@eventuras/fides-auth 0.4.0 → 0.6.0

package/dist/build-BnXr85C9.js

@@ -1,977 +0,0 @@
-//#region ../../node_modules/.pnpm/oauth4webapi@3.8.5/node_modules/oauth4webapi/build/index.js
-var e;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (e = "oauth4webapi/v3.8.5");
-function t(e, t) {
-	if (e == null) return !1;
-	try {
-		return e instanceof t || Object.getPrototypeOf(e)[Symbol.toStringTag] === t.prototype[Symbol.toStringTag];
-	} catch {
-		return !1;
-	}
-}
-var n = "ERR_INVALID_ARG_VALUE", r = "ERR_INVALID_ARG_TYPE";
-function i(e, t, n) {
-	let r = TypeError(e, { cause: n });
-	return Object.assign(r, { code: t }), r;
-}
-var a = Symbol(), o = Symbol(), s = Symbol(), c = Symbol(), l = Symbol(), u = new TextEncoder(), d = new TextDecoder();
-function f(e) {
-	return typeof e == "string" ? u.encode(e) : d.decode(e);
-}
-var p;
-if (Uint8Array.prototype.toBase64) p = (e) => (e instanceof ArrayBuffer && (e = new Uint8Array(e)), e.toBase64({
-	alphabet: "base64url",
-	omitPadding: !0
-}));
-else {
-	let e = 32768;
-	p = (t) => {
-		t instanceof ArrayBuffer && (t = new Uint8Array(t));
-		let n = [];
-		for (let r = 0; r < t.byteLength; r += e) n.push(String.fromCharCode.apply(null, t.subarray(r, r + e)));
-		return btoa(n.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-	};
-}
-var ee = Uint8Array.fromBase64 ? (e) => {
-	try {
-		return Uint8Array.fromBase64(e, { alphabet: "base64url" });
-	} catch (e) {
-		throw i("The input to be decoded is not correctly encoded.", n, e);
-	}
-} : (e) => {
-	try {
-		let t = atob(e.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "")), n = new Uint8Array(t.length);
-		for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
-		return n;
-	} catch (e) {
-		throw i("The input to be decoded is not correctly encoded.", n, e);
-	}
-};
-function m(e) {
-	return typeof e == "string" ? ee(e) : p(e);
-}
-var h = class extends Error {
-	code;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, this.code = P, Error.captureStackTrace?.(this, this.constructor);
-	}
-}, g = class extends Error {
-	code;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, t?.code && (this.code = t?.code), Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-function _(e, t, n) {
-	return new g(e, {
-		code: t,
-		cause: n
-	});
-}
-function v(e) {
-	return !(typeof e != "object" || !e || Array.isArray(e));
-}
-function te(r) {
-	t(r, Headers) && (r = Object.fromEntries(r.entries()));
-	let a = new Headers(r ?? {});
-	if (e && !a.has("user-agent") && a.set("user-agent", e), a.has("authorization")) throw i("\"options.headers\" must not include the \"authorization\" header name", n);
-	return a;
-}
-function y(e, t) {
-	if (t !== void 0) {
-		if (typeof t == "function" && (t = t(e.href)), !(t instanceof AbortSignal)) throw i("\"options.signal\" must return or be an instance of AbortSignal", r);
-		return t;
-	}
-}
-function b(e) {
-	return e.includes("//") ? e.replace("//", "/") : e;
-}
-function x(e, t, n = !1) {
-	return e.pathname === "/" ? e.pathname = t : e.pathname = b(`${t}/${n ? e.pathname : e.pathname.replace(/(\/)$/, "")}`), e;
-}
-function ne(e, t) {
-	return e.pathname = b(`${e.pathname}/${t}`), e;
-}
-async function re(e, t, n, o) {
-	if (!(e instanceof URL)) throw i(`"${t}" must be an instance of URL`, r);
-	ge(e, o?.[a] !== !0);
-	let s = n(new URL(e.href)), l = te(o?.headers);
-	return l.set("accept", "application/json"), (o?.[c] || fetch)(s.href, {
-		body: void 0,
-		headers: Object.fromEntries(l.entries()),
-		method: "GET",
-		redirect: "manual",
-		signal: y(s, o?.signal)
-	});
-}
-async function ie(e, t) {
-	return re(e, "issuerIdentifier", (e) => {
-		switch (t?.algorithm) {
-			case void 0:
-			case "oidc":
-				ne(e, ".well-known/openid-configuration");
-				break;
-			case "oauth2":
-				x(e, ".well-known/oauth-authorization-server");
-				break;
-			default: throw i("\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"", n);
-		}
-		return e;
-	}, t);
-}
-function S(e, t, a, o, s) {
-	try {
-		if (typeof e != "number" || !Number.isFinite(e)) throw i(`${a} must be a number`, r, s);
-		if (e > 0) return;
-		if (t) {
-			if (e !== 0) throw i(`${a} must be a non-negative number`, n, s);
-			return;
