@muze-nl/metro-oidc 0.6.0 → 0.8.0

package/dist/browser.js

@@ -5,19 +5,19 @@
       __defProp(target, name, { get: all[name], enumerable: true });
   };
 
-  // node_modules/@muze-nl/metro/src/metro.mjs
-  var metro_exports = {};
-  __export(metro_exports, {
+  // ../metro-core/src/index.mjs
+  var src_exports = {};
+  __export(src_exports, {
     Client: () => Client,
     client: () => client,
     deepClone: () => deepClone,
-    formdata: () => formdata,
     metroError: () => metroError,
     request: () => request,
     response: () => response,
-    trace: () => trace,
     url: () => url
   });
+
+  // ../metro-core/src/metro.mjs
   var metroURL = "https://metro.muze.nl/details/";
   if (!Symbol.metroProxy) {
     Symbol.metroProxy = /* @__PURE__ */ Symbol("isProxy");
@@ -65,11 +65,14 @@
       }
       for (const verb of this.clientOptions.verbs) {
         this[verb] = async function(...options2) {
-          return this.fetch(request(
-            this.clientOptions,
-            ...options2,
-            { method: verb.toUpperCase() }
-          ));
+          return this.fetch(
+            request(
+              this.clientOptions,
+              ...options2,
+              { method: verb.toUpperCase() }
+            ),
+            fetchOptionsFrom(...options2)
+          );
         };
       }
     }
@@ -113,23 +116,22 @@
       };
       let middlewares = [metrofetch].concat(this.clientOptions?.middlewares?.slice() || []);
       options = Object.assign({}, this.clientOptions, options);
+      const traceContext = createTraceContext(req, options);
+      const middlewareContext = createMiddlewareContext(this, options, traceContext);
       let next;
       for (let middleware of middlewares) {
         next = /* @__PURE__ */ (function(next2, middleware2) {
           return async function(req2) {
             let res;
-            let tracers = Object.values(_Client.tracers);
-            for (let tracer of tracers) {
-              if (tracer.request) {
-                tracer.request.call(tracer, req2, middleware2);
-              }
-            }
-            res = await middleware2(req2, next2);
-            for (let tracer of tracers) {
-              if (tracer.response) {
-                tracer.response.call(tracer, res, middleware2);
-              }
+            let tracers = traceContext.tracers;
+            callTracers(tracers, "request", req2, middleware2, traceContext);
+            try {
+              res = await middleware2(req2, next2, middlewareContext);
+            } catch (error2) {
+              callTracers(tracers, "error", error2, req2, middleware2, traceContext);
+              throw error2;
             }
+            callTracers(tracers, "response", res, middleware2, traceContext);
             return res;
           };
         })(next, middleware);
@@ -143,6 +145,146 @@
       return this.clientOptions.url;
     }
   };
+  var traceContextId = 0;
+  var TRACE_OPTION_KEYS = ["trace", "tracer", "tracers"];
+  function fetchOptionsFrom(...options) {
+    const result = {};
+    for (const option of options) {
+      if (!isPlainObject(option)) {
+        continue;
+      }
+      for (const key of TRACE_OPTION_KEYS) {
+        if (key in option) {
+          result[key] = option[key];
+        }
+      }
+    }
+    return result;
+  }
+  function createTraceContext(req, options = {}) {
+    const parent = traceParentFrom(options.trace || options.tracer || options.tracers);
+    let localTracers = [];
+    if (parent) {
+      localTracers = parent.localTracers || [];
+    } else {
+      localTracers = normalizeTracers(options.trace).concat(normalizeTracers(options.tracer)).concat(normalizeTracers(options.tracers));
+    }
+    const globalTracers = Object.values(Client.tracers || {});
+    const context = {
+      __metroTraceContext: true,
+      id: "metro-trace-context-" + ++traceContextId,
+      parent,
+      request: req,
+      options,
+      globalTracers,
+      localTracers,
+      tracers: globalTracers.concat(localTracers)
+    };
+    return context;
+  }
+  function traceParentFrom(value) {
+    if (!value) {
+      return null;
+    }
+    if (value.context?.__metroTraceContext) {
+      return value.context;
+    }
+    if (value.__metroTraceContext) {
+      return value;
+    }
+    return null;
+  }
+  function normalizeTracers(value) {
+    if (!value || value.__metroTraceContext || value.context?.__metroTraceContext) {
+      return [];
+    }
+    if (Array.isArray(value)) {
+      return value.flatMap(normalizeTracers);
+    }
+    if (isTracer(value)) {
+      return [value];
+    }
+    if (isPlainObject(value)) {
+      return Object.values(value).flatMap(normalizeTracers);
+    }
+    return [];
+  }
+  function isTracer(value) {
+    return value && typeof value == "object" && [
+      "request",
+      "response",
+      "error",
+      "event",
+      "diagnostic",
+      "span",
+      "link",
+      "current"
+    ].some((name) => typeof value[name] == "function");
+  }
+  function createMiddlewareContext(client2, options, traceContext) {
+    const trace = createTraceAPI(traceContext);
+    return Object.freeze({
+      client: client2,
+      options,
+      trace,
+      fetch(req, fetchOptions = {}) {
+        return client2.fetch(req, Object.assign({}, fetchOptions, { trace }));
+      }
+    });
+  }
+  function createTraceAPI(context) {
+    const api = {
+      __metroTraceContext: true,
+      context,
+      event(name, data = {}) {
+        callTracers(context.tracers, "event", name, data, context);
+      },
+      diagnostic(diagnostic = {}) {
+        callTracers(context.tracers, "diagnostic", diagnostic, context);
+      },
+      current() {
+        for (const tracer of context.tracers) {
+          if (typeof tracer.current == "function") {
+            const current = tracer.current(context);
+            if (current) {
+              return current;
+            }
+          }
+        }
+        return { traceId: null, spanId: null };
+      },
+      async span(name, fn, data = {}) {
+        const tracer = context.tracers.find((tracer2) => typeof tracer2.span == "function");
+        if (!tracer) {
+          return fn();
+        }
+        return tracer.span(name, fn, data, context);
+      },
+      link(key) {
+        let traceId = null;
+        for (const tracer of context.tracers) {
+          if (typeof tracer.link == "function") {
+            traceId = tracer.link(key, void 0, context) || traceId;
+          }
+        }
+        return traceId;
+      },
+      options(extra = {}) {
+        return Object.assign({}, extra, { trace: api });
+      }
+    };
+    return api;
+  }
+  function callTracers(tracers, method, ...args) {
+    for (const tracer of tracers) {
+      if (tracer && typeof tracer[method] == "function") {
+        tracer[method].call(tracer, ...args);
+      }
+    }
+  }
+  function isPlainObject(value) {
+    return value && typeof value == "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+  }
   function client(...options) {
     return new Client(...deepClone(options));
   }
@@ -215,7 +357,7 @@
     let r = new Request(requestParams.url, requestParams);
     let data = requestParams.body;
     if (data) {
-      if (typeof data == "object" && !(data instanceof String) && !(data instanceof ReadableStream) && !(data instanceof Blob) && !(data instanceof ArrayBuffer) && !(data instanceof DataView) && !(data instanceof FormData) && !(data instanceof URLSearchParams) && (typeof globalThis.TypedArray == "undefined" || !(data instanceof globalThis.TypedArray))) {
+      if (typeof data == "object" && !(data instanceof String) && !(data instanceof ReadableStream) && !(data instanceof Blob) && !(data instanceof ArrayBuffer) && !(data instanceof DataView) && !(data instanceof FormData) && !(data instanceof URLSearchParams) && (globalThis.ArrayBuffer && ArrayBuffer.isView(data))) {
         if (typeof data.toString == "function") {
           requestParams.body = data.toString({ headers: r.headers });
           r = new Request(requestParams.url, requestParams);
@@ -235,7 +377,7 @@
             break;
           case "with":
             result = function(...options2) {
-              if (data) {
+              if (typeof data !== "undefined") {
                 options2.unshift({ body: data });
               }
               return request(target, ...options2);
@@ -247,8 +389,16 @@
           default:
             if (target[prop] instanceof Function) {
               if (prop === "clone") {
+                result = function() {
+                  const cloned = target.clone();
+                  if (typeof data != "undefined" && !(typeof ReadableStream != "undefined" && data instanceof ReadableStream)) {
+                    return request(cloned, { body: data });
+                  }
+                  return request(cloned);
+                };
+              } else {
+                result = target[prop].bind(target);
               }
-              result = target[prop].bind(target);
             } else {
               result = target[prop];
             }
@@ -329,7 +479,7 @@
             result = data;
             break;
           case "ok":
-            result = target.status >= 200 && target.status < 400;
+            result = target.status >= 200 && target.status < 300;
             break;
           default:
             if (typeof target[prop] == "function") {
@@ -353,9 +503,19 @@
       });
     }
   }
+  function appendHashParams(value, params) {
+    const target = value[Symbol.metroSource] || value;
+    if (!(params instanceof URLSearchParams)) {
+      params = new URLSearchParams(params);
+    }
+    let hash = target.hash || "#";
+    hash += "?" + params;
+    return url(target, { hash });
+  }
   function url(...options) {
     let validParams = [
       "hash",
+      "fragment",
       "host",
       "hostname",
       "href",
@@ -365,9 +525,11 @@
       "protocol",
       "username",
       "search",
-      "searchParams"
+      "searchParams",
+      "hashParams"
     ];
     let u = new URL("https://localhost/");
+    let hParams = null;
     for (let option of options) {
       if (typeof option == "string" || option instanceof String) {
         u = new URL(option, u);
@@ -392,6 +554,16 @@
               if (!validParams.includes(param)) {
                 throw metroError("metro.url: unknown url parameter " + metroURL + "url/unknown-param-name/", param);
               }
+              if (param == "fragment") {
+                let fragment = option.fragment;
+                if (fragment && typeof fragment == "string" && fragment[0] != "#") {
+                  fragment = "#" + fragment;
+                }
+                option.hash = fragment;
+                param = "hash";
+              } else if (param == "hashParams") {
+                hParams = option.hashParams;
+              }
               if (typeof option[param] == "function") {
                 option[param](u[param], u);
               } else if (typeof option[param] == "string" || option[param] instanceof String || typeof option[param] == "number" || option[param] instanceof Number || typeof option[param] == "boolean" || option[param] instanceof Boolean) {
@@ -408,6 +580,16 @@
         throw metroError("metro.url: unsupported option value " + metroURL + "url/unsupported-option-value/", option);
       }
     }
+    if (hParams) {
+      if (!u.hash) {
+        u.hash = "#";
+      }
+      if (typeof hParams == "string") {
+        u.hash += hParams;
+      } else {
+        u = appendHashParams(u, hParams);
+      }
+    }
     Object.freeze(u);
     return new Proxy(u, {
       get(target, prop) {
@@ -428,7 +610,7 @@
             result = target.pathname.split("/").pop();
             break;
           case "folderpath":
-            result = target.pathname.substring(0, target.pathname.lastIndexOf("\\") + 1);
+            result = target.pathname.substring(0, target.pathname.lastIndexOf("/") + 1);
             break;
           case "authority":
             result = target.username ?? "";
@@ -439,11 +621,6 @@
             result += "/";
             result = target.protocol + "//" + result;
             break;
-          case "origin":
-            result = target.protocol + "//" + target.hostname;
-            result += target.port ? ":" + target.port : "";
-            result += "/";
-            break;
           case "fragment":
             result = target.hash.substring(1);
             break;
@@ -466,67 +643,12 @@
       }
     });
   }
-  function formdata(...options) {
-    var params = new FormData();
-    for (let option of options) {
-      if (option instanceof HTMLFormElement) {
-        option = new FormData(option);
-      }
-      if (option instanceof FormData) {
-        for (let entry of option.entries()) {
-          params.append(entry[0], entry[1]);
-        }
-      } else if (option && typeof option == "object") {
-        for (let entry of Object.entries(option)) {
-          if (Array.isArray(entry[1])) {
-            for (let value of entry[1]) {
-              params.append(entry[0], value);
-            }
-          } else {
-            params.append(entry[0], entry[1]);
-          }
-        }
-      } else {
-        throw new metroError("metro.formdata: unknown option type " + metroURL + "formdata/unknown-option-value/", option);
-      }
-    }
-    Object.freeze(params);
-    return new Proxy(params, {
-      get(target, prop) {
-        let result;
-        switch (prop) {
-          case Symbol.metroProxy:
-            result = true;
-            break;
-          case Symbol.metroSource:
-            result = target;
