@pega/auth 0.2.25 → 0.2.27

package/lib/sdk-auth-manager/authManager.js

@@ -1,17 +1,5 @@
 // This file wraps various calls related to logging in, logging out, etc.
 //  that use the auth.html/auth.js to do the work of logging in via OAuth 2.0.
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AuthManager_instances, _AuthManager_ssKeyPrefix, _AuthManager_pegaAuth, _AuthManager_ssKeyConfigInfo, _AuthManager_ssKeySessionInfo, _AuthManager_ssKeyTokenInfo, _AuthManager_ssKeyState, _AuthManager_authConfig, _AuthManager_authDynState, _AuthManager_authHeader, _AuthManager_customTokenParamsCB, _AuthManager_bOAuthCustom, _AuthManager_tokenInfo, _AuthManager_userInfo, _AuthManager_usePASS, _AuthManager_beforeUnloadAdded, _AuthManager_tokenStorage, _AuthManager_transform, _AuthManager_foldSpot, _AuthManager_loadUserinfo, _AuthManager_loginProps, _AuthManager_promiseInitialize, _AuthManager_transformAndParse, _AuthManager_getStorage, _AuthManager_setStorage, _AuthManager_calcFoldSpot, _AuthManager_transformer, _AuthManager_doUnloadUpdates, _AuthManager_doBeforeUnload, _AuthManager_doPageHide, _AuthManager_loadState, _AuthManager_doOnLoad, _AuthManager_doAuthDynStateChanged, _AuthManager_initialize, _AuthManager_constellationInit, _AuthManager_customConstellationInit, _AuthManager_fireTokenAvailable, _AuthManager_processTokenOnLogin, _AuthManager_doCustomTokenParamsCB, _AuthManager_updateLoginStatus, _AuthManager_authFullReauth, _AuthManager_authTokenUpdated;
 // It utilizes a JS Class and private members to protect any sensitive tokens
 //  and token obfuscation routines
 import { PegaAuth } from '../oauth-client/auth.js';
@@ -19,112 +7,158 @@ import { isEmptyObject } from './common-utils.js';
 import { getSdkConfig, SdkConfigAccess } from './config_access.js';
 // Meant to be a singleton...only one instance per page
 class AuthManager {
+    #ssKeyPrefix = 'rs';
+    iOSDevice = false;
+    // will store the PegaAuth (OAuth 2.0 client library) instance
+    #pegaAuth = null;
+    #ssKeyConfigInfo = '';
+    #ssKeySessionInfo = '';
+    #ssKeyTokenInfo = '';
+    #ssKeyState = `${this.#ssKeyPrefix}State`;
+    #authConfig = {};
+    #authDynState = {};
+    #authHeader = null;
+    #customTokenParamsCB = null;
+    // state that should be persisted across loads
+    state = { usePopup: false, noInitialRedirect: false, locale: null };
+    // # of properties within initial state object
+    stateKeysCount = 3;
+    bC11NBootstrapInProgress = false;
+    bC11NBootstrapComplete = false;
+    bCustomAuth = false;
+    #bOAuthCustom = false;
+    #tokenInfo;
+    #userInfo;
+    onLoadDone = false;
+    msReauthStart = null;
+    initInProgress = false;
+    isLoggedIn = false;
+    // Whether to pass a session storage key or structure to auth library
+    #usePASS = false;
+    #beforeUnloadAdded = false;
+    #tokenStorage = 'temp';
+    #transform = true;
+    #foldSpot = 2;
+    // Whether to load and cache user info as part of login
+    #loadUserinfo = false;
+    // Keep loginProps passed to loginIfNecessary
+    #loginProps = null;
+    // Promise for Initialization of PegaAuth and resolution callback
+    #promiseInitialize = null;
     constructor() {
-        _AuthManager_instances.add(this);
-        _AuthManager_ssKeyPrefix.set(this, 'rs');
-        Object.defineProperty(this, "iOSDevice", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        // will store the PegaAuth (OAuth 2.0 client library) instance
-        _AuthManager_pegaAuth.set(this, null);
-        _AuthManager_ssKeyConfigInfo.set(this, '');
-        _AuthManager_ssKeySessionInfo.set(this, '');
-        _AuthManager_ssKeyTokenInfo.set(this, '');
-        _AuthManager_ssKeyState.set(this, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}State`);
-        _AuthManager_authConfig.set(this, {});
-        _AuthManager_authDynState.set(this, {});
-        _AuthManager_authHeader.set(this, null);
-        _AuthManager_customTokenParamsCB.set(this, null);
-        // state that should be persisted across loads
-        Object.defineProperty(this, "state", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: { usePopup: false, noInitialRedirect: false, locale: null }
-        });
-        // # of properties within initial state object
-        Object.defineProperty(this, "stateKeysCount", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: 3
-        });
-        Object.defineProperty(this, "bC11NBootstrapInProgress", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        Object.defineProperty(this, "bCustomAuth", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        _AuthManager_bOAuthCustom.set(this, false);
-        _AuthManager_tokenInfo.set(this, void 0);
-        _AuthManager_userInfo.set(this, void 0);
-        Object.defineProperty(this, "onLoadDone", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        Object.defineProperty(this, "msReauthStart", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: null
-        });
-        Object.defineProperty(this, "initInProgress", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        Object.defineProperty(this, "isLoggedIn", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
-        // Whether to pass a session storage key or structure to auth library
-        _AuthManager_usePASS.set(this, false);
-        _AuthManager_beforeUnloadAdded.set(this, false);
-        _AuthManager_tokenStorage.set(this, 'temp');
-        _AuthManager_transform.set(this, true);
-        _AuthManager_foldSpot.set(this, 2);
-        // Whether to load and cache user info as part of login
-        _AuthManager_loadUserinfo.set(this, false);
-        // Keep loginProps passed to loginIfNecessary
-        _AuthManager_loginProps.set(this, null);
-        // Promise for Initialization of PegaAuth and resolution callback
-        _AuthManager_promiseInitialize.set(this, null);
         // Auth Manager specific state is saved within session storage as important in redirect and popup window scenarios
