@inrupt/solid-client-authn-browser 4.0.0 → 5.0.1

package/dist/solid-client-authn.bundle.js

@@ -1,2 +1,2 @@
-var solidClientAuthentication=function(e){"use strict";var t=crypto;const r=e=>e instanceof CryptoKey,s=new TextEncoder,i=new TextDecoder;function n(...e){const t=e.reduce(((e,{length:t})=>e+t),0),r=new Uint8Array(t);let s=0;return e.forEach((e=>{r.set(e,s),s+=e.length})),r}const o=e=>(e=>{let t=e;"string"==typeof t&&(t=s.encode(t));const r=[];for(let e=0;e<t.length;e+=32768)r.push(String.fromCharCode.apply(null,t.subarray(e,e+32768)));return btoa(r.join(""))})(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"),a=e=>{let t=e;t instanceof Uint8Array&&(t=i.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return(e=>{const t=atob(e),r=new Uint8Array(t.length);for(let e=0;e<t.length;e++)r[e]=t.charCodeAt(e);return r})(t)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}};class c extends Error{static get code(){return"ERR_JOSE_GENERIC"}constructor(e){super(e),this.code="ERR_JOSE_GENERIC",this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class d extends c{static get code(){return"ERR_JWT_CLAIM_VALIDATION_FAILED"}constructor(e,t="unspecified",r="unspecified"){super(e),this.code="ERR_JWT_CLAIM_VALIDATION_FAILED",this.claim=t,this.reason=r}}class l extends c{static get code(){return"ERR_JWT_EXPIRED"}constructor(e,t="unspecified",r="unspecified"){super(e),this.code="ERR_JWT_EXPIRED",this.claim=t,this.reason=r}}class h extends c{constructor(){super(...arguments),this.code="ERR_JOSE_ALG_NOT_ALLOWED"}static get code(){return"ERR_JOSE_ALG_NOT_ALLOWED"}}class u extends c{constructor(){super(...arguments),this.code="ERR_JOSE_NOT_SUPPORTED"}static get code(){return"ERR_JOSE_NOT_SUPPORTED"}}class p extends c{constructor(){super(...arguments),this.code="ERR_JWS_INVALID"}static get code(){return"ERR_JWS_INVALID"}}class g extends c{constructor(){super(...arguments),this.code="ERR_JWT_INVALID"}static get code(){return"ERR_JWT_INVALID"}}class f extends c{constructor(){super(...arguments),this.code="ERR_JWKS_INVALID"}static get code(){return"ERR_JWKS_INVALID"}}class _ extends c{constructor(){super(...arguments),this.code="ERR_JWKS_NO_MATCHING_KEY",this.message="no applicable key found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_NO_MATCHING_KEY"}}class y extends c{constructor(){super(...arguments),this.code="ERR_JWKS_MULTIPLE_MATCHING_KEYS",this.message="multiple matching keys found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_MULTIPLE_MATCHING_KEYS"}}class w extends c{constructor(){super(...arguments),this.code="ERR_JWKS_TIMEOUT",this.message="request timed out"}static get code(){return"ERR_JWKS_TIMEOUT"}}class m extends c{constructor(){super(...arguments),this.code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED",this.message="signature verification failed"}static get code(){return"ERR_JWS_SIGNATURE_VERIFICATION_FAILED"}}function S(e,t="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function v(e,t){return e.name===t}function E(e){return parseInt(e.name.slice(4),10)}function b(e,t,...r){switch(t){case"HS256":case"HS384":case"HS512":{if(!v(e.algorithm,"HMAC"))throw S("HMAC");const r=parseInt(t.slice(2),10);if(E(e.algorithm.hash)!==r)throw S(`SHA-${r}`,"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!v(e.algorithm,"RSASSA-PKCS1-v1_5"))throw S("RSASSA-PKCS1-v1_5");const r=parseInt(t.slice(2),10);if(E(e.algorithm.hash)!==r)throw S(`SHA-${r}`,"algorithm.hash");break}case"PS256":case"PS384":case"PS512":{if(!v(e.algorithm,"RSA-PSS"))throw S("RSA-PSS");const r=parseInt(t.slice(2),10);if(E(e.algorithm.hash)!==r)throw S(`SHA-${r}`,"algorithm.hash");break}case"EdDSA":if("Ed25519"!==e.algorithm.name&&"Ed448"!==e.algorithm.name)throw S("Ed25519 or Ed448");break;case"ES256":case"ES384":case"ES512":{if(!v(e.algorithm,"ECDSA"))throw S("ECDSA");const r=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}(t);if(e.algorithm.namedCurve!==r)throw S(r,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}!function(e,t){if(t.length&&!t.some((t=>e.usages.includes(t)))){let e="CryptoKey does not support this operation, its usages must include ";if(t.length>2){const r=t.pop();e+=`one of ${t.join(", ")}, or ${r}.`}else 2===t.length?e+=`one of ${t[0]} or ${t[1]}.`:e+=`${t[0]}.`;throw new TypeError(e)}}(e,r)}function k(e,t,...r){if(r.length>2){const t=r.pop();e+=`one of type ${r.join(", ")}, or ${t}.`}else 2===r.length?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return null==t?e+=` Received ${t}`:"function"==typeof t&&t.name?e+=` Received function ${t.name}`:"object"==typeof t&&null!=t&&t.constructor&&t.constructor.name&&(e+=` Received an instance of ${t.constructor.name}`),e}t.getRandomValues.bind(t);var I=(e,...t)=>k("Key must be ",e,...t);function T(e,t,...r){return k(`Key for the ${e} algorithm must be `,t,...r)}var A=e=>r(e);const U=["CryptoKey"],R=(...e)=>{const t=e.filter(Boolean);if(0===t.length||1===t.length)return!0;let r;for(const e of t){const t=Object.keys(e);if(r&&0!==r.size)for(const e of t){if(r.has(e))return!1;r.add(e)}else r=new Set(t)}return!0};function P(e){if("object"!=typeof(t=e)||null===t||"[object Object]"!==Object.prototype.toString.call(e))return!1;var t;if(null===Object.getPrototypeOf(e))return!0;let r=e;for(;null!==Object.getPrototypeOf(r);)r=Object.getPrototypeOf(r);return Object.getPrototypeOf(e)===r}var C=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){const{modulusLength:r}=t.algorithm;if("number"!=typeof r||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}};const x=async e=>{if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const{algorithm:r,keyUsages:s}=function(e){let t,r;switch(e.kty){case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"EC":switch(e.alg){case"ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case"ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case"ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"OKP":switch(e.alg){case"EdDSA":t={name:e.crv},r=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;default:throw new u('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:r}}(e),i=[r,e.ext??!1,e.key_ops??s],n={...e};return delete n.alg,delete n.use,t.subtle.importKey("jwk",n,...i)};const O=(e,t,r)=>{e.startsWith("HS")||"dir"===e||e.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(e)?((e,t)=>{if(!(t instanceof Uint8Array)){if(!A(t))throw new TypeError(T(e,t,...U,"Uint8Array"));if("secret"!==t.type)throw new TypeError(`${U.join(" or ")} instances for symmetric algorithms must be of type "secret"`)}})(e,t):((e,t,r)=>{if(!A(t))throw new TypeError(T(e,t,...U));if("secret"===t.type)throw new TypeError(`${U.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);if("sign"===r&&"public"===t.type)throw new TypeError(`${U.join(" or ")} instances for asymmetric algorithm signing must be of type "private"`);if("decrypt"===r&&"public"===t.type)throw new TypeError(`${U.join(" or ")} instances for asymmetric algorithm decryption must be of type "private"`);if(t.algorithm&&"verify"===r&&"private"===t.type)throw new TypeError(`${U.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);if(t.algorithm&&"encrypt"===r&&"private"===t.type)throw new TypeError(`${U.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`)})(e,t,r)};function H(e,t,r,s,i){if(void 0!==i.crit&&void 0===s.crit)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!s||void 0===s.crit)return new Set;if(!Array.isArray(s.crit)||0===s.crit.length||s.crit.some((e=>"string"!=typeof e||0===e.length)))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let n;n=void 0!==r?new Map([...Object.entries(r),...t.entries()]):t;for(const t of s.crit){if(!n.has(t))throw new u(`Extension Header Parameter "${t}" is not recognized`);if(void 0===i[t])throw new e(`Extension Header Parameter "${t}" is missing`);if(n.get(t)&&void 0===s[t])throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return new Set(s.crit)}async function $(e){return(async e=>{if(e instanceof Uint8Array)return{kty:"oct",k:o(e)};if(!r(e))throw new TypeError(I(e,...U,"Uint8Array"));if(!e.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");const{ext:s,key_ops:i,alg:n,use:a,...c}=await t.subtle.exportKey("jwk",e);return c})(e)}function K(e,t){const r=`SHA-${e.slice(-3)}`;switch(e){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:e.slice(-3)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:t.namedCurve};case"EdDSA":return{name:t.name};default:throw new u(`alg ${e} is not supported either by JOSE or your javascript runtime`)}}function D(e,s,i){if(r(s))return b(s,e,i),s;if(s instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(I(s,...U));return t.subtle.importKey("raw",s,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},!1,[i])}throw new TypeError(I(s,...U,"Uint8Array"))}async function N(e,r,o){if(!P(e))throw new p("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new p('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new p("JWS Protected Header incorrect type");if(void 0===e.payload)throw new p("JWS Payload missing");if("string"!=typeof e.signature)throw new p("JWS Signature missing or incorrect type");if(void 0!==e.header&&!P(e.header))throw new p("JWS Unprotected Header incorrect type");let c={};if(e.protected)try{const t=a(e.protected);c=JSON.parse(i.decode(t))}catch{throw new p("JWS Protected Header is invalid")}if(!R(c,e.header))throw new p("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const d={...c,...e.header};let l=!0;if(H(p,new Map([["b64",!0]]),o?.crit,c,d).has("b64")&&(l=c.b64,"boolean"!=typeof l))throw new p('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:u}=d;if("string"!=typeof u||!u)throw new p('JWS "alg" (Algorithm) Header Parameter missing or invalid');const g=o&&((e,t)=>{if(void 0!==t&&(!Array.isArray(t)||t.some((e=>"string"!=typeof e))))throw new TypeError(`"${e}" option must be an array of strings`);if(t)return new Set(t)})("algorithms",o.algorithms);if(g&&!g.has(u))throw new h('"alg" (Algorithm) Header Parameter value not allowed');if(l){if("string"!=typeof e.payload)throw new p("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new p("JWS Payload must be a string or an Uint8Array instance");let f=!1;"function"==typeof r&&(r=await r(c,e),f=!0),O(u,r,"verify");const _=n(s.encode(e.protected??""),s.encode("."),"string"==typeof e.payload?s.encode(e.payload):e.payload);let y;try{y=a(e.signature)}catch{throw new p("Failed to base64url decode the signature")}const w=await(async(e,r,s,i)=>{const n=await D(e,r,"verify");C(e,n);const o=K(e,n.algorithm);try{return await t.subtle.verify(o,n,s,i)}catch{return!1}})(u,r,y,_);if(!w)throw new m;let S;if(l)try{S=a(e.payload)}catch{throw new p("Failed to base64url decode the payload")}else S="string"==typeof e.payload?s.encode(e.payload):e.payload;const v={payload:S};return void 0!==e.protected&&(v.protectedHeader=c),void 0!==e.header&&(v.unprotectedHeader=e.header),f?{...v,key:r}:v}var L=e=>Math.floor(e.getTime()/1e3);const j=86400,J=/^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;var W=e=>{const t=J.exec(e);if(!t)throw new TypeError("Invalid time period format");const r=parseFloat(t[1]);switch(t[2].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":return Math.round(r);case"minute":case"minutes":case"min":case"mins":case"m":return Math.round(60*r);case"hour":case"hours":case"hr":case"hrs":case"h":return Math.round(3600*r);case"day":case"days":case"d":return Math.round(r*j);case"week":case"weeks":case"w":return Math.round(604800*r);default:return Math.round(31557600*r)}};const M=e=>e.toLowerCase().replace(/^application\//,"");var q=(e,t,r={})=>{const{typ:s}=r;if(s&&("string"!=typeof e.typ||M(e.typ)!==M(s)))throw new d('unexpected "typ" JWT header value',"typ","check_failed");let n;try{n=JSON.parse(i.decode(t))}catch{}if(!P(n))throw new g("JWT Claims Set must be a top-level JSON object");const{requiredClaims:o=[],issuer:a,subject:c,audience:h,maxTokenAge:u}=r,p=[...o];void 0!==u&&p.push("iat"),void 0!==h&&p.push("aud"),void 0!==c&&p.push("sub"),void 0!==a&&p.push("iss");for(const e of new Set(p.reverse()))if(!(e in n))throw new d(`missing required "${e}" claim`,e,"missing");if(a&&!(Array.isArray(a)?a:[a]).includes(n.iss))throw new d('unexpected "iss" claim value',"iss","check_failed");if(c&&n.sub!==c)throw new d('unexpected "sub" claim value',"sub","check_failed");if(h&&(f=n.aud,_="string"==typeof h?[h]:h,!("string"==typeof f?_.includes(f):Array.isArray(f)&&_.some(Set.prototype.has.bind(new Set(f))))))throw new d('unexpected "aud" claim value',"aud","check_failed");var f,_;let y;switch(typeof r.clockTolerance){case"string":y=W(r.clockTolerance);break;case"number":y=r.clockTolerance;break;case"undefined":y=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const{currentDate:w}=r,m=L(w||new Date);if((void 0!==n.iat||u)&&"number"!=typeof n.iat)throw new d('"iat" claim must be a number',"iat","invalid");if(void 0!==n.nbf){if("number"!=typeof n.nbf)throw new d('"nbf" claim must be a number',"nbf","invalid");if(n.nbf>m+y)throw new d('"nbf" claim timestamp check failed',"nbf","check_failed")}if(void 0!==n.exp){if("number"!=typeof n.exp)throw new d('"exp" claim must be a number',"exp","invalid");if(n.exp<=m-y)throw new l('"exp" claim timestamp check failed',"exp","check_failed")}if(u){const e=m-n.iat;if(e-y>("number"==typeof u?u:W(u)))throw new l('"iat" claim timestamp check failed (too far in the past)',"iat","check_failed");if(e<0-y)throw new d('"iat" claim timestamp check failed (it should be in the past)',"iat","check_failed")}return n};async function F(e,t,r){const s=await async function(e,t,r){if(e instanceof Uint8Array&&(e=i.decode(e)),"string"!=typeof e)throw new p("Compact JWS must be a string or Uint8Array");const{0:s,1:n,2:o,length:a}=e.split(".");if(3!==a)throw new p("Invalid Compact JWS");const c=await N({payload:n,protected:s,signature:o},t,r),d={payload:c.payload,protectedHeader:c.protectedHeader};return"function"==typeof t?{...d,key:c.key}:d}(e,t,r);if(s.protectedHeader.crit?.includes("b64")&&!1===s.protectedHeader.b64)throw new g("JWTs MUST NOT use unencoded payload");const n={payload:q(s.protectedHeader,s.payload,r),protectedHeader:s.protectedHeader};return"function"==typeof t?{...n,key:s.key}:n}class V{constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this._payload=e}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}async sign(e,r){if(!this._protectedHeader&&!this._unprotectedHeader)throw new p("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!R(this._protectedHeader,this._unprotectedHeader))throw new p("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const a={...this._protectedHeader,...this._unprotectedHeader};let c=!0;if(H(p,new Map([["b64",!0]]),r?.crit,this._protectedHeader,a).has("b64")&&(c=this._protectedHeader.b64,"boolean"!=typeof c))throw new p('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:d}=a;if("string"!=typeof d||!d)throw new p('JWS "alg" (Algorithm) Header Parameter missing or invalid');O(d,e,"sign");let l,h=this._payload;c&&(h=s.encode(o(h))),l=this._protectedHeader?s.encode(o(JSON.stringify(this._protectedHeader))):s.encode("");const u=n(l,s.encode("."),h),g=await(async(e,r,s)=>{const i=await D(e,r,"sign");C(e,i);const n=await t.subtle.sign(K(e,i.algorithm),i,s);return new Uint8Array(n)})(d,e,u),f={signature:o(g),payload:""};return c&&(f.payload=i.decode(h)),this._unprotectedHeader&&(f.header=this._unprotectedHeader),this._protectedHeader&&(f.protected=i.decode(l)),f}}class z{constructor(e){this._flattened=new V(e)}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}async sign(e,t){const r=await this._flattened.sign(e,t);if(void 0===r.payload)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${r.protected}.${r.payload}.${r.signature}`}}function B(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}class G{constructor(e={}){if(!P(e))throw new TypeError("JWT Claims Set MUST be an object");this._payload=e}setIssuer(e){return this._payload={...this._payload,iss:e},this}setSubject(e){return this._payload={...this._payload,sub:e},this}setAudience(e){return this._payload={...this._payload,aud:e},this}setJti(e){return this._payload={...this._payload,jti:e},this}setNotBefore(e){return"number"==typeof e?this._payload={...this._payload,nbf:B("setNotBefore",e)}:e instanceof Date?this._payload={...this._payload,nbf:B("setNotBefore",L(e))}:this._payload={...this._payload,nbf:L(new Date)+W(e)},this}setExpirationTime(e){return"number"==typeof e?this._payload={...this._payload,exp:B("setExpirationTime",e)}:e instanceof Date?this._payload={...this._payload,exp:B("setExpirationTime",L(e))}:this._payload={...this._payload,exp:L(new Date)+W(e)},this}setIssuedAt(e){return void 0===e?this._payload={...this._payload,iat:L(new Date)}:e instanceof Date?this._payload={...this._payload,iat:B("setIssuedAt",L(e))}:this._payload={...this._payload,iat:B("setIssuedAt",e)},this}}class X extends G{setProtectedHeader(e){return this._protectedHeader=e,this}async sign(e,t){const r=new z(s.encode(JSON.stringify(this._payload)));if(r.setProtectedHeader(this._protectedHeader),Array.isArray(this._protectedHeader?.crit)&&this._protectedHeader.crit.includes("b64")&&!1===this._protectedHeader.b64)throw new g("JWTs MUST NOT use unencoded payload");return r.sign(e,t)}}function Q(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(Y)}function Y(e){return P(e)}class Z{constructor(e){if(this._cached=new WeakMap,!Q(e))throw new f("JSON Web Key Set malformed");var t;this._jwks=(t=e,"function"==typeof structuredClone?structuredClone(t):JSON.parse(JSON.stringify(t)))}async getKey(e,t){const{alg:r,kid:s}={...e,...t?.header},i=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new u('Unsupported "alg" value for a JSON Web Key Set')}}(r),n=this._jwks.keys.filter((e=>{let t=i===e.kty;if(t&&"string"==typeof s&&(t=s===e.kid),t&&"string"==typeof e.alg&&(t=r===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t&&"EdDSA"===r&&(t="Ed25519"===e.crv||"Ed448"===e.crv),t)switch(r){case"ES256":t="P-256"===e.crv;break;case"ES256K":t="secp256k1"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv}return t})),{0:o,length:a}=n;if(0===a)throw new _;if(1!==a){const e=new y,{_cached:t}=this;throw e[Symbol.asyncIterator]=async function*(){for(const e of n)try{yield await ee(t,e,r)}catch{continue}},e}return ee(this._cached,o,r)}}async function ee(e,t,r){const s=e.get(t)||e.set(t,{}).get(t);if(void 0===s[r]){const e=await async function(e,t){if(!P(e))throw new TypeError("JWK must be an object");switch(t||(t=e.alg),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw new TypeError('missing "k" (Key Value) Parameter value');return a(e.k);case"RSA":if(void 0!==e.oth)throw new u('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return x({...e,alg:t});default:throw new u('Unsupported "kty" (Key Type) Parameter value')}}({...t,ext:!0},r);if(e instanceof Uint8Array||"public"!==e.type)throw new f("JSON Web Key Set members must be public keys");s[r]=e}return s[r]}let te;if("undefined"==typeof navigator||!navigator.userAgent?.startsWith?.("Mozilla/5.0 ")){te=`${"jose"}/${"v5.1.3"}`}class re extends Z{constructor(e,t){if(super({keys:[]}),this._jwks=void 0,!(e instanceof URL))throw new TypeError("url must be an instance of URL");this._url=new URL(e.href),this._options={agent:t?.agent,headers:t?.headers},this._timeoutDuration="number"==typeof t?.timeoutDuration?t?.timeoutDuration:5e3,this._cooldownDuration="number"==typeof t?.cooldownDuration?t?.cooldownDuration:3e4,this._cacheMaxAge="number"==typeof t?.cacheMaxAge?t?.cacheMaxAge:6e5}coolingDown(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cooldownDuration}fresh(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cacheMaxAge}async getKey(e,t){this._jwks&&this.fresh()||await this.reload();try{return await super.getKey(e,t)}catch(r){if(r instanceof _&&!1===this.coolingDown())return await this.reload(),super.getKey(e,t);throw r}}async reload(){this._pendingFetch&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(this._pendingFetch=void 0);const e=new Headers(this._options.headers);te&&!e.has("User-Agent")&&(e.set("User-Agent",te),this._options.headers=Object.fromEntries(e.entries())),this._pendingFetch||(this._pendingFetch=(async(e,t,r)=>{let s,i,n=!1;"function"==typeof AbortController&&(s=new AbortController,i=setTimeout((()=>{n=!0,s.abort()}),t));const o=await fetch(e.href,{signal:s?s.signal:void 0,redirect:"manual",headers:r.headers}).catch((e=>{if(n)throw new w;throw e}));if(void 0!==i&&clearTimeout(i),200!==o.status)throw new c("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch{throw new c("Failed to parse the JSON Web Key Set HTTP response as JSON")}})(this._url,this._timeoutDuration,this._options).then((e=>{if(!Q(e))throw new f("JSON Web Key Set malformed");this._jwks={keys:e.keys},this._jwksTimestamp=Date.now(),this._pendingFetch=void 0})).catch((e=>{throw this._pendingFetch=void 0,e}))),await this._pendingFetch}}function se(e){const t=e?.modulusLength??2048;if("number"!=typeof t||t<2048)throw new u("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return t}async function ie(e,r){return async function(e,r){let s,i;switch(e){case"PS256":case"PS384":case"PS512":s={name:"RSA-PSS",hash:`SHA-${e.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:se(r)},i=["sign","verify"];break;case"RS256":case"RS384":case"RS512":s={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:se(r)},i=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s={name:"RSA-OAEP",hash:`SHA-${parseInt(e.slice(-3),10)||1}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:se(r)},i=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":s={name:"ECDSA",namedCurve:"P-256"},i=["sign","verify"];break;case"ES384":s={name:"ECDSA",namedCurve:"P-384"},i=["sign","verify"];break;case"ES512":s={name:"ECDSA",namedCurve:"P-521"},i=["sign","verify"];break;case"EdDSA":i=["sign","verify"];const t=r?.crv??"Ed25519";switch(t){case"Ed25519":case"Ed448":s={name:t};break;default:throw new u("Invalid or unsupported crv option provided")}break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{i=["deriveKey","deriveBits"];const e=r?.crv??"P-256";switch(e){case"P-256":case"P-384":case"P-521":s={name:"ECDH",namedCurve:e};break;case"X25519":case"X448":s={name:e};break;default:throw new u("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448")}break}default:throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return t.subtle.generateKey(s,r?.extractable,i)}(e,r)}const ne=[];for(let e=0;e<256;++e)ne.push((e+256).toString(16).slice(1));let oe;const ae=new Uint8Array(16);var ce={randomUUID:"undefined"!=typeof crypto&&crypto.randomUUID&&crypto.randomUUID.bind(crypto)};function de(e,t,r){if(ce.randomUUID&&!t&&!e)return ce.randomUUID();const s=(e=e||{}).random??e.rng?.