-		}
-		throw i(`${a} must be a positive number`, n, s);
-	} catch (e) {
-		throw o ? _(e.message, o, s) : e;
-	}
-}
-function C(e, t, a, o) {
-	try {
-		if (typeof e != "string") throw i(`${t} must be a string`, r, o);
-		if (e.length === 0) throw i(`${t} must not be empty`, n, o);
-	} catch (e) {
-		throw a ? _(e.message, a, o) : e;
-	}
-}
-async function ae(e, n) {
-	let a = e;
-	if (!(a instanceof URL) && a !== H) throw i("\"expectedIssuerIdentifier\" must be an instance of URL", r);
-	if (!t(n, Response)) throw i("\"response\" must be an instance of Response", r);
-	if (n.status !== 200) throw _("\"response\" is not a conform Authorization Server Metadata response (unexpected HTTP status code)", L, n);
-	B(n);
-	let o = await ht(n);
-	if (C(o.issuer, "\"response\" body \"issuer\" property", I, { body: o }), a !== H && new URL(o.issuer).href !== a.href) throw _("\"response\" body \"issuer\" property does not match the expected value", at, {
-		expected: a.href,
-		body: o,
-		attribute: "issuer"
-	});
-	return o;
-}
-function oe(e) {
-	ce(e, "application/json");
-}
-function se(e, ...t) {
-	let n = "\"response\" content-type must be ";
-	if (t.length > 2) {
-		let e = t.pop();
-		n += `${t.join(", ")}, or ${e}`;
-	} else t.length === 2 ? n += `${t[0]} or ${t[1]}` : n += t[0];
-	return _(n, nt, e);
-}
-function ce(e, t) {
-	if (Fe(e) !== t) throw se(e, t);
-}
-function le() {
-	return m(crypto.getRandomValues(new Uint8Array(32)));
-}
-function ue() {
-	return le();
-}
-function de() {
-	return le();
-}
-async function fe(e) {
-	return C(e, "codeVerifier"), m(await crypto.subtle.digest("SHA-256", f(e)));
-}
-function w(e) {
-	let t = e?.[o];
-	return typeof t == "number" && Number.isFinite(t) ? t : 0;
-}
-function T(e) {
-	let t = e?.[s];
-	return typeof t == "number" && Number.isFinite(t) && Math.sign(t) !== -1 ? t : 30;
-}
-function E() {
-	return Math.floor(Date.now() / 1e3);
-}
-function D(e) {
-	if (typeof e != "object" || !e) throw i("\"as\" must be an object", r);
-	C(e.issuer, "\"as.issuer\"");
-}
-function O(e) {
-	if (typeof e != "object" || !e) throw i("\"client\" must be an object", r);
-	C(e.client_id, "\"client.client_id\"");
-}
-function pe(e) {
-	return C(e, "\"clientSecret\""), (t, n, r, i) => {
-		r.set("client_id", n.client_id), r.set("client_secret", e);
-	};
-}
-function me() {
-	return (e, t, n, r) => {
-		n.set("client_id", t.client_id);
-	};
-}
-var he = URL.parse ? (e, t) => URL.parse(e, t) : (e, t) => {
-	try {
-		return new URL(e, t);
-	} catch {
-		return null;
-	}
-};
-function ge(e, t) {
-	if (t && e.protocol !== "https:") throw _("only requests to HTTPS are allowed", rt, e);
-	if (e.protocol !== "https:" && e.protocol !== "http:") throw _("only HTTP and HTTPS requests are allowed", it, e);
-}
-function _e(e, t, n, r) {
-	let i;
-	if (typeof e != "string" || !(i = he(e))) throw _(`authorization server metadata does not contain a valid ${n ? `"as.mtls_endpoint_aliases.${t}"` : `"as.${t}"`}`, e === void 0 ? ot : st, { attribute: n ? `mtls_endpoint_aliases.${t}` : t });
-	return ge(i, r), i;
-}
-function ve(e, t, n, r) {
-	return n && e.mtls_endpoint_aliases && t in e.mtls_endpoint_aliases ? _e(e.mtls_endpoint_aliases[t], t, n, r) : _e(e[t], t, n, r);
-}
-function ye(e) {
-	if (e instanceof Se) {
-		let { 0: t, length: n } = e.cause;
-		return n === 1 && t.scheme === "dpop" && t.parameters.error === "use_dpop_nonce";
-	}
-	return e instanceof be ? e.error === "use_dpop_nonce" : !1;
-}
-var be = class extends Error {
-	cause;
-	code;
-	error;
-	status;
-	error_description;
-	response;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, this.code = et, this.cause = t.cause, this.error = t.cause.error, this.status = t.response.status, this.error_description = t.cause.error_description, Object.defineProperty(this, "response", {
-			enumerable: !1,
-			value: t.response
-		}), Error.captureStackTrace?.(this, this.constructor);
-	}
-}, xe = class extends Error {
-	cause;
-	code;
-	error;
-	error_description;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, this.code = tt, this.cause = t.cause, this.error = t.cause.get("error"), this.error_description = t.cause.get("error_description") ?? void 0, Error.captureStackTrace?.(this, this.constructor);