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_loadState).call(this);
+        this.#loadState();
         this.iOSDevice = /iPad|iPhone|iPod/.test(navigator.userAgent);
     }
+    #transformAndParse(ssKey, ssItem, bForce = false) {
+        let obj = {};
+        try {
+            obj = JSON.parse(this.#transformer(ssKey, ssItem, false, bForce));
+        }
+        catch (e) {
+            // fall thru and return empty object
+        }
+        return obj;
+    }
+    // helper routine to retrieve JSON object stored in a session storage key
+    // a 2nd optional arg can also retrieve an individual attribute
+    #getStorage(ssKey, sAttrib = null) {
+        let ssItem = ssKey ? window.sessionStorage.getItem(ssKey) : null;
+        let obj = {};
+        if (this.#loginProps?.altStateStorage &&
+            !this.isLoggedIn &&
+            !ssItem &&
+            (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo)) {
+            ssItem = window.localStorage.getItem(ssKey);
+        }
+        if (ssItem) {
+            try {
+                obj = JSON.parse(ssItem);
+            }
+            catch (e) {
+                obj = this.#transformAndParse(ssKey, ssItem, true);
+            }
+        }
+        return sAttrib ? obj[sAttrib] : obj;
+    }
+    // helper routine to set storage to the passed in JSON
+    #setStorage(ssKey, obj, bVerify = false) {
+        try {
+            // Set storage only if obj is not empty, else delete the storage
+            if (!obj || isEmptyObject(obj)) {
+                window.sessionStorage.removeItem(ssKey);
+            }
+            else {
+                // const bClear = (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo);
+                const bClear = false;
+                const sValue = bClear
+                    ? JSON.stringify(obj)
+                    : this.#transformer(ssKey, JSON.stringify(obj), true);
+                window.sessionStorage.setItem(ssKey, sValue);
+                if (bVerify) {
+                    const sStored = window.sessionStorage.getItem(ssKey);
+                    if (sStored !== sValue) {
+                        // eslint-disable-next-line no-console
+                        console.error(`Failed to properly write sessionStorage (${ssKey})`);
+                    }
+                }
+                if (this.#loginProps?.altStateStorage &&
+                    !this.isLoggedIn &&
+                    (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo)) {
+                    window.localStorage.setItem(ssKey, sValue);
+                }
+            }
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(`Exception ${e} on attempted write of sessionStorage (${ssKey})`);
+        }
+    }
+    #calcFoldSpot(s) {
+        const nOffset = 1;
+        const sChar = s.length > nOffset ? s.charAt(nOffset) : '2';
+        const nSpot = parseInt(sChar, 10);
+        this.#foldSpot = Number.isNaN(nSpot) ? 2 : (nSpot % 4) + 2;
+    }
+    // helper function to encode storage
+    #transformer(ssKey, s, bIn, bForce = false) {
+        const bTransform = bForce || this.#transform;
+        const fnFold = (x) => {
+            const nLen = x.length;
+            const nExtra = nLen % this.#foldSpot;
+            const nOffset = Math.floor(nLen / this.#foldSpot) + nExtra;
+            const nRem = x.length - nOffset;
+            return x.substring(bIn ? nOffset : nRem) + x.substring(0, bIn ? nOffset : nRem);
+        };
+        const bTknInfo = ssKey === this.#ssKeyTokenInfo;
+        if (bTknInfo && !bIn && bTransform) {
+            s = window.atob(fnFold(s));
+        }
+        // eslint-disable-next-line no-nested-ternary
+        let result = bTransform ? (bIn ? window.btoa(s) : window.atob(s)) : s;
+        if (bTknInfo && bIn && bTransform) {
+            result = fnFold(window.btoa(result));
+        }
+        return result;
+    }
     // Setter for authHeader (no getter)
     set authHeader(value) {
-        __classPrivateFieldSet(this, _AuthManager_authHeader, value, "f");
+        this.#authHeader = value;
         // setAuthorizationHeader method not available til 8.8 so do safety check
         if (window.PCore?.getAuthUtils().setAuthorizationHeader) {
             const authHdr = value === null ? '' : value;
             window.PCore.getAuthUtils().setAuthorizationHeader(authHdr);
         }
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
+        this.#updateLoginStatus();
     }
     // Setter for customTokenParamsCB
     set customTokenParamsCB(fn) {
-        __classPrivateFieldSet(this, _AuthManager_customTokenParamsCB, fn, "f");
+        this.#customTokenParamsCB = fn;
     }
     // Setter/getter for appName
     set appName(appName) {
         this.state.appName = appName;
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+        this.#setStorage(this.#ssKeyState, this.state);
     }
     get appName() {
         return this.state.appName;
@@ -132,7 +166,7 @@ class AuthManager {
     // Setter/getter for usePopupForRestOfSession
     set usePopupForRestOfSession(usePopup) {
         this.state.usePopup = usePopup;
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+        this.#setStorage(this.#ssKeyState, this.state);
     }
     get usePopupForRestOfSession() {
         return this.state.usePopup;
@@ -143,7 +177,7 @@ class AuthManager {
             this.usePopupForRestOfSession = true;
         }
         this.state.noInitialRedirect = bNoInitialRedirect;
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+        this.#setStorage(this.#ssKeyState, this.state);
     }
     get noInitialRedirect() {
         return this.state.noInitialRedirect || false;
@@ -151,7 +185,7 @@ class AuthManager {
     // Setter/getter for locale (override)
     set locale(localeOverride) {
         this.state.locale = localeOverride;
