@openclaw/matrix 2026.5.20 → 2026.5.24-beta.1

package/node_modules/oidc-client-ts/dist/umd/oidc-client-ts.js

@@ -0,0 +1,3719 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AccessTokenEvents: () => AccessTokenEvents,
+  CheckSessionIFrame: () => CheckSessionIFrame,
+  DPoPState: () => DPoPState,
+  ErrorResponse: () => ErrorResponse,
+  ErrorTimeout: () => ErrorTimeout,
+  InMemoryWebStorage: () => InMemoryWebStorage,
+  IndexedDbDPoPStore: () => IndexedDbDPoPStore,
+  Log: () => Log,
+  Logger: () => Logger,
+  MetadataService: () => MetadataService,
+  OidcClient: () => OidcClient,
+  OidcClientSettingsStore: () => OidcClientSettingsStore,
+  SessionMonitor: () => SessionMonitor,
+  SigninResponse: () => SigninResponse,
+  SigninState: () => SigninState,
+  SignoutResponse: () => SignoutResponse,
+  State: () => State,
+  User: () => User,
+  UserManager: () => UserManager,
+  UserManagerSettingsStore: () => UserManagerSettingsStore,
+  Version: () => Version,
+  WebStorageStateStore: () => WebStorageStateStore
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/utils/Logger.ts
+var nopLogger = {
+  debug: () => void 0,
+  info: () => void 0,
+  warn: () => void 0,
+  error: () => void 0
+};
+var level;
+var logger;
+var Log = /* @__PURE__ */ ((Log2) => {
+  Log2[Log2["NONE"] = 0] = "NONE";
+  Log2[Log2["ERROR"] = 1] = "ERROR";
+  Log2[Log2["WARN"] = 2] = "WARN";
+  Log2[Log2["INFO"] = 3] = "INFO";
+  Log2[Log2["DEBUG"] = 4] = "DEBUG";
+  return Log2;
+})(Log || {});
+((Log2) => {
+  function reset() {
+    level = 3 /* INFO */;
+    logger = nopLogger;
+  }
+  Log2.reset = reset;
+  function setLevel(value) {
+    if (!(0 /* NONE */ <= value && value <= 4 /* DEBUG */)) {
+      throw new Error("Invalid log level");
+    }
+    level = value;
+  }
+  Log2.setLevel = setLevel;
+  function setLogger(value) {
+    logger = value;
+  }
+  Log2.setLogger = setLogger;
+})(Log || (Log = {}));
+var Logger = class _Logger {
+  constructor(_name) {
+    this._name = _name;
+  }
+  /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
+  debug(...args) {
+    if (level >= 4 /* DEBUG */) {
+      logger.debug(_Logger._format(this._name, this._method), ...args);
+    }
+  }
+  info(...args) {
+    if (level >= 3 /* INFO */) {
+      logger.info(_Logger._format(this._name, this._method), ...args);
+    }
+  }
+  warn(...args) {
+    if (level >= 2 /* WARN */) {
+      logger.warn(_Logger._format(this._name, this._method), ...args);
+    }
+  }
+  error(...args) {
+    if (level >= 1 /* ERROR */) {
+      logger.error(_Logger._format(this._name, this._method), ...args);
+    }
+  }
+  /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
+  throw(err) {
+    this.error(err);
+    throw err;
+  }
+  create(method) {
+    const methodLogger = Object.create(this);
+    methodLogger._method = method;
+    methodLogger.debug("begin");
+    return methodLogger;
+  }
+  static createStatic(name, staticMethod) {
+    const staticLogger = new _Logger(`${name}.${staticMethod}`);
+    staticLogger.debug("begin");
+    return staticLogger;
+  }
+  static _format(name, method) {
+    const prefix = `[${name}]`;
+    return method ? `${prefix} ${method}:` : prefix;
+  }
+  /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
+  // helpers for static class methods
+  static debug(name, ...args) {
+    if (level >= 4 /* DEBUG */) {
+      logger.debug(_Logger._format(name), ...args);
+    }
+  }
+  static info(name, ...args) {
+    if (level >= 3 /* INFO */) {
+      logger.info(_Logger._format(name), ...args);
+    }
+  }
+  static warn(name, ...args) {
+    if (level >= 2 /* WARN */) {
+      logger.warn(_Logger._format(name), ...args);
+    }
+  }
+  static error(name, ...args) {
+    if (level >= 1 /* ERROR */) {
+      logger.error(_Logger._format(name), ...args);
+    }
+  }
+  /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
+};
+Log.reset();
+
+// src/utils/JwtUtils.ts
+var import_jwt_decode = require("jwt-decode");
+var JwtUtils = class {
+  // IMPORTANT: doesn't validate the token
+  static decode(token) {
+    try {
+      return (0, import_jwt_decode.jwtDecode)(token);
+    } catch (err) {
+      Logger.error("JwtUtils.decode", err);
+      throw err;
+    }
+  }
+  static async generateSignedJwt(header, payload, privateKey) {
+    const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+    const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const encodedToken = `${encodedHeader}.${encodedPayload}`;
+    const signature = await window.crypto.subtle.sign(
+      {
+        name: "ECDSA",
+        hash: { name: "SHA-256" }
+      },
+      privateKey,
+      new TextEncoder().encode(encodedToken)
+    );
+    const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));
+    return `${encodedToken}.${encodedSignature}`;
+  }
+  static async generateSignedJwtWithHmac(header, payload, secretKey) {
+    const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+    const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const encodedToken = `${encodedHeader}.${encodedPayload}`;
+    const signature = await window.crypto.subtle.sign(
+      "HMAC",
+      secretKey,
+      new TextEncoder().encode(encodedToken)
+    );
+    const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));
+    return `${encodedToken}.${encodedSignature}`;
+  }
+};
+
+// src/utils/CryptoUtils.ts
+var UUID_V4_TEMPLATE = "10000000-1000-4000-8000-100000000000";
+var toBase64 = (val) => btoa([...new Uint8Array(val)].map((chr) => String.fromCharCode(chr)).join(""));
+var _CryptoUtils = class _CryptoUtils {
+  static _randomWord() {
+    const arr = new Uint32Array(1);
+    crypto.getRandomValues(arr);
+    return arr[0];
+  }
+  /**
+   * Generates RFC4122 version 4 guid
+   */
+  static generateUUIDv4() {
+    const uuid = UUID_V4_TEMPLATE.replace(
+      /[018]/g,
+      (c) => (+c ^ _CryptoUtils._randomWord() & 15 >> +c / 4).toString(16)
+    );
+    return uuid.replace(/-/g, "");
+  }
+  /**
+   * PKCE: Generate a code verifier
+   */
+  static generateCodeVerifier() {
+    return _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4();
+  }
+  /**
+   * PKCE: Generate a code challenge
+   */
+  static async generateCodeChallenge(code_verifier) {
+    if (!crypto.subtle) {
+      throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");
+    }
+    try {
+      const encoder = new TextEncoder();
+      const data = encoder.encode(code_verifier);
+      const hashed = await crypto.subtle.digest("SHA-256", data);
+      return toBase64(hashed).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    } catch (err) {
+      Logger.error("CryptoUtils.generateCodeChallenge", err);
+      throw err;
+    }
+  }
+  /**
+   * Generates a base64-encoded string for a basic auth header
+   */
+  static generateBasicAuth(client_id, client_secret) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode([client_id, client_secret].join(":"));
+    return toBase64(data);
+  }
+  /**
+   * Generates a hash of a string using a given algorithm
+   * @param alg
+   * @param message
+   */
+  static async hash(alg, message) {
+    const msgUint8 = new TextEncoder().encode(message);
+    const hashBuffer = await crypto.subtle.digest(alg, msgUint8);
+    return new Uint8Array(hashBuffer);
+  }
+  /**
+   * Generates a rfc7638 compliant jwk thumbprint
+   * @param jwk
+   */
+  static async customCalculateJwkThumbprint(jwk) {
+    let jsonObject;
+    switch (jwk.kty) {
+      case "RSA":
+        jsonObject = {
+          "e": jwk.e,
+          "kty": jwk.kty,
+          "n": jwk.n
+        };
+        break;
+      case "EC":
+        jsonObject = {
+          "crv": jwk.crv,
+          "kty": jwk.kty,
+          "x": jwk.x,
+          "y": jwk.y
+        };
+        break;
+      case "OKP":
+        jsonObject = {
+          "crv": jwk.crv,
+          "kty": jwk.kty,
+          "x": jwk.x
+        };
+        break;
+      case "oct":
+        jsonObject = {
+          "crv": jwk.k,
+          "kty": jwk.kty
+        };
+        break;
+      default:
+        throw new Error("Unknown jwk type");
+    }
+    const utf8encodedAndHashed = await _CryptoUtils.hash("SHA-256", JSON.stringify(jsonObject));
+    return _CryptoUtils.encodeBase64Url(utf8encodedAndHashed);
+  }
+  static async generateDPoPProof({
+    url,
+    accessToken,
+    httpMethod,
+    keyPair,
+    nonce
+  }) {
+    let hashedToken;
+    let encodedHash;
+    const payload = {
+      "jti": window.crypto.randomUUID(),
+      "htm": httpMethod != null ? httpMethod : "GET",
+      "htu": url,
+      "iat": Math.floor(Date.now() / 1e3)
+    };
+    if (accessToken) {
+      hashedToken = await _CryptoUtils.hash("SHA-256", accessToken);
+      encodedHash = _CryptoUtils.encodeBase64Url(hashedToken);
+      payload.ath = encodedHash;
+    }
+    if (nonce) {
+      payload.nonce = nonce;
+    }
+    try {
+      const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+      const header = {
+        "alg": "ES256",
+        "typ": "dpop+jwt",
+        "jwk": {
+          "crv": publicJwk.crv,
+          "kty": publicJwk.kty,
+          "x": publicJwk.x,
+          "y": publicJwk.y
+        }
+      };
+      return await JwtUtils.generateSignedJwt(header, payload, keyPair.privateKey);
+    } catch (err) {
+      if (err instanceof TypeError) {
+        throw new Error(`Error exporting dpop public key: ${err.message}`);
+      } else {
+        throw err;
+      }
+    }
+  }
+  static async generateDPoPJkt(keyPair) {
+    try {
+      const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+      return await _CryptoUtils.customCalculateJwkThumbprint(publicJwk);
+    } catch (err) {
+      if (err instanceof TypeError) {
+        throw new Error(`Could not retrieve dpop keys from storage: ${err.message}`);
+      } else {
+        throw err;
+      }
+    }
+  }
+  static async generateDPoPKeys() {
+    return await window.crypto.subtle.generateKey(
+      {
+        name: "ECDSA",
+        namedCurve: "P-256"
+      },
+      false,
+      ["sign", "verify"]
+    );
+  }
+  /**
+   * Generates a client assertion JWT for client_secret_jwt authentication
+   * @param client_id The client identifier
+   * @param client_secret The client secret
+   * @param audience The token endpoint URL (audience)
+   * @param algorithm The HMAC algorithm to use (HS256, HS384, HS512). Defaults to HS256
+   */
+  static async generateClientAssertionJwt(client_id, client_secret, audience, algorithm = "HS256") {
+    const now = Math.floor(Date.now() / 1e3);
+    const header = {
+      "alg": algorithm,
+      "typ": "JWT"
+    };
+    const payload = {
+      "iss": client_id,
+      "sub": client_id,
+      "aud": audience,
+      "jti": _CryptoUtils.generateUUIDv4(),
+      "exp": now + 300,
+      // 5 minutes
+      "iat": now
+    };
+    const hashMap = {
+      "HS256": "SHA-256",
+      "HS384": "SHA-384",
+      "HS512": "SHA-512"
+    };
+    const hashFunction = hashMap[algorithm];
+    if (!hashFunction) {
+      throw new Error(`Unsupported algorithm: ${algorithm}. Supported algorithms are: HS256, HS384, HS512`);
+    }
+    const encoder = new TextEncoder();
+    const secretKey = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(client_secret),
+      { name: "HMAC", hash: hashFunction },
+      false,
+      ["sign"]
+    );
+    return await JwtUtils.generateSignedJwtWithHmac(header, payload, secretKey);
+  }
+};
+/**
+ * Generates a base64url encoded string
+ */
+_CryptoUtils.encodeBase64Url = (input) => {
+  return toBase64(input).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+};
+var CryptoUtils = _CryptoUtils;
+
+// src/utils/Event.ts
+var Event = class {
+  constructor(_name) {
+    this._name = _name;
+    this._callbacks = [];
+    this._logger = new Logger(`Event('${this._name}')`);
+  }
+  addHandler(cb) {
+    this._callbacks.push(cb);
+    return () => this.removeHandler(cb);
+  }
+  removeHandler(cb) {
+    const idx = this._callbacks.lastIndexOf(cb);
+    if (idx >= 0) {
+      this._callbacks.splice(idx, 1);
+    }
+  }
+  async raise(...ev) {
+    this._logger.debug("raise:", ...ev);
+    for (const cb of this._callbacks) {
+      await cb(...ev);
+    }
+  }
+};
+
+// src/utils/PopupUtils.ts
+var PopupUtils = class {
+  /**
+   * Populates a map of window features with a placement centered in front of
+   * the current window. If no explicit width is given, a default value is
+   * binned into [800, 720, 600, 480, 360] based on the current window's width.