-	}
-}, Se = class extends Error {
-	cause;
-	code;
-	response;
-	status;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, this.code = $e, this.cause = t.cause, this.status = t.response.status, this.response = t.response, Object.defineProperty(this, "response", { enumerable: !1 }), Error.captureStackTrace?.(this, this.constructor);
-	}
-}, Ce = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+", we = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}", Te = "(" + Ce + ")\\s*=\\s*\"((?:[^\"\\\\]|\\\\[\\s\\S])*)\"", Ee = "(" + Ce + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)", De = RegExp("^[,\\s]*(" + Ce + ")"), Oe = RegExp("^[,\\s]*" + Te + "[,\\s]*(.*)"), ke = RegExp("^[,\\s]*" + Ee + "[,\\s]*(.*)"), Ae = RegExp("^(" + we + ")(?:$|[,\\s])(.*)");
-function je(e) {
-	if (!t(e, Response)) throw i("\"response\" must be an instance of Response", r);
-	let n = e.headers.get("www-authenticate");
-	if (n === null) return;
-	let a = [], o = n;
-	for (; o;) {
-		let e = o.match(De), t = e?.["1"].toLowerCase();
-		if (!t) return;
-		let n = o.substring(e[0].length);
-		if (n && !n.match(/^[\s,]/)) return;
-		let r = n.match(/^\s+(.*)$/), i = !!r;
-		o = r ? r[1] : void 0;
-		let s = {}, c;
-		if (i) for (; o;) {
-			let t, n;
-			if (e = o.match(Oe)) {
-				if ([, t, n, o] = e, n.includes("\\")) try {
-					n = JSON.parse(`"${n}"`);
-				} catch {}
-				s[t.toLowerCase()] = n;
-				continue;
-			}
-			if (e = o.match(ke)) {
-				[, t, n, o] = e, s[t.toLowerCase()] = n;
-				continue;
-			}
-			if (e = o.match(Ae)) {
-				if (Object.keys(s).length) break;
-				[, c, o] = e;
-				break;
-			}
-			return;
-		}
-		else o = n || void 0;
-		let l = {
-			scheme: t,
-			parameters: s
-		};
-		c && (l.token68 = c), a.push(l);
-	}
-	if (a.length) return a;
-}
-async function Me(e) {
-	if (e.status > 399 && e.status < 500) {
-		B(e), oe(e);
-		try {
-			let t = await e.clone().json();
-			if (v(t) && typeof t.error == "string" && t.error.length) return t;
-		} catch {}
-	}
-}
-async function Ne(e, t, n) {
-	if (e.status !== t) {
-		Ve(e);
-		let t;
-		throw (t = await Me(e)) ? (await e.body?.cancel(), new be("server responded with an error in the response body", {
-			cause: t,
-			response: e
-		})) : _(`"response" is not a conform ${n} response (unexpected HTTP status code)`, L, e);
-	}
-}
-function Pe(e) {
-	if (!j.has(e)) throw i("\"options.DPoP\" is not a valid DPoPHandle", n);
-}
-function Fe(e) {
-	return e.headers.get("content-type")?.split(";")[0];
-}
-async function Ie(e, t, n, r, i, a, o) {
-	return await n(e, t, i, a), a.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8"), (o?.[c] || fetch)(r.href, {
-		body: i,
-		headers: Object.fromEntries(a.entries()),
-		method: "POST",
-		redirect: "manual",
-		signal: y(r, o?.signal)
-	});
-}
-async function Le(e, t, n, r, i, o) {
-	let s = ve(e, "token_endpoint", t.use_mtls_endpoint_aliases, o?.[a] !== !0);
-	i.set("grant_type", r);
-	let c = te(o?.headers);
-	c.set("accept", "application/json"), o?.DPoP !== void 0 && (Pe(o.DPoP), await o.DPoP.addProof(s, c, "POST"));
-	let l = await Ie(e, t, n, s, i, c, o);
-	return o?.DPoP?.cacheNonce(l, s), l;
-}
-async function Re(e, t, n, r, i) {
-	D(e), O(t), C(r, "\"refreshToken\"");
-	let a = new URLSearchParams(i?.additionalParameters);
-	return a.set("refresh_token", r), Le(e, t, n, "refresh_token", a, i);
-}
-var ze = /* @__PURE__ */ new WeakMap(), Be = /* @__PURE__ */ new WeakMap();
-function k(e) {
-	if (!e.id_token) return;
-	let t = ze.get(e);
-	if (!t) throw i("\"ref\" was already garbage collected or did not resolve from the proper sources", n);
-	return t;
-}
-async function A(e, n, a, o, s, c) {
-	if (D(e), O(n), !t(a, Response)) throw i("\"response\" must be an instance of Response", r);
-	await Ne(a, 200, "Token Endpoint"), B(a);
-	let l = await ht(a);
-	if (C(l.access_token, "\"response\" body \"access_token\" property", I, { body: l }), C(l.token_type, "\"response\" body \"token_type\" property", I, { body: l }), l.token_type = l.token_type.toLowerCase(), l.expires_in !== void 0) {
-		let e = typeof l.expires_in == "number" ? l.expires_in : parseFloat(l.expires_in);
