@muze-nl/metro-oidc 0.1.5 → 0.3.0

package/dist/browser.min.js

@@ -1,2 +1,2 @@
-(()=>{var Fe=Object.defineProperty;var G=(e,r)=>{for(var t in r)Fe(e,t,{get:r[t],enumerable:!0})};var ue={};G(ue,{client:()=>Ve,formdata:()=>xe,metroError:()=>j,request:()=>X,response:()=>ce,trace:()=>$e,url:()=>q});var B="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var K=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let n in t)n=="middlewares"?this.#r(t[n]):typeof t[n]=="function"?this.#e[n]=t[n](this.#e[n],this.#e):this.#e[n]=t[n];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...n){return this.fetch(X(this.#e,...n,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(n=>typeof n!="function");if(t>=0)throw j("metro.client: middlewares must be a function or an array of functions "+B+"client/invalid-middlewares-value/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=X(r,t),!r.url)throw j("metro.client."+r.method.toLowerCase()+": Missing url parameter "+B+"client/missing-url-param/",r);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw j("metro.client.fetch: Options is not an object");let o=[async function(a){if(a[Symbol.metroProxy])if(a.body&&a.body[Symbol.metroSource]){let S=a.body[Symbol.metroSource];a=new Request(a[Symbol.metroSource],{body:S})}else a=a[Symbol.metroSource];let y=await fetch(a);return ce(y)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let l of o)i=function(a,y){return async function(S){let c,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,S,y);c=await y(S,a);for(let u of d)u.response&&u.response.call(u,c,y);return c}}(i,l);return i(r)}with(...r){return new e(this,...r)}};function Ve(...e){return new K(...e)}function ae(e,r){let t=r.body;return t||(e===null?t=new ReadableStream:e instanceof ReadableStream?t=e:e instanceof Blob?t=e.stream():t=new ReadableStream({start(n){let o;switch(typeof e){case"object":if(typeof e.toString=="function")o=e.toString();else if(e instanceof FormData)o=new URLSearchParams(e).toString();else if(e instanceof ArrayBuffer||ArrayBuffer.isView(e))o=e;else throw j("Cannot convert body to ReadableStream",e);break;case"string":case"number":case"boolean":o=e;break;default:throw j("Cannot convert body to ReadableStream",e)}n.enqueue(o),n.close()}})),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return e;case"toString":return function(){return""+e}}if(e&&typeof e=="object"&&o in e)return typeof e[o]=="function"?function(...l){return e[o].apply(e,l)}:e[o];if(o in n&&o!="toString")return typeof n[o]=="function"?function(...l){return n[o].apply(n,l)}:n[o]},has(n,o){return e&&typeof e=="object"?o in e:o in n},ownKeys(n){return Reflect.ownKeys(e&&typeof e=="object"?e:n)},getOwnPropertyDescriptor(n,o){return Object.getOwnPropertyDescriptor(e&&typeof e=="object"?e:n,o)}})}function We(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let o=e[n];if(!(typeof o>"u"||o==null))if(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function")o(t[n],t);else if(n=="url")t.url=q(t.url,o);else if(n=="headers"){t.headers=new Headers(r.headers),o instanceof Headers||(o=new Headers(e.headers));for(let[i,l]of o.entries())t.headers.set(i,l)}else t[n]=o}return t}function X(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?r.url=q(r.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?r.body=o:o&&typeof o=="object"&&Object.assign(r,We(o,r));let t=r.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(r.body=JSON.stringify(t));let n=new Request(r.url,r);return Object.freeze(n),new Proxy(n,{get(o,i,l){switch(i){case Symbol.metroSource:return o;case Symbol.metroProxy:return!0;case"with":return function(...a){return t&&a.unshift({body:t}),X(o,...a)};case"body":if(t||(t=o.body),t)return t[Symbol.metroProxy]?t:ae(t,o);break}return o[i]instanceof Function?o[i].bind(o):o[i]}})}function Se(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["status","statusText","headers","body","url","type","redirected"]){let o=e[n];typeof o>"u"||o==null||(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function"?o(t[n],t):n=="url"?t.url=new URL(o,t.url||"https://localhost/"):t[n]=o)}return t}function ce(...e){let r={};for(let n of e)typeof n=="string"?r.body=n:n instanceof Response?Object.assign(r,Se(n,r)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof TypedArray<"u"&&n instanceof TypedArray?r.body=n:Object.assign(r,Se(n,r)));let t=new Response(r.body,r);return Object.freeze(t),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...l){return ce(n,...l)};case"body":return r.body?r.body[Symbol.metroProxy]?r.body:ae(r.body,n):ae("",n);case"ok":return n.status>=200&&n.status<400;case"headers":return n.headers;default:if(o in r&&o!="toString")return r[o];if(o in n&&o!="toString")return typeof n[o]=="function"?function(...l){return n[o].apply(n,l)}:n[o];break}}})}function ke(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,n)=>{e.searchParams.append(n,t)}))}function q(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let n of e)if(typeof n=="string"||n instanceof String)t=new URL(n,t);else if(n instanceof URL||typeof Location<"u"&&n instanceof Location)t=new URL(n);else if(n instanceof URLSearchParams)ke(t,n);else if(n&&typeof n=="object")for(let o in n)if(o=="search")typeof n.search=="function"?n.search(t.search,t):t.search=new URLSearchParams(n.search);else if(o=="searchParams")ke(t,n.searchParams);else{if(!r.includes(o))throw j("metro.url: unknown url parameter "+B+"url/unknown-param-name/",o);if(typeof n[o]=="function")n[o](t[o],t);else if(typeof n[o]=="string"||n[o]instanceof String||typeof n[o]=="number"||n[o]instanceof Number||typeof n[o]=="boolean"||n[o]instanceof Boolean)t[o]=""+n[o];else if(typeof n[o]=="object"&&n[o].toString)t[o]=n[o].toString();else throw j("metro.url: unsupported value for "+o+" "+B+"url/unsupported-param-value/",e[o])}else throw j("metro.url: unsupported option value "+B+"url/unsupported-option-value/",n);return Object.freeze(t),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...l){return q(n,...l)}}return n[o]instanceof Function?n[o].bind(n):n[o]}})}function xe(...e){var r=new FormData;for(let t of e)if(t instanceof FormData)for(let n of t.entries())r.append(n[0],n[1]);else if(t&&typeof t=="object")for(let n of Object.entries(t))if(Array.isArray(n[1]))for(let o of n[1])r.append(n[0],o);else r.append(n[0],n[1]);else throw new j("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(r),new Proxy(r,{get:(t,n,o)=>{switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return xe(t,...i)}}return t[n]instanceof Function?t[n].bind(t):t[n]}})}var N={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function j(e,...r){return N.error(e,...r),new Error(e,...r)}var $e={add(e,r){K.tracers[e]=r},delete(e){delete K.tracers[e]},clear(){K.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,N.group(e),N.info(r?.url,r,t)},response:(r,t)=>{N.info(r?.body?r.body[Symbol.metroSource]:null,r,t),N.groupEnd(e),e--}}}};function C(e){return e=Object.assign({reviver:null,replacer:null,space:""},e),async(r,t)=>{["POST","PUT","PATCH","QUERY"].includes(r.method)?