@muze-nl/metro-oidc 0.3.2 → 0.3.4

package/dist/browser.min.js

@@ -1,2 +1,2 @@
-(()=>{var $e=Object.defineProperty;var ie=(e,r)=>{for(var t in r)$e(e,t,{get:r[t],enumerable:!0})};var $={};ie($,{client:()=>N,formdata:()=>xe,metroError:()=>S,request:()=>D,response:()=>J,trace:()=>Qe,url:()=>E});var W="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var I=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let n in t)n=="middlewares"?this.#r(t[n]):typeof t[n]=="function"?this.#e[n]=t[n](this.#e[n],this.#e):this.#e[n]=t[n];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...n){return this.fetch(D(this.#e,...n,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(n=>typeof n!="function");if(t>=0)throw S("metro.client: middlewares must be a function or an array of functions "+W+"client/invalid-middlewares-value/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=D(r,t),!r.url)throw S("metro.client."+r.method.toLowerCase()+": Missing url parameter "+W+"client/missing-url-param/",r);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw S("metro.client.fetch: Options is not an object");let o=[async function(s){s[Symbol.metroProxy]&&(s=s[Symbol.metroSource]);let d=await fetch(s);return J(d)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let u of o)i=function(s,d){return async function(g){let c,f=Object.values(e.tracers);for(let l of f)l.request&&l.request.call(l,g,d);c=await d(g,s);for(let l of f)l.response&&l.response.call(l,c,d);return c}}(i,u);return i(r)}with(...r){return new e(this,...r)}};function N(...e){return new I(...e)}function Ze(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let o=e[n];if(!(typeof o>"u"||o==null))if(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function")t[n]=o(t[n],t);else if(n=="url")t.url=E(t.url,o);else if(n=="headers"){t.headers=new Headers(r.headers),o instanceof Headers||(o=new Headers(e.headers));for(let[i,u]of o.entries())t.headers.set(i,u)}else t[n]=o}return e instanceof Request&&e.data&&(t.body=e.data),t}function D(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?r.url=E(r.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?r.body=o:o&&typeof o=="object"&&Object.assign(r,Ze(o,r));let t=r.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(r.body=JSON.stringify(t));let n=new Request(r.url,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroSource:return o;case Symbol.metroProxy:return!0;case"with":return function(...s){return t&&s.unshift({body:t}),D(o,...s)};case"body":break;case"data":return t}return o[i]instanceof Function?o[i].bind(o):o[i]}})}function Se(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["status","statusText","headers","body","url","type","redirected"]){let o=e[n];typeof o>"u"||o==null||(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function"?t[n]=o(t[n],t):n=="url"?t.url=new URL(o,t.url||"https://localhost/"):t[n]=o)}return e instanceof Response&&e.data&&(t.body=e.data),t}function J(...e){let r={};for(let o of e)typeof o=="string"?r.body=o:o instanceof Response?Object.assign(r,Se(o,r)):o&&typeof o=="object"&&(o instanceof FormData||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView||o instanceof ReadableStream||o instanceof URLSearchParams||o instanceof String||typeof TypedArray<"u"&&o instanceof TypedArray?r.body=o:Object.assign(r,Se(o,r)));let t;r.body&&(t=r.body);let n=new Response(r.body,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...s){return J(o,...s)};case"data":return t;case"ok":return o.status>=200&&o.status<400}return typeof o[i]=="function"?o[i].bind(o):o[i]}})}function ve(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,n)=>{e.searchParams.append(n,t)}))}function E(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let n of e)if(typeof n=="string"||n instanceof String)t=new URL(n,t);else if(n instanceof URL||typeof Location<"u"&&n instanceof Location)t=new URL(n);else if(n instanceof URLSearchParams)ve(t,n);else if(n&&typeof n=="object")for(let o in n)if(o=="search")typeof n.search=="function"?n.search(t.search,t):t.search=new URLSearchParams(n.search);else if(o=="searchParams")ve(t,n.searchParams);else{if(!r.includes(o))throw S("metro.url: unknown url parameter "+W+"url/unknown-param-name/",o);if(typeof n[o]=="function")n[o](t[o],t);else if(typeof n[o]=="string"||n[o]instanceof String||typeof n[o]=="number"||n[o]instanceof Number||typeof n[o]=="boolean"||n[o]instanceof Boolean)t[o]=""+n[o];else if(typeof n[o]=="object"&&n[o].toString)t[o]=n[o].toString();else throw S("metro.url: unsupported value for "+o+" "+W+"url/unsupported-param-value/",e[o])}else throw S("metro.url: unsupported option value "+W+"url/unsupported-option-value/",n);return Object.freeze(t),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...u){return E(n,...u)}}return n[o]instanceof Function?n[o].bind(n):n[o]}})}function xe(...e){var r=new FormData;for(let t of e)if(t instanceof FormData)for(let n of t.entries())r.append(n[0],n[1]);else if(t&&typeof t=="object")for(let n of Object.entries(t))if(Array.isArray(n[1]))for(let o of n[1])r.append(n[0],o);else r.append(n[0],n[1]);else throw new S("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(r),new Proxy(r,{get:(t,n,o)=>{switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return xe(t,...i)}}return t[n]instanceof Function?t[n].bind(t):t[n]}})}var V={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function S(e,...r){return V.error(e,...r),new Error(e,...r)}var Qe={add(e,r){I.tracers[e]=r},delete(e){delete I.tracers[e]},clear(){I.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,V.group(e),V.info(r?.url,r,t)},response:(r,t)=>{V.info(r?.body?r.body[Symbol.metroSource]:null,r,t),V.groupEnd(e),e--}}}};function K(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{de(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(de(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let n=await t(r);if(de(n.headers.get("content-type"))){let i=await n.clone().text();try{let u=JSON.parse(i,e.reviver);return n.with({body:u})}catch{}}return n}}var Ye=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function de(e){return Ye.exec(e)}function H(e){return async(r,t)=>{let n=await t(r);if(!n.ok)if(e&&typeof e[n.status]=="function")n=e[n.status].apply(n,r);else throw new Error(n.status+": "+n.statusText,{cause:n});return n}}var Re=Object.assign({},$,{mw:{jsonmw:K,thrower:H}});globalThis.metro||(globalThis.metro=Re);var h=Re;var ae={};ie(ae,{authorizePopup:()=>ze,base64url_encode:()=>me,createState:()=>Te,default:()=>M,generateCodeChallenge:()=>Ee,generateCodeVerifier:()=>je,getExpires:()=>he,isExpired:()=>Oe,isRedirected:()=>_e});globalThis.assertEnabled=!1;var O=(e,r)=>{if(globalThis.assertEnabled){let t=R(e,r);if(t)throw new pe("Assertions failed",t,e)}},w=e=>r=>r==null||typeof r>"u"?!1:R(r,e),x=e=>r=>R(r,e),Ae=e=>r=>r==null||typeof r>"u"?