()??function(){if(!oe){if("undefined"==typeof crypto||!crypto.getRandomValues)throw new Error("crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported");oe=crypto.getRandomValues.bind(crypto)}return oe(ae)}();if(s.length<16)throw new Error("Random bytes length must be >= 16");return s[6]=15&s[6]|64,s[8]=63&s[8]|128,function(e,t=0){return(ne[e[t+0]]+ne[e[t+1]]+ne[e[t+2]]+ne[e[t+3]]+"-"+ne[e[t+4]]+ne[e[t+5]]+"-"+ne[e[t+6]]+ne[e[t+7]]+"-"+ne[e[t+8]]+ne[e[t+9]]+"-"+ne[e[t+10]]+ne[e[t+11]]+ne[e[t+12]]+ne[e[t+13]]+ne[e[t+14]]+ne[e[t+15]]).toLowerCase()}(s)}const le="solidClientAuthn:",he=["ES256","RS256"],ue={ERROR:"error",LOGIN:"login",LOGOUT:"logout",NEW_REFRESH_TOKEN:"newRefreshToken",NEW_TOKENS:"newTokens",AUTHORIZATION_REQUEST:"authorizationRequest",SESSION_EXPIRED:"sessionExpired",SESSION_EXTENDED:"sessionExtended",SESSION_RESTORED:"sessionRestore",TIMEOUT_SET:"timeoutSet"},pe=["openid","offline_access","webid"];class ge{handleables;constructor(e){this.handleables=e,this.handleables=e}async getProperHandler(e){const t=await Promise.all(this.handleables.map((t=>t.canHandle(...e))));for(let e=0;e<t.length;e+=1)if(t[e])return this.handleables[e];return null}async canHandle(...e){return null!==await this.getProperHandler(e)}async handle(...e){const t=await this.getProperHandler(e);if(t)return t.handle(...e);throw new Error(`[${this.constructor.name}] cannot find a suitable handler for: ${e.map((e=>{try{return JSON.stringify(e)}catch(t){return e.toString()}})).join(", ")}`)}}async function fe(e,t,r,s){let i,n;try{const{payload:n}=await F(e,function(e,t){const r=new re(e,t);return async function(e,t){return r.getKey(e,t)}}(new URL(t)),{issuer:r,audience:s});i=n}catch(e){throw new Error(`Token verification failed: ${e.stack}`)}if("string"==typeof i.azp&&(n=i.azp),"string"==typeof i.webid)return{webId:i.webid,clientId:n};if("string"!=typeof i.sub)throw new Error(`The token ${JSON.stringify(i)} is invalid: it has no 'webid' claim and no 'sub' claim.`);try{return new URL(i.sub),{webId:i.sub,clientId:n}}catch(e){throw new Error(`The token has no 'webid' claim, and its 'sub' claim of [${i.sub}] is invalid as a URL - error [${e}].`)}}function _e(e){try{const t=new URL(e),r=!t.searchParams.has("code")&&!t.searchParams.has("state"),s=""===t.hash;return r&&s}catch(e){return!1}}function ye(e){const t=new URL(e);return t.searchParams.delete("state"),t.searchParams.delete("code"),t.searchParams.delete("error"),t.searchParams.delete("error_description"),t.searchParams.delete("iss"),t}class we{storageUtility;redirector;constructor(e,t){this.storageUtility=e,this.redirector=t,this.storageUtility=e,this.redirector=t}parametersGuard=e=>void 0!==e.issuerConfiguration.grantTypesSupported&&e.issuerConfiguration.grantTypesSupported.indexOf("authorization_code")>-1&&void 0!==e.redirectUrl;async canHandle(e){return this.parametersGuard(e)}async setupRedirectHandler({oidcLoginOptions:e,state:t,codeVerifier:r,targetUrl:s}){if(!this.parametersGuard(e))throw new Error("The authorization code grant requires a redirectUrl.");var i,n;await Promise.all([this.storageUtility.setForUser(t,{sessionId:e.sessionId}),this.storageUtility.setForUser(e.sessionId,{codeVerifier:r,issuer:e.issuer.toString(),redirectUrl:e.redirectUrl,dpop:Boolean(e.dpop).toString(),keepAlive:(i=e.keepAlive,n=!0,"boolean"==typeof i?Boolean(i):Boolean(n)).toString()})]),this.redirector.redirect(s,{handleRedirect:e.handleRedirect})}}class me{sessionInfoManager;constructor(e){this.sessionInfoManager=e,this.sessionInfoManager=e}async canHandle(){return!0}async handle(e){await this.sessionInfoManager.clear(e)}}class Se{redirector;constructor(e){this.redirector=e,this.redirector=e}async canHandle(e,t){return"idp"===t?.logoutType}async handle(e,t){if("idp"!==t?.logoutType)throw new Error("Attempting to call idp logout handler to perform app logout");if(void 0===t.toLogoutUrl)throw new Error("Cannot perform IDP logout. Did you log in using the OIDC authentication flow?");this.redirector.redirect(t.toLogoutUrl(t),{handleRedirect:t.handleRedirect})}}class ve{handlers;constructor(e,t){this.handlers=[new me(e),new Se(t)]}async canHandle(){return!0}async handle(e,t){for(const r of this.handlers)await r.canHandle(e,t)&&await r.handle(e,t)}}function Ee(){return{isLoggedIn:!1,sessionId:de(),fetch:(...e)=>fetch(...e)}}async function be(e,t){await Promise.all([t.deleteAllUserData(e,{secure:!1}),t.deleteAllUserData(e,{secure:!0})])}class ke{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}update(e,t){throw new Error("Not Implemented")}set(e,t){throw new Error("Not Implemented")}get(e){throw new Error("Not implemented")}async getAll(){throw new Error("Not implemented")}async clear(e){return be(e,this.storageUtility)}async register(e){throw new Error("Not implemented")}async getRegisteredSessionIdAll(){throw new Error("Not implemented")}async clearAll(){throw new Error("Not implemented")}async setOidcContext(e,t){throw new Error("Not implemented")}}function Ie({endSessionEndpoint:e,idTokenHint:t}){if(void 0!==e)return function({state:r,postLogoutUrl:s}){return function({endSessionEndpoint:e,idTokenHint:t,postLogoutRedirectUri:r,state:s}){const i=new URL(e);return void 0!==t&&i.searchParams.append("id_token_hint",t),void 0!==r&&(i.searchParams.append("post_logout_redirect_uri",r),void 0!==s&&i.searchParams.append("state",s)),i.toString()}({endSessionEndpoint:e,idTokenHint:t,state:r,postLogoutRedirectUri:s})}}function Te(e){try{return new URL(e),!0}catch{return!1}}async function Ae(e,t,r,s){let i;if(function(e,t){return t.scopesSupported.includes("webid")&&void 0!==e.clientId&&Te(e.clientId)}(e,t))i={clientId:e.clientId,clientName:e.clientName,clientType:"solid-oidc"};else{if(!function(e){return void 0!==e.clientId&&!Te(e.clientId)}(e))return s.getClient({sessionId:e.sessionId,clientName:e.clientName,redirectUrl:e.redirectUrl},t);i={clientId:e.clientId,clientSecret:e.clientSecret,clientName:e.clientName,clientType:"static"}}const n={clientId:i.clientId,clientType:i.clientType};return"static"===i.clientType&&(n.clientSecret=i.clientSecret),i.clientName&&(n.clientName=i.clientName),await r.setForUser(e.sessionId,n),i}const Ue=(e,t)=>fetch(e,t);let Re=class{loginHandler;redirectHandler;logoutHandler;sessionInfoManager;issuerConfigFetcher;boundLogout;constructor(e,t,r,s,i){this.loginHandler=e,this.redirectHandler=t,this.logoutHandler=r,this.sessionInfoManager=s,this.issuerConfigFetcher=i,this.loginHandler=e,this.redirectHandler=t,this.logoutHandler=r,this.sessionInfoManager=s,this.issuerConfigFetcher=i}fetch=Ue;logout=async(e,t)=>{await this.logoutHandler.handle(e,"idp"===t?.logoutType?{...t,toLogoutUrl:this.boundLogout}:t),this.fetch=Ue,delete this.boundLogout};getSessionInfo=async e=>this.sessionInfoManager.get(e);getAllSessionInfo=async()=>this.sessionInfoManager.getAll()};async function Pe(e,t,r){try{const[s,i,n,o,a]=await Promise.all([t.getForUser(e,"issuer",{errorIfNull:!0}),t.getForUser(e,"codeVerifier"),t.getForUser(e,"redirectUrl"),t.getForUser(e,"dpop",{errorIfNull:!0}),t.getForUser(e,"keepAlive")]);await t.deleteForUser(e,"codeVerifier");return{codeVerifier:i,redirectUrl:n,issuerConfig:await r.fetchConfig(s),dpop:"true"===o,keepAlive:"string"!=typeof a||"true"===a}}catch(t){throw new Error(`Failed to retrieve OIDC context from storage associated with session [${e}]: ${t}`)}}class Ce{secureStorage;insecureStorage;constructor(e,t){this.secureStorage=e,this.insecureStorage=t,this.secureStorage=e,this.insecureStorage=t}getKey(e){return`solidClientAuthenticationUser:${e}`}async getUserData(e,t){const r=await(t?this.secureStorage:this.insecureStorage).get(this.getKey(e));if(void 0===r)return{};try{return JSON.parse(r)}catch(s){throw new Error(`Data for user [${e}] in [${t?"secure":"unsecure"}] storage is corrupted - expected valid JSON, but got: ${r}`)}}async setUserData(e,t,r){await(r?this.secureStorage:this.insecureStorage).set(this.getKey(e),JSON.stringify(t))}async get(e,t){const r=await(t?.secure?this.secureStorage:this.insecureStorage).get(e);if(void 0===r&&t?.errorIfNull)throw new Error(`[${e}] is not stored`);return r}async set(e,t,r){return(r?.secure?this.secureStorage:this.insecureStorage).set(e,t)}async delete(e,t){return(t?.secure?this.secureStorage:this.insecureStorage).delete(e)}async getForUser(e,t,r){const s=await this.getUserData(e,r?.secure);let i;if(s&&s[t]||(i=void 0),i=s[t],void 0===i&&r?.errorIfNull)throw new Error(`Field [${t}] for user [${e}] is not stored`);return i||void 0}async setForUser(e,t,r){let s;try{s=await this.getUserData(e,r?.secure)}catch{s={}}await this.setUserData(e,{...s,...t},r?.secure)}async deleteForUser(e,t,r){const s=await this.getUserData(e,r?.secure);delete s[t],await this.setUserData(e,s,r?.secure)}async deleteAllUserData(e,t){await(t?.secure?this.secureStorage:this.insecureStorage).delete(this.getKey(e))}}class xe{map={};async get(e){return this.map[e]||void 0}async set(e,t){this.map[e]=t}async delete(e){delete this.map[e]}}class Oe extends Error{constructor(e){super(e)}}class He extends Error{constructor(e){super(`[${e}] is not implemented`)}}class $e extends Error{missingFields;constructor(e){super(`Invalid response from OIDC provider: missing fields ${e}`),this.missingFields=e}}class Ke extends Error{error;errorDescription;constructor(e,t,r){super(e),this.error=t,this.errorDescription=r}}function De(e){const t=new URL(e);return new URL(t.pathname,t.origin).toString()}async function Ne(e,t,r){return new X({htu:De(e),htm:t.toUpperCase(),jti:de()}).setProtectedHeader({alg:he[0],jwk:r.publicKey,typ:"dpop+jwt"}).setIssuedAt().sign(r.privateKey,{})}async function Le(e,t,r,s){if(void 0!==r)return async function(e,t,r,s){const i=new Headers(s?.headers);return i.set("Authorization",`DPoP ${t}`),i.set("DPoP",await Ne(e,s?.method??"get",r)),{...s,headers:i}}(e,t,r,s);const i=new Headers(s?.headers);return i.set("Authorization",`Bearer ${t}`),{...s,headers:i}}async function je(e,t,r,s,i=fetch){return i(t,await Le(t.toString(),e,s,r))}const Je=e=>void 0!==e?e-5>0?e-5:e:600;function We(e,t){let r,s=e;const i=t?.refreshOptions,n=t?.eventEmitter;if(void 0!==t&&void 0!==i){const e=async()=>{try{const{accessToken:o,refreshToken:a,expiresIn:c}=await async function(e,t,r){const s=await e.tokenRefresher.refresh(e.sessionId,e.refreshToken,t);return r?.emit(ue.SESSION_EXTENDED,s.expiresIn??600),{accessToken:s.accessToken,refreshToken:s.refreshToken,expiresIn:s.expiresIn}}(i,t.dpopKey,n);s=o,void 0!==a&&(i.refreshToken=a),clearTimeout(r),r=setTimeout(e,1e3*Je(c)),t.eventEmitter?.emit(ue.TIMEOUT_SET,r)}catch(e){e instanceof Ke&&(n?.emit(ue.ERROR,e.error,e.errorDescription),n?.emit(ue.SESSION_EXPIRED)),e instanceof $e&&e.missingFields.includes("access_token")&&n?.emit(ue.SESSION_EXPIRED)}};r=setTimeout(e,1e3*Je(t.expiresIn)),n?.emit(ue.TIMEOUT_SET,r)}else if(void 0!==n){const e=setTimeout((()=>{n.emit(ue.SESSION_EXPIRED)}),1e3*Je(t?.expiresIn));n.emit(ue.TIMEOUT_SET,e)}return async(e,r)=>{let i=await je(s,e,r,t?.dpopKey,t?.fetch);const n=!i.ok&&(o=i.status,![401,403].includes(o));var o;if(i.ok||n)return i;return i.url!==e&&void 0!==t?.dpopKey&&(i=await je(s,i.url,r,t.dpopKey,t.fetch)),i}}function Me(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var qe,Fe={exports:{}};var Ve=function(){if(qe)return Fe.exports;qe=1;var e,t="object"==typeof Reflect?Reflect:null,r=t&&"function"==typeof t.apply?t.apply:function(e,t,r){return Function.prototype.apply.call(e,t,r)};e=t&&"function"==typeof t.ownKeys?t.ownKeys:Object.getOwnPropertySymbols?function(e){return Object.getOwnPropertyNames(e).concat(Object.getOwnPropertySymbols(e))}:function(e){return Object.getOwnPropertyNames(e)};var s=Number.isNaN||function(e){return e!=e};function i(){i.init.call(this)}Fe.exports=i,Fe.exports.once=function(e,t){return new Promise((function(r,s){function i(r){e.removeListener(t,n),s(r)}function n(){"function"==typeof e.removeListener&&e.removeListener("error",i),r([].slice.call(arguments))}g(e,t,n,{once:!0}),"error"!==t&&function(e,t,r){"function"==typeof e.on&&g(e,"error",t,r)}(e,i,{once:!0})}))},i.EventEmitter=i,i.prototype._events=void 0,i.prototype._eventsCount=0,i.prototype._maxListeners=void 0;var n=10;function o(e){if("function"!=typeof e)throw new TypeError('The "listener" argument must be of type Function. Received type '+typeof e)}function a(e){return void 0===e._maxListeners?i.defaultMaxListeners:e._maxListeners}function c(e,t,r,s){var i,n,c,d;if(o(r),void 0===(n=e._events)?(n=e._events=Object.create(null),e._eventsCount=0):(void 0!==n.newListener&&(e.emit("newListener",t,r.listener?r.listener:r),n=e._events),c=n[t]),void 0===c)c=n[t]=r,++e._eventsCount;else if("function"==typeof c?c=n[t]=s?[r,c]:[c,r]:s?c.unshift(r):c.push(r),(i=a(e))>0&&c.length>i&&!c.warned){c.warned=!0;var l=new Error("Possible EventEmitter memory leak detected. "+c.length+" "+String(t)+" listeners added. Use emitter.setMaxListeners() to increase limit");l.name="MaxListenersExceededWarning",l.emitter=e,l.type=t,l.count=c.length,d=l,console&&console.warn&&console.warn(d)}return e}function d(){if(!this.fired)return this.target.removeListener(this.type,this.wrapFn),this.fired=!0,0===arguments.length?this.listener.call(this.target):this.listener.apply(this.target,arguments)}function l(e,t,r){var s={fired:!1,wrapFn:void 0,target:e,type:t,listener:r},i=d.bind(s);return i.listener=r,s.wrapFn=i,i}function h(e,t,r){var s=e._events;if(void 0===s)return[];var i=s[t];return void 0===i?[]:"function"==typeof i?r?[i.listener||i]:[i]:r?function(e){for(var t=new Array(e.length),r=0;r<t.length;++r)t[r]=e[r].listener||e[r];return t}(i):p(i,i.length)}function u(e){var t=this._events;if(void 0!==t){var r=t[e];if("function"==typeof r)return 1;if(void 0!==r)return r.length}return 0}function p(e,t){for(var r=new Array(t),s=0;s<t;++s)r[s]=e[s];return r}function g(e,t,r,s){if("function"==typeof e.on)s.once?e.once(t,r):e.on(t,r);else{if("function"!=typeof e.addEventListener)throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type '+typeof e);e.addEventListener(t,(function i(n){s.once&&e.removeEventListener(t,i),r(n)}))}}return Object.defineProperty(i,"defaultMaxListeners",{enumerable:!0,get:function(){return n},set:function(e){if("number"!=typeof e||e<0||s(e))throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received '+e+".");n=e}}),i.init=function(){void 0!==this._events&&this._events!==Object.getPrototypeOf(this)._events||(this._events=Object.create(null),this._eventsCount=0),this._maxListeners=this._maxListeners||void 0},i.prototype.setMaxListeners=function(e){if("number"!=typeof e||e<0||s(e))throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received '+e+".");return this._maxListeners=e,this},i.prototype.getMaxListeners=function(){return a(this)},i.prototype.emit=function(e){for(var t=[],s=1;s<arguments.length;s++)t.push(arguments[s]);var i="error"===e,n=this._events;if(void 0!==n)i=i&&void 0===n.error;else if(!i)return!1;if(i){var o;if(t.length>0&&(o=t[0]),o instanceof Error)throw o;var a=new Error("Unhandled error."+(o?" ("+o.message+")":""));throw a.context=o,a}var c=n[e];if(void 0===c)return!1;if("function"==typeof c)r(c,this,t);else{var d=c.length,l=p(c,d);for(s=0;s<d;++s)r(l[s],this,t)}return!0},i.prototype.addListener=function(e,t){return c(this,e,t,!1)},i.prototype.on=i.prototype.addListener,i.prototype.prependListener=function(e,t){return c(this,e,t,!0)},i.prototype.once=function(e,t){return o(t),this.on(e,l(this,e,t)),this},i.prototype.prependOnceListener=function(e,t){return o(t),this.prependListener(e,l(this,e,t)),this},i.prototype.removeListener=function(e,t){var r,s,i,n,a;if(o(t),void 0===(s=this._events))return this;if(void 0===(r=s[e]))return this;if(r===t||r.listener===t)0==--this._eventsCount?this._events=Object.create(null):(delete s[e],s.removeListener&&this.emit("removeListener",e,r.listener||t));else if("function"!=typeof r){for(i=-1,n=r.length-1;n>=0;n--)if(r[n]===t||r[n].listener===t){a=r[n].listener,i=n;break}if(i<0)return this;0===i?r.shift():function(e,t){for(;t+1<e.length;t++)e[t]=e[t+1];e.pop()}(r,i),1===r.length&&(s[e]=r[0]),void 0!==s.removeListener&&this.emit("removeListener",e,a||t)}return this},i.prototype.off=i.prototype.removeListener,i.prototype.removeAllListeners=function(e){var t,r,s;if(void 0===(r=this._events))return this;if(void 0===r.removeListener)return 0===arguments.length?(this._events=Object.create(null),this._eventsCount=0):void 0!==r[e]&&(0==--this._eventsCount?this._events=Object.create(null):delete r[e]),this;if(0===arguments.length){var i,n=Object.keys(r);for(s=0;s<n.length;++s)"removeListener"!==(i=n[s])&&this.removeAllListeners(i);return this.removeAllListeners("removeListener"),this._events=Object.create(null),this._eventsCount=0,this}if("function"==typeof(t=r[e]))this.removeListener(e,t);else if(void 0!==t)for(s=t.length-1;s>=0;s--)this.removeListener(e,t[s]);return this},i.prototype.listeners=function(e){return h(this,e,!0)},i.prototype.rawListeners=function(e){return h(this,e,!1)},i.listenerCount=function(e,t){return"function"==typeof e.listenerCount?e.listenerCount(t):u.call(e,t)},i.prototype.listenerCount=u,i.prototype.eventNames=function(){return this._eventsCount>0?e(this._events):[]},Fe.exports}(),ze=Me(Ve);class Be extends Ce{constructor(e,t){super(e,t)}}class Ge extends Error{}function Xe(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw new Error("base64 string is not of the correct length")}try{return function(e){return decodeURIComponent(atob(e).replace(/(.)/g,((e,t)=>{let r=t.charCodeAt(0).toString(16).toUpperCase();return r.length<2&&(r="0"+r),"%"+r})))}(t)}catch(e){return atob(t)}}Ge.prototype.name="InvalidTokenError";var Qe,Ye,Ze,et={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},tt=(e=>(e[e.NONE=0]="NONE",e[e.ERROR=1]="ERROR",e[e.WARN=2]="WARN",e[e.INFO=3]="INFO",e[e.DEBUG=4]="DEBUG",e))(tt||{});(Ze=tt||(tt={})).reset=function(){Qe=3,Ye=et},Ze.setLevel=function(e){if(!(0<=e&&e<=4))throw new Error("Invalid log level");Qe=e},Ze.setLogger=function(e){Ye=e};var rt=class e{constructor(e){this._name=e}debug(...t){Qe>=4&&Ye.debug(e._format(this._name,this._method),...t)}info(...t){Qe>=3&&Ye.info(e._format(this._name,this._method),...t)}warn(...t){Qe>=2&&Ye.warn(e._format(this._name,this._method),...t)}error(...t){Qe>=1&&Ye.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){const t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,r){const s=new e(`${t}.${r}`);return s.debug("begin"),s}static _format(e,t){const r=`[${e}]`;return t?`${r} ${t}:`:r}static debug(t,...r){Qe>=4&&Ye.debug(e._format(t),...r)}static info(t,...r){Qe>=3&&Ye.info(e._format(t),...r)}static warn(t,...r){Qe>=2&&Ye.warn(e._format(t),...r)}static error(t,...r){Qe>=1&&Ye.error(e._format(t),...r)}};tt.reset();var st=class{static decode(e){try{return function(e,t){if("string"!=typeof e)throw new Ge("Invalid token specified: must be a string");t||(t={});const r=!0===t.header?0:1,s=e.split(".")[r];if("string"!=typeof s)throw new Ge(`Invalid token specified: missing part #${r+1}`);let i;try{i=Xe(s)}catch(e){throw new Ge(`Invalid token specified: invalid base64 for part #${r+1} (${e.message})`)}try{return JSON.parse(i)}catch(e){throw new Ge(`Invalid token specified: invalid json for part #${r+1} (${e.message})`)}}(e)}catch(e){throw rt.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,r){const s=`${ot.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}.${ot.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}`,i=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},r,(new TextEncoder).encode(s));return`${s}.${ot.encodeBase64Url(new Uint8Array(i))}`}static async generateSignedJwtWithHmac(e,t,r){const s=`${ot.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}.${ot.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}`,i=await window.crypto.subtle.sign("HMAC",r,(new TextEncoder).encode(s));return`${s}.${ot.encodeBase64Url(new Uint8Array(i))}`}},it=e=>btoa([...new Uint8Array(e)].map((e=>String.fromCharCode(e))).join("")),nt=class e{static _randomWord(){const e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,(t=>(+t^e._randomWord()&15>>+t/4).toString(16))).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{const t=(new TextEncoder).encode(e),r=await crypto.subtle.digest("SHA-256",t);return it(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw rt.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){const r=(new TextEncoder).encode([e,t].join(":"));return it(r)}static async hash(e,t){const r=(new TextEncoder).encode(t),s=await crypto.subtle.digest(e,r);return new Uint8Array(s)}static async customCalculateJwkThumbprint(t){let r;switch(t.kty){case"RSA":r={e:t.e,kty:t.kty,n:t.n};break;case"EC":r={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":r={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":r={crv:t.k,kty:t.kty};break;default:throw new Error("Unknown jwk type")}const s=await e.hash("SHA-256",JSON.stringify(r));return e.encodeBase64Url(s)}static async generateDPoPProof({url:t,accessToken:r,httpMethod:s,keyPair:i,nonce:n}){let o,a;const c={jti:window.crypto.randomUUID(),htm:null!=s?s:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};r&&(o=await e.hash("SHA-256",r),a=e.encodeBase64Url(o),c.ath=a),n&&(c.nonce=n);try{const e=await crypto.subtle.exportKey("jwk",i.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await st.generateSignedJwt(t,c,i.privateKey)}catch(e){throw e instanceof TypeError?new Error(`Error exporting dpop public key: ${e.message}`):e}}static async generateDPoPJkt(t){try{const r=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(r)}catch(e){throw e instanceof TypeError?new Error(`Could not retrieve dpop keys from storage: ${e.message}`):e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,r,s,i="HS256"){const n=Math.floor(Date.now()/1e3),o={alg:i,typ:"JWT"},a={iss:t,sub:t,aud:s,jti:e.generateUUIDv4(),exp:n+300,iat:n},c={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[i];if(!c)throw new Error(`Unsupported algorithm: ${i}. Supported algorithms are: HS256, HS384, HS512`);const d=new TextEncoder,l=await crypto.subtle.importKey("raw",d.encode(r),{name:"HMAC",hash:c},!1,["sign"]);return await st.generateSignedJwtWithHmac(o,a,l)}};nt.encodeBase64Url=e=>it(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var ot=nt,at=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new rt(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){const t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}async raise(...e){this._logger.debug("raise:",...e);for(const t of this._callbacks)await t(...e)}},ct=class e extends at{constructor(){super(...arguments),this._logger=new rt(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{const t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){const r=this._logger.create("init");t=Math.max(Math.floor(t),1);const s=e.getEpochTime()+t;if(this.expiration===s&&this._timerHandle)return void r.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),r.debug("using duration",t),this._expiration=s;const i=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*i)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},dt=class{static readParams(e,t="query"){if(!e)throw new TypeError("Invalid URL");const r=new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"];return new URLSearchParams(r.slice(1))}},lt=";",ht=class extends Error{constructor(e,t){var r,s,i;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw rt.error("ErrorResponse","No error passed"),new Error("No error passed");this.error=e.error,this.error_description=null!=(r=e.error_description)?r:null,this.error_uri=null!