@pega/auth 0.2.24 → 0.2.25

package/lib/sdk-auth-manager/authManager.js

@@ -1,5 +1,17 @@
 // This file wraps various calls related to logging in, logging out, etc.
 //  that use the auth.html/auth.js to do the work of logging in via OAuth 2.0.
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AuthManager_instances, _AuthManager_ssKeyPrefix, _AuthManager_pegaAuth, _AuthManager_ssKeyConfigInfo, _AuthManager_ssKeySessionInfo, _AuthManager_ssKeyTokenInfo, _AuthManager_ssKeyState, _AuthManager_authConfig, _AuthManager_authDynState, _AuthManager_authHeader, _AuthManager_customTokenParamsCB, _AuthManager_bOAuthCustom, _AuthManager_tokenInfo, _AuthManager_userInfo, _AuthManager_usePASS, _AuthManager_beforeUnloadAdded, _AuthManager_tokenStorage, _AuthManager_transform, _AuthManager_foldSpot, _AuthManager_loadUserinfo, _AuthManager_loginProps, _AuthManager_promiseInitialize, _AuthManager_transformAndParse, _AuthManager_getStorage, _AuthManager_setStorage, _AuthManager_calcFoldSpot, _AuthManager_transformer, _AuthManager_doUnloadUpdates, _AuthManager_doBeforeUnload, _AuthManager_doPageHide, _AuthManager_loadState, _AuthManager_doOnLoad, _AuthManager_doAuthDynStateChanged, _AuthManager_initialize, _AuthManager_constellationInit, _AuthManager_customConstellationInit, _AuthManager_fireTokenAvailable, _AuthManager_processTokenOnLogin, _AuthManager_doCustomTokenParamsCB, _AuthManager_updateLoginStatus, _AuthManager_authFullReauth, _AuthManager_authTokenUpdated;
 // It utilizes a JS Class and private members to protect any sensitive tokens
 //  and token obfuscation routines
 import { PegaAuth } from '../oauth-client/auth.js';
@@ -7,157 +19,112 @@ import { isEmptyObject } from './common-utils.js';
 import { getSdkConfig, SdkConfigAccess } from './config_access.js';
 // Meant to be a singleton...only one instance per page
 class AuthManager {
-    #ssKeyPrefix = 'rs';
-    iOSDevice = false;
-    // will store the PegaAuth (OAuth 2.0 client library) instance
-    #pegaAuth = null;
-    #ssKeyConfigInfo = '';
-    #ssKeySessionInfo = '';
-    #ssKeyTokenInfo = '';
-    #ssKeyState = `${this.#ssKeyPrefix}State`;
-    #authConfig = {};
-    #authDynState = {};
-    #authHeader = null;
-    #customTokenParamsCB = null;
-    // state that should be persisted across loads
-    state = { usePopup: false, noInitialRedirect: false, locale: null };
-    // # of properties within initial state object
-    stateKeysCount = 3;
-    bC11NBootstrapInProgress = false;
-    bCustomAuth = false;
-    #bOAuthCustom = false;
-    #tokenInfo;
-    #userInfo;
-    onLoadDone = false;
-    msReauthStart = null;
-    initInProgress = false;
-    isLoggedIn = false;
-    // Whether to pass a session storage key or structure to auth library
-    #usePASS = false;
-    #beforeUnloadAdded = false;
-    #tokenStorage = 'temp';
-    #transform = true;
-    #foldSpot = 2;
-    // Whether to load and cache user info as part of login
-    #loadUserinfo = false;
-    // Keep loginProps passed to loginIfNecessary
-    #loginProps = null;
-    // Promise for Initialization of PegaAuth and resolution callback
-    #promiseInitialize = null;
     constructor() {
+        _AuthManager_instances.add(this);
+        _AuthManager_ssKeyPrefix.set(this, 'rs');
+        Object.defineProperty(this, "iOSDevice", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        // will store the PegaAuth (OAuth 2.0 client library) instance
+        _AuthManager_pegaAuth.set(this, null);
+        _AuthManager_ssKeyConfigInfo.set(this, '');
+        _AuthManager_ssKeySessionInfo.set(this, '');
+        _AuthManager_ssKeyTokenInfo.set(this, '');
+        _AuthManager_ssKeyState.set(this, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}State`);
+        _AuthManager_authConfig.set(this, {});
+        _AuthManager_authDynState.set(this, {});
+        _AuthManager_authHeader.set(this, null);
+        _AuthManager_customTokenParamsCB.set(this, null);
+        // state that should be persisted across loads
+        Object.defineProperty(this, "state", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: { usePopup: false, noInitialRedirect: false, locale: null }
+        });
+        // # of properties within initial state object
+        Object.defineProperty(this, "stateKeysCount", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 3
+        });
+        Object.defineProperty(this, "bC11NBootstrapInProgress", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "bCustomAuth", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        _AuthManager_bOAuthCustom.set(this, false);
+        _AuthManager_tokenInfo.set(this, void 0);
+        _AuthManager_userInfo.set(this, void 0);
+        Object.defineProperty(this, "onLoadDone", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "msReauthStart", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+        Object.defineProperty(this, "initInProgress", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "isLoggedIn", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        // Whether to pass a session storage key or structure to auth library
+        _AuthManager_usePASS.set(this, false);
+        _AuthManager_beforeUnloadAdded.set(this, false);
+        _AuthManager_tokenStorage.set(this, 'temp');
+        _AuthManager_transform.set(this, true);
+        _AuthManager_foldSpot.set(this, 2);
+        // Whether to load and cache user info as part of login
+        _AuthManager_loadUserinfo.set(this, false);
+        // Keep loginProps passed to loginIfNecessary
+        _AuthManager_loginProps.set(this, null);
+        // Promise for Initialization of PegaAuth and resolution callback
+        _AuthManager_promiseInitialize.set(this, null);
         // Auth Manager specific state is saved within session storage as important in redirect and popup window scenarios
-        this.#loadState();
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_loadState).call(this);
         this.iOSDevice = /iPad|iPhone|iPod/.test(navigator.userAgent);
     }
-    #transformAndParse(ssKey, ssItem, bForce = false) {
-        let obj = {};
-        try {
-            obj = JSON.parse(this.#transformer(ssKey, ssItem, false, bForce));
-        }
-        catch (e) {
-            // fall thru and return empty object
-        }
-        return obj;
-    }
-    // helper routine to retrieve JSON object stored in a session storage key
-    // a 2nd optional arg can also retrieve an individual attribute
-    #getStorage(ssKey, sAttrib = null) {
-        let ssItem = ssKey ? window.sessionStorage.getItem(ssKey) : null;
-        let obj = {};
-        if (this.#loginProps?.altStateStorage &&
-            !this.isLoggedIn &&
-            !ssItem &&
-            (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo)) {
-            ssItem = window.localStorage.getItem(ssKey);
-        }
-        if (ssItem) {
-            try {
-                obj = JSON.parse(ssItem);
-            }
-            catch (e) {
-                obj = this.#transformAndParse(ssKey, ssItem, true);
-            }
-        }
-        return sAttrib ? obj[sAttrib] : obj;
-    }
-    // helper routine to set storage to the passed in JSON
-    #setStorage(ssKey, obj, bVerify = false) {
-        try {
-            // Set storage only if obj is not empty, else delete the storage
-            if (!obj || isEmptyObject(obj)) {
-                window.sessionStorage.removeItem(ssKey);
-            }
-            else {
-                // const bClear = (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo);
-                const bClear = false;
-                const sValue = bClear
-                    ? JSON.stringify(obj)
-                    : this.#transformer(ssKey, JSON.stringify(obj), true);
-                window.sessionStorage.setItem(ssKey, sValue);
-                if (bVerify) {
-                    const sStored = window.sessionStorage.getItem(ssKey);
-                    if (sStored !== sValue) {
-                        // eslint-disable-next-line no-console
-                        console.error(`Failed to properly write sessionStorage (${ssKey})`);
-                    }
-                }
-                if (this.#loginProps?.altStateStorage &&
-                    !this.isLoggedIn &&
-                    (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo)) {
-                    window.localStorage.setItem(ssKey, sValue);
-                }
-            }
-        }
-        catch (e) {
-            // eslint-disable-next-line no-console
-            console.error(`Exception ${e} on attempted write of sessionStorage (${ssKey})`);
-        }
-    }
-    #calcFoldSpot(s) {
-        const nOffset = 1;
-        const sChar = s.length > nOffset ? s.charAt(nOffset) : '2';
-        const nSpot = parseInt(sChar, 10);
-        this.#foldSpot = Number.isNaN(nSpot) ? 2 : (nSpot % 4) + 2;
