@muze-nl/metro-oidc 0.5.6 → 0.6.0

package/dist/browser.min.js

@@ -1,2 +1,2 @@
-(()=>{var Ae=Object.defineProperty;var Pe=(e,o)=>{for(var t in o)Ae(e,t,{get:o[t],enumerable:!0})};var I={};Pe(I,{Client:()=>v,client:()=>E,deepClone:()=>T,formdata:()=>ue,metroError:()=>g,request:()=>C,response:()=>H,trace:()=>je,url:()=>b});var L="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var v=class e{clientOptions={url:b(typeof window<"u"?window.location:"https://localhost"),verbs:["get","post","put","delete","patch","head","options","query"]};static tracers={};constructor(...o){for(let t of o)if(typeof t=="string"||t instanceof String)this.clientOptions.url=b(this.clientOptions.url.href,t);else if(t instanceof e)Object.assign(this.clientOptions,t.clientOptions);else if(t instanceof Function)this.#e([t]);else if(t&&typeof t=="object")for(let r in t)r=="middlewares"?this.#e(t[r]):r=="url"?this.clientOptions.url=b(this.clientOptions.url.href,t[r]):typeof t[r]=="function"?this.clientOptions[r]=t[r](this.clientOptions[r],this.clientOptions):this.clientOptions[r]=t[r];for(let t of this.clientOptions.verbs)this[t]=async function(...r){return this.fetch(C(this.clientOptions,...r,{method:t.toUpperCase()}))}}#e(o){typeof o=="function"&&(o=[o]);let t=o.findIndex(r=>typeof r!="function");if(t>=0)throw g("metro.client: middlewares must be a function or an array of functions "+L+"client/invalid-middlewares/",o[t]);Array.isArray(this.clientOptions.middlewares)||(this.clientOptions.middlewares=[]),this.clientOptions.middlewares=this.clientOptions.middlewares.concat(o)}fetch(o,t){if(o=C(o,t),!o.url)throw g("metro.client."+o.method.toLowerCase()+": Missing url parameter "+L+"client/fetch-missing-url/",o);if(t||(t={}),typeof t!="object"||t instanceof String)throw g("metro.client.fetch: Invalid options parameter "+L+"client/fetch-invalid-options/",t);let n=[async function(c){c[Symbol.metroProxy]&&(c=c[Symbol.metroSource]);let _=await fetch(c);return H(_)}].concat(this.clientOptions?.middlewares?.slice()||[]);t=Object.assign({},this.clientOptions,t);let i;for(let a of n)i=(function(c,_){return async function(y){let l,f=Object.values(e.tracers);for(let u of f)u.request&&u.request.call(u,y,_);l=await _(y,c);for(let u of f)u.response&&u.response.call(u,l,_);return l}})(i,a);return i(o)}with(...o){return new e(T(this.clientOptions),...o)}get location(){return this.clientOptions.url}};function E(...e){return new v(...T(e))}function Re(e,o){let t=o||{};!t.url&&o.url&&(t.url=o.url);for(let r of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let n=e[r];if(!(typeof n>"u"||n==null))if(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function")t[r]=n(t[r],t);else if(r=="url")t.url=b(t.url,n);else if(r=="headers"){t.headers=new Headers(o.headers),n instanceof Headers||(n=new Headers(e.headers));for(let[i,a]of n.entries())t.headers.set(i,a)}else t[r]=n}return e instanceof Request&&e.data&&(t.body=e.data),t}function C(...e){let o={url:b(typeof window<"u"?window.location:"https://localhost/"),duplex:"half"};for(let n of e)typeof n=="string"||n instanceof URL||n instanceof URLSearchParams?o.url=b(o.url,n):n&&(n instanceof FormData||n instanceof ReadableStream||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView)?o.body=n:n&&typeof n=="object"&&Object.assign(o,Re(n,o));let t=new Request(o.url,o),r=o.body;return r&&typeof r=="object"&&!(r instanceof String)&&!(r instanceof ReadableStream)&&!(r instanceof Blob)&&!(r instanceof ArrayBuffer)&&!(r instanceof DataView)&&!(r instanceof FormData)&&!(r instanceof URLSearchParams)&&(typeof globalThis.TypedArray>"u"||!(r instanceof globalThis.TypedArray))&&typeof r.toString=="function"&&(o.body=r.toString({headers:t.headers}),t=new Request(o.url,o)),Object.freeze(t),new Proxy(t,{get(n,i){let a;switch(i){case Symbol.metroSource:a=n;break;case Symbol.metroProxy:a=!0;break;case"with":a=function(...c){return r&&c.unshift({body:r}),C(n,...c)};break;case"data":a=r;break;default:n[i]instanceof Function?a=n[i].bind(n):a=n[i];break}return a}})}function ce(e,o){let t=o||{};!t.url&&o.url&&(t.url=o.url);for(let r of["status","statusText","headers","body","url","type","redirected"]){let n=e[r];typeof n>"u"||n==null||(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function"?t[r]=n(t[r],t):r=="url"?t.url=new URL(n,t.url||"https://localhost/"):t[r]=n)}return e instanceof Response&&e.data&&(t.body=e.data),t}function H(...e){let o={};for(let n of e)typeof n=="string"?o.body=n:n instanceof Response?Object.assign(o,ce(n,o)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof globalThis.TypedArray<"u"&&n instanceof globalThis.TypedArray?o.body=n:Object.assign(o,ce(n,o)));let t;o.body&&(t=o.body),[101,204,205,304].includes(o.status)&&(o.body=null);let r=new Response(o.body,o);return Object.freeze(r),new Proxy(r,{get(n,i){let a;switch(i){case Symbol.metroProxy:a=!0;break;case Symbol.metroSource:a=n;break;case"with":a=function(...c){return H(n,...c)};break;case"data":a=t;break;case"ok":a=n.status>=200&&n.status<400;break;default:typeof n[i]=="function"?a=n[i].bind(n):a=n[i];break}return a}})}function le(e,o){typeof o=="function"?o(e.searchParams,e):(o=new URLSearchParams(o),o.forEach((t,r)=>{e.searchParams.append(r,t)}))}function b(...e){let o=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let r of e)if(typeof r=="string"||r instanceof String)t=new URL(r,t);else if(r instanceof URL||typeof Location<"u"&&r instanceof Location)t=new URL(r);else if(r instanceof URLSearchParams)le(t,r);else if(r&&typeof r=="object")for(let n in r)switch(n){case"search":typeof r.search=="function"?r.search(t.search,t):t.search=new URLSearchParams(r.search);break;case"searchParams":le(t,r.searchParams);break;default:if(!o.includes(n))throw g("metro.url: unknown url parameter "+L+"url/unknown-param-name/",n);if(typeof r[n]=="function")r[n](t[n],t);else if(typeof r[n]=="string"||r[n]instanceof String||typeof r[n]=="number"||r[n]instanceof Number||typeof r[n]=="boolean"||r[n]instanceof Boolean)t[n]=""+r[n];else if(typeof r[n]=="object"&&r[n].toString)t[n]=r[n].toString();else throw g("metro.url: unsupported value for "+n+" "+L+"url/unsupported-param-value/",e[n]);break}else throw g("metro.url: unsupported option value "+L+"url/unsupported-option-value/",r);return Object.freeze(t),new Proxy(t,{get(r,n){let i;switch(n){case Symbol.metroProxy:i=!0;break;case Symbol.metroSource:i=r;break;case"with":i=function(...a){return b(r,...a)};break;case"filename":i=r.pathname.split("/").pop();break;case"folderpath":i=r.pathname.substring(0,r.pathname.lastIndexOf("\\")+1);break;case"authority":i=r.username??"",i+=r.password?":"+r.password:"",i+=i?"@":"",i+=r.hostname,i+=r.port?":"+r.port:"",i+="/",i=r.protocol+"//"+i;break;case"origin":i=r.protocol+"//"+r.hostname,i+=r.port?":"+r.port:"",i+="/";break;case"fragment":i=r.hash.substring(1);break;case"scheme":r.protocol?i=r.protocol.substring(0,r.protocol.length-1):i="";break;default:r[n]instanceof Function?i=r[n].bind(r):i=r[n];break}return i}})}function ue(...e){var o=new FormData;for(let t of e)if(t instanceof HTMLFormElement&&(t=new FormData(t)),t instanceof FormData)for(let r of t.entries())o.append(r[0],r[1]);else if(t&&typeof t=="object")for(let r of Object.entries(t))if(Array.isArray(r[1]))for(let n of r[1])o.append(r[0],n);else o.append(r[0],r[1]);else throw new g("metro.formdata: unknown option type "+L+"formdata/unknown-option-value/",t);return Object.freeze(o),new Proxy(o,{get(t,r){let n;switch(r){case Symbol.metroProxy:n=!0;break;case Symbol.metroSource:n=t;break;case"with":n=function(...i){return ue(t,...i)};break;default:t[r]instanceof Function?n=t[r].bind(t):n=t[r];break}return n}})}var J={error:(e,...o)=>{console.error("\u24C2\uFE0F  ",e,...o)},info:(e,...o)=>{console.info("\u24C2\uFE0F  ",e,...o)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function g(e,...o){return J.error(e,...o),new Error(e,...o)}var je={add(e,o){v.tracers[e]=o},delete(e){delete v.tracers[e]},clear(){v.tracers={}},group(){let e=0;return{request:(o,t)=>{e++,J.group(e),J.info(o?.url,o,t)},response:(o,t)=>{J.info(o?.body?o.body[Symbol.metroSource]:null,o,t),J.groupEnd(e),e--}}}};function T(e){if(Array.isArray(e))return e.slice().map(T);if(e&&typeof e=="object")if(e.