@muze-nl/metro-oidc 0.1.3 → 0.2.0

package/dist/browser.js

@@ -1,2 +1,2241 @@
-(()=>{var de=Object.defineProperty;var he=(e,n)=>{for(var t in n)de(e,t,{get:n[t],enumerable:!0})};var X={};he(X,{client:()=>me,formdata:()=>ie,metroError:()=>k,request:()=>K,response:()=>G,trace:()=>pe,url:()=>W});var B="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var E=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...n){for(let t of n)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let r in t)r=="middlewares"?this.#r(t[r]):typeof t[r]=="function"?this.#e[r]=t[r](this.#e[r],this.#e):this.#e[r]=t[r];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...r){return this.fetch(K(this.#e,...r,{method:t.toUpperCase()}))};Object.freeze(this)}#r(n){typeof n=="function"&&(n=[n]);let t=n.findIndex(r=>typeof r!="function");if(t>=0)throw k("metro.client: middlewares must be a function or an array of functions "+B+"client/invalid-middlewares-value/",n[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(n)}fetch(n,t){if(n=K(n,t),!n.url)throw k("metro.client."+n.method.toLowerCase()+": Missing url parameter "+B+"client/missing-url-param/",n);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw k("metro.client.fetch: Options is not an object");let o=[async function(f){if(f[Symbol.metroProxy])if(f.body&&f.body[Symbol.metroSource]){let O=f.body[Symbol.metroSource];f=new Request(f[Symbol.metroSource],{body:O})}else f=f[Symbol.metroSource];let x=await fetch(f);return G(x)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let u of o)i=function(f,x){return async function(O){let T,D=Object.values(e.tracers);for(let a of D)a.request&&a.request.call(a,O,x);T=await x(O,f);for(let a of D)a.response&&a.response.call(a,T,x);return T}}(i,u);return i(n)}with(...n){return new e(this,...n)}};function me(...e){return new E(...e)}function q(e,n){let t=n.body;return t||(e===null?t=new ReadableStream:e instanceof ReadableStream?t=e:e instanceof Blob?t=e.stream():t=new ReadableStream({start(r){let o;switch(typeof e){case"object":if(typeof e.toString=="function")o=e.toString();else if(e instanceof FormData)o=new URLSearchParams(e).toString();else if(e instanceof ArrayBuffer||ArrayBuffer.isView(e))o=e;else throw k("Cannot convert body to ReadableStream",e);break;case"string":case"number":case"boolean":o=e;break;default:throw k("Cannot convert body to ReadableStream",e)}r.enqueue(o),r.close()}})),new Proxy(t,{get(r,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return e;case"toString":return function(){return""+e}}if(e&&typeof e=="object"&&o in e)return typeof e[o]=="function"?function(...u){return e[o].apply(e,u)}:e[o];if(o in r&&o!="toString")return typeof r[o]=="function"?function(...u){return r[o].apply(r,u)}:r[o]},has(r,o){return e&&typeof e=="object"?o in e:o in r},ownKeys(r){return Reflect.ownKeys(e&&typeof e=="object"?e:r)},getOwnPropertyDescriptor(r,o){return Object.getOwnPropertyDescriptor(e&&typeof e=="object"?e:r,o)}})}function _e(e,n){let t=n||{};!t.url&&n.url&&(t.url=n.url);for(let r of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"])if(typeof e[r]=="function")e[r](t[r],t);else if(typeof e[r]<"u")if(r=="url")t.url=W(t.url,e.url);else if(r=="headers"){t.headers=new Headers(n.headers),e.headers instanceof Headers||(e.headers=new Headers(e.headers));for(let[o,i]of e.headers.entries())t.headers.set(o,i)}else t[r]=e[r];return t}function K(...e){let n={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?n.url=W(n.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?n.body=o:o&&typeof o=="object"&&Object.assign(n,_e(o,n));let t=n.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(n.body=JSON.stringify(t));let r=new Request(n.url,n);return Object.freeze(r),new Proxy(r,{get(o,i,u){switch(i){case Symbol.metroSource:return o;case Symbol.metroProxy:return!0;case"with":return function(...f){return t&&f.unshift({body:t}),K(o,...f)};case"body":if(t||(t=o.body),t)return t[Symbol.metroProxy]?t:q(t,o);break}return o[i]instanceof Function?o[i].bind(o):o[i]}})}function ne(e,n){let t=n||{};!t.url&&n.url&&(t.url=n.url);for(let r of["status","statusText","headers","body","url","type","redirected"])typeof e[r]=="function"?e[r](t[r],t):typeof e[r]<"u"&&(r=="url"?t.url=new URL(e.url,t.url||"https://localhost/"):t[r]=e[r]);return t}function G(...e){let n={};for(let r of e)typeof r=="string"?n.body=r:r instanceof Response?Object.assign(n,ne(r,n)):r&&typeof r=="object"&&(r instanceof FormData||r instanceof Blob||r instanceof ArrayBuffer||r instanceof DataView||r instanceof ReadableStream||r instanceof URLSearchParams||r instanceof String||typeof TypedArray<"u"&&r instanceof TypedArray?n.body=r:Object.assign(n,ne(r,n)));let t=new Response(n.body,n);return Object.freeze(t),new Proxy(t,{get(r,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return r;case"with":return function(...u){return G(r,...u)};case"body":return n.body?n.body[Symbol.metroProxy]?n.body:q(n.body,r):q("",r);case"ok":return r.status>=200&&r.status<400;case"headers":return r.headers;default:if(o in n&&o!="toString")return n[o];if(o in r&&o!="toString")return typeof r[o]=="function"?function(...u){return r[o].apply(r,u)}:r[o];break}}})}function oe(e,n){typeof n=="function"?n(e.searchParams,e):(n=new URLSearchParams(n),n.forEach((t,r)=>{e.searchParams.append(r,t)}))}function W(...e){let n=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let r of e)if(typeof r=="string"||r instanceof String)t=new URL(r,t);else if(r instanceof URL||typeof Location<"u"&&r instanceof Location)t=new URL(r);else if(r instanceof URLSearchParams)oe(t,r);else if(r&&typeof r=="object")for(let o in r)if(o=="search")typeof r.search=="function"?r.search(t.search,t):t.search=new URLSearchParams(r.search);else if(o=="searchParams")oe(t,r.searchParams);else{if(!n.includes(o))throw k("metro.url: unknown url parameter "+B+"url/unknown-param-name/",o);if(typeof r[o]=="function")r[o](t[o],t);else if(typeof r[o]=="string"||r[o]instanceof String||typeof r[o]=="number"||r[o]instanceof Number||typeof r[o]=="boolean"||r[o]instanceof Boolean)t[o]=""+r[o];else if(typeof r[o]=="object"&&r[o].toString)t[o]=r[o].toString();else throw k("metro.url: unsupported value for "+o+" "+B+"url/unsupported-param-value/",e[o])}else throw k("metro.url: unsupported option value "+B+"url/unsupported-option-value/",r);return Object.freeze(t),new Proxy(t,{get(r,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return r;case"with":return function(...u){return W(r,...u)}}return r[o]instanceof Function?r[o].bind(r):r[o]}})}function ie(...e){var n=new FormData;for(let t of e)if(t instanceof FormData)for(let r of t.entries())n.append(r[0],r[1]);else if(t&&typeof t=="object")for(let r of Object.entries(t))if(Array.isArray(r[1]))for(let o of r[1])n.append(r[0],o);else n.append(r[0],r[1]);else throw new k("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(n),new Proxy(n,{get:(t,r,o)=>{switch(r){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return ie(t,...i)}}return t[r]instanceof Function?t[r].bind(t):t[r]}})}var M={error:(e,...n)=>{console.error("\u24C2\uFE0F  ",e,...n)},info:(e,...n)=>{console.info("\u24C2\uFE0F  ",e,...n)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function k(e,...n){return M.error(e,...n),new Error(e,...n)}var pe={add(e,n){E.tracers[e]=n},delete(e){delete E.tracers[e]},clear(){E.tracers={}},group(){let e=0;return{request:(n,t)=>{e++,M.group(e),M.info(n?.url,n,t)},response:(n,t)=>{M.info(n?.body?n.body[Symbol.metroSource]:null,n,t),M.groupEnd(e),e--}}}};function j(e){return e=Object.assign({reviver:null,replacer:null,space:""},e),async(n,t)=>{["POST","PUT","PATCH","QUERY"].includes(n.method)?(n=n.with({headers:{"Content-Type":"application/json",Accept:"application/json"}}),n.body&&typeof n.body[Symbol.metroSource]=="object"&&(n=n.with({body:JSON.stringify(n.body[Symbol.metroSource],e.replacer,e.space)}))):n=n.with({headers:{Accept:"application/json"}});let r=await t(n),o=await r.text(),i=JSON.parse(o,e.reviver);return r.with({body:i})}}function A(e){return async(n,t)=>{let r=await t(n);if(!r.ok)if(e&&typeof e[r.status]=="function")r=e[r.status].apply(r,n);else throw new Error(r.status+": "+r.statusText,{cause:r});return r}}var se=Object.assign({},X,{mw:{jsonmw:j,thrower:A}});window.metro=se;var d=se;globalThis.assertEnabled=!1;function v(e,n){if(globalThis.assertEnabled){let t=g(e,n);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,r,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return g(t,e,r,o)}}function _(e){return function(t,r,o){return t==null||typeof t>"u"?m("data is required",t,e||"any value",o):typeof e<"u"?g(t,e,r,o):!1}}function C(e){return function(t,r,o){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,o),!1):g(t,e,r,o)}}function y(...e){return function(t,r,o){for(let i of e)if(!g(t,i,r,o))return!1;return m("data does not match oneOf patterns",t,e,o)}}function U(...e){return function(t,r,o){if(!Array.isArray(t))return m("data is not an array",t,"anyOf",o);for(let i of t)if(y(...e)(i))return m("data does not match anyOf patterns",i,e,o);return!1}}function ae(...e){return function(t,r,o){let i=[];for(let u of e)i=i.concat(g(t,u,r,o));if(i=i.filter(Boolean),i.length)return m("data does not match all given patterns",t,e,o,i)}}function h(e,n,t){try{e instanceof URL&&(e=e.href);let r=new URL(e);if(r.href!=e&&!(r.href+"/"==e||r.href==e+"/"))return m("data is not a valid url",e,"validURL",t)}catch{return m("data is not a valid url",e,"validURL",t)}}function ce(e,n,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return m("data is not a valid email",e,"validEmail",t)}function z(e){return function(t,r,o){if(!(t instanceof e))return m("data is not an instanceof pattern",t,e,o)}}function F(e){return function(t,r,o){if(!g(t,e,r,o))return m("data matches pattern, when required not to",t,e,o)}}function g(e,n,t,r=""){t||(t=e);let o=[];if(n===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(m("data is not a boolean",e,n,r));else if(n===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(m("data is not a number",e,n,r));else if(n===String)typeof e!="string"&&!(e instanceof String)&&o.push(m("data is not a string",e,n,r)),e==""&&o.push(m("data is an empty string, which is not allowed",e,n,r));else if(n instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((u,f)=>g(u,n,t,r+"["+f+"]"));i>-1&&o.push(m("data["+i+"] does not match pattern",e[i],n,r+"["+i+"]"))}else typeof e>"u"?o.push(m("data is undefined, should match pattern",e,n,r)):n.test(e)||o.push(m("data does not match pattern",e,n,r));else if(n instanceof Function){let i=n(e,t,r);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(n)){Array.isArray(e)||o.push(m("data is not an array",e,[],r));for(let i of n)for(let u of e.keys()){let f=g(e[u],i,t,r+"["+u+"]");Array.isArray(f)?o=o.concat(f):f&&o.push(f)}}else if(n&&typeof n=="object")if(Array.isArray(e)){let i=e.findIndex((u,f)=>g(u,n,t,r+"["+f+"]"));i>-1&&o.push(m("data["+i+"] does not match pattern",e[i],n,r+"["+i+"]"))}else if(!e||typeof e!="object")o.push(m("data is not an object, pattern is",e,n,r));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),n instanceof Function){let i=g(e,n,t,r);i&&(o=o.concat(i))}else for(let[i,u]of Object.entries(n)){let f=g(e[i],u,t,r+"."+i);f&&(o=o.concat(f))}else n!=e&&o.push(m("data and pattern are not equal",e,n,r));return o.length?o:!1}function m(e,n,t,r,o){let i={message:e,found:n,expected:t,path:r};return o&&(i.problems=o),i}var I=(...e)=>(n,t)=>e.filter(r=>t.hasOwnKey(r)).length>0?!1:m("root data must have all of",t,e),R=(...e)=>n=>Array.isArray(n)&&e.filter(t=>!n.includes(t)).length==0?!1:m("data must be an array which includes",n,e);var S=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],$=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function H(e={}){v(e,{client:s(z(d.client().constructor)),issuer:_(h)});let n={client:d.client().with(A()).with(j()),requireDynamicRegistration:!1};e=Object.assign({},n,e);let t=!1;function r(x){return t}let o={issuer:_(ae(e.issuer,r)),authorization_endpoint:_(h),token_endpoint:_(h),userinfo_endpoint:C(h),jwks_uri:_(h),registration_endpoint:e.requireDynamicRegistration?