(r=r.with({headers:{"Content-Type":"application/json",Accept:"application/json"}}),r.body&&typeof r.body[Symbol.metroSource]=="object"&&(r=r.with({body:JSON.stringify(r.body[Symbol.metroSource],e.replacer,e.space)}))):r=r.with({headers:{Accept:"application/json"}});let n=await t(r),o=await n.text(),i=JSON.parse(o,e.reviver);return n.with({body:i})}}function D(e){return async(r,t)=>{let n=await t(r);if(!n.ok)if(e&&typeof e[n.status]=="function")n=e[n.status].apply(n,r);else throw new Error(n.status+": "+n.statusText,{cause:n});return n}}var ve=Object.assign({},ue,{mw:{jsonmw:C,thrower:D}});globalThis.metro=ve;var f=ve;globalThis.assertEnabled=!1;function E(e,r){if(globalThis.assertEnabled){let t=A(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,n,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return A(t,e,n,o)}}function w(e){return function(t,n,o){return t==null||typeof t>"u"?m("data is required",t,e||"any value",o):typeof e<"u"?A(t,e,n,o):!1}}function J(e){return function(t,n,o){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,o),!1):A(t,e,n,o)}}function x(...e){return function(t,n,o){for(let i of e)if(!A(t,i,n,o))return!1;return m("data does not match oneOf patterns",t,e,o)}}function H(...e){return function(t,n,o){if(!Array.isArray(t))return m("data is not an array",t,"anyOf",o);for(let i of t)if(x(...e)(i))return m("data does not match anyOf patterns",i,e,o);return!1}}function Re(...e){return function(t,n,o){let i=[];for(let l of e)i=i.concat(A(t,l,n,o));if(i=i.filter(Boolean),i.length)return m("data does not match all given patterns",t,e,o,i)}}function h(e,r,t){try{e instanceof URL&&(e=e.href);let n=new URL(e);if(n.href!=e&&!(n.href+"/"==e||n.href==e+"/"))return m("data is not a valid url",e,"validURL",t)}catch{return m("data is not a valid url",e,"validURL",t)}}function Ae(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return m("data is not a valid email",e,"validEmail",t)}function I(e){return function(t,n,o){if(!(t instanceof e))return m("data is not an instanceof pattern",t,e,o)}}function M(e){return function(t,n,o){if(!A(t,e,n,o))return m("data matches pattern, when required not to",t,e,o)}}function A(e,r,t,n=""){t||(t=e);let o=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(m("data is not a boolean",e,r,n));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(m("data is not a number",e,r,n));else if(r===String)typeof e!="string"&&!(e instanceof String)&&o.push(m("data is not a string",e,r,n)),e==""&&o.push(m("data is an empty string, which is not allowed",e,r,n));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((l,a)=>A(l,r,t,n+"["+a+"]"));i>-1&&o.push(m("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else typeof e>"u"?o.push(m("data is undefined, should match pattern",e,r,n)):r.test(e)||o.push(m("data does not match pattern",e,r,n));else if(r instanceof Function){let i=r(e,t,n);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(r)){Array.isArray(e)||o.push(m("data is not an array",e,[],n));for(let i of r)for(let l of e.keys()){let a=A(e[l],i,t,n+"["+l+"]");Array.isArray(a)?o=o.concat(a):a&&o.push(a)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((l,a)=>A(l,r,t,n+"["+a+"]"));i>-1&&o.push(m("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else if(!e||typeof e!="object")o.push(m("data is not an object, pattern is",e,r,n));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=A(e,r,t,n);i&&(o=o.concat(i))}else for(let[i,l]of Object.entries(r)){let a=A(e[i],l,t,n+"."+i);a&&(o=o.concat(a))}else r!=e&&o.push(m("data and pattern are not equal",e,r,n));return o.length?o:!1}function m(e,r,t,n,o){let i={message:e,found:r,expected:t,path:n};return o&&(i.problems=o),i}var F=(...e)=>(r,t)=>e.filter(n=>t.hasOwnKey(n)).length>0?!1:m("root data must have all of",t,e),z=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:m("data must be an array which includes",r,e);var O=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],ee=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function V(e={}){E(e,{client:s(I(f.client().constructor)),issuer:w(h)});let r={client:f.client().with(D()).with(C()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function n(y){return t}let o={issuer:w(Re(e.issuer,n)),authorization_endpoint:w(h),token_endpoint:w(h),userinfo_endpoint:J(h),jwks_uri:w(h),registration_endpoint:e.requireDynamicRegistration?w(h):J(h),scopes_supported:J(z("openid")),response_types_supported:e.requireDynamicRegistration?w(z("code","id_token","id_token token")):w([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(z("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:w([]),id_token_signing_alg_values_supported:w(z("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(z("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(H(...ee)),token_endpoint_auth_signing_alg_values_supported:s(z("RS256"),M(z("none"))),display_values_supported:s(H("page","popup","touch","wap")),claim_types_supported:s(H("normal","aggregated","distributed")),claims_supported:J([]),service_documentation:s(h),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(h),op_tos_uri:s(h)},i=f.url(e.issuer,".well-known/openid-configuration"),a=(await e.client.get(i)).body[Symbol.metroSource];return E(a,o),E(a.issuer,e.issuer),a}async function W(e){let r={redirect_uris:w([h]),response_types:s([]),grant_types:s(H("authorization_code","refresh_token")),application_type:s(x("native","web")),contacts:s([Ae]),client_name:s(String),logo_uri:s(h),client_uri:s(h),policy_uri:s(h),tos_uri:s(h),jwks_uri:s(h,M(F("jwks"))),jwks:s(h,M(F("jwks_uri"))),sector_identifier_uri:s(h),subject_type:s(String),id_token_signed_response_alg:s(x(...O)),id_token_encrypted_response_alg:s(x(...O)),id_token_encrypted_response_enc:s(x(...O),F("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(x(...O)),userinfo_encrypted_response_alg:s(x(...O)),userinfo_encrypted_response_enc:s(x(...O),F("userinfo_encrypted_response_alg")),request_object_signing_alg:s(x(...O)),request_object_encryption_alg:s(x(...O)),request_object_encryption_enc:s(x(...O)),token_endpoint_auth_method:s(x(...ee)),token_endpoint_auth_signing_alg:s(x(...O)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([h]),request_uris:s([h])};E(e,{client:s(I(f.client().constructor)),registration_endpoint:h,client_info:r});let t={client:f.client().with(D()).with(C())};e=Object.assign({},t,e);let n=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=n.body;if(!o.client_id||!o.client_secret)throw f.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",n);return e.client_info=Object.assign(e.client_info,o),e.client_info}var he={};G(he,{base64url_encode:()=>de,createState:()=>ze,default:()=>re,generateCodeChallenge:()=>Te,generateCodeVerifier:()=>Ee,getExpires:()=>fe,isExpired:()=>je,isRedirected:()=>Ye});globalThis.assertEnabled=!1;var P=(e,r)=>{if(globalThis.assertEnabled){let t=v(e,r);if(t)throw new le("Assertions failed",t,e)}},g=e=>r=>r==null||typeof r>"u"?!1:v(r,e),R=e=>r=>v(r,e),Oe=e=>r=>r==null||typeof r>"u"?