=(s=e.error_uri)?s:null,this.state=e.userState,this.session_state=null!=(i=e.session_state)?i:null,this.url_state=e.url_state}},ut=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},pt=class{constructor(){this._logger=new rt("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}},gt=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},ft=class{constructor(e=[],t=null,r={}){this._jwtHandler=t,this._extraHeaders=r,this._logger=new rt("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){const{timeoutInSeconds:r,...s}=t;if(!r)return await fetch(e,s);const i=new AbortController,n=setTimeout((()=>i.abort()),1e3*r);try{return await fetch(e,{...t,signal:i.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new ut("Network timed out");throw e}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:r,timeoutInSeconds:s}={}){const i=this._logger.create("getJson"),n={Accept:this._contentTypes.join(", ")};let o;t&&(i.debug("token passed, setting Authorization header"),n.Authorization="Bearer "+t),this._appendExtraHeaders(n);try{i.debug("url:",e),o=await this.fetchWithTimeout(e,{method:"GET",headers:n,timeoutInSeconds:s,credentials:r})}catch(e){throw i.error("Network Error"),e}i.debug("HTTP response received, status",o.status);const a=o.headers.get("Content-Type");if(a&&!this._contentTypes.find((e=>a.startsWith(e)))&&i.throw(new Error(`Invalid response Content-Type: ${null!=a?a:"undefined"}, from URL: ${e}`)),o.ok&&this._jwtHandler&&(null==a?void 0:a.startsWith("application/jwt")))return await this._jwtHandler(await o.text());let c;try{c=await o.json()}catch(e){if(i.error("Error parsing JSON response",e),o.ok)throw e;throw new Error(`${o.statusText} (${o.status})`)}if(!o.ok){if(i.error("Error from server:",c),c.error)throw new ht(c);throw new Error(`${o.statusText} (${o.status}): ${JSON.stringify(c)}`)}return c}async postForm(e,{body:t,basicAuth:r,timeoutInSeconds:s,initCredentials:i,extraHeaders:n}){const o=this._logger.create("postForm"),a={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...n};let c;void 0!==r&&(a.Authorization="Basic "+r),this._appendExtraHeaders(a);try{o.debug("url:",e),c=await this.fetchWithTimeout(e,{method:"POST",headers:a,body:t,timeoutInSeconds:s,credentials:i})}catch(e){throw o.error("Network error"),e}o.debug("HTTP response received, status",c.status);const d=c.headers.get("Content-Type");if(d&&!this._contentTypes.find((e=>d.startsWith(e))))throw new Error(`Invalid response Content-Type: ${null!=d?d:"undefined"}, from URL: ${e}`);const l=await c.text();let h={};if(l)try{h=JSON.parse(l)}catch(e){if(o.error("Error parsing JSON response",e),c.ok)throw e;throw new Error(`${c.statusText} (${c.status})`)}if(!c.ok){if(o.error("Error from server:",h),c.headers.has("dpop-nonce")){const e=c.headers.get("dpop-nonce");throw new gt(e,`${JSON.stringify(h)}`)}if(h.error)throw new ht(h,t);throw new Error(`${c.statusText} (${c.status}): ${JSON.stringify(h)}`)}return h}_appendExtraHeaders(e){const t=this._logger.create("appendExtraHeaders"),r=Object.keys(this._extraHeaders),s=["accept","content-type"],i=["authorization"];0!==r.length&&r.forEach((r=>{if(s.includes(r.toLocaleLowerCase()))return void t.warn("Protected header could not be set",r,s);if(i.includes(r.toLocaleLowerCase())&&Object.keys(e).includes(r))return void t.warn("Header could not be overridden",r,i);const n="function"==typeof this._extraHeaders[r]?this._extraHeaders[r]():this._extraHeaders[r];n&&""!==n&&(e[r]=n)}))}},_t=class{constructor(e){this._settings=e,this._logger=new rt("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new ft(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){const e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(new Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);const t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){const r=this._logger.create(`_getMetadataProperty('${e}')`),s=await this.getMetadata();if(r.debug("resolved"),void 0===s[e]){if(!0===t)return void r.warn("Metadata does not contain optional property");r.throw(new Error("Metadata does not contain property "+e))}return s[e]}async getSigningKeys(){const e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;const t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);const r=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",r),!Array.isArray(r.keys))throw e.throw(new Error("Missing keys on keyset")),null;return this._signingKeys=r.keys,this._signingKeys}},yt=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new rt("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){this._logger.create(`get('${e}')`),e=this._prefix+e;return await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;const t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");const e=await this._store.length,t=[];for(let r=0;r<e;r++){const e=await this._store.key(r);e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},wt=class{constructor({authority:e,metadataUrl:t,metadata:r,signingKeys:s,metadataSeed:i,client_id:n,client_secret:o,response_type:a="code",scope:c="openid",redirect_uri:d,post_logout_redirect_uri:l,client_authentication:h="client_secret_post",token_endpoint_auth_signing_alg:u="HS256",prompt:p,display:g,max_age:f,ui_locales:_,acr_values:y,resource:w,response_mode:m,filterProtocolClaims:S=!0,loadUserInfo:v=!1,requestTimeoutInSeconds:E,staleStateAgeInSeconds:b=900,mergeClaimsStrategy:k={array:"replace"},disablePKCE:I=!1,stateStore:T,revokeTokenAdditionalContentTypes:A,fetchRequestCredentials:U,refreshTokenAllowedScope:R,extraQueryParams:P={},extraTokenParams:C={},extraHeaders:x={},dpop:O,omitScopeWhenRequesting:H=!1}){var $;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=r,this.metadataSeed=i,this.signingKeys=s,this.client_id=n,this.client_secret=o,this.response_type=a,this.scope=c,this.redirect_uri=d,this.post_logout_redirect_uri=l,this.client_authentication=h,this.token_endpoint_auth_signing_alg=u,this.prompt=p,this.display=g,this.max_age=f,this.ui_locales=_,this.acr_values=y,this.resource=w,this.response_mode=m,this.filterProtocolClaims=null==S||S,this.loadUserInfo=!!v,this.staleStateAgeInSeconds=b,this.mergeClaimsStrategy=k,this.omitScopeWhenRequesting=H,this.disablePKCE=!!I,this.revokeTokenAdditionalContentTypes=A,this.fetchRequestCredentials=U||"same-origin",this.requestTimeoutInSeconds=E,T)this.stateStore=T;else{const e="undefined"!=typeof window?window.localStorage:new pt;this.stateStore=new yt({store:e})}if(this.refreshTokenAllowedScope=R,this.extraQueryParams=P,this.extraTokenParams=C,this.extraHeaders=x,this.dpop=O,this.dpop&&!(null==($=this.dpop)?void 0:$.store))throw new Error("A DPoPStore is required when dpop is enabled")}},mt=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new rt("UserInfoService"),this._getClaimsFromJwt=async e=>{const t=this._logger.create("_getClaimsFromJwt");try{const r=st.decode(e);return t.debug("JWT decoding successful"),r}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new ft(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){const t=this._logger.create("getClaims");e||this._logger.throw(new Error("No token passed"));const r=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",r);const s=await this._jsonService.getJson(r,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",s),s}},St=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new rt("TokenClient"),this._jsonService=new ft(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:r=this._settings.client_id,client_secret:s=this._settings.client_secret,extraHeaders:i,...n}){const o=this._logger.create("exchangeCode");r||o.throw(new Error("A client_id is required")),t||o.throw(new Error("A redirect_uri is required")),n.code||o.throw(new Error("A code is required"));const a=new URLSearchParams({grant_type:e,redirect_uri:t});for(const[e,t]of Object.entries(n))null!=t&&a.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw o.throw(new Error("A client_secret is required")),null;let c;const d=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":c=ot.generateBasicAuth(r,s);break;case"client_secret_post":a.append("client_id",r),s&&a.append("client_secret",s);break;case"client_secret_jwt":{const e=await ot.generateClientAssertionJwt(r,s,d,this._settings.token_endpoint_auth_signing_alg);a.append("client_id",r),a.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),a.append("client_assertion",e);break}}o.debug("got token endpoint");const l=await this._jsonService.postForm(d,{body:a,basicAuth:c,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:i});return o.debug("got response"),l}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,scope:s=this._settings.scope,...i}){const n=this._logger.create("exchangeCredentials");t||n.throw(new Error("A client_id is required"));const o=new URLSearchParams({grant_type:e});this._settings.omitScopeWhenRequesting||o.set("scope",s);for(const[e,t]of Object.entries(i))null!=t&&o.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw n.throw(new Error("A client_secret is required")),null;let a;const c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=ot.generateBasicAuth(t,r);break;case"client_secret_post":o.append("client_id",t),r&&o.append("client_secret",r);break;case"client_secret_jwt":{const e=await ot.generateClientAssertionJwt(t,r,c,this._settings.token_endpoint_auth_signing_alg);o.append("client_id",t),o.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),o.append("client_assertion",e);break}}n.debug("got token endpoint");const d=await this._jsonService.postForm(c,{body:o,basicAuth:a,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return n.debug("got response"),d}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,timeoutInSeconds:s,extraHeaders:i,...n}){const o=this._logger.create("exchangeRefreshToken");t||o.throw(new Error("A client_id is required")),n.refresh_token||o.throw(new Error("A refresh_token is required"));const a=new URLSearchParams({grant_type:e});for(const[e,t]of Object.entries(n))Array.isArray(t)?t.forEach((t=>a.append(e,t))):null!=t&&a.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw o.throw(new Error("A client_secret is required")),null;let c;const d=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":c=ot.generateBasicAuth(t,r);break;case"client_secret_post":a.append("client_id",t),r&&a.append("client_secret",r);break;case"client_secret_jwt":{const e=await ot.generateClientAssertionJwt(t,r,d,this._settings.token_endpoint_auth_signing_alg);a.append("client_id",t),a.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),a.append("client_assertion",e);break}}o.debug("got token endpoint");const l=await this._jsonService.postForm(d,{body:a,basicAuth:c,timeoutInSeconds:s,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:i});return o.debug("got response"),l}async revoke(e){var t;const r=this._logger.create("revoke");e.token||r.throw(new Error("A token is required"));const s=await this._metadataService.getRevocationEndpoint(!1);r.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);const i=new URLSearchParams;for(const[t,r]of Object.entries(e))null!=r&&i.set(t,r);i.set("client_id",this._settings.client_id),this._settings.client_secret&&i.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(s,{body:i,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),r.debug("got response")}},vt=class{constructor(e,t,r){this._settings=e,this._metadataService=t,this._claimsService=r,this._logger=new rt("ResponseValidator"),this._userInfoService=new mt(this._settings,this._metadataService),this._tokenClient=new St(this._settings,this._metadataService)}async validateSigninResponse(e,t,r){const s=this._logger.create("validateSigninResponse");this._processSigninState(e,t),s.debug("state processed"),await this._processCode(e,t,r),s.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),s.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),s.debug("claims processed")}async validateCredentialsResponse(e,t){const r=this._logger.create("validateCredentialsResponse"),s=e.isOpenId&&!!e.id_token;s&&this._validateIdTokenAttributes(e),r.debug("tokens validated"),await this._processClaims(e,t,s),r.debug("claims processed")}async validateRefreshResponse(e,t){const r=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),r.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);const s=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,s),r.debug("claims processed")}validateSignoutResponse(e,t){const r=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&r.throw(new Error("State does not match")),r.debug("state validated"),e.userState=t.data,e.error)throw r.warn("Response was error",e.error),new ht(e)}_processSigninState(e,t){const r=this._logger.create("_processSigninState");if(t.id!==e.state&&r.throw(new Error("State does not match")),t.client_id||r.throw(new Error("No client_id on state")),t.authority||r.throw(new Error("No authority on state")),this._settings.authority!==t.authority&&r.throw(new Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&r.throw(new Error("client_id mismatch on settings vs. signin state")),r.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw r.warn("Response was error",e.error),new ht(e);t.code_verifier&&!e.code&&r.throw(new Error("Expected code in response"))}async _processClaims(e,t=!1,r=!0){const s=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void s.debug("not loading user info");s.debug("loading user info");const i=await this._userInfoService.getClaims(e.access_token);s.debug("user info claims received from user info endpoint"),r&&i.sub!==e.profile.sub&&s.throw(new Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(i)),s.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,r){const s=this._logger.create("_processCode");if(e.code){s.debug("Validating code");const i=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:r,...t.extraTokenParams});Object.assign(e,i)}else s.debug("No code to process")}_validateIdTokenAttributes(e,t,r){var s;const i=this._logger.create("_validateIdTokenAttributes");i.debug("decoding ID Token JWT");const n=st.decode(null!=(s=e.id_token)?s:"");if(n.sub||i.throw(new Error("ID Token is missing a subject claim")),r&&n.nonce!==r&&i.throw(new Error("nonce in id_token does not match nonce in client storage")),t){const e=st.decode(t);n.sub!==e.sub&&i.throw(new Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==e.auth_time&&i.throw(new Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==e.azp&&i.throw(new Error("azp in id_token does not match original azp")),!n.azp&&e.azp&&i.throw(new Error("azp not in id_token, but present in original id_token"))}e.profile=n}},Et=class e{constructor(e){this.id=e.id||ot.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=ct.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new rt("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return rt.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,r){const s=rt.createStatic("State","clearStaleState"),i=ct.getEpochTime()-r,n=await t.getAllKeys();s.debug("got keys",n);for(let r=0;r<n.length;r++){const o=n[r],a=await t.get(o);let c=!1;if(a)try{const t=await e.fromStorageString(a);s.debug("got item from key:",o,t.created),t.created<=i&&(c=!0)}catch(e){s.error("Error parsing state for key:",o,e),c=!0}else s.debug("no item in storage for key:",o),c=!0;c&&(s.debug("removed item for key:",o),t.remove(o))}}},bt=class e extends Et{constructor(e){super(e),this.code_verifier=e.code_verifier,this.code_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){const r=!0===t.code_verifier?ot.generateCodeVerifier():t.code_verifier||void 0,s=r?await ot.generateCodeChallenge(r):void 0;return new e({...t,code_verifier:r,code_challenge:s})}toStorageString(){return new rt("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){rt.createStatic("SigninState","fromStorageString");const r=JSON.parse(t);return e.create(r)}},kt=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:r,client_id:s,redirect_uri:i,response_type:n,scope:o,state_data:a,response_mode:c,request_type:d,client_secret:l,nonce:h,url_state:u,resource:p,skipUserInfo:g,extraQueryParams:f,extraTokenParams:_,disablePKCE:y,dpopJkt:w,omitScopeWhenRequesting:m,...S}){if(!t)throw this._logger.error("create: No url passed"),new Error("url");if(!s)throw this._logger.error("create: No client_id passed"),new Error("client_id");if(!i)throw this._logger.error("create: No redirect_uri passed"),new Error("redirect_uri");if(!n)throw this._logger.error("create: No response_type passed"),new Error("response_type");if(!o)throw this._logger.error("create: No scope passed"),new Error("scope");if(!r)throw this._logger.error("create: No authority passed"),new Error("authority");const v=await bt.create({data:a,request_type:d,url_state:u,code_verifier:!y,client_id:s,authority:r,redirect_uri:i,response_mode:c,client_secret:l,scope:o,extraTokenParams:_,skipUserInfo:g,nonce:h}),E=new URL(t);E.searchParams.append("client_id",s),E.searchParams.append("redirect_uri",i),E.searchParams.append("response_type",n),m||E.searchParams.append("scope",o),h&&E.searchParams.append("nonce",h),w&&E.searchParams.append("dpop_jkt",w);let b=v.id;if(u&&(b=`${b}${lt}${u}`),E.searchParams.append("state",b),v.code_challenge&&(E.searchParams.append("code_challenge",v.code_challenge),E.searchParams.append("code_challenge_method","S256")),p){(Array.isArray(p)?p:[p]).forEach((e=>E.searchParams.append("resource",e)))}for(const[e,t]of Object.entries({response_mode:c,...S,...f}))null!=t&&E.searchParams.append(e,t.toString());return new e({url:E.href,state:v})}};kt._logger=new rt("SigninRequest");var It=kt,Tt=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(lt);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(lt))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-ct.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+ct.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},At=class{constructor({url:e,state_data:t,id_token_hint:r,post_logout_redirect_uri:s,extraQueryParams:i,request_type:n,client_id:o,url_state:a}){if(this._logger=new rt("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),new Error("url");const c=new URL(e);if(r&&c.searchParams.append("id_token_hint",r),o&&c.searchParams.append("client_id",o),s&&(c.searchParams.append("post_logout_redirect_uri",s),t||a)){this.state=new Et({data:t,request_type:n,url_state:a});let e=this.state.id;a&&(e=`${e}${lt}${a}`),c.searchParams.append("state",e)}for(const[e,t]of Object.entries({...i}))null!=t&&c.searchParams.append(e,t.toString());this.url=c.href}},Ut=class{constructor(e){if(this.state=e.get("state"),this.state){const e=decodeURIComponent(this.state).split(lt);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(lt))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},Rt=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],Pt=["sub","iss","aud","exp","iat"],Ct=class{constructor(e){this._settings=e,this._logger=new rt("ClaimsService")}filterProtocolClaims(e){const t={...e};if(this._settings.filterProtocolClaims){let e;e=Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:Rt;for(const r of e)Pt.includes(r)||delete t[r]}return t}mergeClaims(e,t){const r={...e};for(const[e,s]of Object.entries(t))if(r[e]!==s)if(Array.isArray(r[e])||Array.isArray(s))if("replace"==this._settings.mergeClaimsStrategy.array)r[e]=s;else{const t=Array.isArray(r[e])?r[e]:[r[e]];for(const e of Array.isArray(s)?s:[s])t.includes(e)||t.push(e);r[e]=t}else"object"==typeof r[e]&&"object"==typeof s?r[e]=this.mergeClaims(r[e],s):r[e]=s;return r}},xt=class{constructor(e,t){this.keys=e,this.nonce=t}},Ot=class{constructor(e,t){this._logger=new rt("OidcClient"),this.settings=e instanceof wt?e:new wt(e),this.metadataService=null!=t?t:new _t(this.settings),this._claimsService=new Ct(this.settings),this._validator=new vt(this.settings,this.metadataService,this._claimsService),this._tokenClient=new St(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:r,request_type:s,id_token_hint:i,login_hint:n,skipUserInfo:o,nonce:a,url_state:c,response_type:d=this.settings.response_type,scope:l=this.settings.scope,redirect_uri:h=this.settings.redirect_uri,prompt:u=this.settings.prompt,display:p=this.settings.display,max_age:g=this.settings.max_age,ui_locales:f=this.settings.ui_locales,acr_values:_=this.settings.acr_values,resource:y=this.settings.resource,response_mode:w=this.settings.response_mode,extraQueryParams:m=this.settings.extraQueryParams,extraTokenParams:S=this.settings.extraTokenParams,dpopJkt:v,omitScopeWhenRequesting:E=this.settings.omitScopeWhenRequesting}){const b=this._logger.create("createSigninRequest");if("code"!==d)throw new Error("Only the Authorization Code flow (with PKCE) is supported");const k=await this.metadataService.getAuthorizationEndpoint();b.debug("Received authorization endpoint",k);const I=await It.create({url:k,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:h,response_type:d,scope:l,state_data:e,url_state:c,prompt:u,display:p,max_age:g,ui_locales:f,id_token_hint:i,login_hint:n,acr_values:_,dpopJkt:v,resource:y,request:t,request_uri:r,extraQueryParams:m,extraTokenParams:S,request_type:s,response_mode:w,client_secret:this.settings.client_secret,skipUserInfo:o,nonce:a,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:E});await this.clearStaleState();const T=I.state;return await this.settings.stateStore.set(T.id,T.toStorageString()),I}async readSigninResponseState(e,t=!1){const r=this._logger.create("readSigninResponseState"),s=new Tt(dt.readParams(e,this.settings.response_mode));if(!s.state)throw r.throw(new Error("No state in response")),null;const i=await this.settings.stateStore[t?"remove":"get"](s.state);if(!i)throw r.throw(new Error("No matching state found in storage")),null;return{state:await bt.fromStorageString(i),response:s}}async processSigninResponse(e,t,r=!0){const s=this._logger.create("processSigninResponse"),{state:i,response:n}=await this.readSigninResponseState(e,r);if(s.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){const e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}try{await this._validator.validateSigninResponse(n,i,t)}catch(e){if(!(e instanceof gt&&this.settings.dpop))throw e;{const r=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=r,await this._validator.validateSigninResponse(n,i,t)}}return n}async getDpopProof(e,t){let r,s;return(await e.getAllKeys()).includes(this.settings.client_id)?(s=await e.get(this.settings.client_id),s.nonce!==t&&t&&(s.nonce=t,await e.set(this.settings.client_id,s))):(r=await ot.generateDPoPKeys(),s=new xt(r,t),await e.set(this.settings.client_id,s)),await ot.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:s.keys,nonce:s.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:r=!1,extraTokenParams:s={}}){const i=await this._tokenClient.exchangeCredentials({username:e,password:t,...s}),n=new Tt(new URLSearchParams);return Object.assign(n,i),await this._validator.validateCredentialsResponse(n,r),n}async useRefreshToken({state:e,redirect_uri:t,resource:r,timeoutInSeconds:s,extraHeaders:i,extraTokenParams:n}){var o;const a=this._logger.create("useRefreshToken");let c,d;if(void 0===this.settings.refreshTokenAllowedScope)c=e.scope;else{const t=this.settings.refreshTokenAllowedScope.split(" ");c=((null==(o=e.scope)?void 0:o.split(" "))||[]).filter((e=>t.includes(e))).