_(h):C(h),scopes_supported:C(R("openid")),response_types_supported:e.requireDynamicRegistration?_(R("code","id_token","id_token token")):_([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(R("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:_([]),id_token_signing_alg_values_supported:_(R("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(R("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(U(...$)),token_endpoint_auth_signing_alg_values_supported:s(R("RS256"),F(R("none"))),display_values_supported:s(U("page","popup","touch","wap")),claim_types_supported:s(U("normal","aggregated","distributed")),claims_supported:C([]),service_documentation:s(h),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(h),op_tos_uri:s(h)},i=d.url(e.issuer,".well-known/openid-configuration"),f=(await e.client.get(i)).body[Symbol.metroSource];return v(f,o),v(f.issuer,e.issuer),f}async function N(e){let n={redirect_uris:_([h]),response_types:s([]),grant_types:s(U("authorization_code","refresh_token")),application_type:s(y("native","web")),contacts:s([ce]),client_name:s(String),logo_uri:s(h),client_uri:s(h),policy_uri:s(h),tos_uri:s(h),jwks_uri:s(h,F(I("jwks"))),jwks:s(h,F(I("jwks_uri"))),sector_identifier_uri:s(h),subject_type:s(String),id_token_signed_response_alg:s(y(...S)),id_token_encrypted_response_alg:s(y(...S)),id_token_encrypted_response_enc:s(y(...S),I("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(y(...S)),userinfo_encrypted_response_alg:s(y(...S)),userinfo_encrypted_response_enc:s(y(...S),I("userinfo_encrypted_response_alg")),request_object_signing_alg:s(y(...S)),request_object_encryption_alg:s(y(...S)),request_object_encryption_enc:s(y(...S)),token_endpoint_auth_method:s(y(...$)),token_endpoint_auth_signing_alg:s(y(...S)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([h]),request_uris:s([h])};v(e,{client:s(z(d.client().constructor)),registration_endpoint:h,client_info:n});let t={client:d.client().with(A()).with(j())};e=Object.assign({},t,e);let r=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=r.body;if(!o.client_id||!o.client_secret)throw d.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",r);return e.client_info=Object.assign(e.client_info,o),e.client_info}globalThis.assertEnabled=!1;var J=(e,n)=>{if(globalThis.assertEnabled){let t=L(e,n);if(t)throw new Z("Assertions failed",t,e)}};var V=e=>n=>L(n,e);function Q(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return w("data is not a valid url",e,"validURL")}catch{return w("data is not a valid url",e,"validURL")}return!1}function L(e,n,t){t||(t=e);let r=[];if(n===Boolean)typeof e!="boolean"&&r.push(w("data is not a boolean",e,n));else if(n===Number)typeof e!="number"&&r.push(w("data is not a number",e,n));else if(n instanceof RegExp)if(Array.isArray(e)){let o=e.findIndex(i=>L(i,n,t));o>-1&&r.push(w("data["+o+"] does not match pattern",e[o],n))}else n.test(e)||r.push(w("data does not match pattern",e,n));else if(n instanceof Function)n(e,t)&&r.push(w("data does not match function",e,n));else if(Array.isArray(n)){Array.isArray(e)||r.push(w("data is not an array",e,[]));for(p of n){let o=L(e,p,t);Array.isArray(o)?r.concat(o):o&&r.push(o)}}else if(n&&typeof n=="object")if(Array.isArray(e)){let o=e.findIndex(i=>L(i,n,t));o>-1&&r.push(w("data["+o+"] does not match pattern",e[o],n))}else if(!e||typeof e!="object")r.push(w("data is not an object, pattern is",e,n));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let o=r[r.length-1];for(let[i,u]of Object.entries(n)){let f=L(e[i],u,t);f&&((!o||typeof o=="string")&&(o={},r.push(w(o,e[i],u))),o[i]=f.problems)}}else n!=e&&r.push(w("data and pattern are not equal",e,n));return r.length?r:!1}var Z=class extends Error{constructor(n,t,...r){super(n),this.problems=t,this.details=r}};function w(e,n,t){return{message:e,found:n,expected:t}}function fe(e){let n,t;if(typeof localStorage<"u")n={get:()=>localStorage.getItem("metro/state:"+e),set:r=>localStorage.setItem("metro/state:"+e,r),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:r=>JSON.parse(localStorage.getItem(e+":"+r)),set:(r,o)=>localStorage.setItem(e+":"+r,JSON.stringify(o)),has:r=>localStorage.getItem(e+":"+r)!==null};else{let r=new Map;n={get:()=>r.get("metro/state:"+e),set:o=>r.set("metro/state:"+e,o),has:()=>r.has("metro/state:"+e)},t=new Map}return{state:n,tokens:t}}function ee(e){let n={client:d.client(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:Y.generateCodeVerifier(64)},callbacks:{authorize:async a=>(window.location.href!=a.href&&window.location.replace(a.href),!1)}};J(e,{});let t=Object.assign({},n.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},n,e),e.oauth2_configuration=t;let r=fe(e.site);e.tokens||(e.tokens=r.tokens),e.state||(e.state=r.state),J(e,{oauth2_configuration:{client_id:V(/.+/),grant_type:"authorization_code",authorization_endpoint:V(Q),token_endpoint:V(Q),redirect_uri:V(Q)}});for(let a in t)switch(a){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(a,t[a]);break}return async function(a,l){if(e.force_authorization)return o(a,l);let c;try{if(c=await l(a),c.ok)return c}catch(b){switch(c.status){case 400:case 401:return o(a,l)}throw b}return c};async function o(a,l){if(i(),e.tokens.has("access_token")){if(T(a))return await f()?o(a,l):d.response("false");{let c=e.tokens.get("access_token");return a=d.request(a,{headers:{Authorization:c.type+" "+c.value}}),l(a)}}else{try{if(!await u())return d.response("false")}catch(c){throw console.log("caught",c),c}return o(a,l)}}function i(){if(typeof window<"u"&&window?.location){let a=d.url(window.location),l,c,b;if(a.searchParams.has("code"))b=a.searchParams,a=a.with({search:""}),history.pushState({},"",a.href);else if(a.hash){let P=a.hash.substr(1);b=new URLSearchParams("?"+P),a=a.with({hash:""}),history.pushState({},"",a.href)}if(b){l=b.get("code"),c=b.get("state");let P=e.state.get("metro/state");if(!c||c!==P)return;l&&e.tokens.set("authorization_code",l)}}}async function u(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let b=x();if(!e.callbacks.authorize||typeof e.callbacks.authorize!="function")throw d.metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.options.callbacks.authorize");let P=await e.callbacks.authorize(b);if(P)e.tokens.set("authorization_code",P);else return!1}let a=O(),l=await e.client.post(a);if(!l.ok)throw d.metroError("OAuth2mw: fetch access_token: "+l.status+": "+l.statusText,{cause:a});let c=await l.json();if(e.tokens.set("access_token",{value:c.access_token,expires:D(c.expires_in),type:c.token_type,scope:c.scope}),c.refresh_token){let b={value:c.refresh_token};e.tokens.set("refresh_token",b)}return c}async function f(){let a=O("refresh_token"),l=await e.client.post(a);if(!l.ok)throw d.metroError("OAuth2mw: refresh access_token: "+l.status+": "+l.statusText,{cause:a});let c=await l.json();if(e.tokens.set("access_token",{value:c.access_token,expires:D(c.expires_in),type:c.token_type,scope:c.scope}),c.refresh_token){let b={value:c.refresh_token};e.tokens.set("refresh_token",b)}else return!1;return c}function x(){if(!t.authorization_endpoint)throw d.metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let a=d.url(t.authorization_endpoint,{hash:""});J(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let l={response_type:"code",client_id:t.client_id,client_secret:t.client_secret,redirect_uri:t.redirect_uri,state:t.state||Y.createState(40)};return e.state.set(l.state),t.code_verifier&&(delete l.client_secret,l.code_challenge=Y.generateCodeChallenge(t.code_verifier),l.code_challenge_method="S256"),t.scope&&(l.scope=t.scope),d.url(a,{search:l})}function O(a=null){if(J(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw d.metroError("oauth2mw: Missing options.endpoints.token url");let l=d.url(t.token_endpoint,{hash:""}),c={grant_type:a||t.grant_type,client_id:t.client_id};switch(t.code_verifier?c.code_verifier=t.code_verifier:c.client_secret=t.client_secret,t.scope&&(c.scope=t.scope),t.grant_type){case"authorization_code":c.redirect_uri=t.redirect_uri,c.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":c.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return d.request(l,{method:"POST",body:new URLSearchParams(c)})}function T(a){if(a.oauth2&&a.options.tokens&&a.options.tokens.has("access_token")){let l=new Date,c=a.options.tokens.get("access_token");return l.getTime()>c.expires.getTime()}return!1}function D(a){if(a instanceof Date)return new Date(a.getTime());if(typeof a=="number"){let l=new Date;return l.setSeconds(l.getSeconds()+a),l}throw new TypeError("Unknown expires type "+a)}}var Y={generateCodeVerifier:function(e=64){let n=new Uint8Array(e);return globalThis.crypto.getRandomValues(n),n.toString("hex")},generateCodeChallenge:async function(e){let n=Y.base64url_encode(e),r=new TextEncoder().encode(n);return await globalThis.crypto.subtle.digest("SHA-256",r)},base64url_encode:function(e){let n=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},createState:function(e){let n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",r=0;for(;r<e;)t+=n.charAt(Math.floor(Math.random()*n.length)),r++;return t}};function le(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let n=e.hash.substr(1);if(params=new URLSearchParams("?"+n),params.has("code"))return!0}return!1}return!0}function te(e){let n;if(typeof localStorage<"u")n={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,r)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(r)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;n={get:r=>JSON.parse(t.get("metro/oidc:"+e+":"+r)||null),set:(r,o)=>t.set("metro/oidc:"+e+":"+r,JSON.stringify(o)),has:r=>t.has("metro/oidc:"+e+":"+r)}}return n}function re(e={}){let n={client:d.client(),force_authorization:!1};return e=Object.assign({},n,e),v(e,{client:_(z(d.client().constructor)),client_info:_(),issuer:_(h),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=te(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,r)=>{let o;if(!e.force_authorization){try{o=await r(t)}catch(f){if(o.status!=401&&o.status!=403)throw f}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await H({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(v(e.client_info?.client_name,_()),!e.openid_configuration.registration_endpoint)throw d.metroError("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await N({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,code_verifier:!1,grant_type:"authorization_code",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:e.openid_configuration.scope||"openid",redirect_uri:e.client_info.redirect_uris[0]}});return o=await e.client.with(e.issuer).with(ee(i)).fetch(t),o}}function ue(){return le()}var ye={discover:H,register:N,oidcmw:re,isRedirected:ue};globalThis.oidc=ye;})();
+(() => {
+  var __defProp = Object.defineProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+
+  // node_modules/@muze-nl/metro/src/metro.mjs
+  var metro_exports = {};
+  __export(metro_exports, {
+    client: () => client,
+    formdata: () => formdata,
+    metroError: () => metroError,
+    request: () => request,
+    response: () => response,
+    trace: () => trace,
+    url: () => url
+  });
+  var metroURL = "https://metro.muze.nl/details/";
+  if (!Symbol.metroProxy) {
+    Symbol.metroProxy = Symbol("isProxy");
+  }
+  if (!Symbol.metroSource) {
+    Symbol.metroSource = Symbol("source");
+  }
+  var Client = class _Client {
+    #options = {
+      url: typeof window != "undefined" ? window.location : "https://localhost"
+    };
+    #verbs = ["get", "post", "put", "delete", "patch", "head", "options", "query"];
+    static tracers = {};
+    /**
+     * @typedef {Object} ClientOptions
+     * @property {Array} middlewares - list of middleware functions
+     * @property {string|URL} url - default url of the client
+     * @property {[string]} verbs - a list of verb methods to expose, e.g. ['get','post']
+     * 
+     * Constructs a new metro client. Can have any number of params.