-		S(e, !0, "\"response\" body \"expires_in\" property", I, { body: l }), l.expires_in = e;
-	}
-	if (l.refresh_token !== void 0 && C(l.refresh_token, "\"response\" body \"refresh_token\" property", I, { body: l }), l.scope !== void 0 && typeof l.scope != "string") throw _("\"response\" body \"scope\" property must be a string", I, { body: l });
-	if (l.id_token !== void 0) {
-		C(l.id_token, "\"response\" body \"id_token\" property", I, { body: l });
-		let t = [
-			"aud",
-			"exp",
-			"iat",
-			"iss",
-			"sub"
-		];
-		n.require_auth_time === !0 && t.push("auth_time"), n.default_max_age !== void 0 && (S(n.default_max_age, !0, "\"client.default_max_age\""), t.push("auth_time")), o?.length && t.push(...o);
-		let { claims: r, jwt: i } = await ct(l.id_token, dt.bind(void 0, n.id_token_signed_response_alg, e.id_token_signing_alg_values_supported, "RS256"), w(n), T(n), s).then(Ye.bind(void 0, t)).then(We.bind(void 0, e)).then(Ue.bind(void 0, n.client_id));
-		if (Array.isArray(r.aud) && r.aud.length !== 1) {
-			if (r.azp === void 0) throw _("ID Token \"aud\" (audience) claim includes additional untrusted audiences", z, {
-				claims: r,
-				claim: "aud"
-			});
-			if (r.azp !== n.client_id) throw _("unexpected ID Token \"azp\" (authorized party) claim value", z, {
-				expected: n.client_id,
-				claims: r,
-				claim: "azp"
-			});
-		}
-		r.auth_time !== void 0 && S(r.auth_time, !0, "ID Token \"auth_time\" (authentication time)", I, { claims: r }), Be.set(a, i), ze.set(l, r);
-	}
-	if (c?.[l.token_type] !== void 0) c[l.token_type](a, l);
-	else if (l.token_type !== "dpop" && l.token_type !== "bearer") throw new h("unsupported `token_type` value", { cause: { body: l } });
-	return l;
-}
-function Ve(e) {
-	let t;
-	if (t = je(e)) throw new Se("server responded with a challenge in the WWW-Authenticate HTTP Header", {
-		cause: t,
-		response: e
-	});
-}
-async function He(e, t, n, r) {
-	return A(e, t, n, void 0, r?.[l], r?.recognizedTokenTypes);
-}
-function Ue(e, t) {
-	if (Array.isArray(t.claims.aud)) {
-		if (!t.claims.aud.includes(e)) throw _("unexpected JWT \"aud\" (audience) claim value", z, {
-			expected: e,
-			claims: t.claims,
-			claim: "aud"
-		});
-	} else if (t.claims.aud !== e) throw _("unexpected JWT \"aud\" (audience) claim value", z, {
-		expected: e,
-		claims: t.claims,
-		claim: "aud"
-	});
-	return t;
-}
-function We(e, t) {
-	let n = e[gt]?.(t) ?? e.issuer;
-	if (t.claims.iss !== n) throw _("unexpected JWT \"iss\" (issuer) claim value", z, {
-		expected: n,
-		claims: t.claims,
-		claim: "iss"
-	});
-	return t;
-}
-var j = /* @__PURE__ */ new WeakSet();
-function Ge(e) {
-	return j.add(e), e;
-}
-var Ke = Symbol();
-async function qe(e, t, r, a, o, s, c) {
-	if (D(e), O(t), !j.has(a)) throw i("\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()", n);
-	C(o, "\"redirectUri\"");
-	let l = V(a, "code");
-	if (!l) throw _("no authorization code in \"callbackParameters\"", I);
-	let u = new URLSearchParams(c?.additionalParameters);
-	return u.set("redirect_uri", o), u.set("code", l), s !== Ke && (C(s, "\"codeVerifier\""), u.set("code_verifier", s)), Le(e, t, r, "authorization_code", u, c);
-}
-var Je = {
-	aud: "audience",
-	c_hash: "code hash",
-	client_id: "client id",
-	exp: "expiration time",
-	iat: "issued at",
-	iss: "issuer",
-	jti: "jwt id",
-	nonce: "nonce",
-	s_hash: "state hash",
-	sub: "subject",
-	ath: "access token hash",
-	htm: "http method",
-	htu: "http uri",
-	cnf: "confirmation",
-	auth_time: "authentication time"
-};
-function Ye(e, t) {
-	for (let n of e) if (t.claims[n] === void 0) throw _(`JWT "${n}" (${Je[n]}) claim missing`, I, { claims: t.claims });
-	return t;
-}
-var M = Symbol(), N = Symbol();
-async function Xe(e, t, n, r) {
-	return typeof r?.expectedNonce == "string" || typeof r?.maxAge == "number" || r?.requireIdToken ? Ze(e, t, n, r.expectedNonce, r.maxAge, r[l], r.recognizedTokenTypes) : Qe(e, t, n, r?.[l], r?.recognizedTokenTypes);
-}
-async function Ze(e, t, n, r, i, a, o) {
-	let s = [];
-	switch (r) {
-		case void 0:
-			r = M;
-			break;
-		case M: break;
-		default: C(r, "\"expectedNonce\" argument"), s.push("nonce");
-	}
-	switch (i ??= t.default_max_age, i) {
-		case void 0:
-			i = N;
-			break;
