@ghentcdh/authentication-vue 0.2.2 → 0.3.0

package/index.mjs

@@ -1,428 +1,552 @@
-import { ref as oe, markRaw as ae, watch as se, inject as W } from "vue";
-const F = "GHENTCDH_AUTHENTICATION";
-function $(l) {
-  if (!(this instanceof $))
-    throw new Error("The 'Keycloak' constructor must be invoked with 'new'.");
-  if (typeof l != "string" && !V(l))
-    throw new Error("The 'Keycloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
-  if (V(l)) {
-    const r = "oidcProvider" in l ? ["clientId"] : ["url", "realm", "clientId"];
-    for (const t of r)
-      if (!l[t])
-        throw new Error(`The configuration object is missing the required '${t}' property.`);
-  }
-  var e = this, f, k = [], m, h = {
+import { ref as P, markRaw as I, watch as L, inject as C } from "vue";
+const T = "GHENTCDH_AUTHENTICATION", R = "application/json";
+class x {
+  /** @type {Pick<PromiseWithResolvers<boolean>, 'resolve' | 'reject'>[]} */
+  #r = [];
+  /** @type {KeycloakAdapter} */
+  #t;
+  /** @type {boolean} */
+  #o = !0;
+  /** @type {CallbackStorage} */
+  #l;
+  #n = this.#b(console.info);
+  #u = this.#b(console.warn);
+  /** @type {LoginIframe} */
+  #e = {
     enable: !0,
     callbackList: [],
     interval: 5
   };
-  e.didInitialize = !1;
-  var y = !0, b = X(console.info), T = X(console.warn);
-  globalThis.isSecureContext || T(
-    `[KEYCLOAK] Keycloak JS must be used in a 'secure context' to function properly as it relies on browser APIs that are otherwise not available.
+  /** @type {KeycloakConfig} config */
+  #i;
+  didInitialize = !1;
+  authenticated = !1;
+  loginRequired = !1;
+  /** @type {KeycloakResponseMode} */
+  responseMode = "fragment";
+  /** @type {KeycloakResponseType} */
+  responseType = "code";
+  /** @type {KeycloakFlow} */
+  flow = "standard";
+  /** @type {number?} */
+  timeSkew = null;
+  /** @type {string=} */
+  redirectUri;
+  /** @type {string=} */
+  silentCheckSsoRedirectUri;
+  /** @type {boolean} */
+  silentCheckSsoFallback = !0;
+  /** @type {KeycloakPkceMethod} */
+  pkceMethod = "S256";
+  enableLogging = !1;
+  /** @type {'GET' | 'POST'} */
+  logoutMethod = "GET";
+  /** @type {string=} */
+  scope;
+  messageReceiveTimeout = 1e4;
+  /** @type {string=} */
+  idToken;
+  /** @type {KeycloakTokenParsed=} */
+  idTokenParsed;
+  /** @type {string=} */
+  token;
+  /** @type {KeycloakTokenParsed=} */
+  tokenParsed;
+  /** @type {string=} */
+  refreshToken;
+  /** @type {KeycloakTokenParsed=} */
+  refreshTokenParsed;
+  /** @type {string=} */
+  clientId;
+  /** @type {string=} */
+  sessionId;
+  /** @type {string=} */
+  subject;
+  /** @type {string=} */
+  authServerUrl;
+  /** @type {string=} */
+  realm;
+  /** @type {KeycloakRoles=} */
+  realmAccess;
+  /** @type {KeycloakResourceAccess=} */
+  resourceAccess;
+  /** @type {KeycloakProfile=} */
+  profile;
+  /** @type {{}=} */
+  userInfo;
+  /** @type {Endpoints} */
+  endpoints;
+  /** @type {number=} */
+  tokenTimeoutHandle;
+  /** @type {() => void=} */
+  onAuthSuccess;
+  /** @type {(errorData?: KeycloakError) => void=} */
+  onAuthError;
+  /** @type {() => void=} */
+  onAuthRefreshSuccess;
+  /** @type {() => void=} */
+  onAuthRefreshError;
+  /** @type {() => void=} */
+  onTokenExpired;
+  /** @type {() => void=} */
+  onAuthLogout;
+  /** @type {(authenticated: boolean) => void=} */
+  onReady;
+  /** @type {(status: 'success' | 'cancelled' | 'error', action: string) => void=} */
+  onActionUpdate;
+  /**
+   * @param {KeycloakConfig} config
+   */
+  constructor(e) {
+    if (typeof e != "string" && !v(e))
+      throw new Error("The 'Keycloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
+    if (v(e)) {
+      const t = "oidcProvider" in e ? ["clientId"] : ["url", "realm", "clientId"];
+      for (const r of t)
+        if (!(r in e))
+          throw new Error(`The configuration object is missing the required '${r}' property.`);
+    }
+    globalThis.isSecureContext || this.#u(
+      `[KEYCLOAK] Keycloak JS must be used in a 'secure context' to function properly as it relies on browser APIs that are otherwise not available.
 Continuing to run your application insecurely will lead to unexpected behavior and breakage.
 
 For more information see: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts`
-  ), e.init = function(r = {}) {
-    if (e.didInitialize)
+    ), this.#i = e;
+  }
+  /**
+   * @param {KeycloakInitOptions} initOptions
+   * @returns {Promise<boolean>}
+   */
+  init = async (e = {}) => {
+    if (this.didInitialize)
       throw new Error("A 'Keycloak' instance can only be initialized once.");
-    e.didInitialize = !0, e.authenticated = !1, m = ne();
-    var t = ["default", "cordova", "cordova-native"];
-    if (t.indexOf(r.adapter) > -1 ? f = D(r.adapter) : typeof r.adapter == "object" ? f = r.adapter : window.Cordova || window.cordova ? f = D("cordova") : f = D(), typeof r.useNonce < "u" && (y = r.useNonce), typeof r.checkLoginIframe < "u" && (h.enable = r.checkLoginIframe), r.checkLoginIframeInterval && (h.interval = r.checkLoginIframeInterval), r.onLoad === "login-required" && (e.loginRequired = !0), r.responseMode)
-      if (r.responseMode === "query" || r.responseMode === "fragment")
-        e.responseMode = r.responseMode;
+    this.didInitialize = !0, this.#l = z();
+    const t = ["default", "cordova", "cordova-native"];
+    if (typeof e.adapter == "string" && t.includes(e.adapter) ? this.#t = this.#f(e.adapter) : typeof e.adapter == "object" ? this.#t = e.adapter : "Cordova" in window || "cordova" in window ? this.#t = this.#f("cordova") : this.#t = this.#f("default"), typeof e.useNonce < "u" && (this.#o = e.useNonce), typeof e.checkLoginIframe < "u" && (this.#e.enable = e.checkLoginIframe), e.checkLoginIframeInterval && (this.#e.interval = e.checkLoginIframeInterval), e.onLoad === "login-required" && (this.loginRequired = !0), e.responseMode)
+      if (e.responseMode === "query" || e.responseMode === "fragment")
+        this.responseMode = e.responseMode;
       else
-        throw "Invalid value for responseMode";
-    if (r.flow) {
-      switch (r.flow) {
+        throw new Error("Invalid value for responseMode");
+    if (e.flow) {
+      switch (e.flow) {
         case "standard":
-          e.responseType = "code";
+          this.responseType = "code";
           break;
         case "implicit":
-          e.responseType = "id_token token";
+          this.responseType = "id_token token";
           break;
         case "hybrid":
-          e.responseType = "code id_token token";
+          this.responseType = "code id_token token";
           break;
         default:
-          throw "Invalid value for flow";
+          throw new Error("Invalid value for flow");
       }
-      e.flow = r.flow;
+      this.flow = e.flow;
+    }
+    if (typeof e.timeSkew == "number" && (this.timeSkew = e.timeSkew), e.redirectUri && (this.redirectUri = e.redirectUri), e.silentCheckSsoRedirectUri && (this.silentCheckSsoRedirectUri = e.silentCheckSsoRedirectUri), typeof e.silentCheckSsoFallback == "boolean" && (this.silentCheckSsoFallback = e.silentCheckSsoFallback), typeof e.pkceMethod < "u") {
+      if (e.pkceMethod !== "S256" && e.pkceMethod !== !1)
+        throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${e.pkceMethod}.`);
+      this.pkceMethod = e.pkceMethod;
     }
-    if (r.timeSkew != null && (e.timeSkew = r.timeSkew), r.redirectUri && (e.redirectUri = r.redirectUri), r.silentCheckSsoRedirectUri && (e.silentCheckSsoRedirectUri = r.silentCheckSsoRedirectUri), typeof r.silentCheckSsoFallback == "boolean" ? e.silentCheckSsoFallback = r.silentCheckSsoFallback : e.silentCheckSsoFallback = !0, typeof r.pkceMethod < "u") {
-      if (r.pkceMethod !== "S256" && r.pkceMethod !== !1)
-        throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${r.pkceMethod}.`);
-      e.pkceMethod = r.pkceMethod;
+    return typeof e.enableLogging == "boolean" && (this.enableLogging = e.enableLogging), e.logoutMethod === "POST" && (this.logoutMethod = "POST"), typeof e.scope == "string" && (this.scope = e.scope), typeof e.messageReceiveTimeout == "number" && e.messageReceiveTimeout > 0 && (this.messageReceiveTimeout = e.messageReceiveTimeout), await this.#S(), await this.#E(), await this.#C(e), this.onReady?.(this.authenticated), this.authenticated;
+  };
+  /**
+   * @param {"default" | "cordova" | "cordova-native"} type
+   * @returns {KeycloakAdapter}
+   */
+  #f(e) {
+    if (e === "default")
+      return this.#v();
+    if (e === "cordova")
+      return this.#e.enable = !1, this.#T();
+    if (e === "cordova-native")
+      return this.#e.enable = !1, this.#U();
+    throw new Error("invalid adapter type: " + e);
+  }
+  /**
+   * @returns {KeycloakAdapter}
+   */
+  #v() {
+    const e = (t) => t?.redirectUri || this.redirectUri || globalThis.location.href;
+    return {
+      login: async (t) => (window.location.assign(await this.createLoginUrl(t)), await new Promise(() => {
+      })),
+      logout: async (t) => {
+        if ((t?.logoutMethod ?? this.logoutMethod) === "GET") {
+          window.location.replace(this.createLogoutUrl(t));
+          return;
+        }
+        const o = document.createElement("form");
+        o.setAttribute("method", "POST"), o.setAttribute("action", this.createLogoutUrl(t)), o.style.display = "none";
+        const s = {
+          id_token_hint: this.idToken,
+          client_id: this.clientId,
+          post_logout_redirect_uri: e(t)
+        };
+        for (const [n, a] of Object.entries(s)) {
+          const c = document.createElement("input");
+          c.setAttribute("type", "hidden"), c.setAttribute("name", n), c.setAttribute(
+            "value",