(console.warning("data does not contain recommended value",r,e),!1):v(r,e),$=(...e)=>r=>{for(let t of e)if(!v(r,t))return!1;return k("data does not match oneOf patterns",r,e)},Pe=(...e)=>r=>{if(!Array.isArray(r))return k("data is not an array",r,"anyOf");for(let t of r)if($(...e)(t))return k("data does not match anyOf patterns",t,e);return!1};function b(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return k("data is not a valid url",e,"validURL")}catch{return k("data is not a valid url",e,"validURL")}return!1}function v(e,r,t){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&n.push(k("data is not a boolean",e,r));else if(r===Number)typeof e!="number"&&n.push(k("data is not a number",e,r));else if(r instanceof RegExp)if(Array.isArray(e)){let o=e.findIndex(i=>v(i,r,t));o>-1&&n.push(k("data["+o+"] does not match pattern",e[o],r))}else r.test(e)||n.push(k("data does not match pattern",e,r));else if(r instanceof Function)r(e,t)&&n.push(k("data does not match function",e,r));else if(Array.isArray(r)){Array.isArray(e)||n.push(k("data is not an array",e,[]));for(p of r){let o=v(e,p,t);Array.isArray(o)?n.concat(o):o&&n.push(o)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let o=e.findIndex(i=>v(i,r,t));o>-1&&n.push(k("data["+o+"] does not match pattern",e[o],r))}else if(!e||typeof e!="object")n.push(k("data is not an object, pattern is",e,r));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let o=n[n.length-1];for(let[i,l]of Object.entries(r)){let a=v(e[i],l,t);a&&((!o||typeof o=="string")&&(o={},n.push(k(o,e[i],l))),o[i]=a.problems)}}else r!=e&&n.push(k("data and pattern are not equal",e,r));return n.length?n:!1}var le=class extends Error{constructor(r,t,...n){super(r),this.problems=t,this.details=n}};function k(e,r,t){return{message:e,found:r,expected:t}}function te(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:n=>localStorage.setItem("metro/state:"+e,n),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:n=>JSON.parse(localStorage.getItem(e+":"+n)),set:(n,o)=>localStorage.setItem(e+":"+n,JSON.stringify(o)),has:n=>localStorage.getItem(e+":"+n)!==null};else{let n=new Map;r={get:()=>n.get("metro/state:"+e),set:o=>n.set("metro/state:"+e,o),has:()=>n.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function re(e){let r={client:f.client(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:Ee(64)},callbacks:{authorize:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)}};P(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let n=te(e.site);e.tokens||(e.tokens=n.tokens),e.state||(e.state=n.state),P(e,{oauth2_configuration:{client_id:R(/.+/),grant_type:"authorization_code",authorization_endpoint:R(b),token_endpoint:R(b),redirect_uri:R(b)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,d){if(e.force_authorization)return o(c,d);let u;try{if(u=await d(c),u.ok)return u}catch(_){switch(u.status){case 400:case 401:return o(c,d)}throw _}if(!u.ok)switch(u.status){case 400:case 401:return o(c,d)}return u};async function o(c,d){i();let u=e.tokens.get("access_token");if(u)if(je(u)){try{if(!await a())return f.response("false")}catch(_){throw _}return o(c,d)}else return c=f.request(c,{headers:{Authorization:u.type+" "+u.value}}),d(c);else{try{if(!await l())return f.response("false")}catch(_){throw _}return o(c,d)}}function i(){if(typeof window<"u"&&window?.location){let c=f.url(window.location),d,u,_;if(c.searchParams.has("code"))_=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let T=c.hash.substr(1);_=new URLSearchParams("?"+T),c=c.with({hash:""}),history.pushState({},"",c.href)}if(_){d=_.get("code"),u=_.get("state");let T=e.state.get("metro/state");if(!u||u!==T)return;d&&e.tokens.set("authorization_code",d)}}}async function l(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let _=y();if(!e.callbacks.authorize||typeof e.callbacks.authorize!="function")throw f.metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.options.callbacks.authorize");let T=await e.callbacks.authorize(_);if(T)e.tokens.set("authorization_code",T);else return!1}let c=S(),d=await e.client.post(c);if(!d.ok){let _=await d.text();throw f.metroError("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText,{cause:c})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:fe(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}return u}async function a(){let c=S("refresh_token"),d=await e.client.post(c);if(!d.ok)throw f.metroError("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:c});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:fe(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}else return!1;return u}function y(){if(!t.authorization_endpoint)throw f.metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=f.url(t.authorization_endpoint,{hash:""});P(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||ze(40)};return e.state.set(d.state),t.client_secret&&(d.client_secret=t.client_secret),t.code_verifier&&(d.code_challenge=Te(t.code_verifier),d.code_challenge_method="S256"),t.scope&&(d.scope=t.scope),f.url(c,{search:d})}function S(c=null){if(P(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw f.metroError("oauth2mw: Missing options.endpoints.token url");let d=f.url(t.token_endpoint,{hash:""}),u={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(u.code_verifier=de(t.code_verifier)),t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),t.grant_type){case"authorization_code":if(u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code"),e.dpop){let _=e.tokens.get("keyPair");u.dpop_jkt=_.publicKey}break;case"client_credentials":break;case"refresh_token":u.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return f.request(d,{method:"POST",body:new URLSearchParams(u)})}}function je(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function fe(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function Ee(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),r}async function Te(e){let r=de(e),n=new TextEncoder().encode(r);return await globalThis.crypto.subtle.digest("SHA-256",n)}function de(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function ze(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",n=0;for(;n<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),n++;return t}function Ye(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}var pe={};G(pe,{default:()=>Ue});var ne={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},Q=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),L,Le={};function Ue(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,n)=>{let o=f.url(t.url);switch(o.pathname){case"/authorize/":if(L=v(o.searchParams,{response_type:"code",client_id:"mockClientId",state:g(/.