-            break;
-          //TODO: add toString() that can check
-          //headers param: toString({headers:request.headers})
-          //for the content-type
-          case "with":
-            result = function(...options2) {
-              return formdata(target, ...options2);
-            };
-            break;
-          default:
-            if (target[prop] instanceof Function) {
-              result = target[prop].bind(target);
-            } else {
-              result = target[prop];
-            }
-            break;
-        }
-        return result;
-      }
-    });
-  }
   var metroConsole = {
-    error: (message, ...details) => {
-      console.error("\u24C2\uFE0F  ", message, ...details);
+    error: (message2, ...details) => {
+      console.error("\u24C2\uFE0F  ", message2, ...details);
     },
-    info: (message, ...details) => {
-      console.info("\u24C2\uFE0F  ", message, ...details);
+    info: (message2, ...details) => {
+      console.info("\u24C2\uFE0F  ", message2, ...details);
     },
     group: (name) => {
       console.group("\u24C2\uFE0F  " + name);
@@ -535,59 +657,16 @@
       console.groupEnd("\u24C2\uFE0F  " + name);
     }
   };
-  function metroError(message, ...details) {
-    metroConsole.error(message, ...details);
-    return new Error(message, ...details);
+  function metroError(message2, ...details) {
+    metroConsole.error(message2, ...details);
+    return new Error(message2, ...details);
   }
-  var trace = {
-    /**
-     * Adds a named tracer function
-     * @param {string} name - the name of the tracer
-     * @param {Function} tracer - the tracer function to call
-     */
-    add(name, tracer) {
-      Client.tracers[name] = tracer;
-    },
-    /**
-     * Removes a named tracer function
-     * @param {string} name
-     */
-    delete(name) {
-      delete Client.tracers[name];
-    },
-    /**
-     * Removes all tracer functions
-     */
-    clear() {
-      Client.tracers = {};
-    },
-    /**
-     * Returns a set of request and response tracer functions that use the
-     * console.group feature to shows nested request/response pairs, with
-     * most commonly needed information for debugging
-     */
-    group() {
-      let group = 0;
-      return {
-        request: (req, middleware) => {
-          group++;
-          metroConsole.group(group);
-          metroConsole.info(req?.url, req, middleware);
-        },
-        response: (res, middleware) => {
-          metroConsole.info(res?.body ? res.body[Symbol.metroSource] : null, res, middleware);
-          metroConsole.groupEnd(group);
-          group--;
-        }
-      };
-    }
-  };
   function deepClone(object) {
     if (Array.isArray(object)) {
       return object.slice().map(deepClone);
     }
     if (object && typeof object === "object") {
-      if (object.__proto__.constructor == Object || !object.__proto__) {
+      if (object.__proto__?.constructor == Object || !object.__proto__) {
         let result = Object.assign({}, object);
         Object.keys(result).forEach((key) => {
           result[key] = deepClone(object[key]);
@@ -600,158 +679,7 @@
     return object;
   }
 
-  // node_modules/@muze-nl/metro/src/mw/json.mjs
-  function jsonmw(options) {
-    options = Object.assign({
-      contentType: "application/json",
-      reviver: null,
-      replacer: null,
-      space: ""
-    }, options);
-    return async function json(req, next) {
-      if (!req.headers.get("Accept")) {
-        req = req.with({
-          headers: {
-            "Accept": options.accept ?? options.contentType
-          }
-        });
-      }
-      if (req.method !== "GET" && req.method !== "HEAD") {
-        if (req.data && typeof req.data == "object" && !(req.data instanceof ReadableStream)) {
-          const contentType = req.headers.get("Content-Type");
-          if (!contentType || isPlainText(contentType)) {
-            req = req.with({
-              headers: {
-                "Content-Type": options.contentType
-              }
-            });
-          }
-          if (isJSON(req.headers.get("Content-Type"))) {
-            req = req.with({
-              body: JSON.stringify(req.data, options.replacer, options.space)
-            });
-          }
-        }
-      }
-      let res = await next(req);
-      if (res && isJSON(res.headers?.get("Content-Type"))) {
-        let tempRes = res.clone();
-        let body = await tempRes.text();
-        try {
-          let json2 = JSON.parse(body, options.reviver);
-          return res.with({
-            body: json2
-          });
-        } catch (e) {
-        }
-      }
-      return res;
-    };
-  }
-  var jsonRE = /^application\/([a-zA-Z0-9\-_]+\+)?json\b/;
-  function isJSON(contentType) {
-    return jsonRE.exec(contentType);
-  }
-  function isPlainText(contentType) {
-    return /^text\/plain\b/.exec(contentType);
-  }
-
-  // node_modules/@muze-nl/metro/src/mw/thrower.mjs
-  function throwermw(options) {
-    return async function thrower(req, next) {
-      let res = await next(req);
-      if (!res.ok) {
-        if (options && typeof options[res.status] == "function") {
-          res = options[res.status].apply(res, req);
-        } else {
-          throw new Error(res.status + ": " + res.statusText, {
-            cause: res
-          });
-        }
-      }
-      return res;
-    };
-  }
-
-  // node_modules/@muze-nl/metro/src/mw/getdata.mjs
-  function getdatamw() {
-    return async function getdata(req, next) {
-      let res = await next(req);
-      if (res.ok && res.data) {
-        return res.data;
-      }
-      return res;
-    };
-  }
-
-  // node_modules/@muze-nl/metro/src/api.mjs
-  var API = class extends Client {
-    constructor(base, methods, bind = null) {
-      if (base instanceof Client) {
-        super(base.clientOptions, throwermw(), getdatamw());
-      } else {
-        super(base, throwermw(), getdatamw());
-      }
-      if (!bind) {
-        bind = this;
-      }
-      for (const methodName in methods) {
-        if (typeof methods[methodName] == "function") {
-          this[methodName] = methods[methodName].bind(bind);
-        } else if (methods[methodName] && typeof methods[methodName] == "object") {
-          this[methodName] = new this.constructor(base, methods[methodName], bind);
-        } else {
-          this[methodName] = methods[methodName];
-        }
-      }
-    }
-  };
-  var JsonAPI = class extends API {
-    constructor(base, methods, bind = null) {
-      if (base instanceof Client) {
-        super(base.with(jsonmw()), methods, bind);
-      } else {
-        super(client(base, jsonmw()), methods, bind);
-      }
-    }
-  };
-  function api(...options) {
-    return new API(...deepClone(options));
-  }
-  function jsonApi(...options) {
-    return new JsonAPI(...deepClone(options));
-  }
-
-  // node_modules/@muze-nl/metro/src/everything.mjs
-  var metro = Object.assign({}, metro_exports, {
-    mw: {
-      json: jsonmw,
-      thrower: throwermw,
-      getdata: getdatamw
-    },
-    api,
-    jsonApi
-  });
-  if (!globalThis.metro) {
-    globalThis.metro = metro;
-  }
-  var everything_default = metro;
-
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mjs
-  var oauth2_exports = {};
-  __export(oauth2_exports, {
-    base64url_encode: () => base64url_encode,
-    createState: () => createState,
-    default: () => oauth2mw,
-    generateCodeChallenge: () => generateCodeChallenge,
-    generateCodeVerifier: () => generateCodeVerifier,
-    getExpires: () => getExpires,
-    isAuthorized: () => isAuthorized,
-    isExpired: () => isExpired,
-    isRedirected: () => isRedirected
-  });
-
-  // node_modules/@muze-nl/assert/src/assert.mjs
+  // ../../node_modules/@muze-nl/assert/src/assert.mjs
   globalThis.assertEnabled = false;
   function enable() {
     globalThis.assertEnabled = true;
@@ -957,10 +885,10 @@
     }
     return false;
   }
-  function error(message, found, expected, path, problems) {
+  function error(message2, found, expected, path, problems) {
     let result = {
       path,
-      message,
+      message: message2,
       found,
       expected
     };
@@ -969,8 +897,8 @@
     }
     return result;
   }
-  function warn(message, data, pattern, path) {
-    console.warn("\u{1F170}\uFE0F  Assert: " + path, message, pattern, data);
+  function warn(message2, data, pattern, path) {
+    console.warn("\u{1F170}\uFE0F  Assert: " + path, message2, pattern, data);
   }
   globalThis.assert = {
     warn,
@@ -991,7 +919,7 @@
     fails
   };
 
-  // node_modules/@muze-nl/metro-oauth2/src/tokenstore.mjs
+  // ../metro-oauth2/src/tokenstore.mjs
   function tokenStore(site) {
     let localState, localTokens;
     if (typeof localStorage !== "undefined") {
@@ -999,7 +927,7 @@
         get: () => localStorage.getItem("metro/state:" + site),
         set: (value) => localStorage.setItem("metro/state:" + site, value),
         has: () => localStorage.getItem("metro/state:" + site) !== null,
-        delete: () => localStorage.remoteItem("metro/state:" + site)
+        delete: () => localStorage.removeItem("metro/state:" + site)
       };
       localTokens = {
         get: (name) => JSON.parse(localStorage.getItem(site + ":" + name)),
@@ -1023,7 +951,16 @@
     };
   }
 
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mjs
+  // ../metro-oauth2/src/oauth2.mjs
+  var SUPPORTED_TOKEN_TYPES = /* @__PURE__ */ new Map([
+    ["bearer", "Bearer"],
+    ["dpop", "DPoP"]
+  ]);
+  var SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS = /* @__PURE__ */ new Set([
+    "none",
+    "client_secret_post",
+    "client_secret_basic"
+  ]);
   function oauth2mw(options) {
     const defaultOptions = {
       client: client(),
@@ -1044,9 +981,9 @@
       }
     };
     assert(options, {});
-    const oauth22 = Object.assign({}, defaultOptions.oauth2_configuration, options?.oauth2_configuration);
+    const oauth2 = Object.assign({}, defaultOptions.oauth2_configuration, options?.oauth2_configuration);
     options = Object.assign({}, defaultOptions, options);
-    options.oauth2_configuration = oauth22;
+    options.oauth2_configuration = oauth2;
     const store = tokenStore(options.site);
     if (!options.tokens) {
       options.tokens = store.tokens;
@@ -1063,12 +1000,12 @@
         redirect_uri: Required(validURL)
       }
     });
-    for (let option in oauth22) {
+    for (let option in oauth2) {
       switch (option) {
         case "access_token":
         case "authorization_code":
         case "refresh_token":
-          options.tokens.set(option, oauth22[option]);
+          options.tokens.set(option, normalizeInitialToken(option, oauth2[option]));
           break;
       }
     }
@@ -1076,32 +1013,11 @@
       if (options.force_authorization) {
         return oauth2authorized(req, next);
       }
-      let res;
-      try {
-        res = await next(req);
-        if (res.ok) {
-          return res;
-        }
-      } catch (err) {
-        switch (res?.status) {
-          case 400:
-          // Oauth2.1 RFC 3.2.4
-          case 401:
-            return oauth2authorized(req, next);
-            break;
-        }
-        throw err;
-      }
-      if (!res.ok) {
-        switch (res.status) {
-          case 400:
-          // Oauth2.1 RFC 3.2.4
-          case 401:
-            return oauth2authorized(req, next);
-            break;
-        }
+      const res = await next(req);
+      if (res.ok || !shouldAuthorizeResponse(res)) {
+        return res;
       }
-      return res;
+      return oauth2authorized(req, next);
     };
     async function oauth2authorized(req, next) {
       getTokensFromLocation();
@@ -1109,23 +1025,15 @@
       const refreshToken = options.tokens.get("refresh_token");
       const tokenIsExpired = isExpired(accessToken);
       if (!accessToken || tokenIsExpired && !refreshToken) {
-        try {
-          let token = await fetchAccessToken();
-          if (!token) {
-            return response("false");
-          }
-        } catch (e) {
-          throw e;
+        const token = await fetchAccessToken();
+        if (!token) {
+          return response("false");
         }
         return oauth2authorized(req, next);
       } else if (tokenIsExpired && refreshToken) {
-        try {
-          let token = await refreshAccessToken();
-          if (!token) {
-            return response("false");
-          }
-        } catch (e) {
-          throw e;
+        const token = await refreshAccessToken();
+        if (!token) {
+          return response("false");
         }
         return oauth2authorized(req, next);
       } else {
@@ -1141,7 +1049,7 @@
       if (typeof window !== "undefined" && window?.location) {
         let url2 = url(window.location);
         let code, state, params;
-        if (url2.searchParams.has("code")) {
+        if (url2.searchParams.has("code") || url2.searchParams.has("error")) {
           params = url2.searchParams;
           url2 = url2.with({ search: "" });
           history.pushState({}, "", url2.href);
@@ -1152,12 +1060,12 @@
           history.pushState({}, "", url2.href);
         }
         if (params) {
+          if (params.has("error")) {
+            throw metroError("oauth2mw: authorization failed: " + params.get("error") + (params.get("error_description") ? " (" + params.get("error_description") + ")" : ""));
+          }
           code = params.get("code");
           state = params.get("state");
-          let storedState = options.state.get("metro/state");
-          if (!state || state !== storedState) {
-            return;
-          }
+          validateState(state);
           if (code) {