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+        this.#setStorage(this.#ssKeyState, this.state);
     }
     get locale() {
         return this.state.locale;
@@ -164,7 +198,7 @@ class AuthManager {
         else if (this.msReauthStart) {
             delete this.msReauthStart;
         }
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+        this.#setStorage(this.#ssKeyState, this.state);
     }
     get reauthStart() {
         return this.msReauthStart || 0;
@@ -173,22 +207,22 @@ class AuthManager {
     set keySuffix(s) {
         this.state.sfx = s || undefined;
         if (s) {
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
+            this.#setStorage(this.#ssKeyState, this.state);
             // To make it a bit more obtuse reverse the string and use that as the actual suffix
             const sSfx = s.split('').reverse().join('');
-            __classPrivateFieldSet(this, _AuthManager_ssKeyConfigInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}CI_${sSfx}`, "f");
-            __classPrivateFieldSet(this, _AuthManager_ssKeySessionInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}SI_${sSfx}`, "f");
-            __classPrivateFieldSet(this, _AuthManager_ssKeyTokenInfo, `${__classPrivateFieldGet(this, _AuthManager_ssKeyPrefix, "f")}TI_${sSfx}`, "f");
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_calcFoldSpot).call(this, sSfx);
+            this.#ssKeyConfigInfo = `${this.#ssKeyPrefix}CI_${sSfx}`;
+            this.#ssKeySessionInfo = `${this.#ssKeyPrefix}SI_${sSfx}`;
+            this.#ssKeyTokenInfo = `${this.#ssKeyPrefix}TI_${sSfx}`;
+            this.#calcFoldSpot(sSfx);
         }
         else {
-            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
-            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"));
-            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
-            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
-            __classPrivateFieldSet(this, _AuthManager_ssKeyConfigInfo, '', "f");
-            __classPrivateFieldSet(this, _AuthManager_ssKeySessionInfo, '', "f");
-            __classPrivateFieldSet(this, _AuthManager_ssKeyTokenInfo, '', "f");
+            sessionStorage.removeItem(this.#ssKeyTokenInfo);
+            sessionStorage.removeItem(this.#ssKeyConfigInfo);
+            sessionStorage.removeItem(this.#ssKeySessionInfo);
+            sessionStorage.removeItem(this.#ssKeyState);
+            this.#ssKeyConfigInfo = '';
+            this.#ssKeySessionInfo = '';
+            this.#ssKeyTokenInfo = '';
         }
     }
     /**
@@ -196,25 +230,444 @@ class AuthManager {
      */
     clear(bFullReauth = false) {
         if (!this.bCustomAuth) {
-            __classPrivateFieldSet(this, _AuthManager_authHeader, null, "f");
+            this.#authHeader = null;
         }
         // Clear any established auth tokens
-        __classPrivateFieldSet(this, _AuthManager_tokenInfo, null, "f");
-        sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
+        this.#tokenInfo = null;
+        sessionStorage.removeItem(this.#ssKeyTokenInfo);
         this.isLoggedIn = false;
         // reset the initial redirect as well by using this setter
         this.usePopupForRestOfSession = bFullReauth;
         if (!bFullReauth) {
-            if (!__classPrivateFieldGet(this, _AuthManager_usePASS, "f")) {
-                __classPrivateFieldSet(this, _AuthManager_authConfig, {}, "f");
-                __classPrivateFieldSet(this, _AuthManager_authDynState, {}, "f");
+            if (!this.#usePASS) {
+                this.#authConfig = {};
+                this.#authDynState = {};
             }
             // keySuffix setter has cleanup logic
             this.keySuffix = '';
         }
     }
+    // Found beforeunload to not work well on iOS browsers, and pagehide to work better
+    // However also seeing some scenario like navigating to a different page on Chrome & Firefox only invoking beforeunload
+    // Chrome, Firefox, Safari browsers sequence on page reload: beforeunload, pagehide, visibilitychange
+    // visibilitychange is fired whenever a tab is made visible and when it is hidden
+    #doUnloadUpdates() {
+        // Safari and particularly Safari on mobile devices doesn't seem to load this on first main redirect or
+        // reliably, so have moved to having PegaAuth manage writing all state props to session storage
+        this.#setStorage(this.#ssKeyState, this.state);
+        this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
+        // If tokenStorage was always, token would already be there
+        if (this.#tokenStorage === 'temp') {
+            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
+        }
+    }
+    #doBeforeUnload() {
+        this.#doUnloadUpdates();
+    }
+    #doPageHide() {
+        this.#doUnloadUpdates();
+    }
+    #loadState() {
+        // Note: State storage key doesn't have a client id associated with it
+        const oState = this.#getStorage(this.#ssKeyState);
+        if (oState) {
+            Object.assign(this.state, oState);
+            if (this.state.sfx) {
+                // Setter sets up the ssKey values as well
+                this.keySuffix = this.state.sfx;
+            }
+        }
+    }
+    // This is only called from initialize after #ssKey values are setup
+    #doOnLoad() {
+        if (!this.onLoadDone) {
+            // This authConfig state doesn't collide with other calculated static state...so load it first
+            // Note: transform setting will have already been loaded into #authConfig at this point
+            this.#authDynState = this.#getStorage(this.#ssKeySessionInfo);
+            this.#tokenInfo = this.#getStorage(this.#ssKeyTokenInfo);
+            if (this.#tokenStorage !== 'always') {
+                sessionStorage.removeItem(this.#ssKeyTokenInfo);
+                // Finding on iOS browsers the pageHide event is sometimes not happening causing failed redirects.