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){const e=await this.getDpopProof(this.settings.dpop.store);i={...i,DPoP:e}}try{d=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:c,redirect_uri:t,resource:r,timeoutInSeconds:s,extraHeaders:i,...n})}catch(o){if(!(o instanceof gt&&this.settings.dpop))throw o;i.DPoP=await this.getDpopProof(this.settings.dpop.store,o.nonce),d=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:c,redirect_uri:t,resource:r,timeoutInSeconds:s,extraHeaders:i,...n})}const l=new Tt(new URLSearchParams);return Object.assign(l,d),a.debug("validating response",l),await this._validator.validateRefreshResponse(l,{...e,scope:c}),l}async createSignoutRequest({state:e,id_token_hint:t,client_id:r,request_type:s,url_state:i,post_logout_redirect_uri:n=this.settings.post_logout_redirect_uri,extraQueryParams:o=this.settings.extraQueryParams}={}){const a=this._logger.create("createSignoutRequest"),c=await this.metadataService.getEndSessionEndpoint();if(!c)throw a.throw(new Error("No end session endpoint")),null;a.debug("Received end session endpoint",c),r||!n||t||(r=this.settings.client_id);const d=new At({url:c,id_token_hint:t,client_id:r,post_logout_redirect_uri:n,state_data:e,extraQueryParams:o,request_type:s,url_state:i});await this.clearStaleState();const l=d.state;return l&&(a.debug("Signout request has state to persist"),await this.settings.stateStore.set(l.id,l.toStorageString())),d}async readSignoutResponseState(e,t=!1){const r=this._logger.create("readSignoutResponseState"),s=new Ut(dt.readParams(e,this.settings.response_mode));if(!s.state){if(r.debug("No state in response"),s.error)throw r.warn("Response was error:",s.error),new ht(s);return{state:void 0,response:s}}const i=await this.settings.stateStore[t?"remove":"get"](s.state);if(!i)throw r.throw(new Error("No matching state found in storage")),null;return{state:await Et.fromStorageString(i),response:s}}async processSignoutResponse(e){const t=this._logger.create("processSignoutResponse"),{state:r,response:s}=await this.readSignoutResponseState(e,!0);return r?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(s,r)):t.debug("No state from storage; skipping response validation"),s}clearStaleState(){return this._logger.create("clearStaleState"),Et.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}};function Ht(e,t){if("string"!=typeof e.client_id)throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(e)}`);if(t.redirectUrl&&function(e){return Array.isArray(e.redirect_uris)&&e.redirect_uris.every((e=>"string"==typeof e))}(e)&&e.redirect_uris[0]!==t.redirectUrl.toString())throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(e.redirect_uris)} don't match the provided ${JSON.stringify([t.redirectUrl.toString()])}`);return!0}async function $t(e,t){if(!t.registrationEndpoint)throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");if(!Array.isArray(t.idTokenSigningAlgValuesSupported))throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");const r=(s=t.idTokenSigningAlgValuesSupported,he.find((e=>s.includes(e)))??null);var s;const i={client_name:e.clientName,application_type:"web",redirect_uris:[e.redirectUrl?.toString()],subject_type:"public",token_endpoint_auth_method:"client_secret_basic",id_token_signed_response_alg:r,grant_types:["authorization_code","refresh_token"]},n=await fetch(t.registrationEndpoint.toString(),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});if(n.ok){const t=await n.json();return Ht(t,e),{clientId:t.client_id,clientSecret:t.client_secret,expiresAt:t.client_secret_expires_at,idTokenSignedResponseAlg:t.id_token_signed_response_alg,clientType:"dynamic"}}throw 400===n.status&&function(e,t){if("invalid_redirect_uri"===e.error)throw new Error(`Dynamic client registration failed: the provided redirect uri [${t.redirectUrl?.toString()}] is invalid - ${e.error_description??""}`);if("invalid_client_metadata"===e.error)throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(t)} is invalid - ${e.error_description??""}`);throw new Error(`Dynamic client registration failed: ${e.error} - ${e.error_description??""}`)}(await n.json(),e),new Error(`Dynamic client registration failed: the server returned ${n.status} ${n.statusText} - ${await n.text()}`)}function Kt(e){return void 0!==e.error_description&&"string"==typeof e.error_description}function Dt(e,t){if(void 0!==(r=e).error&&"string"==typeof r.error)throw new Ke(`Token endpoint returned error [${e.error}]${Kt(e)?`: ${e.error_description}`:""}${function(e){return void 0!==e.error_uri&&"string"==typeof e.error_uri}(e)?` (see ${e.error_uri})`:""}`,e.error,Kt(e)?e.error_description:void 0);var r;if(!function(e){return void 0!==e.access_token&&"string"==typeof e.access_token}(e))throw new $e(["access_token"]);if(!function(e){return void 0!==e.id_token&&"string"==typeof e.id_token}(e))throw new $e(["id_token"]);if(!function(e){return void 0!==e.token_type&&"string"==typeof e.token_type}(e))throw new $e(["token_type"]);if(!function(e){return void 0===e.expires_in||"number"==typeof e.expires_in}(e))throw new $e(["expires_in"]);if(!t&&"bearer"!==e.token_type.toLowerCase())throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${e.token_type}].`);return e}async function Nt(e,t,r,s){!function(e,t){if(t.grantType&&(!e.grantTypesSupported||!e.grantTypesSupported.includes(t.grantType)))throw new Error(`The issuer [${e.issuer}] does not support the [${t.grantType}] grant`);if(!e.tokenEndpoint)throw new Error(`This issuer [${e.issuer}] does not have a token endpoint`)}(e,r);const i={"content-type":"application/x-www-form-urlencoded"};let n;s&&(n=await async function(){const{privateKey:e,publicKey:t}=await ie(he[0],{extractable:!0}),r={privateKey:e,publicKey:await $(t)};return[r.publicKey.alg]=he,r}(),i.DPoP=await Ne(e.tokenEndpoint,"POST",n)),t.clientSecret&&(i.Authorization=`Basic ${btoa(`${t.clientId}:${t.clientSecret}`)}`);const o={grant_type:r.grantType,redirect_uri:r.redirectUrl,code:r.code,code_verifier:r.codeVerifier,client_id:t.clientId},a={method:"POST",headers:i,body:new URLSearchParams(o).toString()},c=await fetch(e.tokenEndpoint,a),d=Dt(await c.json(),s),{webId:l,clientId:h}=await fe(d.id_token,e.jwksUri,e.issuer,t.clientId);return{accessToken:d.access_token,idToken:d.id_token,refreshToken:(u=d,void 0!==u.refresh_token&&"string"==typeof u.refresh_token?d.refresh_token:void 0),webId:l,clientId:h,dpopKey:n,expiresIn:d.expires_in};var u}async function Lt(e,t,r,s){if(void 0===r.clientId)throw new Error("No client ID available when trying to refresh the access token.");const i={grant_type:"refresh_token",refresh_token:e};let n={};void 0!==s&&(n={DPoP:await Ne(t.tokenEndpoint,"POST",s)});let o={};void 0!==r.clientSecret?o={Authorization:`Basic ${btoa(`${r.clientId}:${r.clientSecret}`)}`}:(e=>{try{return new URL(e),!0}catch{return!1}})(r.clientId)&&(i.client_id=r.clientId);const a=await fetch(t.tokenEndpoint,{method:"POST",body:new URLSearchParams(i).toString(),headers:{...n,...o,"Content-Type":"application/x-www-form-urlencoded"}});let c;try{c=await a.json()}catch(e){throw new Error(`The token endpoint of issuer ${t.issuer} returned a malformed response.`)}const d=Dt(c,void 0!==s),{webId:l}=await fe(d.id_token,t.jwksUri,t.issuer,r.clientId);return{accessToken:d.access_token,idToken:d.id_token,refreshToken:"string"==typeof d.refresh_token?d.refresh_token:void 0,webId:l,dpopKey:s,expiresIn:d.expires_in}}class jt extends Re{login=async(e,t)=>{"none"!==e.prompt&&await this.sessionInfoManager.clear(e.sessionId);const r=e.redirectUrl??function(e){const t=ye(e);return t.hash="",e.includes(`${t.origin}/`)?t.href:`${t.origin}${t.href.substring(t.origin.length+1)}`}(window.location.href);if(!_e(r))throw new Error(`${r} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);await this.loginHandler.handle({...e,redirectUrl:r,clientName:e.clientName??e.clientId,eventEmitter:t})};validateCurrentSession=async e=>{const t=await this.sessionInfoManager.get(e);return void 0===t||void 0===t.clientAppId||void 0===t.issuer||function(e){return void 0!==e.clientExpiresAt&&0!==e.clientExpiresAt&&e.clientExpiresAt<Math.floor(Date.now()/1e3)}(t)?null:t};handleIncomingRedirect=async(e,t)=>{try{const r=await this.redirectHandler.handle(e,t,void 0);return this.fetch=r.fetch.bind(window),this.boundLogout=r.getLogoutUrl,await this.cleanUrlAfterRedirect(e),{isLoggedIn:r.isLoggedIn,webId:r.webId,sessionId:r.sessionId,expirationDate:r.expirationDate,clientAppId:r.clientAppId}}catch(r){return await this.cleanUrlAfterRedirect(e),void t.emit(ue.ERROR,"redirect",r)}};async cleanUrlAfterRedirect(e){const t=ye(e).href;for(window.history.replaceState(null,"",t);window.location.href!==t;)await new Promise((e=>{setTimeout((()=>e()),1)}))}}function Jt(e){return"string"==typeof e.oidcIssuer}function Wt(e){return"string"==typeof e.redirectUrl}class Mt{storageUtility;oidcHandler;issuerConfigFetcher;clientRegistrar;constructor(e,t,r,s){this.storageUtility=e,this.oidcHandler=t,this.issuerConfigFetcher=r,this.clientRegistrar=s,this.storageUtility=e,this.oidcHandler=t,this.issuerConfigFetcher=r,this.clientRegistrar=s}async canHandle(e){return Jt(e)&&Wt(e)}async handle(e){if(!Jt(e))throw new Oe(`OidcLoginHandler requires an OIDC issuer: missing property 'oidcIssuer' in ${JSON.stringify(e)}`);if(!Wt(e))throw new Oe(`OidcLoginHandler requires a redirect URL: missing property 'redirectUrl' in ${JSON.stringify(e)}`);const t=await this.issuerConfigFetcher.fetchConfig(e.oidcIssuer),r=await Ae(e,t,this.storageUtility,this.clientRegistrar),s={issuer:t.issuer,dpop:"dpop"===e.tokenType.toLowerCase(),...e,issuerConfiguration:t,client:r,scopes:(i=e.customScopes,Array.isArray(i)?Array.from(new Set([...pe,...i.filter((e=>"string"==typeof e&&!e.includes(" ")))])):pe)};var i;return this.oidcHandler.handle(s)}}class qt extends we{async handle(e){const t=e.redirectUrl??"",r={authority:e.issuer.toString(),client_id:e.client.clientId,client_secret:e.client.clientSecret,redirect_uri:t,response_type:"code",scope:e.scopes.join(" "),filterProtocolClaims:!0,loadUserInfo:!1,prompt:e.prompt??"consent"},s=new Ot(r);try{const t=await s.createSigninRequest({});return await this.setupRedirectHandler({oidcLoginOptions:e,state:t.state.id,codeVerifier:t.state.code_verifier??"",targetUrl:t.url.toString()})}catch(e){console.error(e)}}}const Ft={issuer:{toKey:"issuer",convertToUrl:!0},authorization_endpoint:{toKey:"authorizationEndpoint",convertToUrl:!0},token_endpoint:{toKey:"tokenEndpoint",convertToUrl:!0},userinfo_endpoint:{toKey:"userinfoEndpoint",convertToUrl:!0},jwks_uri:{toKey:"jwksUri",convertToUrl:!0},registration_endpoint:{toKey:"registrationEndpoint",convertToUrl:!0},end_session_endpoint:{toKey:"endSessionEndpoint",convertToUrl:!0},scopes_supported:{toKey:"scopesSupported"},response_types_supported:{toKey:"responseTypesSupported"},response_modes_supported:{toKey:"responseModesSupported"},grant_types_supported:{toKey:"grantTypesSupported"},acr_values_supported:{toKey:"acrValuesSupported"},subject_types_supported:{toKey:"subjectTypesSupported"},id_token_signing_alg_values_supported:{toKey:"idTokenSigningAlgValuesSupported"},id_token_encryption_alg_values_supported:{toKey:"idTokenEncryptionAlgValuesSupported"},id_token_encryption_enc_values_supported:{toKey:"idTokenEncryptionEncValuesSupported"},userinfo_signing_alg_values_supported:{toKey:"userinfoSigningAlgValuesSupported"},userinfo_encryption_alg_values_supported:{toKey:"userinfoEncryptionAlgValuesSupported"},userinfo_encryption_enc_values_supported:{toKey:"userinfoEncryptionEncValuesSupported"},request_object_signing_alg_values_supported:{toKey:"requestObjectSigningAlgValuesSupported"},request_object_encryption_alg_values_supported:{toKey:"requestObjectEncryptionAlgValuesSupported"},request_object_encryption_enc_values_supported:{toKey:"requestObjectEncryptionEncValuesSupported"},token_endpoint_auth_methods_supported:{toKey:"tokenEndpointAuthMethodsSupported"},token_endpoint_auth_signing_alg_values_supported:{toKey:"tokenEndpointAuthSigningAlgValuesSupported"},display_values_supported:{toKey:"displayValuesSupported"},claim_types_supported:{toKey:"claimTypesSupported"},claims_supported:{toKey:"claimsSupported"},service_documentation:{toKey:"serviceDocumentation"},claims_locales_supported:{toKey:"claimsLocalesSupported"},ui_locales_supported:{toKey:"uiLocalesSupported"},claims_parameter_supported:{toKey:"claimsParameterSupported"},request_parameter_supported:{toKey:"requestParameterSupported"},request_uri_parameter_supported:{toKey:"requestUriParameterSupported"},require_request_uri_registration:{toKey:"requireRequestUriRegistration"},op_policy_uri:{toKey:"opPolicyUri",convertToUrl:!0},op_tos_uri:{toKey:"opTosUri",convertToUrl:!0}};class Vt{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}static getLocalStorageKey(e){return`issuerConfig:${e}`}async fetchConfig(e){let t;const r=new URL(".well-known/openid-configuration",e.endsWith("/")?e:`${e}/`).href,s=await fetch(r);try{t=function(e){const t={};return Object.keys(e).forEach((r=>{Ft[r]&&(t[Ft[r].toKey]=e[r])})),Array.isArray(t.scopesSupported)||(t.scopesSupported=["openid"]),t}(await s.json())}catch(t){throw new Oe(`[${e.toString()}] has an invalid configuration: ${t.message}`)}return await this.storageUtility.set(Vt.getLocalStorageKey(e),JSON.stringify(t)),t}}async function zt(e,t){await be(e,t),await async function(){const e=new yt({});await Et.clearStaleState(e,900);const t=window.localStorage,r=[];for(let e=0;e<=t.length;e+=1){const s=t.key(e);s&&(s.match(/^oidc\..+$/)||s.match(/^solidClientAuthenticationUser:.+$/))&&r.push(s)}r.forEach((e=>t.removeItem(e)))}()}class Bt extends ke{async get(e){const[t,r,s,i,n,o,a,c,d]=await Promise.all([this.storageUtility.getForUser(e,"isLoggedIn",{secure:!0}),this.storageUtility.getForUser(e,"webId",{secure:!0}),this.storageUtility.getForUser(e,"clientId",{secure:!1}),this.storageUtility.getForUser(e,"clientSecret",{secure:!1}),this.storageUtility.getForUser(e,"redirectUrl",{secure:!1}),this.storageUtility.getForUser(e,"refreshToken",{secure:!0}),this.storageUtility.getForUser(e,"issuer",{secure:!1}),this.storageUtility.getForUser(e,"tokenType",{secure:!1}),this.storageUtility.getForUser(e,"expiresAt",{secure:!1})]);if("string"!=typeof n||_e(n)){if(void 0!==c&&("string"!=typeof(l=c)||!["DPoP","Bearer"].includes(l)))throw new Error(`Tokens of type [${c}] are not supported.`);var l;if(void 0!==s||void 0!==t||void 0!==r||void 0!==o)return{sessionId:e,webId:r,isLoggedIn:"true"===t,redirectUrl:n,refreshToken:o,issuer:a,clientAppId:s,clientAppSecret:i,tokenType:c??"DPoP",clientExpiresAt:void 0!==d?Number.parseInt(d,10):void 0}}else await Promise.all([this.storageUtility.deleteAllUserData(e,{secure:!1}),this.storageUtility.deleteAllUserData(e,{secure:!0})])}async clear(e){return zt(e,this.storageUtility)}}class Gt{async canHandle(e){try{return new URL(e),!0}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e){return Ee()}}class Xt{storageUtility;sessionInfoManager;issuerConfigFetcher;clientRegistrar;tokerRefresher;constructor(e,t,r,s,i){this.storageUtility=e,this.sessionInfoManager=t,this.issuerConfigFetcher=r,this.clientRegistrar=s,this.tokerRefresher=i,this.storageUtility=e,this.sessionInfoManager=t,this.issuerConfigFetcher=r,this.clientRegistrar=s,this.tokerRefresher=i}async canHandle(e){try{const t=new URL(e);return null!==t.searchParams.get("code")&&null!==t.searchParams.get("state")}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e,t){if(!await this.canHandle(e))throw new Error(`AuthCodeRedirectHandler cannot handle [${e}]: it is missing one of [code, state].`);const r=new URL(e),s=r.searchParams.get("state"),i=await this.storageUtility.getForUser(s,"sessionId",{errorIfNull:!0}),{issuerConfig:n,codeVerifier:o,redirectUrl:a,dpop:c}=await Pe(i,this.storageUtility,this.issuerConfigFetcher),d=r.searchParams.get("iss");if("string"==typeof d&&d!==n.issuer)throw new Error(`The value of the iss parameter (${d}) does not match the issuer identifier of the authorization server (${n.issuer}). See [rfc9207](https://www.rfc-editor.org/rfc/rfc9207.html#section-2.3-3.1.1)`);if(void 0===o)throw new Error(`The code verifier for session ${i} is missing from storage.`);if(void 0===a)throw new Error(`The redirect URL for session ${i} is missing from storage.`);const l=await this.clientRegistrar.getClient({sessionId:i},n),h=Date.now(),u=await Nt(n,l,{grantType:"authorization_code",code:r.searchParams.get("code"),codeVerifier:o,redirectUrl:a},c);let p;window.localStorage.removeItem(`oidc.${s}`),void 0!==u.refreshToken&&(p={sessionId:i,refreshToken:u.refreshToken,tokenRefresher:this.tokerRefresher});const g=We(u.accessToken,{dpopKey:u.dpopKey,refreshOptions:p,eventEmitter:t,expiresIn:u.expiresIn});await async function(e,t,r,s,i,n,o){void 0!==r&&await e.setForUser(t,{webId:r},{secure:o}),void 0!==s&&await e.setForUser(t,{clientId:s},{secure:o}),await e.setForUser(t,{isLoggedIn:i},{secure:o})}(this.storageUtility,i,u.webId,u.clientId,"true",0,!0);const f=await this.sessionInfoManager.get(i);if(!f)throw new Error(`Could not retrieve session: [${i}].`);return Object.assign(f,{fetch:g,getLogoutUrl:Ie({idTokenHint:u.idToken,endSessionEndpoint:n.endSessionEndpoint}),expirationDate:"number"==typeof u.expiresIn?h+1e3*u.expiresIn:void 0})}}class Qt extends ge{constructor(e){super(e)}}class Yt{get storage(){return window.localStorage}async get(e){return this.storage.getItem(e)||void 0}async set(e,t){this.storage.setItem(e,t)}async delete(e){this.storage.removeItem(e)}}class Zt{redirect(e,t){t&&t.handleRedirect?t.handleRedirect(e):t&&t.redirectByReplacingState?window.history.replaceState({},"",e):window.location.href=e}}class er{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}async getClient(e,t){const[r,s,i,n,o]=await Promise.all([this.storageUtility.getForUser(e.sessionId,"clientId",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientSecret",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"expiresAt",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientName",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientType",{secure:!1})]),a=void 0!==i?Number.parseInt(i,10):-1,c=void 0!==s&&0!==a&&Math.floor(Date.now()/1e3)>a;if(r&&("string"==typeof(d=o)&&["dynamic","static","solid-oidc"].includes(d))&&!c)return void 0!==s?{clientId:r,clientSecret:s,clientName:n,clientType:"dynamic",expiresAt:a}:{clientId:r,clientName:n,clientType:o};var d;try{const r=await $t(e,t),s={clientId:r.clientId,clientType:"dynamic"};return void 0!==r.clientSecret&&(s.clientSecret=r.clientSecret,s.expiresAt=String(r.expiresAt)),r.idTokenSignedResponseAlg&&(s.idTokenSignedResponseAlg=r.idTokenSignedResponseAlg),await this.storageUtility.setForUser(e.sessionId,s,{secure:!1}),r}catch(e){throw new Error("Client registration failed.",{cause:e})}}}class tr{async canHandle(e){try{return new URL(e).searchParams.has("error")}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e,t){if(void 0!==t){const r=new URL(e),s=r.searchParams.get("error"),i=r.searchParams.get("error_description");t.emit(ue.ERROR,s,i)}return Ee()}}class rr{storageUtility;issuerConfigFetcher;clientRegistrar;constructor(e,t,r){this.storageUtility=e,this.issuerConfigFetcher=t,this.clientRegistrar=r,this.storageUtility=e,this.issuerConfigFetcher=t,this.clientRegistrar=r}async refresh(e,t,r,s){const i=await Pe(e,this.storageUtility,this.issuerConfigFetcher),n=await this.clientRegistrar.getClient({sessionId:e},i.issuerConfig);if(void 0===t)throw new Error(`Session [${e}] has no refresh token to allow it to refresh its access token.`);if(i.dpop&&void 0===r)throw new Error(`For session [${e}], the key bound to the DPoP access token must be provided to refresh said access token.`);const o=await Lt(t,i.issuerConfig,n,r);return void 0!==o.refreshToken&&s?.emit(ue.NEW_REFRESH_TOKEN,o.refreshToken),o}}function sr(e){const t=new xe,r=e.secureStorage||t,s=e.insecureStorage||new Yt,i=new Be(r,s),n=new Vt(i),o=new er(i),a=new Bt(i),c=new rr(i,n,o),d=new Zt,l=new Mt(i,new qt(i,d),n,o),h=new Qt([new tr,new Xt(i,a,n,o,c),new Gt]);return new jt(l,h,new ve(a,d),a,n)}const ir=`${le}currentSession`,nr=`${le}currentUrl`;class or{info;events;clientAuthentication;tokenRequestInProgress=!1;constructor(e={},t=void 0){this.events=new ze,e.clientAuthentication?this.clientAuthentication=e.clientAuthentication:e.secureStorage&&e.insecureStorage?this.clientAuthentication=sr({secureStorage:e.secureStorage,insecureStorage:e.insecureStorage}):this.clientAuthentication=sr({}),e.sessionInfo?this.info={sessionId:e.sessionInfo.sessionId,isLoggedIn:!1,webId:e.sessionInfo.webId,clientAppId:e.sessionInfo.clientAppId}:this.info={sessionId:t??de(),isLoggedIn:!1},this.events.on(ue.LOGIN,(()=>window.localStorage.setItem(ir,this.info.sessionId))),this.events.on(ue.SESSION_EXPIRED,(()=>this.internalLogout(!1))),this.events.on(ue.ERROR,(()=>this.internalLogout(!1)))}login=async e=>(await this.clientAuthentication.login({sessionId:this.info.sessionId,...e,tokenType:e.tokenType??"DPoP"},this.events),new Promise((()=>{})));fetch=(e,t)=>this.clientAuthentication.fetch(e,t);internalLogout=async(e,t)=>{window.localStorage.removeItem(ir),await this.clientAuthentication.logout(this.info.sessionId,t),this.info.isLoggedIn=!1,e&&this.events.emit(ue.LOGOUT)};logout=async e=>this.internalLogout(!0,e);handleIncomingRedirect=async(e={})=>{if(this.info.isLoggedIn)return this.info;if(this.tokenRequestInProgress)return;const t="string"==typeof e?{url:e}:e,r=t.url??window.location.href;this.tokenRequestInProgress=!0;const s=await this.clientAuthentication.handleIncomingRedirect(r,this.events);if(function(e){return!!e?.isLoggedIn}(s)){this.setSessionInfo(s);const e=window.localStorage.getItem(nr);null===e?this.events.emit(ue.LOGIN):(window.localStorage.removeItem(nr),this.events.emit(ue.SESSION_RESTORED,e))}else if(!0===t.restorePreviousSession){const e=window.localStorage.getItem(ir);if(null!==e){if(await async function(e,t,r){const s=await t.validateCurrentSession(e);return null!==s&&(window.localStorage.setItem(nr,window.location.href),await t.login({sessionId:e,prompt:"none",oidcIssuer:s.issuer,redirectUrl:s.redirectUrl,clientId:s.clientAppId,clientSecret:s.clientAppSecret,tokenType:s.tokenType??"DPoP"},r.events),!0)}(e,this.clientAuthentication,this))return new Promise((()=>{}))}}return this.tokenRequestInProgress=!1,s};setSessionInfo(e){this.info.isLoggedIn=e.isLoggedIn,this.info.webId=e.webId,this.info.sessionId=e.sessionId,this.info.clientAppId=e.clientAppId,this.info.expirationDate=e.expirationDate,this.events.on(ue.SESSION_EXTENDED,(e=>{this.info.expirationDate=Date.now()+1e3*e}))}}let ar;function cr(){return void 0===ar&&(ar=new or),ar}return e.ConfigurationError=Oe,e.EVENTS=ue,e.InMemoryStorage=xe,e.NotImplementedError=He,e.Session=or,e.events=function(){return cr().events},e.fetch=function(...e){return cr().fetch(...e)},e.getDefaultSession=cr,e.handleIncomingRedirect=function(...e){return cr().handleIncomingRedirect(...e)},e.login=function(...e){return cr().login(...e)},e.logout=function(...e){return cr().logout(...e)},e}({});