+     * @params {ClientOptions|URL|Function|Client}
+     * @returns {Client} - A metro client object with given or default verb methods
+     */
+    constructor(...options) {
+      for (let option of options) {
+        if (typeof option == "string" || option instanceof String) {
+          this.#options.url = "" + option;
+        } else if (option instanceof _Client) {
+          Object.assign(this.#options, option.#options);
+        } else if (option instanceof Function) {
+          this.#addMiddlewares([option]);
+        } else if (option && typeof option == "object") {
+          for (let param in option) {
+            if (param == "middlewares") {
+              this.#addMiddlewares(option[param]);
+            } else if (typeof option[param] == "function") {
+              this.#options[param] = option[param](this.#options[param], this.#options);
+            } else {
+              this.#options[param] = option[param];
+            }
+          }
+        }
+      }
+      if (this.#options.verbs) {
+        this.#verbs = this.#options.verbs;
+        delete this.#options.verbs;
+      }
+      for (const verb of this.#verbs) {
+        this[verb] = async function(...options2) {
+          return this.fetch(request(
+            this.#options,
+            ...options2,
+            { method: verb.toUpperCase() }
+          ));
+        };
+      }
+      Object.freeze(this);
+    }
+    #addMiddlewares(middlewares) {
+      if (typeof middlewares == "function") {
+        middlewares = [middlewares];
+      }
+      let index = middlewares.findIndex((m) => typeof m != "function");
+      if (index >= 0) {
+        throw metroError("metro.client: middlewares must be a function or an array of functions " + metroURL + "client/invalid-middlewares-value/", middlewares[index]);
+      }
+      if (!Array.isArray(this.#options.middlewares)) {
+        this.#options.middlewares = [];
+      }
+      this.#options.middlewares = this.#options.middlewares.concat(middlewares);
+    }
+    /**
+     * Mimics the standard browser fetch method, but uses any middleware installed through
+     * the constructor.
+     * @param {Request|string|Object} - Required. The URL or Request object, accepts all types that are accepted by metro.request
+     * @param {Object} - Optional. Any object that is accepted by metro.request
+     * @return {Promise<Response|*>} - The metro.response to this request, or any other result as changed by any included middleware.
+     */
+    fetch(req, options) {
+      req = request(req, options);
+      if (!req.url) {
+        throw metroError("metro.client." + req.method.toLowerCase() + ": Missing url parameter " + metroURL + "client/missing-url-param/", req);
+      }
+      if (!options) {
+        options = {};
+      }
+      if (!(typeof options === "object") || Array.isArray(options) || options instanceof String) {
+        throw metroError("metro.client.fetch: Options is not an object");
+      }
+      const metrofetch = async function browserFetch(req2) {
+        if (req2[Symbol.metroProxy]) {
+          if (req2.body && req2.body[Symbol.metroSource]) {
+            let body = req2.body[Symbol.metroSource];
+            req2 = new Request(req2[Symbol.metroSource], { body });
+          } else {
+            req2 = req2[Symbol.metroSource];
+          }
+        }
+        const res = await fetch(req2);
+        return response(res);
+      };
+      let middlewares = [metrofetch].concat(this.#options?.middlewares?.slice() || []);
+      options = Object.assign({}, this.#options, options);
+      let next;
+      for (let middleware of middlewares) {
+        next = /* @__PURE__ */ function(next2, middleware2) {
+          return async function(req2) {
+            let res;
+            let tracers = Object.values(_Client.tracers);
+            for (let tracer of tracers) {
+              if (tracer.request) {
+                tracer.request.call(tracer, req2, middleware2);
+              }
+            }
+            res = await middleware2(req2, next2);
+            for (let tracer of tracers) {
+              if (tracer.response) {
+                tracer.response.call(tracer, res, middleware2);
+              }
+            }
+            return res;
+          };
+        }(next, middleware);
+      }
+      return next(req);
+    }
+    with(...options) {
+      return new _Client(this, ...options);
+    }
+  };
+  function client(...options) {
+    return new Client(...options);
+  }
+  function bodyProxy(body, r) {
+    let source = r.body;
+    if (!source) {
+      if (body === null) {
+        source = new ReadableStream();
+      } else if (body instanceof ReadableStream) {
+        source = body;
+      } else if (body instanceof Blob) {
+        source = body.stream();
+      } else {
+        source = new ReadableStream({
+          start(controller) {
+            let chunk;
+            switch (typeof body) {
+              case "object":
+                if (typeof body.toString == "function") {
+                  chunk = body.toString();
+                } else if (body instanceof FormData) {
+                  chunk = new URLSearchParams(body).toString();
+                } else if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
+                  chunk = body;
+                } else {
+                  throw metroError("Cannot convert body to ReadableStream", body);
+                }
+                break;
+              case "string":
+              case "number":
+              case "boolean":
+                chunk = body;
+                break;
+              default:
+                throw metroError("Cannot convert body to ReadableStream", body);
+                break;
+            }
+            controller.enqueue(chunk);
+            controller.close();
+          }
+        });
+      }
+    }
+    return new Proxy(source, {
+      get(target, prop, receiver) {
+        switch (prop) {
+          case Symbol.metroProxy:
+            return true;
+            break;
+          case Symbol.metroSource:
+            return body;
+            break;
+          case "toString":
+            return function() {
+              return "" + body;
+            };
+            break;
+        }
+        if (body && typeof body == "object") {
+          if (prop in body) {
+            if (typeof body[prop] == "function") {
+              return function(...args) {
+                return body[prop].apply(body, args);
+              };
+            }
+            return body[prop];
+          }
+        }
+        if (prop in target && prop != "toString") {
+          if (typeof target[prop] == "function") {
+            return function(...args) {
+              return target[prop].apply(target, args);
+            };
+          }
+          return target[prop];
+        }
+      },
+      has(target, prop) {
+        if (body && typeof body == "object") {
+          return prop in body;
+        } else {
+          return prop in target;
+        }
+      },
+      ownKeys(target) {
+        if (body && typeof body == "object") {
+          return Reflect.ownKeys(body);
+        } else {
+          return Reflect.ownKeys(target);
+        }
+      },
+      getOwnPropertyDescriptor(target, prop) {
+        if (body && typeof body == "object") {
+          return Object.getOwnPropertyDescriptor(body, prop);
+        } else {
+          return Object.getOwnPropertyDescriptor(target, prop);
+        }
+      }
+    });
+  }
+  function getRequestParams(req, current) {
+    let params2 = current || {};
+    if (!params2.url && current.url) {
+      params2.url = current.url;
+    }
+    for (let prop of [
+      "method",
+      "headers",
+      "body",
+      "mode",
+      "credentials",
+      "cache",
+      "redirect",
+      "referrer",
+      "referrerPolicy",
+      "integrity",
+      "keepalive",
+      "signal",
+      "priority",
+      "url"
+    ]) {
+      let value = req[prop];
+      if (typeof value == "undefined" || value == null) {
+        continue;
+      }
+      if (value?.[Symbol.metroProxy]) {
+        value = value[Symbol.metroSource];
+      }
+      if (typeof value == "function") {
+        value(params2[prop], params2);
+      } else {
+        if (prop == "url") {
+          params2.url = url(params2.url, value);
+        } else if (prop == "headers") {
+          params2.headers = new Headers(current.headers);
+          if (!(value instanceof Headers)) {
+            value = new Headers(req.headers);
+          }
+          for (let [key, val] of value.entries()) {
+            params2.headers.set(key, val);
+          }
+        } else {
+          params2[prop] = value;
+        }
+      }
+    }
+    return params2;
+  }
+  function request(...options) {
+    let requestParams = {
+      url: typeof window != "undefined" ? window.location : "https://localhost/",
+      duplex: "half"
+      // required when setting body to ReadableStream, just set it here by default already
+    };
+    for (let option of options) {
+      if (typeof option == "string" || option instanceof URL || option instanceof URLSearchParams) {
+        requestParams.url = url(requestParams.url, option);
+      } else if (option && (option instanceof FormData || option instanceof ReadableStream || option instanceof Blob || option instanceof ArrayBuffer || option instanceof DataView)) {
+        requestParams.body = option;
+      } else if (option && typeof option == "object") {
+        Object.assign(requestParams, getRequestParams(option, requestParams));
+      }
+    }
+    let body = requestParams.body;
+    if (body) {
+      if (typeof body == "object" && !(body instanceof String) && !(body instanceof ReadableStream) && !(body instanceof Blob) && !(body instanceof ArrayBuffer) && !(body instanceof DataView) && !(body instanceof FormData) && !(body instanceof URLSearchParams) && (typeof TypedArray == "undefined" || !(body instanceof TypedArray))) {
+        requestParams.body = JSON.stringify(body);
+      }
+    }
+    let r = new Request(requestParams.url, requestParams);
+    Object.freeze(r);
+    return new Proxy(r, {
+      get(target, prop, receiver) {
+        switch (prop) {
+          case Symbol.metroSource:
+            return target;
+            break;
+          case Symbol.metroProxy:
+            return true;
+            break;
+          case "with":
+            return function(...options2) {
+              if (body) {
+                options2.unshift({ body });
+              }
+              return request(target, ...options2);
+            };
+            break;
+          case "body":
+            if (!body) {
+              body = target.body;
+            }
+            if (body) {
+              if (body[Symbol.metroProxy]) {
+                return body;
+              }
+              return bodyProxy(body, target);
+            }
+            break;
+        }
+        if (target[prop] instanceof Function) {
+          return target[prop].bind(target);
+        }
+        return target[prop];
+      }
+    });
+  }
+  function getResponseParams(res, current) {
+    let params2 = current || {};
+    if (!params2.url && current.url) {
+      params2.url = current.url;
+    }
+    for (let prop of ["status", "statusText", "headers", "body", "url", "type", "redirected"]) {
+      let value = res[prop];
+      if (typeof value == "undefined" || value == null) {
+        continue;
+      }
+      if (value?.[Symbol.metroProxy]) {
+        value = value[Symbol.metroSource];
+      }
+      if (typeof value == "function") {
+        value(params2[prop], params2);
+      } else {
+        if (prop == "url") {
+          params2.url = new URL(value, params2.url || "https://localhost/");
+        } else {
+          params2[prop] = value;
+        }
+      }
+    }
+    return params2;
+  }
+  function response(...options) {
+    let responseParams = {};
+    for (let option of options) {
+      if (typeof option == "string") {
+        responseParams.body = option;
+      } else if (option instanceof Response) {
+        Object.assign(responseParams, getResponseParams(option, responseParams));
+      } else if (option && typeof option == "object") {
+        if (option instanceof FormData || option instanceof Blob || option instanceof ArrayBuffer || option instanceof DataView || option instanceof ReadableStream || option instanceof URLSearchParams || option instanceof String || typeof TypedArray != "undefined" && option instanceof TypedArray) {
+          responseParams.body = option;
+        } else {
+          Object.assign(responseParams, getResponseParams(option, responseParams));
+        }
+      }
+    }
+    let r = new Response(responseParams.body, responseParams);
+    Object.freeze(r);
+    return new Proxy(r, {