+                if (!this.iOSDevice) {
+                    sessionStorage.removeItem(this.#ssKeySessionInfo);
+                }
+            }
+            this.onLoadDone = true;
+        }
+    }
+    // Callback when auth dynamic state has changed. Decide whether to persisting it based on
+    //  config settings
+    #doAuthDynStateChanged() {
+        // If tokenStorage is setup for always then always persist the auth dynamic state as well
+        if (this.#tokenStorage === 'always' || this.iOSDevice) {
+            this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
+        }
+    }
+    /**
+     * Initialize OAuth config structure members and create authMgr instance (if necessary)
+     * bNew - governs whether to create new sessionStorage or load existing one
+     */
+    async #initialize(bNew = false) {
+        if (!bNew && this.#promiseInitialize) {
+            return this.#promiseInitialize;
+        }
+        this.#promiseInitialize = new Promise(resolve => {
+            /* if (!this.initInProgress && (bNew || isEmptyObject(this.#authConfig) || !this.#pegaAuth)) { */
+            this.initInProgress = true;
+            getSdkConfig().then(sdkConfig => {
+                const sdkConfigAuth = sdkConfig.authConfig;
+                const sdkConfigServer = sdkConfig.serverConfig;
+                const serverType = sdkConfigServer.serverType || 'infinity';
+                const bInfinity = serverType === 'infinity';
+                let pegaUrl = bInfinity
+                    ? sdkConfigServer.infinityRestServerUrl
+                    : sdkConfigServer.launchpadRestServerUrl;
+                // Expecting boolean true/false or undefined
+                const secureCookie = !!sdkConfigAuth.secureCookie;
+                const bNoInitialRedirect = this.noInitialRedirect;
+                const appAliasSeg = sdkConfigServer.appAlias ? `app/${sdkConfigServer.appAlias}/` : '';
+                // Construct default OAuth endpoints (if not explicitly specified)
+                if (pegaUrl) {
+                    // Cope with trailing slash being present
+                    if (!pegaUrl.endsWith('/')) {
+                        pegaUrl += '/';
+                    }
+                    if (!sdkConfigAuth.authorize) {
+                        sdkConfigAuth.authorize = bInfinity
+                            ? `${pegaUrl}PRRestService/oauth2/v1/authorize`
+                            : `${pegaUrl}uas/oauth/authorize`;
+                    }
+                    const infinityOAuth2Url = bInfinity
+                        ? pegaUrl + (secureCookie && appAliasSeg ? `${appAliasSeg}api/` : 'PRRestService/')
+                        : '';
+                    if (!sdkConfigAuth.token) {
+                        sdkConfigAuth.token = bInfinity
+                            ? `${infinityOAuth2Url}oauth2/v1/token`
+                            : `${pegaUrl}uas/oauth/token`;
+                    }
+                    if (!sdkConfigAuth.revoke) {
+                        // Launchpad still does not have a revoke endpoint
+                        sdkConfigAuth.revoke = bInfinity ? `${infinityOAuth2Url}oauth2/v1/revoke` : '';
+                    }
+                    if (!sdkConfigAuth.redirectUri) {
+                        sdkConfigAuth.redirectUri = `${window.location.origin}${window.location.pathname}`;
+                    }
+                    if (!sdkConfigAuth.userinfo) {
+                        sdkConfigAuth.userinfo = bInfinity
+                            ? `${pegaUrl}${appAliasSeg}api/oauthclients/v1/userinfo/JSON`
+                            : '';
+                    }
+                }
+                // Auth service alias
+                if (!sdkConfigAuth.authService) {
+                    sdkConfigAuth.authService = 'pega';
+                }
+                // mashupAuthService provides way to have a different auth service for embedded
+                if (!sdkConfigAuth.mashupAuthService) {
+                    sdkConfigAuth.mashupAuthService = sdkConfigAuth.authService;
+                }
+                // Construct path to auth.html (used for case when not doing a main window redirect)
+                let sNoMainRedirectUri = sdkConfigAuth.redirectUri;
+                const nLastPathSep = sNoMainRedirectUri.lastIndexOf('/');
+                sNoMainRedirectUri =
+                    nLastPathSep !== -1
+                        ? `${sNoMainRedirectUri.substring(0, nLastPathSep + 1)}auth.html`
+                        : `${sNoMainRedirectUri}/auth.html`;
+                const portalGrantType = sdkConfigAuth.portalGrantType || 'authCode';
+                const mashupGrantType = sdkConfigAuth.mashupGrantType || 'authCode';
+                // Some grant types are only available with confidential registrations and require a client secret
+                const clientSecret = bNoInitialRedirect
+                    ? sdkConfigAuth.mashupClientSecret
+                    : sdkConfigAuth.portalClientSecret;
+                const pegaAuthConfig = {
+                    serverType,
+                    clientId: bNoInitialRedirect
+                        ? sdkConfigAuth.mashupClientId
+                        : sdkConfigAuth.portalClientId,
+                    grantType: bNoInitialRedirect ? mashupGrantType : portalGrantType,