-		case N: break;
-		default: S(i, !0, "\"maxAge\" argument"), s.push("auth_time");
-	}
-	let c = await A(e, t, n, s, a, o);
-	C(c.id_token, "\"response\" body \"id_token\" property", I, { body: c });
-	let l = k(c);
-	if (i !== N) {
-		let e = E() + w(t), n = T(t);
-		if (l.auth_time + i < e - n) throw _("too much time has elapsed since the last End-User authentication", R, {
-			claims: l,
-			now: e,
-			tolerance: n,
-			claim: "auth_time"
-		});
-	}
-	if (r === M) {
-		if (l.nonce !== void 0) throw _("unexpected ID Token \"nonce\" claim value", z, {
-			expected: void 0,
-			claims: l,
-			claim: "nonce"
-		});
-	} else if (l.nonce !== r) throw _("unexpected ID Token \"nonce\" claim value", z, {
-		expected: r,
-		claims: l,
-		claim: "nonce"
-	});
-	return c;
-}
-async function Qe(e, t, n, r, i) {
-	let a = await A(e, t, n, void 0, r, i), o = k(a);
-	if (o) {
-		if (t.default_max_age !== void 0) {
-			S(t.default_max_age, !0, "\"client.default_max_age\"");
-			let e = E() + w(t), n = T(t);
-			if (o.auth_time + t.default_max_age < e - n) throw _("too much time has elapsed since the last End-User authentication", R, {
-				claims: o,
-				now: e,
-				tolerance: n,
-				claim: "auth_time"
-			});
-		}
-		if (o.nonce !== void 0) throw _("unexpected ID Token \"nonce\" claim value", z, {
-			expected: void 0,
-			claims: o,
-			claim: "nonce"
-		});
-	}
-	return a;
-}
-var $e = "OAUTH_WWW_AUTHENTICATE_CHALLENGE", et = "OAUTH_RESPONSE_BODY_ERROR", P = "OAUTH_UNSUPPORTED_OPERATION", tt = "OAUTH_AUTHORIZATION_RESPONSE_ERROR", F = "OAUTH_PARSE_ERROR", I = "OAUTH_INVALID_RESPONSE", nt = "OAUTH_RESPONSE_IS_NOT_JSON", L = "OAUTH_RESPONSE_IS_NOT_CONFORM", rt = "OAUTH_HTTP_REQUEST_FORBIDDEN", it = "OAUTH_REQUEST_PROTOCOL_FORBIDDEN", R = "OAUTH_JWT_TIMESTAMP_CHECK_FAILED", z = "OAUTH_JWT_CLAIM_COMPARISON_FAILED", at = "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED", ot = "OAUTH_MISSING_SERVER_METADATA", st = "OAUTH_INVALID_SERVER_METADATA";
-function B(e) {
-	if (e.bodyUsed) throw i("\"response\" body has been used already", n);
-}
-async function ct(e, t, n, r, i) {
-	let { 0: a, 1: o, length: s } = e.split(".");
-	if (s === 5) if (i !== void 0) e = await i(e), {0: a, 1: o, length: s} = e.split(".");
-	else throw new h("JWE decryption is not configured", { cause: e });
-	if (s !== 3) throw _("Invalid JWT", I, e);
-	let c;
-	try {
-		c = JSON.parse(f(m(a)));
-	} catch (e) {
-		throw _("failed to parse JWT Header body as base64url encoded JSON", F, e);
-	}
-	if (!v(c)) throw _("JWT Header must be a top level object", I, e);
-	if (t(c), c.crit !== void 0) throw new h("no JWT \"crit\" header parameter extensions are supported", { cause: { header: c } });
-	let l;
-	try {
-		l = JSON.parse(f(m(o)));
-	} catch (e) {
-		throw _("failed to parse JWT Payload body as base64url encoded JSON", F, e);
-	}
-	if (!v(l)) throw _("JWT Payload must be a top level object", I, e);
-	let u = E() + n;
-	if (l.exp !== void 0) {
-		if (typeof l.exp != "number") throw _("unexpected JWT \"exp\" (expiration time) claim type", I, { claims: l });
-		if (l.exp <= u - r) throw _("unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp", R, {
-			claims: l,
-			now: u,
-			tolerance: r,
-			claim: "exp"
-		});
-	}
-	if (l.iat !== void 0 && typeof l.iat != "number") throw _("unexpected JWT \"iat\" (issued at) claim type", I, { claims: l });
-	if (l.iss !== void 0 && typeof l.iss != "string") throw _("unexpected JWT \"iss\" (issuer) claim type", I, { claims: l });
-	if (l.nbf !== void 0) {
-		if (typeof l.nbf != "number") throw _("unexpected JWT \"nbf\" (not before) claim type", I, { claims: l });
-		if (l.nbf > u + r) throw _("unexpected JWT \"nbf\" (not before) claim value", R, {
-			claims: l,
-			now: u,
-			tolerance: r,
-			claim: "nbf"
-		});
-	}
-	if (l.aud !== void 0 && typeof l.aud != "string" && !Array.isArray(l.aud)) throw _("unexpected JWT \"aud\" (audience) claim type", I, { claims: l });
-	return {
-		header: c,
-		claims: l,
-		jwt: e
-	};
-}
-async function lt(e) {
-	if (e.bodyUsed) throw i("form_post Request instances must contain a readable body", n, { cause: e });
-	return e.text();
-}
-async function ut(e) {