+var solidClientAuthentication=function(e){"use strict";const t=new TextEncoder,r=new TextDecoder,n=new TextDecoder("utf-8",{fatal:!0});function s(...e){const t=e.reduce((e,{length:t})=>e+t,0),r=new Uint8Array(t);let n=0;for(const t of e)r.set(t,n),n+=t.length;return r}const i=/[^\x00-\x7f]/;function o(e){if("string"==typeof e&&e.length>=128){if(i.test(e))throw new TypeError("non-ASCII string encountered in encode()");return t.encode(e)}const r=new Uint8Array(e.length);for(let t=0;t<e.length;t++){const n=e.charCodeAt(t);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");r[t]=n}return r}class a extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,t){super(e,t),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class c extends a{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}}),this.claim=r,this.reason=n,this.payload=t}}class d extends a{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}}),this.claim=r,this.reason=n,this.payload=t}}class l extends a{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class u extends a{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class h extends a{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class p extends a{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class g extends a{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class f extends a{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",t){super(e,t)}}class y extends a{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",t){super(e,t)}}class _ extends a{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",t){super(e,t)}}class w extends a{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",t){super(e,t)}}function m(e){try{return function(e,t=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e,{alphabet:t?"base64url":"base64"});if(t){if(e.includes("+")||e.includes("/"))throw new TypeError("Invalid base64url");e=e.replace(/-/g,"+").replace(/_/g,"/")}const r=atob(e),n=new Uint8Array(r.length);for(let e=0;e<r.length;e++)n[e]=r.charCodeAt(e);return n}("string"==typeof e?e:r.decode(e),!0)}catch(e){throw new TypeError("The input to be decoded is not correctly encoded.",{cause:e})}}function v(e){return function(e,t=!1){if(Uint8Array.prototype.toBase64)return e.toBase64({alphabet:t?"base64url":"base64",omitPadding:t});const r=[];for(let t=0;t<e.length;t+=32768)r.push(String.fromCharCode.apply(null,e.subarray(t,t+32768)));const n=btoa(r.join(""));return t?n.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"):n}("string"==typeof e?t.encode(e):e,!0)}function S(e){if("object"!=typeof e||null===e||"[object Object]"!==Object.prototype.toString.call(e))return!1;const t=Object.getPrototypeOf(e);return null===t||null===Object.getPrototypeOf(t)}function b(e){return S(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(S)}function E(...e){const t=new Set;for(const r of e)if(r)for(const e of Object.keys(r)){if(t.has(e))return!1;t.add(e)}return!0}function k(e,t,r){try{return m(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}const I={__proto__:null,b64:!0};function T(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw new TypeError(`"${e}" option must be an array of strings`);return void 0===t?void 0:new Set(t)}function A(e,t,r,n,s){if(void 0!==s.crit&&void 0===n?.crit)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||void 0===n.crit)return[];if(!Array.isArray(n.crit)||0===n.crit.length||n.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');const i=void 0===r?t:{__proto__:null,...r,...t};for(const t of n.crit){if(!(t in i))throw new u(`Extension Header Parameter "${t}" is not recognized`);if(!Object.hasOwn(s,t)||void 0===s[t])throw new e(`Extension Header Parameter "${t}" is missing`);if(i[t]&&(!Object.hasOwn(n,t)||void 0===n[t]))throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return n.crit}function U(e,t){if(t.includes("b64")){const t=e.b64;if("boolean"!=typeof t)throw new h('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return t}return!0}function R(e,t){let r,n;try{r=JSON.stringify(t),n=JSON.parse(r)}catch(t){throw new e("JOSE Header is not valid JSON",{cause:t})}if(!S(n))throw new e("JOSE Header is not a JSON object");return[n,r]}async function P(e,t,r){const{alg:n,secret:s}=e,i="decrypt"===r||"sign"===r;if(s&&t instanceof Uint8Array)return t;let o,a;if(S(t)){if(o=function(e){const t=J(e);if(void 0!==t.ext&&"boolean"!=typeof t.ext)throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(void 0!==t.key_ops){const e=t.key_ops,r=Array.isArray(e)?[...e]:void 0;if(!r||r.some(e=>"string"!=typeof e)||new Set(r).size!==r.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=r}return t}(t),"string"!=typeof o.kty)throw L(n,t,s);if(!(s?"oct"===o.kty&&"string"==typeof o.k:"oct"!==o.kty&&(i?"AKP"===o.kty&&"string"==typeof o.priv||"string"==typeof o.d:void 0===o.d&&void 0===o.priv)))throw new TypeError(s?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${i?"private":"public"} JWK`);if(((e,t,r)=>{const{alg:n}=e;if(void 0!==t.use){const e="sign"===r||"verify"===r?"sig":"enc";if(t.use!==e)throw new TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`)}if(void 0!==t.alg&&t.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(t.key_ops)){const n="encrypt"===r||"decrypt"===r?e.ops?.["encrypt"===r?0:1]:r;if(n&&!t.key_ops.includes(n))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}})(e,o,r),"oct"===o.kty)return m(o.k);if(!Object.isFrozen(t)){const{key_ops:e}=t;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}}else{if(!K(t))throw L(n,t,s);const e=s?"secret":i?"private":"public";if(t.type!==e&&(s||["secret","public","private"].includes(t.type)))throw new TypeError(`${(e=>e[Symbol.toStringTag])(t)} instances must be of type "${e}" for the ${n} algorithm`);if(O(t))return t;if(a=t,"secret"===a.type)return a.export()}C||=new WeakMap;const c=t;let d=C.get(c);if(d?.[n])return d[n];if(d||C.set(c,d={}),a&&"function"==typeof a.toCryptoKey){const t="public"===a.type,r=x[a.asymmetricKeyDetails?.namedCurve],s=e.resolve?.({crv:r,asymmetricKeyType:a.asymmetricKeyType})??e.subtle;return d[n]=a.toCryptoKey(s,t,e.usages[t?0:1])}return o??=a.export({format:"jwk"}),o.alg=n,d[n]=await W(e,o)}let C;const x={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"},O=e=>{if("CryptoKey"===e?.[Symbol.toStringTag])return!0;try{return e instanceof CryptoKey}catch{return!1}},N=e=>"KeyObject"===e?.[Symbol.toStringTag],K=e=>O(e)||N(e);function $(e,t,...r){if(r.length>2){const t=r.pop();e+=`one of type ${r.join(", ")}, or ${t}.`}else 2===r.length?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return null==t?e+=` Received ${t}`:"function"==typeof t&&t.name?e+=` Received function ${t.name}`:"object"==typeof t&&null!=t&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}function L(e,t,r){const n=["CryptoKey","KeyObject","JSON Web Key"];return r&&n.push("Uint8Array"),new TypeError($(`Key for the ${e} algorithm must be `,t,...n))}const H=(e,t="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function j(e,t){const{modulusLength:r}=t.algorithm;if("number"!=typeof r||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function D(e,t,r){const n=e.algorithm;if(n.name!==t.name)throw H(t.name);if(t.hash&&n.hash?.name!==t.hash)throw H(t.hash,"algorithm.hash");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw H(t.namedCurve,"algorithm.namedCurve");if(void 0!==t.length&&n.length!==t.length)throw H(t.length,"algorithm.length");!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}(e,r)}function J(e){return{__proto__:null,...e}}async function W(e,t,r){if(!e.kty.includes(t.kty))throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');const n=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,s=!(!t.d&&!t.priv),i={...t,ext:r??t.ext};return"AKP"!==i.kty&&delete i.alg,delete i.use,crypto.subtle.importKey("jwk",i,n,i.ext??!s,t.key_ops??e.usages[s?1:0])}async function M(e,t,r,n=!1){return e instanceof Uint8Array&&(e=await crypto.subtle.importKey("raw",e,t,n,[r])),D(e,t,r),e}function q(e){const t={__proto__:null};for(const r in e)t[r]={...e[r],alg:r};return t}const F=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],B=[[],["deriveBits"]],z=[[],[]];function V(e){return{kty:["RSA"],mode:"key-encryption",subtle:{name:"RSA-OAEP",hash:`SHA-${e}`},usages:F,ops:["wrapKey","unwrapKey"]}}function G(e){return{kty:["EC","OKP"],mode:e,subtle:{name:"ECDH"},resolve:({kty:e,crv:t,asymmetricKeyType:r})=>{if("X25519"===t||"x25519"===r)return{name:"X25519"};if("OKP"===e)throw new u('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:t}},usages:B,ops:[void 0,"deriveBits"]}}function X(e,t=!1){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:z,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function Q(){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:"PBKDF2"},usages:z,ops:["deriveBits","deriveBits"]}}const Y=q({dir:{kty:["oct"],mode:"direct-encryption",secret:!0,subtle:{name:"AES-GCM"},usages:z,ops:["encrypt","decrypt"]},"RSA-OAEP":V(1),"RSA-OAEP-256":V(256),"RSA-OAEP-384":V(384),"RSA-OAEP-512":V(512),"ECDH-ES":G("direct-key-agreement"),"ECDH-ES+A128KW":G("key-agreement-with-key-wrapping"),"ECDH-ES+A192KW":G("key-agreement-with-key-wrapping"),"ECDH-ES+A256KW":G("key-agreement-with-key-wrapping"),A128KW:X(128),A192KW:X(192),A256KW:X(256),A128GCMKW:X(128,!0),A192GCMKW:X(192,!0),A256GCMKW:X(256,!0),"PBES2-HS256+A128KW":Q(),"PBES2-HS384+A192KW":Q(),"PBES2-HS512+A256KW":Q()}),Z=["encrypt","decrypt"];function ee(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:z,ops:Z,cekBits:e,ivBits:t?128:96,cbc:t}}q({A128GCM:ee(128),A192GCM:ee(192),A256GCM:ee(256),"A128CBC-HS256":ee(256,!0),"A192CBC-HS384":ee(384,!0),"A256CBC-HS512":ee(512,!0)});const te=[["verify"],["sign"]];function re(e){const t={name:"HMAC",hash:`SHA-${e}`};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:te}}function ne(e,t){const r={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${e}`};return{kty:["RSA"],subtle:r,signing:t?{...r,saltLength:t}:r,usages:te,minRsaBits:2048}}function se(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:`SHA-${t}`},usages:te}}function ie(){const e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:te}}function oe(e){const t={name:`ML-DSA-${e}`};return{kty:["AKP"],subtle:t,signing:t,usages:te}}const ae=q({HS256:re(256),HS384:re(384),HS512:re(512),RS256:ne(256),RS384:ne(384),RS512:ne(512),PS256:ne(256,32),PS384:ne(384,48),PS512:ne(512,64),ES256:se("P-256",256),ES384:se("P-384",384),ES512:se("P-521",512),EdDSA:ie(),Ed25519:ie(),"ML-DSA-44":oe(44),"ML-DSA-65":oe(65),"ML-DSA-87":oe(87)});function ce(e){const t="string"==typeof e?ae[e]:void 0;if(!t)throw new u(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function de(e){return void 0===e?{}:function(e,t,r){let s;try{s=JSON.parse(n.decode(m(e)))}catch{throw new t(r)}if(!S(s))throw new t(r);return s}(e,h,"JWS Protected Header is invalid")}function le(e){try{return o(e)}catch{throw new h("JWS Compact Serialization payload must use only ASCII characters")}}async function ue(e,t,r,n,i){const{protected:a,header:c,payload:d}=e,u=de(a);if(!E(u,c))throw new h("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const p={...u,...c},g=U(u,A(h,I,t[1],u,p)),{alg:f}=p;if("string"!=typeof f||!f)throw new h('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(t[0]&&!t[0].has(f))throw new l('"alg" (Algorithm) Header Parameter value not allowed');if(g){if("string"!=typeof d)throw new h("JWS Payload must be a string")}else if("string"!=typeof d&&!(d instanceof Uint8Array))throw new h("JWS Payload must be a string or an Uint8Array instance");const y=g||"string"!=typeof d?d:n(d);let _=!1;"function"==typeof r&&(r=await r(u,e),_=!0);const m=ce(f),v=s(void 0!==a?o(a):new Uint8Array,o("."),"string"==typeof y?t[2]??=function(e,t,r){try{return o(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}(y,"payload",h):y),S=k(e.signature,"signature",h),b=await P(m,r,"verify"),T=await M(b,m.subtle,"verify");m.minRsaBits&&j(m.alg,T);let R=!1;try{R=await crypto.subtle.verify(m.signing,T,S,v)}catch{}if(!R)throw new w;const C={payload:"string"==typeof y?k(y,"payload",h):y};return void 0!==a&&(C.protectedHeader=u),void 0!==c&&(C.unprotectedHeader=c),_?[{...C,key:b},g]:[C,g]}const he=e=>Math.floor(e.getTime()/1e3),pe={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},ge=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fe="check_failed";function ye(){throw new TypeError("Invalid time period format")}function _e(e){"string"!=typeof e&&ye();const t=ge.exec(e);(!t||t[4]&&t[1])&&ye();const r=parseFloat(t[2]),n=Math.round(r*pe[t[3][0].toLowerCase()]);return Number.isFinite(n)||ye(),"-"===t[1]||"ago"===t[4]?-n:n}function we(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}function me(e,t){if("string"!=typeof t)throw new TypeError(`"${e}" claim must be a string`)}function ve(e,t){return"number"==typeof e?we(t,e):e instanceof Date?we(t,he(e)):he(new Date)+_e(e)}const Se=e=>{const t=e.toLowerCase();return e.includes("/")?t:`application/${t}`};function be(e,t,r=!1){const n=e[t];if(void 0!==n||r){if("number"!=typeof n)throw new c(`"${t}" claim must be a number`,e,t,"invalid");return n}}function Ee(e,t){throw new c(`unexpected "${t}" claim value`,e,t,fe)}function ke(e,t,r={}){let s;try{s=JSON.parse(n.decode(t))}catch{}if(!S(s))throw new p("JWT Claims Set must be a top-level JSON object");const{typ:i}=r;if(void 0!==i&&("string"!=typeof e.typ||Se(e.typ)!==Se(i)))throw new c('unexpected "typ" JWT header value',s,"typ",fe);const{requiredClaims:o=[],issuer:a,subject:l,audience:u,maxTokenAge:h}=r,g=[...o];void 0!==h&&g.push("iat"),void 0!==u&&g.push("aud"),void 0!==l&&g.push("sub"),void 0!==a&&g.push("iss");for(const e of new Set(g.reverse()))if(!Object.hasOwn(s,e))throw new c(`missing required "${e}" claim`,s,e,"missing");var f,y;void 0!==a&&!(Array.isArray(a)?a:[a]).includes(s.iss)&&Ee(s,"iss"),void 0!==l&&s.sub!==l&&Ee(s,"sub"),void 0!==u&&(f=s.aud,y="string"==typeof u?[u]:u,!("string"==typeof f?y.includes(f):Array.isArray(f)&&y.some(e=>f.includes(e))))&&Ee(s,"aud");const{clockTolerance:_}=r;let w=0;if("string"==typeof _)w=_e(_);else if(void 0!==_){if("number"!=typeof _)throw new TypeError("Invalid clockTolerance option type");w=_}we("clockTolerance option",w);const{currentDate:m}=r,v=we("currentDate option",he(void 0===m?new Date:m)),b=be(s,"iat",void 0!==h),E=be(s,"nbf");if(void 0!==E&&E>v+w)throw new c('"nbf" claim timestamp check failed',s,"nbf",fe);const k=be(s,"exp");if(void 0!==k&&k<=v-w)throw new d('"exp" claim timestamp check failed',s,"exp",fe);if(void 0!==h){const e=v-b;if(e-w>we("maxTokenAge option","number"==typeof h?h:_e(h)))throw new d('"iat" claim timestamp check failed (too far in the past)',s,"iat",fe);if(e<-w)throw new c('"iat" claim timestamp check failed (it should be in the past)',s,"iat",fe)}return s}let Ie;function Te(e){return Ie.get(e)}async function Ae(e,t,n){const[s,i]=await async function(e,t,n){if(e instanceof Uint8Array&&(e=r.decode(e)),"string"!=typeof e)throw new h("Compact JWS must be a string or Uint8Array");const{0:s,1:i,2:o,length:a}=e.split(".");if(3!==a)throw new h("Invalid Compact JWS");return ue({payload:i,protected:s,signature:o},t,n,le)}(e,function(e){return[e&&T("algorithms",e.algorithms),e?.crit]}(n),t);if(!i)throw new p("JWTs MUST NOT use unencoded payload");const o=ke(s.protectedHeader,s.payload,n);return{...s,payload:o}}async function Ue(e,r,n){let[i,a,c,d]=e,l="";if(void 0!==a){const e=R(h,a);a=e[0],l=v(e[1])}if(void 0!==c&&(c=R(h,c)[0]),!a&&!c)throw new h("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!E(a,c))throw new h("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const u={...a,...c};!function(e,t){const{crit:r}=t??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}(h,a);const p=U(a,A(h,I,d,a,u));p||n?.();const{alg:g}=u;if("string"!=typeof g||!g)throw new h('JWS "alg" (Algorithm) Header Parameter missing or invalid');const f=ce(g);let y,_="",w=i;p&&(_=v(i),y=t.encode(`${l}.${_}`)),y??=s(o(l),o("."),w);const m=await M(await P(f,r,"sign"),f.subtle,"sign");f.minRsaBits&&j(f.alg,m);const S={signature:v(new Uint8Array(await crypto.subtle.sign(f.signing,m,y))),payload:_};return a&&(S.protected=l),c&&(S.header=c),[S,p]}const Re=class{constructor(e={}){if(!S(e))throw new TypeError("JWT Claims Set MUST be an object");(Ie||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return me("iss",e),Te(this).iss=e,this}setSubject(e){return me("sub",e),Te(this).sub=e,this}setAudience(e){return function(e){if("string"!=typeof e&&(!Array.isArray(e)||Array.from(e).some(e=>"string"!=typeof e)))throw new TypeError('"aud" claim must be a string or an array of strings')}(e),Te(this).aud=e,this}setJti(e){return me("jti",e),Te(this).jti=e,this}setNotBefore(e){return Te(this).nbf=ve(e,"setNotBefore"),this}setExpirationTime(e){return Te(this).exp=ve(e,"setExpirationTime"),this}setIssuedAt(e){const t=Te(this);return t.iat=void 0===e?he(new Date):"string"==typeof e?we("setIssuedAt",he(new Date)+_e(e)):ve(e,"setIssuedAt"),this}};class Pe extends Re{#e;setProtectedHeader(e){return function(e,t){if(void 0!==e)throw new TypeError(`${t} can only be called once`)}(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,r){return async function(e,t,r,n,s){const[i]=await Ue([e,t,void 0,r],n,s);return`${i.protected}.${i.payload}.${i.signature}`}(function(e){const r=Te(e);for(const e of["iat","nbf","exp"]){const t=r[e];if("number"==typeof t&&!Number.isFinite(t))throw new TypeError(`"${e}" claim must be a finite number`)}return t.encode(JSON.stringify(r))}(this),this.#e,r?.crit,e,()=>{throw new p("JWTs MUST NOT use unencoded payload")})}}const Ce='"alg" (Algorithm)';function xe(e='JWK "alg" (Algorithm) Parameter'){throw new u(`Invalid or unsupported ${e} value`)}async function Oe(e){if(N(e)){if("secret"!==e.type)return e.export({format:"jwk"});e=e.export()}if(e instanceof Uint8Array)return{kty:"oct",k:v(e)};if(!O(e))throw new TypeError(((e,...t)=>$("Key must be ",e,...t))(e,"CryptoKey","KeyObject","Uint8Array"));if(!e.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");const t=await crypto.subtle.exportKey("jwk",e);delete t.ext,delete t.key_ops,delete t.use,"AKP"!==t.kty&&delete t.alg;for(const e of Object.keys(t))void 0===t[e]&&delete t[e];return t}async function Ne(e,t,r){const n=e.get(t)||e.set(t,{}).get(t),{alg:s}=r;if(void 0===n[s]){const e=W(r,t,!0).then(e=>{if("public"!==e.type)throw new g("JSON Web Key Set members must be public keys");return n[s]=e,e}).catch(t=>{throw n[s]===e&&delete n[s],t});n[s]=e}return n[s]}function Ke(e){let t;try{t=structuredClone(e)}catch{}if(!b(t))throw new g("JSON Web Key Set malformed");const r=t.keys.map(e=>{const t=J(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),n=new WeakMap;return Object.defineProperty(async(e,s)=>{const{alg:i,kid:o}={...e,...s?.header},a="string"==typeof i?ae[i]:void 0;if(!a||a.secret)throw new u('Unsupported "alg" value for a JSON Web Key Set');const c=t.keys.filter((e,t)=>function(e,t,r,n){const{kty:s,key_ops:i,ext:o,kid:a,alg:c,use:d,crv:l}=e;return(void 0===o||"boolean"==typeof o)&&(void 0===i||Array.isArray(i)&&i.every((e,t)=>"string"==typeof e&&i.indexOf(e)===t)&&i.includes("verify"))&&t.kty.includes(s)&&(void 0===n||"string"==typeof n&&n===a)&&(void 0===c?"AKP"!==s:r===c)&&(void 0===d||"sig"===d)&&(!t.crv||l===t.crv)}(r[t],a,i,o)),{0:d,length:l}=c;if(!l)throw new f;if(1!==l){const e=new y;throw e[Symbol.asyncIterator]=async function*(){for(const e of c)try{yield await Ne(n,e,a)}catch{}},e}return Ne(n,d,a)},"jwks",{value:()=>structuredClone(t)})}let $e;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&($e="jose/v6.2.12");const Le=Symbol();const He=Symbol();function je(e,t){return Number.isFinite(e)&&Date.now()<e+t}function De(e,t,r){if(Number.isNaN(e))throw new TypeError(`"${r}" option must not be NaN`);return"number"==typeof e?e:t}function Je(e,t){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");const r=new URL(e.href).href,n={},s=n.timeoutDuration;if("number"==typeof s&&(!Number.isInteger(s)||s<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');const i="number"==typeof s?s:5e3,o=De(n.cooldownDuration,3e4,"cooldownDuration"),c=De(n.cacheMaxAge,6e5,"cacheMaxAge"),d=new Headers(n.headers);$e&&!d.has("User-Agent")&&d.set("User-Agent",$e),d.has("accept")||d.set("accept","application/json, application/jwk-set+json");const l=n[Le],u=n[He];let h,p,g,y=0,w=0;if(u&&"object"==typeof u){const{uat:e,jwks:t}=u;je(e,c)&&b(t)&&(h=e,g=Ke(t))}const m=async()=>{if(p&&(typeof WebSocketPair<"u"||typeof navigator<"u"&&"Cloudflare-Workers"===navigator.userAgent||typeof EdgeRuntime<"u"&&"vercel"===EdgeRuntime)&&(p=void 0),!p){const e=++y,t=p=async function(e,t,r,n=fetch){const s=await n(e,{method:"GET",signal:r,redirect:"manual",headers:t}).catch(e=>{throw"TimeoutError"===e.name?new _:e});if(200!==s.status)throw new a("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await s.json()}catch{throw new a("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(r,d,AbortSignal.timeout(i),l).then(t=>{const r=Ke(t);if(e<=w)return;g=r;const n=Date.now();u&&(u.uat=n,u.jwks=t),h=n,w=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!je(h,c))&&await m();try{return await g(e,t)}catch(r){if(r instanceof f&&!je(h,o))return await m(),g(e,t);throw r}},{coolingDown:{get:()=>je(h,o),enumerable:!0},fresh:{get:()=>je(h,c),enumerable:!0},reload:{value:m,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}function We(e){const t=e?.modulusLength??2048;if("number"!=typeof t||!Number.isInteger(t)||t<2048)throw new u("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return t}async function Me(e,t){const r=t?.extractable,n=function(e,t){return("string"==typeof e?ae[e]??Y[e]:void 0)??xe(t)}(e,Ce);let s;if(n.secret&&xe(Ce),n.resolve){const e=t?.crv??"P-256";if(!["P-256","P-384","P-521","X25519"].includes(e))throw new u("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");s=n.resolve({crv:e})}else{if(void 0!==n.crv&&void 0!==t?.crv&&t.crv!==n.crv)throw new u(`Invalid or unsupported crv option provided, the only supported value for ${e} is ${n.crv}`);s="RSA"===n.kty[0]?{...n.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:We(t)}:n.subtle}return crypto.subtle.generateKey(s,r,[...n.usages[1],...n.usages[0]])}const qe=[];for(let e=0;e<256;++e)qe.push((e+256).toString(16).slice(1));const Fe=new Uint8Array(16);function Be(e,t,r){return crypto.randomUUID?crypto.randomUUID():function(e){e=e||{};const t=e.random??e.rng?.()??crypto.getRandomValues(Fe);if(t.length<16)throw new Error("Random bytes length must be >= 16");return t[6]=15&t[6]|64,t[8]=63&t[8]|128,function(e,t=0){return(qe[e[t+0]]+qe[e[t+1]]+qe[e[t+2]]+qe[e[t+3]]+"-"+qe[e[t+4]]+qe[e[t+5]]+"-"+qe[e[t+6]]+qe[e[t+7]]+"-"+qe[e[t+8]]+qe[e[t+9]]+"-"+qe[e[t+10]]+qe[e[t+11]]+qe[e[t+12]]+qe[e[t+13]]+qe[e[t+14]]+qe[e[t+15]]).toLowerCase()}(t)}(e)}const ze="solidClientAuthn:",Ve=["ES256","RS256"],Ge={ERROR:"error",LOGIN:"login",LOGOUT:"logout",NEW_REFRESH_TOKEN:"newRefreshToken",NEW_TOKENS:"newTokens",AUTHORIZATION_REQUEST:"authorizationRequest",SESSION_EXPIRED:"sessionExpired",SESSION_EXTENDED:"sessionExtended",SESSION_RESTORED:"sessionRestore",TIMEOUT_SET:"timeoutSet"},Xe=["openid","offline_access","webid"];class Qe{handleables;constructor(e){this.handleables=e,this.handleables=e}async getProperHandler(e){const t=await Promise.all(this.handleables.map(t=>t.canHandle(...e)));for(let e=0;e<t.length;e+=1)if(t[e])return this.handleables[e];return null}async canHandle(...e){return null!