+                    tokenUri: sdkConfigAuth.token,
+                    revokeUri: sdkConfigAuth.revoke,
+                    userinfoUri: sdkConfigAuth.userinfo,
+                    authService: bNoInitialRedirect
+                        ? sdkConfigAuth.mashupAuthService
+                        : sdkConfigAuth.authService,
+                    appAlias: sdkConfigServer.appAlias || '',
+                    useLocking: true
+                };
+                if (clientSecret) {
+                    pegaAuthConfig.clientSecret = clientSecret;
+                }
+                if (serverType === 'launchpad' && pegaAuthConfig.grantType === 'authCode') {
+                    pegaAuthConfig.noPKCE = true;
+                }
+                // Invoke keySuffix setter
+                // Was using pegaAuthConfig.clientId as key but more secure to just use a random string as getting
+                //  both a clientId and the refresh token could yield a new access token.
+                // Suffix is so we might in future move to an array of suffixes based on the appName, so might store
+                //  both portal and embedded tokens/session info at same time
+                if (!this.state?.sfx) {
+                    // Just using a random number to make the suffix unique on each session
+                    this.keySuffix = `${Math.ceil(Math.random() * 100000000)}`;
+                }
+                this.#authConfig.transform =
+                    sdkConfigAuth.transform !== undefined ? sdkConfigAuth.transform : this.#transform;
+                // Using property in class as authConfig may be empty at times
+                this.#transform = this.#authConfig.transform;
+                if (sdkConfigAuth.tokenStorage !== undefined) {
+                    this.#tokenStorage = sdkConfigAuth.tokenStorage;
+                }
+                if (sdkConfigAuth.secureCookie) {
+                    this.#authConfig.secureCookie = true;
+                }
+                // Get latest state once client ids, transform and tokenStorage have been established
+                this.#doOnLoad();
+                // If no clientId is specified assume not OAuth but custom auth
+                if (pegaAuthConfig.grantType === 'none' || !pegaAuthConfig.clientId) {
+                    this.bCustomAuth = true;
+                    return;
+                }
+                // For some OAuth grant type scenarios we opt to pass the Orchestration Engine just an authHeader as
+                //  service broker doesn't have proper support for dealing with refreshing or revoking these:
+                //  * customBearer (except when secureCookie being used)
+                //  * confidential grant types (ones with clientSecret)
+                // (With 25.1 orchestration engine does support this if client_secret is specified on bootstrap)
+                this.#bOAuthCustom =
+                    (pegaAuthConfig.grantType === 'customBearer' && !secureCookie) || clientSecret;
+                if (pegaAuthConfig.grantType === 'authCode') {
+                    const authCodeProps = {
+                        authorizeUri: sdkConfigAuth.authorize,
+                        // If we have already specified a redirect on the authorize redirect, we need to continue to use that
+                        //  on token endpoint
+                        redirectUri: bNoInitialRedirect || this.usePopupForRestOfSession
+                            ? sNoMainRedirectUri
+                            : sdkConfigAuth.redirectUri
+                    };
+                    if ('silentTimeout' in sdkConfigAuth) {
+                        authCodeProps.silentTimeout = sdkConfigAuth.silentTimeout;
+                    }
+                    if (bNoInitialRedirect &&
+                        pegaAuthConfig.authService === 'pega' &&
+                        sdkConfigAuth.mashupUserIdentifier &&
+                        sdkConfigAuth.mashupPassword) {
+                        authCodeProps.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
+                        authCodeProps.password = sdkConfigAuth.mashupPassword;
+                    }
+                    if ('iframeLoginUI' in sdkConfigAuth) {
+                        authCodeProps.iframeLoginUI =
+                            sdkConfigAuth.iframeLoginUI.toString().toLowerCase() === 'true';
+                    }
+                    Object.assign(pegaAuthConfig, authCodeProps);
+                }
+                else if (pegaAuthConfig.grantType === 'passwordCreds') {
+                    pegaAuthConfig.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
+                    pegaAuthConfig.password = sdkConfigAuth.mashupPassword;
+                }
+                Object.assign(this.#authConfig, pegaAuthConfig);
+                // Add beforeunload and page hide handlers to write out key properties that we want to survive a
+                //  browser reload
+                if (!this.#beforeUnloadAdded && (!this.#usePASS || this.#tokenStorage !== 'always')) {
+                    window.addEventListener('beforeunload', this.#doBeforeUnload.bind(this));
+                    window.addEventListener('pagehide', this.#doPageHide.bind(this));
+                    this.#beforeUnloadAdded = true;
+                }