-	if (e.method !== "POST") throw i("form_post responses are expected to use the POST method", n, { cause: e });
-	if (Fe(e) !== "application/x-www-form-urlencoded") throw i("form_post responses are expected to use the application/x-www-form-urlencoded content-type", n, { cause: e });
-	return lt(e);
-}
-function dt(e, t, n, r) {
-	if (e !== void 0) {
-		if (typeof e == "string" ? r.alg !== e : !e.includes(r.alg)) throw _("unexpected JWT \"alg\" header parameter", I, {
-			header: r,
-			expected: e,
-			reason: "client configuration"
-		});
-		return;
-	}
-	if (Array.isArray(t)) {
-		if (!t.includes(r.alg)) throw _("unexpected JWT \"alg\" header parameter", I, {
-			header: r,
-			expected: t,
-			reason: "authorization server metadata"
-		});
-		return;
-	}
-	if (n !== void 0) {
-		if (typeof n == "string" ? r.alg !== n : typeof n == "function" ? !n(r.alg) : !n.includes(r.alg)) throw _("unexpected JWT \"alg\" header parameter", I, {
-			header: r,
-			expected: n,
-			reason: "default value"
-		});
-		return;
-	}
-	throw _("missing client or server configuration to verify used JWT \"alg\" header parameter", void 0, {
-		client: e,
-		issuer: t,
-		fallback: n
-	});
-}
-function V(e, t) {
-	let { 0: n, length: r } = e.getAll(t);
-	if (r > 1) throw _(`"${t}" parameter must be provided only once`, I);
-	return n;
-}
-var ft = Symbol(), pt = Symbol();
-function mt(e, t, n, a) {
-	if (D(e), O(t), n instanceof URL && (n = n.searchParams), !(n instanceof URLSearchParams)) throw i("\"parameters\" must be an instance of URLSearchParams, or URL", r);
-	if (V(n, "response")) throw _("\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()", I, { parameters: n });
-	let o = V(n, "iss"), s = V(n, "state");
-	if (!o && e.authorization_response_iss_parameter_supported) throw _("response parameter \"iss\" (issuer) missing", I, { parameters: n });
-	if (o && o !== e.issuer) throw _("unexpected \"iss\" (issuer) response parameter value", I, {
-		expected: e.issuer,
-		parameters: n
-	});
-	switch (a) {
-		case void 0:
-		case pt:
-			if (s !== void 0) throw _("unexpected \"state\" response parameter encountered", I, {
-				expected: void 0,
-				parameters: n
-			});
-			break;
-		case ft: break;
-		default: if (C(a, "\"expectedState\" argument"), s !== a) throw _(s === void 0 ? "response parameter \"state\" missing" : "unexpected \"state\" response parameter value", I, {
-			expected: a,
-			parameters: n
-		});
-	}
-	if (V(n, "error")) throw new xe("authorization response from the server is an error", { cause: n });
-	let c = V(n, "id_token"), l = V(n, "token");
-	if (c !== void 0 || l !== void 0) throw new h("implicit and hybrid flows are not supported");
-	return Ge(new URLSearchParams(n));
-}
-async function ht(e, t = oe) {
-	let n;
-	try {
-		n = await e.json();
-	} catch (n) {
-		throw t(e), _("failed to parse \"response\" body as JSON", F, n);
-	}
-	if (!v(n)) throw _("\"response\" body must be a top level object", I, { body: n });
-	return n;
-}
-var H = Symbol(), gt = Symbol(), U, _t;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (_t = "openid-client/v6.8.3", U = { "user-agent": _t });
-var W = (e) => vt.get(e), vt, yt;
-function bt(e) {
-	return e === void 0 ? (yt ||= /* @__PURE__ */ new WeakMap(), (e, t, n, r) => {
-		let i;
-		return (i = yt.get(t)) || (xt(t.client_secret, "\"metadata.client_secret\""), i = pe(t.client_secret), yt.set(t, i)), i(e, t, n, r);
-	}) : pe(e);
-}
-function xt(e, t) {
-	if (typeof e != "string") throw J(`${t} must be a string`, q);
-	if (e.length === 0) throw J(`${t} must not be empty`, K);
-}
-function St() {
-	return me();
-}
-var G = c, K = "ERR_INVALID_ARG_VALUE", q = "ERR_INVALID_ARG_TYPE";
-function J(e, t, n) {
-	let r = TypeError(e, { cause: n });
-	return Object.assign(r, { code: t }), r;
-}
-function Ct(e) {
-	return fe(e);
-}
-function wt() {
-	return ue();
-}
-function Tt() {
-	return de();
-}
-var Y = class extends Error {
-	code;
-	constructor(e, t) {
-		super(e, t), this.name = this.constructor.name, this.code = t?.code, Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-new TextDecoder();
-function X(e, t, n) {
-	return new Y(e, {
-		cause: t,
-		code: n
-	});
-}
-function Z(e) {