+            /** @type {string} */
+            a
+          ), o.appendChild(c);
+        }
+        document.body.appendChild(o), o.submit();
+      },
+      register: async (t) => (window.location.assign(await this.createRegisterUrl(t)), await new Promise(() => {
+      })),
+      accountManagement: async () => {
+        const t = this.createAccountUrl();
+        if (typeof t < "u")
+          window.location.href = t;
+        else
+          throw new Error("Not supported by the OIDC server");
+        return await new Promise(() => {
+        });
+      },
+      redirectUri: e
+    };
+  }
+  /**
+   * @returns {KeycloakAdapter}
+   */
+  #T() {
+    const e = (n, a, c) => window.cordova && window.cordova.InAppBrowser ? window.cordova.InAppBrowser.open(n, a, c) : window.open(n, a, c), t = (n) => n && n.cordovaOptions ? Object.keys(n.cordovaOptions).reduce((a, c) => (a[c] = n.cordovaOptions[c], a), {}) : {}, r = (n) => Object.keys(n).reduce((a, c) => (a.push(c + "=" + n[c]), a), []).join(","), o = (n) => {
+      const a = t(n);
+      return a.location = "no", n && n.prompt === "none" && (a.hidden = "yes"), r(a);
+    }, s = () => this.redirectUri || "http://localhost";
+    return {
+      login: async (n) => {
+        const a = o(n), c = await this.createLoginUrl(n), l = e(c, "_blank", a);
+        let d = !1, h = !1;
+        function f() {
+          h = !0, l.close();
+        }
+        return await new Promise((p, w) => {
+          l.addEventListener("loadstart", async (u) => {
+            if (u.url.indexOf(s()) === 0) {
+              const m = this.#a(u.url);
+              try {
+                await this.#c(m), p();
+              } catch (y) {
+                w(y);
+              }
+              f(), d = !0;
+            }
+          }), l.addEventListener("loaderror", async (u) => {
+            if (!d)
+              if (u.url.indexOf(s()) === 0) {
+                const m = this.#a(u.url);
+                try {
+                  await this.#c(m), p();
+                } catch (y) {
+                  w(y);
+                }
+                f(), d = !0;
+              } else
+                w(new Error("Unable to process login.")), f();
+          }), l.addEventListener("exit", function(u) {
+            h || w(new Error("User closed the login window."));
+          });
+        });
+      },
+      logout: async (n) => {
+        const a = this.createLogoutUrl(n), c = e(a, "_blank", "location=no,hidden=yes,clearcache=yes");
+        let l = !1;
+        c.addEventListener("loadstart", (d) => {
+          d.url.indexOf(s()) === 0 && c.close();
+        }), c.addEventListener("loaderror", (d) => {
+          d.url.indexOf(s()) === 0 || (l = !0), c.close();
+        }), await new Promise((d, h) => {
+          c.addEventListener("exit", () => {
+            l ? h(new Error("User closed the login window.")) : (this.clearToken(), d());
+          });
+        });
+      },
+      register: async (n) => {
+        const a = await this.createRegisterUrl(), c = o(n), l = e(a, "_blank", c);
+        await new Promise((h, f) => {
+          l.addEventListener("loadstart", async (p) => {
+            if (p.url.indexOf(s()) === 0) {
+              l.close();
+              const w = this.#a(p.url);
+              try {
+                await this.#c(w), h();
+              } catch (u) {
+                f(u);
+              }
+            }
+          });
+        });
+      },
+      accountManagement: async () => {
+        const n = this.createAccountUrl();
+        if (typeof n < "u") {
+          const a = e(n, "_blank", "location=no");
+          a.addEventListener("loadstart", function(c) {
+            c.url.indexOf(s()) === 0 && a.close();
+          });
+        } else
+          throw new Error("Not supported by the OIDC server");
+      },
+      redirectUri: () => s()
+    };
+  }
+  /**
+   * @returns {KeycloakAdapter}
+   */
+  #U() {
+    return {
+      login: async (e) => {
+        const t = await this.createLoginUrl(e);
+        await new Promise((r, o) => {
+          universalLinks.subscribe("keycloak", async (s) => {
+            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
+            const n = this.#a(s.url);
+            try {
+              await this.#c(n), r();
+            } catch (a) {
+              o(a);
+            }
+          }), window.cordova.plugins.browsertab.openUrl(t);
+        });
+      },
+      logout: async (e) => {
+        const t = this.createLogoutUrl(e);
+        await new Promise((r) => {
+          universalLinks.subscribe("keycloak", () => {
+            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close(), this.clearToken(), r();
+          }), window.cordova.plugins.browsertab.openUrl(t);
+        });
+      },
+      register: async (e) => {
+        const t = await this.createRegisterUrl(e);
+        await new Promise((r, o) => {
+          universalLinks.subscribe("keycloak", async (s) => {
+            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
+            const n = this.#a(s.url);
+            try {
+              await this.#c(n), r();
+            } catch (a) {
+              o(a);
+            }
+          }), window.cordova.plugins.browsertab.openUrl(t);
+        });
+      },
+      accountManagement: async () => {
+        const e = this.createAccountUrl();
+        if (typeof e < "u")
+          window.cordova.plugins.browsertab.openUrl(e);
+        else
+          throw new Error("Not supported by the OIDC server");
+      },
+      redirectUri: (e) => e && e.redirectUri ? e.redirectUri : this.redirectUri ? this.redirectUri : "http://localhost"
+    };
+  }
+  /**
+   * @returns {Promise<void>}
+   */
+  async #S() {
+    if (typeof this.#i == "string") {
+      const e = await Y(this.#i);
+      this.authServerUrl = e["auth-server-url"], this.realm = e.realm, this.clientId = e.resource, this.#g();
+    } else
+      this.clientId = this.#i.clientId, "oidcProvider" in this.#i ? await this.#_(this.#i.oidcProvider) : (this.authServerUrl = this.#i.url, this.realm = this.#i.realm, this.#g());
+  }
+  /**
+   * @returns {void}
+   */
+  #g() {
+    this.endpoints = {
+      authorize: () => this.#s() + "/protocol/openid-connect/auth",
+      token: () => this.#s() + "/protocol/openid-connect/token",
+      logout: () => this.#s() + "/protocol/openid-connect/logout",
+      checkSessionIframe: () => this.#s() + "/protocol/openid-connect/login-status-iframe.html",
+      thirdPartyCookiesIframe: () => this.#s() + "/protocol/openid-connect/3p-cookies/step1.html",
+      register: () => this.#s() + "/protocol/openid-connect/registrations",
+      userinfo: () => this.#s() + "/protocol/openid-connect/userinfo"
+    };
+  }
+  /**
+   * @param {string | OpenIdProviderMetadata} oidcProvider
+   * @returns {Promise<void>}
+   */
+  async #_(e) {
+    if (typeof e == "string") {
+      const t = `${E(e)}/.well-known/openid-configuration`, r = await V(t);
+      this.#k(r);
     } else
-      e.pkceMethod = "S256";
-    typeof r.enableLogging == "boolean" ? e.enableLogging = r.enableLogging : e.enableLogging = !1, r.logoutMethod === "POST" ? e.logoutMethod = "POST" : e.logoutMethod = "GET", typeof r.scope == "string" && (e.scope = r.scope), typeof r.acrValues == "string" && (e.acrValues = r.acrValues), typeof r.messageReceiveTimeout == "number" && r.messageReceiveTimeout > 0 ? e.messageReceiveTimeout = r.messageReceiveTimeout : e.messageReceiveTimeout = 1e4, e.responseMode || (e.responseMode = "fragment"), e.responseType || (e.responseType = "code", e.flow = "standard");
-    var i = w(), s = w();
-    s.promise.then(function() {
-      e.onReady && e.onReady(e.authenticated), i.setSuccess(e.authenticated);
-    }).catch(function(o) {
-      i.setError(o);
+      this.#k(e);
+  }
+  /**
+   * @param {OpenIdProviderMetadata} config
+   * @returns {void}
+   */
+  #k(e) {
+    this.endpoints = {
+      authorize() {
+        return e.authorization_endpoint;
+      },
+      token() {
+        return e.token_endpoint;
+      },
+      logout() {
+        if (!e.end_session_endpoint)
+          throw new Error("Not supported by the OIDC server");
+        return e.end_session_endpoint;
+      },
+      checkSessionIframe() {
+        if (!e.check_session_iframe)
+          throw new Error("Not supported by the OIDC server");
+        return e.check_session_iframe;
+      },
+      register() {
+        throw new Error('Redirection to "Register user" page not supported in standard OIDC mode');
+      },
+      userinfo() {
+        if (!e.userinfo_endpoint)
+          throw new Error("Not supported by the OIDC server");
+        return e.userinfo_endpoint;
+      }
+    };
+  }
+  /**
+   * @returns {Promise<void>}
+   */
+  async #E() {
+    if (!this.#e.enable && !this.silentCheckSsoRedirectUri || typeof this.endpoints.thirdPartyCookiesIframe != "function")
+      return;
+    const e = document.createElement("iframe");
+    e.setAttribute("src", this.endpoints.thirdPartyCookiesIframe()), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-3p-check-iframe"), e.style.display = "none", document.body.appendChild(e);
+    const t = new Promise((r) => {
+      const o = (s) => {
+        e.contentWindow === s.source && (s.data !== "supported" && s.data !== "unsupported" || (s.data === "unsupported" && (this.#u(
+          `[KEYCLOAK] Your browser is blocking access to 3rd-party cookies, this means:
+
+ - It is not possible to retrieve tokens without redirecting to the Keycloak server (a.k.a. no support for silent authentication).
+ - It is not possible to automatically detect changes to the session status (such as the user logging out in another tab).