(console.warning("data does not contain recommended value",r,e),!1):R(r,e),Z=(...e)=>r=>{for(let t of e)if(!R(r,t))return!1;return v("data does not match oneOf patterns",r,e)},Pe=(...e)=>r=>{if(!Array.isArray(r))return v("data is not an array",r,"anyOf");for(let t of r)if(Z(...e)(t))return v("data does not match anyOf patterns",t,e);return!1};function b(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return v("data is not a valid url",e,"validURL")}catch{return v("data is not a valid url",e,"validURL")}return!1}function R(e,r,t){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&n.push(v("data is not a boolean",e,r));else if(r===Number)typeof e!="number"&&n.push(v("data is not a number",e,r));else if(r instanceof RegExp)if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else r.test(e)||n.push(v("data does not match pattern",e,r));else if(r instanceof Function)r(e,t)&&n.push(v("data does not match function",e,r));else if(Array.isArray(r)){Array.isArray(e)||n.push(v("data is not an array",e,[]));for(p of r){let o=R(e,p,t);Array.isArray(o)?n.concat(o):o&&n.push(o)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else if(!e||typeof e!="object")n.push(v("data is not an object, pattern is",e,r));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let o=n[n.length-1];for(let[i,u]of Object.entries(r)){let s=R(e[i],u,t);s&&((!o||typeof o=="string")&&(o={},n.push(v(o,e[i],u))),o[i]=s.problems)}}else r!=e&&n.push(v("data and pattern are not equal",e,r));return n.length?n:!1}var pe=class extends Error{constructor(r,t,...n){super(r),this.problems=t,this.details=n}};function v(e,r,t){return{message:e,found:r,expected:t}}function se(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:n=>localStorage.setItem("metro/state:"+e,n),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:n=>JSON.parse(localStorage.getItem(e+":"+n)),set:(n,o)=>localStorage.setItem(e+":"+n,JSON.stringify(o)),has:n=>localStorage.getItem(e+":"+n)!==null};else{let n=new Map;r={get:()=>n.get("metro/state:"+e),set:o=>n.set("metro/state:"+e,o),has:()=>n.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function M(e){let r={client:N(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:je(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};O(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let n=se(e.site);e.tokens||(e.tokens=n.tokens),e.state||(e.state=n.state),O(e,{oauth2_configuration:{client_id:x(/.+/),grant_type:"authorization_code",authorization_endpoint:x(b),token_endpoint:x(b),redirect_uri:x(b)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,f){if(e.force_authorization)return o(c,f);let l;try{if(l=await f(c),l.ok)return l}catch(m){switch(l.status){case 400:case 401:return o(c,f)}throw m}if(!l.ok)switch(l.status){case 400:case 401:return o(c,f)}return l};async function o(c,f){i();let l=e.tokens.get("access_token");if(l)if(Oe(l)){try{if(!await s())return J("false")}catch(m){throw m}return o(c,f)}else return c=D(c,{headers:{Authorization:l.type+" "+l.value}}),f(c);else{try{if(!await u())return J("false")}catch(m){throw m}return o(c,f)}}function i(){if(typeof window<"u"&&window?.location){let c=E(window.location),f,l,m;if(c.searchParams.has("code"))m=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let z=c.hash.substr(1);m=new URLSearchParams("?"+z),c=c.with({hash:""}),history.pushState({},"",c.href)}if(m){f=m.get("code"),l=m.get("state");let z=e.state.get("metro/state");if(!l||l!==z)return;f&&e.tokens.set("authorization_code",f)}}}async function u(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let m=await d();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw S("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let z=await e.authorize_callback(m);if(z)e.tokens.set("authorization_code",z);else return!1}let c=g(),f=await e.client.post(c);if(!f.ok){let m=await f.text();throw S("OAuth2mw: fetch access_token: "+f.status+": "+f.statusText,{cause:c})}let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}return l}async function s(){let c=g("refresh_token"),f=await e.client.post(c);if(!f.ok)throw S("OAuth2mw: refresh access_token: "+f.status+": "+f.statusText,{cause:c});let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}else return!1;return l}async function d(){if(!t.authorization_endpoint)throw S("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=E(t.authorization_endpoint,{hash:""});O(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let f={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Te(40)};return t.response_type&&(f.response_type=t.response_type),t.response_mode&&(f.response_mode=t.response_mode),e.state.set(f.state),t.client_secret&&(f.client_secret=t.client_secret),t.code_verifier&&(f.code_challenge=await Ee(t.code_verifier),f.code_challenge_method="S256"),t.scope&&(f.scope=t.scope),t.prompt&&(f.prompt=t.prompt),E(c,{search:f})}function g(c=null){if(O(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw S("oauth2mw: Missing options.endpoints.token url");let f=E(t.token_endpoint,{hash:""}),l={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(l.code_verifier=t.code_verifier),t.client_secret&&(l.client_secret=t.client_secret),t.scope&&(l.scope=t.scope),t.grant_type){case"authorization_code":l.redirect_uri=t.redirect_uri,l.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":l.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return D(f,{method:"POST",body:new URLSearchParams(l)})}}function Oe(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function he(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function je(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),me(r)}async function Ee(e){let t=new TextEncoder().encode(e),n=await globalThis.crypto.subtle.digest("SHA-256",t);return me(n)}function me(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Te(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",n=0;for(;n<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),n++;return t}function _e(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}async function ze(e){return new Promise((r,t)=>{addEventListener("oauth2authorized",n=>{r(event.authorization_code)},{once:!0}),window.open(e)})}var ye={};ie(ye,{default:()=>Ue});var ce={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},Q=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),L,Le={};function Ue(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,n)=>{let o=h.url(t.url);switch(o.pathname){case"/authorize/":if(L=R(o.searchParams,{response_type:"code",client_id:"mockClientId",state:w(/.*/)}))return h.response(Q(L));if(o.searchParams.has("code_challenge")){if(!o.searchParams.has("code_challenge_method"))return h.response(Q("missing code_challenge_method"));Le.code_challenge=o.searchParams.get("code_challenge"),Le.code_challenge_method=o.searchParams.get("code_challenge_method")}return h.response(ce,{body:JSON.stringify({code:"mockAuthorizeToken",state:o.