-	if (e instanceof TypeError || e instanceof Y || e instanceof be || e instanceof xe || e instanceof Se) throw e;
-	if (e instanceof g) switch (e.code) {
-		case rt: throw X("only requests to HTTPS are allowed", e, e.code);
-		case it: throw X("only requests to HTTP or HTTPS are allowed", e, e.code);
-		case L: throw X("unexpected HTTP response status code", e.cause, e.code);
-		case nt: throw X("unexpected response content-type", e.cause, e.code);
-		case F: throw X("parsing error occured", e, e.code);
-		case I: throw X("invalid response encountered", e, e.code);
-		case z: throw X("unexpected JWT claim value encountered", e, e.code);
-		case at: throw X("unexpected JSON attribute value encountered", e, e.code);
-		case R: throw X("JWT timestamp claim value failed validation", e, e.code);
-		default: throw X(e.message, e, e.code);
-	}
-	if (e instanceof h) throw X("unsupported operation", e, e.code);
-	if (e instanceof DOMException) switch (e.name) {
-		case "OperationError": throw X("runtime operation error", e, P);
-		case "NotSupportedError": throw X("runtime unsupported operation", e, P);
-		case "TimeoutError": throw X("operation timed out", e, "OAUTH_TIMEOUT");
-		case "AbortError": throw X("operation aborted", e, "OAUTH_ABORT");
-	}
-	throw new Y("something went wrong", { cause: e });
-}
-function Et(e, t, n) {
-	return e.origin === "https://login.microsoftonline.com" && (!n?.algorithm || n.algorithm === "oidc") ? (t[Mt] = !0, !0) : !1;
-}
-function Dt(e, t) {
-	return !!(e.hostname.endsWith(".b2clogin.com") && (!t?.algorithm || t.algorithm === "oidc"));
-}
-async function Ot(e, t, n, r, i) {
-	let a = new Q(await kt(e, i), t, n, r), o = W(a);
-	if (i?.[G] && (o.fetch = i[G]), i?.timeout && (o.timeout = i.timeout), i?.execute) for (let e of i.execute) e(a);
-	return a;
-}
-async function kt(e, t) {
-	if (!(e instanceof URL)) throw J("\"server\" must be an instance of URL", q);
-	let n = !e.href.includes("/.well-known/"), r = t?.timeout ?? 30, i = AbortSignal.timeout(r * 1e3), o = await (n ? ie(e, {
-		algorithm: t?.algorithm,
-		[c]: t?.[G],
-		[a]: t?.execute?.includes(Ft),
-		signal: i,
-		headers: new Headers(U)
-	}) : (t?.[G] || fetch)((ge(e, !t?.execute?.includes(Ft)), e.href), {
-		headers: Object.fromEntries(new Headers({
-			accept: "application/json",
-			...U
-		}).entries()),
-		body: void 0,
-		method: "GET",
-		redirect: "manual",
-		signal: i
-	})).then((e) => ae(H, e)).catch(Z);
-	return n && new URL(o.issuer).href !== e.href && (Et(e, o, t) || Dt(e, t) || (() => {
-		throw new Y("discovered metadata issuer does not match the expected issuer", {
-			code: "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",
-			cause: {
-				expected: e.href,
-				body: o,
-				attribute: "issuer"
-			}
-		});
-	})()), o;
-}
-function At(e) {
-	return { supportsPKCE: {
-		__proto__: null,
-		value(t = "S256") {
-			return e.code_challenge_methods_supported?.includes(t) === !0;
-		}
-	} };
-}
-function jt(e) {
-	Object.defineProperties(e, At(e));
-}
-var Mt = Symbol(), Q = class {
-	constructor(e, t, n, r) {
-		if (typeof t != "string" || !t.length) throw J("\"clientId\" must be a non-empty string", q);
-		if (typeof n == "string" && (n = { client_secret: n }), n?.client_id !== void 0 && t !== n.client_id) throw J("\"clientId\" and \"metadata.client_id\" must be the same", K);
-		let i = {
-			...structuredClone(n),
-			client_id: t
-		};
-		i[o] = n?.[o] ?? 0, i[s] = n?.[s] ?? 30;
-		let a;
-		a = r || (typeof i.client_secret == "string" && i.client_secret.length ? bt(i.client_secret) : St());
-		let c = Object.freeze(i), l = structuredClone(e);
-		Mt in e && (l[gt] = ({ claims: { tid: t } }) => e.issuer.replace("{tenantid}", t));
-		let u = Object.freeze(l);
-		vt ||= /* @__PURE__ */ new WeakMap(), vt.set(this, {
-			__proto__: null,
-			as: u,
-			c,
-			auth: a,
-			tlsOnly: !0,
-			jwksCache: {}
-		});
-	}
-	serverMetadata() {
-		let e = structuredClone(W(this).as);
-		return jt(e), e;
-	}
-	clientMetadata() {
-		return structuredClone(W(this).c);
-	}
-	get timeout() {
-		return W(this).timeout;
-	}
-	set timeout(e) {
-		W(this).timeout = e;
-	}
-	get [G]() {
-		return W(this).fetch;
-	}
-	set [G](e) {
-		W(this).fetch = e;
-	}
-};
-Object.freeze(Q.prototype);
-function Nt(e) {