__proto__.constructor==Object||!e.__proto__){let o=Object.assign({},e);return Object.keys(o).forEach(t=>{o[t]=T(e[t])}),o}else return e;return e}function P(e){return e=Object.assign({contentType:"application/json",reviver:null,replacer:null,space:""},e),async function(t,r){if(t.headers.get("Accept")||(t=t.with({headers:{Accept:e.accept??e.contentType}})),t.method!=="GET"&&t.method!=="HEAD"&&t.data&&typeof t.data=="object"&&!(t.data instanceof ReadableStream)){let i=t.headers.get("Content-Type");(!i||Ee(i))&&(t=t.with({headers:{"Content-Type":e.contentType}})),fe(t.headers.get("Content-Type"))&&(t=t.with({body:JSON.stringify(t.data,e.replacer,e.space)}))}let n=await r(t);if(n&&fe(n.headers?.get("Content-Type"))){let a=await n.clone().text();try{let c=JSON.parse(a,e.reviver);return n.with({body:c})}catch{}}return n}}var Te=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function fe(e){return Te.exec(e)}function Ee(e){return/^text\/plain\b/.exec(e)}function R(e){return async function(t,r){let n=await r(t);if(!n.ok)if(e&&typeof e[n.status]=="function")n=e[n.status].apply(n,t);else throw new Error(n.status+": "+n.statusText,{cause:n});return n}}function M(){return async function(o,t){let r=await t(o);return r.ok&&r.data?r.data:r}}var V=class extends v{constructor(o,t,r=null){o instanceof v?super(o.clientOptions,R(),M()):super(o,R(),M()),r||(r=this);for(let n in t)typeof t[n]=="function"?this[n]=t[n].bind(r):t[n]&&typeof t[n]=="object"?this[n]=new this.constructor(o,t[n],r):this[n]=t[n]}},Y=class extends V{constructor(o,t,r=null){o instanceof v?super(o.with(P()),t,r):super(E(o,P()),t,r)}};function de(...e){return new V(...T(e))}function pe(...e){return new Y(...T(e))}var he=Object.assign({},I,{mw:{json:P,thrower:R,getdata:M},api:de,jsonApi:pe});globalThis.metro||(globalThis.metro=he);var j=he;globalThis.assertEnabled=!1;function ze(){globalThis.assertEnabled=!0}function Ue(){globalThis.assertEnabled=!1}function w(e,o){if(globalThis.assertEnabled){let t=S(e,o);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,r,n){if(typeof t<"u"&&t!=null&&typeof e<"u")return S(t,e,r,n)}}function p(e){return function(t,r,n){return t==null||typeof t>"u"?m("data is required",t,e||"any value",n):typeof e<"u"?S(t,e,r,n):!1}}function N(e){return function(t,r,n){return t==null||typeof t>"u"?(me("data does not contain recommended value",t,e,n),!1):S(t,e,r,n)}}function k(...e){return function(t,r,n){for(let i of e)if(!S(t,i,r,n))return!1;return m("data does not match oneOf patterns",t,e,n)}}function D(...e){return function(t,r,n){if(!Array.isArray(t))return m("data is not an array",t,"anyOf",n);for(let i of t)if(k(...e)(i))return m("data does not match anyOf patterns",i,e,n);return!1}}function q(...e){return function(t,r,n){let i=[];for(let a of e)i=i.concat(S(t,a,r,n));if(i=i.filter(Boolean),i.length)return m("data does not match all given patterns",t,e,n,i)}}function d(e,o,t){try{e instanceof URL&&(e=e.href);let r=new URL(e);if(r.href!=e&&!(r.href+"/"==e||r.href==e+"/"))return m("data is not a valid url",e,"validURL",t)}catch{return m("data is not a valid url",e,"validURL",t)}}function ee(e,o,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return m("data is not a valid email",e,"validEmail",t)}function K(e){return function(t,r,n){if(!(t instanceof e))return m("data is not an instanceof pattern",t,e,n)}}function B(e){return function(t,r,n){if(!S(t,e,r,n))return m("data matches pattern, when required not to",t,e,n)}}function S(e,o,t,r=""){t||(t=e);let n=[];if(o===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&n.push(m("data is not a boolean",e,o,r));else if(o===Number)typeof e!="number"&&!(e instanceof Number)&&n.push(m("data is not a number",e,o,r));else if(o===String)typeof e!="string"&&!(e instanceof String)&&n.push(m("data is not a string",e,o,r)),e==""&&n.push(m("data is an empty string, which is not allowed",e,o,r));else if(o instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((a,c)=>S(a,o,t,r+"["+c+"]"));i>-1&&n.push(m("data["+i+"] does not match pattern",e[i],o,r+"["+i+"]"))}else typeof e>"u"?n.push(m("data is undefined, should match pattern",e,o,r)):o.test(e)||n.push(m("data does not match pattern",e,o,r));else if(o instanceof Function){let i=o(e,t,r);i&&(Array.isArray(i)?n=n.concat(i):n.push(i))}else if(Array.isArray(o)){Array.isArray(e)||n.push(m("data is not an array",e,[],r));for(let i of o)for(let a of e.keys()){let c=S(e[a],i,t,r+"["+a+"]");Array.isArray(c)?n=n.concat(c):c&&n.push(c)}}else if(o&&typeof o=="object")if(Array.isArray(e)){let i=e.findIndex((a,c)=>S(a,o,t,r+"["+c+"]"));i>-1&&n.push(m("data["+i+"] does not match pattern",e[i],o,r+"["+i+"]"))}else if(!e||typeof e!="object")n.push(m("data is not an object, pattern is",e,o,r));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),o instanceof Function){let i=S(e,o,t,r);i&&(n=n.concat(i))}else for(let[i,a]of Object.entries(o)){let c=S(e[i],a,t,r+"."+i);c&&(n=n.concat(c))}else o!=e&&n.push(m("data and pattern are not equal",e,o,r));return n.length?n:!1}function m(e,o,t,r,n){let i={path:r,message:e,found:o,expected:t};return n&&(i.problems=n),i}function me(e,o,t,r){console.warn("\u{1F170}\uFE0F  Assert: "+r,e,t,o)}globalThis.assert={warn:me,error:m,assert:w,enable:ze,disable:Ue,Required:p,Recommended:N,Optional:s,oneOf:k,anyOf:D,allOf:q,validURL:d,validEmail:ee,instanceOf:K,not:B,fails:S};function _e(e){let o,t;if(typeof localStorage<"u")o={get:()=>localStorage.getItem("metro/state:"+e),set:r=>localStorage.setItem("metro/state:"+e,r),has:()=>localStorage.getItem("metro/state:"+e)!==null,delete:()=>localStorage.remoteItem("metro/state:"+e)},t={get:r=>JSON.parse(localStorage.getItem(e+":"+r)),set:(r,n)=>localStorage.setItem(e+":"+r,JSON.stringify(n)),has:r=>localStorage.getItem(e+":"+r)!==null,delete:r=>localStorage.removeItem(e+":"+r)};else{let r=new Map;o={get:()=>r.get("metro/state:"+e),set:n=>r.set("metro/state:"+e,n),has:()=>r.has("metro/state:"+e),delete:()=>r.delete("metro/state:"+e)},t=new Map}return{state:o,tokens:t}}function te(e){let o={client:E(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:Ce(64)},authorize_callback:async l=>(window.location.href!=l.href&&window.location.replace(l.href),!1)};w(e,{});let t=Object.assign({},o.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},o,e),e.oauth2_configuration=t;let r=_e(e.site);e.tokens||(e.tokens=r.tokens),e.state||(e.state=r.state),w(e,{oauth2_configuration:{client_id:p(/.+/),grant_type:"authorization_code",authorization_endpoint:p(d),token_endpoint:p(d),redirect_uri:p(d)}});for(let l in t)switch(l){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(l,t[l]);break}return async function(l,f){if(e.force_authorization)return n(l,f);let u;try{if(u=await f(l),u.ok)return u}catch(h){switch(u?.status){case 400:case 401:return n(l,f)}throw h}if(!u.ok)switch(u.status){case 400:case 401:return n(l,f)}return u};async function n(l,f){i();let u=e.tokens.get("access_token"),h=e.tokens.get("refresh_token"),x=Le(u);if(!u||x&&!h){try{if(!await a())return H("false")}catch(A){throw A}return n(l,f)}else if(x&&h){try{if(!await c())return H("false")}catch(A){throw A}return n(l,f)}else return l=C(l,{headers:{Authorization:u.type+" "+u.value}}),f(l)}function i(){if(typeof window<"u"&&window?.location){let l=b(window.location),f,u,h;if(l.searchParams.has("code"))h=l.searchParams,l=l.with({search:""}),history.pushState({},"",l.href);else if(l.hash){let x=l.hash.substr(1);h=new URLSearchParams("?"