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let d={};t.data.forEach((g,c)=>d[c]=g),t=t.with({body:d})}if(L=R(t,{method:"POST",data:{grant_type:Z("refresh_token","authorization_code")}}))return h.response(Q(L));switch(t.data.grant_type){case"refresh_token":if(L=R(t.data,Z({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return h.response(Q(L));break;case"access_token":if(L=R(t.data,Z({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return h.response(Q(L));break}return h.response(ce,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[u,s]=i?i.split(" "):[];return!s||s!=="mockAccessToken"?h.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):h.response(ce,{body:JSON.stringify({result:"Success"})});case"/public/":return h.response(ce,{body:JSON.stringify({result:"Success"})});default:return h.response({status:404,statusText:"not found",body:"404 Not Found "+o})}}}var ge={};ie(ge,{default:()=>Ke});var Ce=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],De=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Xe={issuer:x(b),authorization_endpoint:x(b),token_endpoint:x(b),jwks_uri:w(b),registration_endpoint:w(b),scopes_supported:Ae([]),response_types_supported:x(Pe("code","token")),response_modes_supported:w([]),grant_types_supported:w([]),token_endpoint_auth_methods_supported:w([]),token_endpoint_auth_signing_alg_values_supported:w([]),service_documentation:w(b),ui_locales_supported:w([]),op_policy_uri:w(b),op_tos_uri:w(b),revocation_endpoint:w(b),revocation_endpoint_auth_methods_supported:w(De),revocation_endpoint_auth_signing_alg_values_supported:w(Ce),introspection_endpoint:w(b),introspection_endpoint_auth_methods_supported:w(De),introspection_endpoint_auth_signing_alg_values_supported:w(Ce),code_challendge_methods_supported:w([])};function Ke(e={}){let r={client:h.client()};e=Object.assign({},r,e),O(e,{issuer:x(b)});let t=qe(e.issuer),n=e.client.with(e.issuer)}async function qe(e,r){let t=r.get(h.url(e,".wellknown/oauth_authorization_server"));if(t.ok){O(t.headers.get("Content-Type"),/application\/json.*/);let n=await t.json();return O(n,Xe),n}throw h.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Y(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=n=>{r(n)},t.onsuccess=n=>{let o=n.target.result;e({set:function(i,u){return new Promise((s,d)=>{let g=o.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{s()},g.onerror=d,c.put(i,u)})},get:function(i){return new Promise((u,s)=>{let d=o.transaction("keyPairs","readonly"),c=d.objectStore("keyPairs").get(i);c.onsuccess=()=>{u(c.result)},c.onerror=s,d.onerror=s})},clear:function(){return new Promise((i,u)=>{let s=o.transaction("keyPairs","readwrite"),g=s.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=u,s.onerror=u})}})}})}var et=new TextEncoder,tt=new TextDecoder;function ue(e){return typeof e=="string"?et.encode(e):tt.decode(e)}function He(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new we(`${e.name} modulusLength must be at least 2048 bits`)}function rt(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return He(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return He(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new U}async function ot(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let n=`${G(ue(JSON.stringify(e)))}.${G(ue(JSON.stringify(r)))}`,o=G(await crypto.subtle.sign(rt(t),t,ue(n)));return`${n}.${o}`}var Ie=32768;function nt(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Ie)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Ie)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function G(e){return nt(e)}function it(){return G(crypto.getRandomValues(new Uint8Array(32)))}var U=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},we=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function st(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function at(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function ct(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new U("unsupported EcKeyAlgorithm namedCurve")}}function ut(e){switch(e.algorithm.name){case"RSA-PSS":return st(e);case"RSASSA-PKCS1-v1_5":return at(e);case"ECDSA":return ct(e);case"Ed25519":return"EdDSA";default:throw new U("unsupported CryptoKey algorithm name")}}function Ne(e){return e instanceof CryptoKey}function lt(e){return Ne(e)&&e.type==="private"}function ft(e){return Ne(e)&&e.type==="public"}function dt(){return Math.floor(Date.now()/1e3)}async function le(e,r,t,n,o,i){let u=e?.privateKey,s=e?.publicKey;if(!lt(u))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!ft(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(s.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(n!==void 0&&typeof n!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return ot({alg:ut(u),typ:"dpop+jwt",jwk:await pt(s)},{...i,iat:dt(),jti:it(),htm:t,nonce:n,htu:r,ath:o?G(await crypto.subtle.digest("SHA-256",ue(o))):void 0},u)}async function pt(e){let{kty:r,e:t,n,x:o,y:i,crv:u}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:u,e:t,n,x:o,y:i}}async function Je(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new U}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function X(e){return O(e,{site:x(b),authorization_endpoint:x(b),token_endpoint:x(b),dpop_signing_alg_values_supported:w([])}),async(r,t)=>{let n=await Y(),o=await n.get(e.site);if(!o){let s=await Je("ES256");o={domain:e.site,keyPair:s},await n.set(o)}let i=h.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let s=r.body;s instanceof URLSearchParams||s instanceof FormData?s.set("dpop_jkt",o.keyPair.publicKey):s.dpop_jkt=o.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let s=await le(o.keyPair,r.url,r.method);r=r.with({headers:{DPoP:s}})}else if(r.headers.has("Authorization")){let s=localStorage.getItem(i.host+":nonce")||void 0,d=r.headers.get("Authorization").split(" ")[1],g=await le(o.keyPair,r.url,r.method,s,d);r=r.with({headers:{Authorization:"DPoP "+d,DPoP:g}})}let u=await t(r);return u.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",u.headers.get("DPoP-Nonce")),u}}var ht=Object.assign(ae,{oauth2mw:M,mockserver:ye,discover:ge,tokenstore:se,dpopmw:X,keysstore:Y});globalThis.metro.oauth2||(globalThis.metro.oauth2=ht);globalThis.assertEnabled=!1;function T(e,r){if(globalThis.assertEnabled){let t=P(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function a(e){return function(t,n,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return P(t,e,n,o)}}function k(e){return function(t,n,o){return t==null||typeof t>"u"?y("data is required",t,e||"any value",o):typeof e<"u"?P(t,e,n,o):!1}}function q(e){return function(t,n,o){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,o),!1):P(t,e,n,o)}}function A(...e){return function(t,n,o){for(let i of e)if(!P(t,i,n,o))return!1;return y("data does not match oneOf patterns",t,e,o)}}function B(...e){return function(t,n,o){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",o);for(let i of t)if(A(...e)(i))return y("data does not match anyOf patterns",i,e,o);return!1}}function Me(...e){return function(t,n,o){let i=[];for(let u of e)i=i.concat(P(t,u,n,o));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,o,i)}}function _(e,r,t){try{e instanceof URL&&(e=e.href);let n=new URL(e);if(n.href!