*/)}))return f.response(Q(L));if(o.searchParams.has("code_challenge")){if(!o.searchParams.has("code_challenge_method"))return f.response(Q("missing code_challenge_method"));Le.code_challenge=o.searchParams.get("code_challenge"),Le.code_challenge_method=o.searchParams.get("code_challenge_method")}return f.response(ne,{body:JSON.stringify({code:"mockAuthorizeToken",state:o.searchParams.get("state")})});case"/token/":if(t.body[Symbol.metroSource]instanceof URLSearchParams){let y={};t.body.forEach((S,c)=>y[c]=S),t=t.with({body:y})}if(L=v(t,{method:"POST",body:{grant_type:$("refresh_token","authorization_code")}}))return f.response(Q(L));switch(t.body.grant_type){case"refresh_token":if(L=v(t.body,$({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return f.response(Q(L));break;case"access_token":if(L=v(t.body,$({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return f.response(Q(L));break}return f.response(ne,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[l,a]=i?i.split(" "):[];return!a||a!=="mockAccessToken"?f.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):f.response(ne,{body:JSON.stringify({result:"Success"})});case"/public/":return f.response(ne,{body:JSON.stringify({result:"Success"})});default:return f.response({status:404,statusText:"not found",body:"404 Not Found "+o})}}}var me={};G(me,{default:()=>Ke});var Ce=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],De=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Ze={issuer:R(b),authorization_endpoint:R(b),token_endpoint:R(b),jwks_uri:g(b),registration_endpoint:g(b),scopes_supported:Oe([]),response_types_supported:R(Pe("code","token")),response_modes_supported:g([]),grant_types_supported:g([]),token_endpoint_auth_methods_supported:g([]),token_endpoint_auth_signing_alg_values_supported:g([]),service_documentation:g(b),ui_locales_supported:g([]),op_policy_uri:g(b),op_tos_uri:g(b),revocation_endpoint:g(b),revocation_endpoint_auth_methods_supported:g(De),revocation_endpoint_auth_signing_alg_values_supported:g(Ce),introspection_endpoint:g(b),introspection_endpoint_auth_methods_supported:g(De),introspection_endpoint_auth_signing_alg_values_supported:g(Ce),code_challendge_methods_supported:g([])};function Ke(e={}){let r={client:f.client()};e=Object.assign({},r,e),P(e,{issuer:R(b)});let t=Ge(e.issuer),n=e.client.with(e.issuer)}async function Ge(e,r){let t=r.get(f.url(e,".wellknown/oauth_authorization_server"));if(t.ok){P(t.headers.get("Content-Type"),/application\/json.*/);let n=await t.json();return P(n,Ze),n}throw f.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}var Xe=new TextEncoder,qe=new TextDecoder;function oe(e){return typeof e=="string"?Xe.encode(e):qe.decode(e)}function He(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new _e(`${e.name} modulusLength must be at least 2048 bits`)}function et(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return He(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return He(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new U}async function tt(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let n=`${Y(oe(JSON.stringify(e)))}.${Y(oe(JSON.stringify(r)))}`,o=Y(await crypto.subtle.sign(et(t),t,oe(n)));return`${n}.${o}`}var Ie=32768;function rt(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Ie)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Ie)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Y(e){return rt(e)}function nt(){return Y(crypto.getRandomValues(new Uint8Array(32)))}var U=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},_e=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function ot(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function it(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function st(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new U("unsupported EcKeyAlgorithm namedCurve")}}function at(e){switch(e.algorithm.name){case"RSA-PSS":return ot(e);case"RSASSA-PKCS1-v1_5":return it(e);case"ECDSA":return st(e);case"Ed25519":return"EdDSA";default:throw new U("unsupported CryptoKey algorithm name")}}function Ne(e){return e instanceof CryptoKey}function ct(e){return Ne(e)&&e.type==="private"}function ut(e){return Ne(e)&&e.type==="public"}function lt(){return Math.floor(Date.now()/1e3)}async function ie(e,r,t,n,o,i){let l=e?.privateKey,a=e?.publicKey;if(!ct(l))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!ut(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(n!==void 0&&typeof n!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return tt({alg:at(l),typ:"dpop+jwt",jwk:await ft(a)},{...i,iat:lt(),jti:nt(),htm:t,nonce:n,htu:r,ath:o?Y(await crypto.subtle.digest("SHA-256",oe(o))):void 0},l)}async function ft(e){let{kty:r,e:t,n,x:o,y:i,crv:l}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:l,e:t,n,x:o,y:i}}async function Be(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new U}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function ye(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=n=>{r(n)},t.onsuccess=n=>{let o=n.target.result;e({set:function(i,l){return new Promise((a,y)=>{let S=o.transaction("keyPairs","readwriteflush",{durability:"strict"}),c=S.objectStore("keyPairs");S.oncomplete=()=>{a()},S.onerror=y,c.put(i,l)})},get:function(i){return new Promise((l,a)=>{let y=o.transaction("keyPairs","readonly"),c=y.objectStore("keyPairs").get(i);c.onsuccess=()=>{l(c.result)},c.onerror=a,y.onerror=a})}})}})}function ge(e){return P(e,{authorization_endpoint:R(b),token_endpoint:R(b)}),async(r,t)=>{let n=await ye(),o=f.url(r.url),i=await n.get(o.host);if(!i){let a=await Be("ES256");i={domain:o.host,keyPair:a},await n.set(i)}if(o.href.startsWith(e.authorization_endpoint)||o.href.startsWith(e.token_endpoint)){let a=await ie(i.keyPair,r.url,r.method);r=r.with({headers:{DPoP:a}})}else if(r.headers.has("Authorization")){let a=localStorage.getItem(o.host+":nonce")||void 0,y=r.headers.get("Authorization").split(" ")[1],S=await ie(i.keyPair,r.url,r.method,a,y);r=r.with({headers:{DPoP:S}})}let l=await t(r);return l.headers.get("DPoP-Nonce")&&localStorage.setItem(o.host+":nonce",l.headers.get("DPoP-Nonce")),l}}var dt=Object.assign(re,he,{mockserver:pe,discovery:me,tokenstore:te,dpopmw:ge}),se=dt;function be(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,n)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(n)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:n=>JSON.parse(t.get("metro/oidc:"+e+":"+n)||null),set:(n,o)=>t.set("metro/oidc:"+e+":"+n,JSON.stringify(o)),has:n=>t.has("metro/oidc:"+e+":"+n)}}return r}function we(e={}){let r={client:f.client(),force_authorization:!1};return e=Object.assign({},r,e),E(e,{client:w(I(f.client().constructor)),client_info:w(),issuer:w(h),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=be(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,n)=>{let o;if(!e.force_authorization){try{o=await n(t)}catch(c){if(o.status!=401&&o.status!=403)throw c}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await V({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(E(e.client_info?.client_name,w()),!e.openid_configuration.registration_endpoint)throw f.metroError("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await W({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,code_verifier:!1,grant_type:"authorization_code",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:e.openid_configuration.scope||"openid",redirect_uri:e.client_info.redirect_uris[0]}}),l={authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported},a=async(c,d)=>{let u=await d(c);if(u.headers.get("content-type")?.startsWith("application/json")){let T=u.clone();try{let Z=await T.json();Z&&Z.id_token&&e.store.set("id_token",Z.id_token)}catch{}}return u},y=e.client.with(e.issuer).with(a).with(se.dpopmw(l));return i.client=y,o=await y.with(se(i)).fetch(t),o}}function Je(){return se.isRedirected()}function Me(e){return e.store.get("id_token")}var ht=Object.assign(we,{discover:V,register:W,isRedirected:Je,idToken:Me});globalThis.oidc=ht;})();