-    }
-    // helper function to encode storage
-    #transformer(ssKey, s, bIn, bForce = false) {
-        const bTransform = bForce || this.#transform;
-        const fnFold = (x) => {
-            const nLen = x.length;
-            const nExtra = nLen % this.#foldSpot;
-            const nOffset = Math.floor(nLen / this.#foldSpot) + nExtra;
-            const nRem = x.length - nOffset;
-            return x.substring(bIn ? nOffset : nRem) + x.substring(0, bIn ? nOffset : nRem);
-        };
-        const bTknInfo = ssKey === this.#ssKeyTokenInfo;
-        if (bTknInfo && !bIn && bTransform) {
-            s = window.atob(fnFold(s));
-        }
-        // eslint-disable-next-line no-nested-ternary
-        let result = bTransform ? (bIn ? window.btoa(s) : window.atob(s)) : s;
-        if (bTknInfo && bIn && bTransform) {
-            result = fnFold(window.btoa(result));
-        }
-        return result;
-    }
     // Setter for authHeader (no getter)
     set authHeader(value) {
-        this.#authHeader = value;
+        __classPrivateFieldSet(this, _AuthManager_authHeader, value, "f");
         // setAuthorizationHeader method not available til 8.8 so do safety check
         if (window.PCore?.getAuthUtils().setAuthorizationHeader) {
             const authHdr = value === null ? '' : value;
             window.PCore.getAuthUtils().setAuthorizationHeader(authHdr);
         }
-        this.#updateLoginStatus();
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
     }
     // Setter for customTokenParamsCB
     set customTokenParamsCB(fn) {
-        this.#customTokenParamsCB = fn;
+        __classPrivateFieldSet(this, _AuthManager_customTokenParamsCB, fn, "f");
     }
     // Setter/getter for appName
     set appName(appName) {
         this.state.appName = appName;
-        this.#setStorage(this.#ssKeyState, this.state);
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
     }
     get appName() {
         return this.state.appName;
@@ -165,7 +132,7 @@ class AuthManager {
     // Setter/getter for usePopupForRestOfSession
     set usePopupForRestOfSession(usePopup) {
         this.state.usePopup = usePopup;
-        this.#setStorage(this.#ssKeyState, this.state);
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
     }
     get usePopupForRestOfSession() {
         return this.state.usePopup;
@@ -176,7 +143,7 @@ class AuthManager {
             this.usePopupForRestOfSession = true;
         }
         this.state.noInitialRedirect = bNoInitialRedirect;
-        this.#setStorage(this.#ssKeyState, this.state);
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
     }
     get noInitialRedirect() {
         return this.state.noInitialRedirect || false;
@@ -184,7 +151,7 @@ class AuthManager {
     // Setter/getter for locale (override)
     set locale(localeOverride) {
         this.state.locale = localeOverride;
-        this.#setStorage(this.#ssKeyState, this.state);
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
     }
     get locale() {
         return this.state.locale;
@@ -197,7 +164,7 @@ class AuthManager {
         else if (this.msReauthStart) {
             delete this.msReauthStart;
         }
-        this.#setStorage(this.#ssKeyState, this.state);
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
     }
     get reauthStart() {
         return this.msReauthStart || 0;
@@ -206,22 +173,22 @@ class AuthManager {
     set keySuffix(s) {
         this.state.sfx = s || undefined;
         if (s) {
-            this.#setStorage(this.#ssKeyState, this.state);
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
             // To make it a bit more obtuse reverse the string and use that as the actual suffix
             const sSfx = s.split('').reverse().join('');
-            this.#ssKeyConfigInfo = `${this.#ssKeyPrefix}CI_${sSfx}`;
-            this.#ssKeySessionInfo = `${this.#ssKeyPrefix}SI_${sSfx}`;
-            this.#ssKeyTokenInfo = `${this.#ssKeyPrefix}TI_${sSfx}`;
-            this.#calcFoldSpot(sSfx);
+            __classPrivateFieldSet(this, _AuthManager_ssKeyConfigInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}CI_${sSfx}`, "f");
+            __classPrivateFieldSet(this, _AuthManager_ssKeySessionInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}SI_${sSfx}`, "f");
+            __classPrivateFieldSet(this, _AuthManager_ssKeyTokenInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}TI_${sSfx}`, "f");
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_calcFoldSpot).call(this, sSfx);
         }
         else {
-            sessionStorage.removeItem(this.#ssKeyTokenInfo);
-            sessionStorage.removeItem(this.#ssKeyConfigInfo);
-            sessionStorage.removeItem(this.#ssKeySessionInfo);
-            sessionStorage.removeItem(this.#ssKeyState);
-            this.#ssKeyConfigInfo = '';
-            this.#ssKeySessionInfo = '';
-            this.#ssKeyTokenInfo = '';
+            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
+            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"));
+            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
+            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
+            __classPrivateFieldSet(this, _AuthManager_ssKeyConfigInfo, '', "f");
+            __classPrivateFieldSet(this, _AuthManager_ssKeySessionInfo, '', "f");
+            __classPrivateFieldSet(this, _AuthManager_ssKeyTokenInfo, '', "f");
         }
     }
     /**
@@ -229,443 +196,25 @@ class AuthManager {
      */
     clear(bFullReauth = false) {
         if (!this.bCustomAuth) {
-            this.#authHeader = null;
+            __classPrivateFieldSet(this, _AuthManager_authHeader, null, "f");
         }
         // Clear any established auth tokens
-        this.#tokenInfo = null;
-        sessionStorage.removeItem(this.#ssKeyTokenInfo);
+        __classPrivateFieldSet(this, _AuthManager_tokenInfo, null, "f");
+        sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
         this.isLoggedIn = false;
         // reset the initial redirect as well by using this setter
         this.usePopupForRestOfSession = bFullReauth;
         if (!bFullReauth) {
-            if (!this.#usePASS) {
-                this.#authConfig = {};
-                this.#authDynState = {};
+            if (!__classPrivateFieldGet(this, _AuthManager_usePASS, "f")) {
+                __classPrivateFieldSet(this, _AuthManager_authConfig, {}, "f");
+                __classPrivateFieldSet(this, _AuthManager_authDynState, {}, "f");
             }
             // keySuffix setter has cleanup logic
             this.keySuffix = '';
         }
     }
-    // Found beforeunload to not work well on iOS browsers, and pagehide to work better
-    // However also seeing some scenario like navigating to a different page on Chrome & Firefox only invoking beforeunload
-    // Chrome, Firefox, Safari browsers sequence on page reload: beforeunload, pagehide, visibilitychange
-    // visibilitychange is fired whenever a tab is made visible and when it is hidden
-    #doUnloadUpdates() {
-        // Safari and particularly Safari on mobile devices doesn't seem to load this on first main redirect or
-        // reliably, so have moved to having PegaAuth manage writing all state props to session storage
-        this.#setStorage(this.#ssKeyState, this.state);
-        this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
-        // If tokenStorage was always, token would already be there
-        if (this.#tokenStorage === 'temp') {
-            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
-        }
-    }
-    #doBeforeUnload() {
-        this.#doUnloadUpdates();
-    }
-    #doPageHide() {
-        this.#doUnloadUpdates();
-    }
-    #loadState() {
-        // Note: State storage key doesn't have a client id associated with it
-        const oState = this.#getStorage(this.#ssKeyState);
-        if (oState) {
-            Object.assign(this.state, oState);
-            if (this.state.sfx) {
-                // Setter sets up the ssKey values as well
-                this.keySuffix = this.state.sfx;
-            }
-        }
-    }
-    // This is only called from initialize after #ssKey values are setup
-    #doOnLoad() {
-        if (!this.onLoadDone) {
-            // This authConfig state doesn't collide with other calculated static state...so load it first
-            // Note: transform setting will have already been loaded into #authConfig at this point
-            this.#authDynState = this.#getStorage(this.#ssKeySessionInfo);
-            this.#tokenInfo = this.#getStorage(this.#ssKeyTokenInfo);
-            if (this.#tokenStorage !== 'always') {
-                sessionStorage.removeItem(this.#ssKeyTokenInfo);
-                // Finding on iOS browsers the pageHide event is sometimes not happening causing failed redirects.