+      get(target, prop, receiver) {
+        switch (prop) {
+          case Symbol.metroProxy:
+            return true;
+            break;
+          case Symbol.metroSource:
+            return target;
+            break;
+          case "with":
+            return function(...options2) {
+              return response(target, ...options2);
+            };
+            break;
+          case "body":
+            if (responseParams.body) {
+              if (responseParams.body[Symbol.metroProxy]) {
+                return responseParams.body;
+              }
+              return bodyProxy(responseParams.body, target);
+            } else {
+              return bodyProxy("", target);
+            }
+            break;
+          case "ok":
+            return target.status >= 200 && target.status < 400;
+            break;
+          case "headers":
+            return target.headers;
+            break;
+          default:
+            if (prop in responseParams && prop != "toString") {
+              return responseParams[prop];
+            }
+            if (prop in target && prop != "toString") {
+              if (typeof target[prop] == "function") {
+                return function(...args) {
+                  return target[prop].apply(target, args);
+                };
+              }
+              return target[prop];
+            }
+            break;
+        }
+        return void 0;
+      }
+    });
+  }
+  function appendSearchParams(url2, params2) {
+    if (typeof params2 == "function") {
+      params2(url2.searchParams, url2);
+    } else {
+      params2 = new URLSearchParams(params2);
+      params2.forEach((value, key) => {
+        url2.searchParams.append(key, value);
+      });
+    }
+  }
+  function url(...options) {
+    let validParams = [
+      "hash",
+      "host",
+      "hostname",
+      "href",
+      "password",
+      "pathname",
+      "port",
+      "protocol",
+      "username",
+      "search",
+      "searchParams"
+    ];
+    let u = new URL("https://localhost/");
+    for (let option of options) {
+      if (typeof option == "string" || option instanceof String) {
+        u = new URL(option, u);
+      } else if (option instanceof URL || typeof Location != "undefined" && option instanceof Location) {
+        u = new URL(option);
+      } else if (option instanceof URLSearchParams) {
+        appendSearchParams(u, option);
+      } else if (option && typeof option == "object") {
+        for (let param in option) {
+          if (param == "search") {
+            if (typeof option.search == "function") {
+              option.search(u.search, u);
+            } else {
+              u.search = new URLSearchParams(option.search);
+            }
+          } else if (param == "searchParams") {
+            appendSearchParams(u, option.searchParams);
+          } else {
+            if (!validParams.includes(param)) {
+              throw metroError("metro.url: unknown url parameter " + metroURL + "url/unknown-param-name/", param);
+            }
+            if (typeof option[param] == "function") {
+              option[param](u[param], u);
+            } else if (typeof option[param] == "string" || option[param] instanceof String || typeof option[param] == "number" || option[param] instanceof Number || typeof option[param] == "boolean" || option[param] instanceof Boolean) {
+              u[param] = "" + option[param];
+            } else if (typeof option[param] == "object" && option[param].toString) {
+              u[param] = option[param].toString();
+            } else {
+              throw metroError("metro.url: unsupported value for " + param + " " + metroURL + "url/unsupported-param-value/", options[param]);
+            }
+          }
+        }
+      } else {
+        throw metroError("metro.url: unsupported option value " + metroURL + "url/unsupported-option-value/", option);
+      }
+    }
+    Object.freeze(u);
+    return new Proxy(u, {
+      get(target, prop, receiver) {
+        switch (prop) {
+          case Symbol.metroProxy:
+            return true;
+            break;
+          case Symbol.metroSource:
+            return target;
+            break;
+          case "with":
+            return function(...options2) {
+              return url(target, ...options2);
+            };
+            break;
+        }
+        if (target[prop] instanceof Function) {
+          return target[prop].bind(target);
+        }
+        return target[prop];
+      }
+    });
+  }
+  function formdata(...options) {
+    var params2 = new FormData();
+    for (let option of options) {
+      if (option instanceof FormData) {
+        for (let entry of option.entries()) {
+          params2.append(entry[0], entry[1]);
+        }
+      } else if (option && typeof option == "object") {
+        for (let entry of Object.entries(option)) {
+          if (Array.isArray(entry[1])) {
+            for (let value of entry[1]) {
+              params2.append(entry[0], value);
+            }
+          } else {
+            params2.append(entry[0], entry[1]);
+          }
+        }
+      } else {
+        throw new metroError("metro.formdata: unknown option type, only FormData or Object supported", option);
+      }
+    }
+    Object.freeze(params2);
+    return new Proxy(params2, {
+      get: (target, prop, receiver) => {
+        switch (prop) {
+          case Symbol.metroProxy:
+            return true;
+            break;
+          case Symbol.metroSource:
+            return target;
+            break;
+          case "with":
+            return function(...options2) {
+              return formdata(target, ...options2);
+            };
+            break;
+        }
+        if (target[prop] instanceof Function) {
+          return target[prop].bind(target);
+        }
+        return target[prop];
+      }
+    });
+  }
+  var metroConsole = {
+    error: (message, ...details) => {
+      console.error("\u24C2\uFE0F  ", message, ...details);
+    },
+    info: (message, ...details) => {
+      console.info("\u24C2\uFE0F  ", message, ...details);
+    },
+    group: (name) => {
+      console.group("\u24C2\uFE0F  " + name);
+    },
+    groupEnd: (name) => {
+      console.groupEnd("\u24C2\uFE0F  " + name);
+    }
+  };
+  function metroError(message, ...details) {
+    metroConsole.error(message, ...details);
+    return new Error(message, ...details);
+  }
+  var trace = {
+    /**
+     * Adds a named tracer function
+     * @param {string} name - the name of the tracer
+     * @param {Function} tracer - the tracer function to call
+     */
+    add(name, tracer) {
+      Client.tracers[name] = tracer;
+    },
+    /**
+     * Removes a named tracer function
+     * @param {string} name
+     */
+    delete(name) {
+      delete Client.tracers[name];
+    },
+    /**
+     * Removes all tracer functions
+     */
+    clear() {
+      Client.tracers = {};
+    },
+    /**
+     * Returns a set of request and response tracer functions that use the
+     * console.group feature to shows nested request/response pairs, with
+     * most commonly needed information for debugging
+     */
+    group() {
+      let group = 0;
+      return {
+        request: (req, middleware) => {
+          group++;
+          metroConsole.group(group);
+          metroConsole.info(req?.url, req, middleware);
+        },
+        response: (res, middleware) => {
+          metroConsole.info(res?.body ? res.body[Symbol.metroSource] : null, res, middleware);
+          metroConsole.groupEnd(group);
+          group--;
+        }
+      };
+    }
+  };
+
+  // node_modules/@muze-nl/metro/src/mw/json.mjs
+  function jsonmw(options) {
+    options = Object.assign({
+      reviver: null,
+      replacer: null,
+      space: ""
+    }, options);
+    return async (req, next) => {
+      if (["POST", "PUT", "PATCH", "QUERY"].includes(req.method)) {
+        req = req.with({
+          headers: {
+            "Content-Type": "application/json",
+            "Accept": "application/json"
+          }
+        });
+        if (req.body && typeof req.body[Symbol.metroSource] == "object") {
+          req = req.with({
+            body: JSON.stringify(req.body[Symbol.metroSource], options.replacer, options.space)
+          });
+        }
+      } else {
+        req = req.with({
+          headers: {
+            "Accept": "application/json"
+          }
+        });
+      }
+      let res = await next(req);
+      let body = await res.text();
+      let json = JSON.parse(body, options.reviver);
+      return res.with({
+        body: json
+      });
+    };
+  }
+
+  // node_modules/@muze-nl/metro/src/mw/thrower.mjs
+  function thrower(options) {
+    return async (req, next) => {
+      let res = await next(req);
+      if (!res.ok) {
+        if (options && typeof options[res.status] == "function") {
+          res = options[res.status].apply(res, req);
+        } else {
+          throw new Error(res.status + ": " + res.statusText, {
+            cause: res
+          });
+        }
+      }
+      return res;
+    };
+  }
+
+  // node_modules/@muze-nl/metro/src/everything.mjs
+  var metro = Object.assign({}, metro_exports, {
+    mw: {
+      jsonmw,
+      thrower
+    }
+  });
+  globalThis.metro = metro;
+  var everything_default = metro;
+
+  // node_modules/@muze-nl/assert/src/assert.mjs
+  globalThis.assertEnabled = false;
+  function assert(source, test) {
+    if (globalThis.assertEnabled) {
+      let problems = fails(source, test);
+      if (problems) {
+        console.error("\u{1F170}\uFE0F  Assertions failed because of:", problems, "in this source:", source);
+        throw new Error("Assertions failed", {
+          cause: { problems, source }
+        });
+      }
+    }
+  }
+  function Optional(pattern) {
+    return function _Optional(data, root, path) {
+      if (typeof data != "undefined" && data != null && typeof pattern != "undefined") {
+        return fails(data, pattern, root, path);
+      }
+    };
+  }
+  function Required(pattern) {
+    return function _Required(data, root, path) {
+      if (data == null || typeof data == "undefined") {
+        return error("data is required", data, pattern || "any value", path);
+      } else if (typeof pattern != "undefined") {
+        return fails(data, pattern, root, path);
+      } else {
+        return false;
+      }
+    };
+  }
+  function Recommended(pattern) {
+    return function _Recommended(data, root, path) {
+      if (data == null || typeof data == "undefined") {
+        console.warn("data does not contain recommended value", data, pattern, path);
+        return false;
+      } else {
+        return fails(data, pattern, root, path);
+      }
+    };
+  }
+  function oneOf(...patterns) {
+    return function _oneOf(data, root, path) {
+      for (let pattern of patterns) {
+        if (!fails(data, pattern, root, path)) {
+          return false;
+        }
+      }
+      return error("data does not match oneOf patterns", data, patterns, path);
+    };
+  }
+  function anyOf(...patterns) {
+    return function _anyOf(data, root, path) {
+      if (!Array.isArray(data)) {
+        return error("data is not an array", data, "anyOf", path);
+      }
+      for (let value of data) {
+        if (oneOf(...patterns)(value)) {
+          return error("data does not match anyOf patterns", value, patterns, path);
+        }
+      }
+      return false;
+    };
+  }
+  function allOf(...patterns) {
+    return function _allOf(data, root, path) {
+      let problems = [];
+      for (let pattern of patterns) {
+        problems = problems.concat(fails(data, pattern, root, path));
+      }
+      problems = problems.filter(Boolean);
+      if (problems.length) {
+        return error("data does not match all given patterns", data, patterns, path, problems);
+      }
+    };
+  }
+  function validURL(data, root, path) {
+    try {
+      if (data instanceof URL) {
+        data = data.href;
+      }
+      let url2 = new URL(data);
+      if (url2.href != data) {
+        if (!(url2.href + "/" == data || url2.href == data + "/")) {
+          return error("data is not a valid url", data, "validURL", path);
+        }
+      }
+    } catch (e) {
+      return error("data is not a valid url", data, "validURL", path);
+    }
+  }
+  function validEmail(data, root, path) {
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data)) {
+      return error("data is not a valid email", data, "validEmail", path);
+    }
+  }
+  function instanceOf(constructor) {
+    return function _instanceOf(data, root, path) {
+      if (!(data instanceof constructor)) {
+        return error("data is not an instanceof pattern", data, constructor, path);
+      }
+    };
+  }
+  function not(pattern) {
+    return function _not(data, root, path) {