+x),l=l.with({hash:""}),history.pushState({},"",l.href)}if(h){f=h.get("code"),u=h.get("state");let x=e.state.get("metro/state");if(!u||u!==x)return;f&&e.tokens.set("authorization_code",f)}}}async function a(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let h=await _();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw g("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let x=await e.authorize_callback(h);if(x)e.tokens.set("authorization_code",x);else return!1}let l=y(),f=await e.client.post(l);if(!f.ok){let h=await f.text();throw g("OAuth2mw: fetch access_token: "+f.status+": "+f.statusText+" ("+h+")",{cause:l})}let u=await f.json();if(e.tokens.set("access_token",{value:u.access_token,expires:ye(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}return e.tokens.delete("authorization_code"),u}async function c(){let l=y("refresh_token"),f=await e.client.post(l);if(!f.ok)throw g("OAuth2mw: refresh access_token: "+f.status+": "+f.statusText,{cause:l});let u=await f.json();if(e.tokens.set("access_token",{value:u.access_token,expires:ye(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}else return!1;return u}async function _(){if(!t.authorization_endpoint)throw g("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let l=b(t.authorization_endpoint,{hash:""});w(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let f={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Ke(40)};return t.response_type&&(f.response_type=t.response_type),t.response_mode&&(f.response_mode=t.response_mode),e.state.set(f.state),t.client_secret&&(f.client_secret=t.client_secret),t.code_verifier&&(e.tokens.set("code_verifier",t.code_verifier),f.code_challenge=await De(t.code_verifier),f.code_challenge_method="S256"),t.scope&&(f.scope=t.scope),t.prompt&&(f.prompt=t.prompt),b(l,{search:f})}function y(l=null){if(w(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw g("oauth2mw: Missing options.endpoints.token url");let f=b(t.token_endpoint,{hash:""}),u={grant_type:l||t.grant_type,client_id:t.client_id};switch(t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),u.grant_type){case"authorization_code":u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code");let h=e.tokens.get("code_verifier");h&&(u.code_verifier=h);break;case"client_credentials":break;case"refresh_token":u.refresh_token=e.tokens.get("refresh_token");break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return C(f,{method:"POST",body:new URLSearchParams(u)})}}function Le(e){if(!e)return!0;let o=new Date(e.expires);return new Date().getTime()>o.getTime()}function ye(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let o=new Date;return o.setSeconds(o.getSeconds()+e),o}throw new TypeError("Unknown expires type "+e)}function Ce(e=64){let o=new Uint8Array(e);return globalThis.crypto.getRandomValues(o),ge(o)}async function De(e){let t=new TextEncoder().encode(e),r=await globalThis.crypto.subtle.digest("SHA-256",t);return ge(r)}function ge(e){let o=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Ke(e){let o="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",r=0;for(;r<e;)t+=o.charAt(Math.floor(Math.random()*o.length)),r++;return t}function we(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let o=e.hash.substr(1);if(new URLSearchParams("?"+o).has("code"))return!0}return!1}return!0}function re(){return new Promise((e,o)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=r=>{o(r)},t.onsuccess=r=>{let n=r.target.result;e({set:function(i,a){return new Promise((c,_)=>{let y=n.transaction("keyPairs","readwrite",{durability:"strict"}),l=y.objectStore("keyPairs");y.oncomplete=()=>{c()},y.onerror=_,l.put(i,a)})},get:function(i){return new Promise((a,c)=>{let _=n.transaction("keyPairs","readonly"),l=_.objectStore("keyPairs").get(i);l.onsuccess=()=>{a(l.result)},l.onerror=c,_.onerror=c})},clear:function(){return new Promise((i,a)=>{let c=n.transaction("keyPairs","readwrite"),y=c.objectStore("keyPairs").clear();y.onsuccess=()=>{i()},y.onerror=a,c.onerror=a})}})}})}var Ie=new TextEncoder,Me=new TextDecoder;function Z(e){return typeof e=="string"?Ie.encode(e):Me.decode(e)}function be(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new oe(`${e.name} modulusLength must be at least 2048 bits`)}function Ne(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return be(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return be(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new z}async function Be(e,o,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let r=`${G(Z(JSON.stringify(e)))}.${G(Z(JSON.stringify(o)))}`,n=G(await crypto.subtle.sign(Ne(t),t,Z(r)));return`${r}.${n}`}var ne;Uint8Array.prototype.toBase64?ne=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0})):ne=o=>{o instanceof ArrayBuffer&&(o=new Uint8Array(o));let t=[];for(let r=0;r<o.byteLength;r+=32768)t.push(String.fromCharCode.apply(null,o.subarray(r,r+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function G(e){return ne(e)}var z=class extends Error{constructor(o){var t;super(o??"operation not supported"),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}},oe=class extends Error{constructor(o){var t;super(o),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}};function Je(e){if(e.algorithm.hash.name==="SHA-256")return"PS256";throw new z("unsupported RsaHashedKeyAlgorithm hash name")}function Fe(e){if(e.algorithm.hash.name==="SHA-256")return"RS256";throw new z("unsupported RsaHashedKeyAlgorithm hash name")}function We(e){if(e.algorithm.namedCurve==="P-256")return"ES256";throw new z("unsupported EcKeyAlgorithm namedCurve")}function $e(e){switch(e.algorithm.name){case"RSA-PSS":return Je(e);case"RSASSA-PKCS1-v1_5":return Fe(e);case"ECDSA":return We(e);case"Ed25519":return"Ed25519";default:throw new z("unsupported CryptoKey algorithm name")}}function ke(e){return e instanceof CryptoKey}function Ve(e){return ke(e)&&e.type==="private"}function Ze(e){return ke(e)&&e.type==="public"}function Ge(){return Math.floor(Date.now()/1e3)}async function ie(e,o,t,r,n,i){let a=e?.privateKey,c=e?.publicKey;if(!Ve(a))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!Ze(c))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(c.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof o!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(r!==void 0&&typeof r!="string")throw new TypeError('"nonce" must be a string or undefined');if(n!==void 0&&typeof n!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return Be({alg:$e(a),typ:"dpop+jwt",jwk:await Qe(c)},Object.assign(Object.assign({},i),{iat:Ge(),jti:crypto.randomUUID(),htm:t,nonce:r,htu:o,ath:n?G(await crypto.subtle.digest("SHA-256",Z(n))):void 0}),a)}async function Qe(e){let{kty:o,e:t,n:r,x:n,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:o,crv:a,e:t,n:r,x:n,y:i}}async function Se(e,o){var t;let r;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":r={name:"RSA-PSS",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":r={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"};break;case"Ed25519":r={name:"Ed25519"};break;default:throw new z}return crypto.subtle.generateKey(r,(t=o?.extractable)!==null&&t!