+                // Initialize PegaAuth OAuth 2.0 client library
+                if (this.#usePASS) {
+                    this.#setStorage(this.#ssKeyConfigInfo, this.#authConfig);
+                    this.#setStorage(this.#ssKeySessionInfo, this.#authDynState);
+                    this.#pegaAuth = new PegaAuth(this.#ssKeyConfigInfo, this.#ssKeySessionInfo);
+                }
+                else {
+                    this.#authConfig.fnDynStateChangedCB = this.#doAuthDynStateChanged.bind(this);
+                    this.#pegaAuth = new PegaAuth(this.#authConfig, this.#authDynState);
+                }
+                this.initInProgress = false;
+                resolve(this.#pegaAuth);
+            });
+        });
+        return this.#promiseInitialize;
+    }
+    /**
+     * Initiate the process to get the Constellation bootstrap shell loaded and initialized
+     * @param {Object} tokenInfo
+     * @param {Function} authTokenUpdated - callback invoked when Constellation JS Engine silently updates
+     *      an expired access_token
+     * @param {Function} fnReauth - callback invoked when a full or custom reauth is needed
+     */
+    #constellationInit(tokenInfo, authTokenUpdated, fnReauth) {
+        const constellationBootConfig = {};
+        const sdkConfigServer = SdkConfigAccess.getSdkConfigServer();
+        const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
+        const authConfig = this.#authConfig;
+        // Set up constellationConfig with data that bootstrapWithAuthHeader expects
+        constellationBootConfig.customRendering = true;
+        constellationBootConfig.restServerUrl = sdkConfigServer.infinityRestServerUrl;
+        // NOTE: Needs a trailing slash! So add one if not provided
+        if (!sdkConfigServer.sdkContentServerUrl.endsWith('/')) {
+            sdkConfigServer.sdkContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}/`;
+        }
+        constellationBootConfig.staticContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}constellation/`;
+        if (!constellationBootConfig.staticContentServerUrl.endsWith('/')) {
+            constellationBootConfig.staticContentServerUrl = `${constellationBootConfig.staticContentServerUrl}/`;
+        }
+        // If appAlias specified, use it
+        if (sdkConfigServer.appAlias) {
+            constellationBootConfig.appAlias = sdkConfigServer.appAlias;
+        }
+        // Determine whether to send credentials with DX API transactions
+        if (sdkConfigAuth.customCookies) {
+            constellationBootConfig.customCookies = true;
+        }
+        if (this.#bOAuthCustom || !tokenInfo) {
+            if (tokenInfo) {
+                this.#authHeader = `${tokenInfo.token_type} ${tokenInfo.access_token}`;
+            }
+            if (this.#authHeader) {
+                constellationBootConfig.authorizationHeader = this.#authHeader;
+            }
+        }
+        else {
+            // Pass in auth info to Constellation
+            constellationBootConfig.authInfo = {
+                authType: 'OAuth2.0',
+                tokenInfo,
+                // Set whether we want constellation to try to do a full re-Auth or not ()
+                // true doesn't seem to be working in SDK scenario so always passing false for now
+                popupReauth: false /* !this.noInitialRedirect */,
+                client_id: authConfig.clientId,
+                client_secret: authConfig.clientSecret,
+                authentication_service: authConfig.authService,
+                redirect_uri: authConfig.redirectUri,
+                endPoints: {
+                    authorize: authConfig.authorizeUri,
+                    token: authConfig.tokenUri,
+                    revoke: authConfig.revokeUri
+                },
+                secureCookie: authConfig.secureCookie,
+                onTokenRetrieval: authTokenUpdated
+            };
+        }
+        // Turn off dynamic load components (should be able to do it here instead of after load?)
+        constellationBootConfig.dynamicLoadComponents = false;
+        // Set envType if appropriate
+        if (authConfig.serverType === 'launchpad') {
+            constellationBootConfig.envType = 'LAUNCHPAD';
+        }
+        // Set locale override if specified
+        const localeOverride = this.locale;
+        if (localeOverride) {
+            constellationBootConfig.locale = localeOverride;
+        }
+        // Set additional headers if specified
+        const additionalHeaders = this.#loginProps.additionalHeaders;
+        if (additionalHeaders) {
+            constellationBootConfig.additionalHeaders = additionalHeaders;
+        }
+        if (this.bC11NBootstrapInProgress) {
+            return;
+        }
+        this.bC11NBootstrapInProgress = true;
+        // Note that staticContentServerUrl already ends with a slash (see above), so no slash added.
+        // In order to have this import succeed needed to use the webpackIgnore magic comment tag.
+        // See:  https://webpack.js.org/api/module-methods/
+        import(
+        /* webpackIgnore: true */ `${constellationBootConfig.staticContentServerUrl}bootstrap-shell.js?v=${Date.now()}`).then(bootstrapShell => {
+            // NOTE: once this callback is done, we lose the ability to access loadMashup.