             options.tokens.set("authorization_code", code);
           }
@@ -1165,14 +1073,14 @@
       }
     }
     async function fetchAccessToken() {
-      if (oauth22.grant_type === "authorization_code" && !options.tokens.has("authorization_code")) {
+      if (oauth2.grant_type === "authorization_code" && !options.tokens.has("authorization_code")) {
         let authReqURL = await getAuthorizationCodeURL();
         if (!options.authorize_callback || typeof options.authorize_callback !== "function") {
           throw metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");
         }
-        let token = await options.authorize_callback(authReqURL);
-        if (token) {
-          options.tokens.set("authorization_code", token);
+        let authorization = await options.authorize_callback(authReqURL);
+        if (authorization) {
+          storeAuthorizationResult(authorization);
         } else {
           return false;
         }
@@ -1184,18 +1092,7 @@
         throw metroError("OAuth2mw: fetch access_token: " + response2.status + ": " + response2.statusText + " (" + msg + ")", { cause: tokenReq });
       }
       let data = await response2.json();
-      options.tokens.set("access_token", {
-        value: data.access_token,
-        expires: getExpires(data.expires_in),
-        type: data.token_type,
-        scope: data.scope
-      });
-      if (data.refresh_token) {
-        let token = {
-          value: data.refresh_token
-        };
-        options.tokens.set("refresh_token", token);
-      }
+      storeTokenResponse(data);
       options.tokens.delete("authorization_code");
       return data;
     }
@@ -1203,88 +1100,72 @@
       let refreshTokenReq = getAccessTokenRequest("refresh_token");
       let response2 = await options.client.post(refreshTokenReq);
       if (!response2.ok) {
-        throw metroError("OAuth2mw: refresh access_token: " + response2.status + ": " + response2.statusText, { cause: refreshTokenReq });
+        let msg = await response2.text();
+        throw metroError("OAuth2mw: refresh access_token: " + response2.status + ": " + response2.statusText + " (" + msg + ")", { cause: refreshTokenReq });
       }
       let data = await response2.json();
-      options.tokens.set("access_token", {
-        value: data.access_token,
-        expires: getExpires(data.expires_in),
-        type: data.token_type,
-        scope: data.scope
-      });
-      if (data.refresh_token) {
-        let token = {
-          value: data.refresh_token
-        };
-        options.tokens.set("refresh_token", token);
-      } else {
-        return false;
-      }
+      storeTokenResponse(data);
       return data;
     }
     async function getAuthorizationCodeURL() {
-      if (!oauth22.authorization_endpoint) {
+      if (!oauth2.authorization_endpoint) {
         throw metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");
       }
-      let url2 = url(oauth22.authorization_endpoint, { hash: "" });
-      assert(oauth22, {
+      let url2 = url(oauth2.authorization_endpoint, { hash: "" });
+      assert(oauth2, {
         client_id: /.+/,
         redirect_uri: /.+/,
         scope: /.*/
       });
       let search = {
         response_type: "code",
-        // implicit flow uses 'token' here, but is not considered safe, so not supported
-        client_id: oauth22.client_id,
-        redirect_uri: oauth22.redirect_uri,
-        state: oauth22.state || createState(40)
-        // OAuth2.1 RFC says optional, but its a good idea to always add/check it
+        client_id: oauth2.client_id,
+        redirect_uri: oauth2.redirect_uri,
+        state: oauth2.state || createState(40)
       };
-      if (oauth22.response_type) {
-        search.response_type = oauth22.response_type;
+      if (oauth2.response_type) {
+        search.response_type = oauth2.response_type;
       }
-      if (oauth22.response_mode) {
-        search.response_mode = oauth22.response_mode;
+      if (oauth2.response_mode) {
+        search.response_mode = oauth2.response_mode;
       }
       options.state.set(search.state);
-      if (oauth22.client_secret) {
-        search.client_secret = oauth22.client_secret;
-      }
-      if (oauth22.code_verifier) {
-        options.tokens.set("code_verifier", oauth22.code_verifier);
-        search.code_challenge = await generateCodeChallenge(oauth22.code_verifier);
+      if (oauth2.code_verifier) {
+        options.tokens.set("code_verifier", oauth2.code_verifier);
+        search.code_challenge = await generateCodeChallenge(oauth2.code_verifier);
         search.code_challenge_method = "S256";
       }
-      if (oauth22.scope) {
-        search.scope = oauth22.scope;
+      if (oauth2.scope) {
+        search.scope = oauth2.scope;
+      }
+      if (oauth2.prompt) {
+        search.prompt = oauth2.prompt;
       }
-      if (oauth22.prompt) {
-        search.prompt = oauth22.prompt;
+      if (oauth2.nonce) {
+        search.nonce = oauth2.nonce;
       }
       return url(url2, { search });
     }
     function getAccessTokenRequest(grant_type = null) {
-      assert(oauth22, {
+      assert(oauth2, {
         client_id: /.+/,
         redirect_uri: /.+/
       });
-      if (!oauth22.token_endpoint) {
+      if (!oauth2.token_endpoint) {
         throw metroError("oauth2mw: Missing options.endpoints.token url");
       }
-      let url2 = url(oauth22.token_endpoint, { hash: "" });
+      let url2 = url(oauth2.token_endpoint, { hash: "" });
       let params = {
-        grant_type: grant_type || oauth22.grant_type,
-        client_id: oauth22.client_id
+        grant_type: grant_type || oauth2.grant_type
       };
-      if (oauth22.client_secret) {
-        params.client_secret = oauth22.client_secret;
-      }
-      if (oauth22.scope) {
-        params.scope = oauth22.scope;
+      let headers = {};
+      applyTokenEndpointAuthentication(params, headers);
+      if (oauth2.scope) {
+        params.scope = oauth2.scope;
       }
       switch (params.grant_type) {
         case "authorization_code":
-          params.redirect_uri = oauth22.redirect_uri;
+          params.redirect_uri = oauth2.redirect_uri;
           params.code = options.tokens.get("authorization_code");
           const code_verifier = options.tokens.get("code_verifier");
           if (code_verifier) {
@@ -1294,24 +1175,146 @@
         case "client_credentials":
           break;
         case "refresh_token":
-          params.refresh_token = options.tokens.get("refresh_token");
+          params.refresh_token = tokenValue(options.tokens.get("refresh_token"));
           break;
         default:
-          throw new Error("Unknown grant_type: ".oauth2.grant_type);
+          throw new Error("Unknown grant_type: " + params.grant_type);
           break;
       }
-      return request(url2, { method: "POST", body: new URLSearchParams(params) });
+      return request(url2, { method: "POST", headers, body: new URLSearchParams(params) });
     }
-  }
-  function isExpired(token) {
-    if (!token) {
-      return true;
+    function applyTokenEndpointAuthentication(params, headers) {
+      const method = tokenEndpointAuthMethod(oauth2);
+      if (method === "none") {
+        params.client_id = oauth2.client_id;
+        return;
+      }
+      if (!oauth2.client_secret) {
+        throw metroError("oauth2mw: token_endpoint_auth_method " + method + " requires oauth2_configuration.client_secret");
+      }
+      if (method === "client_secret_post") {
+        params.client_id = oauth2.client_id;
+        params.client_secret = oauth2.client_secret;
+        return;
+      }
+      if (method === "client_secret_basic") {
+        headers.Authorization = basicAuth(oauth2.client_id, oauth2.client_secret);
+        return;
+      }
     }
-    let expires = new Date(token.expires);
-    let now = /* @__PURE__ */ new Date();
-    return now.getTime() > expires.getTime();
-  }
-  function getExpires(duration) {
+    function storeAuthorizationResult(authorization) {
+      let code = authorization;
+      if (authorization && typeof authorization === "object") {
+        if (authorization.error) {
+          throw metroError("oauth2mw: authorization failed: " + authorization.error);
+        }
+        validateState(authorization.state);
+        code = authorization.authorization_code || authorization.code;
+      }
+      if (!code) {
+        throw metroError("oauth2mw: authorization callback did not return an authorization code");
+      }
+      options.tokens.set("authorization_code", code);
+    }
+    function validateState(state) {
+      let storedState = options.state.get();
+      if (!state || state !== storedState) {
+        throw metroError("oauth2mw: authorization state mismatch");
+      }
+    }
+    function storeTokenResponse(data) {
+      const token = validateTokenResponse(data);
+      options.tokens.set("access_token", token);
+      if (data.refresh_token) {
+        options.tokens.set("refresh_token", { value: data.refresh_token });
+      }
+    }
+  }
+  function shouldAuthorizeResponse(res) {
+    if (!res) {
+      return false;
+    }
+    if (res.status === 400) {
+      return true;
+    }
+    const challenge = parseBearerChallenge(res.headers?.get("WWW-Authenticate"));
+    if (challenge?.error === "insufficient_scope") {
+      return false;
+    }
+    return res.status === 401;
+  }
+  function normalizeInitialToken(name, token) {
+    if (name === "access_token" && token && typeof token === "object") {
+      return token;
+    }
+    if (name === "access_token") {
+      return { value: token, type: "Bearer", expires: null };
+    }
+    if (name === "refresh_token" && token && typeof token === "object") {
+      return token;
+    }
+    return token;
+  }
+  function validateTokenResponse(data) {
+    if (!data || typeof data !== "object") {
+      throw metroError("OAuth2mw: token endpoint did not return a JSON object");
+    }
+    if (!data.access_token) {
+      throw metroError("OAuth2mw: token response did not include access_token");
+    }
+    if (!data.token_type) {
+      throw metroError("OAuth2mw: token response did not include token_type");
+    }
+    const tokenType = normalizeTokenType(data.token_type);
+    return {
+      value: data.access_token,
+      expires: data.expires_in === void 0 ? null : getExpires(data.expires_in),
+      type: tokenType,
+      scope: data.scope
+    };
+  }
+  function normalizeTokenType(type) {
+    const normalized = SUPPORTED_TOKEN_TYPES.get(String(type).toLowerCase());
+    if (!normalized) {
+      throw metroError("OAuth2mw: unsupported token_type " + type);
+    }
+    return normalized;
+  }
+  function tokenEndpointAuthMethod(oauth2) {
+    const method = oauth2.token_endpoint_auth_method || (oauth2.client_secret ? "client_secret_post" : "none");
+    if (!SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS.has(method)) {
+      throw metroError("oauth2mw: unsupported token_endpoint_auth_method " + method);
+    }
+    return method;
+  }
+  function basicAuth(clientId, clientSecret) {
+    const value = formEncode(clientId) + ":" + formEncode(clientSecret);
+    return "Basic " + base64_encode(value);
+  }
+  function formEncode(value) {
+    return encodeURIComponent(value).replace(/%20/g, "+");
+  }
+  function base64_encode(value) {
+    if (typeof btoa === "function") {
+      return btoa(value);
+    }
+    return Buffer.from(value, "binary").toString("base64");
+  }
+  function tokenValue(token) {
+    return token && typeof token === "object" ? token.value : token;
+  }
+  function isExpired(token) {
+    if (!token) {
+      return true;
+    }
+    if (!token.expires) {
+      return false;
+    }
+    let expires = new Date(token.expires);
+    let now = /* @__PURE__ */ new Date();
+    return now.getTime() > expires.getTime();
+  }
+  function getExpires(duration) {
     if (duration instanceof Date) {
       return new Date(duration.getTime());
     }
@@ -1328,8 +1331,8 @@
     return base64url_encode(code_verifier);
   }
   async function generateCodeChallenge(code_verifier) {
-    const encoder2 = new TextEncoder();
-    const data = encoder2.encode(code_verifier);
+    const encoder3 = new TextEncoder();
+    const data = encoder3.encode(code_verifier);
     const challenge = await globalThis.crypto.subtle.digest("SHA-256", data);
     return base64url_encode(challenge);
   }
@@ -1338,6 +1341,11 @@
     return btoa(byteString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
   }
   function createState(length) {
+    const bytes = new Uint8Array(Math.ceil(length * 3 / 4) + 1);
+    if (globalThis.crypto?.getRandomValues) {
+      globalThis.crypto.getRandomValues(bytes);
+      return base64url_encode(bytes).slice(0, length);
+    }
     const validChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
     let randomState = "";
     let counter = 0;
@@ -1361,330 +1369,31 @@
     }
     return true;
   }
-  function isAuthorized(tokens) {
-    if (typeof tokens == "string") {
-      tokens = tokenStore(tokens).tokens;
+  function parseBearerChallenge(value) {
+    if (!value || typeof value !== "string") {
+      return null;
     }
-    let accessToken = tokens.get("access_token");
-    if (accessToken && !isExpired(accessToken)) {
-      return true;
-    }
-    let refreshToken = tokens.get("refresh_token");
-    if (refreshToken) {
-      return true;
-    }
-    return false;
-  }
-
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.mockserver.mjs
-  var oauth2_mockserver_exports = {};
-  __export(oauth2_mockserver_exports, {
-    default: () => oauth2mockserver
-  });
-  var baseResponse = {
-    status: 200,
-    statusText: "OK",
-    headers: {
