code);
+		case I: throw Y("parsing error occured", e, e.code);
+		case L: throw Y("invalid response encountered", e, e.code);
+		case z: throw Y("unexpected JWT claim value encountered", e, e.code);
+		case st: throw Y("unexpected JSON attribute value encountered", e, e.code);
+		case R: throw Y("JWT timestamp claim value failed validation", e, e.code);
+		default: throw Y(e.message, e, e.code);
+	}
+	if (e instanceof g) throw Y("unsupported operation", e, e.code);
+	if (e instanceof DOMException) switch (e.name) {
+		case "OperationError": throw Y("runtime operation error", e, tt);
+		case "NotSupportedError": throw Y("runtime unsupported operation", e, tt);
+		case "TimeoutError": throw Y("operation timed out", e, "OAUTH_TIMEOUT");
+		case "AbortError": throw Y("operation aborted", e, "OAUTH_ABORT");
+	}
+	throw new J("something went wrong", { cause: e });
+}
+function kt(e, t, n) {
+	return e.origin === "https://login.microsoftonline.com" && (!n?.algorithm || n.algorithm === "oidc") ? (t[Ft] = !0, !0) : !1;
+}
+function At(e, t) {
+	return !!(e.hostname.endsWith(".b2clogin.com") && (!t?.algorithm || t.algorithm === "oidc"));
+}
+async function jt(e, t, n, r, i) {
+	let a = new Z(await Mt(e, i), t, n, r), o = U(a);
+	if (i?.[W] && (o.fetch = i[W]), i?.timeout && (o.timeout = i.timeout), i?.execute) for (let e of i.execute) e(a);
+	return a;
+}
+async function Mt(e, t) {
+	if (!(e instanceof URL)) throw q("\"server\" must be an instance of URL", K);
+	let n = !e.href.includes("/.well-known/"), r = t?.timeout ?? 30, i = AbortSignal.timeout(r * 1e3), o = await (n ? ne(e, {
+		algorithm: t?.algorithm,
+		[c]: t?.[W],
+		[a]: t?.execute?.includes(Rt),
+		signal: i,
+		headers: new Headers(H)
+	}) : (t?.[W] || fetch)((k(e, !t?.execute?.includes(Rt)), e.href), {
+		headers: Object.fromEntries(new Headers({
+			accept: "application/json",
+			...H
+		}).entries()),
+		body: void 0,
+		method: "GET",
+		redirect: "manual",
+		signal: i
+	})).then((e) => re(vt, e)).catch(X);
+	return n && new URL(o.issuer).href !== e.href && (kt(e, o, t) || At(e, t) || (() => {
+		throw new J("discovered metadata issuer does not match the expected issuer", {
+			code: "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",
+			cause: {
+				expected: e.href,
+				body: o,
+				attribute: "issuer"
+			}
+		});
+	})()), o;
+}
+function Nt(e) {
+	return { supportsPKCE: {
+		__proto__: null,
+		value(t = "S256") {
+			return e.code_challenge_methods_supported?.includes(t) === !0;
+		}
+	} };
+}
+function Pt(e) {
+	Object.defineProperties(e, Nt(e));
+}
+var Ft = Symbol(), Z = class {
+	constructor(e, t, n, r) {
+		if (typeof t != "string" || !t.length) throw q("\"clientId\" must be a non-empty string", K);
+		if (typeof n == "string" && (n = { client_secret: n }), n?.client_id !== void 0 && t !== n.client_id) throw q("\"clientId\" and \"metadata.client_id\" must be the same", G);
+		let i = {
+			...structuredClone(n),
+			client_id: t
+		};
+		i[o] = n?.[o] ?? 0, i[s] = n?.[s] ?? 30;
+		let a;
+		a = r || (typeof i.client_secret == "string" && i.client_secret.length ? Ct(i.client_secret) : Tt());
+		let c = Object.freeze(i), l = structuredClone(e);
+		Ft in e && (l[yt] = ({ claims: { tid: t } }) => e.issuer.replace("{tenantid}", t));
+		let u = Object.freeze(l);
+		xt ||= /* @__PURE__ */ new WeakMap(), xt.set(this, {
+			__proto__: null,
+			as: u,
+			c,
+			auth: a,
+			tlsOnly: !0,
+			jwksCache: {}
+		});
+	}
+	serverMetadata() {
+		let e = structuredClone(U(this).as);
+		return Pt(e), e;
+	}
+	clientMetadata() {
+		return structuredClone(U(this).c);
+	}
+	get timeout() {
+		return U(this).timeout;
+	}
+	set timeout(e) {
+		U(this).timeout = e;
+	}
+	get [W]() {
+		return U(this).fetch;
+	}
+	set [W](e) {
+		U(this).fetch = e;
+	}
+};
+Object.freeze(Z.prototype);
+function It(e) {
+	let t;
+	if (e.expires_in !== void 0) {
+		let n = /* @__PURE__ */ new Date();
+		n.setSeconds(n.getSeconds() + e.expires_in), t = n.getTime();
+	}
+	return {
+		expiresIn: {
+			__proto__: null,
+			value() {
+				if (t) {
+					let e = Date.now();
+					return t > e ? Math.floor((t - e) / 1e3) : 0;
+				}
+			}
+		},
+		claims: {
+			__proto__: null,
+			value() {
+				try {
+					return P(this);
+				} catch {