+            //  So, create a reference to it
+            window.myLoadMashup = bootstrapShell.loadMashup;
+            window.myLoadPortal = bootstrapShell.loadPortal;
+            window.myLoadDefaultPortal = bootstrapShell.loadDefaultPortal;
+            bootstrapShell
+                .bootstrapWithAuthHeader(constellationBootConfig, 'pega-root')
+                .then(() => {
+                // eslint-disable-next-line no-console
+                console.log('ConstellationJS bootstrap successful!');
+                this.bC11NBootstrapInProgress = false;
+                this.bC11NBootstrapComplete = true;
+                // Setup listener for the reauth event
+                if (!this.#bOAuthCustom && tokenInfo) {
+                    PCore.getPubSubUtils().subscribe(PCore.getConstants().PUB_SUB_EVENTS.EVENT_FULL_REAUTH, fnReauth, 'authFullReauth');
+                }
+                else {
+                    // customReauth event introduced with 8.8
+                    const sEvent = PCore.getConstants().PUB_SUB_EVENTS.EVENT_CUSTOM_REAUTH;
+                    if (sEvent) {
+                        PCore.getPubSubUtils().subscribe(sEvent, fnReauth, 'doReauth');
+                    }
+                }
+                // Fire SdkConstellationReady event so bridge and app route can do expected post PCore initializations
+                const event = new CustomEvent('SdkConstellationReady', {});
+                document.dispatchEvent(event);
+            })
+                .catch(e => {
+                // Assume error caught is because token is not valid and attempt a full reauth
+                // eslint-disable-next-line no-console
+                console.error(`ConstellationJS bootstrap failed. ${e}`);
+                this.bC11NBootstrapInProgress = false;
+                fnReauth();
+            });
+        });
+        /* Ends here */
+    }
+    #customConstellationInit(fnReauth) {
+        this.#constellationInit(null, null, fnReauth);
+    }
+    #fireTokenAvailable(token, bLoadC11N = true) {
+        if (!token) {
+            // This is used on page reload to load the token from sessionStorage and carry on
+            token = this.#tokenInfo;
+            if (!token) {
+                return;
+            }
+        }
+        this.#tokenInfo = token;
+        if (this.#tokenStorage === 'always') {
+            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
+        }
+        this.#updateLoginStatus();
+        // this.isLoggedIn is getting updated in updateLoginStatus
+        this.isLoggedIn = true;
+        this.usePopupForRestOfSession = true;
+        if (!window.PCore && bLoadC11N) {
+            this.#constellationInit(token, this.#authTokenUpdated.bind(this), this.#authRefreshOrFullReauth.bind(this));
+        }
+        /*
+        // Create and dispatch the SdkLoggedIn event to trigger constellationInit
+        const event = new CustomEvent('SdkLoggedIn', { detail: { authConfig, tokenInfo: token } });
+        document.dispatchEvent(event);
+        */
+    }
+    #processTokenOnLogin(token, bLoadC11N = true) {
+        this.#tokenInfo = token;
+        if (this.#tokenStorage === 'always') {
+            this.#setStorage(this.#ssKeyTokenInfo, this.#tokenInfo);
+        }
+        if (this.#bOAuthCustom) {
+            // authHeader setter will also set #authHeader and invoke getAuthUtils().setAuthorizationHeader
+            this.authHeader = `${token.token_type} ${token.access_token}`;
+        }
+        if (window.PCore && !this.#authHeader) {
+            PCore.getAuthUtils().setTokens(token);
+        }
+        else {
+            this.#fireTokenAvailable(token, bLoadC11N);
+        }
+    }
+    #doCustomTokenParamsCB() {
+        if (this.#authConfig.grantType === 'customBearer' && this.#customTokenParamsCB) {
+            try {
+                const customTokenParams = this.#customTokenParamsCB();
+                if (customTokenParams) {
+                    this.#authConfig.customTokenParams = customTokenParams;
+                }
+            }
+            catch (e) {
+                // eslint-disable-next-line no-console
+                console.error(`Error on customTokenParams callback. ${e}`);
+            }
+        }
+    }
     updateRedirectUri(sRedirectUri) {
-        __classPrivateFieldGet(this, _AuthManager_authConfig, "f").redirectUri = sRedirectUri;
+        this.#authConfig.redirectUri = sRedirectUri;
     }
     /**
      * Get available portals which supports SDK
@@ -230,9 +683,9 @@ class AuthManager {
                 const appAlias = serverConfig.appAlias;
                 const appAliasPath = appAlias ? `/app/${appAlias}` : '';
                 const arExcludedPortals = serverConfig.excludePortals;
-                const additionalHeaders = __classPrivateFieldGet(this, _AuthManager_loginProps, "f").additionalHeaders || {};
-                const oHeaders = __classPrivateFieldGet(this, _AuthManager_authHeader, "f")
-                    ? { Authorization: __classPrivateFieldGet(this, _AuthManager_authHeader, "f"), ...additionalHeaders }
+                const additionalHeaders = this.#loginProps.additionalHeaders || {};
+                const oHeaders = this.#authHeader
+                    ? { Authorization: this.#authHeader, ...additionalHeaders }
                     : additionalHeaders;
                 const headers = {
                     'Content-Type': 'application/json',
@@ -243,7 +696,7 @@ class AuthManager {
                 return fetch(`${serverUrl}${appAliasPath}/api/v1/data/${dataPageName}`, {
                     method: 'GET',
                     headers,
-                    credentials: __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie ? 'include' : 'omit'
+                    credentials: this.#authConfig.secureCookie ? 'include' : 'omit'
                 })
                     .then(response => {
                     if (response.ok && response.status === 200) {
@@ -284,27 +737,97 @@ class AuthManager {
             });
         });
     }
+    #updateLoginStatus() {
+        if (!this.#authHeader && this.#tokenInfo?.access_token) {
+            // Use setter to set this securely
+            this.authHeader = `${this.#tokenInfo.token_type} ${this.#tokenInfo.access_token}`;
+        }
+        this.isLoggedIn =
+            !!(this.#authHeader && this.#authHeader.length > 0) ||
+                (this.#authConfig.secureCookie && Object.keys(this.#tokenInfo || {}).length > 0);
+    }
+    // Initiate a full OAuth re-authorization (any refresh token has also expired).