-      "Content-Type": "application/json"
-    }
-  };
-  var badRequest = (error3) => {
-    return {
-      status: 400,
-      statusText: "Bad Request",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        error: "invalid_request",
-        error_description: error3
-      })
-    };
-  };
-  var error2;
-  var pkce = {};
-  function oauth2mockserver(options = {}) {
-    const defaultOptions = {
-      "PKCE": false,
-      "DPoP": false
-    };
-    options = Object.assign({}, defaultOptions, options);
-    return async (req, next) => {
-      let url2 = everything_default.url(req.url);
-      switch (url2.pathname) {
-        case "/authorize/":
-          if (error2 = fails(url2.searchParams, {
-            response_type: "code",
-            client_id: "mockClientId",
-            state: Optional(/.*/)
-          })) {
-            return everything_default.response(badRequest(error2));
-          }
-          if (url2.searchParams.has("code_challenge")) {
-            if (!url2.searchParams.has("code_challenge_method")) {
-              return everything_default.response(badRequest("missing code_challenge_method"));
-            }
-            pkce.code_challenge = url2.searchParams.get("code_challenge");
-            pkce.code_challenge_method = url2.searchParams.get("code_challenge_method");
-          }
-          return everything_default.response(baseResponse, {
-            body: JSON.stringify({
-              code: "mockAuthorizeToken",
-              state: url2.searchParams.get("state")
-            })
-          });
-          break;
-        case "/token/":
-          if (req.data instanceof URLSearchParams) {
-            let body = {};
-            req.data.forEach((value, key) => body[key] = value);
-            req = req.with({ body });
-          }
-          if (error2 = fails(req, {
-            method: "POST",
-            data: {
-              grant_type: oneOf("refresh_token", "authorization_code")
-            }
-          })) {
-            return everything_default.response(badRequest(error2));
-          }
-          switch (req.data.grant_type) {
-            case "refresh_token":
-              if (error2 = fails(req.data, oneOf({
-                refresh_token: "mockRefreshToken",
-                client_id: "mockClientId",
-                client_secret: "mockClientSecret"
-              }, {
-                refresh_token: "mockRefreshToken",
-                client_id: "mockClientId",
-                code_verifier: /.+/
-              }))) {
-                return everything_default.response(badRequest(error2));
-              }
-              break;
-            case "access_token":
-              if (error2 = fails(req.data, oneOf({
-                client_id: "mockClientId",
-                client_secret: "mockClientSecret"
-              }, {
-                client_id: "mockClientId",
-                code_challenge: /.*/,
-                //FIXME: check that this matches code_verifier
-                code_challenge_method: "S256"
-              }))) {
-                return everything_default.response(badRequest(error2));
-              }
-              break;
-          }
-          return everything_default.response(baseResponse, {
-            body: JSON.stringify({
-              access_token: "mockAccessToken",
-              token_type: "mockExample",
-              expires_in: 3600,
-              refresh_token: "mockRefreshToken",
-              example_parameter: "mockExampleValue"
-            })
-          });
-          break;
-        case "/protected/":
-          let auth = req.headers.get("Authorization");
-          let [type, token] = auth ? auth.split(" ") : [];
-          if (!token || token !== "mockAccessToken") {
-            return everything_default.response({
-              status: 401,
-              statusText: "Forbidden",
-              body: "401 Forbidden"
-            });
-          }
-          return everything_default.response(baseResponse, {
-            body: JSON.stringify({
-              result: "Success"
-            })
-          });
-          break;
-        case "/public/":
-          return everything_default.response(baseResponse, {
-            body: JSON.stringify({
-              result: "Success"
-            })
-          });
-          break;
-        default:
-          return everything_default.response({
-            status: 404,
-            statusText: "not found",
-            body: "404 Not Found " + url2
-          });
-          break;
-      }
-    };
-  }
-
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.discovery.mjs
-  var oauth2_discovery_exports = {};
-  __export(oauth2_discovery_exports, {
-    default: () => makeClient
-  });
-  var validAlgorithms = [
-    "HS256",
-    "HS384",
-    "HS512",
-    "RS256",
-    "RS384",
-    "RS512",
-    "ES256",
-    "ES384",
-    "ES512"
-  ];
-  var validAuthMethods = [
-    "client_secret_post",
-    "client_secret_base",
-    "client_secret_jwt",
-    "private_key_jwt"
-  ];
-  var oauth_authorization_server_metadata = {
-    issuer: Required(validURL),
-    authorization_endpoint: Required(validURL),
-    token_endpoint: Required(validURL),
-    jwks_uri: Optional(validURL),
-    registration_endpoint: Optional(validURL),
-    scopes_supported: Recommended([]),
-    response_types_supported: Required(anyOf("code", "token")),
-    response_modes_supported: Optional([]),
-    grant_types_supported: Optional([]),
-    token_endpoint_auth_methods_supported: Optional([]),
-    token_endpoint_auth_signing_alg_values_supported: Optional([]),
-    service_documentation: Optional(validURL),
-    ui_locales_supported: Optional([]),
-    op_policy_uri: Optional(validURL),
-    op_tos_uri: Optional(validURL),
-    revocation_endpoint: Optional(validURL),
-    revocation_endpoint_auth_methods_supported: Optional(validAuthMethods),
-    revocation_endpoint_auth_signing_alg_values_supported: Optional(validAlgorithms),
-    introspection_endpoint: Optional(validURL),
-    introspection_endpoint_auth_methods_supported: Optional(validAuthMethods),
-    introspection_endpoint_auth_signing_alg_values_supported: Optional(validAlgorithms),
-    code_challendge_methods_supported: Optional([])
-  };
-  function makeClient(options = {}) {
-    const defaultOptions = {
-      client: everything_default.client()
-    };
-    options = Object.assign({}, defaultOptions, options);
-    assert(options, {
-      issuer: Required(validURL)
-    });
-    const oauth_authorization_server_configuration = fetchWellknownOauthAuthorizationServer(options.issuer);
-    return options.client.with(options.issuer);
-  }
-  async function fetchWellknownOauthAuthorizationServer(issuer, client2) {
-    let res = client2.get(everything_default.url(issuer, ".wellknown/oauth_authorization_server"));
-    if (res.ok) {
-      assert(res.headers.get("Content-Type"), /application\/json.*/);
-      let configuration = await res.json();
-      assert(configuration, oauth_authorization_server_metadata);
-      return configuration;
+    const trimmed = value.trim();
+    const index = trimmed.search(/\s/);
+    const scheme = index < 0 ? trimmed : trimmed.slice(0, index);
+    const rest = index < 0 ? "" : trimmed.slice(index + 1);
+    if (!["bearer", "dpop"].includes(scheme.toLowerCase())) {
+      return null;
     }
-    throw everything_default.metroError("metro.oidcmw: Error while fetching " + issuer + ".wellknown/oauth_authorization_server", res);
-  }
-
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.popup.mjs
-  function handleRedirect(origin = null) {
-    let success = false;
-    origin = origin || window.location.origin;
-    let params = new URLSearchParams(window.location.search);
-    if (!params.has("code") && window.location.hash) {
-      let query = window.location.hash.substr(1);
-      params = new URLSearchParams("?" + query);
-    }
-    let parent = window.parent !== window ? window.parent : window.opener;
-    if (!parent) {
-      console.error("No parent window found, cannot post authorization code (or error)");
-    } else {
-      if (params.has("code")) {
-        parent.postMessage({
-          authorization_code: params.get("code")
-        }, origin);
-        success = true;
-      } else if (params.has("error")) {
-        parent.postMessage({
-          error: params.get("error")
-        }, origin);
-      } else {
-        parent.postMessage({
-          error: "Could not find an authorization_code"
-        }, origin);
+    const result = { scheme };
+    const pattern = /([A-Za-z][A-Za-z0-9_-]*)=("(?:[^"\\]|\\.)*"|[^,\s]*)/g;
+    let match;
+    while (match = pattern.exec(rest)) {
+      let value2 = match[2];
+      if (value2.startsWith('"') && value2.endsWith('"')) {
+        value2 = value2.slice(1, -1).replace(/\\"/g, '"');
       }
+      result[match[1]] = value2;
     }
-    return success;
-  }
-  function authorizePopup(authorizationCodeURL) {
-    return new Promise((resolve, reject) => {
-      addEventListener("message", (event) => {
-        if (event.data.authorization_code) {
-          resolve(event.data.authorization_code);
-        } else if (event.data.error) {
-          reject(event.data.error);
-        } else {
-          reject("Unknown authorization error");
-        }
-      }, { once: true });
-      window.open(authorizationCodeURL);
-    });
-  }
-
-  // node_modules/@muze-nl/metro-oauth2/src/keysstore.mjs
-  function keysStore() {
-    return new Promise((resolve, reject) => {
-      const request2 = globalThis.indexedDB.open("metro", 1);
-      request2.onupgradeneeded = () => request2.result.createObjectStore("keyPairs", { keyPath: "domain" });
-      request2.onerror = (event) => {
-        reject(event);
-      };
-      request2.onsuccess = (event) => {
-        const db = event.target.result;
-        resolve({
-          set: function(value, key) {
-            return new Promise((resolve2, reject2) => {
-              const tx = db.transaction("keyPairs", "readwrite", { durability: "strict" });
-              const objectStore = tx.objectStore("keyPairs");
-              tx.oncomplete = () => {
-                resolve2();
-              };
-              tx.onerror = reject2;
-              objectStore.put(value, key);
-            });
-          },
-          get: function(key) {
-            return new Promise((resolve2, reject2) => {
-              const tx = db.transaction("keyPairs", "readonly");
-              const objectStore = tx.objectStore("keyPairs");
-              const request3 = objectStore.get(key);
-              request3.onsuccess = () => {
-                resolve2(request3.result);
-              };
-              request3.onerror = reject2;
-              tx.onerror = reject2;
-            });
-          },
-          clear: function() {
-            return new Promise((resolve2, reject2) => {
-              const tx = db.transaction("keyPairs", "readwrite");
-              const objectStore = tx.objectStore("keyPairs");
-              const request3 = objectStore.clear();
-              request3.onsuccess = () => {
-                resolve2();
-              };
-              request3.onerror = reject2;
-              tx.onerror = reject2;
-            });
-          }
-        });
-      };
-    });
+    return result;
   }
 
-  // node_modules/dpop/build/index.js
+  // ../../node_modules/dpop/build/index.js
   var encoder = new TextEncoder();
   var decoder = new TextDecoder();
   function buf(input) {
@@ -1749,17 +1458,17 @@
     return encodeBase64Url(input);
   }
   var UnsupportedOperationError = class extends Error {
-    constructor(message) {
+    constructor(message2) {
       var _a;
-      super(message !== null && message !== void 0 ? message : "operation not supported");
+      super(message2 !== null && message2 !== void 0 ? message2 : "operation not supported");
       this.name = this.constructor.name;
       (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
   };
   var OperationProcessingError = class extends Error {
-    constructor(message) {
+    constructor(message2) {
       var _a;
-      super(message);
+      super(message2);
       this.name = this.constructor.name;
       (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
@@ -1893,7 +1602,58 @@
     return crypto.subtle.generateKey(algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, ["sign", "verify"]);
   }
 
-  // node_modules/@muze-nl/metro-oauth2/src/oauth2.dpop.mjs
+  // ../metro-oauth2/src/keysstore.mjs
+  function keysStore() {
+    return new Promise((resolve, reject) => {
+      const request2 = globalThis.indexedDB.open("metro", 1);
+      request2.onupgradeneeded = () => request2.result.createObjectStore("keyPairs", { keyPath: "domain" });
+      request2.onerror = (event) => {
+        reject(event);
+      };
+      request2.onsuccess = (event) => {
+        const db = event.target.result;
+        resolve({
+          set: function(value, key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite", { durability: "strict" });
+              const objectStore = tx.objectStore("keyPairs");
+              tx.oncomplete = () => {
+                resolve2();
+              };
+              tx.onerror = reject2;
+              objectStore.put(value, key);
+            });
+          },
+          get: function(key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readonly");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.get(key);
+              request3.onsuccess = () => {
+                resolve2(request3.result);
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          },
+          clear: function() {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.clear();