=e&&!(n.href+"/"==e||n.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function Be(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function F(e){return function(t,n,o){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,o)}}function ee(e){return function(t,n,o){if(!P(t,e,n,o))return y("data matches pattern, when required not to",t,e,o)}}function P(e,r,t,n=""){t||(t=e);let o=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(y("data is not a boolean",e,r,n));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(y("data is not a number",e,r,n));else if(r===String)typeof e!="string"&&!(e instanceof String)&&o.push(y("data is not a string",e,r,n)),e==""&&o.push(y("data is an empty string, which is not allowed",e,r,n));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else typeof e>"u"?o.push(y("data is undefined, should match pattern",e,r,n)):r.test(e)||o.push(y("data does not match pattern",e,r,n));else if(r instanceof Function){let i=r(e,t,n);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(r)){Array.isArray(e)||o.push(y("data is not an array",e,[],n));for(let i of r)for(let u of e.keys()){let s=P(e[u],i,t,n+"["+u+"]");Array.isArray(s)?o=o.concat(s):s&&o.push(s)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else if(!e||typeof e!="object")o.push(y("data is not an object, pattern is",e,r,n));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=P(e,r,t,n);i&&(o=o.concat(i))}else for(let[i,u]of Object.entries(r)){let s=P(e[i],u,t,n+"."+i);s&&(o=o.concat(s))}else r!=e&&o.push(y("data and pattern are not equal",e,r,n));return o.length?o:!1}function y(e,r,t,n,o){let i={message:e,found:r,expected:t,path:n};return o&&(i.problems=o),i}var te=(...e)=>(r,t)=>e.filter(n=>t.hasOwnKey(n)).length>0?!1:y("root data must have all of",t,e),C=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var j=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],fe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function re(e={}){T(e,{client:a(F(h.client().constructor)),issuer:k(_)});let r={client:h.client().with(H()).with(K()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function n(d){return t}let o={issuer:k(Me(e.issuer,n)),authorization_endpoint:k(_),token_endpoint:k(_),userinfo_endpoint:q(_),jwks_uri:k(_),registration_endpoint:e.requireDynamicRegistration?k(_):q(_),scopes_supported:q(C("openid")),response_types_supported:e.requireDynamicRegistration?k(C("code","id_token","id_token token")):k([]),response_modes_supported:a([]),grant_types_supported:e.requireDynamicRegistration?a(C("authorization_code")):a([]),acr_values_supported:a([]),subject_types_supported:k([]),id_token_signing_alg_values_supported:k(C("RS256")),id_token_encryption_alg_values_supported:a([]),id_token_encryption_enc_values_supported:a([]),userinfo_signing_alg_values_supported:a([]),userinfo_encryption_alg_values_supported:a([]),userinfo_encryption_enc_values_supported:a([]),request_object_signing_alg_values_supported:a(C("RS256")),request_object_encryption_alg_values_supported:a([]),request_object_encryption_enc_values_supported:a([]),token_endpoint_auth_methods_supported:a(B(...fe)),token_endpoint_auth_signing_alg_values_supported:a(C("RS256"),ee(C("none"))),display_values_supported:a(B("page","popup","touch","wap")),claim_types_supported:a(B("normal","aggregated","distributed")),claims_supported:q([]),service_documentation:a(_),claims_locales_supported:a([]),ui_locales_supported:a([]),claims_parameter_supported:a(Boolean),request_parameter_supported:a(Boolean),request_uri_parameter_supported:a(Boolean),op_policy_uri:a(_),op_tos_uri:a(_)},i=h.url(e.issuer,".well-known/openid-configuration"),s=(await e.client.get(i)).data;return T(s,o),T(s.issuer,e.issuer),s}async function oe(e){let r={redirect_uris:k([_]),response_types:a([]),grant_types:a(B("authorization_code","refresh_token")),application_type:a(A("native","web")),contacts:a([Be]),client_name:a(String),logo_uri:a(_),client_uri:a(_),policy_uri:a(_),tos_uri:a(_),jwks_uri:a(_,ee(te("jwks"))),jwks:a(_,ee(te("jwks_uri"))),sector_identifier_uri:a(_),subject_type:a(String),id_token_signed_response_alg:a(A(...j)),id_token_encrypted_response_alg:a(A(...j)),id_token_encrypted_response_enc:a(A(...j),te("id_token_encrypted_response_alg")),userinfo_signed_response_alg:a(A(...j)),userinfo_encrypted_response_alg:a(A(...j)),userinfo_encrypted_response_enc:a(A(...j),te("userinfo_encrypted_response_alg")),request_object_signing_alg:a(A(...j)),request_object_encryption_alg:a(A(...j)),request_object_encryption_enc:a(A(...j)),token_endpoint_auth_method:a(A(...fe)),token_endpoint_auth_signing_alg:a(A(...j)),default_max_age:a(Number),require_auth_time:a(Boolean),default_acr_values:a([String]),initiate_login_uri:a([_]),request_uris:a([_])};T(e,{client:a(F(h.client().constructor)),registration_endpoint:_,client_info:r});let t={client:h.client().with(H()).with(K())};e=Object.assign({},t,e);let n=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=n.data;if(!o.client_id||!o.client_secret)throw h.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",n);return e.client_info=Object.assign(e.client_info,o),e.client_info}function be(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,n)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(n)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:n=>JSON.parse(t.get("metro/oidc:"+e+":"+n)||null),set:(n,o)=>t.set("metro/oidc:"+e+":"+n,JSON.stringify(o)),has:n=>t.has("metro/oidc:"+e+":"+n)}}return r}function ke(e={}){let r={client:N(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),T(e,{client:k(F(N().constructor)),client_info:k(),issuer:k(_),oauth2:a({}),openid_configuration:a()}),e.store||(e.store=be(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,n)=>{let o;if(!e.force_authorization){try{o=await n(t)}catch(g){if(o.status!=401&&o.status!=403)throw g}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await re({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(T(e.client_info?.client_name,k()),!e.openid_configuration.registration_endpoint)throw S("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await oe({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",u=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),s=async(g,c)=>{let f=await c(g);if(f.headers.get("content-type")?.startsWith("application/json")){let m=f.data?.id_token;if(!m){let z=f.clone();try{let ne=await z.json();ne&&ne.id_token&&(m=ne.id_token)}catch{}}m&&e.store.set("id_token",m)}return f},d=e.client.with(e.issuer).with(s);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};d=d.with(X(g)),u.client=d}return d=d.with(M(u)),o=await d.fetch(t),o}}function Fe(){return _e()}function Ve(e){return e.store.get("id_token")}var We={oidcmw:ke,discover:re,register:oe,isRedirected:Fe,idToken:Ve};globalThis.metro.oidc||(globalThis.metro.oidc=We);var kr=We;})();