==void 0?t:!1,["sign","verify"])}function se(e){return w(e,{site:p(d),authorization_endpoint:p(d),token_endpoint:p(d),dpop_signing_alg_values_supported:s([])}),async(o,t)=>{let r=await re(),n=await r.get(e.site);if(!n){let c=await Se("ES256");n={domain:e.site,keyPair:c},await r.set(n)}let i=j.url(o.url);if(o.url.startsWith(e.authorization_endpoint)){let c=o.body;c instanceof URLSearchParams||c instanceof FormData?c.set("dpop_jkt",n.keyPair.publicKey):c.dpop_jkt=n.keyPair.publicKey}else if(o.url.startsWith(e.token_endpoint)){let c=await ie(n.keyPair,o.url,o.method);o=o.with({headers:{DPoP:c}})}else if(o.headers.has("Authorization")){let c=localStorage.getItem(i.host+":nonce")||void 0,_=o.headers.get("Authorization").split(" ")[1],y=await ie(n.keyPair,o.url,o.method,c,_);o=o.with({headers:{Authorization:"DPoP "+_,DPoP:y}})}let a=await t(o);return a.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",a.headers.get("DPoP-Nonce")),a}}var F=(...e)=>(o,t)=>e.filter(r=>t.hasOwnKey(r)).length>0?!1:m("root data must have all of",t,e),U=(...e)=>o=>Array.isArray(o)&&e.filter(t=>!o.includes(t)).length==0?!1:m("data must be an array which includes",o,e);var O=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Q=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function W(e={}){w(e,{client:s(K(j.client().constructor)),issuer:p(d)});let o={client:j.client().with(R()).with(P()),requireDynamicRegistration:!1};e=Object.assign({},o,e);let t=!1;function r(_){return t}let n={issuer:p(q(e.issuer,r)),authorization_endpoint:p(d),token_endpoint:p(d),userinfo_endpoint:N(d),jwks_uri:p(d),registration_endpoint:e.requireDynamicRegistration?p(d):N(d),scopes_supported:N(U("openid")),response_types_supported:e.requireDynamicRegistration?p(U("code","id_token","id_token token")):p([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(U("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:p([]),id_token_signing_alg_values_supported:p(U("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(U("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(D(...Q)),token_endpoint_auth_signing_alg_values_supported:s(U("RS256"),B(U("none"))),display_values_supported:s(D("page","popup","touch","wap")),claim_types_supported:s(D("normal","aggregated","distributed")),claims_supported:N([]),service_documentation:s(d),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(d),op_tos_uri:s(d)},i=j.url(e.issuer,".well-known/openid-configuration"),c=(await e.client.get(i)).data;return w(c,n),w(c.issuer,e.issuer),c}async function $(e){let o={redirect_uris:p([d]),response_types:s([]),grant_types:s(D("authorization_code","refresh_token")),application_type:s(k("native","web")),contacts:s([ee]),client_name:s(String),logo_uri:s(d),client_uri:s(d),policy_uri:s(d),tos_uri:s(d),jwks_uri:s(d,B(F("jwks"))),jwks:s(d,B(F("jwks_uri"))),sector_identifier_uri:s(d),subject_type:s(String),id_token_signed_response_alg:s(k(...O)),id_token_encrypted_response_alg:s(k(...O)),id_token_encrypted_response_enc:s(k(...O),F("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(k(...O)),userinfo_encrypted_response_alg:s(k(...O)),userinfo_encrypted_response_enc:s(k(...O),F("userinfo_encrypted_response_alg")),request_object_signing_alg:s(k(...O)),request_object_encryption_alg:s(k(...O)),request_object_encryption_enc:s(k(...O)),token_endpoint_auth_method:s(k(...Q)),token_endpoint_auth_signing_alg:s(k(...O)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([d]),request_uris:s([d])};w(e,{client:s(K(j.client().constructor)),registration_endpoint:d,client_info:o});let t={client:j.client().with(R()).with(P()),client_info:{redirect_uris:[globalThis.document?.location.href]}};e=Object.assign({},t,e),e.client_info||(e.client_info={}),e.client_info.redirect_uris||(e.client_info.redirect_uris=[globalThis.document?.location.href]);let r=await e.client.post(e.registration_endpoint,{body:e.client_info}),n=r.data;if(!n.client_id||!n.client_secret)throw j.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",r);return e.client_info=Object.assign(e.client_info,n),e.client_info}function X(e){let o;if(typeof localStorage<"u")o={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,r)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(r)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;o={get:r=>JSON.parse(t.get("metro/oidc:"+e+":"+r)||null),set:(r,n)=>t.set("metro/oidc:"+e+":"+r,JSON.stringify(n)),has:r=>t.has("metro/oidc:"+e+":"+r)}}return o}function ae(e={}){let o={client:E(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},o,e),w(e,{client:p(K(E().constructor)),client_info:p(),issuer:p(d),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=X(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info?.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,r)=>{let n;if(!e.force_authorization){try{n=await r(t)}catch(y){if(n.status!=401&&n.status!=403)throw y}if(n.ok||n.status!=401&&n.status!=403)return n}if(e.openid_configuration||(e.openid_configuration=await W({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(!e.openid_configuration.registration_endpoint)throw g("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await $({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",a=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info?.client_id,client_secret:e.client_info?.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),c=async(y,l)=>{let f=await l(y);if(f.headers.get("content-type")?.startsWith("application/json")){let h=f.data?.id_token;if(!h){let x=f.clone();try{let A=await x.json();A&&A.id_token&&(h=A.id_token)}catch{}}h&&e.store.set("id_token",h)}return f},_=e.client.with(e.issuer).with(c);if(e.use_dpop){let y={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};_=_.with(se(y)),a.client=_}return _=_.with(te(a)),n=await _.fetch(t),n}}function xe(){return we()}function ve(e){if(!e.store){if(!e.issuer)throw g("Must supply options.issuer or options.store to get the id_token");e.store=X(e.issuer)}return e.store.get("id_token")}var Oe={oidcmw:ae,discover:W,register:$,isRedirected:xe,idToken:ve};globalThis.metro.oidc||(globalThis.metro.oidc=Oe);var Qt=Oe;})();
+(()=>{var Fe=Object.defineProperty;var q=(e,n)=>{for(var t in n)Fe(e,t,{get:n[t],enumerable:!0})};var M={};q(M,{Client:()=>O,client:()=>z,deepClone:()=>E,formdata:()=>Se,metroError:()=>S,request:()=>H,response:()=>N,trace:()=>Ve,url:()=>v});var K="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var O=class e{clientOptions={url:v(typeof window<"u"?window.location:"https://localhost"),verbs:["get","post","put","delete","patch","head","options","query"]};static tracers={};constructor(...n){for(let t of n)if(typeof t=="string"||t instanceof String)this.clientOptions.url=v(this.clientOptions.url.href,t);else if(t instanceof e)Object.assign(this.clientOptions,t.clientOptions);else if(t instanceof Function)this.#e([t]);else if(t&&typeof t=="object")for(let r in t)r=="middlewares"?this.#e(t[r]):r=="url"?this.clientOptions.url=v(this.clientOptions.url.href,t[r]):typeof t[r]=="function"?this.clientOptions[r]=t[r](this.clientOptions[r],this.clientOptions):this.clientOptions[r]=t[r];for(let t of this.clientOptions.verbs)this[t]=async function(...r){return this.fetch(H(this.clientOptions,...r,{method:t.toUpperCase()}))}}#e(n){typeof n=="function"&&(n=[n]);let t=n.findIndex(r=>typeof r!="function");if(t>=0)throw S("metro.client: middlewares must be a function or an array of functions "+K+"client/invalid-middlewares/",n[t]);Array.isArray(this.clientOptions.middlewares)||(this.clientOptions.middlewares=[]),this.clientOptions.middlewares=this.clientOptions.middlewares.concat(n)}fetch(n,t){if(n=H(n,t),!n.url)throw S("metro.client."+n.method.toLowerCase()+": Missing url parameter "+K+"client/fetch-missing-url/",n);if(t||(t={}),typeof t!