==await this.getProperHandler(e)}async handle(...e){const t=await this.getProperHandler(e);if(t)return t.handle(...e);throw new Error(`[${this.constructor.name}] cannot find a suitable handler for: ${e.map(e=>{try{return JSON.stringify(e)}catch(t){return e.toString()}}).join(", ")}`)}}async function Ye(e,t,r,n){let s,i;try{const{payload:i}=await Ae(e,Je(new URL(t)),{issuer:r,audience:n});s=i}catch(e){throw new Error(`Token verification failed: ${e.stack}`)}if("string"==typeof s.azp&&(i=s.azp),"string"==typeof s.webid)return{webId:s.webid,clientId:i};if("string"!=typeof s.sub)throw new Error(`The token ${JSON.stringify(s)} is invalid: it has no 'webid' claim and no 'sub' claim.`);try{return new URL(s.sub),{webId:s.sub,clientId:i}}catch(e){throw new Error(`The token has no 'webid' claim, and its 'sub' claim of [${s.sub}] is invalid as a URL - error [${e}].`)}}function Ze(e){try{const t=new URL(e),r=!t.searchParams.has("code")&&!t.searchParams.has("state"),n=""===t.hash;return r&&n}catch(e){return!1}}function et(e){const t=new URL(e);return t.searchParams.delete("state"),t.searchParams.delete("code"),t.searchParams.delete("error"),t.searchParams.delete("error_description"),t.searchParams.delete("iss"),t}class tt{storageUtility;redirector;constructor(e,t){this.storageUtility=e,this.redirector=t,this.storageUtility=e,this.redirector=t}parametersGuard=e=>void 0!==e.issuerConfiguration.grantTypesSupported&&e.issuerConfiguration.grantTypesSupported.indexOf("authorization_code")>-1&&void 0!==e.redirectUrl;async canHandle(e){return this.parametersGuard(e)}async setupRedirectHandler({oidcLoginOptions:e,state:t,codeVerifier:r,targetUrl:n}){if(!this.parametersGuard(e))throw new Error("The authorization code grant requires a redirectUrl.");var s,i;await Promise.all([this.storageUtility.setForUser(t,{sessionId:e.sessionId}),this.storageUtility.setForUser(e.sessionId,{codeVerifier:r,issuer:e.issuer.toString(),redirectUrl:e.redirectUrl,dpop:Boolean(e.dpop).toString(),keepAlive:(s=e.keepAlive,i=!0,"boolean"==typeof s?Boolean(s):Boolean(i)).toString()})]),this.redirector.redirect(n,{handleRedirect:e.handleRedirect})}}class rt{sessionInfoManager;constructor(e){this.sessionInfoManager=e,this.sessionInfoManager=e}async canHandle(){return!0}async handle(e){await this.sessionInfoManager.clear(e)}}class nt{redirector;constructor(e){this.redirector=e,this.redirector=e}async canHandle(e,t){return"idp"===t?.logoutType}async handle(e,t){if("idp"!==t?.logoutType)throw new Error("Attempting to call idp logout handler to perform app logout");if(void 0===t.toLogoutUrl)throw new Error("Cannot perform IDP logout. Did you log in using the OIDC authentication flow?");this.redirector.redirect(t.toLogoutUrl(t),{handleRedirect:t.handleRedirect})}}class st{handlers;constructor(e,t){this.handlers=[new rt(e),new nt(t)]}async canHandle(){return!0}async handle(e,t){for(const r of this.handlers)await r.canHandle(e,t)&&await r.handle(e,t)}}function it(){return{isLoggedIn:!1,sessionId:Be(),fetch:(...e)=>fetch(...e)}}async function ot(e,t){await Promise.all([t.deleteAllUserData(e,{secure:!1}),t.deleteAllUserData(e,{secure:!0})])}class at{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}update(e,t){throw new Error("Not Implemented")}set(e,t){throw new Error("Not Implemented")}get(e){throw new Error("Not implemented")}async getAll(){throw new Error("Not implemented")}async clear(e){return ot(e,this.storageUtility)}async register(e){throw new Error("Not implemented")}async getRegisteredSessionIdAll(){throw new Error("Not implemented")}async clearAll(){throw new Error("Not implemented")}async setOidcContext(e,t){throw new Error("Not implemented")}}function ct({endSessionEndpoint:e,idTokenHint:t}){if(void 0!==e)return function({state:r,postLogoutUrl:n}){return function({endSessionEndpoint:e,idTokenHint:t,postLogoutRedirectUri:r,state:n}){const s=new URL(e);return void 0!==t&&s.searchParams.append("id_token_hint",t),void 0!==r&&(s.searchParams.append("post_logout_redirect_uri",r),void 0!==n&&s.searchParams.append("state",n)),s.toString()}({endSessionEndpoint:e,idTokenHint:t,state:r,postLogoutRedirectUri:n})}}function dt(e){try{return new URL(e),!0}catch{return!1}}async function lt(e,t,r,n){let s;if(function(e,t){return t.scopesSupported.includes("webid")&&void 0!==e.clientId&&dt(e.clientId)}(e,t))s={clientId:e.clientId,clientName:e.clientName,clientType:"solid-oidc"};else{if(!function(e){return void 0!==e.clientId&&!dt(e.clientId)}(e))return n.getClient({sessionId:e.sessionId,clientName:e.clientName,redirectUrl:e.redirectUrl},t);s={clientId:e.clientId,clientSecret:e.clientSecret,clientName:e.clientName,clientType:"static"}}const i={clientId:s.clientId,clientType:s.clientType};return"static"===s.clientType&&(i.clientSecret=s.clientSecret),s.clientName&&(i.clientName=s.clientName),await r.setForUser(e.sessionId,i),s}const ut=(e,t)=>fetch(e,t);let ht=class{loginHandler;redirectHandler;logoutHandler;sessionInfoManager;issuerConfigFetcher;boundLogout;constructor(e,t,r,n,s){this.loginHandler=e,this.redirectHandler=t,this.logoutHandler=r,this.sessionInfoManager=n,this.issuerConfigFetcher=s,this.loginHandler=e,this.redirectHandler=t,this.logoutHandler=r,this.sessionInfoManager=n,this.issuerConfigFetcher=s}fetch=ut;logout=async(e,t)=>{await this.logoutHandler.handle(e,"idp"===t?.logoutType?{...t,toLogoutUrl:this.boundLogout}:t),this.fetch=ut,delete this.boundLogout};getSessionInfo=async e=>this.sessionInfoManager.get(e);getAllSessionInfo=async()=>this.sessionInfoManager.getAll()};async function pt(e,t,r){try{const[n,s,i,o,a]=await Promise.all([t.getForUser(e,"issuer",{errorIfNull:!0}),t.getForUser(e,"codeVerifier"),t.getForUser(e,"redirectUrl"),t.getForUser(e,"dpop",{errorIfNull:!0}),t.getForUser(e,"keepAlive")]);await t.deleteForUser(e,"codeVerifier");return{codeVerifier:s,redirectUrl:i,issuerConfig:await r.fetchConfig(n),dpop:"true"===o,keepAlive:"string"!=typeof a||"true"===a}}catch(t){throw new Error(`Failed to retrieve OIDC context from storage associated with session [${e}]: ${t}`)}}class gt{secureStorage;insecureStorage;constructor(e,t){this.secureStorage=e,this.insecureStorage=t,this.secureStorage=e,this.insecureStorage=t}getKey(e){return`solidClientAuthenticationUser:${e}`}async getUserData(e,t){const r=await(t?this.secureStorage:this.insecureStorage).get(this.getKey(e));if(void 0===r)return{};try{return JSON.parse(r)}catch(n){throw new Error(`Data for user [${e}] in [${t?"secure":"unsecure"}] storage is corrupted - expected valid JSON, but got: ${r}`)}}async setUserData(e,t,r){await(r?this.secureStorage:this.insecureStorage).set(this.getKey(e),JSON.stringify(t))}async get(e,t){const r=await(t?.secure?this.secureStorage:this.insecureStorage).get(e);if(void 0===r&&t?.errorIfNull)throw new Error(`[${e}] is not stored`);return r}async set(e,t,r){return(r?.secure?this.secureStorage:this.insecureStorage).set(e,t)}async delete(e,t){return(t?.secure?this.secureStorage:this.insecureStorage).delete(e)}async getForUser(e,t,r){const n=await this.getUserData(e,r?.secure);let s;if(n&&n[t]||(s=void 0),s=n[t],void 0===s&&r?.errorIfNull)throw new Error(`Field [${t}] for user [${e}] is not stored`);return s||void 0}async setForUser(e,t,r){let n;try{n=await this.getUserData(e,r?.secure)}catch{n={}}await this.setUserData(e,{...n,...t},r?.secure)}async deleteForUser(e,t,r){const n=await this.getUserData(e,r?.secure);delete n[t],await this.setUserData(e,n,r?.secure)}async deleteAllUserData(e,t){await(t?.secure?this.secureStorage:this.insecureStorage).delete(this.getKey(e))}}class ft{map={};async get(e){return this.map[e]||void 0}async set(e,t){this.map[e]=t}async delete(e){delete this.map[e]}}class yt extends Error{constructor(e){super(e)}}class _t extends Error{constructor(e){super(`[${e}] is not implemented`)}}class wt extends Error{missingFields;constructor(e){super(`Invalid response from OIDC provider: missing fields ${e}`),this.missingFields=e}}class mt extends Error{error;errorDescription;constructor(e,t,r){super(e),this.error=t,this.errorDescription=r}}function vt(e){const t=new URL(e);return new URL(t.pathname,t.origin).toString()}async function St(e,t,r){return new Pe({htu:vt(e),htm:t.toUpperCase(),jti:Be()}).setProtectedHeader({alg:Ve[0],jwk:r.publicKey,typ:"dpop+jwt"}).setIssuedAt().sign(r.privateKey,{})}async function bt(e,t,r,n){if(void 0!==r)return async function(e,t,r,n){const s=new Headers(n?.headers);return s.set("Authorization",`DPoP ${t}`),s.set("DPoP",await St(e,n?.method??"get",r)),{...n,headers:s}}(e,t,r,n);const s=new Headers(n?.headers);return s.set("Authorization",`Bearer ${t}`),{...n,headers:s}}async function Et(e,t,r,n,s=fetch){return s(t,await bt(t.toString(),e,n,r))}const kt=e=>void 0!==e?e-5>0?e-5:e:600;function It(e,t){let r,n=e;const s=t?.refreshOptions,i=t?.eventEmitter;if(void 0!==t&&void 0!==s){const e=async()=>{try{const{accessToken:o,refreshToken:a,expiresIn:c}=await async function(e,t,r){const n=await e.tokenRefresher.refresh(e.sessionId,e.refreshToken,t);return r?.emit(Ge.SESSION_EXTENDED,n.expiresIn??600),{accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn}}(s,t.dpopKey,i);n=o,void 0!==a&&(s.refreshToken=a),clearTimeout(r),r=setTimeout(e,1e3*kt(c)),t.eventEmitter?.emit(Ge.TIMEOUT_SET,r)}catch(e){e instanceof mt&&(i?.emit(Ge.ERROR,e.error,e.errorDescription),i?.emit(Ge.SESSION_EXPIRED)),e instanceof wt&&e.missingFields.includes("access_token")&&i?.emit(Ge.SESSION_EXPIRED)}};r=setTimeout(e,1e3*kt(t.expiresIn)),i?.emit(Ge.TIMEOUT_SET,r)}else if(void 0!==i){const e=setTimeout(()=>{i.emit(Ge.SESSION_EXPIRED)},1e3*kt(t?.expiresIn));i.emit(Ge.TIMEOUT_SET,e)}return async(e,r)=>{let s=await Et(n,e,r,t?.dpopKey,t?.fetch);const i=!s.ok&&(o=s.status,![401,403].includes(o));var o;if(s.ok||i)return s;return s.url!==e&&void 0!==t?.dpopKey&&(s=await Et(n,s.url,r,t.dpopKey,t.fetch)),s}}const Tt=[];for(let e=0;e<256;++e)Tt.push((e+256).toString(16).slice(1));const At=new Uint8Array(16);function Ut(e,t,r){return crypto.randomUUID?crypto.randomUUID():function(e){e=e||{};const t=e.random??e.rng?.()??crypto.getRandomValues(At);if(t.length<16)throw new Error("Random bytes length must be >= 16");return t[6]=15&t[6]|64,t[8]=63&t[8]|128,function(e,t=0){return(Tt[e[t+0]]+Tt[e[t+1]]+Tt[e[t+2]]+Tt[e[t+3]]+"-"+Tt[e[t+4]]+Tt[e[t+5]]+"-"+Tt[e[t+6]]+Tt[e[t+7]]+"-"+Tt[e[t+8]]+Tt[e[t+9]]+"-"+Tt[e[t+10]]+Tt[e[t+11]]+Tt[e[t+12]]+Tt[e[t+13]]+Tt[e[t+14]]+Tt[e[t+15]]).toLowerCase()}(t)}(e)}function Rt(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var Pt,Ct={exports:{}};var xt=function(){if(Pt)return Ct.exports;Pt=1;var e,t="object"==typeof Reflect?Reflect:null,r=t&&"function"==typeof t.apply?t.apply:function(e,t,r){return Function.prototype.apply.call(e,t,r)};e=t&&"function"==typeof t.ownKeys?t.ownKeys:Object.getOwnPropertySymbols?function(e){return Object.getOwnPropertyNames(e).concat(Object.getOwnPropertySymbols(e))}:function(e){return Object.getOwnPropertyNames(e)};var n=Number.isNaN||function(e){return e!=e};function s(){s.init.call(this)}Ct.exports=s,Ct.exports.once=function(e,t){return new Promise(function(r,n){function s(r){e.removeListener(t,i),n(r)}function i(){"function"==typeof e.removeListener&&e.removeListener("error",s),r([].slice.call(arguments))}g(e,t,i,{once:!0}),"error"!==t&&function(e,t,r){"function"==typeof e.on&&g(e,"error",t,r)}(e,s,{once:!0})})},s.EventEmitter=s,s.prototype._events=void 0,s.prototype._eventsCount=0,s.prototype._maxListeners=void 0;var i=10;function o(e){if("function"!=typeof e)throw new TypeError('The "listener" argument must be of type Function. Received type '+typeof e)}function a(e){return void 0===e._maxListeners?s.defaultMaxListeners:e._maxListeners}function c(e,t,r,n){var s,i,c,d;if(o(r),void 0===(i=e._events)?(i=e._events=Object.create(null),e._eventsCount=0):(void 0!==i.newListener&&(e.emit("newListener",t,r.listener?r.listener:r),i=e._events),c=i[t]),void 0===c)c=i[t]=r,++e._eventsCount;else if("function"==typeof c?c=i[t]=n?[r,c]:[c,r]:n?c.unshift(r):c.push(r),(s=a(e))>0&&c.length>s&&!c.warned){c.warned=!0;var l=new Error("Possible EventEmitter memory leak detected. "+c.length+" "+String(t)+" listeners added. Use emitter.setMaxListeners() to increase limit");l.name="MaxListenersExceededWarning",l.emitter=e,l.type=t,l.count=c.length,d=l,console&&console.warn&&console.warn(d)}return e}function d(){if(!this.fired)return this.target.removeListener(this.type,this.wrapFn),this.fired=!0,0===arguments.length?this.listener.call(this.target):this.listener.apply(this.target,arguments)}function l(e,t,r){var n={fired:!1,wrapFn:void 0,target:e,type:t,listener:r},s=d.bind(n);return s.listener=r,n.wrapFn=s,s}function u(e,t,r){var n=e._events;if(void 0===n)return[];var s=n[t];return void 0===s?[]:"function"==typeof s?r?[s.listener||s]:[s]:r?function(e){for(var t=new Array(e.length),r=0;r<t.length;++r)t[r]=e[r].listener||e[r];return t}(s):p(s,s.length)}function h(e){var t=this._events;if(void 0!==t){var r=t[e];if("function"==typeof r)return 1;if(void 0!==r)return r.length}return 0}function p(e,t){for(var r=new Array(t),n=0;n<t;++n)r[n]=e[n];return r}function g(e,t,r,n){if("function"==typeof e.on)n.once?e.once(t,r):e.on(t,r);else{if("function"!=typeof e.addEventListener)throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type '+typeof e);e.addEventListener(t,function s(i){n.once&&e.removeEventListener(t,s),r(i)})}}return Object.defineProperty(s,"defaultMaxListeners",{enumerable:!0,get:function(){return i},set:function(e){if("number"!=typeof e||e<0||n(e))throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received '+e+".");i=e}}),s.init=function(){void 0!==this._events&&this._events!==Object.getPrototypeOf(this)._events||(this._events=Object.create(null),this._eventsCount=0),this._maxListeners=this._maxListeners||void 0},s.prototype.setMaxListeners=function(e){if("number"!=typeof e||e<0||n(e))throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received '+e+".");return this._maxListeners=e,this},s.prototype.getMaxListeners=function(){return a(this)},s.prototype.emit=function(e){for(var t=[],n=1;n<arguments.length;n++)t.push(arguments[n]);var s="error"===e,i=this._events;if(void 0!==i)s=s&&void 0===i.error;else if(!s)return!1;if(s){var o;if(t.length>0&&(o=t[0]),o instanceof Error)throw o;var a=new Error("Unhandled error."+(o?" ("+o.message+")":""));throw a.context=o,a}var c=i[e];if(void 0===c)return!1;if("function"==typeof c)r(c,this,t);else{var d=c.length,l=p(c,d);for(n=0;n<d;++n)r(l[n],this,t)}return!0},s.prototype.addListener=function(e,t){return c(this,e,t,!1)},s.prototype.on=s.prototype.addListener,s.prototype.prependListener=function(e,t){return c(this,e,t,!0)},s.prototype.once=function(e,t){return o(t),this.on(e,l(this,e,t)),this},s.prototype.prependOnceListener=function(e,t){return o(t),this.prependListener(e,l(this,e,t)),this},s.prototype.removeListener=function(e,t){var r,n,s,i,a;if(o(t),void 0===(n=this._events))return this;if(void 0===(r=n[e]))return this;if(r===t||r.listener===t)0===--this._eventsCount?this._events=Object.create(null):(delete n[e],n.removeListener&&this.emit("removeListener",e,r.listener||t));else if("function"!=typeof r){for(s=-1,i=r.length-1;i>=0;i--)if(r[i]===t||r[i].listener===t){a=r[i].listener,s=i;break}if(s<0)return this;0===s?r.shift():function(e,t){for(;t+1<e.length;t++)e[t]=e[t+1];e.pop()}(r,s),1===r.length&&(n[e]=r[0]),void 0!==n.removeListener&&this.emit("removeListener",e,a||t)}return this},s.prototype.off=s.prototype.removeListener,s.prototype.removeAllListeners=function(e){var t,r,n;if(void 0===(r=this._events))return this;if(void 0===r.removeListener)return 0===arguments.length?(this._events=Object.create(null),this._eventsCount=0):void 0!==r[e]&&(0===--this._eventsCount?this._events=Object.create(null):delete r[e]),this;if(0===arguments.length){var s,i=Object.keys(r);for(n=0;n<i.length;++n)"removeListener"!==(s=i[n])&&this.removeAllListeners(s);return this.removeAllListeners("removeListener"),this._events=Object.create(null),this._eventsCount=0,this}if("function"==typeof(t=r[e]))this.removeListener(e,t);else if(void 0!==t)for(n=t.length-1;n>=0;n--)this.removeListener(e,t[n]);return this},s.prototype.listeners=function(e){return u(this,e,!0)},s.prototype.rawListeners=function(e){return u(this,e,!1)},s.listenerCount=function(e,t){return"function"==typeof e.listenerCount?e.listenerCount(t):h.call(e,t)},s.prototype.listenerCount=h,s.prototype.eventNames=function(){return this._eventsCount>0?e(this._events):[]},Ct.exports}(),Ot=Rt(xt);class Nt extends gt{constructor(e,t){super(e,t)}}class Kt extends Error{}function $t(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw new Error("base64 string is not of the correct length")}try{return function(e){return decodeURIComponent(atob(e).replace(/(.)/g,(e,t)=>{let r=t.charCodeAt(0).toString(16).toUpperCase();return r.length<2&&(r="0"+r),"%"+r}))}(t)}catch(e){return atob(t)}}Kt.prototype.name="InvalidTokenError";var Lt,Ht,jt,Dt={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Jt=(e=>(e[e.NONE=0]="NONE",e[e.ERROR=1]="ERROR",e[e.WARN=2]="WARN",e[e.INFO=3]="INFO",e[e.DEBUG=4]="DEBUG",e))(Jt||{});(jt=Jt||(Jt={})).reset=function(){Lt=3,Ht=Dt},jt.setLevel=function(e){if(!(0<=e&&e<=4))throw new Error("Invalid log level");Lt=e},jt.setLogger=function(e){Ht=e};var Wt=class e{constructor(e){this._name=e}debug(...t){Lt>=4&&Ht.debug(e._format(this._name,this._method),...t)}info(...t){Lt>=3&&Ht.info(e._format(this._name,this._method),...t)}warn(...t){Lt>=2&&Ht.warn(e._format(this._name,this._method),...t)}error(...t){Lt>=1&&Ht.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){const t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,r){const n=new e(`${t}.${r}`);return n.debug("begin"),n}static _format(e,t){const r=`[${e}]`;return t?`${r} ${t}:`:r}static debug(t,...r){Lt>=4&&Ht.debug(e._format(t),...r)}static info(t,...r){Lt>=3&&Ht.info(e._format(t),...r)}static warn(t,...r){Lt>=2&&Ht.warn(e._format(t),...r)}static error(t,...r){Lt>=1&&Ht.error(e._format(t),...r)}};Jt.reset();var Mt=class{static decode(e){try{return function(e,t){if("string"!=typeof e)throw new Kt("Invalid token specified: must be a string");t||(t={});const r=!0===t.header?0:1,n=e.split(".")[r];if("string"!=typeof n)throw new Kt(`Invalid token specified: missing part #${r+1}`);let s;try{s=$t(n)}catch(e){throw new Kt(`Invalid token specified: invalid base64 for part #${r+1} (${e.message})`)}try{return JSON.parse(s)}catch(e){throw new Kt(`Invalid token specified: invalid json for part #${r+1} (${e.message})`)}}(e)}catch(e){throw Wt.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,r){const n=`${Bt.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}.${Bt.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}`,s=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},r,(new TextEncoder).encode(n));return`${n}.${Bt.encodeBase64Url(new Uint8Array(s))}`}static async generateSignedJwtWithHmac(e,t,r){const n=`${Bt.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}.${Bt.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}`,s=await window.crypto.subtle.sign("HMAC",r,(new TextEncoder).encode(n));return`${n}.${Bt.encodeBase64Url(new Uint8Array(s))}`}},qt=e=>btoa([...new Uint8Array(e)].map(e=>String.fromCharCode(e)).join("")),Ft=class e{static _randomWord(){const e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,t=>(+t^e._randomWord()&15>>+t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{const t=(new TextEncoder).encode(e),r=await crypto.subtle.digest("SHA-256",t);return qt(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw Wt.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){const r=(new TextEncoder).encode([e,t].join(":"));return qt(r)}static async hash(e,t){const r=(new TextEncoder).encode(t),n=await crypto.subtle.digest(e,r);return new Uint8Array(n)}static async customCalculateJwkThumbprint(t){let r;switch(t.kty){case"RSA":r={e:t.e,kty:t.kty,n:t.n};break;case"EC":r={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":r={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":r={crv:t.k,kty:t.kty};break;default:throw new Error("Unknown jwk type")}const n=await e.hash("SHA-256",JSON.stringify(r));return e.encodeBase64Url(n)}static async generateDPoPProof({url:t,accessToken:r,httpMethod:n,keyPair:s,nonce:i}){let o,a;const c={jti:window.crypto.randomUUID(),htm:null!=n?n:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};r&&(o=await e.hash("SHA-256",r),a=e.encodeBase64Url(o),c.ath=a),i&&(c.nonce=i);try{const e=await crypto.subtle.exportKey("jwk",s.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await Mt.generateSignedJwt(t,c,s.privateKey)}catch(e){throw e instanceof TypeError?new Error(`Error exporting dpop public key: ${e.message}`):e}}static async generateDPoPJkt(t){try{const r=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(r)}catch(e){throw e instanceof TypeError?new Error(`Could not retrieve dpop keys from storage: ${e.message}`):e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,r,n,s="HS256"){const i=Math.floor(Date.now()/1e3),o={alg:s,typ:"JWT"},a={iss:t,sub:t,aud:n,jti:e.generateUUIDv4(),exp:i+300,iat:i},c={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[s];if(!c)throw new Error(`Unsupported algorithm: ${s}. Supported algorithms are: HS256, HS384, HS512`);const d=new TextEncoder,l=await crypto.subtle.importKey("raw",d.encode(r),{name:"HMAC",hash:c},!1,["sign"]);return await Mt.generateSignedJwtWithHmac(o,a,l)}};Ft.encodeBase64Url=e=>qt(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var Bt=Ft,zt=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new Wt(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){const t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}async raise(...e){this._logger.debug("raise:",...e);for(const t of this._callbacks)await t(...e)}},Vt=class e extends zt{constructor(){super(...arguments),this._logger=new Wt(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{const t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){const r=this._logger.create("init");t=Math.max(Math.floor(t),1);const n=e.getEpochTime()+t;if(this.expiration===n&&this._timerHandle)return void r.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),r.debug("using duration",t),this._expiration=n;const s=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*s)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},Gt=class{static readParams(e,t="query"){if(!e)throw new TypeError("Invalid URL");const r=new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"];return new URLSearchParams(r.slice(1))}},Xt=";",Qt=class extends Error{constructor(e,t){var r,n,s;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw Wt.error("ErrorResponse","No error passed"),new Error("No error passed");this.error=e.error,this.error_description=null!=(r=e.error_description)?r:null,this.error_uri=null!=(n=e.error_uri)?n:null,this.state=e.userState,this.session_state=null!