+(()=>{var Ke=Object.defineProperty;var X=(e,r)=>{for(var t in r)Ke(e,t,{get:r[t],enumerable:!0})};var N={};X(N,{client:()=>D,formdata:()=>_e,metroError:()=>k,request:()=>T,response:()=>K,trace:()=>Ie,url:()=>x});var E="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var C=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let o in t)o=="middlewares"?this.#r(t[o]):typeof t[o]=="function"?this.#e[o]=t[o](this.#e[o],this.#e):this.#e[o]=t[o];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...o){return this.fetch(T(this.#e,...o,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(o=>typeof o!="function");if(t>=0)throw k("metro.client: middlewares must be a function or an array of functions "+E+"client/invalid-middlewares/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=T(r,t),!r.url)throw k("metro.client."+r.method.toLowerCase()+": Missing url parameter "+E+"client/fetch-missing-url/",r);if(t||(t={}),typeof t!="object"||t instanceof String)throw k("metro.client.fetch: Invalid options parameter "+E+"client/fetch-invalid-options/",t);let n=[async function(a){a[Symbol.metroProxy]&&(a=a[Symbol.metroSource]);let h=await fetch(a);return K(h)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let l of n)i=function(a,h){return async function(g){let c,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,g,h);c=await h(g,a);for(let u of d)u.response&&u.response.call(u,c,h);return c}}(i,l);return i(r)}with(...r){return new e(this,...r)}};function D(...e){return new C(...e)}function He(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let n=e[o];if(!(typeof n>"u"||n==null))if(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function")t[o]=n(t[o],t);else if(o=="url")t.url=x(t.url,n);else if(o=="headers"){t.headers=new Headers(r.headers),n instanceof Headers||(n=new Headers(e.headers));for(let[i,l]of n.entries())t.headers.set(i,l)}else t[o]=n}return e instanceof Request&&e.data&&(t.body=e.data),t}function T(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let n of e)typeof n=="string"||n instanceof URL||n instanceof URLSearchParams?r.url=x(r.url,n):n&&(n instanceof FormData||n instanceof ReadableStream||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView)?r.body=n:n&&typeof n=="object"&&Object.assign(r,He(n,r));let t=new Request(r.url,r),o=r.body;return o&&typeof o=="object"&&!(o instanceof String)&&!(o instanceof ReadableStream)&&!(o instanceof Blob)&&!(o instanceof ArrayBuffer)&&!(o instanceof DataView)&&!(o instanceof FormData)&&!(o instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(o instanceof TypedArray))&&typeof o.toString=="function"&&(r.body=o.toString({headers:t.headers}),t=new Request(r.url,r)),Object.freeze(t),new Proxy(t,{get(n,i,l){switch(i){case Symbol.metroSource:return n;case Symbol.metroProxy:return!0;case"with":return function(...a){return o&&a.unshift({body:o}),T(n,...a)};case"data":return o}return n[i]instanceof Function?n[i].bind(n):n[i]}})}function he(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["status","statusText","headers","body","url","type","redirected"]){let n=e[o];typeof n>"u"||n==null||(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function"?t[o]=n(t[o],t):o=="url"?t.url=new URL(n,t.url||"https://localhost/"):t[o]=n)}return e instanceof Response&&e.data&&(t.body=e.data),t}function K(...e){let r={};for(let n of e)typeof n=="string"?r.body=n:n instanceof Response?Object.assign(r,he(n,r)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof TypedArray<"u"&&n instanceof TypedArray?r.body=n:Object.assign(r,he(n,r)));let t;r.body&&(t=r.body),[101,204,205,304].includes(r.status)&&(r.body=null);let o=new Response(r.body,r);return Object.freeze(o),new Proxy(o,{get(n,i,l){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...a){return K(n,...a)};case"data":return t;case"ok":return n.status>=200&&n.status<400}return typeof n[i]=="function"?n[i].bind(n):n[i]}})}function me(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,o)=>{e.searchParams.append(o,t)}))}function x(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let o of e)if(typeof o=="string"||o instanceof String)t=new URL(o,t);else if(o instanceof URL||typeof Location<"u"&&o instanceof Location)t=new URL(o);else if(o instanceof URLSearchParams)me(t,o);else if(o&&typeof o=="object")for(let n in o)switch(n){case"search":typeof o.search=="function"?o.search(t.search,t):t.search=new URLSearchParams(o.search);break;case"searchParams":me(t,o.searchParams);break;default:if(!r.includes(n))throw k("metro.url: unknown url parameter "+E+"url/unknown-param-name/",n);if(typeof o[n]=="function")o[n](t[n],t);else if(typeof o[n]=="string"||o[n]instanceof String||typeof o[n]=="number"||o[n]instanceof Number||typeof o[n]=="boolean"||o[n]instanceof Boolean)t[n]=""+o[n];else if(typeof o[n]=="object"&&o[n].toString)t[n]=o[n].toString();else throw k("metro.url: unsupported value for "+n+" "+E+"url/unsupported-param-value/",e[n]);break}else throw k("metro.url: unsupported option value "+E+"url/unsupported-option-value/",o);return Object.freeze(t),new Proxy(t,{get(o,n,i){switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...l){return x(o,...l)};case"filename":return o.pathname.split("/").pop();case"folderpath":return o.pathname.substring(0,o.pathname.lastIndexOf("\\")+1)}return o[n]instanceof Function?o[n].bind(o):o[n]}})}function _e(...e){var r=new FormData;for(let t of e)if(t instanceof HTMLFormElement&&(t=new FormData(t)),t instanceof FormData)for(let o of t.entries())r.append(o[0],o[1]);else if(t&&typeof t=="object")for(let o of Object.entries(t))if(Array.isArray(o[1]))for(let n of o[1])r.append(o[0],n);else r.append(o[0],o[1]);else throw new k("metro.formdata: unknown option type "+E+"formdata/unknown-option-value/",t);return Object.freeze(r),new Proxy(r,{get:(t,o,n)=>{switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return _e(t,...i)}}return t[o]instanceof Function?t[o].bind(t):t[o]}})}var M={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function k(e,...r){return M.error(e,...r),new Error(e,...r)}var Ie={add(e,r){C.tracers[e]=r},delete(e){delete C.tracers[e]},clear(){C.