+(()=>{var Ve=Object.defineProperty;var X=(e,r)=>{for(var t in r)Ve(e,t,{get:r[t],enumerable:!0})};var le={};X(le,{client:()=>We,formdata:()=>Se,metroError:()=>E,request:()=>q,response:()=>ue,trace:()=>Qe,url:()=>ee});var J="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var K=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let o in t)o=="middlewares"?this.#r(t[o]):typeof t[o]=="function"?this.#e[o]=t[o](this.#e[o],this.#e):this.#e[o]=t[o];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...o){return this.fetch(q(this.#e,...o,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(o=>typeof o!="function");if(t>=0)throw E("metro.client: middlewares must be a function or an array of functions "+J+"client/invalid-middlewares-value/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=q(r,t),!r.url)throw E("metro.client."+r.method.toLowerCase()+": Missing url parameter "+J+"client/missing-url-param/",r);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw E("metro.client.fetch: Options is not an object");let n=[async function(a){a[Symbol.metroProxy]&&(a=a[Symbol.metroSource]);let y=await fetch(a);return ue(y)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let l of n)i=function(a,y){return async function(g){let c,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,g,y);c=await y(g,a);for(let u of d)u.response&&u.response.call(u,c,y);return c}}(i,l);return i(r)}with(...r){return new e(this,...r)}};function We(...e){return new K(...e)}function $e(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let n=e[o];if(!(typeof n>"u"||n==null))if(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function")t[o]=n(t[o],t);else if(o=="url")t.url=ee(t.url,n);else if(o=="headers"){t.headers=new Headers(r.headers),n instanceof Headers||(n=new Headers(e.headers));for(let[i,l]of n.entries())t.headers.set(i,l)}else t[o]=n}return e instanceof Request&&e.data&&(t.body=e.data),t}function q(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let n of e)typeof n=="string"||n instanceof URL||n instanceof URLSearchParams?r.url=ee(r.url,n):n&&(n instanceof FormData||n instanceof ReadableStream||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView)?r.body=n:n&&typeof n=="object"&&Object.assign(r,$e(n,r));let t=r.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(r.body=JSON.stringify(t));let o=new Request(r.url,r);return Object.freeze(o),new Proxy(o,{get(n,i,l){switch(i){case Symbol.metroSource:return n;case Symbol.metroProxy:return!0;case"with":return function(...a){return t&&a.unshift({body:t}),q(n,...a)};case"body":break;case"data":return t}return n[i]instanceof Function?n[i].bind(n):n[i]}})}function be(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["status","statusText","headers","body","url","type","redirected"]){let n=e[o];typeof n>"u"||n==null||(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function"?t[o]=n(t[o],t):o=="url"?t.url=new URL(n,t.url||"https://localhost/"):t[o]=n)}return e instanceof Response&&e.data&&(t.body=e.data),t}function ue(...e){let r={};for(let n of e)typeof n=="string"?r.body=n:n instanceof Response?Object.assign(r,be(n,r)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof TypedArray<"u"&&n instanceof TypedArray?r.body=n:Object.assign(r,be(n,r)));let t;r.body&&(t=r.body);let o=new Response(r.body,r);return Object.freeze(o),new Proxy(o,{get(n,i,l){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...a){return ue(n,...a)};case"data":return t;case"ok":return n.status>=200&&n.status<400}return typeof n[i]=="function"?n[i].bind(n):n[i]}})}function ke(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,o)=>{e.searchParams.append(o,t)}))}function ee(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let o of e)if(typeof o=="string"||o instanceof String)t=new URL(o,t);else if(o instanceof URL||typeof Location<"u"&&o instanceof Location)t=new URL(o);else if(o instanceof URLSearchParams)ke(t,o);else if(o&&typeof o=="object")for(let n in o)if(n=="search")typeof o.search=="function"?o.search(t.search,t):t.search=new URLSearchParams(o.search);else if(n=="searchParams")ke(t,o.searchParams);else{if(!r.includes(n))throw E("metro.url: unknown url parameter "+J+"url/unknown-param-name/",n);if(typeof o[n]=="function")o[n](t[n],t);else if(typeof o[n]=="string"||o[n]instanceof String||typeof o[n]=="number"||o[n]instanceof Number||typeof o[n]=="boolean"||o[n]instanceof Boolean)t[n]=""+o[n];else if(typeof o[n]=="object"&&o[n].toString)t[n]=o[n].toString();else throw E("metro.url: unsupported value for "+n+" "+J+"url/unsupported-param-value/",e[n])}else throw E("metro.url: unsupported option value "+J+"url/unsupported-option-value/",o);return Object.freeze(t),new Proxy(t,{get(o,n,i){switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...l){return ee(o,...l)}}return o[n]instanceof Function?o[n].bind(o):o[n]}})}function Se(...e){var r=new FormData;for(let t of e)if(t instanceof FormData)for(let o of t.entries())r.append(o[0],o[1]);else if(t&&typeof t=="object")for(let o of Object.entries(t))if(Array.isArray(o[1]))for(let n of o[1])r.append(o[0],n);else r.append(o[0],o[1]);else throw new E("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(r),new Proxy(r,{get:(t,o,n)=>{switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return Se(t,...i)}}return t[o]instanceof Function?t[o].bind(t):t[o]}})}var N={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function E(e,...r){return N.error(e,...r),new Error(e,...r)}var Qe={add(e,r){K.tracers[e]=r},delete(e){delete K.tracers[e]},clear(){K.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,N.group(e),N.info(r?.url,r,t)},response:(r,t)=>{N.info(r?.body?r.body[Symbol.metroSource]:null,r,t),N.groupEnd(e),e--}}}};function C(e){return e=Object.assign({reviver:null,replacer:null,space:""},e),async(r,t)=>{["POST","PUT","PATCH","QUERY"].includes(r.method)?(r=r.with({headers:{"Content-Type":"application/json",Accept:"application/json"}}),r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}))):r=r.with({headers:{Accept:"application/json"}});let o=await t(r),n=await o.text(),i=JSON.parse(n,e.reviver);return o.with({body:i})}}function D(e){return async(r,t)=>{let o=await t(r);if(!o.ok)if(e&&typeof e[o.status]=="function")o=e[o.status].apply(o,r);else throw new Error(o.status+": "+o.statusText,{cause:o});return o}}var xe=Object.assign({},le,{mw:{jsonmw:C,thrower:D}});globalThis.metro=xe;var f=xe;globalThis.assertEnabled=!1;function j(e,r){if(globalThis.assertEnabled){let t=R(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,o,n){if(typeof t<"u"&&t!=null&&typeof e<"u")return R(t,e,o,n)}}function k(e){return function(t,o,n){return t==null||typeof t>"u"?