+   */
+  static center({ ...features }) {
+    var _a, _b, _c;
+    if (features.width == null)
+      features.width = (_a = [800, 720, 600, 480].find((width) => width <= window.outerWidth / 1.618)) != null ? _a : 360;
+    (_b = features.left) != null ? _b : features.left = Math.max(0, Math.round(window.screenX + (window.outerWidth - features.width) / 2));
+    if (features.height != null)
+      (_c = features.top) != null ? _c : features.top = Math.max(0, Math.round(window.screenY + (window.outerHeight - features.height) / 2));
+    return features;
+  }
+  static serialize(features) {
+    return Object.entries(features).filter(([, value]) => value != null).map(([key, value]) => `${key}=${typeof value !== "boolean" ? value : value ? "yes" : "no"}`).join(",");
+  }
+};
+
+// src/utils/Timer.ts
+var Timer = class _Timer extends Event {
+  constructor() {
+    super(...arguments);
+    this._logger = new Logger(`Timer('${this._name}')`);
+    this._timerHandle = null;
+    this._expiration = 0;
+    this._callback = () => {
+      const diff = this._expiration - _Timer.getEpochTime();
+      this._logger.debug("timer completes in", diff);
+      if (this._expiration <= _Timer.getEpochTime()) {
+        this.cancel();
+        void super.raise();
+      }
+    };
+  }
+  // get the time
+  static getEpochTime() {
+    return Math.floor(Date.now() / 1e3);
+  }
+  init(durationInSeconds) {
+    const logger2 = this._logger.create("init");
+    durationInSeconds = Math.max(Math.floor(durationInSeconds), 1);
+    const expiration = _Timer.getEpochTime() + durationInSeconds;
+    if (this.expiration === expiration && this._timerHandle) {
+      logger2.debug("skipping since already initialized for expiration at", this.expiration);
+      return;
+    }
+    this.cancel();
+    logger2.debug("using duration", durationInSeconds);
+    this._expiration = expiration;
+    const timerDurationInSeconds = Math.min(durationInSeconds, 5);
+    this._timerHandle = setInterval(this._callback, timerDurationInSeconds * 1e3);
+  }
+  get expiration() {
+    return this._expiration;
+  }
+  cancel() {
+    this._logger.create("cancel");
+    if (this._timerHandle) {
+      clearInterval(this._timerHandle);
+      this._timerHandle = null;
+    }
+  }
+};
+
+// src/utils/UrlUtils.ts
+var UrlUtils = class {
+  static readParams(url, responseMode = "query") {
+    if (!url) throw new TypeError("Invalid URL");
+    const parsedUrl = new URL(url, "http://127.0.0.1");
+    const params = parsedUrl[responseMode === "fragment" ? "hash" : "search"];
+    return new URLSearchParams(params.slice(1));
+  }
+};
+var URL_STATE_DELIMITER = ";";
+
+// src/errors/ErrorResponse.ts
+var ErrorResponse = class extends Error {
+  constructor(args, form) {
+    var _a, _b, _c;
+    super(args.error_description || args.error || "");
+    this.form = form;
+    /** Marker to detect class: "ErrorResponse" */
+    this.name = "ErrorResponse";
+    if (!args.error) {
+      Logger.error("ErrorResponse", "No error passed");
+      throw new Error("No error passed");
+    }
+    this.error = args.error;
+    this.error_description = (_a = args.error_description) != null ? _a : null;
+    this.error_uri = (_b = args.error_uri) != null ? _b : null;
+    this.state = args.userState;
+    this.session_state = (_c = args.session_state) != null ? _c : null;
+    this.url_state = args.url_state;
+  }
+};
+
+// src/errors/ErrorTimeout.ts
+var ErrorTimeout = class extends Error {
+  constructor(message) {
+    super(message);
+    /** Marker to detect class: "ErrorTimeout" */
+    this.name = "ErrorTimeout";
+  }
+};
+
+// src/AccessTokenEvents.ts
+var AccessTokenEvents = class {
+  constructor(args) {
+    this._logger = new Logger("AccessTokenEvents");
+    this._expiringTimer = new Timer("Access token expiring");
+    this._expiredTimer = new Timer("Access token expired");
+    this._expiringNotificationTimeInSeconds = args.expiringNotificationTimeInSeconds;
+  }
+  async load(container) {
+    const logger2 = this._logger.create("load");
+    if (container.access_token && container.expires_in !== void 0) {
+      const duration = container.expires_in;
+      logger2.debug("access token present, remaining duration:", duration);
+      if (duration > 0) {
+        let expiring = duration - this._expiringNotificationTimeInSeconds;
+        if (expiring <= 0) {
+          expiring = 1;
+        }
+        logger2.debug("registering expiring timer, raising in", expiring, "seconds");
+        this._expiringTimer.init(expiring);
+      } else {
+        logger2.debug("canceling existing expiring timer because we're past expiration.");
+        this._expiringTimer.cancel();
+      }
+      const expired = duration + 1;
+      logger2.debug("registering expired timer, raising in", expired, "seconds");
+      this._expiredTimer.init(expired);
+    } else {
+      this._expiringTimer.cancel();
+      this._expiredTimer.cancel();
+    }
+  }
+  async unload() {
+    this._logger.debug("unload: canceling existing access token timers");
+    this._expiringTimer.cancel();
+    this._expiredTimer.cancel();
+  }
+  /**
+   * Add callback: Raised prior to the access token expiring.
+   */
+  addAccessTokenExpiring(cb) {
+    return this._expiringTimer.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised prior to the access token expiring.
+   */
+  removeAccessTokenExpiring(cb) {
+    this._expiringTimer.removeHandler(cb);
+  }
+  /**
+   * Add callback: Raised after the access token has expired.
+   */
+  addAccessTokenExpired(cb) {
+    return this._expiredTimer.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised after the access token has expired.
+   */
+  removeAccessTokenExpired(cb) {
+    this._expiredTimer.removeHandler(cb);
+  }
+};
+
+// src/CheckSessionIFrame.ts
+var CheckSessionIFrame = class {
+  constructor(_callback, _client_id, url, _intervalInSeconds, _stopOnError) {
+    this._callback = _callback;
+    this._client_id = _client_id;
+    this._intervalInSeconds = _intervalInSeconds;
+    this._stopOnError = _stopOnError;
+    this._logger = new Logger("CheckSessionIFrame");
+    this._timer = null;
+    this._session_state = null;
+    this._message = (e) => {
+      if (e.origin === this._frame_origin && e.source === this._frame.contentWindow) {
+        if (e.data === "error") {
+          this._logger.error("error message from check session op iframe");
+          if (this._stopOnError) {
+            this.stop();
+          }
+        } else if (e.data === "changed") {
+          this._logger.debug("changed message from check session op iframe");
+          this.stop();
+          void this._callback();
+        } else {
+          this._logger.debug(e.data + " message from check session op iframe");
+        }
+      }
+    };
+    const parsedUrl = new URL(url);
+    this._frame_origin = parsedUrl.origin;
+    this._frame = window.document.createElement("iframe");
+    this._frame.style.visibility = "hidden";
+    this._frame.style.position = "fixed";
+    this._frame.style.left = "-1000px";
+    this._frame.style.top = "0";
+    this._frame.width = "0";
+    this._frame.height = "0";
+    this._frame.src = parsedUrl.href;
+  }
+  load() {
+    return new Promise((resolve) => {
+      this._frame.onload = () => {
+        resolve();
+      };
+      window.document.body.appendChild(this._frame);
+      window.addEventListener("message", this._message, false);
+    });
+  }
+  start(session_state) {
+    if (this._session_state === session_state) {
+      return;
+    }
+    this._logger.create("start");
+    this.stop();
+    this._session_state = session_state;
+    const send = () => {
+      if (!this._frame.contentWindow || !this._session_state) {
+        return;
+      }
+      this._frame.contentWindow.postMessage(this._client_id + " " + this._session_state, this._frame_origin);
+    };
+    send();
+    this._timer = setInterval(send, this._intervalInSeconds * 1e3);
+  }
+  stop() {
+    this._logger.create("stop");
+    this._session_state = null;
+    if (this._timer) {
+      clearInterval(this._timer);
+      this._timer = null;
+    }
+  }
+};
+
+// src/InMemoryWebStorage.ts
+var InMemoryWebStorage = class {
+  constructor() {
+    this._logger = new Logger("InMemoryWebStorage");
+    this._data = {};
+  }
+  clear() {
+    this._logger.create("clear");
+    this._data = {};
+  }
+  getItem(key) {
+    this._logger.create(`getItem('${key}')`);
+    return this._data[key];
+  }
+  setItem(key, value) {
+    this._logger.create(`setItem('${key}')`);
+    this._data[key] = value;
+  }
+  removeItem(key) {
+    this._logger.create(`removeItem('${key}')`);
+    delete this._data[key];
+  }
+  get length() {
+    return Object.getOwnPropertyNames(this._data).length;
+  }
+  key(index) {
+    return Object.getOwnPropertyNames(this._data)[index];
+  }
+};
+
+// src/errors/ErrorDPoPNonce.ts
+var ErrorDPoPNonce = class extends Error {
+  constructor(nonce, message) {
+    super(message);
+    /** Marker to detect class: "ErrorDPoPNonce" */
+    this.name = "ErrorDPoPNonce";
+    this.nonce = nonce;
+  }
+};
+
+// src/JsonService.ts
+var JsonService = class {
+  constructor(additionalContentTypes = [], _jwtHandler = null, _extraHeaders = {}) {
+    this._jwtHandler = _jwtHandler;
+    this._extraHeaders = _extraHeaders;
+    this._logger = new Logger("JsonService");
+    this._contentTypes = [];
+    this._contentTypes.push(...additionalContentTypes, "application/json");
+    if (_jwtHandler) {
+      this._contentTypes.push("application/jwt");
+    }
+  }
+  async fetchWithTimeout(input, init = {}) {
+    const { timeoutInSeconds, ...initFetch } = init;
+    if (!timeoutInSeconds) {
+      return await fetch(input, initFetch);
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutInSeconds * 1e3);
+    try {
+      const response = await fetch(input, {
+        ...init,
+        signal: controller.signal
+      });
+      return response;
+    } catch (err) {
+      if (err instanceof DOMException && err.name === "AbortError") {
+        throw new ErrorTimeout("Network timed out");
+      }
+      throw err;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  async getJson(url, {
+    token,
+    credentials,
+    timeoutInSeconds
+  } = {}) {
+    const logger2 = this._logger.create("getJson");
+    const headers = {
+      "Accept": this._contentTypes.join(", ")
+    };
+    if (token) {
+      logger2.debug("token passed, setting Authorization header");
+      headers["Authorization"] = "Bearer " + token;
+    }
+    this._appendExtraHeaders(headers);
+    let response;
+    try {
+      logger2.debug("url:", url);
+      response = await this.fetchWithTimeout(url, { method: "GET", headers, timeoutInSeconds, credentials });
+    } catch (err) {
+      logger2.error("Network Error");
+      throw err;
+    }
+    logger2.debug("HTTP response received, status", response.status);
+    const contentType = response.headers.get("Content-Type");
+    if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {
+      logger2.throw(new Error(`Invalid response Content-Type: ${contentType != null ? contentType : "undefined"}, from URL: ${url}`));
+    }
+    if (response.ok && this._jwtHandler && (contentType == null ? void 0 : contentType.startsWith("application/jwt"))) {
+      return await this._jwtHandler(await response.text());
+    }
+    let json;
+    try {
+      json = await response.json();
+    } catch (err) {
+      logger2.error("Error parsing JSON response", err);
+      if (response.ok) throw err;
+      throw new Error(`${response.statusText} (${response.status})`);
+    }
+    if (!response.ok) {
+      logger2.error("Error from server:", json);
+      if (json.error) {
+        throw new ErrorResponse(json);
+      }
+      throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);
+    }
+    return json;
+  }
+  async postForm(url, {
+    body,
+    basicAuth,
+    timeoutInSeconds,
+    initCredentials,
+    extraHeaders
+  }) {
+    const logger2 = this._logger.create("postForm");
+    const headers = {
+      "Accept": this._contentTypes.join(", "),
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...extraHeaders
+    };
+    if (basicAuth !== void 0) {
+      headers["Authorization"] = "Basic " + basicAuth;
+    }
+    this._appendExtraHeaders(headers);
+    let response;
+    try {
+      logger2.debug("url:", url);
+      response = await this.fetchWithTimeout(url, { method: "POST", headers, body, timeoutInSeconds, credentials: initCredentials });
+    } catch (err) {
+      logger2.error("Network error");
+      throw err;
+    }
+    logger2.debug("HTTP response received, status", response.status);
+    const contentType = response.headers.get("Content-Type");
+    if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {
+      throw new Error(`Invalid response Content-Type: ${contentType != null ? contentType : "undefined"}, from URL: ${url}`);
+    }
+    const responseText = await response.text();
+    let json = {};
+    if (responseText) {
+      try {
+        json = JSON.parse(responseText);
+      } catch (err) {
+        logger2.error("Error parsing JSON response", err);
+        if (response.ok) throw err;
+        throw new Error(`${response.statusText} (${response.status})`);
+      }
+    }
+    if (!response.ok) {
+      logger2.error("Error from server:", json);
+      if (response.headers.has("dpop-nonce")) {
+        const nonce = response.headers.get("dpop-nonce");
+        throw new ErrorDPoPNonce(nonce, `${JSON.stringify(json)}`);
+      }
+      if (json.error) {
+        throw new ErrorResponse(json, body);
+      }
+      throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);
+    }
+    return json;
+  }
+  _appendExtraHeaders(headers) {
+    const logger2 = this._logger.create("appendExtraHeaders");
+    const customKeys = Object.keys(this._extraHeaders);
+    const protectedHeaders = [
+      "accept",
+      "content-type"
+    ];
+    const preventOverride = [
+      "authorization"
+    ];
+    if (customKeys.length === 0) {
+      return;
+    }
+    customKeys.forEach((headerName) => {
+      if (protectedHeaders.includes(headerName.toLocaleLowerCase())) {
+        logger2.warn("Protected header could not be set", headerName, protectedHeaders);
+        return;
+      }
+      if (preventOverride.includes(headerName.toLocaleLowerCase()) && Object.keys(headers).includes(headerName)) {
+        logger2.warn("Header could not be overridden", headerName, preventOverride);
+        return;
+      }
+      const content = typeof this._extraHeaders[headerName] === "function" ? this._extraHeaders[headerName]() : this._extraHeaders[headerName];
+      if (content && content !== "") {
+        headers[headerName] = content;
+      }
+    });
+  }
+};
+
+// src/MetadataService.ts
+var MetadataService = class {
+  constructor(_settings) {
+    this._settings = _settings;
+    this._logger = new Logger("MetadataService");
+    this._signingKeys = null;
+    this._metadata = null;
+    this._metadataUrl = this._settings.metadataUrl;
+    this._jsonService = new JsonService(
+      ["application/jwk-set+json"],
+      null,
+      this._settings.extraHeaders
+    );
+    if (this._settings.signingKeys) {
+      this._logger.debug("using signingKeys from settings");
+      this._signingKeys = this._settings.signingKeys;
+    }
+    if (this._settings.metadata) {
+      this._logger.debug("using metadata from settings");
+      this._metadata = this._settings.metadata;
+    }
+    if (this._settings.fetchRequestCredentials) {
+      this._logger.debug("using fetchRequestCredentials from settings");