+      if (!fails(data, pattern, root, path)) {
+        return error("data matches pattern, when required not to", data, pattern, path);
+      }
+    };
+  }
+  function fails(data, pattern, root, path = "") {
+    if (!root) {
+      root = data;
+    }
+    let problems = [];
+    if (pattern === Boolean) {
+      if (typeof data != "boolean" && !(data instanceof Boolean)) {
+        problems.push(error("data is not a boolean", data, pattern, path));
+      }
+    } else if (pattern === Number) {
+      if (typeof data != "number" && !(data instanceof Number)) {
+        problems.push(error("data is not a number", data, pattern, path));
+      }
+    } else if (pattern === String) {
+      if (typeof data != "string" && !(data instanceof String)) {
+        problems.push(error("data is not a string", data, pattern, path));
+      }
+      if (data == "") {
+        problems.push(error("data is an empty string, which is not allowed", data, pattern, path));
+      }
+    } else if (pattern instanceof RegExp) {
+      if (Array.isArray(data)) {
+        let index = data.findIndex((element, index2) => fails(element, pattern, root, path + "[" + index2 + "]"));
+        if (index > -1) {
+          problems.push(error("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
+        }
+      } else if (typeof data == "undefined") {
+        problems.push(error("data is undefined, should match pattern", data, pattern, path));
+      } else if (!pattern.test(data)) {
+        problems.push(error("data does not match pattern", data, pattern, path));
+      }
+    } else if (pattern instanceof Function) {
+      let problem = pattern(data, root, path);
+      if (problem) {
+        if (Array.isArray(problem)) {
+          problems = problems.concat(problem);
+        } else {
+          problems.push(problem);
+        }
+      }
+    } else if (Array.isArray(pattern)) {
+      if (!Array.isArray(data)) {
+        problems.push(error("data is not an array", data, [], path));
+      }
+      for (let p2 of pattern) {
+        for (let index of data.keys()) {
+          let problem = fails(data[index], p2, root, path + "[" + index + "]");
+          if (Array.isArray(problem)) {
+            problems = problems.concat(problem);
+          } else if (problem) {
+            problems.push(problem);
+          }
+        }
+      }
+    } else if (pattern && typeof pattern == "object") {
+      if (Array.isArray(data)) {
+        let index = data.findIndex((element, index2) => fails(element, pattern, root, path + "[" + index2 + "]"));
+        if (index > -1) {
+          problems.push(error("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
+        }
+      } else if (!data || typeof data != "object") {
+        problems.push(error("data is not an object, pattern is", data, pattern, path));
+      } else {
+        if (data instanceof URLSearchParams) {
+          data = Object.fromEntries(data);
+        }
+        if (pattern instanceof Function) {
+          let result = fails(data, pattern, root, path);
+          if (result) {
+            problems = problems.concat(result);
+          }
+        } else {
+          for (const [wKey, wVal] of Object.entries(pattern)) {
+            let result = fails(data[wKey], wVal, root, path + "." + wKey);
+            if (result) {
+              problems = problems.concat(result);
+            }
+          }
+        }
+      }
+    } else {
+      if (pattern != data) {
+        problems.push(error("data and pattern are not equal", data, pattern, path));
+      }
+    }
+    if (problems.length) {
+      return problems;
+    }
+    return false;
+  }
+  function error(message, found, expected, path, problems) {
+    let result = {
+      message,
+      found,
+      expected,
+      path
+    };
+    if (problems) {
+      result.problems = problems;
+    }
+    return result;
+  }
+
+  // src/oidc.util.mjs
+  var MustHave = (...options) => (value, root) => {
+    if (options.filter((o) => root.hasOwnKey(o)).length > 0) {
+      return false;
+    }
+    return error("root data must have all of", root, options);
+  };
+  var MustInclude = (...options) => (value) => {
+    if (Array.isArray(value) && options.filter((o) => !value.includes(o)).length == 0) {
+      return false;
+    } else {
+      return error("data must be an array which includes", value, options);
+    }
+  };
+  var validJWA = [
+    "HS256",
+    "HS384",
+    "HS512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "ES256",
+    "ES384",
+    "ES512"
+  ];
+  var validAuthMethods = [
+    "client_secret_post",
+    "client_secret_basic",
+    "client_secret_jwt",
+    "private_key_jwt"
+  ];
+
+  // src/oidc.discovery.mjs
+  async function oidcDiscovery(options = {}) {
+    assert(options, {
+      client: Optional(instanceOf(everything_default.client().constructor)),
+      issuer: Required(validURL)
+    });
+    const defaultOptions = {
+      client: everything_default.client().with(thrower()).with(jsonmw()),
+      requireDynamicRegistration: false
+    };
+    options = Object.assign({}, defaultOptions, options);
+    const TestSucceeded = false;
+    function MustUseHTTPS(url2) {
+      return TestSucceeded;
+    }
+    const openid_provider_metadata = {
+      issuer: Required(allOf(options.issuer, MustUseHTTPS)),
+      authorization_endpoint: Required(validURL),
+      token_endpoint: Required(validURL),
+      userinfo_endpoint: Recommended(validURL),
+      // todo: test for https protocol
+      jwks_uri: Required(validURL),
+      registration_endpoint: options.requireDynamicRegistration ? Required(validURL) : Recommended(validURL),
+      scopes_supported: Recommended(MustInclude("openid")),
+      response_types_supported: options.requireDynamicRegistration ? Required(MustInclude("code", "id_token", "id_token token")) : Required([]),
+      response_modes_supported: Optional([]),
+      grant_types_supported: options.requireDynamicRegistration ? Optional(MustInclude("authorization_code")) : Optional([]),
+      acr_values_supported: Optional([]),
+      subject_types_supported: Required([]),
+      id_token_signing_alg_values_supported: Required(MustInclude("RS256")),
+      id_token_encryption_alg_values_supported: Optional([]),
+      id_token_encryption_enc_values_supported: Optional([]),
+      userinfo_signing_alg_values_supported: Optional([]),
+      userinfo_encryption_alg_values_supported: Optional([]),
+      userinfo_encryption_enc_values_supported: Optional([]),
+      request_object_signing_alg_values_supported: Optional(MustInclude("RS256")),
+      // not testing for 'none'
+      request_object_encryption_alg_values_supported: Optional([]),
+      request_object_encryption_enc_values_supported: Optional([]),
+      token_endpoint_auth_methods_supported: Optional(anyOf(...validAuthMethods)),
+      token_endpoint_auth_signing_alg_values_supported: Optional(MustInclude("RS256"), not(MustInclude("none"))),
+      display_values_supported: Optional(anyOf("page", "popup", "touch", "wap")),
+      claim_types_supported: Optional(anyOf("normal", "aggregated", "distributed")),
+      claims_supported: Recommended([]),
+      service_documentation: Optional(validURL),
+      claims_locales_supported: Optional([]),
+      ui_locales_supported: Optional([]),
+      claims_parameter_supported: Optional(Boolean),
+      request_parameter_supported: Optional(Boolean),
+      request_uri_parameter_supported: Optional(Boolean),
+      op_policy_uri: Optional(validURL),
+      op_tos_uri: Optional(validURL)
+    };
+    const configURL = everything_default.url(options.issuer, ".well-known/openid-configuration");
+    const response2 = await options.client.get(
+      // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+      // note: this allows path components in the options.issuer url
+      configURL
+    );
+    const openid_config = response2.body[Symbol.metroSource];
+    assert(openid_config, openid_provider_metadata);
+    assert(openid_config.issuer, options.issuer);
+    return openid_config;
+  }
+
+  // src/oidc.register.mjs
+  async function register(options) {
+    const openid_client_metadata = {
+      redirect_uris: Required([validURL]),
+      response_types: Optional([]),
+      grant_types: Optional(anyOf("authorization_code", "refresh_token")),
+      //TODO: match response_types with grant_types
+      application_type: Optional(oneOf("native", "web")),
+      contacts: Optional([validEmail]),
+      client_name: Optional(String),
+      logo_uri: Optional(validURL),
+      client_uri: Optional(validURL),
+      policy_uri: Optional(validURL),
+      tos_uri: Optional(validURL),
+      jwks_uri: Optional(validURL, not(MustHave("jwks"))),
+      jwks: Optional(validURL, not(MustHave("jwks_uri"))),
+      sector_identifier_uri: Optional(validURL),
+      subject_type: Optional(String),
+      id_token_signed_response_alg: Optional(oneOf(...validJWA)),
+      id_token_encrypted_response_alg: Optional(oneOf(...validJWA)),
+      id_token_encrypted_response_enc: Optional(oneOf(...validJWA), MustHave("id_token_encrypted_response_alg")),
+      userinfo_signed_response_alg: Optional(oneOf(...validJWA)),
+      userinfo_encrypted_response_alg: Optional(oneOf(...validJWA)),
+      userinfo_encrypted_response_enc: Optional(oneOf(...validJWA), MustHave("userinfo_encrypted_response_alg")),
+      request_object_signing_alg: Optional(oneOf(...validJWA)),
+      request_object_encryption_alg: Optional(oneOf(...validJWA)),
+      request_object_encryption_enc: Optional(oneOf(...validJWA)),
+      token_endpoint_auth_method: Optional(oneOf(...validAuthMethods)),
+      token_endpoint_auth_signing_alg: Optional(oneOf(...validJWA)),
+      default_max_age: Optional(Number),
+      require_auth_time: Optional(Boolean),
+      default_acr_values: Optional([String]),
+      initiate_login_uri: Optional([validURL]),
+      request_uris: Optional([validURL])
+    };
+    assert(options, {
+      client: Optional(instanceOf(everything_default.client().constructor)),
+      registration_endpoint: validURL,
+      client_info: openid_client_metadata
+    });
+    const defaultOptions = {
+      client: everything_default.client().with(thrower()).with(jsonmw())
+    };
+    options = Object.assign({}, defaultOptions, options);
+    let response2 = await options.client.post(options.registration_endpoint, {
+      body: options.client_info
+    });
+    let info = response2.body;
+    if (!info.client_id || !info.client_secret) {
+      throw everything_default.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned", response2);
+    }
+    options.client_info = Object.assign(options.client_info, info);
+    return options.client_info;
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mjs
+  var oauth2_exports = {};
+  __export(oauth2_exports, {
+    base64url_encode: () => base64url_encode,
+    createState: () => createState,
+    default: () => oauth2mw,
+    generateCodeChallenge: () => generateCodeChallenge,
+    generateCodeVerifier: () => generateCodeVerifier,
+    getExpires: () => getExpires,
+    isExpired: () => isExpired,
+    isRedirected: () => isRedirected
+  });
+
+  // node_modules/@muze-nl/metro-oauth2/node_modules/@muze-nl/assert/src/assert.mjs
+  globalThis.assertEnabled = false;
+  var assert2 = (source, test) => {
+    if (globalThis.assertEnabled) {
+      let problems = fails2(source, test);
+      if (problems) {
+        throw new assertError("Assertions failed", problems, source);
+      }
+    }
+  };
+  var Optional2 = (pattern) => (data) => data == null || typeof data == "undefined" ? false : fails2(data, pattern);
+  var Required2 = (pattern) => (data) => fails2(data, pattern);
+  var Recommended2 = (pattern) => (data) => data == null || typeof data == "undefined" ? (() => {
+    console.warning("data does not contain recommended value", data, pattern);
+    return false;
+  })() : fails2(data, pattern);
+  var oneOf2 = (...patterns) => (data) => {
+    for (let pattern of patterns) {
+      if (!fails2(data, pattern)) {
+        return false;
+      }
+    }
+    return error2("data does not match oneOf patterns", data, patterns);
+  };
+  var anyOf2 = (...patterns) => (data) => {
+    if (!Array.isArray(data)) {
+      return error2("data is not an array", data, "anyOf");
+    }
+    for (let value of data) {
+      if (oneOf2(...patterns)(value)) {
+        return error2("data does not match anyOf patterns", value, patterns);
+      }
+    }
+    return false;
+  };
+  function validURL2(data) {
+    try {
+      if (data instanceof URL) {
+        data = data.href;
+      }
+      let url2 = new URL(data);
+      if (url2.href != data) {
+        return error2("data is not a valid url", data, "validURL");
+      }
+    } catch (e) {
+      return error2("data is not a valid url", data, "validURL");