="object"||t instanceof String)throw S("metro.client.fetch: Invalid options parameter "+K+"client/fetch-invalid-options/",t);let o=[async function(c){c[Symbol.metroProxy]&&(c=c[Symbol.metroSource]);let h=await fetch(c);return N(h)}].concat(this.clientOptions?.middlewares?.slice()||[]);t=Object.assign({},this.clientOptions,t);let i;for(let a of o)i=(function(c,h){return async function(g){let l,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,g,h);l=await h(g,c);for(let u of d)u.response&&u.response.call(u,l,h);return l}})(i,a);return i(n)}with(...n){return new e(E(this.clientOptions),...n)}get location(){return this.clientOptions.url}};function z(...e){return new O(...E(e))}function We(e,n){let t=n||{};!t.url&&n.url&&(t.url=n.url);for(let r of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let o=e[r];if(!(typeof o>"u"||o==null))if(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function")t[r]=o(t[r],t);else if(r=="url")t.url=v(t.url,o);else if(r=="headers"){t.headers=new Headers(n.headers),o instanceof Headers||(o=new Headers(e.headers));for(let[i,a]of o.entries())t.headers.set(i,a)}else t[r]=o}return e instanceof Request&&e.data&&(t.body=e.data),t}function H(...e){let n={url:v(typeof window<"u"?window.location:"https://localhost/"),duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?n.url=v(n.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?n.body=o:o&&typeof o=="object"&&Object.assign(n,We(o,n));let t=new Request(n.url,n),r=n.body;return r&&typeof r=="object"&&!(r instanceof String)&&!(r instanceof ReadableStream)&&!(r instanceof Blob)&&!(r instanceof ArrayBuffer)&&!(r instanceof DataView)&&!(r instanceof FormData)&&!(r instanceof URLSearchParams)&&(typeof globalThis.TypedArray>"u"||!(r instanceof globalThis.TypedArray))&&typeof r.toString=="function"&&(n.body=r.toString({headers:t.headers}),t=new Request(n.url,n)),Object.freeze(t),new Proxy(t,{get(o,i){let a;switch(i){case Symbol.metroSource:a=o;break;case Symbol.metroProxy:a=!0;break;case"with":a=function(...c){return r&&c.unshift({body:r}),H(o,...c)};break;case"data":a=r;break;default:o[i]instanceof Function?a=o[i].bind(o):a=o[i];break}return a}})}function be(e,n){let t=n||{};!t.url&&n.url&&(t.url=n.url);for(let r of["status","statusText","headers","body","url","type","redirected"]){let o=e[r];typeof o>"u"||o==null||(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function"?t[r]=o(t[r],t):r=="url"?t.url=new URL(o,t.url||"https://localhost/"):t[r]=o)}return e instanceof Response&&e.data&&(t.body=e.data),t}function N(...e){let n={};for(let o of e)typeof o=="string"?n.body=o:o instanceof Response?Object.assign(n,be(o,n)):o&&typeof o=="object"&&(o instanceof FormData||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView||o instanceof ReadableStream||o instanceof URLSearchParams||o instanceof String||typeof globalThis.TypedArray<"u"&&o instanceof globalThis.TypedArray?n.body=o:Object.assign(n,be(o,n)));let t;n.body&&(t=n.body),[101,204,205,304].includes(n.status)&&(n.body=null);let r=new Response(n.body,n);return Object.freeze(r),new Proxy(r,{get(o,i){let a;switch(i){case Symbol.metroProxy:a=!0;break;case Symbol.metroSource:a=o;break;case"with":a=function(...c){return N(o,...c)};break;case"data":a=t;break;case"ok":a=o.status>=200&&o.status<400;break;default:typeof o[i]=="function"?a=o[i].bind(o):a=o[i];break}return a}})}function ke(e,n){typeof n=="function"?n(e.searchParams,e):(n=new URLSearchParams(n),n.forEach((t,r)=>{e.searchParams.append(r,t)}))}function v(...e){let n=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let r of e)if(typeof r=="string"||r instanceof String)t=new URL(r,t);else if(r instanceof URL||typeof Location<"u"&&r instanceof Location)t=new URL(r);else if(r instanceof URLSearchParams)ke(t,r);else if(r&&typeof r=="object")for(let o in r)switch(o){case"search":typeof r.search=="function"?r.search(t.search,t):t.search=new URLSearchParams(r.search);break;case"searchParams":ke(t,r.searchParams);break;default:if(!n.includes(o))throw S("metro.url: unknown url parameter "+K+"url/unknown-param-name/",o);if(typeof r[o]=="function")r[o](t[o],t);else if(typeof r[o]=="string"||r[o]instanceof String||typeof r[o]=="number"||r[o]instanceof Number||typeof r[o]=="boolean"||r[o]instanceof Boolean)t[o]=""+r[o];else if(typeof r[o]=="object"&&r[o].toString)t[o]=r[o].toString();else throw S("metro.url: unsupported value for "+o+" "+K+"url/unsupported-param-value/",e[o]);break}else throw S("metro.url: unsupported option value "+K+"url/unsupported-option-value/",r);return Object.freeze(t),new Proxy(t,{get(r,o){let i;switch(o){case Symbol.metroProxy:i=!0;break;case Symbol.metroSource:i=r;break;case"with":i=function(...a){return v(r,...a)};break;case"filename":i=r.pathname.split("/").pop();break;case"folderpath":i=r.pathname.substring(0,r.pathname.lastIndexOf("\\")+1);break;case"authority":i=r.username??"",i+=r.password?":"+r.password:"",i+=i?"@":"",i+=r.hostname,i+=r.port?":"+r.port:"",i+="/",i=r.protocol+"//"+i;break;case"origin":i=r.protocol+"//"+r.hostname,i+=r.port?":"+r.port:"",i+="/";break;case"fragment":i=r.hash.substring(1);break;case"scheme":r.protocol?i=r.protocol.substring(0,r.protocol.length-1):i="";break;default:r[o]instanceof Function?i=r[o].bind(r):i=r[o];break}return i}})}function Se(...e){var n=new FormData;for(let t of e)if(t instanceof HTMLFormElement&&(t=new FormData(t)),t instanceof FormData)for(let r of t.entries())n.append(r[0],r[1]);else if(t&&typeof t=="object")for(let r of Object.entries(t))if(Array.isArray(r[1]))for(let o of r[1])n.append(r[0],o);else n.append(r[0],r[1]);else throw new S("metro.formdata: unknown option type "+K+"formdata/unknown-option-value/",t);return Object.freeze(n),new Proxy(n,{get(t,r){let o;switch(r){case Symbol.metroProxy:o=!0;break;case Symbol.metroSource:o=t;break;case"with":o=function(...i){return Se(t,...i)};break;default:t[r]instanceof Function?o=t[r].bind(t):o=t[r];break}return o}})}var W={error:(e,...n)=>{console.error("\u24C2\uFE0F  ",e,...n)},info:(e,...n)=>{console.info("\u24C2\uFE0F  ",e,...n)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function S(e,...n){return W.error(e,...n),new Error(e,...n)}var Ve={add(e,n){O.tracers[e]=n},delete(e){delete O.tracers[e]},clear(){O.tracers={}},group(){let e=0;return{request:(n,t)=>{e++,W.group(e),W.info(n?.url,n,t)},response:(n,t)=>{W.info(n?.body?n.body[Symbol.metroSource]:null,n,t),W.groupEnd(e),e--}}}};function E(e){if(Array.isArray(e))return e.slice().map(E);if(e&&typeof e=="object")if(e.__proto__.constructor==Object||!e.__proto__){let n=Object.assign({},e);return Object.keys(n).forEach(t=>{n[t]=E(e[t])}),n}else return e;return e}function A(e){return e=Object.assign({contentType:"application/json",reviver:null,replacer:null,space:""},e),async function(t,r){if(t.headers.get("Accept")||(t=t.with({headers:{Accept:e.accept??e.contentType}})),t.method!=="GET"&&t.method!=="HEAD"&&t.data&&typeof t.data=="object"&&!