=(s=e.session_state)?s:null,this.url_state=e.url_state}},Yt=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},Zt=class{constructor(){this._logger=new Wt("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}},er=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},tr=class{constructor(e=[],t=null,r={}){this._jwtHandler=t,this._extraHeaders=r,this._logger=new Wt("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){const{timeoutInSeconds:r,...n}=t;if(!r)return await fetch(e,n);const s=new AbortController,i=setTimeout(()=>s.abort(),1e3*r);try{return await fetch(e,{...t,signal:s.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new Yt("Network timed out");throw e}finally{clearTimeout(i)}}async getJson(e,{token:t,credentials:r,timeoutInSeconds:n}={}){const s=this._logger.create("getJson"),i={Accept:this._contentTypes.join(", ")};let o;t&&(s.debug("token passed, setting Authorization header"),i.Authorization="Bearer "+t),this._appendExtraHeaders(i);try{s.debug("url:",e),o=await this.fetchWithTimeout(e,{method:"GET",headers:i,timeoutInSeconds:n,credentials:r})}catch(e){throw s.error("Network Error"),e}s.debug("HTTP response received, status",o.status);const a=o.headers.get("Content-Type");if(a&&!this._contentTypes.find(e=>a.startsWith(e))&&s.throw(new Error(`Invalid response Content-Type: ${null!=a?a:"undefined"}, from URL: ${e}`)),o.ok&&this._jwtHandler&&(null==a?void 0:a.startsWith("application/jwt")))return await this._jwtHandler(await o.text());let c;try{c=await o.json()}catch(e){if(s.error("Error parsing JSON response",e),o.ok)throw e;throw new Error(`${o.statusText} (${o.status})`)}if(!o.ok){if(s.error("Error from server:",c),c.error)throw new Qt(c);throw new Error(`${o.statusText} (${o.status}): ${JSON.stringify(c)}`)}return c}async postForm(e,{body:t,basicAuth:r,timeoutInSeconds:n,initCredentials:s,extraHeaders:i}){const o=this._logger.create("postForm"),a={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...i};let c;void 0!==r&&(a.Authorization="Basic "+r),this._appendExtraHeaders(a);try{o.debug("url:",e),c=await this.fetchWithTimeout(e,{method:"POST",headers:a,body:t,timeoutInSeconds:n,credentials:s})}catch(e){throw o.error("Network error"),e}o.debug("HTTP response received, status",c.status);const d=c.headers.get("Content-Type");if(d&&!this._contentTypes.find(e=>d.startsWith(e)))throw new Error(`Invalid response Content-Type: ${null!=d?d:"undefined"}, from URL: ${e}`);const l=await c.text();let u={};if(l)try{u=JSON.parse(l)}catch(e){if(o.error("Error parsing JSON response",e),c.ok)throw e;throw new Error(`${c.statusText} (${c.status})`)}if(!c.ok){if(o.error("Error from server:",u),c.headers.has("dpop-nonce")){const e=c.headers.get("dpop-nonce");throw new er(e,`${JSON.stringify(u)}`)}if(u.error)throw new Qt(u,t);throw new Error(`${c.statusText} (${c.status}): ${JSON.stringify(u)}`)}return u}_appendExtraHeaders(e){const t=this._logger.create("appendExtraHeaders"),r=Object.keys(this._extraHeaders),n=["accept","content-type"],s=["authorization"];0!==r.length&&r.forEach(r=>{if(n.includes(r.toLocaleLowerCase()))return void t.warn("Protected header could not be set",r,n);if(s.includes(r.toLocaleLowerCase())&&Object.keys(e).includes(r))return void t.warn("Header could not be overridden",r,s);const i="function"==typeof this._extraHeaders[r]?this._extraHeaders[r]():this._extraHeaders[r];i&&""!==i&&(e[r]=i)})}},rr=class{constructor(e){this._settings=e,this._logger=new Wt("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new tr(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){const e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(new Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);const t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){const r=this._logger.create(`_getMetadataProperty('${e}')`),n=await this.getMetadata();if(r.debug("resolved"),void 0===n[e]){if(!0===t)return void r.warn("Metadata does not contain optional property");r.throw(new Error("Metadata does not contain property "+e))}return n[e]}async getSigningKeys(){const e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;const t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);const r=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",r),!Array.isArray(r.keys))throw e.throw(new Error("Missing keys on keyset")),null;return this._signingKeys=r.keys,this._signingKeys}},nr=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new Wt("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){this._logger.create(`get('${e}')`),e=this._prefix+e;return await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;const t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");const e=await this._store.length,t=[];for(let r=0;r<e;r++){const e=await this._store.key(r);e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},sr=class{constructor({authority:e,metadataUrl:t,metadata:r,signingKeys:n,metadataSeed:s,client_id:i,client_secret:o,response_type:a="code",scope:c="openid",redirect_uri:d,post_logout_redirect_uri:l,client_authentication:u="client_secret_post",token_endpoint_auth_signing_alg:h="HS256",prompt:p,display:g,max_age:f,ui_locales:y,acr_values:_,resource:w,response_mode:m,filterProtocolClaims:v=!0,loadUserInfo:S=!1,requestTimeoutInSeconds:b,staleStateAgeInSeconds:E=900,mergeClaimsStrategy:k={array:"replace"},disablePKCE:I=!1,stateStore:T,revokeTokenAdditionalContentTypes:A,fetchRequestCredentials:U,refreshTokenAllowedScope:R,extraQueryParams:P={},extraTokenParams:C={},extraHeaders:x={},dpop:O,omitScopeWhenRequesting:N=!1}){var K;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=r,this.metadataSeed=s,this.signingKeys=n,this.client_id=i,this.client_secret=o,this.response_type=a,this.scope=c,this.redirect_uri=d,this.post_logout_redirect_uri=l,this.client_authentication=u,this.token_endpoint_auth_signing_alg=h,this.prompt=p,this.display=g,this.max_age=f,this.ui_locales=y,this.acr_values=_,this.resource=w,this.response_mode=m,this.filterProtocolClaims=null==v||v,this.loadUserInfo=!!S,this.staleStateAgeInSeconds=E,this.mergeClaimsStrategy=k,this.omitScopeWhenRequesting=N,this.disablePKCE=!!I,this.revokeTokenAdditionalContentTypes=A,this.fetchRequestCredentials=U||"same-origin",this.requestTimeoutInSeconds=b,T)this.stateStore=T;else{const e="undefined"!=typeof window?window.localStorage:new Zt;this.stateStore=new nr({store:e})}if(this.refreshTokenAllowedScope=R,this.extraQueryParams=P,this.extraTokenParams=C,this.extraHeaders=x,this.dpop=O,this.dpop&&!(null==(K=this.dpop)?void 0:K.store))throw new Error("A DPoPStore is required when dpop is enabled")}},ir=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new Wt("UserInfoService"),this._getClaimsFromJwt=async e=>{const t=this._logger.create("_getClaimsFromJwt");try{const r=Mt.decode(e);return t.debug("JWT decoding successful"),r}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new tr(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){const t=this._logger.create("getClaims");e||this._logger.throw(new Error("No token passed"));const r=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",r);const n=await this._jsonService.getJson(r,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",n),n}},or=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new Wt("TokenClient"),this._jsonService=new tr(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:r=this._settings.client_id,client_secret:n=this._settings.client_secret,extraHeaders:s,...i}){const o=this._logger.create("exchangeCode");r||o.throw(new Error("A client_id is required")),t||o.throw(new Error("A redirect_uri is required")),i.code||o.throw(new Error("A code is required"));const a=new URLSearchParams({grant_type:e,redirect_uri:t});for(const[e,t]of Object.entries(i))null!=t&&a.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==n)throw o.throw(new Error("A client_secret is required")),null;let c;const d=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":c=Bt.generateBasicAuth(r,n);break;case"client_secret_post":a.append("client_id",r),n&&a.append("client_secret",n);break;case"client_secret_jwt":{const e=await Bt.generateClientAssertionJwt(r,n,d,this._settings.token_endpoint_auth_signing_alg);a.append("client_id",r),a.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),a.append("client_assertion",e);break}}o.debug("got token endpoint");const l=await this._jsonService.postForm(d,{body:a,basicAuth:c,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:s});return o.debug("got response"),l}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,scope:n=this._settings.scope,...s}){const i=this._logger.create("exchangeCredentials");t||i.throw(new Error("A client_id is required"));const o=new URLSearchParams({grant_type:e});this._settings.omitScopeWhenRequesting||o.set("scope",n);for(const[e,t]of Object.entries(s))null!=t&&o.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw i.throw(new Error("A client_secret is required")),null;let a;const c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=Bt.generateBasicAuth(t,r);break;case"client_secret_post":o.append("client_id",t),r&&o.append("client_secret",r);break;case"client_secret_jwt":{const e=await Bt.generateClientAssertionJwt(t,r,c,this._settings.token_endpoint_auth_signing_alg);o.append("client_id",t),o.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),o.append("client_assertion",e);break}}i.debug("got token endpoint");const d=await this._jsonService.postForm(c,{body:o,basicAuth:a,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return i.debug("got response"),d}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,timeoutInSeconds:n,extraHeaders:s,...i}){const o=this._logger.create("exchangeRefreshToken");t||o.throw(new Error("A client_id is required")),i.refresh_token||o.throw(new Error("A refresh_token is required"));const a=new URLSearchParams({grant_type:e});for(const[e,t]of Object.entries(i))Array.isArray(t)?t.forEach(t=>a.append(e,t)):null!=t&&a.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw o.throw(new Error("A client_secret is required")),null;let c;const d=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":c=Bt.generateBasicAuth(t,r);break;case"client_secret_post":a.append("client_id",t),r&&a.append("client_secret",r);break;case"client_secret_jwt":{const e=await Bt.generateClientAssertionJwt(t,r,d,this._settings.token_endpoint_auth_signing_alg);a.append("client_id",t),a.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),a.append("client_assertion",e);break}}o.debug("got token endpoint");const l=await this._jsonService.postForm(d,{body:a,basicAuth:c,timeoutInSeconds:n,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:s});return o.debug("got response"),l}async revoke(e){var t;const r=this._logger.create("revoke");e.token||r.throw(new Error("A token is required"));const n=await this._metadataService.getRevocationEndpoint(!1);r.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);const s=new URLSearchParams;for(const[t,r]of Object.entries(e))null!=r&&s.set(t,r);s.set("client_id",this._settings.client_id),this._settings.client_secret&&s.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(n,{body:s,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),r.debug("got response")}},ar=class{constructor(e,t,r){this._settings=e,this._metadataService=t,this._claimsService=r,this._logger=new Wt("ResponseValidator"),this._userInfoService=new ir(this._settings,this._metadataService),this._tokenClient=new or(this._settings,this._metadataService)}async validateSigninResponse(e,t,r){const n=this._logger.create("validateSigninResponse");this._processSigninState(e,t),n.debug("state processed"),await this._processCode(e,t,r),n.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),n.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),n.debug("claims processed")}async validateCredentialsResponse(e,t){const r=this._logger.create("validateCredentialsResponse"),n=e.isOpenId&&!!e.id_token;n&&this._validateIdTokenAttributes(e),r.debug("tokens validated"),await this._processClaims(e,t,n),r.debug("claims processed")}async validateRefreshResponse(e,t){const r=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),r.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);const n=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,n),r.debug("claims processed")}validateSignoutResponse(e,t){const r=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&r.throw(new Error("State does not match")),r.debug("state validated"),e.userState=t.data,e.error)throw r.warn("Response was error",e.error),new Qt(e)}_processSigninState(e,t){const r=this._logger.create("_processSigninState");if(t.id!==e.state&&r.throw(new Error("State does not match")),t.client_id||r.throw(new Error("No client_id on state")),t.authority||r.throw(new Error("No authority on state")),this._settings.authority!==t.authority&&r.throw(new Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&r.throw(new Error("client_id mismatch on settings vs. signin state")),r.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw r.warn("Response was error",e.error),new Qt(e);t.code_verifier&&!e.code&&r.throw(new Error("Expected code in response"))}async _processClaims(e,t=!1,r=!0){const n=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void n.debug("not loading user info");n.debug("loading user info");const s=await this._userInfoService.getClaims(e.access_token);n.debug("user info claims received from user info endpoint"),r&&s.sub!==e.profile.sub&&n.throw(new Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(s)),n.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,r){const n=this._logger.create("_processCode");if(e.code){n.debug("Validating code");const s=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:r,...t.extraTokenParams});Object.assign(e,s)}else n.debug("No code to process")}_validateIdTokenAttributes(e,t,r){var n;const s=this._logger.create("_validateIdTokenAttributes");s.debug("decoding ID Token JWT");const i=Mt.decode(null!=(n=e.id_token)?n:"");if(i.sub||s.throw(new Error("ID Token is missing a subject claim")),r&&i.nonce!==r&&s.throw(new Error("nonce in id_token does not match nonce in client storage")),t){const e=Mt.decode(t);i.sub!==e.sub&&s.throw(new Error("sub in id_token does not match current sub")),i.auth_time&&i.auth_time!==e.auth_time&&s.throw(new Error("auth_time in id_token does not match original auth_time")),i.azp&&i.azp!==e.azp&&s.throw(new Error("azp in id_token does not match original azp")),!i.azp&&e.azp&&s.throw(new Error("azp not in id_token, but present in original id_token"))}e.profile=i}},cr=class e{constructor(e){this.id=e.id||Bt.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=Vt.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new Wt("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return Wt.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,r){const n=Wt.createStatic("State","clearStaleState"),s=Vt.getEpochTime()-r,i=await t.getAllKeys();n.debug("got keys",i);for(let r=0;r<i.length;r++){const o=i[r],a=await t.get(o);let c=!1;if(a)try{const t=await e.fromStorageString(a);n.debug("got item from key:",o,t.created),t.created<=s&&(c=!0)}catch(e){n.error("Error parsing state for key:",o,e),c=!0}else n.debug("no item in storage for key:",o),c=!0;c&&(n.debug("removed item for key:",o),t.remove(o))}}},dr=class e extends cr{constructor(e){super(e),this.code_verifier=e.code_verifier,this.code_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){const r=!0===t.code_verifier?Bt.generateCodeVerifier():t.code_verifier||void 0,n=r?await Bt.generateCodeChallenge(r):void 0;return new e({...t,code_verifier:r,code_challenge:n})}toStorageString(){return new Wt("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){Wt.createStatic("SigninState","fromStorageString");const r=JSON.parse(t);return e.create(r)}},lr=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:r,client_id:n,redirect_uri:s,response_type:i,scope:o,state_data:a,response_mode:c,request_type:d,client_secret:l,nonce:u,url_state:h,resource:p,skipUserInfo:g,extraQueryParams:f,extraTokenParams:y,disablePKCE:_,dpopJkt:w,omitScopeWhenRequesting:m,...v}){if(!t)throw this._logger.error("create: No url passed"),new Error("url");if(!n)throw this._logger.error("create: No client_id passed"),new Error("client_id");if(!s)throw this._logger.error("create: No redirect_uri passed"),new Error("redirect_uri");if(!i)throw this._logger.error("create: No response_type passed"),new Error("response_type");if(!o)throw this._logger.error("create: No scope passed"),new Error("scope");if(!r)throw this._logger.error("create: No authority passed"),new Error("authority");const S=await dr.create({data:a,request_type:d,url_state:h,code_verifier:!_,client_id:n,authority:r,redirect_uri:s,response_mode:c,client_secret:l,scope:o,extraTokenParams:y,skipUserInfo:g,nonce:u}),b=new URL(t);b.searchParams.append("client_id",n),b.searchParams.append("redirect_uri",s),b.searchParams.append("response_type",i),m||b.searchParams.append("scope",o),u&&b.searchParams.append("nonce",u),w&&b.searchParams.append("dpop_jkt",w);let E=S.id;if(h&&(E=`${E}${Xt}${h}`),b.searchParams.append("state",E),S.code_challenge&&(b.searchParams.append("code_challenge",S.code_challenge),b.searchParams.append("code_challenge_method","S256")),p){(Array.isArray(p)?p:[p]).forEach(e=>b.searchParams.append("resource",e))}for(const[e,t]of Object.entries({response_mode:c,...v,...f}))null!=t&&b.searchParams.append(e,t.toString());return new e({url:b.href,state:S})}};lr._logger=new Wt("SigninRequest");var ur=lr,hr=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(Xt);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(Xt))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-Vt.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+Vt.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},pr=class{constructor({url:e,state_data:t,id_token_hint:r,post_logout_redirect_uri:n,extraQueryParams:s,request_type:i,client_id:o,url_state:a}){if(this._logger=new Wt("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),new Error("url");const c=new URL(e);if(r&&c.searchParams.append("id_token_hint",r),o&&c.searchParams.append("client_id",o),n&&(c.searchParams.append("post_logout_redirect_uri",n),t||a)){this.state=new cr({data:t,request_type:i,url_state:a});let e=this.state.id;a&&(e=`${e}${Xt}${a}`),c.searchParams.append("state",e)}for(const[e,t]of Object.entries({...s}))null!=t&&c.searchParams.append(e,t.toString());this.url=c.href}},gr=class{constructor(e){if(this.state=e.get("state"),this.state){const e=decodeURIComponent(this.state).split(Xt);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(Xt))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},fr=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],yr=["sub","iss","aud","exp","iat"],_r=class{constructor(e){this._settings=e,this._logger=new Wt("ClaimsService")}filterProtocolClaims(e){const t={...e};if(this._settings.filterProtocolClaims){let e;e=Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:fr;for(const r of e)yr.includes(r)||delete t[r]}return t}mergeClaims(e,t){const r={...e};for(const[e,n]of Object.entries(t))if(r[e]!==n)if(Array.isArray(r[e])||Array.isArray(n))if("replace"==this._settings.mergeClaimsStrategy.array)r[e]=n;else{const t=Array.isArray(r[e])?r[e]:[r[e]];for(const e of Array.isArray(n)?n:[n])t.includes(e)||t.push(e);r[e]=t}else"object"==typeof r[e]&&"object"==typeof n?r[e]=this.mergeClaims(r[e],n):r[e]=n;return r}},wr=class{constructor(e,t){this.keys=e,this.nonce=t}},mr=class{constructor(e,t){this._logger=new Wt("OidcClient"),this.settings=e instanceof sr?e:new sr(e),this.metadataService=null!=t?t:new rr(this.settings),this._claimsService=new _r(this.settings),this._validator=new ar(this.settings,this.metadataService,this._claimsService),this._tokenClient=new or(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:r,request_type:n,id_token_hint:s,login_hint:i,skipUserInfo:o,nonce:a,url_state:c,response_type:d=this.settings.response_type,scope:l=this.settings.scope,redirect_uri:u=this.settings.redirect_uri,prompt:h=this.settings.prompt,display:p=this.settings.display,max_age:g=this.settings.max_age,ui_locales:f=this.settings.ui_locales,acr_values:y=this.settings.acr_values,resource:_=this.settings.resource,response_mode:w=this.settings.response_mode,extraQueryParams:m=this.settings.extraQueryParams,extraTokenParams:v=this.settings.extraTokenParams,dpopJkt:S,omitScopeWhenRequesting:b=this.settings.omitScopeWhenRequesting}){const E=this._logger.create("createSigninRequest");if("code"!==d)throw new Error("Only the Authorization Code flow (with PKCE) is supported");const k=await this.metadataService.getAuthorizationEndpoint();E.debug("Received authorization endpoint",k);const I=await ur.create({url:k,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:u,response_type:d,scope:l,state_data:e,url_state:c,prompt:h,display:p,max_age:g,ui_locales:f,id_token_hint:s,login_hint:i,acr_values:y,dpopJkt:S,resource:_,request:t,request_uri:r,extraQueryParams:m,extraTokenParams:v,request_type:n,response_mode:w,client_secret:this.settings.client_secret,skipUserInfo:o,nonce:a,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:b});await this.clearStaleState();const T=I.state;return await this.settings.stateStore.set(T.id,T.toStorageString()),I}async readSigninResponseState(e,t=!1){const r=this._logger.create("readSigninResponseState"),n=new hr(Gt.readParams(e,this.settings.response_mode));if(!n.state)throw r.throw(new Error("No state in response")),null;const s=await this.settings.stateStore[t?"remove":"get"](n.state);if(!s)throw r.throw(new Error("No matching state found in storage")),null;return{state:await dr.fromStorageString(s),response:n}}async processSigninResponse(e,t,r=!0){const n=this._logger.create("processSigninResponse"),{state:s,response:i}=await this.readSigninResponseState(e,r);if(n.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){const e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}try{await this._validator.validateSigninResponse(i,s,t)}catch(e){if(!(e instanceof er&&this.settings.dpop))throw e;{const r=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=r,await this._validator.validateSigninResponse(i,s,t)}}return i}async getDpopProof(e,t){let r,n;return(await e.getAllKeys()).includes(this.settings.client_id)?(n=await e.get(this.settings.client_id),n.nonce!==t&&t&&(n.nonce=t,await e.set(this.settings.client_id,n))):(r=await Bt.generateDPoPKeys(),n=new wr(r,t),await e.set(this.settings.client_id,n)),await Bt.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:n.keys,nonce:n.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:r=!1,extraTokenParams:n={}}){const s=await this._tokenClient.exchangeCredentials({username:e,password:t,...n}),i=new hr(new URLSearchParams);return Object.assign(i,s),await this._validator.validateCredentialsResponse(i,r),i}async useRefreshToken({state:e,redirect_uri:t,resource:r,timeoutInSeconds:n,extraHeaders:s,extraTokenParams:i}){var o;const a=this._logger.create("useRefreshToken");let c,d;if(void 0===this.settings.refreshTokenAllowedScope)c=e.scope;else{const t=this.settings.refreshTokenAllowedScope.split(" ");c=((null==(o=e.scope)?void 0:o.split(" "))||[]).filter(e=>t.includes(e)).