+    }
+    return false;
+  }
+  function fails2(data, pattern, root) {
+    if (!root) {
+      root = data;
+    }
+    let problems = [];
+    if (pattern === Boolean) {
+      if (typeof data != "boolean") {
+        problems.push(error2("data is not a boolean", data, pattern));
+      }
+    } else if (pattern === Number) {
+      if (typeof data != "number") {
+        problems.push(error2("data is not a number", data, pattern));
+      }
+    } else if (pattern instanceof RegExp) {
+      if (Array.isArray(data)) {
+        let index = data.findIndex((element) => fails2(element, pattern, root));
+        if (index > -1) {
+          problems.push(error2("data[" + index + "] does not match pattern", data[index], pattern));
+        }
+      } else if (!pattern.test(data)) {
+        problems.push(error2("data does not match pattern", data, pattern));
+      }
+    } else if (pattern instanceof Function) {
+      if (pattern(data, root)) {
+        problems.push(error2("data does not match function", data, pattern));
+      }
+    } else if (Array.isArray(pattern)) {
+      if (!Array.isArray(data)) {
+        problems.push(error2("data is not an array", data, []));
+      }
+      for (p of pattern) {
+        let problem = fails2(data, p, root);
+        if (Array.isArray(problem)) {
+          problems.concat(problem);
+        } else if (problem) {
+          problems.push(problem);
+        }
+      }
+    } else if (pattern && typeof pattern == "object") {
+      if (Array.isArray(data)) {
+        let index = data.findIndex((element) => fails2(element, pattern, root));
+        if (index > -1) {
+          problems.push(error2("data[" + index + "] does not match pattern", data[index], pattern));
+        }
+      } else if (!data || typeof data != "object") {
+        problems.push(error2("data is not an object, pattern is", data, pattern));
+      } else {
+        if (data instanceof URLSearchParams) {
+          data = Object.fromEntries(data);
+        }
+        let p2 = problems[problems.length - 1];
+        for (const [wKey, wVal] of Object.entries(pattern)) {
+          let result = fails2(data[wKey], wVal, root);
+          if (result) {
+            if (!p2 || typeof p2 == "string") {
+              p2 = {};
+              problems.push(error2(p2, data[wKey], wVal));
+            }
+            p2[wKey] = result.problems;
+          }
+        }
+      }
+    } else {
+      if (pattern != data) {
+        problems.push(error2("data and pattern are not equal", data, pattern));
+      }
+    }
+    if (problems.length) {
+      return problems;
+    }
+    return false;
+  }
+  var assertError = class extends Error {
+    constructor(message, problems, ...details) {
+      super(message);
+      this.problems = problems;
+      this.details = details;
+    }
+  };
+  function error2(message, found, expected) {
+    return {
+      message,
+      found,
+      expected
+    };
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/tokenstore.mjs
+  function tokenStore(site) {
+    let localState, localTokens;
+    if (typeof localStorage !== "undefined") {
+      localState = {
+        get: () => localStorage.getItem("metro/state:" + site),
+        set: (value) => localStorage.setItem("metro/state:" + site, value),
+        has: () => localStorage.getItem("metro/state:" + site) !== null
+      };
+      localTokens = {
+        get: (name) => JSON.parse(localStorage.getItem(site + ":" + name)),
+        set: (name, value) => localStorage.setItem(site + ":" + name, JSON.stringify(value)),
+        has: (name) => localStorage.getItem(site + ":" + name) !== null
+      };
+    } else {
+      let stateMap = /* @__PURE__ */ new Map();
+      localState = {
+        get: () => stateMap.get("metro/state:" + site),
+        set: (value) => stateMap.set("metro/state:" + site, value),
+        has: () => stateMap.has("metro/state:" + site)
+      };
+      localTokens = /* @__PURE__ */ new Map();
+    }
+    return {
+      state: localState,
+      tokens: localTokens
+    };
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mjs
+  function oauth2mw(options) {
+    const defaultOptions = {
+      client: everything_default.client(),
+      force_authorization: false,
+      site: "default",
+      oauth2_configuration: {
+        authorization_endpoint: "/authorize",
+        token_endpoint: "/token",
+        redirect_uri: globalThis.document?.location.href,
+        grant_type: "authorization_code",
+        code_verifier: generateCodeVerifier(64)
+      },
+      callbacks: {
+        authorize: async (url2) => {
+          if (window.location.href != url2.href) {
+            window.location.replace(url2.href);
+          }
+          return false;
+        }
+      }
+    };
+    assert2(options, {});
+    const oauth22 = Object.assign({}, defaultOptions.oauth2_configuration, options?.oauth2_configuration);
+    options = Object.assign({}, defaultOptions, options);
+    options.oauth2_configuration = oauth22;
+    const store = tokenStore(options.site);
+    if (!options.tokens) {
+      options.tokens = store.tokens;
+    }
+    if (!options.state) {
+      options.state = store.state;
+    }
+    assert2(options, {
+      oauth2_configuration: {
+        client_id: Required2(/.+/),
+        grant_type: "authorization_code",
+        authorization_endpoint: Required2(validURL2),
+        token_endpoint: Required2(validURL2),
+        redirect_uri: Required2(validURL2)
+      }
+    });
+    for (let option in oauth22) {
+      switch (option) {
+        case "access_token":
+        case "authorization_code":
+        case "refresh_token":
+          options.tokens.set(option, oauth22[option]);
+          break;
+      }
+    }
+    return async function(req, next) {
+      if (options.force_authorization) {
+        return oauth2authorized(req, next);
+      }
+      let res;
+      try {
+        res = await next(req);
+        if (res.ok) {
+          return res;
+        }
+      } catch (err) {
+        switch (res.status) {
+          case 400:
+          // Oauth2.1 RFC 3.2.4
+          case 401:
+            return oauth2authorized(req, next);
+            break;
+        }
+        throw err;
+      }
+      if (!res.ok) {
+        switch (res.status) {
+          case 400:
+          // Oauth2.1 RFC 3.2.4
+          case 401:
+            return oauth2authorized(req, next);
+            break;
+        }
+      }
+      return res;
+    };
+    async function oauth2authorized(req, next) {
+      getTokensFromLocation();
+      let accessToken = options.tokens.get("access_token");
+      if (!accessToken) {
+        try {
+          let token = await fetchAccessToken();
+          if (!token) {
+            return everything_default.response("false");
+          }
+        } catch (e) {
+          throw e;
+        }
+        return oauth2authorized(req, next);
+      } else if (isExpired(accessToken)) {
+        try {
+          let token = await fetchRefreshToken();
+          if (!token) {
+            return everything_default.response("false");
+          }
+        } catch (e) {
+          throw e;
+        }
+        return oauth2authorized(req, next);
+      } else {
+        req = everything_default.request(req, {
+          headers: {
+            Authorization: accessToken.type + " " + accessToken.value
+          }
+        });
+        return next(req);
+      }
+    }
+    function getTokensFromLocation() {
+      if (typeof window !== "undefined" && window?.location) {
+        let url2 = everything_default.url(window.location);
+        let code, state, params2;
+        if (url2.searchParams.has("code")) {
+          params2 = url2.searchParams;
+          url2 = url2.with({ search: "" });
+          history.pushState({}, "", url2.href);
+        } else if (url2.hash) {
+          let query = url2.hash.substr(1);
+          params2 = new URLSearchParams("?" + query);
+          url2 = url2.with({ hash: "" });
+          history.pushState({}, "", url2.href);
+        }
+        if (params2) {
+          code = params2.get("code");
+          state = params2.get("state");
+          let storedState = options.state.get("metro/state");
+          if (!state || state !== storedState) {
+            return;
+          }
+          if (code) {
+            options.tokens.set("authorization_code", code);
+          }
+        }
+      }
+    }
+    async function fetchAccessToken() {
+      if (oauth22.grant_type === "authorization_code" && !options.tokens.has("authorization_code")) {
+        let authReqURL = await getAuthorizationCodeURL();
+        if (!options.callbacks.authorize || typeof options.callbacks.authorize !== "function") {
+          throw everything_default.metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.options.callbacks.authorize");
+        }
+        let token = await options.callbacks.authorize(authReqURL);
+        if (token) {
+          options.tokens.set("authorization_code", token);
+        } else {
+          return false;
+        }
+      }
+      let tokenReq = getAccessTokenRequest();
+      let response2 = await options.client.post(tokenReq);
+      if (!response2.ok) {
+        let msg = await response2.text();
+        throw everything_default.metroError("OAuth2mw: fetch access_token: " + response2.status + ": " + response2.statusText, { cause: tokenReq });
+      }
+      let data = await response2.json();
+      options.tokens.set("access_token", {
+        value: data.access_token,
+        expires: getExpires(data.expires_in),
+        type: data.token_type,
+        scope: data.scope
+      });
+      if (data.refresh_token) {
+        let token = {
+          value: data.refresh_token
+        };
+        options.tokens.set("refresh_token", token);
+      }
+      return data;
+    }
+    async function fetchRefreshToken() {
+      let refreshTokenReq = getAccessTokenRequest("refresh_token");
+      let response2 = await options.client.post(refreshTokenReq);
+      if (!response2.ok) {
+        throw everything_default.metroError("OAuth2mw: refresh access_token: " + response2.status + ": " + response2.statusText, { cause: refreshTokenReq });
+      }
+      let data = await response2.json();
+      options.tokens.set("access_token", {
+        value: data.access_token,
+        expires: getExpires(data.expires_in),
+        type: data.token_type,
+        scope: data.scope
+      });
+      if (data.refresh_token) {
+        let token = {
+          value: data.refresh_token
+        };
+        options.tokens.set("refresh_token", token);
+      } else {
+        return false;
+      }
+      return data;
+    }
+    async function getAuthorizationCodeURL() {
+      if (!oauth22.authorization_endpoint) {
+        throw everything_default.metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");
+      }
+      let url2 = everything_default.url(oauth22.authorization_endpoint, { hash: "" });
+      assert2(oauth22, {
+        client_id: /.+/,
+        redirect_uri: /.+/,
+        scope: /.*/
+      });
+      let search = {
+        response_type: "code",
+        // implicit flow uses 'token' here, but is not considered safe, so not supported
+        client_id: oauth22.client_id,
+        redirect_uri: oauth22.redirect_uri,
+        state: oauth22.state || createState(40)
+        // OAuth2.1 RFC says optional, but its a good idea to always add/check it
+      };
+      if (oauth22.response_type) {
+        search.response_type = oauth22.response_type;
+      }
+      if (oauth22.response_mode) {
+        search.response_mode = oauth22.response_mode;
+      }
+      options.state.set(search.state);
+      if (oauth22.client_secret) {
+        search.client_secret = oauth22.client_secret;
+      }
+      if (oauth22.code_verifier) {
+        search.code_challenge = base64url_encode(await generateCodeChallenge(oauth22.code_verifier));
+        search.code_challenge_method = "S256";
+      }
+      if (oauth22.scope) {
+        search.scope = oauth22.scope;
+      }
+      if (oauth22.prompt) {
+        search.prompt = oauth22.prompt;
+      }
+      return everything_default.url(url2, { search });
+    }
+    function getAccessTokenRequest(grant_type = null) {
+      assert2(oauth22, {
+        client_id: /.+/,
+        redirect_uri: /.+/
+      });
+      if (!oauth22.token_endpoint) {
+        throw everything_default.metroError("oauth2mw: Missing options.endpoints.token url");
+      }
+      let url2 = everything_default.url(oauth22.token_endpoint, { hash: "" });
+      let params2 = {
+        grant_type: grant_type || oauth22.grant_type,
+        client_id: oauth22.client_id
+      };
+      if (oauth22.code_verifier) {
+        params2.code_verifier = base64url_encode(oauth22.code_verifier);
+      }
+      if (oauth22.client_secret) {