_("data is required",t,e||"any value",n):typeof e<"u"?R(t,e,o,n):!1}}function M(e){return function(t,o,n){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,n),!1):R(t,e,o,n)}}function v(...e){return function(t,o,n){for(let i of e)if(!R(t,i,o,n))return!1;return _("data does not match oneOf patterns",t,e,n)}}function H(...e){return function(t,o,n){if(!Array.isArray(t))return _("data is not an array",t,"anyOf",n);for(let i of t)if(v(...e)(i))return _("data does not match anyOf patterns",i,e,n);return!1}}function ve(...e){return function(t,o,n){let i=[];for(let l of e)i=i.concat(R(t,l,o,n));if(i=i.filter(Boolean),i.length)return _("data does not match all given patterns",t,e,n,i)}}function m(e,r,t){try{e instanceof URL&&(e=e.href);let o=new URL(e);if(o.href!=e&&!(o.href+"/"==e||o.href==e+"/"))return _("data is not a valid url",e,"validURL",t)}catch{return _("data is not a valid url",e,"validURL",t)}}function Ae(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return _("data is not a valid email",e,"validEmail",t)}function I(e){return function(t,o,n){if(!(t instanceof e))return _("data is not an instanceof pattern",t,e,n)}}function B(e){return function(t,o,n){if(!R(t,e,o,n))return _("data matches pattern, when required not to",t,e,n)}}function R(e,r,t,o=""){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&n.push(_("data is not a boolean",e,r,o));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&n.push(_("data is not a number",e,r,o));else if(r===String)typeof e!="string"&&!(e instanceof String)&&n.push(_("data is not a string",e,r,o)),e==""&&n.push(_("data is an empty string, which is not allowed",e,r,o));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((l,a)=>R(l,r,t,o+"["+a+"]"));i>-1&&n.push(_("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else typeof e>"u"?n.push(_("data is undefined, should match pattern",e,r,o)):r.test(e)||n.push(_("data does not match pattern",e,r,o));else if(r instanceof Function){let i=r(e,t,o);i&&(Array.isArray(i)?n=n.concat(i):n.push(i))}else if(Array.isArray(r)){Array.isArray(e)||n.push(_("data is not an array",e,[],o));for(let i of r)for(let l of e.keys()){let a=R(e[l],i,t,o+"["+l+"]");Array.isArray(a)?n=n.concat(a):a&&n.push(a)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((l,a)=>R(l,r,t,o+"["+a+"]"));i>-1&&n.push(_("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else if(!e||typeof e!="object")n.push(_("data is not an object, pattern is",e,r,o));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=R(e,r,t,o);i&&(n=n.concat(i))}else for(let[i,l]of Object.entries(r)){let a=R(e[i],l,t,o+"."+i);a&&(n=n.concat(a))}else r!=e&&n.push(_("data and pattern are not equal",e,r,o));return n.length?n:!1}function _(e,r,t,o,n){let i={message:e,found:r,expected:t,path:o};return n&&(i.problems=n),i}var F=(...e)=>(r,t)=>e.filter(o=>t.hasOwnKey(o)).length>0?!1:_("root data must have all of",t,e),T=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:_("data must be an array which includes",r,e);var O=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],te=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function V(e={}){j(e,{client:s(I(f.client().constructor)),issuer:k(m)});let r={client:f.client().with(D()).with(C()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function o(y){return t}let n={issuer:k(ve(e.issuer,o)),authorization_endpoint:k(m),token_endpoint:k(m),userinfo_endpoint:M(m),jwks_uri:k(m),registration_endpoint:e.requireDynamicRegistration?k(m):M(m),scopes_supported:M(T("openid")),response_types_supported:e.requireDynamicRegistration?k(T("code","id_token","id_token token")):k([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(T("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:k([]),id_token_signing_alg_values_supported:k(T("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(T("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(H(...te)),token_endpoint_auth_signing_alg_values_supported:s(T("RS256"),B(T("none"))),display_values_supported:s(H("page","popup","touch","wap")),claim_types_supported:s(H("normal","aggregated","distributed")),claims_supported:M([]),service_documentation:s(m),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(m),op_tos_uri:s(m)},i=f.url(e.issuer,".well-known/openid-configuration"),a=(await e.client.get(i)).data;return j(a,n),j(a.issuer,e.issuer),a}async function W(e){let r={redirect_uris:k([m]),response_types:s([]),grant_types:s(H("authorization_code","refresh_token")),application_type:s(v("native","web")),contacts:s([Ae]),client_name:s(String),logo_uri:s(m),client_uri:s(m),policy_uri:s(m),tos_uri:s(m),jwks_uri:s(m,B(F("jwks"))),jwks:s(m,B(F("jwks_uri"))),sector_identifier_uri:s(m),subject_type:s(String),id_token_signed_response_alg:s(v(...O)),id_token_encrypted_response_alg:s(v(...O)),id_token_encrypted_response_enc:s(v(...O),F("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(v(...O)),userinfo_encrypted_response_alg:s(v(...O)),userinfo_encrypted_response_enc:s(v(...O),F("userinfo_encrypted_response_alg")),request_object_signing_alg:s(v(...O)),request_object_encryption_alg:s(v(...O)),request_object_encryption_enc:s(v(...O)),token_endpoint_auth_method:s(v(...te)),token_endpoint_auth_signing_alg:s(v(...O)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([m]),request_uris:s([m])};j(e,{client:s(I(f.client().constructor)),registration_endpoint:m,client_info:r});let t={client:f.client().with(D()).with(C())};e=Object.assign({},t,e);let o=await e.client.post(e.registration_endpoint,{body:e.client_info}),n=o.data;if(!n.client_id||!n.client_secret)throw f.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",o);return e.client_info=Object.assign(e.client_info,n),e.client_info}var pe={};X(pe,{base64url_encode:()=>ne,createState:()=>Te,default:()=>oe,generateCodeChallenge:()=>Ee,generateCodeVerifier:()=>je,getExpires:()=>de,isExpired:()=>Pe,isRedirected:()=>Ze});globalThis.assertEnabled=!1;var P=(e,r)=>{if(globalThis.assertEnabled){let t=A(e,r);if(t)throw new fe("Assertions failed",t,e)}},w=e=>r=>r==null||typeof r>"u"?!1:A(r,e),x=e=>r=>A(r,e),Re=e=>r=>r==null||typeof r>"u"?(console.warning("data does not contain recommended value",r,e),!1):A(r,e),$=(...e)=>r=>{for(let t of e)if(!A(r,t))return!1;return S("data does not match oneOf patterns",r,e)},Oe=(...e)=>r=>{if(!Array.isArray(r))return S("data is not an array",r,"anyOf");for(let t of r)if($(...e)(t))return S("data does not match anyOf patterns",t,e);return!1};function b(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return S("data is not a valid url",e,"validURL")}catch{return S("data is not a valid url",e,"validURL")}return!1}function A(e,r,t){t||(t=e);let o=[];if(r===Boolean)typeof e!="boolean"&&o.push(S("data is not a boolean",e,r));else if(r===Number)typeof e!