+      this._fetchRequestCredentials = this._settings.fetchRequestCredentials;
+    }
+  }
+  resetSigningKeys() {
+    this._signingKeys = null;
+  }
+  async getMetadata() {
+    const logger2 = this._logger.create("getMetadata");
+    if (this._metadata) {
+      logger2.debug("using cached values");
+      return this._metadata;
+    }
+    if (!this._metadataUrl) {
+      logger2.throw(new Error("No authority or metadataUrl configured on settings"));
+      throw null;
+    }
+    logger2.debug("getting metadata from", this._metadataUrl);
+    const metadata = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });
+    logger2.debug("merging remote JSON with seed metadata");
+    this._metadata = Object.assign({}, metadata, this._settings.metadataSeed);
+    return this._metadata;
+  }
+  getIssuer() {
+    return this._getMetadataProperty("issuer");
+  }
+  getAuthorizationEndpoint() {
+    return this._getMetadataProperty("authorization_endpoint");
+  }
+  getUserInfoEndpoint() {
+    return this._getMetadataProperty("userinfo_endpoint");
+  }
+  getTokenEndpoint(optional = true) {
+    return this._getMetadataProperty("token_endpoint", optional);
+  }
+  getCheckSessionIframe() {
+    return this._getMetadataProperty("check_session_iframe", true);
+  }
+  getEndSessionEndpoint() {
+    return this._getMetadataProperty("end_session_endpoint", true);
+  }
+  getRevocationEndpoint(optional = true) {
+    return this._getMetadataProperty("revocation_endpoint", optional);
+  }
+  getKeysEndpoint(optional = true) {
+    return this._getMetadataProperty("jwks_uri", optional);
+  }
+  async _getMetadataProperty(name, optional = false) {
+    const logger2 = this._logger.create(`_getMetadataProperty('${name}')`);
+    const metadata = await this.getMetadata();
+    logger2.debug("resolved");
+    if (metadata[name] === void 0) {
+      if (optional === true) {
+        logger2.warn("Metadata does not contain optional property");
+        return void 0;
+      }
+      logger2.throw(new Error("Metadata does not contain property " + name));
+    }
+    return metadata[name];
+  }
+  async getSigningKeys() {
+    const logger2 = this._logger.create("getSigningKeys");
+    if (this._signingKeys) {
+      logger2.debug("returning signingKeys from cache");
+      return this._signingKeys;
+    }
+    const jwks_uri = await this.getKeysEndpoint(false);
+    logger2.debug("got jwks_uri", jwks_uri);
+    const keySet = await this._jsonService.getJson(jwks_uri, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });
+    logger2.debug("got key set", keySet);
+    if (!Array.isArray(keySet.keys)) {
+      logger2.throw(new Error("Missing keys on keyset"));
+      throw null;
+    }
+    this._signingKeys = keySet.keys;
+    return this._signingKeys;
+  }
+};
+
+// src/WebStorageStateStore.ts
+var WebStorageStateStore = class {
+  constructor({
+    prefix = "oidc.",
+    store = localStorage
+  } = {}) {
+    this._logger = new Logger("WebStorageStateStore");
+    this._store = store;
+    this._prefix = prefix;
+  }
+  async set(key, value) {
+    this._logger.create(`set('${key}')`);
+    key = this._prefix + key;
+    await this._store.setItem(key, value);
+  }
+  async get(key) {
+    this._logger.create(`get('${key}')`);
+    key = this._prefix + key;
+    const item = await this._store.getItem(key);
+    return item;
+  }
+  async remove(key) {
+    this._logger.create(`remove('${key}')`);
+    key = this._prefix + key;
+    const item = await this._store.getItem(key);
+    await this._store.removeItem(key);
+    return item;
+  }
+  async getAllKeys() {
+    this._logger.create("getAllKeys");
+    const len = await this._store.length;
+    const keys = [];
+    for (let index = 0; index < len; index++) {
+      const key = await this._store.key(index);
+      if (key && key.indexOf(this._prefix) === 0) {
+        keys.push(key.substr(this._prefix.length));
+      }
+    }
+    return keys;
+  }
+};
+
+// src/OidcClientSettings.ts
+var DefaultResponseType = "code";
+var DefaultScope = "openid";
+var DefaultClientAuthentication = "client_secret_post";
+var DefaultStaleStateAgeInSeconds = 60 * 15;
+var OidcClientSettingsStore = class {
+  constructor({
+    // metadata related
+    authority,
+    metadataUrl,
+    metadata,
+    signingKeys,
+    metadataSeed,
+    // client related
+    client_id,
+    client_secret,
+    response_type = DefaultResponseType,
+    scope = DefaultScope,
+    redirect_uri,
+    post_logout_redirect_uri,
+    client_authentication = DefaultClientAuthentication,
+    token_endpoint_auth_signing_alg = "HS256",
+    // optional protocol
+    prompt,
+    display,
+    max_age,
+    ui_locales,
+    acr_values,
+    resource,
+    response_mode,
+    // behavior flags
+    filterProtocolClaims = true,
+    loadUserInfo = false,
+    requestTimeoutInSeconds,
+    staleStateAgeInSeconds = DefaultStaleStateAgeInSeconds,
+    mergeClaimsStrategy = { array: "replace" },
+    disablePKCE = false,
+    // other behavior
+    stateStore,
+    revokeTokenAdditionalContentTypes,
+    fetchRequestCredentials,
+    refreshTokenAllowedScope,
+    // extra
+    extraQueryParams = {},
+    extraTokenParams = {},
+    extraHeaders = {},
+    dpop,
+    omitScopeWhenRequesting = false
+  }) {
+    var _a;
+    this.authority = authority;
+    if (metadataUrl) {
+      this.metadataUrl = metadataUrl;
+    } else {
+      this.metadataUrl = authority;
+      if (authority) {
+        if (!this.metadataUrl.endsWith("/")) {
+          this.metadataUrl += "/";
+        }
+        this.metadataUrl += ".well-known/openid-configuration";
+      }
+    }
+    this.metadata = metadata;
+    this.metadataSeed = metadataSeed;
+    this.signingKeys = signingKeys;
+    this.client_id = client_id;
+    this.client_secret = client_secret;
+    this.response_type = response_type;
+    this.scope = scope;
+    this.redirect_uri = redirect_uri;
+    this.post_logout_redirect_uri = post_logout_redirect_uri;
+    this.client_authentication = client_authentication;
+    this.token_endpoint_auth_signing_alg = token_endpoint_auth_signing_alg;
+    this.prompt = prompt;
+    this.display = display;
+    this.max_age = max_age;
+    this.ui_locales = ui_locales;
+    this.acr_values = acr_values;
+    this.resource = resource;
+    this.response_mode = response_mode;
+    this.filterProtocolClaims = filterProtocolClaims != null ? filterProtocolClaims : true;
+    this.loadUserInfo = !!loadUserInfo;
+    this.staleStateAgeInSeconds = staleStateAgeInSeconds;
+    this.mergeClaimsStrategy = mergeClaimsStrategy;
+    this.omitScopeWhenRequesting = omitScopeWhenRequesting;
+    this.disablePKCE = !!disablePKCE;
+    this.revokeTokenAdditionalContentTypes = revokeTokenAdditionalContentTypes;
+    this.fetchRequestCredentials = fetchRequestCredentials ? fetchRequestCredentials : "same-origin";
+    this.requestTimeoutInSeconds = requestTimeoutInSeconds;
+    if (stateStore) {
+      this.stateStore = stateStore;
+    } else {
+      const store = typeof window !== "undefined" ? window.localStorage : new InMemoryWebStorage();
+      this.stateStore = new WebStorageStateStore({ store });
+    }
+    this.refreshTokenAllowedScope = refreshTokenAllowedScope;
+    this.extraQueryParams = extraQueryParams;
+    this.extraTokenParams = extraTokenParams;
+    this.extraHeaders = extraHeaders;
+    this.dpop = dpop;
+    if (this.dpop && !((_a = this.dpop) == null ? void 0 : _a.store)) {
+      throw new Error("A DPoPStore is required when dpop is enabled");
+    }
+  }
+};
+
+// src/UserInfoService.ts
+var UserInfoService = class {
+  constructor(_settings, _metadataService) {
+    this._settings = _settings;
+    this._metadataService = _metadataService;
+    this._logger = new Logger("UserInfoService");
+    this._getClaimsFromJwt = async (responseText) => {
+      const logger2 = this._logger.create("_getClaimsFromJwt");
+      try {
+        const payload = JwtUtils.decode(responseText);
+        logger2.debug("JWT decoding successful");
+        return payload;
+      } catch (err) {
+        logger2.error("Error parsing JWT response");
+        throw err;
+      }
+    };
+    this._jsonService = new JsonService(
+      void 0,
+      this._getClaimsFromJwt,
+      this._settings.extraHeaders
+    );
+  }
+  async getClaims(token) {
+    const logger2 = this._logger.create("getClaims");
+    if (!token) {
+      this._logger.throw(new Error("No token passed"));
+    }
+    const url = await this._metadataService.getUserInfoEndpoint();
+    logger2.debug("got userinfo url", url);
+    const claims = await this._jsonService.getJson(url, {
+      token,
+      credentials: this._settings.fetchRequestCredentials,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds
+    });
+    logger2.debug("got claims", claims);
+    return claims;
+  }
+};
+
+// src/TokenClient.ts
+var TokenClient = class {
+  constructor(_settings, _metadataService) {
+    this._settings = _settings;
+    this._metadataService = _metadataService;
+    this._logger = new Logger("TokenClient");
+    this._jsonService = new JsonService(
+      this._settings.revokeTokenAdditionalContentTypes,
+      null,
+      this._settings.extraHeaders
+    );
+  }
+  /**
+   * Exchange code.
+   *
+   * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
+   */
+  async exchangeCode({
+    grant_type = "authorization_code",
+    redirect_uri = this._settings.redirect_uri,
+    client_id = this._settings.client_id,
+    client_secret = this._settings.client_secret,
+    extraHeaders,
+    ...args
+  }) {
+    const logger2 = this._logger.create("exchangeCode");
+    if (!client_id) {
+      logger2.throw(new Error("A client_id is required"));
+    }
+    if (!redirect_uri) {
+      logger2.throw(new Error("A redirect_uri is required"));
+    }
+    if (!args.code) {
+      logger2.throw(new Error("A code is required"));
+    }
+    const params = new URLSearchParams({ grant_type, redirect_uri });
+    for (const [key, value] of Object.entries(args)) {
+      if (value != null) {
+        params.set(key, value);
+      }
+    }
+    if ((this._settings.client_authentication === "client_secret_basic" || this._settings.client_authentication === "client_secret_jwt") && (client_secret === void 0 || client_secret === null)) {
+      logger2.throw(new Error("A client_secret is required"));
+      throw null;
+    }
+    let basicAuth;
+    const url = await this._metadataService.getTokenEndpoint(false);
+    switch (this._settings.client_authentication) {
+      case "client_secret_basic":
+        basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);
+        break;
+      case "client_secret_post":
+        params.append("client_id", client_id);
+        if (client_secret) {
+          params.append("client_secret", client_secret);
+        }
+        break;
+      case "client_secret_jwt": {
+        const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);
+        params.append("client_id", client_id);
+        params.append("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+        params.append("client_assertion", clientAssertion);
+        break;
+      }
+    }
+    logger2.debug("got token endpoint");
+    const response = await this._jsonService.postForm(url, {
+      body: params,
+      basicAuth,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds,
+      initCredentials: this._settings.fetchRequestCredentials,
+      extraHeaders
+    });
+    logger2.debug("got response");
+    return response;
+  }
+  /**
+   * Exchange credentials.
+   *
+   * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2
+   */
+  async exchangeCredentials({
+    grant_type = "password",
+    client_id = this._settings.client_id,
+    client_secret = this._settings.client_secret,
+    scope = this._settings.scope,
+    ...args
+  }) {
+    const logger2 = this._logger.create("exchangeCredentials");
+    if (!client_id) {
+      logger2.throw(new Error("A client_id is required"));
+    }
+    const params = new URLSearchParams({ grant_type });
+    if (!this._settings.omitScopeWhenRequesting) {
+      params.set("scope", scope);
+    }
+    for (const [key, value] of Object.entries(args)) {
+      if (value != null) {
+        params.set(key, value);
+      }
+    }
+    if ((this._settings.client_authentication === "client_secret_basic" || this._settings.client_authentication === "client_secret_jwt") && (client_secret === void 0 || client_secret === null)) {
+      logger2.throw(new Error("A client_secret is required"));
+      throw null;
+    }
+    let basicAuth;
+    const url = await this._metadataService.getTokenEndpoint(false);
+    switch (this._settings.client_authentication) {
+      case "client_secret_basic":
+        basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);
+        break;
+      case "client_secret_post":
+        params.append("client_id", client_id);
+        if (client_secret) {
+          params.append("client_secret", client_secret);
+        }
+        break;
+      case "client_secret_jwt": {
+        const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);
+        params.append("client_id", client_id);
+        params.append("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+        params.append("client_assertion", clientAssertion);
+        break;
+      }
+    }
+    logger2.debug("got token endpoint");
+    const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });
+    logger2.debug("got response");
+    return response;
+  }
+  /**
+   * Exchange a refresh token.
+   *
+   * @see https://www.rfc-editor.org/rfc/rfc6749#section-6
+   */
+  async exchangeRefreshToken({
+    grant_type = "refresh_token",
+    client_id = this._settings.client_id,
+    client_secret = this._settings.client_secret,
+    timeoutInSeconds,
+    extraHeaders,
+    ...args
+  }) {
+    const logger2 = this._logger.create("exchangeRefreshToken");
+    if (!client_id) {
+      logger2.throw(new Error("A client_id is required"));
+    }
+    if (!args.refresh_token) {
+      logger2.throw(new Error("A refresh_token is required"));
+    }
+    const params = new URLSearchParams({ grant_type });
+    for (const [key, value] of Object.entries(args)) {
+      if (Array.isArray(value)) {
+        value.forEach((param) => params.append(key, param));
+      } else if (value != null) {
+        params.set(key, value);
+      }
+    }
+    if ((this._settings.client_authentication === "client_secret_basic" || this._settings.client_authentication === "client_secret_jwt") && (client_secret === void 0 || client_secret === null)) {
+      logger2.throw(new Error("A client_secret is required"));
+      throw null;
+    }
+    let basicAuth;
+    const url = await this._metadataService.getTokenEndpoint(false);
+    switch (this._settings.client_authentication) {
+      case "client_secret_basic":
+        basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);
+        break;
+      case "client_secret_post":
+        params.append("client_id", client_id);
+        if (client_secret) {
+          params.append("client_secret", client_secret);
+        }
+        break;
+      case "client_secret_jwt": {
+        const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);
+        params.append("client_id", client_id);
+        params.append("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+        params.append("client_assertion", clientAssertion);
+        break;
+      }
+    }
+    logger2.debug("got token endpoint");
+    const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials, extraHeaders });
+    logger2.debug("got response");
+    return response;
+  }
+  /**
+   * Revoke an access or refresh token.