+        params2.client_secret = oauth22.client_secret;
+      }
+      if (oauth22.scope) {
+        params2.scope = oauth22.scope;
+      }
+      switch (oauth22.grant_type) {
+        case "authorization_code":
+          params2.redirect_uri = oauth22.redirect_uri;
+          params2.code = options.tokens.get("authorization_code");
+          if (options.dpop) {
+            const keyPair = options.tokens.get("keyPair");
+            params2.dpop_jkt = keyPair.publicKey;
+          }
+          break;
+        case "client_credentials":
+          break;
+        case "refresh_token":
+          params2.refresh_token = oauth22.refresh_token;
+          break;
+        default:
+          throw new Error("Unknown grant_type: ".oauth2.grant_type);
+          break;
+      }
+      return everything_default.request(url2, { method: "POST", body: new URLSearchParams(params2) });
+    }
+  }
+  function isExpired(token) {
+    if (!token) {
+      return true;
+    }
+    let expires = new Date(token.expires);
+    let now = /* @__PURE__ */ new Date();
+    return now.getTime() > expires.getTime();
+  }
+  function getExpires(duration) {
+    if (duration instanceof Date) {
+      return new Date(duration.getTime());
+    }
+    if (typeof duration === "number") {
+      let date = /* @__PURE__ */ new Date();
+      date.setSeconds(date.getSeconds() + duration);
+      return date;
+    }
+    throw new TypeError("Unknown expires type " + duration);
+  }
+  function generateCodeVerifier(size = 64) {
+    const code_verifier = new Uint8Array(size);
+    globalThis.crypto.getRandomValues(code_verifier);
+    return code_verifier;
+  }
+  async function generateCodeChallenge(code_verifier) {
+    const b64encoded = base64url_encode(code_verifier);
+    const encoder2 = new TextEncoder();
+    const data = encoder2.encode(b64encoded);
+    return await globalThis.crypto.subtle.digest("SHA-256", data);
+  }
+  function base64url_encode(buffer) {
+    const byteString = Array.from(new Uint8Array(buffer), (b) => String.fromCharCode(b)).join("");
+    return btoa(byteString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  function createState(length) {
+    const validChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    let randomState = "";
+    let counter = 0;
+    while (counter < length) {
+      randomState += validChars.charAt(Math.floor(Math.random() * validChars.length));
+      counter++;
+    }
+    return randomState;
+  }
+  function isRedirected() {
+    let url2 = new URL(document.location.href);
+    if (!url2.searchParams.has("code")) {
+      if (url2.hash) {
+        let query = url2.hash.substr(1);
+        params = new URLSearchParams("?" + query);
+        if (params.has("code")) {
+          return true;
+        }
+      }
+      return false;
+    }
+    return true;
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mockserver.mjs
+  var oauth2_mockserver_exports = {};
+  __export(oauth2_mockserver_exports, {
+    default: () => oauth2mockserver
+  });
+  var baseResponse = {
+    status: 200,
+    statusText: "OK",
+    headers: {
+      "Content-Type": "application/json"
+    }
+  };
+  var badRequest = (error4) => {
+    return {
+      status: 400,
+      statusText: "Bad Request",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        error: "invalid_request",
+        error_description: error4
+      })
+    };
+  };
+  var error3;
+  var pkce = {};
+  function oauth2mockserver(options = {}) {
+    const defaultOptions = {
+      "PKCE": false,
+      "DPoP": false
+    };
+    options = Object.assign({}, defaultOptions, options);
+    return async (req, next) => {
+      let url2 = everything_default.url(req.url);
+      switch (url2.pathname) {
+        case "/authorize/":
+          if (error3 = fails2(url2.searchParams, {
+            response_type: "code",
+            client_id: "mockClientId",
+            state: Optional2(/.*/)
+          })) {
+            return everything_default.response(badRequest(error3));
+          }
+          if (url2.searchParams.has("code_challenge")) {
+            if (!url2.searchParams.has("code_challenge_method")) {
+              return everything_default.response(badRequest("missing code_challenge_method"));
+            }
+            pkce.code_challenge = url2.searchParams.get("code_challenge");
+            pkce.code_challenge_method = url2.searchParams.get("code_challenge_method");
+          }
+          return everything_default.response(baseResponse, {
+            body: JSON.stringify({
+              code: "mockAuthorizeToken",
+              state: url2.searchParams.get("state")
+            })
+          });
+          break;
+        case "/token/":
+          if (req.body[Symbol.metroSource] instanceof URLSearchParams) {
+            let body = {};
+            req.body.forEach((value, key) => body[key] = value);
+            req = req.with({ body });
+          }
+          if (error3 = fails2(req, {
+            method: "POST",
+            body: {
+              grant_type: oneOf2("refresh_token", "authorization_code")
+            }
+          })) {
+            return everything_default.response(badRequest(error3));
+          }
+          switch (req.body.grant_type) {
+            case "refresh_token":
+              if (error3 = fails2(req.body, oneOf2({
+                refresh_token: "mockRefreshToken",
+                client_id: "mockClientId",
+                client_secret: "mockClientSecret"
+              }, {
+                refresh_token: "mockRefreshToken",
+                client_id: "mockClientId",
+                code_verifier: /.+/
+              }))) {
+                return everything_default.response(badRequest(error3));
+              }
+              break;
+            case "access_token":
+              if (error3 = fails2(req.body, oneOf2({
+                client_id: "mockClientId",
+                client_secret: "mockClientSecret"
+              }, {
+                client_id: "mockClientId",
+                code_challenge: /.*/,
+                //FIXME: check that this matches code_verifier
+                code_challenge_method: "S256"
+              }))) {
+                return everything_default.response(badRequest(error3));
+              }
+              break;
+          }
+          return everything_default.response(baseResponse, {
+            body: JSON.stringify({
+              access_token: "mockAccessToken",
+              token_type: "mockExample",
+              expires_in: 3600,
+              refresh_token: "mockRefreshToken",
+              example_parameter: "mockExampleValue"
+            })
+          });
+          break;
+        case "/protected/":
+          let auth = req.headers.get("Authorization");
+          let [type, token] = auth ? auth.split(" ") : [];
+          if (!token || token !== "mockAccessToken") {
+            return everything_default.response({
+              status: 401,
+              statusText: "Forbidden",
+              body: "401 Forbidden"
+            });
+          }
+          return everything_default.response(baseResponse, {
+            body: JSON.stringify({
+              result: "Success"
+            })
+          });
+          break;
+        case "/public/":
+          return everything_default.response(baseResponse, {
+            body: JSON.stringify({
+              result: "Success"
+            })
+          });
+          break;
+        default:
+          return everything_default.response({
+            status: 404,
+            statusText: "not found",
+            body: "404 Not Found " + url2
+          });
+          break;
+      }
+    };
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.discovery.mjs
+  var oauth2_discovery_exports = {};
+  __export(oauth2_discovery_exports, {
+    default: () => makeClient
+  });
+  var validAlgorithms = [
+    "HS256",
+    "HS384",
+    "HS512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "ES256",
+    "ES384",
+    "ES512"
+  ];
+  var validAuthMethods2 = [
+    "client_secret_post",
+    "client_secret_base",
+    "client_secret_jwt",
+    "private_key_jwt"
+  ];
+  var oauth_authorization_server_metadata = {
+    issuer: Required2(validURL2),
+    authorization_endpoint: Required2(validURL2),
+    token_endpoint: Required2(validURL2),
+    jwks_uri: Optional2(validURL2),
+    registration_endpoint: Optional2(validURL2),
+    scopes_supported: Recommended2([]),
+    response_types_supported: Required2(anyOf2("code", "token")),
+    response_modes_supported: Optional2([]),
+    grant_types_supported: Optional2([]),
+    token_endpoint_auth_methods_supported: Optional2([]),
+    token_endpoint_auth_signing_alg_values_supported: Optional2([]),
+    service_documentation: Optional2(validURL2),
+    ui_locales_supported: Optional2([]),
+    op_policy_uri: Optional2(validURL2),
+    op_tos_uri: Optional2(validURL2),
+    revocation_endpoint: Optional2(validURL2),
+    revocation_endpoint_auth_methods_supported: Optional2(validAuthMethods2),
+    revocation_endpoint_auth_signing_alg_values_supported: Optional2(validAlgorithms),
+    introspection_endpoint: Optional2(validURL2),
+    introspection_endpoint_auth_methods_supported: Optional2(validAuthMethods2),
+    introspection_endpoint_auth_signing_alg_values_supported: Optional2(validAlgorithms),
+    code_challendge_methods_supported: Optional2([])
+  };
+  function makeClient(options = {}) {
+    const defaultOptions = {
+      client: everything_default.client()
+    };
+    options = Object.assign({}, defaultOptions, options);
+    assert2(options, {
+      issuer: Required2(validURL2)
+    });
+    const oauth_authorization_server_configuration = fetchWellknownOauthAuthorizationServer(options.issuer);
+    let client2 = options.client.with(options.issuer);
+  }
+  async function fetchWellknownOauthAuthorizationServer(issuer, client2) {
+    let res = client2.get(everything_default.url(issuer, ".wellknown/oauth_authorization_server"));
+    if (res.ok) {
+      assert2(res.headers.get("Content-Type"), /application\/json.*/);
+      let configuration = await res.json();
+      assert2(configuration, oauth_authorization_server_metadata);
+      return configuration;
+    }
+    throw everything_default.metroError("metro.oidcmw: Error while fetching " + issuer + ".wellknown/oauth_authorization_server", res);
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/keysstore.mjs
+  function keysStore() {
+    return new Promise((resolve, reject) => {
+      const request2 = globalThis.indexedDB.open("metro", 1);
+      request2.onupgradeneeded = () => request2.result.createObjectStore("keyPairs", { keyPath: "domain" });
+      request2.onerror = (event) => {
+        reject(event);
+      };
+      request2.onsuccess = (event) => {
+        const db = event.target.result;
+        resolve({
+          set: function(value, key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite", { durability: "strict" });
+              const objectStore = tx.objectStore("keyPairs");
+              tx.oncomplete = () => {
+                resolve2();
+              };
+              tx.onerror = reject2;
+              objectStore.put(value, key);
+            });
+          },
+          get: function(key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readonly");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.get(key);
+              request3.onsuccess = () => {
+                resolve2(request3.result);
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          },
+          clear: function() {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.clear();
+              request3.onsuccess = () => {
+                resolve2();
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          }
+        });
+      };
+    });
+  }
+
+  // node_modules/dpop/build/index.js
+  var encoder = new TextEncoder();
+  var decoder = new TextDecoder();
+  function buf(input) {
+    if (typeof input === "string") {
+      return encoder.encode(input);
+    }
+    return decoder.decode(input);
+  }
+  function checkRsaKeyAlgorithm(algorithm) {
+    if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
+      throw new OperationProcessingError(`${algorithm.name} modulusLength must be at least 2048 bits`);
+    }
+  }
+  function subtleAlgorithm(key) {
+    switch (key.algorithm.name) {
+      case "ECDSA":
+        return { name: key.algorithm.name, hash: "SHA-256" };
+      case "RSA-PSS":
+        checkRsaKeyAlgorithm(key.algorithm);
+        return {
+          name: key.algorithm.name,
+          saltLength: 256 >> 3
+        };
+      case "RSASSA-PKCS1-v1_5":
+        checkRsaKeyAlgorithm(key.algorithm);
+        return { name: key.algorithm.name };
+      case "Ed25519":
+        return { name: key.algorithm.name };