+              request3.onsuccess = () => {
+                resolve2();
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          }
+        });
+      };
+    });
+  }
+
+  // ../metro-oauth2/src/oauth2.dpop.mjs
   function dpopmw(options) {
     assert(options, {
       site: Required(validURL),
@@ -1910,7 +1670,7 @@
         keyInfo = { domain: options.site, keyPair };
         await keys.set(keyInfo);
       }
-      const url2 = everything_default.url(req.url);
+      const url2 = url(req.url);
       if (req.url.startsWith(options.authorization_endpoint)) {
         let params = req.body;
         if (params instanceof URLSearchParams || params instanceof FormData) {
@@ -1944,47 +1704,106 @@
     };
   }
 
-  // node_modules/@muze-nl/metro-oauth2/src/browser.mjs
-  var oauth2 = Object.assign({}, oauth2_exports, {
-    oauth2mw,
-    mockserver: oauth2_mockserver_exports,
-    discover: oauth2_discovery_exports,
-    tokenstore: tokenStore,
-    dpopmw,
-    keysstore: keysStore,
-    authorizePopup,
-    popupHandleRedirect: handleRedirect
-  });
-  if (!globalThis.metro.oauth2) {
-    globalThis.metro.oauth2 = oauth2;
-  }
-
-  // src/oidc.util.mjs
-  var MustHave = (...options) => (value, root) => {
-    if (options.filter((o) => root.hasOwnKey(o)).length > 0) {
-      return false;
-    }
-    return error("root data must have all of", root, options);
-  };
-  var MustInclude = (...options) => (value) => {
-    if (Array.isArray(value) && options.filter((o) => !value.includes(o)).length == 0) {
-      return false;
-    } else {
-      return error("data must be an array which includes", value, options);
-    }
-  };
-  var validJWA = [
-    "HS256",
-    "HS384",
-    "HS512",
-    "RS256",
-    "RS384",
-    "RS512",
-    "ES256",
-    "ES384",
-    "ES512"
+  // ../metro-middleware/src/json.mjs
+  function jsonmw(options) {
+    options = Object.assign({
+      contentType: "application/json",
+      reviver: null,
+      replacer: null,
+      space: ""
+    }, options);
+    return async function json(req, next) {
+      if (!req.headers.get("Accept")) {
+        req = req.with({
+          headers: {
+            "Accept": options.accept ?? options.contentType
+          }
+        });
+      }
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        if (req.data && typeof req.data == "object" && !(req.data instanceof ReadableStream)) {
+          const contentType = req.headers.get("Content-Type");
+          if (!contentType || isPlainText(contentType)) {
+            req = req.with({
+              headers: {
+                "Content-Type": options.contentType
+              }
+            });
+          }
+          if (isJSON(req.headers.get("Content-Type"))) {
+            req = req.with({
+              body: JSON.stringify(req.data, options.replacer, options.space)
+            });
+          }
+        }
+      }
+      let res = await next(req);
+      if (res && isJSON(res.headers?.get("Content-Type"))) {
+        let tempRes = res.clone();
+        let body = await tempRes.text();
+        try {
+          let json2 = JSON.parse(body, options.reviver);
+          return res.with({
+            body: json2
+          });
+        } catch (e) {
+        }
+      }
+      return res;
+    };
+  }
+  var jsonRE = /^application\/([a-zA-Z0-9\-_]+\+)?json\b/;
+  function isJSON(contentType) {
+    return jsonRE.exec(contentType);
+  }
+  function isPlainText(contentType) {
+    return /^text\/plain\b/.exec(contentType);
+  }
+
+  // ../metro-middleware/src/thrower.mjs
+  function throwermw(options) {
+    return async function thrower(req, next) {
+      let res = await next(req);
+      if (!res.ok) {
+        if (options && typeof options[res.status] == "function") {
+          res = options[res.status].apply(res, req);
+        } else {
+          throw new Error(res.status + ": " + res.statusText, {
+            cause: res
+          });
+        }
+      }
+      return res;
+    };
+  }
+
+  // src/oidc.util.mjs
+  var MustHave = (...options) => (value, root) => {
+    if (options.filter((o) => root.hasOwnKey(o)).length > 0) {
+      return false;
+    }
+    return error("root data must have all of", root, options);
+  };
+  var MustInclude = (...options) => (value) => {
+    if (Array.isArray(value) && options.filter((o) => !value.includes(o)).length == 0) {
+      return false;
+    } else {
+      return error("data must be an array which includes", value, options);
+    }
+  };
+  var validJWA = [
+    "HS256",
+    "HS384",
+    "HS512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "ES256",
+    "ES384",
+    "ES512"
   ];
-  var validAuthMethods2 = [
+  var validAuthMethods = [
+    "none",
     "client_secret_post",
     "client_secret_basic",
     "client_secret_jwt",
@@ -1994,14 +1813,15 @@
   // src/oidc.discovery.mjs
   async function oidcDiscovery(options = {}) {
     assert(options, {
-      client: Optional(instanceOf(everything_default.client().constructor)),
+      client: Optional(instanceOf(client().constructor)),
       issuer: Required(validURL)
     });
     const defaultOptions = {
-      client: everything_default.client().with(throwermw()).with(jsonmw()),
+      client: client().with(throwermw()).with(jsonmw()),
       requireDynamicRegistration: false
     };
     options = Object.assign({}, defaultOptions, options);
+    options.client = options.client.with(throwermw()).with(jsonmw());
     const TestSucceeded = false;
     function MustUseHTTPS(url2) {
       return TestSucceeded;
@@ -2030,7 +1850,7 @@
       // not testing for 'none'
       request_object_encryption_alg_values_supported: Optional([]),
       request_object_encryption_enc_values_supported: Optional([]),
-      token_endpoint_auth_methods_supported: Optional(anyOf(...validAuthMethods2)),
+      token_endpoint_auth_methods_supported: Optional(anyOf(...validAuthMethods)),
       token_endpoint_auth_signing_alg_values_supported: Optional(MustInclude("RS256"), not(MustInclude("none"))),
       display_values_supported: Optional(anyOf("page", "popup", "touch", "wap")),
       claim_types_supported: Optional(anyOf("normal", "aggregated", "distributed")),
@@ -2044,7 +1864,7 @@
       op_policy_uri: Optional(validURL),
       op_tos_uri: Optional(validURL)
     };
-    const configURL = everything_default.url(options.issuer, ".well-known/openid-configuration");
+    const configURL = url(options.issuer, ".well-known/openid-configuration");
     const response2 = await options.client.get(
       // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
       // note: this allows path components in the options.issuer url
@@ -2083,7 +1903,7 @@
       request_object_signing_alg: Optional(oneOf(...validJWA)),
       request_object_encryption_alg: Optional(oneOf(...validJWA)),
       request_object_encryption_enc: Optional(oneOf(...validJWA)),
-      token_endpoint_auth_method: Optional(oneOf(...validAuthMethods2)),
+      token_endpoint_auth_method: Optional(oneOf(...validAuthMethods)),
       token_endpoint_auth_signing_alg: Optional(oneOf(...validJWA)),
       default_max_age: Optional(Number),
       require_auth_time: Optional(Boolean),
@@ -2092,17 +1912,18 @@
       request_uris: Optional([validURL])
     };
     assert(options, {
-      client: Optional(instanceOf(everything_default.client().constructor)),
+      client: Optional(instanceOf(client().constructor)),
       registration_endpoint: validURL,
       client_info: openid_client_metadata
     });
     const defaultOptions = {
-      client: everything_default.client().with(throwermw()).with(jsonmw()),
+      client: client().with(throwermw()).with(jsonmw()),
       client_info: {
         redirect_uris: [globalThis.document?.location.href]
       }
     };
     options = Object.assign({}, defaultOptions, options);
+    options.client = options.client.with(throwermw()).with(jsonmw());
     if (!options.client_info) {
       options.client_info = {};
     }
@@ -2113,8 +1934,8 @@
       body: options.client_info
     });
     let info = response2.data;
-    if (!info.client_id || !info.client_secret) {
-      throw everything_default.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned", response2);
+    if (!info.client_id) {
+      throw metroError("metro.oidc: Error: dynamic registration of client failed, no client_id returned", response2);
     }
     options.client_info = Object.assign(options.client_info, info);
     return options.client_info;
@@ -2140,6 +1961,1292 @@
     return store;
   }
 
+  // ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
+  var encoder2 = new TextEncoder();
+  var decoder2 = new TextDecoder();
+  var MAX_INT32 = 2 ** 32;
+  function concat(...buffers) {
+    const size = buffers.reduce((acc, { length }) => acc + length, 0);
+    const buf2 = new Uint8Array(size);
+    let i = 0;
+    for (const buffer of buffers) {
+      buf2.set(buffer, i);
+      i += buffer.length;
+    }
+    return buf2;
+  }
+  function encode(string) {
+    const bytes = new Uint8Array(string.length);
+    for (let i = 0; i < string.length; i++) {
+      const code = string.charCodeAt(i);
+      if (code > 127) {
+        throw new TypeError("non-ASCII string encountered in encode()");
+      }
+      bytes[i] = code;
+    }
+    return bytes;
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/base64.js
+  function decodeBase64(encoded) {
+    if (Uint8Array.fromBase64) {
+      return Uint8Array.fromBase64(encoded);
+    }
+    const binary = atob(encoded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+  }
+
+  // ../../node_modules/jose/dist/webapi/util/base64url.js
+  function decode(input) {
+    if (Uint8Array.fromBase64) {
+      return Uint8Array.fromBase64(typeof input === "string" ? input : decoder2.decode(input), {
+        alphabet: "base64url"
+      });
+    }
+    let encoded = input;
+    if (encoded instanceof Uint8Array) {
+      encoded = decoder2.decode(encoded);
+    }
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+    try {
+      return decodeBase64(encoded);
+    } catch {
+      throw new TypeError("The input to be decoded is not correctly encoded.");
+    }
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/crypto_key.js
+  var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+  var isAlgorithm = (algorithm, name) => algorithm.name === name;
+  function getHashLength(hash) {
+    return parseInt(hash.name.slice(4), 10);
+  }
+  function checkHashLength(algorithm, expected) {
+    const actual = getHashLength(algorithm.hash);
+    if (actual !== expected)
+      throw unusable(`SHA-${expected}`, "algorithm.hash");
+  }
+  function getNamedCurve(alg) {
+    switch (alg) {
+      case "ES256":
+        return "P-256";
+      case "ES384":
+        return "P-384";
+      case "ES512":
+        return "P-521";
+      default:
+        throw new Error("unreachable");
+    }
+  }
+  function checkUsage(key, usage) {
+    if (usage && !key.usages.includes(usage)) {
+      throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+    }
+  }
+  function checkSigCryptoKey(key, alg, usage) {
+    switch (alg) {
+      case "HS256":
+      case "HS384":
+      case "HS512": {
+        if (!isAlgorithm(key.algorithm, "HMAC"))
+          throw unusable("HMAC");
+        checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+        break;
+      }
+      case "RS256":
+      case "RS384":
+      case "RS512": {
+        if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5"))
+          throw unusable("RSASSA-PKCS1-v1_5");
+        checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+        break;
+      }
+      case "PS256":
+      case "PS384":
+      case "PS512": {
+        if (!isAlgorithm(key.algorithm, "RSA-PSS"))
+          throw unusable("RSA-PSS");
+        checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+        break;
+      }
+      case "Ed25519":
+      case "EdDSA": {
+        if (!isAlgorithm(key.algorithm, "Ed25519"))
+          throw unusable("Ed25519");
+        break;
+      }
+      case "ML-DSA-44":
+      case "ML-DSA-65":
+      case "ML-DSA-87": {
+        if (!isAlgorithm(key.algorithm, alg))
+          throw unusable(alg);
+        break;
+      }
+      case "ES256":
+      case "ES384":
+      case "ES512": {
+        if (!isAlgorithm(key.algorithm, "ECDSA"))
+          throw unusable("ECDSA");
+        const expected = getNamedCurve(alg);
+        const actual = key.algorithm.namedCurve;
+        if (actual !== expected)
+          throw unusable(expected, "algorithm.namedCurve");
+        break;
+      }
+      default:
+        throw new TypeError("CryptoKey does not support this operation");
+    }
+    checkUsage(key, usage);
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/invalid_key_input.js
+  function message(msg, actual, ...types) {
+    types = types.filter(Boolean);
+    if (types.length > 2) {
+      const last = types.pop();
+      msg += `one of type ${types.join(", ")}, or ${last}.`;
+    } else if (types.length === 2) {
+      msg += `one of type ${types[0]} or ${types[1]}.`;
+    } else {
+      msg += `of type ${types[0]}.`;
+    }
+    if (actual == null) {
+      msg += ` Received ${actual}`;
+    } else if (typeof actual === "function" && actual.name) {
+      msg += ` Received function ${actual.name}`;
+    } else if (typeof actual === "object" && actual != null) {
+      if (actual.constructor?.name) {
+        msg += ` Received an instance of ${actual.constructor.name}`;
+      }
+    }
+    return msg;
+  }
+  var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+  var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+
+  // ../../node_modules/jose/dist/webapi/util/errors.js