-                if (!this.iOSDevice) {
-                    sessionStorage.removeItem(this.#ssKeySessionInfo);
-                }
-            }
-            this.onLoadDone = true;
-        }
-    }
-    // Callback when auth dynamic state has changed. Decide whether to persisting it based on
-    //  config settings
-    #doAuthDynStateChanged() {
-        // If tokenStorage is setup for always then always persist the auth dynamic state as well
-        if (this.#tokenStorage === 'always' || this.iOSDevice) {
-            this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
-        }
-    }
-    /**
-     * Initialize OAuth config structure members and create authMgr instance (if necessary)
-     * bNew - governs whether to create new sessionStorage or load existing one
-     */
-    async #initialize(bNew = false) {
-        if (!bNew && this.#promiseInitialize) {
-            return this.#promiseInitialize;
-        }
-        this.#promiseInitialize = new Promise(resolve => {
-            /* if (!this.initInProgress && (bNew || isEmptyObject(this.#authConfig) || !this.#pegaAuth)) { */
-            this.initInProgress = true;
-            getSdkConfig().then(sdkConfig => {
-                const sdkConfigAuth = sdkConfig.authConfig;
-                const sdkConfigServer = sdkConfig.serverConfig;
-                const serverType = sdkConfigServer.serverType || 'infinity';
-                const bInfinity = serverType === 'infinity';
-                let pegaUrl = bInfinity
-                    ? sdkConfigServer.infinityRestServerUrl
-                    : sdkConfigServer.launchpadRestServerUrl;
-                // Expecting boolean true/false or undefined
-                const secureCookie = !!sdkConfigAuth.secureCookie;
-                const bNoInitialRedirect = this.noInitialRedirect;
-                const appAliasSeg = sdkConfigServer.appAlias ? `app/${sdkConfigServer.appAlias}/` : '';
-                // Construct default OAuth endpoints (if not explicitly specified)
-                if (pegaUrl) {
-                    // Cope with trailing slash being present
-                    if (!pegaUrl.endsWith('/')) {
-                        pegaUrl += '/';
-                    }
-                    if (!sdkConfigAuth.authorize) {
-                        sdkConfigAuth.authorize = bInfinity
-                            ? `${pegaUrl}PRRestService/oauth2/v1/authorize`
-                            : `${pegaUrl}uas/oauth/authorize`;
-                    }
-                    const infinityOAuth2Url = bInfinity
-                        ? pegaUrl + (secureCookie && appAliasSeg ? `${appAliasSeg}api/` : 'PRRestService/')
-                        : '';
-                    if (!sdkConfigAuth.token) {
-                        sdkConfigAuth.token = bInfinity
-                            ? `${infinityOAuth2Url}oauth2/v1/token`
-                            : `${pegaUrl}uas/oauth/token`;
-                    }
-                    if (!sdkConfigAuth.revoke) {
-                        // Launchpad still does not have a revoke endpoint
-                        sdkConfigAuth.revoke = bInfinity ? `${infinityOAuth2Url}oauth2/v1/revoke` : '';
-                    }
-                    if (!sdkConfigAuth.redirectUri) {
-                        sdkConfigAuth.redirectUri = `${window.location.origin}${window.location.pathname}`;
-                    }
-                    if (!sdkConfigAuth.userinfo) {
-                        sdkConfigAuth.userinfo = bInfinity
-                            ? `${pegaUrl}${appAliasSeg}api/oauthclients/v1/userinfo/JSON`
-                            : '';
-                    }
-                }
-                // Auth service alias
-                if (!sdkConfigAuth.authService) {
-                    sdkConfigAuth.authService = 'pega';
-                }
-                // mashupAuthService provides way to have a different auth service for embedded
-                if (!sdkConfigAuth.mashupAuthService) {
-                    sdkConfigAuth.mashupAuthService = sdkConfigAuth.authService;
-                }
-                // Construct path to auth.html (used for case when not doing a main window redirect)
-                let sNoMainRedirectUri = sdkConfigAuth.redirectUri;
-                const nLastPathSep = sNoMainRedirectUri.lastIndexOf('/');
-                sNoMainRedirectUri =
-                    nLastPathSep !== -1
-                        ? `${sNoMainRedirectUri.substring(0, nLastPathSep + 1)}auth.html`
-                        : `${sNoMainRedirectUri}/auth.html`;
-                const portalGrantType = sdkConfigAuth.portalGrantType || 'authCode';
-                const mashupGrantType = sdkConfigAuth.mashupGrantType || 'authCode';
-                // Some grant types are only available with confidential registrations and require a client secret
-                const clientSecret = bNoInitialRedirect
-                    ? sdkConfigAuth.mashupClientSecret
-                    : sdkConfigAuth.portalClientSecret;
-                const pegaAuthConfig = {
-                    serverType,
-                    clientId: bNoInitialRedirect
-                        ? sdkConfigAuth.mashupClientId
-                        : sdkConfigAuth.portalClientId,
-                    grantType: bNoInitialRedirect ? mashupGrantType : portalGrantType,
-                    tokenUri: sdkConfigAuth.token,
-                    revokeUri: sdkConfigAuth.revoke,
-                    userinfoUri: sdkConfigAuth.userinfo,
-                    authService: bNoInitialRedirect
-                        ? sdkConfigAuth.mashupAuthService
-                        : sdkConfigAuth.authService,
-                    appAlias: sdkConfigServer.appAlias || '',
-                    useLocking: true
-                };
-                if (clientSecret) {
-                    pegaAuthConfig.clientSecret = clientSecret;
-                }
-                if (serverType === 'launchpad' && pegaAuthConfig.grantType === 'authCode') {
-                    pegaAuthConfig.noPKCE = true;
-                }
-                // Invoke keySuffix setter
-                // Was using pegaAuthConfig.clientId as key but more secure to just use a random string as getting
-                //  both a clientId and the refresh token could yield a new access token.
-                // Suffix is so we might in future move to an array of suffixes based on the appName, so might store
-                //  both portal and embedded tokens/session info at same time
-                if (!this.state?.sfx) {
-                    // Just using a random number to make the suffix unique on each session
-                    this.keySuffix = `${Math.ceil(Math.random() * 100000000)}`;
-                }
-                this.#authConfig.transform =
-                    sdkConfigAuth.transform !== undefined ? sdkConfigAuth.transform : this.#transform;
-                // Using property in class as authConfig may be empty at times
-                this.#transform = this.#authConfig.transform;
-                if (sdkConfigAuth.tokenStorage !== undefined) {
-                    this.#tokenStorage = sdkConfigAuth.tokenStorage;
-                }
-                if (sdkConfigAuth.secureCookie) {
-                    this.#authConfig.secureCookie = true;
-                }
-                // Get latest state once client ids, transform and tokenStorage have been established
-                this.#doOnLoad();
-                // If no clientId is specified assume not OAuth but custom auth
-                if (pegaAuthConfig.grantType === 'none' || !pegaAuthConfig.clientId) {
-                    this.bCustomAuth = true;
-                    return;
-                }
-                // For some OAuth grant type scenarios we opt to pass the Orchestration Engine just an authHeader as
-                //  service broker doesn't have proper support for dealing with refreshing or revoking these:
-                //  * customBearer (except when secureCookie being used)
-                //  * confidential grant types (ones with clientSecret)
-                // (With 25.1 orchestration engine does support this if client_secret is specified on bootstrap)
-                this.#bOAuthCustom =
-                    (pegaAuthConfig.grantType === 'customBearer' && !secureCookie) || clientSecret;
-                if (pegaAuthConfig.grantType === 'authCode') {
-                    const authCodeProps = {
-                        authorizeUri: sdkConfigAuth.authorize,
-                        // If we have already specified a redirect on the authorize redirect, we need to continue to use that
-                        //  on token endpoint
-                        redirectUri: bNoInitialRedirect || this.usePopupForRestOfSession
-                            ? sNoMainRedirectUri
-                            : sdkConfigAuth.redirectUri
-                    };
-                    if ('silentTimeout' in sdkConfigAuth) {
-                        authCodeProps.silentTimeout = sdkConfigAuth.silentTimeout;
-                    }
-                    if (bNoInitialRedirect &&
-                        pegaAuthConfig.authService === 'pega' &&
-                        sdkConfigAuth.mashupUserIdentifier &&
-                        sdkConfigAuth.mashupPassword) {
-                        authCodeProps.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
-                        authCodeProps.password = sdkConfigAuth.mashupPassword;
-                    }
-                    if ('iframeLoginUI' in sdkConfigAuth) {
-                        authCodeProps.iframeLoginUI =
-                            sdkConfigAuth.iframeLoginUI.toString().toLowerCase() === 'true';
-                    }
-                    Object.assign(pegaAuthConfig, authCodeProps);
-                }
-                else if (pegaAuthConfig.grantType === 'passwordCreds') {
-                    pegaAuthConfig.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
-                    pegaAuthConfig.password = sdkConfigAuth.mashupPassword;
-                }
-                Object.assign(this.#authConfig, pegaAuthConfig);
-                // Add beforeunload and page hide handlers to write out key properties that we want to survive a
-                //  browser reload
-                if (!this.#beforeUnloadAdded && (!this.#usePASS || this.#tokenStorage !== 'always')) {
-                    window.addEventListener('beforeunload', this.#doBeforeUnload.bind(this));
-                    window.addEventListener('pagehide', this.#doPageHide.bind(this));
-                    this.#beforeUnloadAdded = true;
-                }
-                // Initialize PegaAuth OAuth 2.0 client library
-                if (this.#usePASS) {
-                    this.#setStorage(this.#ssKeyConfigInfo, this.#authConfig);
-                    this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
-                    this.#pegaAuth = new PegaAuth(this.#ssKeyConfigInfo, this.#ssKeySessionInfo);
-                }
-                else {
-                    this.#authConfig.fnDynStateChangedCB = this.#doAuthDynStateChanged.bind(this);
-                    this.#pegaAuth = new PegaAuth(this.#authConfig, this.#authDynState);
-                }
-                this.initInProgress = false;
-                resolve(this.#pegaAuth);
-            });
-        });
-        return this.#promiseInitialize;
-    }
-    /**
-     * Initiate the process to get the Constellation bootstrap shell loaded and initialized
-     * @param {Object} tokenInfo
-     * @param {Function} authTokenUpdated - callback invoked when Constellation JS Engine silently updates
-     *      an expired access_token
-     * @param {Function} fnReauth - callback invoked when a full or custom reauth is needed
-     */
-    #constellationInit(tokenInfo, authTokenUpdated, fnReauth) {
-        const constellationBootConfig = {};
-        const sdkConfigServer = SdkConfigAccess.getSdkConfigServer();
-        const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
-        const authConfig = this.#authConfig;
-        // Set up constellationConfig with data that bootstrapWithAuthHeader expects
-        constellationBootConfig.customRendering = true;
-        constellationBootConfig.restServerUrl = sdkConfigServer.infinityRestServerUrl;
-        // NOTE: Needs a trailing slash! So add one if not provided
-        if (!sdkConfigServer.sdkContentServerUrl.endsWith('/')) {
-            sdkConfigServer.sdkContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}/`;
-        }
-        constellationBootConfig.staticContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}constellation/`;
-        if (!constellationBootConfig.staticContentServerUrl.endsWith('/')) {
-            constellationBootConfig.staticContentServerUrl = `${constellationBootConfig.staticContentServerUrl}/`;
-        }
-        // If appAlias specified, use it
-        if (sdkConfigServer.appAlias) {
-            constellationBootConfig.appAlias = sdkConfigServer.appAlias;
-        }
-        // Determine whether to send credentials with DX API transactions
-        if (sdkConfigAuth.customCookies) {
-            constellationBootConfig.customCookies = true;
-        }
-        if (this.#bOAuthCustom || !tokenInfo) {
-            if (tokenInfo) {
-                this.#authHeader = `${tokenInfo.token_type} ${tokenInfo.access_token}`;
-            }
-            if (this.#authHeader) {
-                constellationBootConfig.authorizationHeader = this.#authHeader;
-            }
-        }
-        else {
-            // Pass in auth info to Constellation
-            constellationBootConfig.authInfo = {
-                authType: 'OAuth2.0',
-                tokenInfo,
-                // Set whether we want constellation to try to do a full re-Auth or not ()
-                // true doesn't seem to be working in SDK scenario so always passing false for now
-                popupReauth: false /* !this.noInitialRedirect */,
-                client_id: authConfig.clientId,
-                client_secret: authConfig.clientSecret,
-                authentication_service: authConfig.authService,
-                redirect_uri: authConfig.redirectUri,
-                endPoints: {
-                    authorize: authConfig.authorizeUri,
-                    token: authConfig.tokenUri,
-                    revoke: authConfig.revokeUri
-                },
-                secureCookie: authConfig.secureCookie,
-                onTokenRetrieval: authTokenUpdated
-            };
-        }
-        // Turn off dynamic load components (should be able to do it here instead of after load?)