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,M.group(e),M.info(r?.url,r,t)},response:(r,t)=>{M.info(r?.body?r.body[Symbol.metroSource]:null,r,t),M.groupEnd(e),e--}}}};function z(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{ie(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(ie(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let o=await t(r);if(ie(o.headers.get("content-type"))){let i=await o.clone().text();try{let l=JSON.parse(i,e.reviver);return o.with({body:l})}catch{}}return o}}var Me=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function ie(e){return Me.exec(e)}function L(e){return async(r,t)=>{let o=await t(r);if(!o.ok)if(e&&typeof e[o.status]=="function")o=e[o.status].apply(o,r);else throw new Error(o.status+": "+o.statusText,{cause:o});return o}}var ye=Object.assign({},N,{mw:{jsonmw:z,thrower:L}});globalThis.metro||(globalThis.metro=ye);var m=ye;var q={};X(q,{base64url_encode:()=>ce,createState:()=>Se,default:()=>I,generateCodeChallenge:()=>ke,generateCodeVerifier:()=>be,getExpires:()=>se,isAuthorized:()=>Je,isExpired:()=>ae,isRedirected:()=>ue});globalThis.assertEnabled=!1;function w(e,r){if(globalThis.assertEnabled){let t=S(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,o,n){if(typeof t<"u"&&t!=null&&typeof e<"u")return S(t,e,o,n)}}function p(e){return function(t,o,n){return t==null||typeof t>"u"?y("data is required",t,e||"any value",n):typeof e<"u"?S(t,e,o,n):!1}}function U(e){return function(t,o,n){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,n),!1):S(t,e,o,n)}}function b(...e){return function(t,o,n){for(let i of e)if(!S(t,i,o,n))return!1;return y("data does not match oneOf patterns",t,e,n)}}function P(...e){return function(t,o,n){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",n);for(let i of t)if(b(...e)(i))return y("data does not match anyOf patterns",i,e,n);return!1}}function ge(...e){return function(t,o,n){let i=[];for(let l of e)i=i.concat(S(t,l,o,n));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,n,i)}}function f(e,r,t){try{e instanceof URL&&(e=e.href);let o=new URL(e);if(o.href!=e&&!(o.href+"/"==e||o.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function we(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function H(e){return function(t,o,n){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,n)}}function J(e){return function(t,o,n){if(!S(t,e,o,n))return y("data matches pattern, when required not to",t,e,n)}}function S(e,r,t,o=""){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&n.push(y("data is not a boolean",e,r,o));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&n.push(y("data is not a number",e,r,o));else if(r===String)typeof e!="string"&&!(e instanceof String)&&n.push(y("data is not a string",e,r,o)),e==""&&n.push(y("data is an empty string, which is not allowed",e,r,o));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else typeof e>"u"?n.push(y("data is undefined, should match pattern",e,r,o)):r.test(e)||n.push(y("data does not match pattern",e,r,o));else if(r instanceof Function){let i=r(e,t,o);i&&(Array.isArray(i)?n=n.concat(i):n.push(i))}else if(Array.isArray(r)){Array.isArray(e)||n.push(y("data is not an array",e,[],o));for(let i of r)for(let l of e.keys()){let a=S(e[l],i,t,o+"["+l+"]");Array.isArray(a)?n=n.concat(a):a&&n.push(a)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else if(!e||typeof e!="object")n.push(y("data is not an object, pattern is",e,r,o));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=S(e,r,t,o);i&&(n=n.concat(i))}else for(let[i,l]of Object.entries(r)){let a=S(e[i],l,t,o+"."+i);a&&(n=n.concat(a))}else r!=e&&n.push(y("data and pattern are not equal",e,r,o));return n.length?n:!1}function y(e,r,t,o,n){let i={message:e,found:r,expected:t,path:o};return n&&(i.problems=n),i}function B(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:o=>localStorage.setItem("metro/state:"+e,o),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:o=>JSON.parse(localStorage.getItem(e+":"+o)),set:(o,n)=>localStorage.setItem(e+":"+o,JSON.stringify(n)),has:o=>localStorage.getItem(e+":"+o)!==null};else{let o=new Map;r={get:()=>o.get("metro/state:"+e),set:n=>o.set("metro/state:"+e,n),has:()=>o.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function I(e){let r={client:D(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:be(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};w(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let o=B(e.site);e.tokens||(e.tokens=o.tokens),e.state||(e.state=o.state),w(e,{oauth2_configuration:{client_id:p(/.+/),grant_type:"authorization_code",authorization_endpoint:p(f),token_endpoint:p(f),redirect_uri:p(f)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,d){if(e.force_authorization)return n(c,d);let u;try{if(u=await d(c),u.ok)return u}catch(_){switch(u.status){case 400:case 401:return n(c,d)}throw _}if(!u.ok)switch(u.status){case 400:case 401:return n(c,d)}return u};async function n(c,d){i();let u=e.tokens.get("access_token");if(u)if(ae(u)){try{if(!await a())return K("false")}catch(_){throw _}return n(c,d)}else return c=T(c,{headers:{Authorization:u.type+" "+u.value}}),d(c);else{try{if(!await l())return K("false")}catch(_){throw _}return n(c,d)}}function i(){if(typeof window<"u"&&window?.location){let c=x(window.location),d,u,_;if(c.searchParams.has("code"))_=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let R=c.hash.substr(1);_=new URLSearchParams("?"+R),c=c.with({hash:""}),history.pushState({},"",c.href)}if(_){d=_.get("code"),u=_.get("state");let R=e.state.get("metro/state");if(!u||u!==R)return;d&&e.tokens.set("authorization_code",d)}}}async function l(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let _=await h();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw k("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let R=await e.authorize_callback(_);if(R)e.tokens.set("authorization_code",R);else return!1}let c=g(),d=await e.client.post(c);if(!d.ok){let _=await d.text();throw k("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText,{cause:c})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}return u}async function a(){let c=g("refresh_token"),d=await e.client.post(c);if(!d.ok)throw k("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:c});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}else return!1;return u}async function h(){if(!t.authorization_endpoint)throw k("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=x(t.authorization_endpoint,{hash:""});w(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Se(40)};return t.response_type&&(d.response_type=t.response_type),t.response_mode&&(d.response_mode=t.response_mode),e.state.set(d.state),t.client_secret&&(d.client_secret=t.client_secret),t.code_verifier&&(d.code_challenge=await ke(t.code_verifier),d.code_challenge_method="S256"),t.scope&&(d.scope=t.scope),t.prompt&&(d.prompt=t.prompt),x(c,{search:d})}function g(c=null){if(w(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw k("oauth2mw: Missing options.endpoints.token url");let d=x(t.token_endpoint,{hash:""}),u={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(u.code_verifier=t.code_verifier),t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),t.grant_type){case"authorization_code":u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":u.