(t.data instanceof ReadableStream)){let i=t.headers.get("Content-Type");(!i||Ze(i))&&(t=t.with({headers:{"Content-Type":e.contentType}})),ve(t.headers.get("Content-Type"))&&(t=t.with({body:JSON.stringify(t.data,e.replacer,e.space)}))}let o=await r(t);if(o&&ve(o.headers?.get("Content-Type"))){let a=await o.clone().text();try{let c=JSON.parse(a,e.reviver);return o.with({body:c})}catch{}}return o}}var $e=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function ve(e){return $e.exec(e)}function Ze(e){return/^text\/plain\b/.exec(e)}function T(e){return async function(t,r){let o=await r(t);if(!o.ok)if(e&&typeof e[o.status]=="function")o=e[o.status].apply(o,t);else throw new Error(o.status+": "+o.statusText,{cause:o});return o}}function J(){return async function(n,t){let r=await t(n);return r.ok&&r.data?r.data:r}}var ee=class extends O{constructor(n,t,r=null){n instanceof O?super(n.clientOptions,T(),J()):super(n,T(),J()),r||(r=this);for(let o in t)typeof t[o]=="function"?this[o]=t[o].bind(r):t[o]&&typeof t[o]=="object"?this[o]=new this.constructor(n,t[o],r):this[o]=t[o]}},ae=class extends ee{constructor(n,t,r=null){n instanceof O?super(n.with(A()),t,r):super(z(n,A()),t,r)}};function xe(...e){return new ee(...E(e))}function Oe(...e){return new ae(...E(e))}var Re=Object.assign({},M,{mw:{json:A,thrower:T,getdata:J},api:xe,jsonApi:Oe});globalThis.metro||(globalThis.metro=Re);var m=Re;var te={};q(te,{base64url_encode:()=>de,createState:()=>je,default:()=>F,generateCodeChallenge:()=>Te,generateCodeVerifier:()=>Ae,getExpires:()=>ue,isAuthorized:()=>Ye,isExpired:()=>fe,isRedirected:()=>pe});globalThis.assertEnabled=!1;function Ge(){globalThis.assertEnabled=!0}function Qe(){globalThis.assertEnabled=!1}function w(e,n){if(globalThis.assertEnabled){let t=k(e,n);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,r,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return k(t,e,r,o)}}function p(e){return function(t,r,o){return t==null||typeof t>"u"?y("data is required",t,e||"any value",o):typeof e<"u"?k(t,e,r,o):!1}}function C(e){return function(t,r,o){return t==null||typeof t>"u"?(Pe("data does not contain recommended value",t,e,o),!1):k(t,e,r,o)}}function b(...e){return function(t,r,o){for(let i of e)if(!k(t,i,r,o))return!1;return y("data does not match oneOf patterns",t,e,o)}}function j(...e){return function(t,r,o){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",o);for(let i of t)if(b(...e)(i))return y("data does not match anyOf patterns",i,e,o);return!1}}function ce(...e){return function(t,r,o){let i=[];for(let a of e)i=i.concat(k(t,a,r,o));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,o,i)}}function f(e,n,t){try{e instanceof URL&&(e=e.href);let r=new URL(e);if(r.href!=e&&!(r.href+"/"==e||r.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function le(e,n,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function I(e){return function(t,r,o){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,o)}}function B(e){return function(t,r,o){if(!k(t,e,r,o))return y("data matches pattern, when required not to",t,e,o)}}function k(e,n,t,r=""){t||(t=e);let o=[];if(n===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(y("data is not a boolean",e,n,r));else if(n===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(y("data is not a number",e,n,r));else if(n===String)typeof e!="string"&&!(e instanceof String)&&o.push(y("data is not a string",e,n,r)),e==""&&o.push(y("data is an empty string, which is not allowed",e,n,r));else if(n instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((a,c)=>k(a,n,t,r+"["+c+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],n,r+"["+i+"]"))}else typeof e>"u"?o.push(y("data is undefined, should match pattern",e,n,r)):n.test(e)||o.push(y("data does not match pattern",e,n,r));else if(n instanceof Function){let i=n(e,t,r);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(n)){Array.isArray(e)||o.push(y("data is not an array",e,[],r));for(let i of n)for(let a of e.keys()){let c=k(e[a],i,t,r+"["+a+"]");Array.isArray(c)?o=o.concat(c):c&&o.push(c)}}else if(n&&typeof n=="object")if(Array.isArray(e)){let i=e.findIndex((a,c)=>k(a,n,t,r+"["+c+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],n,r+"["+i+"]"))}else if(!e||typeof e!="object")o.push(y("data is not an object, pattern is",e,n,r));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),n instanceof Function){let i=k(e,n,t,r);i&&(o=o.concat(i))}else for(let[i,a]of Object.entries(n)){let c=k(e[i],a,t,r+"."+i);c&&(o=o.concat(c))}else n!=e&&o.push(y("data and pattern are not equal",e,n,r));return o.length?o:!1}function y(e,n,t,r,o){let i={path:r,message:e,found:n,expected:t};return o&&(i.problems=o),i}function Pe(e,n,t,r){console.warn("\u{1F170}\uFE0F  Assert: "+r,e,t,n)}globalThis.assert={warn:Pe,error:y,assert:w,enable:Ge,disable:Qe,Required:p,Recommended:C,Optional:s,oneOf:b,anyOf:j,allOf:ce,validURL:f,validEmail:le,instanceOf:I,not:B,fails:k};function V(e){let n,t;if(typeof localStorage<"u")n={get:()=>localStorage.getItem("metro/state:"+e),set:r=>localStorage.setItem("metro/state:"+e,r),has:()=>localStorage.getItem("metro/state:"+e)!==null,delete:()=>localStorage.remoteItem("metro/state:"+e)},t={get:r=>JSON.parse(localStorage.getItem(e+":"+r)),set:(r,o)=>localStorage.setItem(e+":"+r,JSON.stringify(o)),has:r=>localStorage.getItem(e+":"+r)!==null,delete:r=>localStorage.removeItem(e+":"+r)};else{let r=new Map;n={get:()=>r.get("metro/state:"+e),set:o=>r.set("metro/state:"+e,o),has:()=>r.has("metro/state:"+e),delete:()=>r.delete("metro/state:"+e)},t=new Map}return{state:n,tokens:t}}function F(e){let n={client:z(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:Ae(64)},authorize_callback:async l=>(window.location.href!=l.href&&window.location.replace(l.href),!1)};w(e,{});let t=Object.assign({},n.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},n,e),e.oauth2_configuration=t;let r=V(e.site);e.tokens||(e.tokens=r.tokens),e.state||(e.state=r.state),w(e,{oauth2_configuration:{client_id:p(/.+/),grant_type:"authorization_code",authorization_endpoint:p(f),token_endpoint:p(f),redirect_uri:p(f)}});for(let l in t)switch(l){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(l,t[l]);break}return async function(l,d){if(e.force_authorization)return o(l,d);let u;try{if(u=await d(l),u.ok)return u}catch(_){switch(u?.status){case 400:case 401:return o(l,d)}throw _}if(!u.ok)switch(u.status){case 400:case 401:return o(l,d)}return u};async function o(l,d){i();let u=e.tokens.get("access_token"),_=e.tokens.get("refresh_token"),x=fe(u);if(!u||x&&!_){try{if(!await a())return N("false")}catch(P){throw P}return o(l,d)}else if(x&&_){try{if(!await c())return N("false")}catch(P){throw P}return o(l,d)}else return l=H(l,{headers:{Authorization:u.type+" "+u.value}}),d(l)}function i(){if(typeof window<"u"&&window?.location){let l=v(window.location),d,u,_;if(l.searchParams.has("code"))_=l.searchParams,l=l.with({search:""}),history.pushState({},"",l.href);else if(l.hash){let x=l.hash.substr(1);_=new URLSearchParams("?"+x),l=l.with({hash:""}),history.pushState({},"",l.href)}if(_){d=_.get("code"),u=_.get("state");let x=e.state.get("metro/state");if(!u||u!==x)return;d&&e.tokens.set("authorization_code",d)}}}async function a(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let _=await h();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw S("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let x=await e.authorize_callback(_);if(x)e.tokens.set("authorization_code",x);else return!1}let l=g(),d=await e.client.post(l);if(!d.ok){let _=await d.text();throw S("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText+" ("+_+")",{cause:l})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:ue(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}return e.tokens.delete("authorization_code"),u}async function c(){let l=g("refresh_token"),d=await e.client.post(l);if(!d.ok)throw S("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:l});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:ue(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}else return!1;return u}async function h(){if(!t.authorization_endpoint)throw S("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let l=v(t.authorization_endpoint,{hash:""});w(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||je(40)};return t.response_type&&(d.response_type=t.response_type),t.response_mode&&(d.response_mode=t.response_mode),e.state.set(d.state),t.client_secret&&(d.client_secret=t.client_secret),t.code_verifier&&(e.tokens.set("code_verifier",t.code_verifier),d.code_challenge=await Te(t.code_verifier),d.code_challenge_method="S256"),t.scope&&(d.scope=t.scope),t.prompt&&(d.prompt=t.prompt),v(l,{search:d})}function