-        constellationBootConfig.dynamicLoadComponents = false;
-        // Set envType if appropriate
-        if (authConfig.serverType === 'launchpad') {
-            constellationBootConfig.envType = 'LAUNCHPAD';
-        }
-        // Set locale override if specified
-        const localeOverride = this.locale;
-        if (localeOverride) {
-            constellationBootConfig.locale = localeOverride;
-        }
-        // Set additional headers if specified
-        const additionalHeaders = this.#loginProps.additionalHeaders;
-        if (additionalHeaders) {
-            constellationBootConfig.additionalHeaders = additionalHeaders;
-        }
-        if (this.bC11NBootstrapInProgress) {
-            return;
-        }
-        this.bC11NBootstrapInProgress = true;
-        // Note that staticContentServerUrl already ends with a slash (see above), so no slash added.
-        // In order to have this import succeed needed to use the webpackIgnore magic comment tag.
-        // See:  https://webpack.js.org/api/module-methods/
-        import(
-        /* webpackIgnore: true */ `${constellationBootConfig.staticContentServerUrl}bootstrap-shell.js?v=${Date.now()}`).then(bootstrapShell => {
-            // NOTE: once this callback is done, we lose the ability to access loadMashup.
-            //  So, create a reference to it
-            window.myLoadMashup = bootstrapShell.loadMashup;
-            window.myLoadPortal = bootstrapShell.loadPortal;
-            window.myLoadDefaultPortal = bootstrapShell.loadDefaultPortal;
-            bootstrapShell
-                .bootstrapWithAuthHeader(constellationBootConfig, 'pega-root')
-                .then(() => {
-                // eslint-disable-next-line no-console
-                console.log('ConstellationJS bootstrap successful!');
-                this.bC11NBootstrapInProgress = false;
-                // Setup listener for the reauth event
-                if (!this.#bOAuthCustom && tokenInfo) {
-                    PCore.getPubSubUtils().subscribe(PCore.getConstants().PUB_SUB_EVENTS.EVENT_FULL_REAUTH, fnReauth, 'authFullReauth');
-                }
-                else {
-                    // customReauth event introduced with 8.8
-                    const sEvent = PCore.getConstants().PUB_SUB_EVENTS.EVENT_CUSTOM_REAUTH;
-                    if (sEvent) {
-                        PCore.getPubSubUtils().subscribe(sEvent, fnReauth, 'doReauth');
-                    }
-                }
-                // Fire SdkConstellationReady event so bridge and app route can do expected post PCore initializations
-                const event = new CustomEvent('SdkConstellationReady', {});
-                document.dispatchEvent(event);
-            })
-                .catch(e => {
-                // Assume error caught is because token is not valid and attempt a full reauth
-                // eslint-disable-next-line no-console
-                console.error(`ConstellationJS bootstrap failed. ${e}`);
-                this.bC11NBootstrapInProgress = false;
-                fnReauth();
-            });
-        });
-        /* Ends here */
-    }
-    #customConstellationInit(fnReauth) {
-        this.#constellationInit(null, null, fnReauth);
-    }
-    #fireTokenAvailable(token, bLoadC11N = true) {
-        if (!token) {
-            // This is used on page reload to load the token from sessionStorage and carry on
-            token = this.#tokenInfo;
-            if (!token) {
-                return;
-            }
-        }
-        this.#tokenInfo = token;
-        if (this.#tokenStorage === 'always') {
-            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
-        }
-        this.#updateLoginStatus();
-        // this.isLoggedIn is getting updated in updateLoginStatus
-        this.isLoggedIn = true;
-        this.usePopupForRestOfSession = true;
-        if (!window.PCore && bLoadC11N) {
-            this.#constellationInit(token, this.#authTokenUpdated.bind(this), this.#authFullReauth.bind(this));
-        }
-        /*
-        // Create and dispatch the SdkLoggedIn event to trigger constellationInit
-        const event = new CustomEvent('SdkLoggedIn', { detail: { authConfig, tokenInfo: token } });
-        document.dispatchEvent(event);
-        */
-    }
-    #processTokenOnLogin(token, bLoadC11N = true) {
-        this.#tokenInfo = token;
-        if (this.#tokenStorage === 'always') {
-            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
-        }
-        if (this.#bOAuthCustom) {
-            // authHeader setter will also set #authHeader and invoke getAuthUtils().setAuthorizationHeader
-            this.authHeader = `${token.token_type} ${token.access_token}`;
-        }
-        if (window.PCore && !this.#authHeader) {
-            PCore.getAuthUtils().setTokens(token);
-        }
-        else {
-            this.#fireTokenAvailable(token, bLoadC11N);
-        }
-    }
-    #doCustomTokenParamsCB() {
-        if (this.#authConfig.grantType === 'customBearer' && this.#customTokenParamsCB) {
-            try {
-                const customTokenParams = this.#customTokenParamsCB();
-                if (customTokenParams) {
-                    this.#authConfig.customTokenParams = customTokenParams;
-                }
-            }
-            catch (e) {
-                // eslint-disable-next-line no-console
-                console.error(`Error on customTokenParams callback. ${e}`);
-            }
-        }
-    }
     updateRedirectUri(sRedirectUri) {
-        this.#authConfig.redirectUri = sRedirectUri;
+        __classPrivateFieldGet(this, _AuthManager_authConfig, "f").redirectUri = sRedirectUri;
     }
     /**
      * Get available portals which supports SDK
@@ -681,9 +230,9 @@ class AuthManager {
                 const appAlias = serverConfig.appAlias;
                 const appAliasPath = appAlias ? `/app/${appAlias}` : '';
                 const arExcludedPortals = serverConfig.excludePortals;
-                const additionalHeaders = this.#loginProps.additionalHeaders || {};
-                const oHeaders = this.#authHeader
-                    ? { Authorization: this.#authHeader, ...additionalHeaders }
+                const additionalHeaders = __classPrivateFieldGet(this, _AuthManager_loginProps, "f").additionalHeaders || {};
+                const oHeaders = __classPrivateFieldGet(this, _AuthManager_authHeader, "f")
+                    ? { Authorization: __classPrivateFieldGet(this, _AuthManager_authHeader, "f"), ...additionalHeaders }
                     : additionalHeaders;
                 const headers = {
                     'Content-Type': 'application/json',
@@ -694,7 +243,7 @@ class AuthManager {
                 return fetch(`${serverUrl}${appAliasPath}/api/v1/data/${dataPageName}`, {
                     method: 'GET',
                     headers,
-                    credentials: this.#authConfig.secureCookie ? 'include' : 'omit'
+                    credentials: __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie ? 'include' : 'omit'
                 })
                     .then(response => {
                     if (response.ok && response.status === 200) {
@@ -735,66 +284,27 @@ class AuthManager {
             });
         });
     }
-    #updateLoginStatus() {
-        if (!this.#authHeader && this.#tokenInfo?.access_token) {
-            // Use setter to set this securely
-            this.authHeader = `${this.#tokenInfo.token_type} ${this.#tokenInfo.access_token}`;
-        }
-        this.isLoggedIn =
-            !!(this.#authHeader && this.#authHeader.length > 0) ||
-                (this.#authConfig.secureCookie && Object.keys(this.#tokenInfo || {}).length > 0);
-    }
-    // Initiate a full OAuth re-authorization (any refresh token has also expired).