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return T(d,{method:"POST",body:new URLSearchParams(u)})}}function ae(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function se(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function be(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),ce(r)}async function ke(e){let t=new TextEncoder().encode(e),o=await globalThis.crypto.subtle.digest("SHA-256",t);return ce(o)}function ce(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Se(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",o=0;for(;o<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),o++;return t}function ue(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}function Je(e){typeof e=="string"&&(e=B(e).tokens);let r=e.get("access_token");return!!(r&&!ae(r)||e.get("refresh_token"))}var le={};X(le,{default:()=>xe});var ee={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},F=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),A,ve={};function xe(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,o)=>{let n=m.url(t.url);switch(n.pathname){case"/authorize/":if(A=S(n.searchParams,{response_type:"code",client_id:"mockClientId",state:s(/.*/)}))return m.response(F(A));if(n.searchParams.has("code_challenge")){if(!n.searchParams.has("code_challenge_method"))return m.response(F("missing code_challenge_method"));ve.code_challenge=n.searchParams.get("code_challenge"),ve.code_challenge_method=n.searchParams.get("code_challenge_method")}return m.response(ee,{body:JSON.stringify({code:"mockAuthorizeToken",state:n.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let h={};t.data.forEach((g,c)=>h[c]=g),t=t.with({body:h})}if(A=S(t,{method:"POST",data:{grant_type:b("refresh_token","authorization_code")}}))return m.response(F(A));switch(t.data.grant_type){case"refresh_token":if(A=S(t.data,b({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return m.response(F(A));break;case"access_token":if(A=S(t.data,b({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return m.response(F(A));break}return m.response(ee,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[l,a]=i?i.split(" "):[];return!a||a!=="mockAccessToken"?m.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):m.response(ee,{body:JSON.stringify({result:"Success"})});case"/public/":return m.response(ee,{body:JSON.stringify({result:"Success"})});default:return m.response({status:404,statusText:"not found",body:"404 Not Found "+n})}}}var fe={};X(fe,{default:()=>Ae});var Re=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Pe=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Be={issuer:p(f),authorization_endpoint:p(f),token_endpoint:p(f),jwks_uri:s(f),registration_endpoint:s(f),scopes_supported:U([]),response_types_supported:p(P("code","token")),response_modes_supported:s([]),grant_types_supported:s([]),token_endpoint_auth_methods_supported:s([]),token_endpoint_auth_signing_alg_values_supported:s([]),service_documentation:s(f),ui_locales_supported:s([]),op_policy_uri:s(f),op_tos_uri:s(f),revocation_endpoint:s(f),revocation_endpoint_auth_methods_supported:s(Pe),revocation_endpoint_auth_signing_alg_values_supported:s(Re),introspection_endpoint:s(f),introspection_endpoint_auth_methods_supported:s(Pe),introspection_endpoint_auth_signing_alg_values_supported:s(Re),code_challendge_methods_supported:s([])};function Ae(e={}){let r={client:m.client()};e=Object.assign({},r,e),w(e,{issuer:p(f)});let t=Fe(e.issuer),o=e.client.with(e.issuer)}async function Fe(e,r){let t=r.get(m.url(e,".wellknown/oauth_authorization_server"));if(t.ok){w(t.headers.get("Content-Type"),/application\/json.*/);let o=await t.json();return w(o,Be),o}throw m.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Oe(){let e=new URLSearchParams(window.location.search);if(!e.has("code")&&window.location.hash){let t=window.location.hash.substr(1);e=new URLSearchParams("?"+t)}let r=window.parent?window.parent:window.opener;e.has("code")?r.postMessage({authorization_code:e.get("code")},window.location.origin):e.has("error")?r.postMessage({error},window.location.origin):r.postMessage({error:"Could not find an authorization_code"},window.location.origin)}function je(e){return new Promise((r,t)=>{addEventListener("message",o=>{event.data.authorization_code?r(event.data.authorization_code):event.data.error?t(event.data.error):t("Unknown authorization error")},{once:!0}),window.open(e)})}function W(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=o=>{r(o)},t.onsuccess=o=>{let n=o.target.result;e({set:function(i,l){return new Promise((a,h)=>{let g=n.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{a()},g.onerror=h,c.put(i,l)})},get:function(i){return new Promise((l,a)=>{let h=n.transaction("keyPairs","readonly"),c=h.objectStore("keyPairs").get(i);c.onsuccess=()=>{l(c.result)},c.onerror=a,h.onerror=a})},clear:function(){return new Promise((i,l)=>{let a=n.transaction("keyPairs","readwrite"),g=a.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=l,a.onerror=l})}})}})}var We=new TextEncoder,Ve=new TextDecoder;function te(e){return typeof e=="string"?We.encode(e):Ve.decode(e)}function Ee(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new de(`${e.name} modulusLength must be at least 2048 bits`)}function $e(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Ee(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Ee(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new O}async function Ze(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let o=`${V(te(JSON.stringify(e)))}.${V(te(JSON.stringify(r)))}`,n=V(await crypto.subtle.sign($e(t),t,te(o)));return`${o}.${n}`}var Te=32768;function Qe(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Te)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Te)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function V(e){return Qe(e)}function Ye(){return V(crypto.getRandomValues(new Uint8Array(32)))}var O=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},de=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function Ge(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new O("unsupported RsaHashedKeyAlgorithm hash name")}}function Xe(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new O("unsupported RsaHashedKeyAlgorithm hash name")}}function qe(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new O("unsupported EcKeyAlgorithm namedCurve")}}function et(e){switch(e.algorithm.name){case"RSA-PSS":return Ge(e);case"RSASSA-PKCS1-v1_5":return Xe(e);case"ECDSA":return qe(e);case"Ed25519":return"EdDSA";default:throw new O("unsupported CryptoKey algorithm name")}}function ze(e){return e instanceof CryptoKey}function tt(e){return ze(e)&&e.type==="private"}function rt(e){return ze(e)&&e.type==="public"}function ot(){return Math.floor(Date.now()/1e3)}async function re(e,r,t,o,n,i){let l=e?.privateKey,a=e?.publicKey;if(!tt(l))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!rt(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(o!