+
+For more information see: https://www.keycloak.org/securing-apps/javascript-adapter#_modern_browsers`
+        ), this.#e.enable = !1, this.silentCheckSsoFallback && (this.silentCheckSsoRedirectUri = void 0)), document.body.removeChild(e), window.removeEventListener("message", o), r()));
+      };
+      window.addEventListener("message", o, !1);
     });
-    var a = Z();
-    function c() {
-      var o = function(d) {
-        d || (p.prompt = "none"), r.locale && (p.locale = r.locale), e.login(p).then(function() {
-          s.setSuccess();
-        }).catch(function(g) {
-          s.setError(g);
-        });
-      }, u = async function() {
-        var d = document.createElement("iframe"), g = await e.createLoginUrl({ prompt: "none", redirectUri: e.silentCheckSsoRedirectUri });
-        d.setAttribute("src", g), d.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), d.setAttribute("title", "keycloak-silent-check-sso"), d.style.display = "none", document.body.appendChild(d);
-        var S = function(I) {
-          if (!(I.origin !== window.location.origin || d.contentWindow !== I.source)) {
-            var U = E(I.data);
-            A(U, s), document.body.removeChild(d), window.removeEventListener("message", S);
-          }
-        };
-        window.addEventListener("message", S);
-      }, p = {};
-      switch (r.onLoad) {
+    return await j(t, this.messageReceiveTimeout, "Timeout when waiting for 3rd party check iframe message.");
+  }
+  /**
+   * @param {KeycloakInitOptions} initOptions
+   * @returns {Promise<void>}
+   */
+  async #C(e) {
+    const t = this.#a(window.location.href);
+    if (t?.newUrl && window.history.replaceState(window.history.state, "", t.newUrl), t && t.valid) {
+      await this.#p(), await this.#c(t);
+      return;
+    }
+    const r = async (s) => {
+      const n = {};
+      s || (n.prompt = "none"), e.locale && (n.locale = e.locale), await this.login(n);
+    }, o = async () => {
+      switch (e.onLoad) {
         case "check-sso":
-          h.enable ? H().then(function() {
-            P().then(function(d) {
-              d ? s.setSuccess() : e.silentCheckSsoRedirectUri ? u() : o(!1);
-            }).catch(function(d) {
-              s.setError(d);
-            });
-          }) : e.silentCheckSsoRedirectUri ? u() : o(!1);
+          this.#e.enable ? (await this.#p(), await this.#d() || (this.silentCheckSsoRedirectUri ? await this.#m() : await r(!1))) : this.silentCheckSsoRedirectUri ? await this.#m() : await r(!1);
           break;
         case "login-required":
-          o(!0);
+          await r(!0);
           break;
         default:
-          throw "Invalid value for onLoad";
-      }
-    }
-    function n() {
-      var o = E(window.location.href);
-      if (o && window.history.replaceState(window.history.state, null, o.newUrl), o && o.valid)
-        return H().then(function() {
-          A(o, s);
-        }).catch(function(u) {
-          s.setError(u);
-        });
-      r.token && r.refreshToken ? (x(r.token, r.refreshToken, r.idToken), h.enable ? H().then(function() {
-        P().then(function(u) {
-          u ? (e.onAuthSuccess && e.onAuthSuccess(), s.setSuccess(), K()) : s.setSuccess();
-        }).catch(function(u) {
-          s.setError(u);
-        });
-      }) : e.updateToken(-1).then(function() {
-        e.onAuthSuccess && e.onAuthSuccess(), s.setSuccess();
-      }).catch(function(u) {
-        e.onAuthError && e.onAuthError(), r.onLoad ? c() : s.setError(u);
-      })) : r.onLoad ? c() : s.setSuccess();
-    }
-    return a.then(function() {
-      te().then(n).catch(function(o) {
-        i.setError(o);
-      });
-    }), a.catch(function(o) {
-      i.setError(o);
-    }), i.promise;
-  }, e.login = function(r) {
-    return f.login(r);
-  };
-  function R(r) {
-    if (typeof crypto > "u" || typeof crypto.getRandomValues > "u")
-      throw new Error("Web Crypto API is not available.");
-    return crypto.getRandomValues(new Uint8Array(r));
-  }
-  function C(r) {
-    return v(r, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
-  }
-  function v(r, t) {
-    for (var i = R(r), s = new Array(r), a = 0; a < r; a++)
-      s[a] = t.charCodeAt(i[a] % t.length);
-    return String.fromCharCode.apply(null, s);
-  }
-  async function M(r, t) {
-    if (r !== "S256")
-      throw new TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${r}'.`);
-    const i = new Uint8Array(await ce(t));
-    return ie(i).replace(/\+/g, "-").replace(/\//g, "_").replace(/\=/g, "");
-  }
-  function N(r) {
-    var t = {
-      id_token: {
-        acr: r
+          throw new Error("Invalid value for onLoad");
       }
     };
-    return JSON.stringify(t);
-  }
-  e.createLoginUrl = async function(r) {
-    var t = q(), i = q(), s = f.redirectUri(r), a = {
-      state: t,
-      nonce: i,
-      redirectUri: encodeURIComponent(s),
-      loginOptions: r
-    };
-    r && r.prompt && (a.prompt = r.prompt);
-    var c;
-    r && r.action == "register" ? c = e.endpoints.register() : c = e.endpoints.authorize();
-    var n = r && r.scope || e.scope;
-    n ? n.indexOf("openid") === -1 && (n = "openid " + n) : n = "openid";
-    var o = c + "?client_id=" + encodeURIComponent(e.clientId) + "&redirect_uri=" + encodeURIComponent(s) + "&state=" + encodeURIComponent(t) + "&response_mode=" + encodeURIComponent(e.responseMode) + "&response_type=" + encodeURIComponent(e.responseType) + "&scope=" + encodeURIComponent(n);
-    if (y && (o = o + "&nonce=" + encodeURIComponent(i)), r && r.prompt && (o += "&prompt=" + encodeURIComponent(r.prompt)), r && typeof r.maxAge == "number" && (o += "&max_age=" + encodeURIComponent(r.maxAge)), r && r.loginHint && (o += "&login_hint=" + encodeURIComponent(r.loginHint)), r && r.idpHint && (o += "&kc_idp_hint=" + encodeURIComponent(r.idpHint)), r && r.action && r.action != "register" && (o += "&kc_action=" + encodeURIComponent(r.action)), r && r.locale && (o += "&ui_locales=" + encodeURIComponent(r.locale)), r && r.acr) {
-      var u = N(r.acr);
-      o += "&claims=" + encodeURIComponent(u);
-    }
-    if ((r && r.acrValues || e.acrValues) && (o += "&acr_values=" + encodeURIComponent(r.acrValues || e.acrValues)), e.pkceMethod)
-      try {
-        const p = C(96), d = await M(e.pkceMethod, p);
-        a.pkceCodeVerifier = p, o += "&code_challenge=" + d, o += "&code_challenge_method=" + e.pkceMethod;
-      } catch (p) {
-        throw new Error("Failed to generate PKCE challenge.", { cause: p });
-      }
-    return m.add(a), o;
-  }, e.logout = function(r) {
-    return f.logout(r);
-  }, e.createLogoutUrl = function(r) {
-    if (((r == null ? void 0 : r.logoutMethod) ?? e.logoutMethod) === "POST")
-      return e.endpoints.logout();
-    var i = e.endpoints.logout() + "?client_id=" + encodeURIComponent(e.clientId) + "&post_logout_redirect_uri=" + encodeURIComponent(f.redirectUri(r, !1));
-    return e.idToken && (i += "&id_token_hint=" + encodeURIComponent(e.idToken)), i;
-  }, e.register = function(r) {
-    return f.register(r);
-  }, e.createRegisterUrl = async function(r) {
-    return r || (r = {}), r.action = "register", await e.createLoginUrl(r);
-  }, e.createAccountUrl = function(r) {
-    var t = _(), i = void 0;
-    return typeof t < "u" && (i = t + "/account?referrer=" + encodeURIComponent(e.clientId) + "&referrer_uri=" + encodeURIComponent(f.redirectUri(r))), i;
-  }, e.accountManagement = function() {
-    return f.accountManagement();
-  }, e.hasRealmRole = function(r) {
-    var t = e.realmAccess;
-    return !!t && t.roles.indexOf(r) >= 0;
-  }, e.hasResourceRole = function(r, t) {
-    if (!e.resourceAccess)
-      return !1;
-    var i = e.resourceAccess[t || e.clientId];
-    return !!i && i.roles.indexOf(r) >= 0;
-  }, e.loadUserProfile = function() {
-    var r = _() + "/account", t = new XMLHttpRequest();
-    t.open("GET", r, !0), t.setRequestHeader("Accept", "application/json"), t.setRequestHeader("Authorization", "bearer " + e.token);
-    var i = w();
-    return t.onreadystatechange = function() {
-      t.readyState == 4 && (t.status == 200 ? (e.profile = JSON.parse(t.responseText), i.setSuccess(e.profile)) : i.setError());
-    }, t.send(), i.promise;
-  }, e.loadUserInfo = function() {
-    var r = e.endpoints.userinfo(), t = new XMLHttpRequest();
-    t.open("GET", r, !0), t.setRequestHeader("Accept", "application/json"), t.setRequestHeader("Authorization", "bearer " + e.token);
-    var i = w();
-    return t.onreadystatechange = function() {
-      t.readyState == 4 && (t.status == 200 ? (e.userInfo = JSON.parse(t.responseText), i.setSuccess(e.userInfo)) : i.setError());
-    }, t.send(), i.promise;
-  }, e.isTokenExpired = function(r) {
-    if (!e.tokenParsed || !e.refreshToken && e.flow != "implicit")
-      throw "Not authenticated";
-    if (e.timeSkew == null)
-      return b("[KEYCLOAK] Unable to determine if token is expired as timeskew is not set"), !0;
-    var t = e.tokenParsed.exp - Math.ceil((/* @__PURE__ */ new Date()).getTime() / 1e3) + e.timeSkew;
-    if (r) {
-      if (isNaN(r))
-        throw "Invalid minValidity";
-      t -= r;
-    }
-    return t < 0;
-  }, e.updateToken = function(r) {
-    var t = w();
-    if (!e.refreshToken)
-      return t.setError(), t.promise;
-    r = r || 5;
-    var i = function() {
-      var a = !1;
-      if (r == -1 ? (a = !0, b("[KEYCLOAK] Refreshing token: forced refresh")) : (!e.tokenParsed || e.isTokenExpired(r)) && (a = !0, b("[KEYCLOAK] Refreshing token: token expired")), !a)
-        t.setSuccess(!1);
-      else {
-        var c = "grant_type=refresh_token&refresh_token=" + e.refreshToken, n = e.endpoints.token();
-        if (k.push(t), k.length == 1) {