+					return;
+				}
+			}
+		}
+	};
+}
+function Lt(e) {
+	Object.defineProperties(e, It(e));
+}
+function Rt(e) {
+	U(e).tlsOnly = !1;
+}
+function zt(e) {
+	return e = new URL(e), e.search = "", e.hash = "", e.href;
+}
+function Bt(e, t) {
+	try {
+		return Object.getPrototypeOf(e)[Symbol.toStringTag] === t;
+	} catch {
+		return !1;
+	}
+}
+async function Vt(e, t, n, r, i) {
+	if (Q(e), i?.flag !== $ && !(t instanceof URL) && !Bt(t, "Request")) throw q("\"currentUrl\" must be an instance of URL, or Request", K);
+	let o, s, { as: u, c: d, auth: f, fetch: p, tlsOnly: m, jarm: h, hybrid: g, nonRepudiation: _, timeout: v, decrypt: y, implicit: b } = U(e);
+	if (i?.flag === $) o = i.authResponse, s = i.redirectUri;
+	else {
+		if (!(t instanceof URL)) {
+			let e = t;
+			switch (t = new URL(t.url), e.method) {
+				case "GET": break;
+				case "POST":
+					let n = new URLSearchParams(await ft(e));
+					if (g) t.hash = n.toString();
+					else for (let [e, r] of n.entries()) t.searchParams.append(e, r);
+					break;
+				default: throw q("unexpected Request HTTP method", G);
+			}
+		}
+		switch (s = zt(t), !0) {
+			case !!h:
+				o = await h(t, n?.expectedState);
+				break;
+			case !!g:
+				o = await g(t, n?.expectedNonce, n?.expectedState, n?.maxAge);
+				break;
+			case !!b: throw TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");
+			default: try {
+				o = gt(u, d, t.searchParams, n?.expectedState);
+			} catch (e) {
+				X(e);
+			}
+		}
+	}
+	let x = await Ge(u, d, f, o, s, n?.pkceCodeVerifier || We, {
+		additionalParameters: r,
+		[c]: p,
+		[a]: !m,
+		DPoP: i?.DPoP,
+		headers: new Headers(H),
+		signal: Gt(v)
+	}).catch(X);
+	(typeof n?.expectedNonce == "string" || typeof n?.maxAge == "number") && (n.idTokenExpected = !0);
+	let S = Xe(u, d, x, {
+		expectedNonce: n?.expectedNonce,
+		maxAge: n?.maxAge,
+		requireIdToken: n?.idTokenExpected,
+		[l]: y
+	}), C;
+	try {
+		C = await S;
+	} catch (t) {
+		if (Kt(t, i)) return Vt(e, void 0, n, r, {
+			...i,
+			flag: $,
+			authResponse: o,
+			redirectUri: s
+		});
+		X(t);
+	}
+	return C.id_token && await _?.(x), Lt(C), C;
+}
+async function Ht(e, t, n, r) {
+	Q(e), n = new URLSearchParams(n);
+	let { as: i, c: o, auth: s, fetch: u, tlsOnly: d, nonRepudiation: f, timeout: p, decrypt: m } = U(e), h = await Fe(i, o, s, t, {
+		[c]: u,
+		[a]: !d,
+		additionalParameters: n,
+		DPoP: r?.DPoP,
+		headers: new Headers(H),
+		signal: Gt(p)
+	}).catch(X), g = ze(i, o, h, { [l]: m }), _;
+	try {
+		_ = await g;
+	} catch (i) {
+		if (Kt(i, r)) return Ht(e, t, n, {
+			...r,
+			flag: $
+		});
+		X(i);
+	}
+	return _.id_token && await f?.(h), Lt(_), _;
+}
+function Ut(e, t) {
+	Q(e);
+	let { as: n, c: r, tlsOnly: i, hybrid: a, jarm: o, implicit: s } = U(e), c = A(n, "authorization_endpoint", !1, i);
+	if (t = new URLSearchParams(t), t.has("client_id") || t.set("client_id", r.client_id), !t.has("request_uri") && !t.has("request")) {
+		if (t.has("response_type") || t.set("response_type", a ? "code id_token" : s ? "id_token" : "code"), s && !t.has("nonce")) throw q("response_type=id_token clients must provide a nonce parameter in their authorization request parameters", G);
+		o && t.set("response_mode", "jwt");
+	}
+	for (let [e, n] of t.entries()) c.searchParams.append(e, n);
+	return c;
+}
+async function Wt(e, t, n) {
+	Q(e);
+	let r = Ut(e, t), { as: i, c: o, auth: s, fetch: l, tlsOnly: u, timeout: d } = U(e), f = Oe(i, o, await _e(i, o, s, r.searchParams, {
+		[c]: l,
+		[a]: !u,
+		DPoP: n?.DPoP,
+		headers: new Headers(H),
+		signal: Gt(d)
+	}).catch(X)), p;
+	try {
+		p = await f;
+	} catch (r) {
+		if (Kt(r, n)) return Wt(e, t, {
+			...n,
+			flag: $
+		});
+		X(r);
+	}
+	return Ut(e, { request_uri: p.request_uri });
+}
+function Q(e) {
+	if (!(e instanceof Z)) throw q("\"config\" must be an instance of Configuration", K);
+	if (Object.getPrototypeOf(e) !== Z.prototype) throw q("subclassing Configuration is not allowed", G);
+}
+function Gt(e) {
+	return e ? AbortSignal.timeout(e * 1e3) : void 0;
+}
+function Kt(e, t) {
+	return t?.DPoP && t.flag !== $ ? ve(e) : !1;
+}
+var $ = Symbol();
+//#endregion
+export { Et as a, Ot as c, Wt as i, Ht as l, Vt as n, jt as o, Ut as r, Dt as s, Ct as t };