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+   */
+  async revoke(args) {
+    var _a;
+    const logger2 = this._logger.create("revoke");
+    if (!args.token) {
+      logger2.throw(new Error("A token is required"));
+    }
+    const url = await this._metadataService.getRevocationEndpoint(false);
+    logger2.debug(`got revocation endpoint, revoking ${(_a = args.token_type_hint) != null ? _a : "default token type"}`);
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(args)) {
+      if (value != null) {
+        params.set(key, value);
+      }
+    }
+    params.set("client_id", this._settings.client_id);
+    if (this._settings.client_secret) {
+      params.set("client_secret", this._settings.client_secret);
+    }
+    await this._jsonService.postForm(url, { body: params, timeoutInSeconds: this._settings.requestTimeoutInSeconds });
+    logger2.debug("got response");
+  }
+};
+
+// src/ResponseValidator.ts
+var ResponseValidator = class {
+  constructor(_settings, _metadataService, _claimsService) {
+    this._settings = _settings;
+    this._metadataService = _metadataService;
+    this._claimsService = _claimsService;
+    this._logger = new Logger("ResponseValidator");
+    this._userInfoService = new UserInfoService(this._settings, this._metadataService);
+    this._tokenClient = new TokenClient(this._settings, this._metadataService);
+  }
+  async validateSigninResponse(response, state, extraHeaders) {
+    const logger2 = this._logger.create("validateSigninResponse");
+    this._processSigninState(response, state);
+    logger2.debug("state processed");
+    await this._processCode(response, state, extraHeaders);
+    logger2.debug("code processed");
+    if (response.isOpenId) {
+      this._validateIdTokenAttributes(response, "", state.nonce);
+    }
+    logger2.debug("tokens validated");
+    await this._processClaims(response, state == null ? void 0 : state.skipUserInfo, response.isOpenId);
+    logger2.debug("claims processed");
+  }
+  async validateCredentialsResponse(response, skipUserInfo) {
+    const logger2 = this._logger.create("validateCredentialsResponse");
+    const shouldValidateSubClaim = response.isOpenId && !!response.id_token;
+    if (shouldValidateSubClaim) {
+      this._validateIdTokenAttributes(response);
+    }
+    logger2.debug("tokens validated");
+    await this._processClaims(response, skipUserInfo, shouldValidateSubClaim);
+    logger2.debug("claims processed");
+  }
+  async validateRefreshResponse(response, state) {
+    var _a, _b;
+    const logger2 = this._logger.create("validateRefreshResponse");
+    response.userState = state.data;
+    (_a = response.session_state) != null ? _a : response.session_state = state.session_state;
+    (_b = response.scope) != null ? _b : response.scope = state.scope;
+    if (response.isOpenId && !!response.id_token) {
+      this._validateIdTokenAttributes(response, state.id_token);
+      logger2.debug("ID Token validated");
+    }
+    if (!response.id_token) {
+      response.id_token = state.id_token;
+      response.profile = state.profile;
+    }
+    const hasIdToken = response.isOpenId && !!response.id_token;
+    await this._processClaims(response, false, hasIdToken);
+    logger2.debug("claims processed");
+  }
+  validateSignoutResponse(response, state) {
+    const logger2 = this._logger.create("validateSignoutResponse");
+    if (state.id !== response.state) {
+      logger2.throw(new Error("State does not match"));
+    }
+    logger2.debug("state validated");
+    response.userState = state.data;
+    if (response.error) {
+      logger2.warn("Response was error", response.error);
+      throw new ErrorResponse(response);
+    }
+  }
+  _processSigninState(response, state) {
+    var _a;
+    const logger2 = this._logger.create("_processSigninState");
+    if (state.id !== response.state) {
+      logger2.throw(new Error("State does not match"));
+    }
+    if (!state.client_id) {
+      logger2.throw(new Error("No client_id on state"));
+    }
+    if (!state.authority) {
+      logger2.throw(new Error("No authority on state"));
+    }
+    if (this._settings.authority !== state.authority) {
+      logger2.throw(new Error("authority mismatch on settings vs. signin state"));
+    }
+    if (this._settings.client_id && this._settings.client_id !== state.client_id) {
+      logger2.throw(new Error("client_id mismatch on settings vs. signin state"));
+    }
+    logger2.debug("state validated");
+    response.userState = state.data;
+    response.url_state = state.url_state;
+    (_a = response.scope) != null ? _a : response.scope = state.scope;
+    if (response.error) {
+      logger2.warn("Response was error", response.error);
+      throw new ErrorResponse(response);
+    }
+    if (state.code_verifier && !response.code) {
+      logger2.throw(new Error("Expected code in response"));
+    }
+  }
+  async _processClaims(response, skipUserInfo = false, validateSub = true) {
+    const logger2 = this._logger.create("_processClaims");
+    response.profile = this._claimsService.filterProtocolClaims(response.profile);
+    if (skipUserInfo || !this._settings.loadUserInfo || !response.access_token) {
+      logger2.debug("not loading user info");
+      return;
+    }
+    logger2.debug("loading user info");
+    const claims = await this._userInfoService.getClaims(response.access_token);
+    logger2.debug("user info claims received from user info endpoint");
+    if (validateSub && claims.sub !== response.profile.sub) {
+      logger2.throw(new Error("subject from UserInfo response does not match subject in ID Token"));
+    }
+    response.profile = this._claimsService.mergeClaims(response.profile, this._claimsService.filterProtocolClaims(claims));
+    logger2.debug("user info claims received, updated profile:", response.profile);
+  }
+  async _processCode(response, state, extraHeaders) {
+    const logger2 = this._logger.create("_processCode");
+    if (response.code) {
+      logger2.debug("Validating code");
+      const tokenResponse = await this._tokenClient.exchangeCode({
+        client_id: state.client_id,
+        client_secret: state.client_secret,
+        code: response.code,
+        redirect_uri: state.redirect_uri,
+        code_verifier: state.code_verifier,
+        extraHeaders,
+        ...state.extraTokenParams
+      });
+      Object.assign(response, tokenResponse);
+    } else {
+      logger2.debug("No code to process");
+    }
+  }
+  _validateIdTokenAttributes(response, existingToken, nonce) {
+    var _a;
+    const logger2 = this._logger.create("_validateIdTokenAttributes");
+    logger2.debug("decoding ID Token JWT");
+    const incoming = JwtUtils.decode((_a = response.id_token) != null ? _a : "");
+    if (!incoming.sub) {
+      logger2.throw(new Error("ID Token is missing a subject claim"));
+    }
+    if (nonce && incoming.nonce !== nonce) {
+      logger2.throw(new Error("nonce in id_token does not match nonce in client storage"));
+    }
+    if (existingToken) {
+      const existing = JwtUtils.decode(existingToken);
+      if (incoming.sub !== existing.sub) {
+        logger2.throw(new Error("sub in id_token does not match current sub"));
+      }
+      if (incoming.auth_time && incoming.auth_time !== existing.auth_time) {
+        logger2.throw(new Error("auth_time in id_token does not match original auth_time"));
+      }
+      if (incoming.azp && incoming.azp !== existing.azp) {
+        logger2.throw(new Error("azp in id_token does not match original azp"));
+      }
+      if (!incoming.azp && existing.azp) {
+        logger2.throw(new Error("azp not in id_token, but present in original id_token"));
+      }
+    }
+    response.profile = incoming;
+  }
+};
+
+// src/State.ts
+var State = class _State {
+  constructor(args) {
+    this.id = args.id || CryptoUtils.generateUUIDv4();
+    this.data = args.data;
+    if (args.created && args.created > 0) {
+      this.created = args.created;
+    } else {
+      this.created = Timer.getEpochTime();
+    }
+    this.request_type = args.request_type;
+    this.url_state = args.url_state;
+  }
+  toStorageString() {
+    new Logger("State").create("toStorageString");
+    return JSON.stringify({
+      id: this.id,
+      data: this.data,
+      created: this.created,
+      request_type: this.request_type,
+      url_state: this.url_state
+    });
+  }
+  static fromStorageString(storageString) {
+    Logger.createStatic("State", "fromStorageString");
+    return Promise.resolve(new _State(JSON.parse(storageString)));
+  }
+  static async clearStaleState(storage, age) {
+    const logger2 = Logger.createStatic("State", "clearStaleState");
+    const cutoff = Timer.getEpochTime() - age;
+    const keys = await storage.getAllKeys();
+    logger2.debug("got keys", keys);
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      const item = await storage.get(key);
+      let remove = false;
+      if (item) {
+        try {
+          const state = await _State.fromStorageString(item);
+          logger2.debug("got item from key:", key, state.created);
+          if (state.created <= cutoff) {
+            remove = true;
+          }
+        } catch (err) {
+          logger2.error("Error parsing state for key:", key, err);
+          remove = true;
+        }
+      } else {
+        logger2.debug("no item in storage for key:", key);
+        remove = true;
+      }
+      if (remove) {
+        logger2.debug("removed item for key:", key);
+        void storage.remove(key);
+      }
+    }
+  }
+};
+
+// src/SigninState.ts
+var SigninState = class _SigninState extends State {
+  constructor(args) {
+    super(args);
+    this.code_verifier = args.code_verifier;
+    this.code_challenge = args.code_challenge;
+    this.authority = args.authority;
+    this.client_id = args.client_id;
+    this.redirect_uri = args.redirect_uri;
+    this.scope = args.scope;
+    this.client_secret = args.client_secret;
+    this.extraTokenParams = args.extraTokenParams;
+    this.response_mode = args.response_mode;
+    this.skipUserInfo = args.skipUserInfo;
+    this.nonce = args.nonce;
+  }
+  static async create(args) {
+    const code_verifier = args.code_verifier === true ? CryptoUtils.generateCodeVerifier() : args.code_verifier || void 0;
+    const code_challenge = code_verifier ? await CryptoUtils.generateCodeChallenge(code_verifier) : void 0;
+    return new _SigninState({
+      ...args,
+      code_verifier,
+      code_challenge
+    });
+  }
+  toStorageString() {
+    new Logger("SigninState").create("toStorageString");
+    return JSON.stringify({
+      id: this.id,
+      data: this.data,
+      created: this.created,
+      request_type: this.request_type,
+      url_state: this.url_state,
+      code_verifier: this.code_verifier,
+      authority: this.authority,
+      client_id: this.client_id,
+      redirect_uri: this.redirect_uri,
+      scope: this.scope,
+      client_secret: this.client_secret,
+      extraTokenParams: this.extraTokenParams,
+      response_mode: this.response_mode,
+      skipUserInfo: this.skipUserInfo,
+      nonce: this.nonce
+    });
+  }
+  static fromStorageString(storageString) {
+    Logger.createStatic("SigninState", "fromStorageString");
+    const data = JSON.parse(storageString);
+    return _SigninState.create(data);
+  }
+};
+
+// src/SigninRequest.ts
+var _SigninRequest = class _SigninRequest {
+  constructor(args) {
+    this.url = args.url;
+    this.state = args.state;
+  }
+  static async create({
+    // mandatory
+    url,
+    authority,
+    client_id,
+    redirect_uri,
+    response_type,
+    scope,
+    // optional
+    state_data,
+    response_mode,
+    request_type,
+    client_secret,
+    nonce,
+    url_state,
+    resource,
+    skipUserInfo,
+    extraQueryParams,
+    extraTokenParams,
+    disablePKCE,
+    dpopJkt,
+    omitScopeWhenRequesting,
+    ...optionalParams
+  }) {
+    if (!url) {
+      this._logger.error("create: No url passed");
+      throw new Error("url");
+    }
+    if (!client_id) {
+      this._logger.error("create: No client_id passed");
+      throw new Error("client_id");
+    }
+    if (!redirect_uri) {
+      this._logger.error("create: No redirect_uri passed");
+      throw new Error("redirect_uri");
+    }
+    if (!response_type) {
+      this._logger.error("create: No response_type passed");
+      throw new Error("response_type");
+    }
+    if (!scope) {
+      this._logger.error("create: No scope passed");
+      throw new Error("scope");
+    }
+    if (!authority) {
+      this._logger.error("create: No authority passed");
+      throw new Error("authority");
+    }
+    const state = await SigninState.create({
+      data: state_data,
+      request_type,
+      url_state,
+      code_verifier: !disablePKCE,
+      client_id,
+      authority,
+      redirect_uri,
+      response_mode,
+      client_secret,
+      scope,
+      extraTokenParams,
+      skipUserInfo,
+      nonce
+    });
+    const parsedUrl = new URL(url);
+    parsedUrl.searchParams.append("client_id", client_id);
+    parsedUrl.searchParams.append("redirect_uri", redirect_uri);
+    parsedUrl.searchParams.append("response_type", response_type);
+    if (!omitScopeWhenRequesting) {
+      parsedUrl.searchParams.append("scope", scope);
+    }
+    if (nonce) {
+      parsedUrl.searchParams.append("nonce", nonce);
+    }
+    if (dpopJkt) {
+      parsedUrl.searchParams.append("dpop_jkt", dpopJkt);
+    }
+    let stateParam = state.id;
+    if (url_state) {
+      stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;
+    }
+    parsedUrl.searchParams.append("state", stateParam);
+    if (state.code_challenge) {
+      parsedUrl.searchParams.append("code_challenge", state.code_challenge);
+      parsedUrl.searchParams.append("code_challenge_method", "S256");
+    }
+    if (resource) {
+      const resources = Array.isArray(resource) ? resource : [resource];
+      resources.forEach((r) => parsedUrl.searchParams.append("resource", r));
+    }
+    for (const [key, value] of Object.entries({ response_mode, ...optionalParams, ...extraQueryParams })) {
+      if (value != null) {
+        parsedUrl.searchParams.append(key, value.toString());
+      }
+    }
+    return new _SigninRequest({
+      url: parsedUrl.href,
+      state
+    });
+  }
+};
+_SigninRequest._logger = new Logger("SigninRequest");
+var SigninRequest = _SigninRequest;
+
+// src/SigninResponse.ts
+var OidcScope = "openid";
+var SigninResponse = class {
+  constructor(params) {
+    /** @see {@link User.access_token} */
+    this.access_token = "";
+    /** @see {@link User.token_type} */
+    this.token_type = "";
+    /** @see {@link User.profile} */
+    this.profile = {};
+    this.state = params.get("state");
+    this.session_state = params.get("session_state");
+    if (this.state) {
+      const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);
+      this.state = splitState[0];
+      if (splitState.length > 1) {
+        this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);
+      }
+    }
+    this.error = params.get("error");
+    this.error_description = params.get("error_description");
+    this.error_uri = params.get("error_uri");
+    this.code = params.get("code");
+  }
+  get expires_in() {
+    if (this.expires_at === void 0) {
+      return void 0;
+    }
+    return this.expires_at - Timer.getEpochTime();
+  }
+  set expires_in(value) {
+    if (typeof value === "string") value = Number(value);
+    if (value !== void 0 && value >= 0) {
+      this.expires_at = Math.floor(value) + Timer.getEpochTime();
+    }
+  }
+  get isOpenId() {
+    var _a;
+    return ((_a = this.scope) == null ? void 0 : _a.split(" ").includes(OidcScope)) || !!this.id_token;
+  }
+};
+
+// src/SignoutRequest.ts
+var SignoutRequest = class {
+  constructor({
+    url,
+    state_data,
+    id_token_hint,
+    post_logout_redirect_uri,
+    extraQueryParams,
+    request_type,
+    client_id,
+    url_state
+  }) {
+    this._logger = new Logger("SignoutRequest");
+    if (!url) {
+      this._logger.error("ctor: No url passed");
+      throw new Error("url");
+    }
+    const parsedUrl = new URL(url);
+    if (id_token_hint) {
+      parsedUrl.searchParams.append("id_token_hint", id_token_hint);
+    }
+    if (client_id) {
+      parsedUrl.searchParams.append("client_id", client_id);
+    }
+    if (post_logout_redirect_uri) {
+      parsedUrl.searchParams.append("post_logout_redirect_uri", post_logout_redirect_uri);
+      if (state_data || url_state) {
+        this.state = new State({ data: state_data, request_type, url_state });
+        let stateParam = this.state.id;
+        if (url_state) {
+          stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;
+        }
+        parsedUrl.searchParams.append("state", stateParam);
+      }
+    }
+    for (const [key, value] of Object.entries({ ...extraQueryParams })) {