+  var JOSEError = class extends Error {
+    static code = "ERR_JOSE_GENERIC";
+    code = "ERR_JOSE_GENERIC";
+    constructor(message2, options) {
+      super(message2, options);
+      this.name = this.constructor.name;
+      Error.captureStackTrace?.(this, this.constructor);
+    }
+  };
+  var JWTClaimValidationFailed = class extends JOSEError {
+    static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+    code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+    claim;
+    reason;
+    payload;
+    constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+      super(message2, { cause: { claim, reason, payload } });
+      this.claim = claim;
+      this.reason = reason;
+      this.payload = payload;
+    }
+  };
+  var JWTExpired = class extends JOSEError {
+    static code = "ERR_JWT_EXPIRED";
+    code = "ERR_JWT_EXPIRED";
+    claim;
+    reason;
+    payload;
+    constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+      super(message2, { cause: { claim, reason, payload } });
+      this.claim = claim;
+      this.reason = reason;
+      this.payload = payload;
+    }
+  };
+  var JOSEAlgNotAllowed = class extends JOSEError {
+    static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+    code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  };
+  var JOSENotSupported = class extends JOSEError {
+    static code = "ERR_JOSE_NOT_SUPPORTED";
+    code = "ERR_JOSE_NOT_SUPPORTED";
+  };
+  var JWSInvalid = class extends JOSEError {
+    static code = "ERR_JWS_INVALID";
+    code = "ERR_JWS_INVALID";
+  };
+  var JWTInvalid = class extends JOSEError {
+    static code = "ERR_JWT_INVALID";
+    code = "ERR_JWT_INVALID";
+  };
+  var JWKSInvalid = class extends JOSEError {
+    static code = "ERR_JWKS_INVALID";
+    code = "ERR_JWKS_INVALID";
+  };
+  var JWKSNoMatchingKey = class extends JOSEError {
+    static code = "ERR_JWKS_NO_MATCHING_KEY";
+    code = "ERR_JWKS_NO_MATCHING_KEY";
+    constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
+      super(message2, options);
+    }
+  };
+  var JWKSMultipleMatchingKeys = class extends JOSEError {
+    [Symbol.asyncIterator];
+    static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+    code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+    constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
+      super(message2, options);
+    }
+  };
+  var JWSSignatureVerificationFailed = class extends JOSEError {
+    static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+    code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+    constructor(message2 = "signature verification failed", options) {
+      super(message2, options);
+    }
+  };
+
+  // ../../node_modules/jose/dist/webapi/lib/is_key_like.js
+  var isCryptoKey2 = (key) => {
+    if (key?.[Symbol.toStringTag] === "CryptoKey")
+      return true;
+    try {
+      return key instanceof CryptoKey;
+    } catch {
+      return false;
+    }
+  };
+  var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+  var isKeyLike = (key) => isCryptoKey2(key) || isKeyObject(key);
+
+  // ../../node_modules/jose/dist/webapi/lib/helpers.js
+  function decodeBase64url(value, label, ErrorClass) {
+    try {
+      return decode(value);
+    } catch {
+      throw new ErrorClass(`Failed to base64url decode the ${label}`);
+    }
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/type_checks.js
+  var isObjectLike = (value) => typeof value === "object" && value !== null;
+  function isObject(input) {
+    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+      return false;
+    }
+    if (Object.getPrototypeOf(input) === null) {
+      return true;
+    }
+    let proto = input;
+    while (Object.getPrototypeOf(proto) !== null) {
+      proto = Object.getPrototypeOf(proto);
+    }
+    return Object.getPrototypeOf(input) === proto;
+  }
+  function isDisjoint(...headers) {
+    const sources = headers.filter(Boolean);
+    if (sources.length === 0 || sources.length === 1) {
+      return true;
+    }
+    let acc;
+    for (const header of sources) {
+      const parameters = Object.keys(header);
+      if (!acc || acc.size === 0) {
+        acc = new Set(parameters);
+        continue;
+      }
+      for (const parameter of parameters) {
+        if (acc.has(parameter)) {
+          return false;
+        }
+        acc.add(parameter);
+      }
+    }
+    return true;
+  }
+  var isJWK = (key) => isObject(key) && typeof key.kty === "string";
+  var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
+  var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
+  var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
+
+  // ../../node_modules/jose/dist/webapi/lib/signing.js
+  function checkKeyLength(alg, key) {
+    if (alg.startsWith("RS") || alg.startsWith("PS")) {
+      const { modulusLength } = key.algorithm;
+      if (typeof modulusLength !== "number" || modulusLength < 2048) {
+        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+      }
+    }
+  }
+  function subtleAlgorithm2(alg, algorithm) {
+    const hash = `SHA-${alg.slice(-3)}`;
+    switch (alg) {
+      case "HS256":
+      case "HS384":
+      case "HS512":
+        return { hash, name: "HMAC" };
+      case "PS256":
+      case "PS384":
+      case "PS512":
+        return { hash, name: "RSA-PSS", saltLength: parseInt(alg.slice(-3), 10) >> 3 };
+      case "RS256":
+      case "RS384":
+      case "RS512":
+        return { hash, name: "RSASSA-PKCS1-v1_5" };
+      case "ES256":
+      case "ES384":
+      case "ES512":
+        return { hash, name: "ECDSA", namedCurve: algorithm.namedCurve };
+      case "Ed25519":
+      case "EdDSA":
+        return { name: "Ed25519" };
+      case "ML-DSA-44":
+      case "ML-DSA-65":
+      case "ML-DSA-87":
+        return { name: alg };
+      default:
+        throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+  }
+  async function getSigKey(alg, key, usage) {
+    if (key instanceof Uint8Array) {
+      if (!alg.startsWith("HS")) {
+        throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+      }
+      return crypto.subtle.importKey("raw", key, { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" }, false, [usage]);
+    }
+    checkSigCryptoKey(key, alg, usage);
+    return key;
+  }
+  async function verify(alg, key, signature, data) {
+    const cryptoKey = await getSigKey(alg, key, "verify");
+    checkKeyLength(alg, cryptoKey);
+    const algorithm = subtleAlgorithm2(alg, cryptoKey.algorithm);
+    try {
+      return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+    } catch {
+      return false;
+    }
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/jwk_to_key.js
+  var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
+  function subtleMapping(jwk) {
+    let algorithm;
+    let keyUsages;
+    switch (jwk.kty) {
+      case "AKP": {
+        switch (jwk.alg) {
+          case "ML-DSA-44":
+          case "ML-DSA-65":
+          case "ML-DSA-87":
+            algorithm = { name: jwk.alg };
+            keyUsages = jwk.priv ? ["sign"] : ["verify"];
+            break;
+          default:
+            throw new JOSENotSupported(unsupportedAlg);
+        }
+        break;
+      }
+      case "RSA": {
+        switch (jwk.alg) {
+          case "PS256":
+          case "PS384":
+          case "PS512":
+            algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+            keyUsages = jwk.d ? ["sign"] : ["verify"];
+            break;
+          case "RS256":
+          case "RS384":
+          case "RS512":
+            algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${jwk.alg.slice(-3)}` };
+            keyUsages = jwk.d ? ["sign"] : ["verify"];
+            break;
+          case "RSA-OAEP":
+          case "RSA-OAEP-256":
+          case "RSA-OAEP-384":
+          case "RSA-OAEP-512":
+            algorithm = {
+              name: "RSA-OAEP",
+              hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+            };
+            keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+            break;
+          default:
+            throw new JOSENotSupported(unsupportedAlg);
+        }
+        break;
+      }
+      case "EC": {
+        switch (jwk.alg) {
+          case "ES256":
+          case "ES384":
+          case "ES512":
+            algorithm = {
+              name: "ECDSA",
+              namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+            };
+            keyUsages = jwk.d ? ["sign"] : ["verify"];
+            break;
+          case "ECDH-ES":
+          case "ECDH-ES+A128KW":
+          case "ECDH-ES+A192KW":
+          case "ECDH-ES+A256KW":
+            algorithm = { name: "ECDH", namedCurve: jwk.crv };
+            keyUsages = jwk.d ? ["deriveBits"] : [];
+            break;
+          default:
+            throw new JOSENotSupported(unsupportedAlg);
+        }
+        break;
+      }
+      case "OKP": {
+        switch (jwk.alg) {
+          case "Ed25519":
+          case "EdDSA":
+            algorithm = { name: "Ed25519" };
+            keyUsages = jwk.d ? ["sign"] : ["verify"];
+            break;
+          case "ECDH-ES":
+          case "ECDH-ES+A128KW":
+          case "ECDH-ES+A192KW":
+          case "ECDH-ES+A256KW":
+            algorithm = { name: jwk.crv };
+            keyUsages = jwk.d ? ["deriveBits"] : [];
+            break;
+          default:
+            throw new JOSENotSupported(unsupportedAlg);
+        }
+        break;
+      }
+      default:
+        throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+    }
+    return { algorithm, keyUsages };
+  }
+  async function jwkToKey(jwk) {
+    if (!jwk.alg) {
+      throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    const { algorithm, keyUsages } = subtleMapping(jwk);
+    const keyData = { ...jwk };
+    if (keyData.kty !== "AKP") {
+      delete keyData.alg;
+    }
+    delete keyData.use;
+    return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/normalize_key.js
+  var unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
+  var cache;
+  var handleJWK = async (key, jwk, alg, freeze = false) => {
+    cache ||= /* @__PURE__ */ new WeakMap();
+    let cached = cache.get(key);
+    if (cached?.[alg]) {
+      return cached[alg];
+    }
+    const cryptoKey = await jwkToKey({ ...jwk, alg });
+    if (freeze)
+      Object.freeze(key);
+    if (!cached) {
+      cache.set(key, { [alg]: cryptoKey });
+    } else {
+      cached[alg] = cryptoKey;
+    }
+    return cryptoKey;
+  };
+  var handleKeyObject = (keyObject, alg) => {
+    cache ||= /* @__PURE__ */ new WeakMap();
+    let cached = cache.get(keyObject);
+    if (cached?.[alg]) {
+      return cached[alg];
+    }
+    const isPublic = keyObject.type === "public";
+    const extractable = isPublic ? true : false;
+    let cryptoKey;
+    if (keyObject.asymmetricKeyType === "x25519") {
+      switch (alg) {
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          break;
+        default:
+          throw new TypeError(unusableForAlg);
+      }
+      cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
+    }
+    if (keyObject.asymmetricKeyType === "ed25519") {
+      if (alg !== "EdDSA" && alg !== "Ed25519") {
+        throw new TypeError(unusableForAlg);
+      }
+      cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+        isPublic ? "verify" : "sign"
+      ]);
+    }
+    switch (keyObject.asymmetricKeyType) {
+      case "ml-dsa-44":
+      case "ml-dsa-65":
+      case "ml-dsa-87": {
+        if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
+          throw new TypeError(unusableForAlg);
+        }
+        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+          isPublic ? "verify" : "sign"
+        ]);
+      }
+    }
+    if (keyObject.asymmetricKeyType === "rsa") {
+      let hash;
+      switch (alg) {
+        case "RSA-OAEP":
+          hash = "SHA-1";
+          break;
+        case "RS256":
+        case "PS256":
+        case "RSA-OAEP-256":
+          hash = "SHA-256";
+          break;
+        case "RS384":
+        case "PS384":
+        case "RSA-OAEP-384":
+          hash = "SHA-384";
+          break;
+        case "RS512":
+        case "PS512":
+        case "RSA-OAEP-512":
+          hash = "SHA-512";
+          break;
+        default:
+          throw new TypeError(unusableForAlg);
+      }
+      if (alg.startsWith("RSA-OAEP")) {
+        return keyObject.toCryptoKey({
+          name: "RSA-OAEP",
+          hash
+        }, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
+      }
+      cryptoKey = keyObject.toCryptoKey({
+        name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+        hash
+      }, extractable, [isPublic ? "verify" : "sign"]);
+    }
+    if (keyObject.asymmetricKeyType === "ec") {
+      const nist = /* @__PURE__ */ new Map([
+        ["prime256v1", "P-256"],
+        ["secp384r1", "P-384"],
+        ["secp521r1", "P-521"]
+      ]);
+      const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
+      if (!namedCurve) {
+        throw new TypeError(unusableForAlg);
+      }
+      const expectedCurve = { ES256: "P-256", ES384: "P-384", ES512: "P-521" };
+      if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {
+        cryptoKey = keyObject.toCryptoKey({
+          name: "ECDSA",
+          namedCurve
+        }, extractable, [isPublic ? "verify" : "sign"]);
+      }
+      if (alg.startsWith("ECDH-ES")) {
+        cryptoKey = keyObject.toCryptoKey({
+          name: "ECDH",
+          namedCurve
+        }, extractable, isPublic ? [] : ["deriveBits"]);
+      }
+    }
+    if (!cryptoKey) {
+      throw new TypeError(unusableForAlg);
+    }