="number"&&o.push(S("data is not a number",e,r));else if(r instanceof RegExp)if(Array.isArray(e)){let n=e.findIndex(i=>A(i,r,t));n>-1&&o.push(S("data["+n+"] does not match pattern",e[n],r))}else r.test(e)||o.push(S("data does not match pattern",e,r));else if(r instanceof Function)r(e,t)&&o.push(S("data does not match function",e,r));else if(Array.isArray(r)){Array.isArray(e)||o.push(S("data is not an array",e,[]));for(p of r){let n=A(e,p,t);Array.isArray(n)?o.concat(n):n&&o.push(n)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let n=e.findIndex(i=>A(i,r,t));n>-1&&o.push(S("data["+n+"] does not match pattern",e[n],r))}else if(!e||typeof e!="object")o.push(S("data is not an object, pattern is",e,r));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let n=o[o.length-1];for(let[i,l]of Object.entries(r)){let a=A(e[i],l,t);a&&((!n||typeof n=="string")&&(n={},o.push(S(n,e[i],l))),n[i]=a.problems)}}else r!=e&&o.push(S("data and pattern are not equal",e,r));return o.length?o:!1}var fe=class extends Error{constructor(r,t,...o){super(r),this.problems=t,this.details=o}};function S(e,r,t){return{message:e,found:r,expected:t}}function re(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:o=>localStorage.setItem("metro/state:"+e,o),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:o=>JSON.parse(localStorage.getItem(e+":"+o)),set:(o,n)=>localStorage.setItem(e+":"+o,JSON.stringify(n)),has:o=>localStorage.getItem(e+":"+o)!==null};else{let o=new Map;r={get:()=>o.get("metro/state:"+e),set:n=>o.set("metro/state:"+e,n),has:()=>o.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function oe(e){let r={client:f.client(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:je(64)},callbacks:{authorize:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)}};P(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let o=re(e.site);e.tokens||(e.tokens=o.tokens),e.state||(e.state=o.state),P(e,{oauth2_configuration:{client_id:x(/.+/),grant_type:"authorization_code",authorization_endpoint:x(b),token_endpoint:x(b),redirect_uri:x(b)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,d){if(e.force_authorization)return n(c,d);let u;try{if(u=await d(c),u.ok)return u}catch(h){switch(u.status){case 400:case 401:return n(c,d)}throw h}if(!u.ok)switch(u.status){case 400:case 401:return n(c,d)}return u};async function n(c,d){i();let u=e.tokens.get("access_token");if(u)if(Pe(u)){try{if(!await a())return f.response("false")}catch(h){throw h}return n(c,d)}else return c=f.request(c,{headers:{Authorization:u.type+" "+u.value}}),d(c);else{try{if(!await l())return f.response("false")}catch(h){throw h}return n(c,d)}}function i(){if(typeof window<"u"&&window?.location){let c=f.url(window.location),d,u,h;if(c.searchParams.has("code"))h=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let U=c.hash.substr(1);h=new URLSearchParams("?"+U),c=c.with({hash:""}),history.pushState({},"",c.href)}if(h){d=h.get("code"),u=h.get("state");let U=e.state.get("metro/state");if(!u||u!==U)return;d&&e.tokens.set("authorization_code",d)}}}async function l(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let h=await y();if(!e.callbacks.authorize||typeof e.callbacks.authorize!="function")throw f.metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.options.callbacks.authorize");let U=await e.callbacks.authorize(h);if(U)e.tokens.set("authorization_code",U);else return!1}let c=g(),d=await e.client.post(c);if(!d.ok){let h=await d.text();throw f.metroError("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText,{cause:c})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:de(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}return u}async function a(){let c=g("refresh_token"),d=await e.client.post(c);if(!d.ok)throw f.metroError("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:c});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:de(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}else return!1;return u}async function y(){if(!t.authorization_endpoint)throw f.metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=f.url(t.authorization_endpoint,{hash:""});P(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Te(40)};return t.response_type&&(d.response_type=t.response_type),t.response_mode&&(d.response_mode=t.response_mode),e.state.set(d.state),t.client_secret&&(d.client_secret=t.client_secret),t.code_verifier&&(d.code_challenge=ne(await Ee(t.code_verifier)),d.code_challenge_method="S256"),t.scope&&(d.scope=t.scope),t.prompt&&(d.prompt=t.prompt),f.url(c,{search:d})}function g(c=null){if(P(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw f.metroError("oauth2mw: Missing options.endpoints.token url");let d=f.url(t.token_endpoint,{hash:""}),u={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(u.code_verifier=ne(t.code_verifier)),t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),t.grant_type){case"authorization_code":if(u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code"),e.dpop){let h=e.tokens.get("keyPair");u.dpop_jkt=h.publicKey}break;case"client_credentials":break;case"refresh_token":u.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return f.request(d,{method:"POST",body:new URLSearchParams(u)})}}function Pe(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function de(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function je(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),r}async function Ee(e){let r=ne(e),o=new TextEncoder().encode(r);return await globalThis.crypto.subtle.digest("SHA-256",o)}function ne(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Te(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",o=0;for(;o<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),o++;return t}function Ze(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}var he={};X(he,{default:()=>Le});var ie={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},Q=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),z,ze={};function Le(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,o)=>{let n=f.url(t.url);switch(n.pathname){case"/authorize/":if(z=A(n.searchParams,{response_type:"code",client_id:"mockClientId",state:w(/.*/)}))return f.response(Q(z));if(n.searchParams.has("code_challenge")){if(!n.searchParams.has("code_challenge_method"))return f.response(Q("missing code_challenge_method"));ze.code_challenge=n.searchParams.get("code_challenge"),ze.code_challenge_method=n.searchParams.get("code_challenge_method")}return f.response(ie,{body:JSON.stringify({code:"mockAuthorizeToken",state:n.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let y={};t.data.forEach((g,c)=>y[c]=g),t=t.with({body:y})}if(z=A(t,{method:"POST",data:{grant_type:$("refresh_token","authorization_code")}}))return f.response(Q(z));switch(t.data.grant_type){case"refresh_token":if(z=A(t.data,$({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return f.response(Q(z));break;case"access_token":if(z=A(t.data,$({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return f.response(Q(z));break}return f.response(ie,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[l,a]=i?i.split(" "):[];return!a||a!=="mockAccessToken"?f.