+      if (value != null) {
+        parsedUrl.searchParams.append(key, value.toString());
+      }
+    }
+    this.url = parsedUrl.href;
+  }
+};
+
+// src/SignoutResponse.ts
+var SignoutResponse = class {
+  constructor(params) {
+    this.state = params.get("state");
+    if (this.state) {
+      const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);
+      this.state = splitState[0];
+      if (splitState.length > 1) {
+        this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);
+      }
+    }
+    this.error = params.get("error");
+    this.error_description = params.get("error_description");
+    this.error_uri = params.get("error_uri");
+  }
+};
+
+// src/ClaimsService.ts
+var DefaultProtocolClaims = [
+  "nbf",
+  "jti",
+  "auth_time",
+  "nonce",
+  "acr",
+  "amr",
+  "azp",
+  "at_hash"
+  // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
+];
+var InternalRequiredProtocolClaims = ["sub", "iss", "aud", "exp", "iat"];
+var ClaimsService = class {
+  constructor(_settings) {
+    this._settings = _settings;
+    this._logger = new Logger("ClaimsService");
+  }
+  filterProtocolClaims(claims) {
+    const result = { ...claims };
+    if (this._settings.filterProtocolClaims) {
+      let protocolClaims;
+      if (Array.isArray(this._settings.filterProtocolClaims)) {
+        protocolClaims = this._settings.filterProtocolClaims;
+      } else {
+        protocolClaims = DefaultProtocolClaims;
+      }
+      for (const claim of protocolClaims) {
+        if (!InternalRequiredProtocolClaims.includes(claim)) {
+          delete result[claim];
+        }
+      }
+    }
+    return result;
+  }
+  mergeClaims(claims1, claims2) {
+    const result = { ...claims1 };
+    for (const [claim, values] of Object.entries(claims2)) {
+      if (result[claim] !== values) {
+        if (Array.isArray(result[claim]) || Array.isArray(values)) {
+          if (this._settings.mergeClaimsStrategy.array == "replace") {
+            result[claim] = values;
+          } else {
+            const mergedValues = Array.isArray(result[claim]) ? result[claim] : [result[claim]];
+            for (const value of Array.isArray(values) ? values : [values]) {
+              if (!mergedValues.includes(value)) {
+                mergedValues.push(value);
+              }
+            }
+            result[claim] = mergedValues;
+          }
+        } else if (typeof result[claim] === "object" && typeof values === "object") {
+          result[claim] = this.mergeClaims(result[claim], values);
+        } else {
+          result[claim] = values;
+        }
+      }
+    }
+    return result;
+  }
+};
+
+// src/DPoPStore.ts
+var DPoPState = class {
+  constructor(keys, nonce) {
+    this.keys = keys;
+    this.nonce = nonce;
+  }
+};
+
+// src/OidcClient.ts
+var OidcClient = class {
+  constructor(settings, metadataService) {
+    this._logger = new Logger("OidcClient");
+    this.settings = settings instanceof OidcClientSettingsStore ? settings : new OidcClientSettingsStore(settings);
+    this.metadataService = metadataService != null ? metadataService : new MetadataService(this.settings);
+    this._claimsService = new ClaimsService(this.settings);
+    this._validator = new ResponseValidator(this.settings, this.metadataService, this._claimsService);
+    this._tokenClient = new TokenClient(this.settings, this.metadataService);
+  }
+  async createSigninRequest({
+    state,
+    request,
+    request_uri,
+    request_type,
+    id_token_hint,
+    login_hint,
+    skipUserInfo,
+    nonce,
+    url_state,
+    response_type = this.settings.response_type,
+    scope = this.settings.scope,
+    redirect_uri = this.settings.redirect_uri,
+    prompt = this.settings.prompt,
+    display = this.settings.display,
+    max_age = this.settings.max_age,
+    ui_locales = this.settings.ui_locales,
+    acr_values = this.settings.acr_values,
+    resource = this.settings.resource,
+    response_mode = this.settings.response_mode,
+    extraQueryParams = this.settings.extraQueryParams,
+    extraTokenParams = this.settings.extraTokenParams,
+    dpopJkt,
+    omitScopeWhenRequesting = this.settings.omitScopeWhenRequesting
+  }) {
+    const logger2 = this._logger.create("createSigninRequest");
+    if (response_type !== "code") {
+      throw new Error("Only the Authorization Code flow (with PKCE) is supported");
+    }
+    const url = await this.metadataService.getAuthorizationEndpoint();
+    logger2.debug("Received authorization endpoint", url);
+    const signinRequest = await SigninRequest.create({
+      url,
+      authority: this.settings.authority,
+      client_id: this.settings.client_id,
+      redirect_uri,
+      response_type,
+      scope,
+      state_data: state,
+      url_state,
+      prompt,
+      display,
+      max_age,
+      ui_locales,
+      id_token_hint,
+      login_hint,
+      acr_values,
+      dpopJkt,
+      resource,
+      request,
+      request_uri,
+      extraQueryParams,
+      extraTokenParams,
+      request_type,
+      response_mode,
+      client_secret: this.settings.client_secret,
+      skipUserInfo,
+      nonce,
+      disablePKCE: this.settings.disablePKCE,
+      omitScopeWhenRequesting
+    });
+    await this.clearStaleState();
+    const signinState = signinRequest.state;
+    await this.settings.stateStore.set(signinState.id, signinState.toStorageString());
+    return signinRequest;
+  }
+  async readSigninResponseState(url, removeState = false) {
+    const logger2 = this._logger.create("readSigninResponseState");
+    const response = new SigninResponse(UrlUtils.readParams(url, this.settings.response_mode));
+    if (!response.state) {
+      logger2.throw(new Error("No state in response"));
+      throw null;
+    }
+    const storedStateString = await this.settings.stateStore[removeState ? "remove" : "get"](response.state);
+    if (!storedStateString) {
+      logger2.throw(new Error("No matching state found in storage"));
+      throw null;
+    }
+    const state = await SigninState.fromStorageString(storedStateString);
+    return { state, response };
+  }
+  async processSigninResponse(url, extraHeaders, removeState = true) {
+    const logger2 = this._logger.create("processSigninResponse");
+    const { state, response } = await this.readSigninResponseState(url, removeState);
+    logger2.debug("received state from storage; validating response");
+    if (this.settings.dpop && this.settings.dpop.store) {
+      const dpopProof = await this.getDpopProof(this.settings.dpop.store);
+      extraHeaders = { ...extraHeaders, "DPoP": dpopProof };
+    }
+    try {
+      await this._validator.validateSigninResponse(response, state, extraHeaders);
+    } catch (err) {
+      if (err instanceof ErrorDPoPNonce && this.settings.dpop) {
+        const dpopProof = await this.getDpopProof(this.settings.dpop.store, err.nonce);
+        extraHeaders["DPoP"] = dpopProof;
+        await this._validator.validateSigninResponse(response, state, extraHeaders);
+      } else {
+        throw err;
+      }
+    }
+    return response;
+  }
+  async getDpopProof(dpopStore, nonce) {
+    let keyPair;
+    let dpopState;
+    if (!(await dpopStore.getAllKeys()).includes(this.settings.client_id)) {
+      keyPair = await CryptoUtils.generateDPoPKeys();
+      dpopState = new DPoPState(keyPair, nonce);
+      await dpopStore.set(this.settings.client_id, dpopState);
+    } else {
+      dpopState = await dpopStore.get(this.settings.client_id);
+      if (dpopState.nonce !== nonce && nonce) {
+        dpopState.nonce = nonce;
+        await dpopStore.set(this.settings.client_id, dpopState);
+      }
+    }
+    return await CryptoUtils.generateDPoPProof({
+      url: await this.metadataService.getTokenEndpoint(false),
+      httpMethod: "POST",
+      keyPair: dpopState.keys,
+      nonce: dpopState.nonce
+    });
+  }
+  async processResourceOwnerPasswordCredentials({
+    username,
+    password,
+    skipUserInfo = false,
+    extraTokenParams = {}
+  }) {
+    const tokenResponse = await this._tokenClient.exchangeCredentials({ username, password, ...extraTokenParams });
+    const signinResponse = new SigninResponse(new URLSearchParams());
+    Object.assign(signinResponse, tokenResponse);
+    await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);
+    return signinResponse;
+  }
+  async useRefreshToken({
+    state,
+    redirect_uri,
+    resource,
+    timeoutInSeconds,
+    extraHeaders,
+    extraTokenParams
+  }) {
+    var _a;
+    const logger2 = this._logger.create("useRefreshToken");
+    let scope;
+    if (this.settings.refreshTokenAllowedScope === void 0) {
+      scope = state.scope;
+    } else {
+      const allowableScopes = this.settings.refreshTokenAllowedScope.split(" ");
+      const providedScopes = ((_a = state.scope) == null ? void 0 : _a.split(" ")) || [];
+      scope = providedScopes.filter((s) => allowableScopes.includes(s)).join(" ");
+    }
+    if (this.settings.dpop && this.settings.dpop.store) {
+      const dpopProof = await this.getDpopProof(this.settings.dpop.store);
+      extraHeaders = { ...extraHeaders, "DPoP": dpopProof };
+    }
+    let result;
+    try {
+      result = await this._tokenClient.exchangeRefreshToken({
+        refresh_token: state.refresh_token,
+        // provide the (possible filtered) scope list
+        scope,
+        redirect_uri,
+        resource,
+        timeoutInSeconds,
+        extraHeaders,
+        ...extraTokenParams
+      });
+    } catch (err) {
+      if (err instanceof ErrorDPoPNonce && this.settings.dpop) {
+        extraHeaders["DPoP"] = await this.getDpopProof(this.settings.dpop.store, err.nonce);
+        result = await this._tokenClient.exchangeRefreshToken({
+          refresh_token: state.refresh_token,
+          // provide the (possible filtered) scope list
+          scope,
+          redirect_uri,
+          resource,
+          timeoutInSeconds,
+          extraHeaders,
+          ...extraTokenParams
+        });
+      } else {
+        throw err;
+      }
+    }
+    const response = new SigninResponse(new URLSearchParams());
+    Object.assign(response, result);
+    logger2.debug("validating response", response);
+    await this._validator.validateRefreshResponse(response, {
+      ...state,
+      // override the scope in the state handed over to the validator
+      // so it can set the granted scope to the requested scope in case none is included in the response
+      scope
+    });
+    return response;
+  }
+  async createSignoutRequest({
+    state,
+    id_token_hint,
+    client_id,
+    request_type,
+    url_state,
+    post_logout_redirect_uri = this.settings.post_logout_redirect_uri,
+    extraQueryParams = this.settings.extraQueryParams
+  } = {}) {
+    const logger2 = this._logger.create("createSignoutRequest");
+    const url = await this.metadataService.getEndSessionEndpoint();
+    if (!url) {
+      logger2.throw(new Error("No end session endpoint"));
+      throw null;
+    }
+    logger2.debug("Received end session endpoint", url);
+    if (!client_id && post_logout_redirect_uri && !id_token_hint) {
+      client_id = this.settings.client_id;
+    }
+    const request = new SignoutRequest({
+      url,
+      id_token_hint,
+      client_id,
+      post_logout_redirect_uri,
+      state_data: state,
+      extraQueryParams,
+      request_type,
+      url_state
+    });
+    await this.clearStaleState();
+    const signoutState = request.state;
+    if (signoutState) {
+      logger2.debug("Signout request has state to persist");
+      await this.settings.stateStore.set(signoutState.id, signoutState.toStorageString());
+    }
+    return request;
+  }
+  async readSignoutResponseState(url, removeState = false) {
+    const logger2 = this._logger.create("readSignoutResponseState");
+    const response = new SignoutResponse(UrlUtils.readParams(url, this.settings.response_mode));
+    if (!response.state) {
+      logger2.debug("No state in response");
+      if (response.error) {
+        logger2.warn("Response was error:", response.error);
+        throw new ErrorResponse(response);
+      }
+      return { state: void 0, response };
+    }
+    const storedStateString = await this.settings.stateStore[removeState ? "remove" : "get"](response.state);
+    if (!storedStateString) {
+      logger2.throw(new Error("No matching state found in storage"));
+      throw null;
+    }
+    const state = await State.fromStorageString(storedStateString);
+    return { state, response };
+  }
+  async processSignoutResponse(url) {
+    const logger2 = this._logger.create("processSignoutResponse");
+    const { state, response } = await this.readSignoutResponseState(url, true);
+    if (state) {
+      logger2.debug("Received state from storage; validating response");
+      this._validator.validateSignoutResponse(response, state);
+    } else {
+      logger2.debug("No state from storage; skipping response validation");
+    }
+    return response;
+  }
+  clearStaleState() {
+    this._logger.create("clearStaleState");
+    return State.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);
+  }
+  async revokeToken(token, type) {
+    this._logger.create("revokeToken");
+    return await this._tokenClient.revoke({
+      token,
+      token_type_hint: type
+    });
+  }
+};
+
+// src/SessionMonitor.ts
+var SessionMonitor = class {
+  constructor(_userManager) {
+    this._userManager = _userManager;
+    this._logger = new Logger("SessionMonitor");
+    this._start = async (user) => {
+      const session_state = user.session_state;
+      if (!session_state) {
+        return;
+      }
+      const logger2 = this._logger.create("_start");
+      if (user.profile) {
+        this._sub = user.profile.sub;
+        logger2.debug("session_state", session_state, ", sub", this._sub);
+      } else {
+        this._sub = void 0;
+        logger2.debug("session_state", session_state, ", anonymous user");
+      }
+      if (this._checkSessionIFrame) {
+        this._checkSessionIFrame.start(session_state);
+        return;
+      }
+      try {
+        const url = await this._userManager.metadataService.getCheckSessionIframe();
+        if (url) {
+          logger2.debug("initializing check session iframe");
+          const client_id = this._userManager.settings.client_id;
+          const intervalInSeconds = this._userManager.settings.checkSessionIntervalInSeconds;
+          const stopOnError = this._userManager.settings.stopCheckSessionOnError;
+          const checkSessionIFrame = new CheckSessionIFrame(this._callback, client_id, url, intervalInSeconds, stopOnError);
+          await checkSessionIFrame.load();
+          this._checkSessionIFrame = checkSessionIFrame;
+          checkSessionIFrame.start(session_state);
+        } else {
+          logger2.warn("no check session iframe found in the metadata");
+        }
+      } catch (err) {
+        logger2.error("Error from getCheckSessionIframe:", err instanceof Error ? err.message : err);
+      }
+    };
+    this._stop = () => {
+      const logger2 = this._logger.create("_stop");
+      this._sub = void 0;
+      if (this._checkSessionIFrame) {
+        this._checkSessionIFrame.stop();
+      }
+      if (this._userManager.settings.monitorAnonymousSession) {
+        const timerHandle = setInterval(async () => {
+          clearInterval(timerHandle);
+          try {
+            const session = await this._userManager.querySessionStatus();
+            if (session) {
+              const tmpUser = {
+                session_state: session.session_state,
+                profile: session.sub ? {
+                  sub: session.sub
+                } : null
+              };
+              void this._start(tmpUser);
+            }
+          } catch (err) {
+            logger2.error("error from querySessionStatus", err instanceof Error ? err.message : err);
+          }
+        }, 1e3);
+      }
+    };
+    this._callback = async () => {
+      const logger2 = this._logger.create("_callback");
+      try {
+        const session = await this._userManager.querySessionStatus();
+        let raiseEvent = true;
+        if (session && this._checkSessionIFrame) {
+          if (session.sub === this._sub) {
+            raiseEvent = false;
+            this._checkSessionIFrame.start(session.session_state);
+            logger2.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state", session.session_state);
+            await this._userManager.events._raiseUserSessionChanged();
+          } else {
+            logger2.debug("different subject signed into OP", session.sub);
+          }
+        } else {
+          logger2.debug("subject no longer signed into OP");
+        }
+        if (raiseEvent) {
+          if (this._sub) {
+            await this._userManager.events._raiseUserSignedOut();
+          } else {