+    if (!cached) {
+      cache.set(keyObject, { [alg]: cryptoKey });
+    } else {
+      cached[alg] = cryptoKey;
+    }
+    return cryptoKey;
+  };
+  async function normalizeKey(key, alg) {
+    if (key instanceof Uint8Array) {
+      return key;
+    }
+    if (isCryptoKey2(key)) {
+      return key;
+    }
+    if (isKeyObject(key)) {
+      if (key.type === "secret") {
+        return key.export();
+      }
+      if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") {
+        try {
+          return handleKeyObject(key, alg);
+        } catch (err) {
+          if (err instanceof TypeError) {
+            throw err;
+          }
+        }
+      }
+      let jwk = key.export({ format: "jwk" });
+      return handleJWK(key, jwk, alg);
+    }
+    if (isJWK(key)) {
+      if (key.k) {
+        return decode(key.k);
+      }
+      return handleJWK(key, key, alg, true);
+    }
+    throw new Error("unreachable");
+  }
+
+  // ../../node_modules/jose/dist/webapi/key/import.js
+  async function importJWK(jwk, alg, options) {
+    if (!isObject(jwk)) {
+      throw new TypeError("JWK must be an object");
+    }
+    let ext;
+    alg ??= jwk.alg;
+    ext ??= options?.extractable ?? jwk.ext;
+    switch (jwk.kty) {
+      case "oct":
+        if (typeof jwk.k !== "string" || !jwk.k) {
+          throw new TypeError('missing "k" (Key Value) Parameter value');
+        }
+        return decode(jwk.k);
+      case "RSA":
+        if ("oth" in jwk && jwk.oth !== void 0) {
+          throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+        }
+        return jwkToKey({ ...jwk, alg, ext });
+      case "AKP": {
+        if (typeof jwk.alg !== "string" || !jwk.alg) {
+          throw new TypeError('missing "alg" (Algorithm) Parameter value');
+        }
+        if (alg !== void 0 && alg !== jwk.alg) {
+          throw new TypeError("JWK alg and alg option value mismatch");
+        }
+        return jwkToKey({ ...jwk, ext });
+      }
+      case "EC":
+      case "OKP":
+        return jwkToKey({ ...jwk, alg, ext });
+      default:
+        throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/validate_crit.js
+  function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+    if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
+      throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+    }
+    if (!protectedHeader || protectedHeader.crit === void 0) {
+      return /* @__PURE__ */ new Set();
+    }
+    if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
+      throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+    }
+    let recognized;
+    if (recognizedOption !== void 0) {
+      recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+    } else {
+      recognized = recognizedDefault;
+    }
+    for (const parameter of protectedHeader.crit) {
+      if (!recognized.has(parameter)) {
+        throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+      }
+      if (joseHeader[parameter] === void 0) {
+        throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+      }
+      if (recognized.get(parameter) && protectedHeader[parameter] === void 0) {
+        throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+      }
+    }
+    return new Set(protectedHeader.crit);
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/validate_algorithms.js
+  function validateAlgorithms(option, algorithms) {
+    if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
+      throw new TypeError(`"${option}" option must be an array of strings`);
+    }
+    if (!algorithms) {
+      return void 0;
+    }
+    return new Set(algorithms);
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/check_key_type.js
+  var tag = (key) => key?.[Symbol.toStringTag];
+  var jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== void 0) {
+      let expected;
+      switch (usage) {
+        case "sign":
+        case "verify":
+          expected = "sig";
+          break;
+        case "encrypt":
+        case "decrypt":
+          expected = "enc";
+          break;
+      }
+      if (key.use !== expected) {
+        throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+      }
+    }
+    if (key.alg !== void 0 && key.alg !== alg) {
+      throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+    }
+    if (Array.isArray(key.key_ops)) {
+      let expectedKeyOp;
+      switch (true) {
+        case (usage === "sign" || usage === "verify"):
+        case alg === "dir":
+        case alg.includes("CBC-HS"):
+          expectedKeyOp = usage;
+          break;
+        case alg.startsWith("PBES2"):
+          expectedKeyOp = "deriveBits";
+          break;
+        case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
+          if (!alg.includes("GCM") && alg.endsWith("KW")) {
+            expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
+          } else {
+            expectedKeyOp = usage;
+          }
+          break;
+        case (usage === "encrypt" && alg.startsWith("RSA")):
+          expectedKeyOp = "wrapKey";
+          break;
+        case usage === "decrypt":
+          expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+          break;
+      }
+      if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
+        throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+      }
+    }
+    return true;
+  };
+  var symmetricTypeCheck = (alg, key, usage) => {
+    if (key instanceof Uint8Array)
+      return;
+    if (isJWK(key)) {
+      if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+        return;
+      throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
+    if (!isKeyLike(key)) {
+      throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+    }
+    if (key.type !== "secret") {
+      throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    }
+  };
+  var asymmetricTypeCheck = (alg, key, usage) => {
+    if (isJWK(key)) {
+      switch (usage) {
+        case "decrypt":
+        case "sign":
+          if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+          throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
+        case "encrypt":
+        case "verify":
+          if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+          throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+      }
+    }
+    if (!isKeyLike(key)) {
+      throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    if (key.type === "secret") {
+      throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+    }
+    if (key.type === "public") {
+      switch (usage) {
+        case "sign":
+          throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+        case "decrypt":
+          throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+      }
+    }
+    if (key.type === "private") {
+      switch (usage) {
+        case "verify":
+          throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+        case "encrypt":
+          throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+      }
+    }
+  };
+  function checkKeyType(alg, key, usage) {
+    switch (alg.substring(0, 2)) {
+      case "A1":
+      case "A2":
+      case "di":
+      case "HS":
+      case "PB":
+        symmetricTypeCheck(alg, key, usage);
+        break;
+      default:
+        asymmetricTypeCheck(alg, key, usage);
+    }
+  }
+
+  // ../../node_modules/jose/dist/webapi/jws/flattened/verify.js
+  async function flattenedVerify(jws, key, options) {
+    if (!isObject(jws)) {
+      throw new JWSInvalid("Flattened JWS must be an object");
+    }
+    if (jws.protected === void 0 && jws.header === void 0) {
+      throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+    }
+    if (jws.protected !== void 0 && typeof jws.protected !== "string") {
+      throw new JWSInvalid("JWS Protected Header incorrect type");
+    }
+    if (jws.payload === void 0) {
+      throw new JWSInvalid("JWS Payload missing");
+    }
+    if (typeof jws.signature !== "string") {
+      throw new JWSInvalid("JWS Signature missing or incorrect type");
+    }
+    if (jws.header !== void 0 && !isObject(jws.header)) {
+      throw new JWSInvalid("JWS Unprotected Header incorrect type");
+    }
+    let parsedProt = {};
+    if (jws.protected) {
+      try {
+        const protectedHeader = decode(jws.protected);
+        parsedProt = JSON.parse(decoder2.decode(protectedHeader));
+      } catch {
+        throw new JWSInvalid("JWS Protected Header is invalid");
+      }
+    }
+    if (!isDisjoint(parsedProt, jws.header)) {
+      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+    }
+    const joseHeader = {
+      ...parsedProt,
+      ...jws.header
+    };
+    const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
+    let b64 = true;
+    if (extensions.has("b64")) {
+      b64 = parsedProt.b64;
+      if (typeof b64 !== "boolean") {
+        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+      }
+    }
+    const { alg } = joseHeader;
+    if (typeof alg !== "string" || !alg) {
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
+    if (algorithms && !algorithms.has(alg)) {
+      throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    if (b64) {
+      if (typeof jws.payload !== "string") {
+        throw new JWSInvalid("JWS Payload must be a string");
+      }
+    } else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) {
+      throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+    }
+    let resolvedKey = false;
+    if (typeof key === "function") {
+      key = await key(parsedProt, jws);
+      resolvedKey = true;
+    }
+    checkKeyType(alg, key, "verify");
+    const data = concat(jws.protected !== void 0 ? encode(jws.protected) : new Uint8Array(), encode("."), typeof jws.payload === "string" ? b64 ? encode(jws.payload) : encoder2.encode(jws.payload) : jws.payload);
+    const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
+    const k = await normalizeKey(key, alg);
+    const verified = await verify(alg, k, signature, data);
+    if (!verified) {
+      throw new JWSSignatureVerificationFailed();
+    }
+    let payload;
+    if (b64) {
+      payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
+    } else if (typeof jws.payload === "string") {
+      payload = encoder2.encode(jws.payload);
+    } else {
+      payload = jws.payload;
+    }
+    const result = { payload };
+    if (jws.protected !== void 0) {
+      result.protectedHeader = parsedProt;
+    }
+    if (jws.header !== void 0) {
+      result.unprotectedHeader = jws.header;
+    }
+    if (resolvedKey) {
+      return { ...result, key: k };
+    }
+    return result;
+  }
+
+  // ../../node_modules/jose/dist/webapi/jws/compact/verify.js
+  async function compactVerify(jws, key, options) {
+    if (jws instanceof Uint8Array) {
+      jws = decoder2.decode(jws);
+    }
+    if (typeof jws !== "string") {
+      throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+    }
+    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+    if (length !== 3) {
+      throw new JWSInvalid("Invalid Compact JWS");
+    }
+    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === "function") {
+      return { ...result, key: verified.key };
+    }
+    return result;
+  }
+
+  // ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+  var epoch = (date) => Math.floor(date.getTime() / 1e3);
+  var minute = 60;
+  var hour = minute * 60;
+  var day = hour * 24;
+  var week = day * 7;
+  var year = day * 365.25;
+  var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+  function secs(str) {
+    const matched = REGEX.exec(str);
+    if (!matched || matched[4] && matched[1]) {
+      throw new TypeError("Invalid time period format");
+    }
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
+    switch (unit) {
+      case "sec":
+      case "secs":
+      case "second":
+      case "seconds":
+      case "s":
+        numericDate = Math.round(value);
+        break;
+      case "minute":
+      case "minutes":
+      case "min":
+      case "mins":
+      case "m":
+        numericDate = Math.round(value * minute);
+        break;
+      case "hour":
+      case "hours":
+      case "hr":
+      case "hrs":
+      case "h":
+        numericDate = Math.round(value * hour);
+        break;
+      case "day":
+      case "days":
+      case "d":
+        numericDate = Math.round(value * day);
+        break;
+      case "week":
+      case "weeks":
+      case "w":
+        numericDate = Math.round(value * week);
+        break;
+      default:
+        numericDate = Math.round(value * year);
+        break;
+    }
+    if (matched[1] === "-" || matched[4] === "ago") {
+      return -numericDate;
+    }
+    return numericDate;
+  }
+  var normalizeTyp = (value) => {
+    if (value.includes("/")) {
+      return value.toLowerCase();
+    }
+    return `application/${value.toLowerCase()}`;
+  };
+  var checkAudiencePresence = (audPayload, audOption) => {
+    if (typeof audPayload === "string") {
+      return audOption.includes(audPayload);
+    }
+    if (Array.isArray(audPayload)) {
+      return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+    }
+    return false;
+  };
+  function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+    let payload;
+    try {
+      payload = JSON.parse(decoder2.decode(encodedPayload));
+    } catch {
+    }
+    if (!isObject(payload)) {
+      throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+    }
+    const { typ } = options;
+    if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+      throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", "check_failed");
+    }
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+    const presenceCheck = [...requiredClaims];