g(l=null){if(w(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw S("oauth2mw: Missing options.endpoints.token url");let d=v(t.token_endpoint,{hash:""}),u={grant_type:l||t.grant_type,client_id:t.client_id};switch(t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),u.grant_type){case"authorization_code":u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code");let _=e.tokens.get("code_verifier");_&&(u.code_verifier=_);break;case"client_credentials":break;case"refresh_token":u.refresh_token=e.tokens.get("refresh_token");break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return H(d,{method:"POST",body:new URLSearchParams(u)})}}function fe(e){if(!e)return!0;let n=new Date(e.expires);return new Date().getTime()>n.getTime()}function ue(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let n=new Date;return n.setSeconds(n.getSeconds()+e),n}throw new TypeError("Unknown expires type "+e)}function Ae(e=64){let n=new Uint8Array(e);return globalThis.crypto.getRandomValues(n),de(n)}async function Te(e){let t=new TextEncoder().encode(e),r=await globalThis.crypto.subtle.digest("SHA-256",t);return de(r)}function de(e){let n=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function je(e){let n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",r=0;for(;r<e;)t+=n.charAt(Math.floor(Math.random()*n.length)),r++;return t}function pe(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let n=e.hash.substr(1);if(new URLSearchParams("?"+n).has("code"))return!0}return!1}return!0}function Ye(e){typeof e=="string"&&(e=V(e).tokens);let n=e.get("access_token");return!!(n&&!fe(n)||e.get("refresh_token"))}var he={};q(he,{default:()=>ze});var re={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},$=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),U,Ee={};function ze(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,r)=>{let o=m.url(t.url);switch(o.pathname){case"/authorize/":if(U=k(o.searchParams,{response_type:"code",client_id:"mockClientId",state:s(/.*/)}))return m.response($(U));if(o.searchParams.has("code_challenge")){if(!o.searchParams.has("code_challenge_method"))return m.response($("missing code_challenge_method"));Ee.code_challenge=o.searchParams.get("code_challenge"),Ee.code_challenge_method=o.searchParams.get("code_challenge_method")}return m.response(re,{body:JSON.stringify({code:"mockAuthorizeToken",state:o.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let h={};t.data.forEach((g,l)=>h[l]=g),t=t.with({body:h})}if(U=k(t,{method:"POST",data:{grant_type:b("refresh_token","authorization_code")}}))return m.response($(U));switch(t.data.grant_type){case"refresh_token":if(U=k(t.data,b({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return m.response($(U));break;case"access_token":if(U=k(t.data,b({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return m.response($(U));break}return m.response(re,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[a,c]=i?i.split(" "):[];return!c||c!=="mockAccessToken"?m.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):m.response(re,{body:JSON.stringify({result:"Success"})});case"/public/":return m.response(re,{body:JSON.stringify({result:"Success"})});default:return m.response({status:404,statusText:"not found",body:"404 Not Found "+o})}}}var me={};q(me,{default:()=>Le});var Ce=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Ue=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],qe={issuer:p(f),authorization_endpoint:p(f),token_endpoint:p(f),jwks_uri:s(f),registration_endpoint:s(f),scopes_supported:C([]),response_types_supported:p(j("code","token")),response_modes_supported:s([]),grant_types_supported:s([]),token_endpoint_auth_methods_supported:s([]),token_endpoint_auth_signing_alg_values_supported:s([]),service_documentation:s(f),ui_locales_supported:s([]),op_policy_uri:s(f),op_tos_uri:s(f),revocation_endpoint:s(f),revocation_endpoint_auth_methods_supported:s(Ue),revocation_endpoint_auth_signing_alg_values_supported:s(Ce),introspection_endpoint:s(f),introspection_endpoint_auth_methods_supported:s(Ue),introspection_endpoint_auth_signing_alg_values_supported:s(Ce),code_challendge_methods_supported:s([])};function Le(e={}){let n={client:m.client()};e=Object.assign({},n,e),w(e,{issuer:p(f)});let t=et(e.issuer);return e.client.with(e.issuer)}async function et(e,n){let t=n.get(m.url(e,".wellknown/oauth_authorization_server"));if(t.ok){w(t.headers.get("Content-Type"),/application\/json.*/);let r=await t.json();return w(r,qe),r}throw m.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function De(e=null){let n=!1;e=e||window.location.origin;let t=new URLSearchParams(window.location.search);if(!t.has("code")&&window.location.hash){let o=window.location.hash.substr(1);t=new URLSearchParams("?"+o)}let r=window.parent!==window?window.parent:window.opener;return r?t.has("code")?(r.postMessage({authorization_code:t.get("code")},e),n=!0):t.has("error")?r.postMessage({error:t.get("error")},e):r.postMessage({error:"Could not find an authorization_code"},e):console.error("No parent window found, cannot post authorization code (or error)"),n}function Ke(e){return new Promise((n,t)=>{addEventListener("message",r=>{r.data.authorization_code?n(r.data.authorization_code):r.data.error?t(r.data.error):t("Unknown authorization error")},{once:!0}),window.open(e)})}function Z(){return new Promise((e,n)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=r=>{n(r)},t.onsuccess=r=>{let o=r.target.result;e({set:function(i,a){return new Promise((c,h)=>{let g=o.transaction("keyPairs","readwrite",{durability:"strict"}),l=g.objectStore("keyPairs");g.oncomplete=()=>{c()},g.onerror=h,l.put(i,a)})},get:function(i){return new Promise((a,c)=>{let h=o.transaction("keyPairs","readonly"),l=h.objectStore("keyPairs").get(i);l.onsuccess=()=>{a(l.result)},l.onerror=c,h.onerror=c})},clear:function(){return new Promise((i,a)=>{let c=o.transaction("keyPairs","readwrite"),g=c.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=a,c.onerror=a})}})}})}var tt=new TextEncoder,rt=new TextDecoder;function oe(e){return typeof e=="string"?tt.encode(e):rt.decode(e)}function He(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new ye(`${e.name} modulusLength must be at least 2048 bits`)}function ot(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return He(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return He(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new L}async function nt(e,n,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let r=`${ne(oe(JSON.stringify(e)))}.${ne(oe(JSON.stringify(n)))}`,o=ne(await crypto.subtle.sign(ot(t),t,oe(r)));return`${r}.${o}`}var _e;Uint8Array.prototype.toBase64?_e=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0})):_e=n=>{n instanceof ArrayBuffer&&(n=new Uint8Array(n));let t=[];for(let r=0;r<n.byteLength;r+=32768)t.push(String.fromCharCode.apply(null,n.subarray(r,r+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function ne(e){return _e(e)}var L=class extends Error{constructor(n){var t;super(n??"operation not supported"),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}},ye=class extends Error{constructor(n){var t;super(n),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}};function it(e){if(e.algorithm.hash.name==="SHA-256")return"PS256";throw new L("unsupported RsaHashedKeyAlgorithm hash name")}function st(e){if(e.algorithm.hash.name==="SHA-256")return"RS256";throw new L("unsupported RsaHashedKeyAlgorithm hash name")}function at(e){if(e.algorithm.namedCurve==="P-256")return"ES256";throw new L("unsupported EcKeyAlgorithm namedCurve")}function ct(e){switch(e.algorithm.name){case"RSA-PSS":return it(e);case"RSASSA-PKCS1-v1_5":return st(e);case"ECDSA":return at(e);case"Ed25519":return"Ed25519";default:throw new L("unsupported CryptoKey algorithm name")}}function Ie(e){return e instanceof CryptoKey}function lt(e){return Ie(e)&&e.type==="private"}function ut(e){return Ie(e)&&e.type==="public"}function ft(){return Math.floor(Date.now()/1e3)}async function ge(e,n,t,r,o,i){let a=e?.privateKey,c=e?.publicKey;if(!lt(a))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!ut(c))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(c.