+            await this._userManager.events._raiseUserSignedIn();
+          }
+        } else {
+          logger2.debug("no change in session detected, no event to raise");
+        }
+      } catch (err) {
+        if (this._sub) {
+          logger2.debug("Error calling queryCurrentSigninSession; raising signed out event", err);
+          await this._userManager.events._raiseUserSignedOut();
+        }
+      }
+    };
+    if (!_userManager) {
+      this._logger.throw(new Error("No user manager passed"));
+    }
+    this._userManager.events.addUserLoaded(this._start);
+    this._userManager.events.addUserUnloaded(this._stop);
+    this._init().catch((err) => {
+      this._logger.error(err);
+    });
+  }
+  async _init() {
+    this._logger.create("_init");
+    const user = await this._userManager.getUser();
+    if (user) {
+      void this._start(user);
+    } else if (this._userManager.settings.monitorAnonymousSession) {
+      const session = await this._userManager.querySessionStatus();
+      if (session) {
+        const tmpUser = {
+          session_state: session.session_state,
+          profile: session.sub ? {
+            sub: session.sub
+          } : null
+        };
+        void this._start(tmpUser);
+      }
+    }
+  }
+};
+
+// src/User.ts
+var User = class _User {
+  constructor(args) {
+    var _a;
+    this.id_token = args.id_token;
+    this.session_state = (_a = args.session_state) != null ? _a : null;
+    this.access_token = args.access_token;
+    this.refresh_token = args.refresh_token;
+    this.token_type = args.token_type;
+    this.scope = args.scope;
+    this.profile = args.profile;
+    this.expires_at = args.expires_at;
+    this.state = args.userState;
+    this.url_state = args.url_state;
+  }
+  /** Computed number of seconds the access token has remaining. */
+  get expires_in() {
+    if (this.expires_at === void 0) {
+      return void 0;
+    }
+    return this.expires_at - Timer.getEpochTime();
+  }
+  set expires_in(value) {
+    if (value !== void 0) {
+      this.expires_at = Math.floor(value) + Timer.getEpochTime();
+    }
+  }
+  /** Computed value indicating if the access token is expired. */
+  get expired() {
+    const expires_in = this.expires_in;
+    if (expires_in === void 0) {
+      return void 0;
+    }
+    return expires_in <= 0;
+  }
+  /** Array representing the parsed values from the `scope`. */
+  get scopes() {
+    var _a, _b;
+    return (_b = (_a = this.scope) == null ? void 0 : _a.split(" ")) != null ? _b : [];
+  }
+  toStorageString() {
+    new Logger("User").create("toStorageString");
+    return JSON.stringify({
+      id_token: this.id_token,
+      session_state: this.session_state,
+      access_token: this.access_token,
+      refresh_token: this.refresh_token,
+      token_type: this.token_type,
+      scope: this.scope,
+      profile: this.profile,
+      expires_at: this.expires_at
+    });
+  }
+  static fromStorageString(storageString) {
+    Logger.createStatic("User", "fromStorageString");
+    return new _User(JSON.parse(storageString));
+  }
+};
+
+// src/navigators/AbstractChildWindow.ts
+var messageSource = "oidc-client";
+var AbstractChildWindow = class {
+  constructor() {
+    this._abort = new Event("Window navigation aborted");
+    this._disposeHandlers = /* @__PURE__ */ new Set();
+    this._window = null;
+  }
+  async navigate(params) {
+    const logger2 = this._logger.create("navigate");
+    if (!this._window) {
+      throw new Error("Attempted to navigate on a disposed window");
+    }
+    logger2.debug("setting URL in window");
+    this._window.location.replace(params.url);
+    const { url, keepOpen } = await new Promise((resolve, reject) => {
+      const listener = (e) => {
+        var _a;
+        const data = e.data;
+        const origin = (_a = params.scriptOrigin) != null ? _a : window.location.origin;
+        if (e.origin !== origin || (data == null ? void 0 : data.source) !== messageSource) {
+          return;
+        }
+        try {
+          const state = UrlUtils.readParams(data.url, params.response_mode).get("state");
+          if (!state) {
+            logger2.warn("no state found in response url");
+          }
+          if (e.source !== this._window && state !== params.state) {
+            return;
+          }
+        } catch {
+          this._dispose();
+          reject(new Error("Invalid response from window"));
+        }
+        resolve(data);
+      };
+      window.addEventListener("message", listener, false);
+      this._disposeHandlers.add(() => window.removeEventListener("message", listener, false));
+      const channel = new BroadcastChannel(`oidc-client-popup-${params.state}`);
+      channel.addEventListener("message", listener, false);
+      this._disposeHandlers.add(() => channel.close());
+      this._disposeHandlers.add(this._abort.addHandler((reason) => {
+        this._dispose();
+        reject(reason);
+      }));
+    });
+    logger2.debug("got response from window");
+    this._dispose();
+    if (!keepOpen) {
+      this.close();
+    }
+    return { url };
+  }
+  _dispose() {
+    this._logger.create("_dispose");
+    for (const dispose of this._disposeHandlers) {
+      dispose();
+    }
+    this._disposeHandlers.clear();
+  }
+  static _notifyParent(parent, url, keepOpen = false, targetOrigin = window.location.origin) {
+    const msgData = {
+      source: messageSource,
+      url,
+      keepOpen
+    };
+    const logger2 = new Logger("_notifyParent");
+    if (parent) {
+      logger2.debug("With parent. Using parent.postMessage.");
+      parent.postMessage(msgData, targetOrigin);
+    } else {
+      logger2.debug("No parent. Using BroadcastChannel.");
+      const state = new URL(url).searchParams.get("state");
+      if (!state) {
+        throw new Error("No parent and no state in URL. Can't complete notification.");
+      }
+      const channel = new BroadcastChannel(`oidc-client-popup-${state}`);
+      channel.postMessage(msgData);
+      channel.close();
+    }
+  }
+};
+
+// src/UserManagerSettings.ts
+var DefaultPopupWindowFeatures = {
+  location: false,
+  toolbar: false,
+  height: 640,
+  closePopupWindowAfterInSeconds: -1
+};
+var DefaultPopupTarget = "_blank";
+var DefaultAccessTokenExpiringNotificationTimeInSeconds = 60;
+var DefaultCheckSessionIntervalInSeconds = 2;
+var DefaultSilentRequestTimeoutInSeconds = 10;
+var UserManagerSettingsStore = class extends OidcClientSettingsStore {
+  constructor(args) {
+    const {
+      popup_redirect_uri = args.redirect_uri,
+      popup_post_logout_redirect_uri = args.post_logout_redirect_uri,
+      popupWindowFeatures = DefaultPopupWindowFeatures,
+      popupWindowTarget = DefaultPopupTarget,
+      redirectMethod = "assign",
+      redirectTarget = "self",
+      iframeNotifyParentOrigin = args.iframeNotifyParentOrigin,
+      iframeScriptOrigin = args.iframeScriptOrigin,
+      requestTimeoutInSeconds,
+      silent_redirect_uri = args.redirect_uri,
+      silentRequestTimeoutInSeconds,
+      automaticSilentRenew = true,
+      validateSubOnSilentRenew = true,
+      includeIdTokenInSilentRenew = false,
+      monitorSession = false,
+      monitorAnonymousSession = false,
+      checkSessionIntervalInSeconds = DefaultCheckSessionIntervalInSeconds,
+      query_status_response_type = "code",
+      stopCheckSessionOnError = true,
+      revokeTokenTypes = ["access_token", "refresh_token"],
+      revokeTokensOnSignout = false,
+      includeIdTokenInSilentSignout = false,
+      accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,
+      maxSilentRenewTimeoutRetries,
+      userStore
+    } = args;
+    super(args);
+    this.popup_redirect_uri = popup_redirect_uri;
+    this.popup_post_logout_redirect_uri = popup_post_logout_redirect_uri;
+    this.popupWindowFeatures = popupWindowFeatures;
+    this.popupWindowTarget = popupWindowTarget;
+    this.redirectMethod = redirectMethod;
+    this.redirectTarget = redirectTarget;
+    this.iframeNotifyParentOrigin = iframeNotifyParentOrigin;
+    this.iframeScriptOrigin = iframeScriptOrigin;
+    this.silent_redirect_uri = silent_redirect_uri;
+    this.silentRequestTimeoutInSeconds = silentRequestTimeoutInSeconds || requestTimeoutInSeconds || DefaultSilentRequestTimeoutInSeconds;
+    this.automaticSilentRenew = automaticSilentRenew;
+    this.validateSubOnSilentRenew = validateSubOnSilentRenew;
+    this.includeIdTokenInSilentRenew = includeIdTokenInSilentRenew;
+    this.monitorSession = monitorSession;
+    this.monitorAnonymousSession = monitorAnonymousSession;
+    this.checkSessionIntervalInSeconds = checkSessionIntervalInSeconds;
+    this.stopCheckSessionOnError = stopCheckSessionOnError;
+    this.query_status_response_type = query_status_response_type;
+    this.revokeTokenTypes = revokeTokenTypes;
+    this.revokeTokensOnSignout = revokeTokensOnSignout;
+    this.includeIdTokenInSilentSignout = includeIdTokenInSilentSignout;
+    this.accessTokenExpiringNotificationTimeInSeconds = accessTokenExpiringNotificationTimeInSeconds;
+    this.maxSilentRenewTimeoutRetries = maxSilentRenewTimeoutRetries;
+    if (userStore) {
+      this.userStore = userStore;
+    } else {
+      const store = typeof window !== "undefined" ? window.sessionStorage : new InMemoryWebStorage();
+      this.userStore = new WebStorageStateStore({ store });
+    }
+  }
+};
+
+// src/navigators/IFrameWindow.ts
+var IFrameWindow = class _IFrameWindow extends AbstractChildWindow {
+  constructor({
+    silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds
+  }) {
+    super();
+    this._logger = new Logger("IFrameWindow");
+    this._timeoutInSeconds = silentRequestTimeoutInSeconds;
+    this._frame = _IFrameWindow.createHiddenIframe();
+    this._window = this._frame.contentWindow;
+  }
+  static createHiddenIframe() {
+    const iframe = window.document.createElement("iframe");
+    iframe.style.visibility = "hidden";
+    iframe.style.position = "fixed";
+    iframe.style.left = "-1000px";
+    iframe.style.top = "0";
+    iframe.width = "0";
+    iframe.height = "0";
+    window.document.body.appendChild(iframe);
+    return iframe;
+  }
+  async navigate(params) {
+    this._logger.debug("navigate: Using timeout of:", this._timeoutInSeconds);
+    const timer = setTimeout(() => void this._abort.raise(new ErrorTimeout("IFrame timed out without a response")), this._timeoutInSeconds * 1e3);
+    this._disposeHandlers.add(() => clearTimeout(timer));
+    return await super.navigate(params);
+  }
+  close() {
+    var _a;
+    if (this._frame) {
+      if (this._frame.parentNode) {
+        this._frame.addEventListener("load", (ev) => {
+          var _a2;
+          const frame = ev.target;
+          (_a2 = frame.parentNode) == null ? void 0 : _a2.removeChild(frame);
+          void this._abort.raise(new Error("IFrame removed from DOM"));
+        }, true);
+        (_a = this._frame.contentWindow) == null ? void 0 : _a.location.replace("about:blank");
+      }
+      this._frame = null;
+    }
+    this._window = null;
+  }
+  static notifyParent(url, targetOrigin) {
+    return super._notifyParent(window.parent, url, false, targetOrigin);
+  }
+};
+
+// src/navigators/IFrameNavigator.ts
+var IFrameNavigator = class {
+  constructor(_settings) {
+    this._settings = _settings;
+    this._logger = new Logger("IFrameNavigator");
+  }
+  async prepare({
+    silentRequestTimeoutInSeconds = this._settings.silentRequestTimeoutInSeconds
+  }) {
+    return new IFrameWindow({ silentRequestTimeoutInSeconds });
+  }
+  async callback(url) {
+    this._logger.create("callback");
+    IFrameWindow.notifyParent(url, this._settings.iframeNotifyParentOrigin);
+  }
+};
+
+// src/navigators/PopupWindow.ts
+var checkForPopupClosedInterval = 500;
+var second = 1e3;
+var PopupWindow = class extends AbstractChildWindow {
+  constructor({
+    popupWindowTarget = DefaultPopupTarget,
+    popupWindowFeatures = {},
+    popupSignal,
+    popupAbortOnClose
+  }) {
+    super();
+    this._logger = new Logger("PopupWindow");
+    const centeredPopup = PopupUtils.center({ ...DefaultPopupWindowFeatures, ...popupWindowFeatures });
+    this._window = window.open(void 0, popupWindowTarget, PopupUtils.serialize(centeredPopup));
+    this.abortOnClose = Boolean(popupAbortOnClose);
+    if (popupSignal) {
+      popupSignal.addEventListener("abort", () => {
+        var _a;
+        void this._abort.raise(new Error((_a = popupSignal.reason) != null ? _a : "Popup aborted"));
+      });
+    }
+    if (popupWindowFeatures.closePopupWindowAfterInSeconds && popupWindowFeatures.closePopupWindowAfterInSeconds > 0) {
+      setTimeout(() => {
+        if (!this._window || typeof this._window.closed !== "boolean" || this._window.closed) {
+          void this._abort.raise(new Error("Popup blocked by user"));
+          return;
+        }
+        this.close();
+      }, popupWindowFeatures.closePopupWindowAfterInSeconds * second);
+    }
+  }
+  async navigate(params) {
+    var _a;
+    (_a = this._window) == null ? void 0 : _a.focus();
+    const popupClosedInterval = setInterval(() => {
+      if (!this._window || this._window.closed) {
+        this._logger.debug("Popup closed by user or isolated by redirect");
+        clearPopupClosedInterval();
+        this._disposeHandlers.delete(clearPopupClosedInterval);
+        if (this.abortOnClose) {
+          void this._abort.raise(new Error("Popup closed by user"));
+        }
+      }
+    }, checkForPopupClosedInterval);
+    const clearPopupClosedInterval = () => clearInterval(popupClosedInterval);
+    this._disposeHandlers.add(clearPopupClosedInterval);
+    return await super.navigate(params);
+  }
+  close() {
+    if (this._window) {
+      if (!this._window.closed) {
+        this._window.close();
+        void this._abort.raise(new Error("Popup closed"));
+      }
+    }
+    this._window = null;
+  }
+  static notifyOpener(url, keepOpen) {
+    super._notifyParent(window.opener, url, keepOpen);
+    if (!keepOpen && !window.opener) {
+      window.close();
+    }
+  }
+};
+
+// src/navigators/PopupNavigator.ts
+var PopupNavigator = class {
+  constructor(_settings) {
+    this._settings = _settings;
+    this._logger = new Logger("PopupNavigator");
+  }
+  async prepare({
+    popupWindowFeatures = this._settings.popupWindowFeatures,
+    popupWindowTarget = this._settings.popupWindowTarget,
+    popupSignal,
+    popupAbortOnClose
+  }) {
+    return new PopupWindow({
+      popupWindowFeatures,
+      popupWindowTarget,
+      popupSignal,
+      popupAbortOnClose
+    });
+  }
+  async callback(url, { keepOpen = false }) {
+    this._logger.create("callback");
+    PopupWindow.notifyOpener(url, keepOpen);
+  }
+};
+
+// src/navigators/RedirectNavigator.ts
+var RedirectNavigator = class {
+  constructor(_settings) {
+    this._settings = _settings;
+    this._logger = new Logger("RedirectNavigator");
+  }
+  async prepare({
+    redirectMethod = this._settings.redirectMethod,
+    redirectTarget = this._settings.redirectTarget
+  }) {
+    var _a;
+    this._logger.create("prepare");
+    let targetWindow = window.self;
+    if (redirectTarget === "top") {
+      targetWindow = (_a = window.top) != null ? _a : window.self;
+    }
+    const redirect = targetWindow.location[redirectMethod].bind(targetWindow.location);
+    let abort;
+    return {
+      navigate: async (params) => {
+        this._logger.create("navigate");
+        const promise = new Promise((resolve, reject) => {
+          abort = reject;
+          window.addEventListener("pageshow", () => resolve(window.location.href));
+          redirect(params.url);
+        });
+        return await promise;
+      },
+      close: () => {
+        this._logger.create("close");
+        abort == null ? void 0 : abort(new Error("Redirect aborted"));
+        targetWindow.stop();
+      }
+    };
+  }
+  async callback() {
+    return;
+  }
+};
+
+// src/UserManagerEvents.ts
+var UserManagerEvents = class extends AccessTokenEvents {
+  constructor(settings) {
+    super({ expiringNotificationTimeInSeconds: settings.accessTokenExpiringNotificationTimeInSeconds });
+    this._logger = new Logger("UserManagerEvents");
+    this._userLoaded = new Event("User loaded");
+    this._userUnloaded = new Event("User unloaded");
+    this._silentRenewError = new Event("Silent renew error");
+    this._userSignedIn = new Event("User signed in");
+    this._userSignedOut = new Event("User signed out");
+    this._userSessionChanged = new Event("User session changed");
+  }
+  async load(user, raiseEvent = true) {
+    await super.load(user);
+    if (raiseEvent) {
+      await this._userLoaded.raise(user);
+    }
+  }
+  async unload() {
+    await super.unload();
+    await this._userUnloaded.raise();
+  }
+  /**
+   * Add callback: Raised when a user session has been established (or re-established).