+    if (maxTokenAge !== void 0)
+      presenceCheck.push("iat");
+    if (audience !== void 0)
+      presenceCheck.push("aud");
+    if (subject !== void 0)
+      presenceCheck.push("sub");
+    if (issuer !== void 0)
+      presenceCheck.push("iss");
+    for (const claim of new Set(presenceCheck.reverse())) {
+      if (!(claim in payload)) {
+        throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+      }
+    }
+    if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+      throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, "iss", "check_failed");
+    }
+    if (subject && payload.sub !== subject) {
+      throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, "sub", "check_failed");
+    }
+    if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
+      throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, "aud", "check_failed");
+    }
+    let tolerance;
+    switch (typeof options.clockTolerance) {
+      case "string":
+        tolerance = secs(options.clockTolerance);
+        break;
+      case "number":
+        tolerance = options.clockTolerance;
+        break;
+      case "undefined":
+        tolerance = 0;
+        break;
+      default:
+        throw new TypeError("Invalid clockTolerance option type");
+    }
+    const { currentDate } = options;
+    const now = epoch(currentDate || /* @__PURE__ */ new Date());
+    if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") {
+      throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, "iat", "invalid");
+    }
+    if (payload.nbf !== void 0) {
+      if (typeof payload.nbf !== "number") {
+        throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, "nbf", "invalid");
+      }
+      if (payload.nbf > now + tolerance) {
+        throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", "check_failed");
+      }
+    }
+    if (payload.exp !== void 0) {
+      if (typeof payload.exp !== "number") {
+        throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, "exp", "invalid");
+      }
+      if (payload.exp <= now - tolerance) {
+        throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", "check_failed");
+      }
+    }
+    if (maxTokenAge) {
+      const age = now - payload.iat;
+      const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+      if (age - tolerance > max) {
+        throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", "check_failed");
+      }
+      if (age < 0 - tolerance) {
+        throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", "check_failed");
+      }
+    }
+    return payload;
+  }
+
+  // ../../node_modules/jose/dist/webapi/jwt/verify.js
+  async function jwtVerify(jwt2, key, options) {
+    const verified = await compactVerify(jwt2, key, options);
+    if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    }
+    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === "function") {
+      return { ...result, key: verified.key };
+    }
+    return result;
+  }
+
+  // ../../node_modules/jose/dist/webapi/jwks/local.js
+  function getKtyFromAlg(alg) {
+    switch (typeof alg === "string" && alg.slice(0, 2)) {
+      case "RS":
+      case "PS":
+        return "RSA";
+      case "ES":
+        return "EC";
+      case "Ed":
+        return "OKP";
+      case "ML":
+        return "AKP";
+      default:
+        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+  }
+  function isJWKSLike(jwks) {
+    return jwks && typeof jwks === "object" && Array.isArray(jwks.keys) && jwks.keys.every(isJWKLike);
+  }
+  function isJWKLike(key) {
+    return isObject(key);
+  }
+  var LocalJWKSet = class {
+    #jwks;
+    #cached = /* @__PURE__ */ new WeakMap();
+    constructor(jwks) {
+      if (!isJWKSLike(jwks)) {
+        throw new JWKSInvalid("JSON Web Key Set malformed");
+      }
+      this.#jwks = structuredClone(jwks);
+    }
+    jwks() {
+      return this.#jwks;
+    }
+    async getKey(protectedHeader, token) {
+      const { alg, kid } = { ...protectedHeader, ...token?.header };
+      const kty = getKtyFromAlg(alg);
+      const candidates = this.#jwks.keys.filter((jwk2) => {
+        let candidate = kty === jwk2.kty;
+        if (candidate && typeof kid === "string") {
+          candidate = kid === jwk2.kid;
+        }
+        if (candidate && (typeof jwk2.alg === "string" || kty === "AKP")) {
+          candidate = alg === jwk2.alg;
+        }
+        if (candidate && typeof jwk2.use === "string") {
+          candidate = jwk2.use === "sig";
+        }
+        if (candidate && Array.isArray(jwk2.key_ops)) {
+          candidate = jwk2.key_ops.includes("verify");
+        }
+        if (candidate) {
+          switch (alg) {
+            case "ES256":
+              candidate = jwk2.crv === "P-256";
+              break;
+            case "ES384":
+              candidate = jwk2.crv === "P-384";
+              break;
+            case "ES512":
+              candidate = jwk2.crv === "P-521";
+              break;
+            case "Ed25519":
+            case "EdDSA":
+              candidate = jwk2.crv === "Ed25519";
+              break;
+          }
+        }
+        return candidate;
+      });
+      const { 0: jwk, length } = candidates;
+      if (length === 0) {
+        throw new JWKSNoMatchingKey();
+      }
+      if (length !== 1) {
+        const error2 = new JWKSMultipleMatchingKeys();
+        const _cached = this.#cached;
+        error2[Symbol.asyncIterator] = async function* () {
+          for (const jwk2 of candidates) {
+            try {
+              yield await importWithAlgCache(_cached, jwk2, alg);
+            } catch {
+            }
+          }
+        };
+        throw error2;
+      }
+      return importWithAlgCache(this.#cached, jwk, alg);
+    }
+  };
+  async function importWithAlgCache(cache2, jwk, alg) {
+    const cached = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
+    if (cached[alg] === void 0) {
+      const key = await importJWK({ ...jwk, ext: true }, alg);
+      if (key instanceof Uint8Array || key.type !== "public") {
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      }
+      cached[alg] = key;
+    }
+    return cached[alg];
+  }
+  function createLocalJWKSet(jwks) {
+    const set = new LocalJWKSet(jwks);
+    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(localJWKSet, {
+      jwks: {
+        value: () => structuredClone(set.jwks()),
+        enumerable: false,
+        configurable: false,
+        writable: false
+      }
+    });
+    return localJWKSet;
+  }
+
+  // src/oidc.jwt.mjs
+  var jwksCache = /* @__PURE__ */ new WeakMap();
+  function keySetFor(jwks) {
+    if (!jwks || !Array.isArray(jwks.keys)) {
+      throw metroError("metro.oidc: Error: jwks must be an object with a keys array");
+    }
+    if (!jwksCache.has(jwks)) {
+      jwksCache.set(jwks, createLocalJWKSet(jwks));
+    }
+    return jwksCache.get(jwks);
+  }
+  function supportedAlgorithms(openidConfiguration = {}) {
+    const algorithms = openidConfiguration.id_token_signing_alg_values_supported;
+    if (Array.isArray(algorithms) && algorithms.length) {
+      return algorithms.filter((algorithm) => algorithm !== "none");
+    }
+    return ["RS256"];
+  }
+  async function validateIdToken(idToken2, options = {}) {
+    if (!idToken2) {
+      throw metroError("metro.oidc: Error: token response did not include an id_token");
+    }
+    if (!options.jwks) {
+      throw metroError("metro.oidc: Error: cannot validate id_token without jwks");
+    }
+    if (!options.issuer) {
+      throw metroError("metro.oidc: Error: cannot validate id_token without issuer");
+    }
+    if (!options.client_id) {
+      throw metroError("metro.oidc: Error: cannot validate id_token without client_id");
+    }
+    const { payload, protectedHeader } = await jwtVerify(
+      idToken2,
+      keySetFor(options.jwks),
+      {
+        issuer: options.issuer,
+        audience: options.client_id,
+        algorithms: options.algorithms || supportedAlgorithms(options.openid_configuration),
+        clockTolerance: options.clockTolerance ?? 60,
+        requiredClaims: ["iss", "sub", "aud", "exp", "iat"]
+      }
+    );
+    if (options.nonce !== void 0 && payload.nonce !== options.nonce) {
+      throw metroError("metro.oidc: Error: id_token nonce mismatch");
+    }
+    return {
+      header: protectedHeader,
+      claims: payload
+    };
+  }
+
   // src/oidcmw.mjs
   function oidcmw(options = {}) {
     const defaultOptions = {
@@ -2177,7 +3284,8 @@
         try {
           res = await next(req);
         } catch (err) {
-          if (res.status != 401 && res.status != 403) {
+          res = err?.cause;
+          if (!res || res.status != 401 && res.status != 403) {
             throw err;
           }
         }
@@ -2187,7 +3295,8 @@
       }
       if (!options.openid_configuration) {
         options.openid_configuration = await oidcDiscovery({
-          issuer: options.issuer
+          issuer: options.issuer,
+          client: options.client.with(options.issuer)
         });
         options.store.set("openid_configuration", options.openid_configuration);
       }
@@ -2197,11 +3306,14 @@
         }
         options.client_info = await register({
           registration_endpoint: options.openid_configuration.registration_endpoint,
+          client: options.client,
           client_info: options.client_info
         });
         options.store.set("client_info", options.client_info);
       }
       const scope = options.scope || "openid";
+      const nonce = options.nonce || generateCodeVerifier(32);
+      options.store.set("pending_nonce", nonce);
       const oauth2Options = Object.assign(
         {
           site: options.issuer,
@@ -2218,32 +3330,49 @@
             token_endpoint: options.openid_configuration.token_endpoint,
             scope,
             //FIXME: should only use scopes supported by server
-            redirect_uri: options.client_info.redirect_uris[0]
+            redirect_uri: options.client_info.redirect_uris[0],
+            nonce
           }
         }
         //...
       );
       const storeIdToken = async (req2, next2) => {
         const res2 = await next2(req2);
+        const tokenEndpoint = url(options.openid_configuration.token_endpoint, { hash: "" }).href;
+        const requestUrl = url(req2.url, { hash: "" }).href;
+        if (requestUrl !== tokenEndpoint) {
+          return res2;
+        }
         const contentType = res2.headers.get("content-type");
-        if (contentType?.startsWith("application/json")) {
-          let id_token = res2.data?.id_token;
-          if (!id_token) {
-            const res22 = res2.clone();
-            try {
-              let data = await res22.json();
-              if (data && data.id_token) {
-                id_token = data.id_token;
-              }
-            } catch (e) {
-            }
-          }
-          if (id_token) {
-            options.store.set("id_token", id_token);
-          }
+        if (!contentType?.startsWith("application/json")) {
+          return res2;
+        }
+        let data = res2.data && typeof res2.data === "object" ? res2.data : null;
+        if (!data) {
+          const res22 = res2.clone();
+          data = await res22.json();
         }
+        const id_token = data?.id_token;
+        const jwks = await getJwks();
+        const validation = await validateIdToken(id_token, {
+          issuer: options.openid_configuration.issuer,
+          client_id: options.client_info.client_id,
+          jwks,
+          openid_configuration: options.openid_configuration,
+          nonce: options.store.get("pending_nonce")
+        });
+        options.store.set("id_token", id_token);
+        options.store.set("id_token_claims", validation.claims);
         return res2;
       };
+      const getJwks = async () => {
+        if (!options.jwks) {
+          const jwksClient = options.client.with(throwermw()).with(jsonmw());
+          const response2 = await jwksClient.get(options.openid_configuration.jwks_uri);
+          options.jwks = response2.data;
+        }
+        return options.jwks;
+      };
       let oauth2client = options.client.with(options.issuer).with(storeIdToken);
       if (options.use_dpop) {
         const dpopOptions = {
@@ -2253,8 +3382,8 @@
           dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported
         };
         oauth2client = oauth2client.with(dpopmw(dpopOptions));
-        oauth2Options.client = oauth2client;
       }
+      oauth2Options.client = oauth2client;
       oauth2client = oauth2client.with(oauth2mw(oauth2Options));
       res = await oauth2client.fetch(req);
       return res;
@@ -2272,18 +3401,33 @@
     }
     return options.store.get("id_token");
   }
+  function idTokenClaims(options) {
+    if (!options.store) {
+      if (!options.issuer) {
+        throw metroError("Must supply options.issuer or options.store to get the id_token claims");
+      }
+      options.store = oidcStore(options.issuer);
+    }
+    return options.store.get("id_token_claims");
+  }
 
-  // src/browser.mjs
+  // src/index.mjs
   var oidc = {
     oidcmw,
     discover: oidcDiscovery,
     register,
     isRedirected: isRedirected2,
-    idToken
+    idToken,
+    idTokenClaims
   };
-  if (!globalThis.metro.oidc) {
-    globalThis.metro.oidc = oidc;
+  var index_default = oidc;
+
+  // src/browser.mjs
+  var metro = Object.assign({}, src_exports, globalThis.metro || {});
+  if (!metro.oidc) {
+    metro.oidc = index_default;
   }
-  var browser_default2 = oidc;
+  globalThis.metro = metro;
+  var browser_default = index_default;
 })();
 //# sourceMappingURL=browser.js.map