-          var o = new XMLHttpRequest();
-          o.open("POST", n, !0), o.setRequestHeader("Content-type", "application/x-www-form-urlencoded"), o.withCredentials = !0, c += "&client_id=" + encodeURIComponent(e.clientId);
-          var u = (/* @__PURE__ */ new Date()).getTime();
-          o.onreadystatechange = function() {
-            if (o.readyState == 4)
-              if (o.status == 200) {
-                b("[KEYCLOAK] Token refreshed"), u = (u + (/* @__PURE__ */ new Date()).getTime()) / 2;
-                var p = JSON.parse(o.responseText);
-                x(p.access_token, p.refresh_token, p.id_token, u), e.onAuthRefreshSuccess && e.onAuthRefreshSuccess();
-                for (var d = k.pop(); d != null; d = k.pop())
-                  d.setSuccess(!0);
-              } else {
-                T("[KEYCLOAK] Failed to refresh token"), o.status == 400 && e.clearToken(), e.onAuthRefreshError && e.onAuthRefreshError();
-                for (var d = k.pop(); d != null; d = k.pop())
-                  d.setError("Failed to refresh token: An unexpected HTTP error occurred while attempting to refresh the token.");
-              }
-          }, o.send(c);
+    if (e.token && e.refreshToken)
+      if (this.#h(e.token, e.refreshToken, e.idToken), this.#e.enable)
+        await this.#p(), await this.#d() && (this.onAuthSuccess?.(), this.#w());
+      else
+        try {
+          await this.updateToken(-1), this.onAuthSuccess?.();
+        } catch (s) {
+          if (this.onAuthError?.(), e.onLoad)
+            await o();
+          else
+            throw s;
         }
-      }
+    else e.onLoad && await o();
+  }
+  /**
+   * @returns {Promise<void>}
+   */
+  async #p() {
+    if (!this.#e.enable || this.#e.iframe)
+      return;
+    const e = document.createElement("iframe");
+    this.#e.iframe = e, e.setAttribute("src", this.endpoints.checkSessionIframe()), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-session-iframe"), e.style.display = "none", document.body.appendChild(e);
+    const t = (o) => {
+      if (o.origin !== this.#e.iframeOrigin || this.#e.iframe?.contentWindow !== o.source || !(o.data === "unchanged" || o.data === "changed" || o.data === "error"))
+        return;
+      o.data !== "unchanged" && this.clearToken();
+      const s = this.#e.callbackList;
+      this.#e.callbackList = [];
+      for (const n of s.reverse())
+        o.data === "error" ? n(new Error("Error while checking login iframe")) : n(null, o.data === "unchanged");
     };
-    if (h.enable) {
-      var s = P();
-      s.then(function() {
-        i();
-      }).catch(function(a) {
-        t.setError(a);
+    window.addEventListener("message", t, !1), await new Promise((o) => {
+      e.addEventListener("load", () => {
+        const s = this.endpoints.authorize();
+        s.startsWith("/") ? this.#e.iframeOrigin = globalThis.location.origin : this.#e.iframeOrigin = new URL(s).origin, o();
       });
-    } else
-      i();
-    return t.promise;
-  }, e.clearToken = function() {
-    e.token && (x(null, null, null), e.onAuthLogout && e.onAuthLogout(), e.loginRequired && e.login());
-  };
-  function _() {
-    if (typeof e.authServerUrl < "u")
-      return e.authServerUrl.charAt(e.authServerUrl.length - 1) == "/" ? e.authServerUrl + "realms/" + encodeURIComponent(e.realm) : e.authServerUrl + "/realms/" + encodeURIComponent(e.realm);
-  }
-  function Q() {
-    return window.location.origin ? window.location.origin : window.location.protocol + "//" + window.location.hostname + (window.location.port ? ":" + window.location.port : "");
-  }
-  function A(r, t) {
-    var i = r.code, s = r.error, a = r.prompt, c = (/* @__PURE__ */ new Date()).getTime();
-    if (r.kc_action_status && e.onActionUpdate && e.onActionUpdate(r.kc_action_status, r.kc_action), s) {
-      if (a != "none")
-        if (r.error_description && r.error_description === "authentication_expired")
-          e.login(r.loginOptions);
-        else {
-          var n = { error: s, error_description: r.error_description };
-          e.onAuthError && e.onAuthError(n), t && t.setError(n);
-        }
-      else
-        t && t.setSuccess();
+    });
+  }
+  /**
+   * @returns {Promise<boolean | undefined>}
+   */
+  async #d() {
+    if (!this.#e.iframe || !this.#e.iframeOrigin)
       return;
-    } else e.flow != "standard" && (r.access_token || r.id_token) && d(r.access_token, null, r.id_token, !0);
-    if (e.flow != "implicit" && i) {
-      var o = "code=" + i + "&grant_type=authorization_code", u = e.endpoints.token(), p = new XMLHttpRequest();
-      p.open("POST", u, !0), p.setRequestHeader("Content-type", "application/x-www-form-urlencoded"), o += "&client_id=" + encodeURIComponent(e.clientId), o += "&redirect_uri=" + r.redirectUri, r.pkceCodeVerifier && (o += "&code_verifier=" + r.pkceCodeVerifier), p.withCredentials = !0, p.onreadystatechange = function() {
-        if (p.readyState == 4)
-          if (p.status == 200) {
-            var g = JSON.parse(p.responseText);
-            d(g.access_token, g.refresh_token, g.id_token, e.flow === "standard"), K();
-          } else
-            e.onAuthError && e.onAuthError(), t && t.setError();
-      }, p.send(o);
-    }
-    function d(g, S, I, U) {
-      c = (c + (/* @__PURE__ */ new Date()).getTime()) / 2, x(g, S, I, c), y && e.idTokenParsed && e.idTokenParsed.nonce != r.storedNonce ? (b("[KEYCLOAK] Invalid nonce, clearing token"), e.clearToken(), t && t.setError()) : U && (e.onAuthSuccess && e.onAuthSuccess(), t && t.setSuccess());
-    }
+    const e = `${this.clientId} ${this.sessionId ? this.sessionId : ""}`, t = this.#e.iframeOrigin;
+    return await new Promise((o, s) => {
+      const n = (a, c) => a ? s(a) : o(
+        /** @type {boolean} */
+        c
+      );
+      this.#e.callbackList.push(n), this.#e.callbackList.length === 1 && this.#e.iframe?.contentWindow?.postMessage(e, t);
+    });
   }
-  function Z() {
-    var r = w(), t;
-    typeof l == "string" && (t = l);
-    function i(n) {
-      n ? e.endpoints = {
-        authorize: function() {
-          return n.authorization_endpoint;
-        },
-        token: function() {
-          return n.token_endpoint;
-        },
-        logout: function() {
-          if (!n.end_session_endpoint)
-            throw "Not supported by the OIDC server";
-          return n.end_session_endpoint;
-        },
-        checkSessionIframe: function() {
-          if (!n.check_session_iframe)
-            throw "Not supported by the OIDC server";
-          return n.check_session_iframe;
-        },
-        register: function() {
-          throw 'Redirection to "Register user" page not supported in standard OIDC mode';
-        },
-        userinfo: function() {
-          if (!n.userinfo_endpoint)
-            throw "Not supported by the OIDC server";
-          return n.userinfo_endpoint;
-        }
-      } : e.endpoints = {
-        authorize: function() {
-          return _() + "/protocol/openid-connect/auth";
-        },
-        token: function() {
-          return _() + "/protocol/openid-connect/token";
-        },
-        logout: function() {
-          return _() + "/protocol/openid-connect/logout";
-        },
-        checkSessionIframe: function() {
-          return _() + "/protocol/openid-connect/login-status-iframe.html";
-        },
-        thirdPartyCookiesIframe: function() {
-          return _() + "/protocol/openid-connect/3p-cookies/step1.html";
-        },
-        register: function() {
-          return _() + "/protocol/openid-connect/registrations";
-        },
-        userinfo: function() {
-          return _() + "/protocol/openid-connect/userinfo";
+  /**
+   * @returns {Promise<void>}
+   */
+  async #m() {
+    const e = document.createElement("iframe"), t = await this.createLoginUrl({ prompt: "none", redirectUri: this.silentCheckSsoRedirectUri });
+    return e.setAttribute("src", t), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-silent-check-sso"), e.style.display = "none", document.body.appendChild(e), await new Promise((r, o) => {
+      const s = async (n) => {
+        if (n.origin !== window.location.origin || e.contentWindow !== n.source)
+          return;
+        const a = this.#a(n.data);
+        try {
+          await this.#c(a), r();
+        } catch (c) {
+          o(c);
         }
+        document.body.removeChild(e), window.removeEventListener("message", s);
       };
-    }
-    if (t) {
-      var s = new XMLHttpRequest();
-      s.open("GET", t, !0), s.setRequestHeader("Accept", "application/json"), s.onreadystatechange = function() {
-        if (s.readyState == 4)
-          if (s.status == 200 || G(s)) {
-            var n = JSON.parse(s.responseText);
-            e.authServerUrl = n["auth-server-url"], e.realm = n.realm, e.clientId = n.resource, i(null), r.setSuccess();
-          } else
-            r.setError();
-      }, s.send();
-    } else {
-      e.clientId = l.clientId;
-      var a = l.oidcProvider;
-      if (!a)
-        e.authServerUrl = l.url, e.realm = l.realm, i(null), r.setSuccess();
-      else if (typeof a == "string") {
-        var c;
-        a.charAt(a.length - 1) == "/" ? c = a + ".well-known/openid-configuration" : c = a + "/.well-known/openid-configuration";
-        var s = new XMLHttpRequest();
-        s.open("GET", c, !0), s.setRequestHeader("Accept", "application/json"), s.onreadystatechange = function() {
-          if (s.readyState == 4)
-            if (s.status == 200 || G(s)) {
-              var o = JSON.parse(s.responseText);
-              i(o), r.setSuccess();
-            } else
-              r.setError();
-        }, s.send();