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){const e=await this.getDpopProof(this.settings.dpop.store);s={...s,DPoP:e}}try{d=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:c,redirect_uri:t,resource:r,timeoutInSeconds:n,extraHeaders:s,...i})}catch(o){if(!(o instanceof er&&this.settings.dpop))throw o;s.DPoP=await this.getDpopProof(this.settings.dpop.store,o.nonce),d=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:c,redirect_uri:t,resource:r,timeoutInSeconds:n,extraHeaders:s,...i})}const l=new hr(new URLSearchParams);return Object.assign(l,d),a.debug("validating response",l),await this._validator.validateRefreshResponse(l,{...e,scope:c}),l}async createSignoutRequest({state:e,id_token_hint:t,client_id:r,request_type:n,url_state:s,post_logout_redirect_uri:i=this.settings.post_logout_redirect_uri,extraQueryParams:o=this.settings.extraQueryParams}={}){const a=this._logger.create("createSignoutRequest"),c=await this.metadataService.getEndSessionEndpoint();if(!c)throw a.throw(new Error("No end session endpoint")),null;a.debug("Received end session endpoint",c),r||!i||t||(r=this.settings.client_id);const d=new pr({url:c,id_token_hint:t,client_id:r,post_logout_redirect_uri:i,state_data:e,extraQueryParams:o,request_type:n,url_state:s});await this.clearStaleState();const l=d.state;return l&&(a.debug("Signout request has state to persist"),await this.settings.stateStore.set(l.id,l.toStorageString())),d}async readSignoutResponseState(e,t=!1){const r=this._logger.create("readSignoutResponseState"),n=new gr(Gt.readParams(e,this.settings.response_mode));if(!n.state){if(r.debug("No state in response"),n.error)throw r.warn("Response was error:",n.error),new Qt(n);return{state:void 0,response:n}}const s=await this.settings.stateStore[t?"remove":"get"](n.state);if(!s)throw r.throw(new Error("No matching state found in storage")),null;return{state:await cr.fromStorageString(s),response:n}}async processSignoutResponse(e){const t=this._logger.create("processSignoutResponse"),{state:r,response:n}=await this.readSignoutResponseState(e,!0);return r?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(n,r)):t.debug("No state from storage; skipping response validation"),n}clearStaleState(){return this._logger.create("clearStaleState"),cr.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}};function vr(e,t){if("string"!=typeof e.client_id)throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(e)}`);if(t.redirectUrl&&function(e){return Array.isArray(e.redirect_uris)&&e.redirect_uris.every(e=>"string"==typeof e)}(e)&&e.redirect_uris[0]!==t.redirectUrl.toString())throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(e.redirect_uris)} don't match the provided ${JSON.stringify([t.redirectUrl.toString()])}`);return!0}async function Sr(e,t){if(!t.registrationEndpoint)throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");if(!Array.isArray(t.idTokenSigningAlgValuesSupported))throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");const r=(n=t.idTokenSigningAlgValuesSupported,Ve.find(e=>n.includes(e))??null);var n;const s={client_name:e.clientName,application_type:"web",redirect_uris:[e.redirectUrl?.toString()],subject_type:"public",token_endpoint_auth_method:"client_secret_basic",id_token_signed_response_alg:r,grant_types:["authorization_code","refresh_token"]},i=await fetch(t.registrationEndpoint.toString(),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)});if(i.ok){const t=await i.json();return vr(t,e),{clientId:t.client_id,clientSecret:t.client_secret,expiresAt:t.client_secret_expires_at,idTokenSignedResponseAlg:t.id_token_signed_response_alg,clientType:"dynamic"}}throw 400===i.status&&function(e,t){if("invalid_redirect_uri"===e.error)throw new Error(`Dynamic client registration failed: the provided redirect uri [${t.redirectUrl?.toString()}] is invalid - ${e.error_description??""}`);if("invalid_client_metadata"===e.error)throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(t)} is invalid - ${e.error_description??""}`);throw new Error(`Dynamic client registration failed: ${e.error} - ${e.error_description??""}`)}(await i.json(),e),new Error(`Dynamic client registration failed: the server returned ${i.status} ${i.statusText} - ${await i.text()}`)}function br(e){return void 0!==e.error_description&&"string"==typeof e.error_description}function Er(e,t){if(void 0!==(r=e).error&&"string"==typeof r.error)throw new mt(`Token endpoint returned error [${e.error}]${br(e)?`: ${e.error_description}`:""}${function(e){return void 0!==e.error_uri&&"string"==typeof e.error_uri}(e)?` (see ${e.error_uri})`:""}`,e.error,br(e)?e.error_description:void 0);var r;if(!function(e){return void 0!==e.access_token&&"string"==typeof e.access_token}(e))throw new wt(["access_token"]);if(!function(e){return void 0!==e.id_token&&"string"==typeof e.id_token}(e))throw new wt(["id_token"]);if(!function(e){return void 0!==e.token_type&&"string"==typeof e.token_type}(e))throw new wt(["token_type"]);if(!function(e){return void 0===e.expires_in||"number"==typeof e.expires_in}(e))throw new wt(["expires_in"]);if(!t&&"bearer"!==e.token_type.toLowerCase())throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${e.token_type}].`);return e}async function kr(e,t,r,n){!function(e,t){if(t.grantType&&(!e.grantTypesSupported||!e.grantTypesSupported.includes(t.grantType)))throw new Error(`The issuer [${e.issuer}] does not support the [${t.grantType}] grant`);if(!e.tokenEndpoint)throw new Error(`This issuer [${e.issuer}] does not have a token endpoint`)}(e,r);const s={"content-type":"application/x-www-form-urlencoded"};let i;n&&(i=await async function(){const{privateKey:e,publicKey:t}=await Me(Ve[0],{extractable:!0}),r={privateKey:e,publicKey:await Oe(t)};return[r.publicKey.alg]=Ve,r}(),s.DPoP=await St(e.tokenEndpoint,"POST",i)),t.clientSecret&&(s.Authorization=`Basic ${btoa(`${t.clientId}:${t.clientSecret}`)}`);const o={grant_type:r.grantType,redirect_uri:r.redirectUrl,code:r.code,code_verifier:r.codeVerifier,client_id:t.clientId},a={method:"POST",headers:s,body:new URLSearchParams(o).toString()},c=await fetch(e.tokenEndpoint,a),d=Er(await c.json(),n),{webId:l,clientId:u}=await Ye(d.id_token,e.jwksUri,e.issuer,t.clientId);return{accessToken:d.access_token,idToken:d.id_token,refreshToken:(h=d,void 0!==h.refresh_token&&"string"==typeof h.refresh_token?d.refresh_token:void 0),webId:l,clientId:u,dpopKey:i,expiresIn:d.expires_in};var h}async function Ir(e,t,r,n){if(void 0===r.clientId)throw new Error("No client ID available when trying to refresh the access token.");const s={grant_type:"refresh_token",refresh_token:e};let i={};void 0!==n&&(i={DPoP:await St(t.tokenEndpoint,"POST",n)});let o={};void 0!==r.clientSecret?o={Authorization:`Basic ${btoa(`${r.clientId}:${r.clientSecret}`)}`}:(e=>{try{return new URL(e),!0}catch{return!1}})(r.clientId)&&(s.client_id=r.clientId);const a=await fetch(t.tokenEndpoint,{method:"POST",body:new URLSearchParams(s).toString(),headers:{...i,...o,"Content-Type":"application/x-www-form-urlencoded"}});let c;try{c=await a.json()}catch(e){throw new Error(`The token endpoint of issuer ${t.issuer} returned a malformed response.`)}const d=Er(c,void 0!==n),{webId:l}=await Ye(d.id_token,t.jwksUri,t.issuer,r.clientId);return{accessToken:d.access_token,idToken:d.id_token,refreshToken:"string"==typeof d.refresh_token?d.refresh_token:void 0,webId:l,dpopKey:n,expiresIn:d.expires_in}}class Tr extends ht{login=async(e,t)=>{"none"!==e.prompt&&await this.sessionInfoManager.clear(e.sessionId);const r=e.redirectUrl??function(e){const t=et(e);return t.hash="",e.includes(`${t.origin}/`)?t.href:`${t.origin}${t.href.substring(t.origin.length+1)}`}(window.location.href);if(!Ze(r))throw new Error(`${r} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);await this.loginHandler.handle({...e,redirectUrl:r,clientName:e.clientName??e.clientId,eventEmitter:t})};validateCurrentSession=async e=>{const t=await this.sessionInfoManager.get(e);return void 0===t||void 0===t.clientAppId||void 0===t.issuer||function(e){return void 0!==e.clientExpiresAt&&0!==e.clientExpiresAt&&e.clientExpiresAt<Math.floor(Date.now()/1e3)}(t)?null:t};handleIncomingRedirect=async(e,t)=>{try{const r=await this.redirectHandler.handle(e,t,void 0);return this.fetch=r.fetch.bind(window),this.boundLogout=r.getLogoutUrl,await this.cleanUrlAfterRedirect(e),{isLoggedIn:r.isLoggedIn,webId:r.webId,sessionId:r.sessionId,expirationDate:r.expirationDate,clientAppId:r.clientAppId}}catch(r){return await this.cleanUrlAfterRedirect(e),void t.emit(Ge.ERROR,"redirect",r)}};async cleanUrlAfterRedirect(e){const t=et(e).href;for(window.history.replaceState(null,"",t);window.location.href!==t;)await new Promise(e=>{setTimeout(()=>e(),1)})}}function Ar(e){return"string"==typeof e.oidcIssuer}function Ur(e){return"string"==typeof e.redirectUrl}class Rr{storageUtility;oidcHandler;issuerConfigFetcher;clientRegistrar;constructor(e,t,r,n){this.storageUtility=e,this.oidcHandler=t,this.issuerConfigFetcher=r,this.clientRegistrar=n,this.storageUtility=e,this.oidcHandler=t,this.issuerConfigFetcher=r,this.clientRegistrar=n}async canHandle(e){return Ar(e)&&Ur(e)}async handle(e){if(!Ar(e))throw new yt(`OidcLoginHandler requires an OIDC issuer: missing property 'oidcIssuer' in ${JSON.stringify(e)}`);if(!Ur(e))throw new yt(`OidcLoginHandler requires a redirect URL: missing property 'redirectUrl' in ${JSON.stringify(e)}`);const t=await this.issuerConfigFetcher.fetchConfig(e.oidcIssuer),r=await lt(e,t,this.storageUtility,this.clientRegistrar),n={issuer:t.issuer,dpop:"dpop"===e.tokenType.toLowerCase(),...e,issuerConfiguration:t,client:r,scopes:(s=e.customScopes,Array.isArray(s)?Array.from(new Set([...Xe,...s.filter(e=>"string"==typeof e&&!e.includes(" "))])):Xe)};var s;return this.oidcHandler.handle(n)}}class Pr extends tt{async handle(e){const t=e.redirectUrl??"",r={authority:e.issuer.toString(),client_id:e.client.clientId,client_secret:e.client.clientSecret,redirect_uri:t,response_type:"code",scope:e.scopes.join(" "),filterProtocolClaims:!0,loadUserInfo:!1,prompt:e.prompt??"consent"},n=new mr(r);try{const t=await n.createSigninRequest({});return await this.setupRedirectHandler({oidcLoginOptions:e,state:t.state.id,codeVerifier:t.state.code_verifier??"",targetUrl:t.url.toString()})}catch(e){console.error(e)}}}const Cr={issuer:{toKey:"issuer",convertToUrl:!0},authorization_endpoint:{toKey:"authorizationEndpoint",convertToUrl:!0},token_endpoint:{toKey:"tokenEndpoint",convertToUrl:!0},userinfo_endpoint:{toKey:"userinfoEndpoint",convertToUrl:!0},jwks_uri:{toKey:"jwksUri",convertToUrl:!0},registration_endpoint:{toKey:"registrationEndpoint",convertToUrl:!0},end_session_endpoint:{toKey:"endSessionEndpoint",convertToUrl:!0},scopes_supported:{toKey:"scopesSupported"},response_types_supported:{toKey:"responseTypesSupported"},response_modes_supported:{toKey:"responseModesSupported"},grant_types_supported:{toKey:"grantTypesSupported"},acr_values_supported:{toKey:"acrValuesSupported"},subject_types_supported:{toKey:"subjectTypesSupported"},id_token_signing_alg_values_supported:{toKey:"idTokenSigningAlgValuesSupported"},id_token_encryption_alg_values_supported:{toKey:"idTokenEncryptionAlgValuesSupported"},id_token_encryption_enc_values_supported:{toKey:"idTokenEncryptionEncValuesSupported"},userinfo_signing_alg_values_supported:{toKey:"userinfoSigningAlgValuesSupported"},userinfo_encryption_alg_values_supported:{toKey:"userinfoEncryptionAlgValuesSupported"},userinfo_encryption_enc_values_supported:{toKey:"userinfoEncryptionEncValuesSupported"},request_object_signing_alg_values_supported:{toKey:"requestObjectSigningAlgValuesSupported"},request_object_encryption_alg_values_supported:{toKey:"requestObjectEncryptionAlgValuesSupported"},request_object_encryption_enc_values_supported:{toKey:"requestObjectEncryptionEncValuesSupported"},token_endpoint_auth_methods_supported:{toKey:"tokenEndpointAuthMethodsSupported"},token_endpoint_auth_signing_alg_values_supported:{toKey:"tokenEndpointAuthSigningAlgValuesSupported"},display_values_supported:{toKey:"displayValuesSupported"},claim_types_supported:{toKey:"claimTypesSupported"},claims_supported:{toKey:"claimsSupported"},service_documentation:{toKey:"serviceDocumentation"},claims_locales_supported:{toKey:"claimsLocalesSupported"},ui_locales_supported:{toKey:"uiLocalesSupported"},claims_parameter_supported:{toKey:"claimsParameterSupported"},request_parameter_supported:{toKey:"requestParameterSupported"},request_uri_parameter_supported:{toKey:"requestUriParameterSupported"},require_request_uri_registration:{toKey:"requireRequestUriRegistration"},op_policy_uri:{toKey:"opPolicyUri",convertToUrl:!0},op_tos_uri:{toKey:"opTosUri",convertToUrl:!0}};class xr{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}static getLocalStorageKey(e){return`issuerConfig:${e}`}async fetchConfig(e){let t;const r=new URL(".well-known/openid-configuration",e.endsWith("/")?e:`${e}/`).href,n=await fetch(r);try{t=function(e){const t={};return Object.keys(e).forEach(r=>{Cr[r]&&(t[Cr[r].toKey]=e[r])}),Array.isArray(t.scopesSupported)||(t.scopesSupported=["openid"]),t}(await n.json())}catch(t){throw new yt(`[${e.toString()}] has an invalid configuration: ${t.message}`)}return await this.storageUtility.set(xr.getLocalStorageKey(e),JSON.stringify(t)),t}}async function Or(e,t){await ot(e,t),await async function(){const e=new nr({});await cr.clearStaleState(e,900);const t=window.localStorage,r=[];for(let e=0;e<=t.length;e+=1){const n=t.key(e);n&&(n.match(/^oidc\..+$/)||n.match(/^solidClientAuthenticationUser:.+$/))&&r.push(n)}r.forEach(e=>t.removeItem(e))}()}class Nr extends at{async get(e){const[t,r,n,s,i,o,a,c,d]=await Promise.all([this.storageUtility.getForUser(e,"isLoggedIn",{secure:!0}),this.storageUtility.getForUser(e,"webId",{secure:!0}),this.storageUtility.getForUser(e,"clientId",{secure:!1}),this.storageUtility.getForUser(e,"clientSecret",{secure:!1}),this.storageUtility.getForUser(e,"redirectUrl",{secure:!1}),this.storageUtility.getForUser(e,"refreshToken",{secure:!0}),this.storageUtility.getForUser(e,"issuer",{secure:!1}),this.storageUtility.getForUser(e,"tokenType",{secure:!1}),this.storageUtility.getForUser(e,"expiresAt",{secure:!1})]);if("string"!=typeof i||Ze(i)){if(void 0!==c&&("string"!=typeof(l=c)||!["DPoP","Bearer"].includes(l)))throw new Error(`Tokens of type [${c}] are not supported.`);var l;if(void 0!==n||void 0!==t||void 0!==r||void 0!==o)return{sessionId:e,webId:r,isLoggedIn:"true"===t,redirectUrl:i,refreshToken:o,issuer:a,clientAppId:n,clientAppSecret:s,tokenType:c??"DPoP",clientExpiresAt:void 0!==d?Number.parseInt(d,10):void 0}}else await Promise.all([this.storageUtility.deleteAllUserData(e,{secure:!1}),this.storageUtility.deleteAllUserData(e,{secure:!0})])}async clear(e){return Or(e,this.storageUtility)}}class Kr{async canHandle(e){try{return new URL(e),!0}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e){return it()}}class $r{storageUtility;sessionInfoManager;issuerConfigFetcher;clientRegistrar;tokerRefresher;constructor(e,t,r,n,s){this.storageUtility=e,this.sessionInfoManager=t,this.issuerConfigFetcher=r,this.clientRegistrar=n,this.tokerRefresher=s,this.storageUtility=e,this.sessionInfoManager=t,this.issuerConfigFetcher=r,this.clientRegistrar=n,this.tokerRefresher=s}async canHandle(e){try{const t=new URL(e);return null!==t.searchParams.get("code")&&null!==t.searchParams.get("state")}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e,t){if(!await this.canHandle(e))throw new Error(`AuthCodeRedirectHandler cannot handle [${e}]: it is missing one of [code, state].`);const r=new URL(e),n=r.searchParams.get("state"),s=await this.storageUtility.getForUser(n,"sessionId",{errorIfNull:!0}),{issuerConfig:i,codeVerifier:o,redirectUrl:a,dpop:c}=await pt(s,this.storageUtility,this.issuerConfigFetcher),d=r.searchParams.get("iss");if("string"==typeof d&&d!==i.issuer)throw new Error(`The value of the iss parameter (${d}) does not match the issuer identifier of the authorization server (${i.issuer}). See [rfc9207](https://www.rfc-editor.org/rfc/rfc9207.html#section-2.3-3.1.1)`);if(void 0===o)throw new Error(`The code verifier for session ${s} is missing from storage.`);if(void 0===a)throw new Error(`The redirect URL for session ${s} is missing from storage.`);const l=await this.clientRegistrar.getClient({sessionId:s},i),u=Date.now(),h=await kr(i,l,{grantType:"authorization_code",code:r.searchParams.get("code"),codeVerifier:o,redirectUrl:a},c);let p;window.localStorage.removeItem(`oidc.${n}`),void 0!==h.refreshToken&&(p={sessionId:s,refreshToken:h.refreshToken,tokenRefresher:this.tokerRefresher});const g=It(h.accessToken,{dpopKey:h.dpopKey,refreshOptions:p,eventEmitter:t,expiresIn:h.expiresIn});await async function(e,t,r,n,s,i,o){void 0!==r&&await e.setForUser(t,{webId:r},{secure:o}),void 0!==n&&await e.setForUser(t,{clientId:n},{secure:o}),await e.setForUser(t,{isLoggedIn:s},{secure:o})}(this.storageUtility,s,h.webId,h.clientId,"true",0,!0);const f=await this.sessionInfoManager.get(s);if(!f)throw new Error(`Could not retrieve session: [${s}].`);return Object.assign(f,{fetch:g,getLogoutUrl:ct({idTokenHint:h.idToken,endSessionEndpoint:i.endSessionEndpoint}),expirationDate:"number"==typeof h.expiresIn?u+1e3*h.expiresIn:void 0})}}class Lr extends Qe{constructor(e){super(e)}}class Hr{get storage(){return window.localStorage}async get(e){return this.storage.getItem(e)||void 0}async set(e,t){this.storage.setItem(e,t)}async delete(e){this.storage.removeItem(e)}}class jr{redirect(e,t){t&&t.handleRedirect?t.handleRedirect(e):t&&t.redirectByReplacingState?window.history.replaceState({},"",e):window.location.href=e}}class Dr{storageUtility;constructor(e){this.storageUtility=e,this.storageUtility=e}async getClient(e,t){const[r,n,s,i,o]=await Promise.all([this.storageUtility.getForUser(e.sessionId,"clientId",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientSecret",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"expiresAt",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientName",{secure:!1}),this.storageUtility.getForUser(e.sessionId,"clientType",{secure:!1})]),a=void 0!==s?Number.parseInt(s,10):-1,c=void 0!==n&&0!==a&&Math.floor(Date.now()/1e3)>a;if(r&&("string"==typeof(d=o)&&["dynamic","static","solid-oidc"].includes(d))&&!c)return void 0!==n?{clientId:r,clientSecret:n,clientName:i,clientType:"dynamic",expiresAt:a}:{clientId:r,clientName:i,clientType:o};var d;try{const r=await Sr(e,t),n={clientId:r.clientId,clientType:"dynamic"};return void 0!==r.clientSecret&&(n.clientSecret=r.clientSecret,n.expiresAt=String(r.expiresAt)),r.idTokenSignedResponseAlg&&(n.idTokenSignedResponseAlg=r.idTokenSignedResponseAlg),await this.storageUtility.setForUser(e.sessionId,n,{secure:!1}),r}catch(e){throw new Error("Client registration failed.",{cause:e})}}}class Jr{async canHandle(e){try{return new URL(e).searchParams.has("error")}catch(t){throw new Error(`[${e}] is not a valid URL, and cannot be used as a redirect URL: ${t}`)}}async handle(e,t){if(void 0!==t){const r=new URL(e),n=r.searchParams.get("error"),s=r.searchParams.get("error_description");t.emit(Ge.ERROR,n,s)}return it()}}class Wr{storageUtility;issuerConfigFetcher;clientRegistrar;constructor(e,t,r){this.storageUtility=e,this.issuerConfigFetcher=t,this.clientRegistrar=r,this.storageUtility=e,this.issuerConfigFetcher=t,this.clientRegistrar=r}async refresh(e,t,r,n){const s=await pt(e,this.storageUtility,this.issuerConfigFetcher),i=await this.clientRegistrar.getClient({sessionId:e},s.issuerConfig);if(void 0===t)throw new Error(`Session [${e}] has no refresh token to allow it to refresh its access token.`);if(s.dpop&&void 0===r)throw new Error(`For session [${e}], the key bound to the DPoP access token must be provided to refresh said access token.`);const o=await Ir(t,s.issuerConfig,i,r);return void 0!==o.refreshToken&&n?.emit(Ge.NEW_REFRESH_TOKEN,o.refreshToken),o}}function Mr(e){const t=new ft,r=e.secureStorage||t,n=e.insecureStorage||new Hr,s=new Nt(r,n),i=new xr(s),o=new Dr(s),a=new Nr(s),c=new Wr(s,i,o),d=new jr,l=new Rr(s,new Pr(s,d),i,o),u=new Lr([new Jr,new $r(s,a,i,o,c),new Kr]);return new Tr(l,u,new st(a,d),a,i)}const qr=`${ze}currentSession`,Fr=`${ze}currentUrl`;class Br{info;events;clientAuthentication;tokenRequestInProgress=!1;constructor(e={},t=void 0){this.events=new Ot,e.clientAuthentication?this.clientAuthentication=e.clientAuthentication:e.secureStorage&&e.insecureStorage?this.clientAuthentication=Mr({secureStorage:e.secureStorage,insecureStorage:e.insecureStorage}):this.clientAuthentication=Mr({}),e.sessionInfo?this.info={sessionId:e.sessionInfo.sessionId,isLoggedIn:!1,webId:e.sessionInfo.webId,clientAppId:e.sessionInfo.clientAppId}:this.info={sessionId:t??Ut(),isLoggedIn:!1},this.events.on(Ge.LOGIN,()=>window.localStorage.setItem(qr,this.info.sessionId)),this.events.on(Ge.SESSION_EXPIRED,()=>this.internalLogout(!1)),this.events.on(Ge.ERROR,()=>this.internalLogout(!1))}login=async e=>(await this.clientAuthentication.login({sessionId:this.info.sessionId,...e,tokenType:e.tokenType??"DPoP"},this.events),new Promise(()=>{}));fetch=(e,t)=>this.clientAuthentication.fetch(e,t);internalLogout=async(e,t)=>{window.localStorage.removeItem(qr),await this.clientAuthentication.logout(this.info.sessionId,t),this.info.isLoggedIn=!1,e&&this.events.emit(Ge.LOGOUT)};logout=async e=>this.internalLogout(!0,e);handleIncomingRedirect=async(e={})=>{if(this.info.isLoggedIn)return this.info;if(this.tokenRequestInProgress)return;const t="string"==typeof e?{url:e}:e,r=t.url??window.location.href;this.tokenRequestInProgress=!0;const n=await this.clientAuthentication.handleIncomingRedirect(r,this.events);if(function(e){return!!e?.isLoggedIn}(n)){this.setSessionInfo(n);const e=window.localStorage.getItem(Fr);null===e?this.events.emit(Ge.LOGIN):(window.localStorage.removeItem(Fr),this.events.emit(Ge.SESSION_RESTORED,e))}else if(!0===t.restorePreviousSession){const e=window.localStorage.getItem(qr);if(null!==e){if(await async function(e,t,r){const n=await t.validateCurrentSession(e);return null!==n&&(window.localStorage.setItem(Fr,window.location.href),await t.login({sessionId:e,prompt:"none",oidcIssuer:n.issuer,redirectUrl:n.redirectUrl,clientId:n.clientAppId,clientSecret:n.clientAppSecret,tokenType:n.tokenType??"DPoP"},r.events),!0)}(e,this.clientAuthentication,this))return new Promise(()=>{})}}return this.tokenRequestInProgress=!1,n};setSessionInfo(e){this.info.isLoggedIn=e.isLoggedIn,this.info.webId=e.webId,this.info.sessionId=e.sessionId,this.info.clientAppId=e.clientAppId,this.info.expirationDate=e.expirationDate,this.events.on(Ge.SESSION_EXTENDED,e=>{this.info.expirationDate=Date.now()+1e3*e})}}let zr;function Vr(){return void 0===zr&&(zr=new Br),zr}return e.ConfigurationError=yt,e.EVENTS=Ge,e.InMemoryStorage=ft,e.NotImplementedError=_t,e.Session=Br,e.events=function(){return Vr().events},e.fetch=function(...e){return Vr().fetch(...e)},e.getDefaultSession=Vr,e.handleIncomingRedirect=function(...e){return Vr().handleIncomingRedirect(...e)},e.login=function(...e){return Vr().login(...e)},e.logout=function(...e){return Vr().logout(...e)},e}({});
 //# sourceMappingURL=solid-client-authn.bundle.js.map