+   */
+  addUserLoaded(cb) {
+    return this._userLoaded.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when a user session has been established (or re-established).
+   */
+  removeUserLoaded(cb) {
+    return this._userLoaded.removeHandler(cb);
+  }
+  /**
+   * Add callback: Raised when a user session has been terminated.
+   */
+  addUserUnloaded(cb) {
+    return this._userUnloaded.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when a user session has been terminated.
+   */
+  removeUserUnloaded(cb) {
+    return this._userUnloaded.removeHandler(cb);
+  }
+  /**
+   * Add callback: Raised when the automatic silent renew has failed.
+   */
+  addSilentRenewError(cb) {
+    return this._silentRenewError.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when the automatic silent renew has failed.
+   */
+  removeSilentRenewError(cb) {
+    return this._silentRenewError.removeHandler(cb);
+  }
+  /**
+   * @internal
+   */
+  async _raiseSilentRenewError(e) {
+    await this._silentRenewError.raise(e);
+  }
+  /**
+   * Add callback: Raised when the user is signed in (when `monitorSession` is set).
+   * @see {@link UserManagerSettings.monitorSession}
+   */
+  addUserSignedIn(cb) {
+    return this._userSignedIn.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when the user is signed in (when `monitorSession` is set).
+   */
+  removeUserSignedIn(cb) {
+    this._userSignedIn.removeHandler(cb);
+  }
+  /**
+   * @internal
+   */
+  async _raiseUserSignedIn() {
+    await this._userSignedIn.raise();
+  }
+  /**
+   * Add callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).
+   * @see {@link UserManagerSettings.monitorSession}
+   */
+  addUserSignedOut(cb) {
+    return this._userSignedOut.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).
+   */
+  removeUserSignedOut(cb) {
+    this._userSignedOut.removeHandler(cb);
+  }
+  /**
+   * @internal
+   */
+  async _raiseUserSignedOut() {
+    await this._userSignedOut.raise();
+  }
+  /**
+   * Add callback: Raised when the user session changed (when `monitorSession` is set).
+   * @see {@link UserManagerSettings.monitorSession}
+   */
+  addUserSessionChanged(cb) {
+    return this._userSessionChanged.addHandler(cb);
+  }
+  /**
+   * Remove callback: Raised when the user session changed (when `monitorSession` is set).
+   */
+  removeUserSessionChanged(cb) {
+    this._userSessionChanged.removeHandler(cb);
+  }
+  /**
+   * @internal
+   */
+  async _raiseUserSessionChanged() {
+    await this._userSessionChanged.raise();
+  }
+};
+
+// src/SilentRenewService.ts
+var SilentRenewService = class {
+  constructor(_userManager) {
+    this._userManager = _userManager;
+    this._logger = new Logger("SilentRenewService");
+    this._isStarted = false;
+    this._retryTimer = new Timer("Retry Silent Renew");
+    this._timeoutRetryCount = 0;
+    this._tokenExpiring = async () => {
+      const logger2 = this._logger.create("_tokenExpiring");
+      try {
+        await this._userManager.signinSilent();
+        this._timeoutRetryCount = 0;
+        logger2.debug("silent token renewal successful");
+      } catch (err) {
+        if (err instanceof ErrorTimeout) {
+          this._timeoutRetryCount++;
+          const maxRetries = this._userManager.settings.maxSilentRenewTimeoutRetries;
+          const hasReachedLimit = maxRetries !== void 0 && this._timeoutRetryCount > maxRetries;
+          if (hasReachedLimit) {
+            logger2.error(
+              `Timeout retry limit reached (${this._timeoutRetryCount} > ${maxRetries}), raising silentRenewError:`,
+              err
+            );
+            this._timeoutRetryCount = 0;
+            await this._userManager.events._raiseSilentRenewError(err);
+            return;
+          }
+          logger2.warn(
+            `ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,
+            err
+          );
+          this._retryTimer.init(5);
+          return;
+        }
+        logger2.error("Error from signinSilent:", err);
+        this._timeoutRetryCount = 0;
+        await this._userManager.events._raiseSilentRenewError(err);
+      }
+    };
+  }
+  async start() {
+    const logger2 = this._logger.create("start");
+    if (!this._isStarted) {
+      this._isStarted = true;
+      this._userManager.events.addAccessTokenExpiring(this._tokenExpiring);
+      this._retryTimer.addHandler(this._tokenExpiring);
+      try {
+        await this._userManager.getUser();
+      } catch (err) {
+        logger2.error("getUser error", err);
+      }
+    }
+  }
+  stop() {
+    if (this._isStarted) {
+      this._retryTimer.cancel();
+      this._retryTimer.removeHandler(this._tokenExpiring);
+      this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring);
+      this._isStarted = false;
+    }
+  }
+};
+
+// src/RefreshState.ts
+var RefreshState = class {
+  constructor(args) {
+    this.refresh_token = args.refresh_token;
+    this.id_token = args.id_token;
+    this.session_state = args.session_state;
+    this.scope = args.scope;
+    this.profile = args.profile;
+    this.data = args.state;
+  }
+};
+
+// src/UserManager.ts
+var UserManager = class {
+  constructor(settings, redirectNavigator, popupNavigator, iframeNavigator) {
+    this._logger = new Logger("UserManager");
+    this.settings = new UserManagerSettingsStore(settings);
+    this._client = new OidcClient(settings);
+    this._redirectNavigator = redirectNavigator != null ? redirectNavigator : new RedirectNavigator(this.settings);
+    this._popupNavigator = popupNavigator != null ? popupNavigator : new PopupNavigator(this.settings);
+    this._iframeNavigator = iframeNavigator != null ? iframeNavigator : new IFrameNavigator(this.settings);
+    this._events = new UserManagerEvents(this.settings);
+    this._silentRenewService = new SilentRenewService(this);
+    if (this.settings.automaticSilentRenew) {
+      this.startSilentRenew();
+    }
+    this._sessionMonitor = null;
+    if (this.settings.monitorSession) {
+      this._sessionMonitor = new SessionMonitor(this);
+    }
+  }
+  /**
+   * Get object used to register for events raised by the `UserManager`.
+   */
+  get events() {
+    return this._events;
+  }
+  /**
+   * Get object used to access the metadata configuration of the identity provider.
+   */
+  get metadataService() {
+    return this._client.metadataService;
+  }
+  /**
+   * Load the `User` object for the currently authenticated user.
+   *
+   * @param raiseEvent - If `true`, the `UserLoaded` event will be raised. Defaults to false.
+   * @returns A promise
+   */
+  async getUser(raiseEvent = false) {
+    const logger2 = this._logger.create("getUser");
+    const user = await this._loadUser();
+    if (user) {
+      logger2.info("user loaded");
+      await this._events.load(user, raiseEvent);
+      return user;
+    }
+    logger2.info("user not found in storage");
+    return null;
+  }
+  /**
+   * Remove from any storage the currently authenticated user.
+   *
+   * @returns A promise
+   */
+  async removeUser() {
+    const logger2 = this._logger.create("removeUser");
+    await this.storeUser(null);
+    logger2.info("user removed from storage");
+    await this._events.unload();
+  }
+  /**
+   * Trigger a redirect of the current window to the authorization endpoint.
+   *
+   * @returns A promise
+   *
+   * @throws `Error` In cases of wrong authentication.
+   */
+  async signinRedirect(args = {}) {
+    var _a;
+    this._logger.create("signinRedirect");
+    const {
+      redirectMethod,
+      ...requestArgs
+    } = args;
+    let dpopJkt;
+    if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {
+      dpopJkt = await this.generateDPoPJkt(this.settings.dpop);
+    }
+    const handle = await this._redirectNavigator.prepare({ redirectMethod });
+    await this._signinStart({
+      request_type: "si:r",
+      dpopJkt,
+      ...requestArgs
+    }, handle);
+  }
+  /**
+   * Process the response (callback) from the authorization endpoint.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
+   *
+   * @returns A promise containing the authenticated `User`.
+   *
+   * @see {@link UserManager.signinCallback}
+   */
+  async signinRedirectCallback(url = window.location.href) {
+    const logger2 = this._logger.create("signinRedirectCallback");
+    const user = await this._signinEnd(url);
+    if (user.profile && user.profile.sub) {
+      logger2.info("success, signed in subject", user.profile.sub);
+    } else {
+      logger2.info("no subject");
+    }
+    return user;
+  }
+  /**
+   * Trigger the signin with user/password.
+   *
+   * @returns A promise containing the authenticated `User`.
+   * @throws {@link ErrorResponse} In cases of wrong authentication.
+   */
+  async signinResourceOwnerCredentials({
+    username,
+    password,
+    skipUserInfo = false
+  }) {
+    const logger2 = this._logger.create("signinResourceOwnerCredential");
+    const signinResponse = await this._client.processResourceOwnerPasswordCredentials({
+      username,
+      password,
+      skipUserInfo,
+      extraTokenParams: this.settings.extraTokenParams
+    });
+    logger2.debug("got signin response");
+    const user = await this._buildUser(signinResponse);
+    if (user.profile && user.profile.sub) {
+      logger2.info("success, signed in subject", user.profile.sub);
+    } else {
+      logger2.info("no subject");
+    }
+    return user;
+  }
+  /**
+   * Trigger a request (via a popup window) to the authorization endpoint.
+   *
+   * @returns A promise containing the authenticated `User`.
+   * @throws `Error` In cases of wrong authentication.
+   */
+  async signinPopup(args = {}) {
+    var _a;
+    const logger2 = this._logger.create("signinPopup");
+    let dpopJkt;
+    if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {
+      dpopJkt = await this.generateDPoPJkt(this.settings.dpop);
+    }
+    const {
+      popupWindowFeatures,
+      popupWindowTarget,
+      popupSignal,
+      popupAbortOnClose,
+      ...requestArgs
+    } = args;
+    const url = this.settings.popup_redirect_uri;
+    if (!url) {
+      logger2.throw(new Error("No popup_redirect_uri configured"));
+    }
+    const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal, popupAbortOnClose });
+    const user = await this._signin({
+      request_type: "si:p",
+      redirect_uri: url,
+      display: "popup",
+      dpopJkt,
+      ...requestArgs
+    }, handle);
+    if (user) {
+      if (user.profile && user.profile.sub) {
+        logger2.info("success, signed in subject", user.profile.sub);
+      } else {
+        logger2.info("no subject");
+      }
+    }
+    return user;
+  }
+  /**
+   * Notify the opening window of response (callback) from the authorization endpoint.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
+   *
+   * @returns A promise
+   *
+   * @see {@link UserManager.signinCallback}
+   */
+  async signinPopupCallback(url = window.location.href, keepOpen = false) {
+    const logger2 = this._logger.create("signinPopupCallback");
+    await this._popupNavigator.callback(url, { keepOpen });
+    logger2.info("success");
+  }
+  /**
+   * Trigger a silent request (via refresh token or an iframe) to the authorization endpoint.
+   *
+   * @returns A promise that contains the authenticated `User`.
+   */
+  async signinSilent(args = {}) {
+    var _a, _b;
+    const logger2 = this._logger.create("signinSilent");
+    const {
+      silentRequestTimeoutInSeconds,
+      ...requestArgs
+    } = args;
+    let user = await this._loadUser();
+    if (!args.forceIframeAuth && (user == null ? void 0 : user.refresh_token)) {
+      logger2.debug("using refresh token");
+      const state = new RefreshState(user);
+      return await this._useRefreshToken({
+        state,
+        redirect_uri: requestArgs.redirect_uri,
+        resource: requestArgs.resource,
+        extraTokenParams: requestArgs.extraTokenParams,
+        timeoutInSeconds: silentRequestTimeoutInSeconds
+      });
+    }
+    let dpopJkt;
+    if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {
+      dpopJkt = await this.generateDPoPJkt(this.settings.dpop);
+    }
+    const url = this.settings.silent_redirect_uri;
+    if (!url) {
+      logger2.throw(new Error("No silent_redirect_uri configured"));
+    }
+    let verifySub;
+    if (user && this.settings.validateSubOnSilentRenew) {
+      logger2.debug("subject prior to silent renew:", user.profile.sub);
+      verifySub = user.profile.sub;
+    }
+    const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });
+    user = await this._signin({
+      request_type: "si:s",
+      redirect_uri: url,
+      prompt: "none",
+      id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,
+      dpopJkt,
+      ...requestArgs
+    }, handle, verifySub);
+    if (user) {
+      if ((_b = user.profile) == null ? void 0 : _b.sub) {
+        logger2.info("success, signed in subject", user.profile.sub);
+      } else {
+        logger2.info("no subject");
+      }
+    }
+    return user;
+  }
+  async _useRefreshToken(args) {
+    const response = await this._client.useRefreshToken({
+      timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,
+      ...args
+    });
+    const user = new User({ ...args.state, ...response });
+    await this.storeUser(user);
+    await this._events.load(user);
+    return user;
+  }
+  /**
+   *
+   * Notify the parent window of response (callback) from the authorization endpoint.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
+   *
+   * @returns A promise
+   *
+   * @see {@link UserManager.signinCallback}
+   */
+  async signinSilentCallback(url = window.location.href) {
+    const logger2 = this._logger.create("signinSilentCallback");
+    await this._iframeNavigator.callback(url);
+    logger2.info("success");
+  }
+  /**
+   * Process any response (callback) from the authorization endpoint, by dispatching the request_type
+   * and executing one of the following functions:
+   * - {@link UserManager.signinRedirectCallback}
+   * - {@link UserManager.signinPopupCallback}
+   * - {@link UserManager.signinSilentCallback}
+   *
+   * @throws `Error` If request_type is unknown or signin cannot be processed.