-      } else
-        i(a), r.setSuccess();
-    }
-    return r.promise;
-  }
-  function G(r) {
-    return r.status == 0 && r.responseText && r.responseURL.startsWith("file:");
+      window.addEventListener("message", s);
+    });
   }
-  function x(r, t, i, s) {
-    if (e.tokenTimeoutHandle && (clearTimeout(e.tokenTimeoutHandle), e.tokenTimeoutHandle = null), t ? (e.refreshToken = t, e.refreshTokenParsed = J(t)) : (delete e.refreshToken, delete e.refreshTokenParsed), i ? (e.idToken = i, e.idTokenParsed = J(i)) : (delete e.idToken, delete e.idTokenParsed), r) {
-      if (e.token = r, e.tokenParsed = J(r), e.sessionId = e.tokenParsed.sid, e.authenticated = !0, e.subject = e.tokenParsed.sub, e.realmAccess = e.tokenParsed.realm_access, e.resourceAccess = e.tokenParsed.resource_access, s && (e.timeSkew = Math.floor(s / 1e3) - e.tokenParsed.iat), e.timeSkew != null && (b("[KEYCLOAK] Estimated time difference between browser and server is " + e.timeSkew + " seconds"), e.onTokenExpired)) {
-        var a = (e.tokenParsed.exp - (/* @__PURE__ */ new Date()).getTime() / 1e3 + e.timeSkew) * 1e3;
-        b("[KEYCLOAK] Token expires in " + Math.round(a / 1e3) + " s"), a <= 0 ? e.onTokenExpired() : e.tokenTimeoutHandle = setTimeout(e.onTokenExpired, a);
-      }
-    } else
-      delete e.token, delete e.tokenParsed, delete e.subject, delete e.realmAccess, delete e.resourceAccess, e.authenticated = !1;
-  }
-  function q() {
-    if (typeof crypto > "u" || typeof crypto.randomUUID > "u")
-      throw new Error("Web Crypto API is not available.");
-    return crypto.randomUUID();
-  }
-  function E(r) {
-    var t = ee(r);
-    if (t) {
-      var i = m.get(t.state);
-      return i && (t.valid = !0, t.redirectUri = i.redirectUri, t.storedNonce = i.nonce, t.prompt = i.prompt, t.pkceCodeVerifier = i.pkceCodeVerifier, t.loginOptions = i.loginOptions), t;
-    }
+  /**
+   * @param {string} url
+   */
+  #a(e) {
+    const t = this.#A(e);
+    if (!t)
+      return;
+    const r = this.#l.get(t.state);
+    return r && (t.valid = !0, t.redirectUri = r.redirectUri, t.storedNonce = r.nonce, t.prompt = r.prompt, t.pkceCodeVerifier = r.pkceCodeVerifier, t.loginOptions = r.loginOptions), t;
   }
-  function ee(r) {
-    var t;
-    switch (e.flow) {
+  /**
+   * @param {string} urlString
+   */
+  #A(e) {
+    let t = [];
+    switch (this.flow) {
       case "standard":
         t = ["code", "state", "session_state", "kc_action_status", "kc_action", "iss"];
         break;
@@ -434,379 +558,497 @@ For more information see: https://developer.mozilla.org/en-US/docs/Web/Security/
         break;
     }
     t.push("error"), t.push("error_description"), t.push("error_uri");
-    var i = r.indexOf("?"), s = r.indexOf("#"), a, c;
-    if (e.responseMode === "query" && i !== -1 ? (a = r.substring(0, i), c = B(r.substring(i + 1, s !== -1 ? s : r.length), t), c.paramsString !== "" && (a += "?" + c.paramsString), s !== -1 && (a += r.substring(s))) : e.responseMode === "fragment" && s !== -1 && (a = r.substring(0, s), c = B(r.substring(s + 1), t), c.paramsString !== "" && (a += "#" + c.paramsString)), c && c.oauthParams) {
-      if (e.flow === "standard" || e.flow === "hybrid") {
-        if ((c.oauthParams.code || c.oauthParams.error) && c.oauthParams.state)
-          return c.oauthParams.newUrl = a, c.oauthParams;
-      } else if (e.flow === "implicit" && (c.oauthParams.access_token || c.oauthParams.error) && c.oauthParams.state)
-        return c.oauthParams.newUrl = a, c.oauthParams;
-    }
-  }
-  function B(r, t) {
-    for (var i = r.split("&"), s = {
-      paramsString: "",
-      oauthParams: {}
-    }, a = 0; a < i.length; a++) {
-      var c = i[a].indexOf("="), n = i[a].slice(0, c);
-      t.indexOf(n) !== -1 ? s.oauthParams[n] = i[a].slice(c + 1) : (s.paramsString !== "" && (s.paramsString += "&"), s.paramsString += i[a]);
+    const r = new URL(e);
+    let o = "", s;
+    if (this.responseMode === "query" && r.searchParams.size > 0 ? (s = this.#y(r.search, t), r.search = s.paramsString, o = r.toString()) : this.responseMode === "fragment" && r.hash.length > 0 && (s = this.#y(r.hash.substring(1), t), r.hash = s.paramsString, o = r.toString()), s?.oauthParams) {
+      if (this.flow === "standard" || this.flow === "hybrid") {
+        if ((s.oauthParams.code || s.oauthParams.error) && s.oauthParams.state)
+          return s.oauthParams.newUrl = o, s.oauthParams;
+      } else if (this.flow === "implicit" && (s.oauthParams.access_token || s.oauthParams.error) && s.oauthParams.state)
+        return s.oauthParams.newUrl = o, s.oauthParams;
     }
-    return s;
   }
-  function w() {
-    var r = {
-      setSuccess: function(t) {
-        r.resolve(t);
-      },
-      setError: function(t) {
-        r.reject(t);
-      }
+  /**
+   * @typedef {Object} ParsedCallbackParams
+   * @property {string} paramsString
+   * @property {Record<string, string | undefined>} oauthParams
+   */
+  /**
+   * @param {string} paramsString
+   * @param {string[]} supportedParams
+   * @returns {ParsedCallbackParams}
+   */
+  #y(e, t) {
+    const r = new URLSearchParams(e), o = {};
+    for (const [s, n] of Array.from(r.entries()))
+      t.includes(s) && (o[s] = n, r.delete(s));
+    return {
+      paramsString: r.toString(),
+      oauthParams: o
     };
-    return r.promise = new Promise(function(t, i) {
-      r.resolve = t, r.reject = i;
-    }), r;
-  }
-  function re(r, t, i) {
-    var s = null, a = new Promise(function(c, n) {
-      s = setTimeout(function() {
-        n({ error: i });
-      }, t);
-    });
-    return Promise.race([r, a]).finally(function() {
-      clearTimeout(s);
-    });
   }
-  function H() {
-    var r = w();
-    if (!h.enable || h.iframe)
-      return r.setSuccess(), r.promise;
-    var t = document.createElement("iframe");
-    h.iframe = t, t.onload = function() {
-      var a = e.endpoints.authorize();
-      a.charAt(0) === "/" ? h.iframeOrigin = Q() : h.iframeOrigin = a.substring(0, a.indexOf("/", 8)), r.setSuccess();
+  async #c(e) {
+    const { code: t, error: r, prompt: o } = e;
+    let s = (/* @__PURE__ */ new Date()).getTime();
+    const n = (a, c, l) => {
+      if (s = (s + (/* @__PURE__ */ new Date()).getTime()) / 2, this.#h(a, c, l, s), this.#o && this.idTokenParsed && this.idTokenParsed.nonce !== e.storedNonce)
+        throw this.#n("[KEYCLOAK] Invalid nonce, clearing token"), this.clearToken(), new Error("Invalid nonce.");
     };
-    var i = e.endpoints.checkSessionIframe();
-    t.setAttribute("src", i), t.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), t.setAttribute("title", "keycloak-session-iframe"), t.style.display = "none", document.body.appendChild(t);
-    var s = function(a) {
-      if (!(a.origin !== h.iframeOrigin || h.iframe.contentWindow !== a.source) && (a.data == "unchanged" || a.data == "changed" || a.data == "error")) {
-        a.data != "unchanged" && e.clearToken();
-        for (var c = h.callbackList.splice(0, h.callbackList.length), n = c.length - 1; n >= 0; --n) {
-          var o = c[n];
-          a.data == "error" ? o.setError() : o.setSuccess(a.data == "unchanged");
+    if (e.kc_action_status && this.onActionUpdate && this.onActionUpdate(e.kc_action_status, e.kc_action), r) {
+      if (o !== "none")
+        if (e.error_description && e.error_description === "authentication_expired")
+          await this.login(e.loginOptions);
+        else {
+          const a = { error: r, error_description: e.error_description };
+          throw this.onAuthError?.(a), a;
         }
+      return;
+    } else this.flow !== "standard" && (e.access_token || e.id_token) && (n(e.access_token, void 0, e.id_token), this.onAuthSuccess?.());
+    if (this.flow !== "implicit" && t)
+      try {
+        const a = await B(
+          this.endpoints.token(),
+          t,
+          /** @type {string} */
+          this.clientId,
+          e.redirectUri,
+          e.pkceCodeVerifier
+        );
+        n(a.access_token, a.refresh_token, a.id_token), this.flow === "standard" && this.onAuthSuccess?.(), this.#w();
+      } catch (a) {
+        throw this.onAuthError?.(), a;
       }
-    };
-    return window.addEventListener("message", s, !1), r.promise;
   }
-  function K() {
-    h.enable && e.token && setTimeout(function() {
-      P().then(function(r) {
-        r && K();
-      });
-    }, h.interval * 1e3);
-  }
-  function P() {
-    var r = w();
-    if (h.iframe && h.iframeOrigin) {
-      var t = e.clientId + " " + (e.sessionId ? e.sessionId : "");
-      h.callbackList.push(r);
-      var i = h.iframeOrigin;
-      h.callbackList.length == 1 && h.iframe.contentWindow.postMessage(t, i);
-    } else
-      r.setSuccess();
-    return r.promise;
-  }
-  function te() {
-    var r = w();
-    if ((h.enable || e.silentCheckSsoRedirectUri) && typeof e.endpoints.thirdPartyCookiesIframe == "function") {
-      var t = document.createElement("iframe");
-      t.setAttribute("src", e.endpoints.thirdPartyCookiesIframe()), t.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), t.setAttribute("title", "keycloak-3p-check-iframe"), t.style.display = "none", document.body.appendChild(t);
-      var i = function(s) {
-        t.contentWindow === s.source && (s.data !== "supported" && s.data !== "unsupported" || (s.data === "unsupported" && (T(
-          `[KEYCLOAK] Your browser is blocking access to 3rd-party cookies, this means:
-
- - It is not possible to retrieve tokens without redirecting to the Keycloak server (a.k.a. no support for silent authentication).
- - It is not possible to automatically detect changes to the session status (such as the user logging out in another tab).