+    }
+    throw new UnsupportedOperationError();
+  }
+  async function jwt(header, claimsSet, key) {
+    if (key.usages.includes("sign") === false) {
+      throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');
+    }
+    const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(claimsSet)))}`;
+    const signature = b64u(await crypto.subtle.sign(subtleAlgorithm(key), key, buf(input)));
+    return `${input}.${signature}`;
+  }
+  var CHUNK_SIZE = 32768;
+  function encodeBase64Url(input) {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  }
+  function b64u(input) {
+    return encodeBase64Url(input);
+  }
+  function randomBytes() {
+    return b64u(crypto.getRandomValues(new Uint8Array(32)));
+  }
+  var UnsupportedOperationError = class extends Error {
+    constructor(message) {
+      super(message ?? "operation not supported");
+      this.name = this.constructor.name;
+      Error.captureStackTrace?.(this, this.constructor);
+    }
+  };
+  var OperationProcessingError = class extends Error {
+    constructor(message) {
+      super(message);
+      this.name = this.constructor.name;
+      Error.captureStackTrace?.(this, this.constructor);
+    }
+  };
+  function psAlg(key) {
+    switch (key.algorithm.hash.name) {
+      case "SHA-256":
+        return "PS256";
+      default:
+        throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name");
+    }
+  }
+  function rsAlg(key) {
+    switch (key.algorithm.hash.name) {
+      case "SHA-256":
+        return "RS256";
+      default:
+        throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name");
+    }
+  }
+  function esAlg(key) {
+    switch (key.algorithm.namedCurve) {
+      case "P-256":
+        return "ES256";
+      default:
+        throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve");
+    }
+  }
+  function determineJWSAlgorithm(key) {
+    switch (key.algorithm.name) {
+      case "RSA-PSS":
+        return psAlg(key);
+      case "RSASSA-PKCS1-v1_5":
+        return rsAlg(key);
+      case "ECDSA":
+        return esAlg(key);
+      case "Ed25519":
+        return "EdDSA";
+      default:
+        throw new UnsupportedOperationError("unsupported CryptoKey algorithm name");
+    }
+  }
+  function isCryptoKey(key) {
+    return key instanceof CryptoKey;
+  }
+  function isPrivateKey(key) {
+    return isCryptoKey(key) && key.type === "private";
+  }
+  function isPublicKey(key) {
+    return isCryptoKey(key) && key.type === "public";
+  }
+  function epochTime() {
+    return Math.floor(Date.now() / 1e3);
+  }
+  async function DPoP(keypair, htu, htm, nonce, accessToken, additional) {
+    const privateKey = keypair?.privateKey;
+    const publicKey = keypair?.publicKey;
+    if (!isPrivateKey(privateKey)) {
+      throw new TypeError('"keypair.privateKey" must be a private CryptoKey');
+    }
+    if (!isPublicKey(publicKey)) {
+      throw new TypeError('"keypair.publicKey" must be a public CryptoKey');
+    }
+    if (publicKey.extractable !== true) {
+      throw new TypeError('"keypair.publicKey.extractable" must be true');
+    }
+    if (typeof htu !== "string") {
+      throw new TypeError('"htu" must be a string');
+    }
+    if (typeof htm !== "string") {
+      throw new TypeError('"htm" must be a string');
+    }
+    if (nonce !== void 0 && typeof nonce !== "string") {
+      throw new TypeError('"nonce" must be a string or undefined');
+    }
+    if (accessToken !== void 0 && typeof accessToken !== "string") {
+      throw new TypeError('"accessToken" must be a string or undefined');
+    }
+    if (additional !== void 0 && (typeof additional !== "object" || additional === null || Array.isArray(additional))) {
+      throw new TypeError('"additional" must be an object');
+    }
+    return jwt({
+      alg: determineJWSAlgorithm(privateKey),
+      typ: "dpop+jwt",
+      jwk: await publicJwk(publicKey)
+    }, {
+      ...additional,
+      iat: epochTime(),
+      jti: randomBytes(),
+      htm,
+      nonce,
+      htu,
+      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : void 0
+    }, privateKey);
+  }
+  async function publicJwk(key) {
+    const { kty, e, n, x, y, crv } = await crypto.subtle.exportKey("jwk", key);
+    return { kty, crv, e, n, x, y };
+  }
+  async function generateKeyPair(alg, options) {
+    let algorithm;
+    if (typeof alg !== "string" || alg.length === 0) {
+      throw new TypeError('"alg" must be a non-empty string');
+    }
+    switch (alg) {
+      case "PS256":
+        algorithm = {
+          name: "RSA-PSS",
+          hash: "SHA-256",
+          modulusLength: options?.modulusLength ?? 2048,
+          publicExponent: new Uint8Array([1, 0, 1])
+        };
+        break;
+      case "RS256":
+        algorithm = {
+          name: "RSASSA-PKCS1-v1_5",
+          hash: "SHA-256",
+          modulusLength: options?.modulusLength ?? 2048,
+          publicExponent: new Uint8Array([1, 0, 1])
+        };
+        break;
+      case "ES256":
+        algorithm = { name: "ECDSA", namedCurve: "P-256" };
+        break;
+      case "EdDSA":
+        algorithm = { name: "Ed25519" };
+        break;
+      default:
+        throw new UnsupportedOperationError();
+    }
+    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, ["sign", "verify"]);
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.dpop.mjs
+  function dpopmw(options) {
+    assert2(options, {
+      site: Required2(validURL2),
+      authorization_endpoint: Required2(validURL2),
+      token_endpoint: Required2(validURL2)
+      //		dpop_signing_alg_values_supported: Required([]) // this property is unfortunately rarely supported
+    });
+    return async (req, next) => {
+      const keys = await keysStore();
+      let keyInfo = await keys.get(options.site);
+      if (!keyInfo) {
+        let keyPair = await generateKeyPair("ES256");
+        keyInfo = { domain: options.site, keyPair };
+        await keys.set(keyInfo);
+      }
+      const url2 = everything_default.url(req.url);
+      if (req.url.startsWith(options.authorization_endpoint) || req.url.startsWith(options.token_endpoint)) {
+        const dpopHeader = await DPoP(keyInfo.keyPair, req.url, req.method);
+        req = req.with({
+          headers: {
+            "DPoP": dpopHeader
+          }
+        });
+      } else if (req.headers.has("Authorization")) {
+        const nonce = localStorage.getItem(url2.host + ":nonce") || void 0;
+        const accessToken = req.headers.get("Authorization").split(" ")[1];
+        const dpopHeader = await DPoP(keyInfo.keyPair, req.url, req.method, nonce, accessToken);
+        req = req.with({
+          headers: {
+            "Authorization": "DPoP " + accessToken,
+            //solidcommunity server sends accesstoken with type Bearer
+            "DPoP": dpopHeader
+          }
+        });
+      }
+      let response2 = await next(req);
+      if (response2.headers.get("DPoP-Nonce")) {
+        localStorage.setItem(url2.host + ":nonce", response2.headers.get("DPoP-Nonce"));
+      }
+      return response2;
+    };
+  }
+
+  // node_modules/@muze-nl/metro-oauth2/src/browser.mjs
+  var oauth2 = Object.assign(oauth2mw, oauth2_exports, {
+    mockserver: oauth2_mockserver_exports,
+    discovery: oauth2_discovery_exports,
+    tokenstore: tokenStore,
+    dpopmw,
+    keysstore: keysStore
+  });
+  globalThis.oauth2 = oauth2;
+  var browser_default = oauth2;
+
+  // src/oidc.store.mjs
+  function oidcStore(site) {
+    let store;
+    if (typeof localStorage !== "undefined") {
+      store = {
+        get: (name) => JSON.parse(localStorage.getItem("metro/oidc:" + site + ":" + name)),
+        set: (name, value) => localStorage.setItem("metro/oidc:" + site + ":" + name, JSON.stringify(value)),
+        has: (name) => localStorage.getItem("metro/oidc:" + site + ":" + name) !== null
+      };
+    } else {
+      let storeMap = /* @__PURE__ */ new Map();
+      store = {
+        get: (name) => JSON.parse(storeMap.get("metro/oidc:" + site + ":" + name) || null),
+        set: (name, value) => storeMap.set("metro/oidc:" + site + ":" + name, JSON.stringify(value)),
+        has: (name) => storeMap.has("metro/oidc:" + site + ":" + name)
+      };
+    }
+    return store;
+  }
+
+  // src/oidcmw.mjs
+  function oidcmw(options = {}) {
+    const defaultOptions = {
+      client: everything_default.client(),
+      force_authorization: false
+    };
+    options = Object.assign({}, defaultOptions, options);
+    assert(options, {
+      client: Required(instanceOf(everything_default.client().constructor)),
+      // required because it is set in defaultOptions
+      client_info: Required(),
+      issuer: Required(validURL),
+      oauth2: Optional({}),
+      openid_configuration: Optional()
+    });
+    if (!options.store) {
+      options.store = oidcStore(options.issuer);
+    }
+    if (!options.openid_configuration && options.store.has("openid_configuration")) {
+      options.openid_configuration = options.store.get("openid_configuration");
+    }
+    if (!options.client_info.client_id && options.store.has("client_info")) {
+      options.client_info = options.store.get("client_info");
+    }
+    return async (req, next) => {
+      let res;
+      if (!options.force_authorization) {
+        try {
+          res = await next(req);
+        } catch (err) {
+          if (res.status != 401 && res.status != 403) {
+            throw err;
+          }
+        }
+        if (res.ok || res.status != 401 && res.status != 403) {
+          return res;
+        }
+      }
+      if (!options.openid_configuration) {
+        options.openid_configuration = await oidcDiscovery({
+          issuer: options.issuer
+        });
+        options.store.set("openid_configuration", options.openid_configuration);
+      }
+      if (!options.client_info?.client_id) {
+        assert(options.client_info?.client_name, Required());
+        if (!options.openid_configuration.registration_endpoint) {
+          throw everything_default.metroError("metro.oidcmw: Error: issuer " + options.issuer + " does not support dynamic client registration, but you haven't specified a client_id");
+        }
+        options.client_info = await register({
+          registration_endpoint: options.openid_configuration.registration_endpoint,
+          client_info: options.client_info
+        });
+        options.store.set("client_info", options.client_info);
+      }
+      const scope = options.scope || "openid";
+      const oauth2Options = Object.assign(
+        {
+          site: options.issuer,
+          client: options.client,
+          force_authorization: true,
+          oauth2_configuration: {
+            client_id: options.client_info.client_id,
+            client_secret: options.client_info.client_secret,
+            grant_type: "authorization_code",
+            response_type: "code",
+            response_mode: "query",
+            authorization_endpoint: options.openid_configuration.authorization_endpoint,
+            token_endpoint: options.openid_configuration.token_endpoint,
+            scope,
+            //FIXME: should only use scopes supported by server
+            redirect_uri: options.client_info.redirect_uris[0]
+            //FIXME: find the best match?
+          }
+        }
+        //...
+      );
+      const dpopOptions = {
+        site: options.issuer,
+        authorization_endpoint: options.openid_configuration.authorization_endpoint,
+        token_endpoint: options.openid_configuration.token_endpoint,
+        dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported
+      };
+      const storeIdToken = async (req2, next2) => {
+        const res2 = await next2(req2);
+        const contentType = res2.headers.get("content-type");
+        if (contentType?.startsWith("application/json")) {
+          const res22 = res2.clone();
+          try {
+            let data = await res22.json();
+            if (data && data.id_token) {
+              options.store.set("id_token", data.id_token);
+            }
+          } catch (e) {
+          }
+        }
+        return res2;
+      };
+      const dPopClient = options.client.with(options.issuer).with(storeIdToken).with(browser_default.dpopmw(dpopOptions));
+      oauth2Options.client = dPopClient;
+      const oauth2client = dPopClient.with(browser_default(oauth2Options));
+      res = await oauth2client.fetch(req);
+      return res;
+    };
+  }
+  function isRedirected2() {
+    return browser_default.isRedirected();
+  }
+  function idToken(options) {
+    return options.store.get("id_token");
+  }
+
+  // src/browser.mjs
+  var oidc = Object.assign(oidcmw, {
+    discover: oidcDiscovery,
+    register,
+    isRedirected: isRedirected2,
+    idToken
+  });
+  globalThis.oidc = oidc;
+})();
 //# sourceMappingURL=browser.js.map