-    #authFullReauth() {
-        const bHandleHere = true; // Other alternative is to raise an event and have someone else handle it
-        if (this.reauthStart) {
-            const reauthIgnoreInterval = 300000; // 5 minutes
-            const currTime = Date.now();
-            const bReauthInProgress = currTime - this.reauthStart <= reauthIgnoreInterval;
-            if (bReauthInProgress) {
-                return;
-            }
-        }
-        if (bHandleHere) {
-            // Don't want to do a full clear of authMgr as will loose state props (like sessionIndex).  Rather just clear the tokens
-            this.clear(true);
-            // eslint-disable-next-line @typescript-eslint/no-use-before-define
-            login(true);
-        }
-        else {
-            // Fire the SdkFullReauth event to indicate a new token is needed (PCore.getAuthUtils.setTokens method
-            //  should be used to communicate the new token to Constellation JS Engine.
-            const event = new CustomEvent('SdkFullReauth', {
-                detail: this.#processTokenOnLogin.bind(this)
-            });
-            document.dispatchEvent(event);
-        }
-    }
-    // Passive update where just session storage is updated so can be used on a window refresh
-    #authTokenUpdated(tokenInfo) {
-        this.#tokenInfo = tokenInfo;
-    }
     // TODO: Cope with 401 and refresh token if possible (or just hope that it succeeds during login)
     /**
      * Retrieve UserInfo for current authentication service
      */
     getUserInfo() {
-        if (this.#userInfo) {
-            return this.#userInfo;
+        if (__classPrivateFieldGet(this, _AuthManager_userInfo, "f")) {
+            return __classPrivateFieldGet(this, _AuthManager_userInfo, "f");
         }
-        return this.#initialize(false).then(aMgr => {
-            return aMgr.getUserinfo(this.#tokenInfo.access_token).then(data => {
-                this.#userInfo = data;
-                return this.#userInfo;
+        return __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
+            return aMgr.getUserinfo(__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token).then(data => {
+                __classPrivateFieldSet(this, _AuthManager_userInfo, data, "f");
+                return __classPrivateFieldGet(this, _AuthManager_userInfo, "f");
             });
         });
     }
     login(bFullReauth = false) {
         if (this.bCustomAuth)
             return;
-        this.#initialize(!bFullReauth).then(aMgr => {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, !bFullReauth).then(aMgr => {
             const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
-            if (this.#authConfig.grantType === 'authCode') {
+            if (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").grantType === 'authCode') {
                 const bMainRedirect = !this.noInitialRedirect;
                 let sRedirectUri = sdkConfigAuth.redirectUri;
                 // If initial main redirect is OK, redirect to main page, otherwise will authorize in a popup window
@@ -815,12 +325,12 @@ class AuthManager {
                 this.updateRedirectUri(sRedirectUri);
             }
             return new Promise((resolve, reject) => {
-                this.#doCustomTokenParamsCB();
+                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doCustomTokenParamsCB).call(this);
                 aMgr
                     .login()
                     .then(token => {
-                    this.#processTokenOnLogin(token);
-                    if (this.#loadUserinfo) {
+                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).call(this, token);
+                    if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
                         this.getUserInfo();
                     }
                     resolve(token.access_token);
@@ -841,17 +351,17 @@ class AuthManager {
         const state = urlParams.get('state');
         // If state should also match before accepting code
         if (code) {
-            this.#initialize(false).then(aMgr => {
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
                 if (aMgr.checkStateMatch(state)) {
                     aMgr.getToken(code).then(token => {
                         // Remove any altStateStorage
-                        if (this.#loginProps?.altStateStorage) {
-                            window.localStorage.removeItem(this.#ssKeySessionInfo);
-                            window.localStorage.removeItem(this.#ssKeyState);
+                        if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage) {
+                            window.localStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
+                            window.localStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
                         }
                         if (token && token.token_type) {
-                            this.#processTokenOnLogin(token, false);
-                            if (this.#loadUserinfo) {
+                            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).call(this, token, false);
+                            if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
                                 this.getUserInfo();
                             }
                             if (fnLoggedInCB) {
@@ -877,14 +387,14 @@ class AuthManager {
     }
     loginIfNecessary(loginProps) {
         const { appName, deferLogin, redirectDoneCB, locale } = loginProps;
-        this.#loginProps = { ...loginProps };
+        __classPrivateFieldSet(this, _AuthManager_loginProps, { ...loginProps }, "f");
         const noMainRedirect = !loginProps.mainRedirect;
         // We need to load state before making any decisions. If appName is not there
         //  and this is not the first time load...suspect something is wrong and we need to reload
         if (Object.keys(this.state).length <= this.stateKeysCount || !this.appName) {
             // Once appName is defined it should exceed this count.  If not there should be no
             // harm trying once more
-            this.#loadState();
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_loadState).call(this);
         }
         // If no initial redirect status of page changed...clear AuthMgr
         const currNoMainRedirect = this.noInitialRedirect;
@@ -903,9 +413,9 @@ class AuthManager {
         }
         // If custom auth no need to do any OAuth logic
         if (this.bCustomAuth) {
-            this.#updateLoginStatus();
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
             if (!window.PCore) {
-                this.#customConstellationInit(() => {
+                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_customConstellationInit).call(this, () => {
                     // Fire the SdkCustomReauth event to indicate a new authHeader is needed. Event listener should invoke sdkSetAuthHeader
                     //  to communicate the new token to sdk (and Constellation JS Engine)
                     // eslint-disable-next-line @typescript-eslint/no-use-before-define
@@ -934,7 +444,7 @@ class AuthManager {
                 window.location.replace(window.location.pathname);
             };
             // INC-B43979 had strange case where sessionStorage was empty after redirects
-            if (!this.state.sfx && !this.#loginProps?.altStateStorage) {
+            if (!this.state.sfx && !__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage) {
                 // Reload the page to trigger another login.  Invoking login method here instead didn't
                 //  resolve the issue in client environment.