-
-For more information see: https://www.keycloak.org/securing-apps/javascript-adapter#_modern_browsers`
-        ), h.enable = !1, e.silentCheckSsoFallback && (e.silentCheckSsoRedirectUri = !1)), document.body.removeChild(t), window.removeEventListener("message", i), r.setSuccess()));
-      };
-      window.addEventListener("message", i, !1);
-    } else
-      r.setSuccess();
-    return re(r.promise, e.messageReceiveTimeout, "Timeout when waiting for 3rd party check iframe message.");
-  }
-  function D(r) {
-    if (!r || r == "default")
-      return {
-        login: async function(n) {
-          return window.location.assign(await e.createLoginUrl(n)), w().promise;
-        },
-        logout: async function(n) {
-          if (((n == null ? void 0 : n.logoutMethod) ?? e.logoutMethod) === "GET") {
-            window.location.replace(e.createLogoutUrl(n));
-            return;
-          }
-          const u = document.createElement("form");
-          u.setAttribute("method", "POST"), u.setAttribute("action", e.createLogoutUrl(n)), u.style.display = "none";
-          const p = {
-            id_token_hint: e.idToken,
-            client_id: e.clientId,
-            post_logout_redirect_uri: f.redirectUri(n, !1)
-          };
-          for (const [d, g] of Object.entries(p)) {
-            const S = document.createElement("input");
-            S.setAttribute("type", "hidden"), S.setAttribute("name", d), S.setAttribute("value", g), u.appendChild(S);
-          }
-          document.body.appendChild(u), u.submit();
-        },
-        register: async function(n) {
-          return window.location.assign(await e.createRegisterUrl(n)), w().promise;
-        },
-        accountManagement: function() {
-          var n = e.createAccountUrl();
-          if (typeof n < "u")
-            window.location.href = n;
-          else
-            throw "Not supported by the OIDC server";
-          return w().promise;
-        },
-        redirectUri: function(n, o) {
-          return n && n.redirectUri ? n.redirectUri : e.redirectUri ? e.redirectUri : location.href;
-        }
-      };
-    if (r == "cordova") {
-      h.enable = !1;
-      var t = function(n, o, u) {
-        return window.cordova && window.cordova.InAppBrowser ? window.cordova.InAppBrowser.open(n, o, u) : window.open(n, o, u);
-      }, i = function(n) {
-        return n && n.cordovaOptions ? Object.keys(n.cordovaOptions).reduce(function(o, u) {
-          return o[u] = n.cordovaOptions[u], o;
-        }, {}) : {};
-      }, s = function(n) {
-        return Object.keys(n).reduce(function(o, u) {
-          return o.push(u + "=" + n[u]), o;
-        }, []).join(",");
-      }, a = function(n) {
-        var o = i(n);
-        return o.location = "no", n && n.prompt == "none" && (o.hidden = "yes"), s(o);
-      }, c = function() {
-        return e.redirectUri || "http://localhost";
-      };
-      return {
-        login: async function(n) {
-          var o = w(), u = a(n), p = await e.createLoginUrl(n), d = t(p, "_blank", u), g = !1, S = !1, I = function() {
-            S = !0, d.close();
-          };
-          return d.addEventListener("loadstart", function(U) {
-            if (U.url.indexOf(c()) == 0) {
-              var z = E(U.url);
-              A(z, o), I(), g = !0;
-            }
-          }), d.addEventListener("loaderror", function(U) {
-            if (!g)
-              if (U.url.indexOf(c()) == 0) {
-                var z = E(U.url);
-                A(z, o), I(), g = !0;
-              } else
-                o.setError(), I();
-          }), d.addEventListener("exit", function(U) {
-            S || o.setError({
-              reason: "closed_by_user"
-            });
-          }), o.promise;
-        },
-        logout: function(n) {
-          var o = w(), u = e.createLogoutUrl(n), p = t(u, "_blank", "location=no,hidden=yes,clearcache=yes"), d;
-          return p.addEventListener("loadstart", function(g) {
-            g.url.indexOf(c()) == 0 && p.close();
-          }), p.addEventListener("loaderror", function(g) {
-            g.url.indexOf(c()) == 0 || (d = !0), p.close();
-          }), p.addEventListener("exit", function(g) {
-            d ? o.setError() : (e.clearToken(), o.setSuccess());
-          }), o.promise;
-        },
-        register: async function(n) {
-          var o = w(), u = await e.createRegisterUrl(), p = a(n), d = t(u, "_blank", p);
-          return d.addEventListener("loadstart", function(g) {
-            if (g.url.indexOf(c()) == 0) {
-              d.close();
-              var S = E(g.url);
-              A(S, o);
-            }
-          }), o.promise;
-        },
-        accountManagement: function() {
-          var n = e.createAccountUrl();
-          if (typeof n < "u") {
-            var o = t(n, "_blank", "location=no");
-            o.addEventListener("loadstart", function(u) {
-              u.url.indexOf(c()) == 0 && o.close();
-            });
-          } else
-            throw "Not supported by the OIDC server";
-        },
-        redirectUri: function(n) {
-          return c();
-        }
-      };
-    }
-    if (r == "cordova-native")
-      return h.enable = !1, {
-        login: async function(n) {
-          var o = w(), u = await e.createLoginUrl(n);
-          return universalLinks.subscribe("keycloak", function(p) {
-            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
-            var d = E(p.url);
-            A(d, o);
-          }), window.cordova.plugins.browsertab.openUrl(u), o.promise;
-        },
-        logout: function(n) {
-          var o = w(), u = e.createLogoutUrl(n);
-          return universalLinks.subscribe("keycloak", function(p) {
-            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close(), e.clearToken(), o.setSuccess();
-          }), window.cordova.plugins.browsertab.openUrl(u), o.promise;
-        },
-        register: async function(n) {
-          var o = w(), u = await e.createRegisterUrl(n);
-          return universalLinks.subscribe("keycloak", function(p) {
-            universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
-            var d = E(p.url);
-            A(d, o);
-          }), window.cordova.plugins.browsertab.openUrl(u), o.promise;
-        },
-        accountManagement: function() {
-          var n = e.createAccountUrl();
-          if (typeof n < "u")
-            window.cordova.plugins.browsertab.openUrl(n);
-          else
-            throw "Not supported by the OIDC server";
-        },
-        redirectUri: function(n) {
-          return n && n.redirectUri ? n.redirectUri : e.redirectUri ? e.redirectUri : "http://localhost";
-        }
-      };
-    throw "invalid adapter type: " + r;
-  }
-  const L = "kc-callback-";
-  var j = function() {
-    if (!(this instanceof j))
-      return new j();
-    localStorage.setItem("kc-test", "test"), localStorage.removeItem("kc-test");
-    var r = this;
-    function t() {
-      const c = Date.now();
-      for (const [n, o] of s()) {
-        const u = a(o);
-        (u === null || u < c) && localStorage.removeItem(n);
-      }
-    }
-    function i() {
-      for (const [c] of s())
-        localStorage.removeItem(c);
-    }
-    function s() {
-      return Object.entries(localStorage).filter(([c]) => c.startsWith(L));
-    }
-    function a(c) {
-      let n;
+  async #w() {
+    this.#e.enable && this.token && (await X(this.#e.interval * 1e3), await this.#d() && await this.#w());
+  }
+  /**
+   * @param {KeycloakLoginOptions} [options]
+   * @returns {Promise<void>}
+   */
+  login = (e) => this.#t.login(e);
+  /**
+   * @param {KeycloakLoginOptions} [options]
+   * @returns {Promise<string>}
+   */
+  createLoginUrl = async (e) => {
+    const t = S(), r = S(), o = this.#t.redirectUri(e), s = {
+      state: t,
+      nonce: r,
+      redirectUri: o,
+      loginOptions: e
+    };
+    e?.prompt && (s.prompt = e.prompt);
+    const n = e?.action === "register" ? this.endpoints.register() : this.endpoints.authorize();
+    let a = e?.scope || this.scope;
+    const c = a ? a.split(" ") : [];
+    c.includes("openid") || c.unshift("openid"), a = c.join(" ");
+    const l = new URLSearchParams([
+      [
+        "client_id",
+        /** @type {string} */
+        this.clientId
+      ],
+      ["redirect_uri", o],
+      ["state", t],
+      ["response_mode", this.responseMode],
+      ["response_type", this.responseType],
+      ["scope", a]
+    ]);
+    if (this.#o && l.append("nonce", r), e?.prompt && l.append("prompt", e.prompt), typeof e?.maxAge == "number" && l.append("max_age", e.maxAge.toString()), e?.loginHint && l.append("login_hint", e.loginHint), e?.idpHint && l.append("kc_idp_hint", e.idpHint), e?.action && e.action !== "register" && l.append("kc_action", e.action), e?.locale && l.append("ui_locales", e.locale), e?.acr && l.append("claims", M(e.acr)), e?.acrValues && l.append("acr_values", e.acrValues), this.pkceMethod)
       try {
-        n = JSON.parse(c);
-      } catch {
-        return null;
+        const d = N(96), h = await D(this.pkceMethod, d);
+        s.pkceCodeVerifier = d, l.append("code_challenge", h), l.append("code_challenge_method", this.pkceMethod);
+      } catch (d) {
+        throw new Error("Failed to generate PKCE challenge.", { cause: d });
       }
-      return V(n) && "expires" in n && typeof n.expires == "number" ? n.expires : null;
+    return this.#l.add(s), `${n}?${l.toString()}`;
+  };
+  /**
+   * @param {KeycloakLogoutOptions} [options]
+   * @returns {Promise<void>}
+   */
+  logout = (e) => this.#t.logout(e);
+  /**
+   * @param {KeycloakLogoutOptions} [options]
+   * @returns {string}
+   */
+  createLogoutUrl = (e) => {
+    const t = e?.logoutMethod ?? this.logoutMethod, r = this.endpoints.logout();
+    if (t === "POST")
+      return r;
+    const o = new URLSearchParams([
+      [
+        "client_id",
+        /** @type {string} */
+        this.clientId
+      ],
+      ["post_logout_redirect_uri", this.#t.redirectUri(e)]
+    ]);
+    return this.idToken && o.append("id_token_hint", this.idToken), `${r}?${o.toString()}`;
+  };
+  /**
+   * @param {KeycloakRegisterOptions} [options]
+   * @returns {Promise<void>}
+   */
+  register = (e) => this.#t.register(e);
+  /**
+   * @param {KeycloakRegisterOptions} [options]
+   * @returns {Promise<string>}
+   */
+  createRegisterUrl = (e) => this.createLoginUrl({ ...e, action: "register" });
+  /**
+   * @param {KeycloakAccountOptions} [options]
+   * @returns {string}
+   */
+  createAccountUrl = (e) => {
+    const t = this.#s();
+    if (!t)
+      throw new Error("Unable to create account URL, make sure the adapter is not configured using a generic OIDC provider.");
+    const r = new URLSearchParams([
+      [
+        "referrer",
+        /** @type {string} */
+        this.clientId
+      ],
+      ["referrer_uri", this.#t.redirectUri(e)]
+    ]);
+    return `${t}/account?${r.toString()}`;
+  };
+  /**
+   * @returns {Promise<void>}
+   */
+  accountManagement = () => this.#t.accountManagement();
+  /**
+   * @param {string} role
+   * @returns {boolean}
+   */
+  hasRealmRole = (e) => {
+    const t = this.realmAccess;
+    return !!t && t.roles.indexOf(e) >= 0;
+  };
+  /**
+   * @param {string} role
+   * @param {string} [resource]
+   * @returns {boolean}
+   */
+  hasResourceRole = (e, t) => {
+    if (!this.resourceAccess)
+      return !1;
+    const r = this.resourceAccess[t || /** @type {string} */
+    this.clientId];
+    return !!r && r.roles.indexOf(e) >= 0;
+  };
+  /**
+   * @returns {Promise<KeycloakProfile>}
+   */
+  loadUserProfile = async () => {
+    const e = this.#s();
+    if (!e)
+      throw new Error("Unable to load user profile, make sure the adapter is not configured using a generic OIDC provider.");
+    const t = `${e}/account`, r = await k(t, {
+      headers: [_(this.token)]
+    });
+    return this.profile = r;
+  };
+  /**
+   * @returns {Promise<{}>}
+   */
+  loadUserInfo = async () => {
+    const e = this.endpoints.userinfo(), t = await k(e, {
+      headers: [_(this.token)]
+    });
+    return this.userInfo = t;
+  };
+  /**
+   * @param {number} [minValidity]
+   * @returns {boolean}
+   */
+  isTokenExpired = (e) => {
+    if (!this.tokenParsed || !this.refreshToken && this.flow !== "implicit")
+      throw new Error("Not authenticated");
+    if (this.timeSkew == null)
+      return this.#n("[KEYCLOAK] Unable to determine if token is expired as timeskew is not set"), !0;
+    if (typeof this.tokenParsed.exp != "number")
+      return !1;
+    let t = this.tokenParsed.exp - Math.ceil((/* @__PURE__ */ new Date()).getTime() / 1e3) + this.timeSkew;
+    if (e) {
+      if (isNaN(e))
+        throw new Error("Invalid minValidity");
+      t -= e;
     }
-    r.get = function(c) {
-      if (c) {
-        var n = L + c, o = localStorage.getItem(n);
-        return o && (localStorage.removeItem(n), o = JSON.parse(o)), t(), o;
-      }
-    }, r.add = function(c) {
-      t();
-      const n = L + c.state, o = JSON.stringify({
-        ...c,
-        // Set the expiry time to 1 hour from now.