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof n!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(r!==void 0&&typeof r!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return nt({alg:ct(a),typ:"dpop+jwt",jwk:await dt(c)},Object.assign(Object.assign({},i),{iat:ft(),jti:crypto.randomUUID(),htm:t,nonce:r,htu:n,ath:o?ne(await crypto.subtle.digest("SHA-256",oe(o))):void 0}),a)}async function dt(e){let{kty:n,e:t,n:r,x:o,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:n,crv:a,e:t,n:r,x:o,y:i}}async function Ne(e,n){var t;let r;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":r={name:"RSA-PSS",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":r={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"};break;case"Ed25519":r={name:"Ed25519"};break;default:throw new L}return crypto.subtle.generateKey(r,(t=n?.extractable)!==null&&t!==void 0?t:!1,["sign","verify"])}function G(e){return w(e,{site:p(f),authorization_endpoint:p(f),token_endpoint:p(f),dpop_signing_alg_values_supported:s([])}),async(n,t)=>{let r=await Z(),o=await r.get(e.site);if(!o){let c=await Ne("ES256");o={domain:e.site,keyPair:c},await r.set(o)}let i=m.url(n.url);if(n.url.startsWith(e.authorization_endpoint)){let c=n.body;c instanceof URLSearchParams||c instanceof FormData?c.set("dpop_jkt",o.keyPair.publicKey):c.dpop_jkt=o.keyPair.publicKey}else if(n.url.startsWith(e.token_endpoint)){let c=await ge(o.keyPair,n.url,n.method);n=n.with({headers:{DPoP:c}})}else if(n.headers.has("Authorization")){let c=localStorage.getItem(i.host+":nonce")||void 0,h=n.headers.get("Authorization").split(" ")[1],g=await ge(o.keyPair,n.url,n.method,c,h);n=n.with({headers:{Authorization:"DPoP "+h,DPoP:g}})}let a=await t(n);return a.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",a.headers.get("DPoP-Nonce")),a}}var ht=Object.assign({},te,{oauth2mw:F,mockserver:he,discover:me,tokenstore:V,dpopmw:G,keysstore:Z,authorizePopup:Ke,popupHandleRedirect:De});globalThis.metro.oauth2||(globalThis.metro.oauth2=ht);var Q=(...e)=>(n,t)=>e.filter(r=>t.hasOwnKey(r)).length>0?!1:y("root data must have all of",t,e),D=(...e)=>n=>Array.isArray(n)&&e.filter(t=>!n.includes(t)).length==0?!1:y("data must be an array which includes",n,e);var R=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],ie=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function X(e={}){w(e,{client:s(I(m.client().constructor)),issuer:p(f)});let n={client:m.client().with(T()).with(A()),requireDynamicRegistration:!1};e=Object.assign({},n,e);let t=!1;function r(h){return t}let o={issuer:p(ce(e.issuer,r)),authorization_endpoint:p(f),token_endpoint:p(f),userinfo_endpoint:C(f),jwks_uri:p(f),registration_endpoint:e.requireDynamicRegistration?p(f):C(f),scopes_supported:C(D("openid")),response_types_supported:e.requireDynamicRegistration?p(D("code","id_token","id_token token")):p([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(D("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:p([]),id_token_signing_alg_values_supported:p(D("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(D("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(j(...ie)),token_endpoint_auth_signing_alg_values_supported:s(D("RS256"),B(D("none"))),display_values_supported:s(j("page","popup","touch","wap")),claim_types_supported:s(j("normal","aggregated","distributed")),claims_supported:C([]),service_documentation:s(f),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(f),op_tos_uri:s(f)},i=m.url(e.issuer,".well-known/openid-configuration"),c=(await e.client.get(i)).data;return w(c,o),w(c.issuer,e.issuer),c}async function Y(e){let n={redirect_uris:p([f]),response_types:s([]),grant_types:s(j("authorization_code","refresh_token")),application_type:s(b("native","web")),contacts:s([le]),client_name:s(String),logo_uri:s(f),client_uri:s(f),policy_uri:s(f),tos_uri:s(f),jwks_uri:s(f,B(Q("jwks"))),jwks:s(f,B(Q("jwks_uri"))),sector_identifier_uri:s(f),subject_type:s(String),id_token_signed_response_alg:s(b(...R)),id_token_encrypted_response_alg:s(b(...R)),id_token_encrypted_response_enc:s(b(...R),Q("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(b(...R)),userinfo_encrypted_response_alg:s(b(...R)),userinfo_encrypted_response_enc:s(b(...R),Q("userinfo_encrypted_response_alg")),request_object_signing_alg:s(b(...R)),request_object_encryption_alg:s(b(...R)),request_object_encryption_enc:s(b(...R)),token_endpoint_auth_method:s(b(...ie)),token_endpoint_auth_signing_alg:s(b(...R)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([f]),request_uris:s([f])};w(e,{client:s(I(m.client().constructor)),registration_endpoint:f,client_info:n});let t={client:m.client().with(T()).with(A()),client_info:{redirect_uris:[globalThis.document?.location.href]}};e=Object.assign({},t,e),e.client_info||(e.client_info={}),e.client_info.redirect_uris||(e.client_info.redirect_uris=[globalThis.document?.location.href]);let r=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=r.data;if(!o.client_id||!o.client_secret)throw m.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",r);return e.client_info=Object.assign(e.client_info,o),e.client_info}function se(e){let n;if(typeof localStorage<"u")n={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,r)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(r)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;n={get:r=>JSON.parse(t.get("metro/oidc:"+e+":"+r)||null),set:(r,o)=>t.set("metro/oidc:"+e+":"+r,JSON.stringify(o)),has:r=>t.has("metro/oidc:"+e+":"+r)}}return n}function we(e={}){let n={client:z(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},n,e),w(e,{client:p(I(z().constructor)),client_info:p(),issuer:p(f),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=se(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info?.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,r)=>{let o;if(!e.force_authorization){try{o=await r(t)}catch(g){if(o.status!=401&&o.status!=403)throw g}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await X({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(!e.openid_configuration.registration_endpoint)throw S("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await Y({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",a=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info?.client_id,client_secret:e.client_info?.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),c=async(g,l)=>{let d=await l(g);if(d.headers.get("content-type")?.startsWith("application/json")){let _=d.data?.id_token;if(!_){let x=d.clone();try{let P=await x.json();P&&P.id_token&&(_=P.id_token)}catch{}}_&&e.store.set("id_token",_)}return d},h=e.client.with(e.issuer).with(c);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};h=h.with(G(g)),a.client=h}return h=h.with(F(a)),o=await h.fetch(t),o}}function Me(){return pe()}function Je(e){if(!e.store){if(!e.issuer)throw S("Must supply options.issuer or options.store to get the id_token");e.store=se(e.issuer)}return e.store.get("id_token")}var Be={oidcmw:we,discover:X,register:Y,isRedirected:Me,idToken:Je};globalThis.metro.oidc||(globalThis.metro.oidc=Be);var Or=Be;})();
 //# sourceMappingURL=browser.min.js.map