-	let t;
-	if (e.expires_in !== void 0) {
-		let n = /* @__PURE__ */ new Date();
-		n.setSeconds(n.getSeconds() + e.expires_in), t = n.getTime();
-	}
-	return {
-		expiresIn: {
-			__proto__: null,
-			value() {
-				if (t) {
-					let e = Date.now();
-					return t > e ? Math.floor((t - e) / 1e3) : 0;
-				}
-			}
-		},
-		claims: {
-			__proto__: null,
-			value() {
-				try {
-					return k(this);
-				} catch {
-					return;
-				}
-			}
-		}
-	};
-}
-function Pt(e) {
-	Object.defineProperties(e, Nt(e));
-}
-function Ft(e) {
-	W(e).tlsOnly = !1;
-}
-function It(e) {
-	return e = new URL(e), e.search = "", e.hash = "", e.href;
-}
-function Lt(e, t) {
-	try {
-		return Object.getPrototypeOf(e)[Symbol.toStringTag] === t;
-	} catch {
-		return !1;
-	}
-}
-async function Rt(e, t, n, r, i) {
-	if (Vt(e), i?.flag !== $ && !(t instanceof URL) && !Lt(t, "Request")) throw J("\"currentUrl\" must be an instance of URL, or Request", q);
-	let o, s, { as: u, c: d, auth: f, fetch: p, tlsOnly: ee, jarm: m, hybrid: h, nonRepudiation: g, timeout: _, decrypt: v, implicit: te } = W(e);
-	if (i?.flag === $) o = i.authResponse, s = i.redirectUri;
-	else {
-		if (!(t instanceof URL)) {
-			let e = t;
-			switch (t = new URL(t.url), e.method) {
-				case "GET": break;
-				case "POST":
-					let n = new URLSearchParams(await ut(e));
-					if (h) t.hash = n.toString();
-					else for (let [e, r] of n.entries()) t.searchParams.append(e, r);
-					break;
-				default: throw J("unexpected Request HTTP method", K);
-			}
-		}
-		switch (s = It(t), !0) {
-			case !!m:
-				o = await m(t, n?.expectedState);
-				break;
-			case !!h:
-				o = await h(t, n?.expectedNonce, n?.expectedState, n?.maxAge);
-				break;
-			case !!te: throw TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");
-			default: try {
-				o = mt(u, d, t.searchParams, n?.expectedState);
-			} catch (e) {
-				Z(e);
-			}
-		}
-	}
-	let y = await qe(u, d, f, o, s, n?.pkceCodeVerifier || Ke, {
-		additionalParameters: r,
-		[c]: p,
-		[a]: !ee,
-		DPoP: i?.DPoP,
-		headers: new Headers(U),
-		signal: Ht(_)
-	}).catch(Z);
-	(typeof n?.expectedNonce == "string" || typeof n?.maxAge == "number") && (n.idTokenExpected = !0);
-	let b = Xe(u, d, y, {
-		expectedNonce: n?.expectedNonce,
-		maxAge: n?.maxAge,
-		requireIdToken: n?.idTokenExpected,
-		[l]: v
-	}), x;
-	try {
-		x = await b;
-	} catch (t) {
-		if (Ut(t, i)) return Rt(e, void 0, n, r, {
-			...i,
-			flag: $,
-			authResponse: o,
-			redirectUri: s
-		});
-		Z(t);
-	}
-	return x.id_token && await g?.(y), Pt(x), x;
-}
-async function zt(e, t, n, r) {
-	Vt(e), n = new URLSearchParams(n);
-	let { as: i, c: o, auth: s, fetch: u, tlsOnly: d, nonRepudiation: f, timeout: p, decrypt: ee } = W(e), m = await Re(i, o, s, t, {
-		[c]: u,
-		[a]: !d,
-		additionalParameters: n,
-		DPoP: r?.DPoP,
-		headers: new Headers(U),
-		signal: Ht(p)
-	}).catch(Z), h = He(i, o, m, { [l]: ee }), g;
-	try {
-		g = await h;
-	} catch (i) {
-		if (Ut(i, r)) return zt(e, t, n, {
-			...r,
-			flag: $
-		});
-		Z(i);
-	}
-	return g.id_token && await f?.(m), Pt(g), g;
-}
-function Bt(e, t) {
-	Vt(e);
-	let { as: n, c: r, tlsOnly: i, hybrid: a, jarm: o, implicit: s } = W(e), c = ve(n, "authorization_endpoint", !1, i);
-	if (t = new URLSearchParams(t), t.has("client_id") || t.set("client_id", r.client_id), !t.has("request_uri") && !t.has("request")) {
-		if (t.has("response_type") || t.set("response_type", a ? "code id_token" : s ? "id_token" : "code"), s && !t.has("nonce")) throw J("response_type=id_token clients must provide a nonce parameter in their authorization request parameters", K);
-		o && t.set("response_mode", "jwt");
-	}
-	for (let [e, n] of t.entries()) c.searchParams.append(e, n);
-	return c;
-}
-function Vt(e) {
-	if (!(e instanceof Q)) throw J("\"config\" must be an instance of Configuration", q);
-	if (Object.getPrototypeOf(e) !== Q.prototype) throw J("subclassing Configuration is not allowed", K);
-}
-function Ht(e) {
-	return e ? AbortSignal.timeout(e * 1e3) : void 0;
-}
-function Ut(e, t) {
-	return t?.DPoP && t.flag !== $ ? ye(e) : !1;
-}
-var $ = Symbol();
-//#endregion
-export { Ot as a, zt as c, Ct as i, Rt as n, wt as o, Bt as r, Tt as s, bt as t };