-        expires: Date.now() + 3600 * 1e3
-      });
+    return t < 0;
+  };
+  /**
+   * @param {number} minValidity
+   * @returns {Promise<boolean>}
+   */
+  updateToken = async (e) => {
+    if (!this.refreshToken)
+      throw new Error("Unable to update token, no refresh token available.");
+    e = e || 5, this.#e.enable && await this.#d();
+    let t = !1;
+    if (e === -1 ? (t = !0, this.#n("[KEYCLOAK] Refreshing token: forced refresh")) : (!this.tokenParsed || this.isTokenExpired(e)) && (t = !0, this.#n("[KEYCLOAK] Refreshing token: token expired")), !t)
+      return !1;
+    const { promise: r, resolve: o, reject: s } = Promise.withResolvers();
+    if (this.#r.push({ resolve: o, reject: s }), this.#r.length === 1) {
+      const n = this.endpoints.token();
+      let a = (/* @__PURE__ */ new Date()).getTime();
       try {
-        localStorage.setItem(n, o);
-      } catch {
-        i(), localStorage.setItem(n, o);
-      }
-    };
-  }, O = function() {
-    if (!(this instanceof O))
-      return new O();
-    var r = this;
-    r.get = function(a) {
-      if (a) {
-        var c = i(L + a);
-        if (s(L + a, "", t(-100)), c)
-          return JSON.parse(c);
+        const c = await G(
+          n,
+          this.refreshToken,
+          /** @type {string} */
+          this.clientId
+        );
+        this.#n("[KEYCLOAK] Token refreshed"), a = (a + (/* @__PURE__ */ new Date()).getTime()) / 2, this.#h(c.access_token, c.refresh_token, c.id_token, a), this.onAuthRefreshSuccess?.();
+        for (let l = this.#r.pop(); l != null; l = this.#r.pop())
+          l.resolve(!0);
+      } catch (c) {
+        this.#u("[KEYCLOAK] Failed to refresh token"), c instanceof A && c.response.status === 400 && this.clearToken(), this.onAuthRefreshError?.();
+        for (let l = this.#r.pop(); l != null; l = this.#r.pop())
+          l.reject(c);
       }
-    }, r.add = function(a) {
-      s(L + a.state, JSON.stringify(a), t(60));
-    }, r.removeItem = function(a) {
-      s(a, "", t(-100));
-    };
-    var t = function(a) {
-      var c = /* @__PURE__ */ new Date();
-      return c.setTime(c.getTime() + a * 60 * 1e3), c;
-    }, i = function(a) {
-      for (var c = a + "=", n = document.cookie.split(";"), o = 0; o < n.length; o++) {
-        for (var u = n[o]; u.charAt(0) == " "; )
-          u = u.substring(1);
-        if (u.indexOf(c) == 0)
-          return u.substring(c.length, u.length);
+    }
+    return await r;
+  };
+  clearToken = () => {
+    this.token && (this.#h(), this.onAuthLogout?.(), this.loginRequired && this.login());
+  };
+  /**
+   * @param {string} [token]
+   * @param {string} [refreshToken]
+   * @param {string} [idToken]
+   * @param {number} [timeLocal]
+   */
+  #h(e, t, r, o) {
+    if (this.tokenTimeoutHandle && (clearTimeout(this.tokenTimeoutHandle), this.tokenTimeoutHandle = void 0), t ? (this.refreshToken = t, this.refreshTokenParsed = b(t)) : (delete this.refreshToken, delete this.refreshTokenParsed), r ? (this.idToken = r, this.idTokenParsed = b(r)) : (delete this.idToken, delete this.idTokenParsed), e) {
+      if (this.token = e, this.tokenParsed = b(e), this.sessionId = this.tokenParsed.sid, this.authenticated = !0, this.subject = this.tokenParsed.sub, this.realmAccess = this.tokenParsed.realm_access, this.resourceAccess = this.tokenParsed.resource_access, o && (this.timeSkew = Math.floor(o / 1e3) - this.tokenParsed.iat), this.timeSkew !== null && (this.#n("[KEYCLOAK] Estimated time difference between browser and server is " + this.timeSkew + " seconds"), this.onTokenExpired)) {
+        const s = (this.tokenParsed.exp - (/* @__PURE__ */ new Date()).getTime() / 1e3 + this.timeSkew) * 1e3;
+        this.#n("[KEYCLOAK] Token expires in " + Math.round(s / 1e3) + " s"), s <= 0 ? this.onTokenExpired() : this.tokenTimeoutHandle = window.setTimeout(this.onTokenExpired, s);
       }
-      return "";
-    }, s = function(a, c, n) {
-      var o = a + "=" + c + "; expires=" + n.toUTCString() + "; ";
-      document.cookie = o;
+    } else
+      delete this.token, delete this.tokenParsed, delete this.subject, delete this.realmAccess, delete this.resourceAccess, this.authenticated = !1;
+  }
+  /**
+   * @returns {string=}
+   */
+  #s() {
+    if (!(typeof this.authServerUrl > "u"))
+      return `${E(this.authServerUrl)}/realms/${encodeURIComponent(
+        /** @type {string} */
+        this.realm
+      )}`;
+  }
+  /**
+   * @param {Function} fn
+   * @returns {(message: string) => void}
+   */
+  #b(e) {
+    return (t) => {
+      this.enableLogging && e.call(console, t);
     };
-  };
-  function ne() {
+  }
+}
+function S() {
+  if (typeof crypto > "u" || typeof crypto.randomUUID > "u")
+    throw new Error("Web Crypto API is not available.");
+  return crypto.randomUUID();
+}
+function M(i) {
+  return JSON.stringify({
+    id_token: {
+      acr: i
+    }
+  });
+}
+function N(i) {
+  return K(i, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
+}
+async function D(i, e) {
+  if (i !== "S256")
+    throw new TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${i}'.`);
+  const t = new Uint8Array(await W(e));
+  return J(t).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function K(i, e) {
+  const t = O(i), r = new Array(i);
+  for (let o = 0; o < i; o++)
+    r[o] = e.charCodeAt(t[o] % e.length);
+  return String.fromCharCode.apply(null, r);
+}
+function O(i) {
+  if (typeof crypto > "u" || typeof crypto.getRandomValues > "u")
+    throw new Error("Web Crypto API is not available.");
+  return crypto.getRandomValues(new Uint8Array(i));
+}
+function j(i, e, t) {
+  let r;
+  const o = new Promise(function(s, n) {
+    r = window.setTimeout(function() {
+      n(new Error(t));
+    }, e);
+  });
+  return Promise.race([i, o]).finally(function() {
+    clearTimeout(r);
+  });
+}
+function z() {
+  try {
+    return new H();
+  } catch {
+    return new $();
+  }
+}
+const g = "kc-callback-";
+class H {
+  constructor() {
+    globalThis.localStorage.setItem("kc-test", "test"), globalThis.localStorage.removeItem("kc-test");
+  }
+  /**
+   * @param {string} [state]
+   * @returns {CallbackState | null}
+   */
+  get(e) {
+    if (!e)
+      return null;
+    this.#r();
+    const t = g + e, r = globalThis.localStorage.getItem(t);
+    return r ? (globalThis.localStorage.removeItem(t), JSON.parse(r)) : null;
+  }
+  /**
+   * @param {CallbackState} state
+   */
+  add(e) {
+    this.#r();
+    const t = g + e.state, r = JSON.stringify({
+      ...e,
+      // Set the expiry time to 1 hour from now.
+      expires: Date.now() + 3600 * 1e3
+    });
     try {
-      return new j();
+      globalThis.localStorage.setItem(t, r);
     } catch {
+      this.#t(), globalThis.localStorage.setItem(t, r);
     }
-    return new O();
   }
-  function X(r) {
-    return function() {
-      e.enableLogging && r.apply(console, Array.prototype.slice.call(arguments));
-    };
+  /**
+   * Clears all values from local storage that are no longer valid.
+   */
+  #r() {
+    const e = Date.now();
+    for (const [t, r] of this.#o()) {
+      const o = this.#l(r);
+      (o === null || o < e) && globalThis.localStorage.removeItem(t);
+    }
+  }
+  /**
+   * Clears all known values from local storage.
+   */
+  #t() {
+    for (const [e] of this.#o())
+      globalThis.localStorage.removeItem(e);
+  }
+  /**
+   * Gets all entries stored in local storage that are known to be managed by this class.
+   * @returns {[string, string][]} An array of key-value pairs.
+   */
+  #o() {
+    return Object.entries(globalThis.localStorage).filter(([e]) => e.startsWith(g));
+  }
+  /**
+   * Parses the expiry time from a value stored in local storage.
+   * @param {string} value
+   * @returns {number | null} The expiry time in milliseconds, or `null` if the value is malformed.