                 this.clear();
@@ -943,11 +453,11 @@ class AuthManager {
             return this.authRedirectCallback(window.location.href, redirectDoneCB || cbDefault);
         }
         if (!deferLogin) {
-            return this.#initialize(false).then(() => {
-                this.#updateLoginStatus();
+            return __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(() => {
+                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
                 if (this.isLoggedIn) {
-                    this.#fireTokenAvailable(this.#tokenInfo);
-                    if (this.#loadUserinfo) {
+                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_fireTokenAvailable).call(this, __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
+                    if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
                         this.getUserInfo();
                     }
                 }
@@ -958,10 +468,10 @@ class AuthManager {
         }
     }
     logout() {
-        if (this.#beforeUnloadAdded) {
-            window.removeEventListener('beforeunload', this.#doBeforeUnload.bind(this));
-            window.removeEventListener('pagehide', this.#doPageHide.bind(this));
-            this.#beforeUnloadAdded = false;
+        if (__classPrivateFieldGet(this, _AuthManager_beforeUnloadAdded, "f")) {
+            window.removeEventListener('beforeunload', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doBeforeUnload).bind(this));
+            window.removeEventListener('pagehide', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doPageHide).bind(this));
+            __classPrivateFieldSet(this, _AuthManager_beforeUnloadAdded, false, "f");
         }
         return new Promise(resolve => {
             const fnClearAndResolve = () => {
@@ -975,8 +485,8 @@ class AuthManager {
                 return;
             }
             // For secure cookie there will not be an access_token so just check for token_type
-            if (this.#tokenInfo && this.#tokenInfo.token_type) {
-                if (window.PCore && !this.#bOAuthCustom) {
+            if (__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f") && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").token_type) {
+                if (window.PCore && !__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f")) {
                     window.PCore.getAuthUtils()
                         .revokeTokens()
                         .catch(err => {
@@ -988,11 +498,11 @@ class AuthManager {
                     });
                 }
                 else {
-                    this.#initialize(false).then(aMgr => {
+                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
                         aMgr
-                            .revokeTokens(this.#authConfig.secureCookie ? 'cookie' : this.#tokenInfo.access_token, this.#authConfig.secureCookie && this.#tokenInfo.is_refresh_token_enabled
+                            .revokeTokens(__classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie ? 'cookie' : __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token, __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").is_refresh_token_enabled
                             ? 'cookie'
-                            : this.#tokenInfo.refresh_token)
+                            : __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").refresh_token)
                             .then(() => {
                             // Go to finally
                         })
@@ -1008,6 +518,515 @@ class AuthManager {
         });
     }
 }
+_AuthManager_ssKeyPrefix = new WeakMap(), _AuthManager_pegaAuth = new WeakMap(), _AuthManager_ssKeyConfigInfo = new WeakMap(), _AuthManager_ssKeySessionInfo = new WeakMap(), _AuthManager_ssKeyTokenInfo = new WeakMap(), _AuthManager_ssKeyState = new WeakMap(), _AuthManager_authConfig = new WeakMap(), _AuthManager_authDynState = new WeakMap(), _AuthManager_authHeader = new WeakMap(), _AuthManager_customTokenParamsCB = new WeakMap(), _AuthManager_bOAuthCustom = new WeakMap(), _AuthManager_tokenInfo = new WeakMap(), _AuthManager_userInfo = new WeakMap(), _AuthManager_usePASS = new WeakMap(), _AuthManager_beforeUnloadAdded = new WeakMap(), _AuthManager_tokenStorage = new WeakMap(), _AuthManager_transform = new WeakMap(), _AuthManager_foldSpot = new WeakMap(), _AuthManager_loadUserinfo = new WeakMap(), _AuthManager_loginProps = new WeakMap(), _AuthManager_promiseInitialize = new WeakMap(), _AuthManager_instances = new WeakSet(), _AuthManager_transformAndParse = function _AuthManager_transformAndParse(ssKey, ssItem, bForce = false) {
+    let obj = {};
+    try {
+        obj = JSON.parse(__classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformer).call(this, ssKey, ssItem, false, bForce));
+    }
+    catch (e) {
+        // fall thru and return empty object
+    }
+    return obj;
+}, _AuthManager_getStorage = function _AuthManager_getStorage(ssKey, sAttrib = null) {
+    let ssItem = ssKey ? window.sessionStorage.getItem(ssKey) : null;
+    let obj = {};
+    if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage &&
+        !this.isLoggedIn &&
+        !ssItem &&
+        (ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f") || ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"))) {
+        ssItem = window.localStorage.getItem(ssKey);
+    }
+    if (ssItem) {
+        try {
+            obj = JSON.parse(ssItem);
+        }
+        catch (e) {
+            obj = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformAndParse).call(this, ssKey, ssItem, true);
+        }
+    }
+    return sAttrib ? obj[sAttrib] : obj;
+}, _AuthManager_setStorage = function _AuthManager_setStorage(ssKey, obj, bVerify = false) {
+    try {
+        // Set storage only if obj is not empty, else delete the storage
+        if (!obj || isEmptyObject(obj)) {
+            window.sessionStorage.removeItem(ssKey);
+        }
+        else {
+            // const bClear = (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo);
+            const bClear = false;
+            const sValue = bClear
+                ? JSON.stringify(obj)
+                : __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformer).call(this, ssKey, JSON.stringify(obj), true);
+            window.sessionStorage.setItem(ssKey, sValue);
+            if (bVerify) {
+                const sStored = window.sessionStorage.getItem(ssKey);
+                if (sStored !== sValue) {
+                    // eslint-disable-next-line no-console
+                    console.error(`Failed to properly write sessionStorage (${ssKey})`);
+                }
+            }
+            if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage &&
+                !this.isLoggedIn &&
+                (ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f") || ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"))) {
+                window.localStorage.setItem(ssKey, sValue);
+            }
+        }
+    }
+    catch (e) {
+        // eslint-disable-next-line no-console
+        console.error(`Exception ${e} on attempted write of sessionStorage (${ssKey})`);
+    }
+}, _AuthManager_calcFoldSpot = function _AuthManager_calcFoldSpot(s) {
+    const nOffset = 1;
+    const sChar = s.length > nOffset ? s.charAt(nOffset) : '2';
+    const nSpot = parseInt(sChar, 10);
+    __classPrivateFieldSet(this, _AuthManager_foldSpot, Number.isNaN(nSpot) ? 2 : (nSpot % 4) + 2, "f");
+}, _AuthManager_transformer = function _AuthManager_transformer(ssKey, s, bIn, bForce = false) {
+    const bTransform = bForce || __classPrivateFieldGet(this, _AuthManager_transform, "f");
+    const fnFold = (x) => {
+        const nLen = x.length;
+        const nExtra = nLen % __classPrivateFieldGet(this, _AuthManager_foldSpot, "f");
+        const nOffset = Math.floor(nLen / __classPrivateFieldGet(this, _AuthManager_foldSpot, "f")) + nExtra;
+        const nRem = x.length - nOffset;
+        return x.substring(bIn ? nOffset : nRem) + x.substring(0, bIn ? nOffset : nRem);
+    };
+    const bTknInfo = ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f");
+    if (bTknInfo && !bIn && bTransform) {
+        s = window.atob(fnFold(s));
+    }
+    // eslint-disable-next-line no-nested-ternary
+    let result = bTransform ? (bIn ? window.btoa(s) : window.atob(s)) : s;
+    if (bTknInfo && bIn && bTransform) {
+        result = fnFold(window.btoa(result));
+    }
+    return result;
+}, _AuthManager_doUnloadUpdates = function _AuthManager_doUnloadUpdates() {
+    // Safari and particularly Safari on mobile devices doesn't seem to load this on first main redirect or
+    // reliably, so have moved to having PegaAuth manage writing all state props to session storage
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
+    // If tokenStorage was always, token would already be there
+    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'temp') {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
+    }
+}, _AuthManager_doBeforeUnload = function _AuthManager_doBeforeUnload() {
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doUnloadUpdates).call(this);
+}, _AuthManager_doPageHide = function _AuthManager_doPageHide() {
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doUnloadUpdates).call(this);
+}, _AuthManager_loadState = function _AuthManager_loadState() {
+    // Note: State storage key doesn't have a client id associated with it
+    const oState = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
+    if (oState) {
+        Object.assign(this.state, oState);
+        if (this.state.sfx) {
+            // Setter sets up the ssKey values as well
+            this.keySuffix = this.state.sfx;
+        }
+    }
+}, _AuthManager_doOnLoad = function _AuthManager_doOnLoad() {
+    if (!this.onLoadDone) {
+        // This authConfig state doesn't collide with other calculated static state...so load it first
+        // Note: transform setting will have already been loaded into #authConfig at this point
+        __classPrivateFieldSet(this, _AuthManager_authDynState, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f")), "f");
+        __classPrivateFieldSet(this, _AuthManager_tokenInfo, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f")), "f");
+        if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") !== 'always') {
+            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
+            // Finding on iOS browsers the pageHide event is sometimes not happening causing failed redirects.