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):f.response(ie,{body:JSON.stringify({result:"Success"})});case"/public/":return f.response(ie,{body:JSON.stringify({result:"Success"})});default:return f.response({status:404,statusText:"not found",body:"404 Not Found "+n})}}}var me={};X(me,{default:()=>De});var Ue=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Ce=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Ge={issuer:x(b),authorization_endpoint:x(b),token_endpoint:x(b),jwks_uri:w(b),registration_endpoint:w(b),scopes_supported:Re([]),response_types_supported:x(Oe("code","token")),response_modes_supported:w([]),grant_types_supported:w([]),token_endpoint_auth_methods_supported:w([]),token_endpoint_auth_signing_alg_values_supported:w([]),service_documentation:w(b),ui_locales_supported:w([]),op_policy_uri:w(b),op_tos_uri:w(b),revocation_endpoint:w(b),revocation_endpoint_auth_methods_supported:w(Ce),revocation_endpoint_auth_signing_alg_values_supported:w(Ue),introspection_endpoint:w(b),introspection_endpoint_auth_methods_supported:w(Ce),introspection_endpoint_auth_signing_alg_values_supported:w(Ue),code_challendge_methods_supported:w([])};function De(e={}){let r={client:f.client()};e=Object.assign({},r,e),P(e,{issuer:x(b)});let t=Xe(e.issuer),o=e.client.with(e.issuer)}async function Xe(e,r){let t=r.get(f.url(e,".wellknown/oauth_authorization_server"));if(t.ok){P(t.headers.get("Content-Type"),/application\/json.*/);let o=await t.json();return P(o,Ge),o}throw f.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Y(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=o=>{r(o)},t.onsuccess=o=>{let n=o.target.result;e({set:function(i,l){return new Promise((a,y)=>{let g=n.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{a()},g.onerror=y,c.put(i,l)})},get:function(i){return new Promise((l,a)=>{let y=n.transaction("keyPairs","readonly"),c=y.objectStore("keyPairs").get(i);c.onsuccess=()=>{l(c.result)},c.onerror=a,y.onerror=a})},clear:function(){return new Promise((i,l)=>{let a=n.transaction("keyPairs","readwrite"),g=a.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=l,a.onerror=l})}})}})}var qe=new TextEncoder,et=new TextDecoder;function se(e){return typeof e=="string"?qe.encode(e):et.decode(e)}function Ke(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new _e(`${e.name} modulusLength must be at least 2048 bits`)}function tt(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Ke(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Ke(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new L}async function rt(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let o=`${Z(se(JSON.stringify(e)))}.${Z(se(JSON.stringify(r)))}`,n=Z(await crypto.subtle.sign(tt(t),t,se(o)));return`${o}.${n}`}var He=32768;function nt(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=He)r.push(String.fromCharCode.apply(null,e.subarray(t,t+He)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Z(e){return nt(e)}function ot(){return Z(crypto.getRandomValues(new Uint8Array(32)))}var L=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},_e=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function it(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new L("unsupported RsaHashedKeyAlgorithm hash name")}}function st(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new L("unsupported RsaHashedKeyAlgorithm hash name")}}function at(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new L("unsupported EcKeyAlgorithm namedCurve")}}function ct(e){switch(e.algorithm.name){case"RSA-PSS":return it(e);case"RSASSA-PKCS1-v1_5":return st(e);case"ECDSA":return at(e);case"Ed25519":return"EdDSA";default:throw new L("unsupported CryptoKey algorithm name")}}function Ie(e){return e instanceof CryptoKey}function ut(e){return Ie(e)&&e.type==="private"}function lt(e){return Ie(e)&&e.type==="public"}function ft(){return Math.floor(Date.now()/1e3)}async function ae(e,r,t,o,n,i){let l=e?.privateKey,a=e?.publicKey;if(!ut(l))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!lt(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(o!==void 0&&typeof o!="string")throw new TypeError('"nonce" must be a string or undefined');if(n!==void 0&&typeof n!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return rt({alg:ct(l),typ:"dpop+jwt",jwk:await dt(a)},{...i,iat:ft(),jti:ot(),htm:t,nonce:o,htu:r,ath:n?Z(await crypto.subtle.digest("SHA-256",se(n))):void 0},l)}async function dt(e){let{kty:r,e:t,n:o,x:n,y:i,crv:l}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:l,e:t,n:o,x:n,y:i}}async function Ne(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new L}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function ye(e){return P(e,{site:x(b),authorization_endpoint:x(b),token_endpoint:x(b)}),async(r,t)=>{let o=await Y(),n=await o.get(e.site);if(!n){let a=await Ne("ES256");n={domain:e.site,keyPair:a},await o.set(n)}let i=f.url(r.url);if(r.url.startsWith(e.authorization_endpoint)||r.url.startsWith(e.token_endpoint)){let a=await ae(n.keyPair,r.url,r.method);r=r.with({headers:{DPoP:a}})}else if(r.headers.has("Authorization")){let a=localStorage.getItem(i.host+":nonce")||void 0,y=r.headers.get("Authorization").split(" ")[1],g=await ae(n.keyPair,r.url,r.method,a,y);r=r.with({headers:{Authorization:"DPoP "+y,DPoP:g}})}let l=await t(r);return l.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",l.headers.get("DPoP-Nonce")),l}}var Je=Object.assign(oe,pe,{mockserver:he,discovery:me,tokenstore:re,dpopmw:ye,keysstore:Y});globalThis.oauth2=Je;var ce=Je;function ge(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,o)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(o)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:o=>JSON.parse(t.get("metro/oidc:"+e+":"+o)||null),set:(o,n)=>t.set("metro/oidc:"+e+":"+o,JSON.stringify(n)),has:o=>t.has("metro/oidc:"+e+":"+o)}}return r}function we(e={}){let r={client:f.client(),force_authorization:!1};return e=Object.assign({},r,e),j(e,{client:k(I(f.client().constructor)),client_info:k(),issuer:k(m),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=ge(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,o)=>{let n;if(!e.force_authorization){try{n=await o(t)}catch(d){if(n.status!=401&&n.status!=403)throw d}if(n.ok||n.status!=401&&n.status!=403)return n}if(e.openid_configuration||(e.openid_configuration=await V({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(j(e.client_info?.client_name,k()),!e.openid_configuration.registration_endpoint)throw f.metroError("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await W({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",l=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),a={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported},y=async(d,u)=>{let h=await u(d);if(h.headers.get("content-type")?.startsWith("application/json")){let Fe=h.clone();try{let G=await Fe.json();G&&G.id_token&&e.store.set("id_token",G.id_token)}catch{}}return h},g=e.client.with(e.issuer).with(y).with(ce.dpopmw(a));return l.client=g,n=await g.with(ce(l)).fetch(t),n}}function Me(){return ce.isRedirected()}function Be(e){return e.store.get("id_token")}var pt=Object.assign(we,{discover:V,register:W,isRedirected:Me,idToken:Be});globalThis.oidc=pt;})();
 //# sourceMappingURL=browser.min.js.map