+   */
+  #l(e) {
+    let t;
+    try {
+      t = JSON.parse(e);
+    } catch {
+      return null;
+    }
+    return v(t) && "expires" in t && typeof t.expires == "number" ? t.expires : null;
+  }
+}
+class $ {
+  /**
+   * @param {string} [state]
+   * @returns {CallbackState | null}
+   */
+  get(e) {
+    if (!e)
+      return null;
+    const t = this.#r(g + e);
+    return this.#t(g + e, "", this.#o(-100)), t ? JSON.parse(t) : null;
+  }
+  /**
+   * @param {CallbackState} state
+   */
+  add(e) {
+    this.#t(g + e.state, JSON.stringify(e), this.#o(60));
+  }
+  /**
+   * @param {string} key
+   * @returns
+   */
+  #r(e) {
+    const t = e + "=", r = document.cookie.split(";");
+    for (let o = 0; o < r.length; o++) {
+      let s = r[o];
+      for (; s.charAt(0) === " "; )
+        s = s.substring(1);
+      if (s.indexOf(t) === 0)
+        return s.substring(t.length, s.length);
+    }
+    return "";
+  }
+  /**
+   * @param {string} key
+   * @param {string} value
+   * @param {Date} expirationDate
+   */
+  #t(e, t, r) {
+    const o = e + "=" + t + "; expires=" + r.toUTCString() + "; ";
+    document.cookie = o;
+  }
+  /**
+   * @param {number} minutes
+   * @returns {Date}
+   */
+  #o(e) {
+    const t = /* @__PURE__ */ new Date();
+    return t.setTime(t.getTime() + e * 60 * 1e3), t;
   }
 }
-function ie(l) {
-  const e = String.fromCodePoint(...l);
+function J(i) {
+  const e = String.fromCodePoint(...i);
   return btoa(e);
 }
-async function ce(l) {
-  const f = new TextEncoder().encode(l);
+async function W(i) {
+  const t = new TextEncoder().encode(i);
   if (typeof crypto > "u" || typeof crypto.subtle > "u")
     throw new Error("Web Crypto API is not available.");
-  return await crypto.subtle.digest("SHA-256", f);
+  return await crypto.subtle.digest("SHA-256", t);
 }
-function J(l) {
-  const [e, f] = l.split(".");
-  if (typeof f != "string")
+function b(i) {
+  const [, e] = i.split(".");
+  if (typeof e != "string")
     throw new Error("Unable to decode token, payload not found.");
-  let k;
+  let t;
   try {
-    k = ue(f);
-  } catch (m) {
-    throw new Error("Unable to decode token, payload is not a valid Base64URL value.", { cause: m });
+    t = F(e);
+  } catch (r) {
+    throw new Error("Unable to decode token, payload is not a valid Base64URL value.", { cause: r });
   }
   try {
-    return JSON.parse(k);
-  } catch (m) {
-    throw new Error("Unable to decode token, payload is not a valid JSON value.", { cause: m });
+    return JSON.parse(t);
+  } catch (r) {
+    throw new Error("Unable to decode token, payload is not a valid JSON value.", { cause: r });
   }
 }
-function ue(l) {
-  let e = l.replaceAll("-", "+").replaceAll("_", "/");
+function F(i) {
+  let e = i.replaceAll("-", "+").replaceAll("_", "/");
   switch (e.length % 4) {
     case 0:
       break;
@@ -820,21 +1062,85 @@ function ue(l) {
       throw new Error("Input is not of the correct length.");
   }
   try {
-    return le(e);
+    return q(e);
   } catch {
     return atob(e);
   }
 }
-function le(l) {
-  return decodeURIComponent(atob(l).replace(/(.)/g, (e, f) => {
-    let k = f.charCodeAt(0).toString(16).toUpperCase();
-    return k.length < 2 && (k = "0" + k), "%" + k;
+function q(i) {
+  return decodeURIComponent(atob(i).replace(/(.)/g, (e, t) => {
+    let r = t.charCodeAt(0).toString(16).toUpperCase();
+    return r.length < 2 && (r = "0" + r), "%" + r;
   }));
 }
-function V(l) {
-  return typeof l == "object" && l !== null;
+function v(i) {
+  return typeof i == "object" && i !== null;
 }
-class Y extends $ {
+async function Y(i) {
+  return await k(i);
+}
+async function V(i) {
+  return await k(i);
+}
+async function B(i, e, t, r, o) {
+  const s = new URLSearchParams([
+    ["code", e],
+    ["grant_type", "authorization_code"],
+    ["client_id", t],
+    ["redirect_uri", r]
+  ]);
+  return o && s.append("code_verifier", o), await k(i, {
+    method: "POST",
+    credentials: "include",
+    body: s
+  });
+}
+async function G(i, e, t) {
+  const r = new URLSearchParams([
+    ["grant_type", "refresh_token"],
+    ["refresh_token", e],
+    ["client_id", t]
+  ]);
+  return await k(i, {
+    method: "POST",
+    credentials: "include",
+    body: r
+  });
+}
+async function k(i, e = {}) {
+  const t = new Headers(e.headers);
+  return t.set("Accept", R), await (await Q(i, {
+    ...e,
+    headers: t
+  })).json();
+}
+async function Q(i, e) {
+  const t = await fetch(i, e);
+  if (!t.ok)
+    throw new A("Server responded with an invalid status.", { response: t });
+  return t;
+}
+function _(i) {
+  if (!i)
+    throw new Error("Unable to build authorization header, token is not set, make sure the user is authenticated.");
+  return ["Authorization", `bearer ${i}`];
+}
+function E(i) {
+  return i.endsWith("/") ? i.slice(0, -1) : i;
+}
+class A extends Error {
+  /** @type {Response} */
+  response;
+  /**
+   * @param {string} message
+   * @param {NetworkErrorOptions} options
+   */
+  constructor(e, t) {
+    super(e, t), this.response = t.response;
+  }
+}
+const X = (i) => new Promise((e) => setTimeout(e, i));
+class U extends x {
   constructor(e) {
     super(e);
   }
@@ -849,8 +1155,8 @@ class Y extends $ {
     }
   }
   static async init(e) {
-    const f = new Y(e);
-    return console.log("KeycloakAdapter", e), await f.initialize(), f;
+    const t = new U(e);
+    return console.log("KeycloakAdapter", e), await t.initialize(), t;
   }
   get userInfo() {
     return this.idTokenParsed;
@@ -862,116 +1168,107 @@ class Y extends $ {
     return this.authenticated ?? !1;
   }
 }
-const de = {
+const Z = {
   skipAuthentication: !1
-}, pe = (l) => {
-  const e = oe(!1);
-  let f;
-  const k = { ...de, ...l }, m = async () => {
-    const v = await Y.init(l.keycloak);
-    return f = v, e.value = !0, v;
-  }, h = () => f == null ? void 0 : f.token, y = async () => {
-    if (!f)
-      return m();
-    e.value || await new Promise((v) => {
-      const M = se(e, (N) => {
-        N && (M(), v());
+}, te = (i) => {
+  const e = P(!1);
+  let t;
+  const r = { ...Z, ...i }, o = async () => {
+    const h = await U.init(i.keycloak);
+    return t = h, e.value = !0, h;
+  }, s = () => t?.token, n = async () => {
+    if (!t)
+      return o();
+    e.value || await new Promise((h) => {
+      const f = L(e, (p) => {
+        p && (f(), h());
       });
     });
-  }, C = ae({
-    install(v) {
-      v.runWithContext(() => {
-        v.config.globalProperties.$auth = k, v.provide(F, C);
+  }, d = I({
+    install(h) {
+      h.runWithContext(() => {
+        h.config.globalProperties.$auth = r, h.provide(T, d);
       });
     },
-    updateToken: async () => {
-      var v;
-      return (v = await y()) == null ? void 0 : v.updateToken();
-    },
-    token: h,
-    user: async () => {
-      var v;
-      return (v = await y()) == null ? void 0 : v.userInfo;
-    },
-    logout: async () => {
-      var v;
-      return (v = await y()) == null ? void 0 : v.logout();
-    },
-    options: k
+    updateToken: async () => (await n())?.updateToken(),
+    token: s,
+    user: async () => (await n())?.userInfo,
+    logout: async () => (await n())?.logout(),
+    options: r
   });
-  return C;
-}, he = () => {
-  const l = W(F);
-  l || console.warn("No auth provided, authorized calls may not work");
-  const e = async (f, k, m = { contentType: "application/json" }) => {
-    const h = (m == null ? void 0 : m.skipAuth) ?? (l == null ? void 0 : l.options.skipAuthentication), y = {
+  return d;
+}, re = () => {
+  const i = C(T);
+  i || console.warn("No auth provided, authorized calls may not work");
+  const e = async (t, r, o = { contentType: "application/json" }) => {
+    const s = o?.skipAuth ?? i?.options.skipAuthentication, n = {
       accept: "application/json",
-      ...k.headers ?? {}
+      ...r.headers ?? {}
     };
-    m.contentType && (y["Content-Type"] = m.contentType), h || (await (l == null ? void 0 : l.updateToken()), y.Authorization = `Bearer ${l == null ? void 0 : l.token()}`);
-    const b = new URL(f, window.location.href);
-    if (m != null && m.queryParams)
-      for (const [R, C] of Object.entries(m.queryParams))
-        b.searchParams.set(R, C);
-    const T = await fetch(b.toString(), {
-      ...k,
-      headers: y
+    o.contentType && (n["Content-Type"] = o.contentType), s || (await i?.updateToken(), n.Authorization = `Bearer ${i?.token()}`);
+    const a = new URL(t, window.location.href);
+    if (o?.queryParams)
+      for (const [l, d] of Object.entries(o.queryParams))
+        a.searchParams.set(l, d);
+    const c = await fetch(a.toString(), {
+      ...r,
+      headers: n
     });
-    return T.ok ? T.json() : (m != null && m.skipAuth, Promise.reject({
-      content: T.body,
-      status: T.status
+    return c.ok ? c.json() : (o?.skipAuth, Promise.reject({
+      content: c.body,
+      status: c.status
     }));
   };
   return {
-    get: (f, k) => e(f, { method: "GET" }, k),
-    postFile: (f, k, m = {}, h) => {
-      const y = new FormData();
-      for (const b in m)
-        y.append(b, m[b]);
-      return y.append("file", k), e(
-        f,
+    get: (t, r) => e(t, { method: "GET" }, r),
+    postFile: (t, r, o = {}, s) => {
+      const n = new FormData();
+      for (const a in o)
+        n.append(a, o[a]);
+      return n.append("file", r), e(
+        t,
         {
           method: "POST",
-          body: y
+          body: n
         },
-        { ...h, contentType: void 0 }
+        { ...s, contentType: void 0 }
       );
     },
-    post: (f, k, m) => e(
-      f,
+    post: (t, r, o) => e(
+      t,
       {
         method: "POST",
-        body: JSON.stringify(k)
+        body: JSON.stringify(r)
       },
-      m
+      o
     ),
-    patch: (f, k, m) => e(
-      f,
+    patch: (t, r, o) => e(
+      t,
       {
         method: "PATCH",
-        body: JSON.stringify(k)
+        body: JSON.stringify(r)
       },
-      m
+      o
     ),
-    delete: (f, k, m) => e(
-      f,
+    delete: (t, r, o) => e(
+      t,
       {
         method: "DELETE",
-        body: JSON.stringify(k)
+        body: JSON.stringify(r)
       },
-      m
+      o
     )
   };
-}, me = () => {
-  const l = W(F);
-  return l || console.warn("No auth provided, authorized calls may not work"), {
-    isAuthenticated: () => !!(l != null && l.user()),
-    getUser: () => l == null ? void 0 : l.user(),
-    logout: () => l == null ? void 0 : l.logout()
+}, oe = () => {
+  const i = C(T);
+  return i || console.warn("No auth provided, authorized calls may not work"), {
+    isAuthenticated: () => !!i?.user(),
+    getUser: () => i?.user(),
+    logout: () => i?.logout()
   };
 };
 export {
-  pe as createAuth,
-  me as useAuthenticate,
-  he as useHttpRequest
+  te as createAuth,
+  oe as useAuthenticate,
+  re as useHttpRequest
 };