==void 0&&typeof o!="string")throw new TypeError('"nonce" must be a string or undefined');if(n!==void 0&&typeof n!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return Ze({alg:et(l),typ:"dpop+jwt",jwk:await nt(a)},{...i,iat:ot(),jti:Ye(),htm:t,nonce:o,htu:r,ath:n?V(await crypto.subtle.digest("SHA-256",te(n))):void 0},l)}async function nt(e){let{kty:r,e:t,n:o,x:n,y:i,crv:l}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:l,e:t,n:o,x:n,y:i}}async function Le(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new O}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function $(e){return w(e,{site:p(f),authorization_endpoint:p(f),token_endpoint:p(f),dpop_signing_alg_values_supported:s([])}),async(r,t)=>{let o=await W(),n=await o.get(e.site);if(!n){let a=await Le("ES256");n={domain:e.site,keyPair:a},await o.set(n)}let i=m.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let a=r.body;a instanceof URLSearchParams||a instanceof FormData?a.set("dpop_jkt",n.keyPair.publicKey):a.dpop_jkt=n.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let a=await re(n.keyPair,r.url,r.method);r=r.with({headers:{DPoP:a}})}else if(r.headers.has("Authorization")){let a=localStorage.getItem(i.host+":nonce")||void 0,h=r.headers.get("Authorization").split(" ")[1],g=await re(n.keyPair,r.url,r.method,a,h);r=r.with({headers:{Authorization:"DPoP "+h,DPoP:g}})}let l=await t(r);return l.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",l.headers.get("DPoP-Nonce")),l}}var it=Object.assign(q,{oauth2mw:I,mockserver:le,discover:fe,tokenstore:B,dpopmw:$,keysstore:W,authorizePopup:je,popupHandleRedirect:Oe});globalThis.metro.oauth2||(globalThis.metro.oauth2=it);var Z=(...e)=>(r,t)=>e.filter(o=>t.hasOwnKey(o)).length>0?!1:y("root data must have all of",t,e),j=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var v=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],oe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function Q(e={}){w(e,{client:s(H(m.client().constructor)),issuer:p(f)});let r={client:m.client().with(L()).with(z()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function o(h){return t}let n={issuer:p(ge(e.issuer,o)),authorization_endpoint:p(f),token_endpoint:p(f),userinfo_endpoint:U(f),jwks_uri:p(f),registration_endpoint:e.requireDynamicRegistration?p(f):U(f),scopes_supported:U(j("openid")),response_types_supported:e.requireDynamicRegistration?p(j("code","id_token","id_token token")):p([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(j("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:p([]),id_token_signing_alg_values_supported:p(j("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(j("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(P(...oe)),token_endpoint_auth_signing_alg_values_supported:s(j("RS256"),J(j("none"))),display_values_supported:s(P("page","popup","touch","wap")),claim_types_supported:s(P("normal","aggregated","distributed")),claims_supported:U([]),service_documentation:s(f),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(f),op_tos_uri:s(f)},i=m.url(e.issuer,".well-known/openid-configuration"),a=(await e.client.get(i)).data;return w(a,n),w(a.issuer,e.issuer),a}async function Y(e){let r={redirect_uris:p([f]),response_types:s([]),grant_types:s(P("authorization_code","refresh_token")),application_type:s(b("native","web")),contacts:s([we]),client_name:s(String),logo_uri:s(f),client_uri:s(f),policy_uri:s(f),tos_uri:s(f),jwks_uri:s(f,J(Z("jwks"))),jwks:s(f,J(Z("jwks_uri"))),sector_identifier_uri:s(f),subject_type:s(String),id_token_signed_response_alg:s(b(...v)),id_token_encrypted_response_alg:s(b(...v)),id_token_encrypted_response_enc:s(b(...v),Z("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(b(...v)),userinfo_encrypted_response_alg:s(b(...v)),userinfo_encrypted_response_enc:s(b(...v),Z("userinfo_encrypted_response_alg")),request_object_signing_alg:s(b(...v)),request_object_encryption_alg:s(b(...v)),request_object_encryption_enc:s(b(...v)),token_endpoint_auth_method:s(b(...oe)),token_endpoint_auth_signing_alg:s(b(...v)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([f]),request_uris:s([f])};w(e,{client:s(H(m.client().constructor)),registration_endpoint:f,client_info:r});let t={client:m.client().with(L()).with(z())};e=Object.assign({},t,e);let o=await e.client.post(e.registration_endpoint,{body:e.client_info}),n=o.data;if(!n.client_id||!n.client_secret)throw m.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",o);return e.client_info=Object.assign(e.client_info,n),e.client_info}function ne(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,o)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(o)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:o=>JSON.parse(t.get("metro/oidc:"+e+":"+o)||null),set:(o,n)=>t.set("metro/oidc:"+e+":"+o,JSON.stringify(n)),has:o=>t.has("metro/oidc:"+e+":"+o)}}return r}function pe(e={}){let r={client:D(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),w(e,{client:p(H(D().constructor)),client_info:p(),issuer:p(f),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=ne(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,o)=>{let n;if(!e.force_authorization){try{n=await o(t)}catch(g){if(n.status!=401&&n.status!=403)throw g}if(n.ok||n.status!=401&&n.status!=403)return n}if(e.openid_configuration||(e.openid_configuration=await Q({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(w(e.client_info?.client_name,p()),!e.openid_configuration.registration_endpoint)throw k("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await Y({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",l=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),a=async(g,c)=>{let d=await c(g);if(d.headers.get("content-type")?.startsWith("application/json")){let _=d.data?.id_token;if(!_){let R=d.clone();try{let G=await R.json();G&&G.id_token&&(_=G.id_token)}catch{}}_&&e.store.set("id_token",_)}return d},h=e.client.with(e.issuer).with(a);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};h=h.with($(g)),l.client=h}return h=h.with(I(l)),n=await h.fetch(t),n}}function Ue(){return ue()}function Ce(e){if(!e.store){if(!e.issuer)throw k("Must supply options.issuer or options.store to get the id_token");e.store=ne(e.issuer)}return e.store.get("id_token")}var De={oidcmw:pe,discover:Q,register:Y,isRedirected:Ue,idToken:Ce};globalThis.metro.oidc||(globalThis.metro.oidc=De);var pr=De;})();
 //# sourceMappingURL=browser.min.js.map