+   */
+  async signinCallback(url = window.location.href) {
+    const { state } = await this._client.readSigninResponseState(url);
+    switch (state.request_type) {
+      case "si:r":
+        return await this.signinRedirectCallback(url);
+      case "si:p":
+        await this.signinPopupCallback(url);
+        break;
+      case "si:s":
+        await this.signinSilentCallback(url);
+        break;
+      default:
+        throw new Error("invalid request_type in state");
+    }
+    return void 0;
+  }
+  /**
+   * Process any response (callback) from the end session endpoint, by dispatching the request_type
+   * and executing one of the following functions:
+   * - {@link UserManager.signoutRedirectCallback}
+   * - {@link UserManager.signoutPopupCallback}
+   * - {@link UserManager.signoutSilentCallback}
+   *
+   * @throws `Error` If request_type is unknown or signout cannot be processed.
+   */
+  async signoutCallback(url = window.location.href, keepOpen = false) {
+    const { state } = await this._client.readSignoutResponseState(url);
+    if (!state) {
+      return void 0;
+    }
+    switch (state.request_type) {
+      case "so:r":
+        return await this.signoutRedirectCallback(url);
+      case "so:p":
+        await this.signoutPopupCallback(url, keepOpen);
+        break;
+      case "so:s":
+        await this.signoutSilentCallback(url);
+        break;
+      default:
+        throw new Error("invalid request_type in state");
+    }
+    return void 0;
+  }
+  /**
+   * Query OP for user's current signin status.
+   *
+   * @returns A promise object with session_state and subject identifier.
+   */
+  async querySessionStatus(args = {}) {
+    const logger2 = this._logger.create("querySessionStatus");
+    const {
+      silentRequestTimeoutInSeconds,
+      ...requestArgs
+    } = args;
+    const url = this.settings.silent_redirect_uri;
+    if (!url) {
+      logger2.throw(new Error("No silent_redirect_uri configured"));
+    }
+    const user = await this._loadUser();
+    const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });
+    const navResponse = await this._signinStart({
+      request_type: "si:s",
+      // this acts like a signin silent
+      redirect_uri: url,
+      prompt: "none",
+      id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,
+      response_type: this.settings.query_status_response_type,
+      scope: "openid",
+      skipUserInfo: true,
+      ...requestArgs
+    }, handle);
+    try {
+      const extraHeaders = {};
+      const signinResponse = await this._client.processSigninResponse(navResponse.url, extraHeaders);
+      logger2.debug("got signin response");
+      if (signinResponse.session_state && signinResponse.profile.sub) {
+        logger2.info("success for subject", signinResponse.profile.sub);
+        return {
+          session_state: signinResponse.session_state,
+          sub: signinResponse.profile.sub
+        };
+      }
+      logger2.info("success, user not authenticated");
+      return null;
+    } catch (err) {
+      if (this.settings.monitorAnonymousSession && err instanceof ErrorResponse) {
+        switch (err.error) {
+          case "login_required":
+          case "consent_required":
+          case "interaction_required":
+          case "account_selection_required":
+            logger2.info("success for anonymous user");
+            return {
+              session_state: err.session_state
+            };
+        }
+      }
+      throw err;
+    }
+  }
+  async _signin(args, handle, verifySub) {
+    const navResponse = await this._signinStart(args, handle);
+    return await this._signinEnd(navResponse.url, verifySub);
+  }
+  async _signinStart(args, handle) {
+    const logger2 = this._logger.create("_signinStart");
+    try {
+      const signinRequest = await this._client.createSigninRequest(args);
+      logger2.debug("got signin request");
+      return await handle.navigate({
+        url: signinRequest.url,
+        state: signinRequest.state.id,
+        response_mode: signinRequest.state.response_mode,
+        scriptOrigin: this.settings.iframeScriptOrigin
+      });
+    } catch (err) {
+      logger2.debug("error after preparing navigator, closing navigator window");
+      handle.close();
+      throw err;
+    }
+  }
+  async _signinEnd(url, verifySub) {
+    const logger2 = this._logger.create("_signinEnd");
+    const extraHeaders = {};
+    const signinResponse = await this._client.processSigninResponse(url, extraHeaders);
+    logger2.debug("got signin response");
+    const user = await this._buildUser(signinResponse, verifySub);
+    return user;
+  }
+  async _buildUser(signinResponse, verifySub) {
+    const logger2 = this._logger.create("_buildUser");
+    const user = new User(signinResponse);
+    if (verifySub) {
+      if (verifySub !== user.profile.sub) {
+        logger2.debug("current user does not match user returned from signin. sub from signin:", user.profile.sub);
+        throw new ErrorResponse({ ...signinResponse, error: "login_required" });
+      }
+      logger2.debug("current user matches user returned from signin");
+    }
+    await this.storeUser(user);
+    logger2.debug("user stored");
+    await this._events.load(user);
+    return user;
+  }
+  /**
+   * Trigger a redirect of the current window to the end session endpoint.
+   *
+   * @returns A promise
+   */
+  async signoutRedirect(args = {}) {
+    const logger2 = this._logger.create("signoutRedirect");
+    const {
+      redirectMethod,
+      ...requestArgs
+    } = args;
+    const handle = await this._redirectNavigator.prepare({ redirectMethod });
+    await this._signoutStart({
+      request_type: "so:r",
+      post_logout_redirect_uri: this.settings.post_logout_redirect_uri,
+      ...requestArgs
+    }, handle);
+    logger2.info("success");
+  }
+  /**
+   * Process response (callback) from the end session endpoint.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
+   *
+   * @returns A promise containing signout response
+   *
+   * @see {@link UserManager.signoutCallback}
+   */
+  async signoutRedirectCallback(url = window.location.href) {
+    const logger2 = this._logger.create("signoutRedirectCallback");
+    const response = await this._signoutEnd(url);
+    logger2.info("success");
+    return response;
+  }
+  /**
+   * Trigger a redirect of a popup window to the end session endpoint.
+   *
+   * @returns A promise
+   */
+  async signoutPopup(args = {}) {
+    const logger2 = this._logger.create("signoutPopup");
+    const {
+      popupWindowFeatures,
+      popupWindowTarget,
+      popupSignal,
+      ...requestArgs
+    } = args;
+    const url = this.settings.popup_post_logout_redirect_uri;
+    const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal });
+    await this._signout({
+      request_type: "so:p",
+      post_logout_redirect_uri: url,
+      // we're putting a dummy entry in here because we
+      // need a unique id from the state for notification
+      // to the parent window, which is necessary if we
+      // plan to return back to the client after signout
+      // and so we can close the popup after signout
+      state: url == null ? void 0 : {},
+      ...requestArgs
+    }, handle);
+    logger2.info("success");
+  }
+  /**
+   * Process response (callback) from the end session endpoint from a popup window.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
+   *
+   * @returns A promise
+   *
+   * @see {@link UserManager.signoutCallback}
+   */
+  async signoutPopupCallback(url = window.location.href, keepOpen = false) {
+    const logger2 = this._logger.create("signoutPopupCallback");
+    await this._popupNavigator.callback(url, { keepOpen });
+    logger2.info("success");
+  }
+  async _signout(args, handle) {
+    const navResponse = await this._signoutStart(args, handle);
+    return await this._signoutEnd(navResponse.url);
+  }
+  async _signoutStart(args = {}, handle) {
+    var _a;
+    const logger2 = this._logger.create("_signoutStart");
+    try {
+      const user = await this._loadUser();
+      logger2.debug("loaded current user from storage");
+      if (this.settings.revokeTokensOnSignout) {
+        await this._revokeInternal(user);
+      }
+      const id_token = args.id_token_hint || user && user.id_token;
+      if (id_token) {
+        logger2.debug("setting id_token_hint in signout request");
+        args.id_token_hint = id_token;
+      }
+      await this.removeUser();
+      logger2.debug("user removed, creating signout request");
+      const signoutRequest = await this._client.createSignoutRequest(args);
+      logger2.debug("got signout request");
+      return await handle.navigate({
+        url: signoutRequest.url,
+        state: (_a = signoutRequest.state) == null ? void 0 : _a.id,
+        scriptOrigin: this.settings.iframeScriptOrigin
+      });
+    } catch (err) {
+      logger2.debug("error after preparing navigator, closing navigator window");
+      handle.close();
+      throw err;
+    }
+  }
+  async _signoutEnd(url) {
+    const logger2 = this._logger.create("_signoutEnd");
+    const signoutResponse = await this._client.processSignoutResponse(url);
+    logger2.debug("got signout response");
+    return signoutResponse;
+  }
+  /**
+   * Trigger a silent request (via an iframe) to the end session endpoint.
+   *
+   * @returns A promise
+   */
+  async signoutSilent(args = {}) {
+    var _a;
+    const logger2 = this._logger.create("signoutSilent");
+    const {
+      silentRequestTimeoutInSeconds,
+      ...requestArgs
+    } = args;
+    const id_token_hint = this.settings.includeIdTokenInSilentSignout ? (_a = await this._loadUser()) == null ? void 0 : _a.id_token : void 0;
+    const url = this.settings.popup_post_logout_redirect_uri;
+    const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });
+    await this._signout({
+      request_type: "so:s",
+      post_logout_redirect_uri: url,
+      id_token_hint,
+      ...requestArgs
+    }, handle);
+    logger2.info("success");
+  }
+  /**
+   * Notify the parent window of response (callback) from the end session endpoint.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
+   *
+   * @returns A promise
+   *
+   * @see {@link UserManager.signoutCallback}
+   */
+  async signoutSilentCallback(url = window.location.href) {
+    const logger2 = this._logger.create("signoutSilentCallback");
+    await this._iframeNavigator.callback(url);
+    logger2.info("success");
+  }
+  async revokeTokens(types) {
+    const user = await this._loadUser();
+    await this._revokeInternal(user, types);
+  }
+  async _revokeInternal(user, types = this.settings.revokeTokenTypes) {
+    const logger2 = this._logger.create("_revokeInternal");
+    if (!user) return;
+    const typesPresent = types.filter((type) => typeof user[type] === "string");
+    if (!typesPresent.length) {
+      logger2.debug("no need to revoke due to no token(s)");
+      return;
+    }
+    for (const type of typesPresent) {
+      await this._client.revokeToken(
+        user[type],
+        type
+      );
+      logger2.info(`${type} revoked successfully`);
+      if (type !== "access_token") {
+        user[type] = null;
+      }
+    }
+    await this.storeUser(user);
+    logger2.debug("user stored");
+    await this._events.load(user);
+  }
+  /**
+   * Enables silent renew for the `UserManager`.
+   */
+  startSilentRenew() {
+    this._logger.create("startSilentRenew");
+    void this._silentRenewService.start();
+  }
+  /**
+   * Disables silent renew for the `UserManager`.
+   */
+  stopSilentRenew() {
+    this._silentRenewService.stop();
+  }
+  get _userStoreKey() {
+    return `user:${this.settings.authority}:${this.settings.client_id}`;
+  }
+  async _loadUser() {
+    const logger2 = this._logger.create("_loadUser");
+    const storageString = await this.settings.userStore.get(this._userStoreKey);
+    if (storageString) {
+      logger2.debug("user storageString loaded");
+      return User.fromStorageString(storageString);
+    }
+    logger2.debug("no user storageString");
+    return null;
+  }
+  async storeUser(user) {
+    const logger2 = this._logger.create("storeUser");
+    if (user) {
+      logger2.debug("storing user");
+      const storageString = user.toStorageString();
+      await this.settings.userStore.set(this._userStoreKey, storageString);
+    } else {
+      this._logger.debug("removing user");
+      await this.settings.userStore.remove(this._userStoreKey);
+      if (this.settings.dpop) {
+        await this.settings.dpop.store.remove(this.settings.client_id);
+      }
+    }
+  }
+  /**
+   * Removes stale state entries in storage for incomplete authorize requests.
+   */
+  async clearStaleState() {
+    await this._client.clearStaleState();
+  }
+  /**
+   * Dynamically generates a DPoP proof for a given user, URL and optional Http method.
+   * This method is useful when you need to make a request to a resource server
+   * with fetch or similar, and you need to include a DPoP proof in a DPoP header.
+   * @param url - The URL to generate the DPoP proof for
+   * @param user - The user to generate the DPoP proof for
+   * @param httpMethod - Optional, defaults to "GET"
+   * @param nonce - Optional nonce provided by the resource server
+   *
+   * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.
+   */
+  async dpopProof(url, user, httpMethod, nonce) {
+    var _a, _b;
+    const dpopState = await ((_b = (_a = this.settings.dpop) == null ? void 0 : _a.store) == null ? void 0 : _b.get(this.settings.client_id));
+    if (dpopState) {
+      return await CryptoUtils.generateDPoPProof({
+        url,
+        accessToken: user == null ? void 0 : user.access_token,
+        httpMethod,
+        keyPair: dpopState.keys,
+        nonce
+      });
+    }
+    return void 0;
+  }
+  async generateDPoPJkt(dpopSettings) {
+    let dpopState = await dpopSettings.store.get(this.settings.client_id);
+    if (!dpopState) {
+      const dpopKeys = await CryptoUtils.generateDPoPKeys();
+      dpopState = new DPoPState(dpopKeys);
+      await dpopSettings.store.set(this.settings.client_id, dpopState);
+    }
+    return await CryptoUtils.generateDPoPJkt(dpopState.keys);
+  }
+};
+
+// package.json
+var version = "3.5.0";
+
+// src/Version.ts
+var Version = version;
+
+// src/IndexedDbDPoPStore.ts
+var IndexedDbDPoPStore = class {
+  constructor() {
+    this._dbName = "oidc";
+    this._storeName = "dpop";
+  }
+  async set(key, value) {
+    const store = await this.createStore(this._dbName, this._storeName);
+    await store("readwrite", (str) => {
+      str.put(value, key);
+      return this.promisifyRequest(str.transaction);
+    });
+  }
+  async get(key) {
+    const store = await this.createStore(this._dbName, this._storeName);
+    return await store("readonly", (str) => {
+      return this.promisifyRequest(str.get(key));
+    });
+  }
+  async remove(key) {
+    const item = await this.get(key);
+    const store = await this.createStore(this._dbName, this._storeName);
+    await store("readwrite", (str) => {
+      return this.promisifyRequest(str.delete(key));
+    });
+    return item;
+  }
+  async getAllKeys() {
+    const store = await this.createStore(this._dbName, this._storeName);
+    return await store("readonly", (str) => {
+      return this.promisifyRequest(str.getAllKeys());
+    });
+  }
+  promisifyRequest(request) {
+    return new Promise((resolve, reject) => {
+      request.oncomplete = request.onsuccess = () => resolve(request.result);
+      request.onabort = request.onerror = () => reject(request.error);
+    });
+  }
+  async createStore(dbName, storeName) {
+    const request = indexedDB.open(dbName);
+    request.onupgradeneeded = () => request.result.createObjectStore(storeName);
+    const db = await this.promisifyRequest(request);
+    return async (txMode, callback) => {
+      const tx = db.transaction(storeName, txMode);
+      const store = tx.objectStore(storeName);
+      return await callback(store);
+    };
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AccessTokenEvents,
+  CheckSessionIFrame,
+  DPoPState,
+  ErrorResponse,
+  ErrorTimeout,
+  InMemoryWebStorage,
+  IndexedDbDPoPStore,
+  Log,
+  Logger,
+  MetadataService,
+  OidcClient,
+  OidcClientSettingsStore,
+  SessionMonitor,
+  SigninResponse,
+  SigninState,
+  SignoutResponse,
+  State,
+  User,
+  UserManager,
+  UserManagerSettingsStore,
+  Version,
+  WebStorageStateStore
+});
+//# sourceMappingURL=oidc-client-ts.js.map