+            if (!this.iOSDevice) {
+                sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
+            }
+        }
+        this.onLoadDone = true;
+    }
+}, _AuthManager_doAuthDynStateChanged = function _AuthManager_doAuthDynStateChanged() {
+    // If tokenStorage is setup for always then always persist the auth dynamic state as well
+    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always' || this.iOSDevice) {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
+    }
+}, _AuthManager_initialize = 
+/**
+ * Initialize OAuth config structure members and create authMgr instance (if necessary)
+ * bNew - governs whether to create new sessionStorage or load existing one
+ */
+async function _AuthManager_initialize(bNew = false) {
+    if (!bNew && __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f")) {
+        return __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f");
+    }
+    __classPrivateFieldSet(this, _AuthManager_promiseInitialize, new Promise(resolve => {
+        /* if (!this.initInProgress && (bNew || isEmptyObject(this.#authConfig) || !this.#pegaAuth)) { */
+        this.initInProgress = true;
+        getSdkConfig().then(sdkConfig => {
+            const sdkConfigAuth = sdkConfig.authConfig;
+            const sdkConfigServer = sdkConfig.serverConfig;
+            const serverType = sdkConfigServer.serverType || 'infinity';
+            const bInfinity = serverType === 'infinity';
+            let pegaUrl = bInfinity
+                ? sdkConfigServer.infinityRestServerUrl
+                : sdkConfigServer.launchpadRestServerUrl;
+            // Expecting boolean true/false or undefined
+            const secureCookie = !!sdkConfigAuth.secureCookie;
+            const bNoInitialRedirect = this.noInitialRedirect;
+            const appAliasSeg = sdkConfigServer.appAlias ? `app/${sdkConfigServer.appAlias}/` : '';
+            // Construct default OAuth endpoints (if not explicitly specified)
+            if (pegaUrl) {
+                // Cope with trailing slash being present
+                if (!pegaUrl.endsWith('/')) {
+                    pegaUrl += '/';
+                }
+                if (!sdkConfigAuth.authorize) {
+                    sdkConfigAuth.authorize = bInfinity
+                        ? `${pegaUrl}PRRestService/oauth2/v1/authorize`
+                        : `${pegaUrl}uas/oauth/authorize`;
+                }
+                const infinityOAuth2Url = bInfinity
+                    ? pegaUrl + (secureCookie && appAliasSeg ? `${appAliasSeg}api/` : 'PRRestService/')
+                    : '';
+                if (!sdkConfigAuth.token) {
+                    sdkConfigAuth.token = bInfinity
+                        ? `${infinityOAuth2Url}oauth2/v1/token`
+                        : `${pegaUrl}uas/oauth/token`;
+                }
+                if (!sdkConfigAuth.revoke) {
+                    // Launchpad still does not have a revoke endpoint
+                    sdkConfigAuth.revoke = bInfinity ? `${infinityOAuth2Url}oauth2/v1/revoke` : '';
+                }
+                if (!sdkConfigAuth.redirectUri) {
+                    sdkConfigAuth.redirectUri = `${window.location.origin}${window.location.pathname}`;
+                }
+                if (!sdkConfigAuth.userinfo) {
+                    sdkConfigAuth.userinfo = bInfinity
+                        ? `${pegaUrl}${appAliasSeg}api/oauthclients/v1/userinfo/JSON`
+                        : '';
+                }
+            }
+            // Auth service alias
+            if (!sdkConfigAuth.authService) {
+                sdkConfigAuth.authService = 'pega';
+            }
+            // mashupAuthService provides way to have a different auth service for embedded
+            if (!sdkConfigAuth.mashupAuthService) {
+                sdkConfigAuth.mashupAuthService = sdkConfigAuth.authService;
+            }
+            // Construct path to auth.html (used for case when not doing a main window redirect)
+            let sNoMainRedirectUri = sdkConfigAuth.redirectUri;
+            const nLastPathSep = sNoMainRedirectUri.lastIndexOf('/');
+            sNoMainRedirectUri =
+                nLastPathSep !== -1
+                    ? `${sNoMainRedirectUri.substring(0, nLastPathSep + 1)}auth.html`
+                    : `${sNoMainRedirectUri}/auth.html`;
+            const portalGrantType = sdkConfigAuth.portalGrantType || 'authCode';
+            const mashupGrantType = sdkConfigAuth.mashupGrantType || 'authCode';
+            // Some grant types are only available with confidential registrations and require a client secret
+            const clientSecret = bNoInitialRedirect
+                ? sdkConfigAuth.mashupClientSecret
+                : sdkConfigAuth.portalClientSecret;
+            const pegaAuthConfig = {
+                serverType,
+                clientId: bNoInitialRedirect
+                    ? sdkConfigAuth.mashupClientId
+                    : sdkConfigAuth.portalClientId,
+                grantType: bNoInitialRedirect ? mashupGrantType : portalGrantType,
+                tokenUri: sdkConfigAuth.token,
+                revokeUri: sdkConfigAuth.revoke,
+                userinfoUri: sdkConfigAuth.userinfo,
+                authService: bNoInitialRedirect
+                    ? sdkConfigAuth.mashupAuthService
+                    : sdkConfigAuth.authService,
+                appAlias: sdkConfigServer.appAlias || '',
+                useLocking: true
+            };
+            if (clientSecret) {
+                pegaAuthConfig.clientSecret = clientSecret;
+            }
+            if (serverType === 'launchpad' && pegaAuthConfig.grantType === 'authCode') {
+                pegaAuthConfig.noPKCE = true;
+            }
+            // Invoke keySuffix setter
+            // Was using pegaAuthConfig.clientId as key but more secure to just use a random string as getting
+            //  both a clientId and the refresh token could yield a new access token.
+            // Suffix is so we might in future move to an array of suffixes based on the appName, so might store
+            //  both portal and embedded tokens/session info at same time
+            if (!this.state?.sfx) {
+                // Just using a random number to make the suffix unique on each session
+                this.keySuffix = `${Math.ceil(Math.random() * 100000000)}`;
+            }
+            __classPrivateFieldGet(this, _AuthManager_authConfig, "f").transform =
+                sdkConfigAuth.transform !== undefined ? sdkConfigAuth.transform : __classPrivateFieldGet(this, _AuthManager_transform, "f");
+            // Using property in class as authConfig may be empty at times
+            __classPrivateFieldSet(this, _AuthManager_transform, __classPrivateFieldGet(this, _AuthManager_authConfig, "f").transform, "f");
+            if (sdkConfigAuth.tokenStorage !== undefined) {
+                __classPrivateFieldSet(this, _AuthManager_tokenStorage, sdkConfigAuth.tokenStorage, "f");
+            }
+            if (sdkConfigAuth.secureCookie) {
+                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie = true;
+            }
+            // Get latest state once client ids, transform and tokenStorage have been established
+            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doOnLoad).call(this);
+            // If no clientId is specified assume not OAuth but custom auth
+            if (pegaAuthConfig.grantType === 'none' || !pegaAuthConfig.clientId) {
+                this.bCustomAuth = true;
+                return;
+            }
+            // For some OAuth grant type scenarios we opt to pass the Orchestration Engine just an authHeader as
+            //  service broker doesn't have proper support for dealing with refreshing or revoking these:
+            //  * customBearer (except when secureCookie being used)
+            //  * confidential grant types (ones with clientSecret)
+            // (With 25.1 orchestration engine does support this if client_secret is specified on bootstrap)
+            __classPrivateFieldSet(this, _AuthManager_bOAuthCustom, (pegaAuthConfig.grantType === 'customBearer' && !secureCookie) || clientSecret, "f");
+            if (pegaAuthConfig.grantType === 'authCode') {
+                const authCodeProps = {
+                    authorizeUri: sdkConfigAuth.authorize,
+                    // If we have already specified a redirect on the authorize redirect, we need to continue to use that
+                    //  on token endpoint
+                    redirectUri: bNoInitialRedirect || this.usePopupForRestOfSession
+                        ? sNoMainRedirectUri
+                        : sdkConfigAuth.redirectUri
+                };
+                if ('silentTimeout' in sdkConfigAuth) {
+                    authCodeProps.silentTimeout = sdkConfigAuth.silentTimeout;
+                }
+                if (bNoInitialRedirect &&
+                    pegaAuthConfig.authService === 'pega' &&
+                    sdkConfigAuth.mashupUserIdentifier &&
+                    sdkConfigAuth.mashupPassword) {
+                    authCodeProps.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
+                    authCodeProps.password = sdkConfigAuth.mashupPassword;
+                }
+                if ('iframeLoginUI' in sdkConfigAuth) {
+                    authCodeProps.iframeLoginUI =
+                        sdkConfigAuth.iframeLoginUI.toString().toLowerCase() === 'true';
+                }
+                Object.assign(pegaAuthConfig, authCodeProps);
+            }
+            else if (pegaAuthConfig.grantType === 'passwordCreds') {
+                pegaAuthConfig.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
+                pegaAuthConfig.password = sdkConfigAuth.mashupPassword;
+            }
+            Object.assign(__classPrivateFieldGet(this, _AuthManager_authConfig, "f"), pegaAuthConfig);
+            // Add beforeunload and page hide handlers to write out key properties that we want to survive a
+            //  browser reload
+            if (!__classPrivateFieldGet(this, _AuthManager_beforeUnloadAdded, "f") && (!__classPrivateFieldGet(this, _AuthManager_usePASS, "f") || __classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") !== 'always')) {
+                window.addEventListener('beforeunload', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doBeforeUnload).bind(this));
+                window.addEventListener('pagehide', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doPageHide).bind(this));
+                __classPrivateFieldSet(this, _AuthManager_beforeUnloadAdded, true, "f");
+            }
+            // Initialize PegaAuth OAuth 2.0 client library
+            if (__classPrivateFieldGet(this, _AuthManager_usePASS, "f")) {
+                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authConfig, "f"));
+                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
+                __classPrivateFieldSet(this, _AuthManager_pegaAuth, new PegaAuth(__classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"), __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f")), "f");
+            }
+            else {
+                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").fnDynStateChangedCB = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doAuthDynStateChanged).bind(this);
+                __classPrivateFieldSet(this, _AuthManager_pegaAuth, new PegaAuth(__classPrivateFieldGet(this, _AuthManager_authConfig, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f")), "f");
+            }
+            this.initInProgress = false;
+            resolve(__classPrivateFieldGet(this, _AuthManager_pegaAuth, "f"));
+        });
+    }), "f");
+    return __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f");
+}, _AuthManager_constellationInit = function _AuthManager_constellationInit(tokenInfo, authTokenUpdated, fnReauth) {
+    const constellationBootConfig = {};
+    const sdkConfigServer = SdkConfigAccess.getSdkConfigServer();
+    const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
+    const authConfig = __classPrivateFieldGet(this, _AuthManager_authConfig, "f");
+    // Set up constellationConfig with data that bootstrapWithAuthHeader expects
+    constellationBootConfig.customRendering = true;
+    constellationBootConfig.restServerUrl = sdkConfigServer.infinityRestServerUrl;
+    // NOTE: Needs a trailing slash! So add one if not provided
+    if (!sdkConfigServer.sdkContentServerUrl.endsWith('/')) {
+        sdkConfigServer.sdkContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}/`;
+    }
+    constellationBootConfig.staticContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}constellation/`;
+    if (!constellationBootConfig.staticContentServerUrl.endsWith('/')) {
+        constellationBootConfig.staticContentServerUrl = `${constellationBootConfig.staticContentServerUrl}/`;
+    }
+    // If appAlias specified, use it
+    if (sdkConfigServer.appAlias) {
+        constellationBootConfig.appAlias = sdkConfigServer.appAlias;
+    }
+    // Determine whether to send credentials with DX API transactions
+    if (sdkConfigAuth.customCookies) {
+        constellationBootConfig.customCookies = true;
+    }
+    if (__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f") || !tokenInfo) {
+        if (tokenInfo) {
+            __classPrivateFieldSet(this, _AuthManager_authHeader, `${tokenInfo.token_type} ${tokenInfo.access_token}`, "f");
+        }
+        if (__classPrivateFieldGet(this, _AuthManager_authHeader, "f")) {
+            constellationBootConfig.authorizationHeader = __classPrivateFieldGet(this, _AuthManager_authHeader, "f");
+        }
+    }
+    else {
+        // Pass in auth info to Constellation
+        constellationBootConfig.authInfo = {
+            authType: 'OAuth2.0',
+            tokenInfo,
+            // Set whether we want constellation to try to do a full re-Auth or not ()
+            // true doesn't seem to be working in SDK scenario so always passing false for now
+            popupReauth: false /* !this.noInitialRedirect */,
+            client_id: authConfig.clientId,
+            client_secret: authConfig.clientSecret,
+            authentication_service: authConfig.authService,
+            redirect_uri: authConfig.redirectUri,
+            endPoints: {
+                authorize: authConfig.authorizeUri,
+                token: authConfig.tokenUri,
+                revoke: authConfig.revokeUri
+            },
+            secureCookie: authConfig.secureCookie,
+            onTokenRetrieval: authTokenUpdated
+        };
+    }
+    // Turn off dynamic load components (should be able to do it here instead of after load?)
+    constellationBootConfig.dynamicLoadComponents = false;
+    // Set envType if appropriate
+    if (authConfig.serverType === 'launchpad') {
+        constellationBootConfig.envType = 'LAUNCHPAD';
+    }
+    // Set locale override if specified
+    const localeOverride = this.locale;
+    if (localeOverride) {
+        constellationBootConfig.locale = localeOverride;
+    }
+    // Set additional headers if specified
+    const additionalHeaders = __classPrivateFieldGet(this, _AuthManager_loginProps, "f").additionalHeaders;
+    if (additionalHeaders) {
+        constellationBootConfig.additionalHeaders = additionalHeaders;
+    }
+    if (this.bC11NBootstrapInProgress) {
+        return;
+    }
+    this.bC11NBootstrapInProgress = true;
+    // Note that staticContentServerUrl already ends with a slash (see above), so no slash added.
+    // In order to have this import succeed needed to use the webpackIgnore magic comment tag.
+    // See:  https://webpack.js.org/api/module-methods/
+    import(
+    /* webpackIgnore: true */ `${constellationBootConfig.staticContentServerUrl}bootstrap-shell.js?v=${Date.now()}`).then(bootstrapShell => {
+        // NOTE: once this callback is done, we lose the ability to access loadMashup.
+        //  So, create a reference to it
+        window.myLoadMashup = bootstrapShell.loadMashup;
+        window.myLoadPortal = bootstrapShell.loadPortal;
+        window.myLoadDefaultPortal = bootstrapShell.loadDefaultPortal;
+        bootstrapShell
+            .bootstrapWithAuthHeader(constellationBootConfig, 'pega-root')
+            .then(() => {
+            // eslint-disable-next-line no-console
+            console.log('ConstellationJS bootstrap successful!');
+            this.bC11NBootstrapInProgress = false;
+            // Setup listener for the reauth event
+            if (!__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f") && tokenInfo) {
+                PCore.getPubSubUtils().subscribe(PCore.getConstants().PUB_SUB_EVENTS.EVENT_FULL_REAUTH, fnReauth, 'authFullReauth');
+            }
+            else {
+                // customReauth event introduced with 8.8
+                const sEvent = PCore.getConstants().PUB_SUB_EVENTS.EVENT_CUSTOM_REAUTH;
+                if (sEvent) {
+                    PCore.getPubSubUtils().subscribe(sEvent, fnReauth, 'doReauth');
+                }
+            }
+            // Fire SdkConstellationReady event so bridge and app route can do expected post PCore initializations
+            const event = new CustomEvent('SdkConstellationReady', {});
+            document.dispatchEvent(event);
+        })
+            .catch(e => {
+            // Assume error caught is because token is not valid and attempt a full reauth
+            // eslint-disable-next-line no-console
+            console.error(`ConstellationJS bootstrap failed. ${e}`);
+            this.bC11NBootstrapInProgress = false;
+            fnReauth();
+        });
+    });
+    /* Ends here */
+}, _AuthManager_customConstellationInit = function _AuthManager_customConstellationInit(fnReauth) {
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_constellationInit).call(this, null, null, fnReauth);
+}, _AuthManager_fireTokenAvailable = function _AuthManager_fireTokenAvailable(token, bLoadC11N = true) {
+    if (!token) {
+        // This is used on page reload to load the token from sessionStorage and carry on
+        token = __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f");
+        if (!token) {
+            return;
+        }
+    }
+    __classPrivateFieldSet(this, _AuthManager_tokenInfo, token, "f");
+    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always') {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
+    }
+    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
+    // this.isLoggedIn is getting updated in updateLoginStatus
+    this.isLoggedIn = true;
+    this.usePopupForRestOfSession = true;
+    if (!window.PCore && bLoadC11N) {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_constellationInit).call(this, token, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_authTokenUpdated).bind(this), __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_authFullReauth).bind(this));
+    }
+    /*
+    // Create and dispatch the SdkLoggedIn event to trigger constellationInit
+    const event = new CustomEvent('SdkLoggedIn', { detail: { authConfig, tokenInfo: token } });
+    document.dispatchEvent(event);
+    */
+}, _AuthManager_processTokenOnLogin = function _AuthManager_processTokenOnLogin(token, bLoadC11N = true) {
+    __classPrivateFieldSet(this, _AuthManager_tokenInfo, token, "f");
+    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always') {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
+    }
+    if (__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f")) {
+        // authHeader setter will also set #authHeader and invoke getAuthUtils().setAuthorizationHeader
+        this.authHeader = `${token.token_type} ${token.access_token}`;
+    }
+    if (window.PCore && !__classPrivateFieldGet(this, _AuthManager_authHeader, "f")) {
+        PCore.getAuthUtils().setTokens(token);
+    }
+    else {
+        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_fireTokenAvailable).call(this, token, bLoadC11N);
+    }
+}, _AuthManager_doCustomTokenParamsCB = function _AuthManager_doCustomTokenParamsCB() {
+    if (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").grantType === 'customBearer' && __classPrivateFieldGet(this, _AuthManager_customTokenParamsCB, "f")) {
+        try {
+            const customTokenParams = __classPrivateFieldGet(this, _AuthManager_customTokenParamsCB, "f").call(this);
+            if (customTokenParams) {
+                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").customTokenParams = customTokenParams;
+            }
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(`Error on customTokenParams callback. ${e}`);
+        }
+    }
+}, _AuthManager_updateLoginStatus = function _AuthManager_updateLoginStatus() {
+    if (!__classPrivateFieldGet(this, _AuthManager_authHeader, "f") && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f")?.access_token) {
+        // Use setter to set this securely
+        this.authHeader = `${__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").token_type} ${__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token}`;
+    }
+    this.isLoggedIn =
+        !!(__classPrivateFieldGet(this, _AuthManager_authHeader, "f") && __classPrivateFieldGet(this, _AuthManager_authHeader, "f").length > 0) ||
+            (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie && Object.keys(__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f") || {}).length > 0);
+}, _AuthManager_authFullReauth = function _AuthManager_authFullReauth() {
+    const bHandleHere = true; // Other alternative is to raise an event and have someone else handle it
+    if (this.reauthStart) {
+        const reauthIgnoreInterval = 300000; // 5 minutes
+        const currTime = Date.now();
+        const bReauthInProgress = currTime - this.reauthStart <= reauthIgnoreInterval;
+        if (bReauthInProgress) {
+            return;
+        }
+    }
+    if (bHandleHere) {
+        // Don't want to do a full clear of authMgr as will loose state props (like sessionIndex).  Rather just clear the tokens
+        this.clear(true);
+        // eslint-disable-next-line @typescript-eslint/no-use-before-define
+        login(true);
+    }
+    else {
+        // Fire the SdkFullReauth event to indicate a new token is needed (PCore.getAuthUtils.setTokens method
+        //  should be used to communicate the new token to Constellation JS Engine.
+        const event = new CustomEvent('SdkFullReauth', {
+            detail: __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).bind(this)
+        });
+        document.dispatchEvent(event);
+    }
+}, _AuthManager_authTokenUpdated = function _AuthManager_authTokenUpdated(tokenInfo) {
+    __classPrivateFieldSet(this, _AuthManager_tokenInfo, tokenInfo, "f");
+};
 const gAuthMgr = new AuthManager();
 // TODO: Cope with 401 and refresh token if possible (or just hope that it succeeds during login)
 /**