+    #authFullReauth() {
+        const bHandleHere = true; // Other alternative is to raise an event and have someone else handle it
+        if (this.reauthStart) {
+            const reauthIgnoreInterval = 300000; // 5 minutes
+            const currTime = Date.now();
+            const bReauthInProgress = currTime - this.reauthStart <= reauthIgnoreInterval;
+            if (bReauthInProgress) {
+                return;
+            }
+        }
+        if (bHandleHere) {
+            // Don't want to do a full clear of authMgr as will loose state props (like sessionIndex).  Rather just clear the tokens
+            this.clear(true);
+            // eslint-disable-next-line @typescript-eslint/no-use-before-define
+            login(true);
+        }
+        else {
+            // Fire the SdkFullReauth event to indicate a new token is needed (PCore.getAuthUtils.setTokens method
+            //  should be used to communicate the new token to Constellation JS Engine.
+            const event = new CustomEvent('SdkFullReauth', {
+                detail: this.#processTokenOnLogin.bind(this)
+            });
+            document.dispatchEvent(event);
+        }
+    }
+    #authRefresh(tokenInfo) {
+        const bBootstrapComplete = this.bC11NBootstrapComplete;
+        this.#initialize(false).then(aMgr => {
+            aMgr.refreshToken(tokenInfo.refresh_token).then(token => {
+                if (token?.token_type) {
+                    this.#processTokenOnLogin(token, !bBootstrapComplete);
+                }
+                else {
+                    this.#authFullReauth();
+                }
+            });
+        });
+    }
+    #isRefreshTokenAvailable() {
+        return ((!this.#authConfig.secureCookie && this.#tokenInfo?.refresh_token) ||
+            (this.#authConfig.secureCookie && this.#tokenInfo.is_refresh_token_enabled));
+    }
+    // Do a full reauth or token refresh
+    #authRefreshOrFullReauth() {
+        if (this.#authHeader && this.#authConfig.grantType === 'none') {
+            // Should never come down this path
+        }
+        else if (this.#isRefreshTokenAvailable() &&
+            (this.#authConfig.secureCookie || this.#bOAuthCustom || !this.bC11NBootstrapComplete)) {
+            // If not doing custom and have a refresh token, then attempt a refresh
+            this.#authRefresh(this.#tokenInfo);
+        }
+        else {
+            this.#authFullReauth();
+        }
+    }
+    // Passive update where just session storage is updated so can be used on a window refresh
+    #authTokenUpdated(tokenInfo) {
+        this.#tokenInfo = tokenInfo;
+    }
     // TODO: Cope with 401 and refresh token if possible (or just hope that it succeeds during login)
     /**
      * Retrieve UserInfo for current authentication service
      */
     getUserInfo() {
-        if (__classPrivateFieldGet(this, _AuthManager_userInfo, "f")) {
-            return __classPrivateFieldGet(this, _AuthManager_userInfo, "f");
+        if (this.#userInfo) {
+            return this.#userInfo;
         }
-        return __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
-            return aMgr.getUserinfo(__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token).then(data => {
-                __classPrivateFieldSet(this, _AuthManager_userInfo, data, "f");
-                return __classPrivateFieldGet(this, _AuthManager_userInfo, "f");
+        return this.#initialize(false).then(aMgr => {
+            return aMgr.getUserinfo(this.#tokenInfo.access_token).then(data => {
+                this.#userInfo = data;
+                return this.#userInfo;
             });
         });
     }
     login(bFullReauth = false) {
         if (this.bCustomAuth)
             return;
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, !bFullReauth).then(aMgr => {
+        this.#initialize(!bFullReauth).then(aMgr => {
             const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
-            if (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").grantType === 'authCode') {
+            if (this.#authConfig.grantType === 'authCode') {
                 const bMainRedirect = !this.noInitialRedirect;
                 let sRedirectUri = sdkConfigAuth.redirectUri;
                 // If initial main redirect is OK, redirect to main page, otherwise will authorize in a popup window
@@ -325,12 +848,12 @@ class AuthManager {
                 this.updateRedirectUri(sRedirectUri);
             }
             return new Promise((resolve, reject) => {
-                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doCustomTokenParamsCB).call(this);
+                this.#doCustomTokenParamsCB();
                 aMgr
                     .login()
                     .then(token => {
-                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).call(this, token);
-                    if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
+                    this.#processTokenOnLogin(token);
+                    if (this.#loadUserinfo) {
                         this.getUserInfo();
                     }
                     resolve(token.access_token);
@@ -351,17 +874,17 @@ class AuthManager {
         const state = urlParams.get('state');
         // If state should also match before accepting code
         if (code) {
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
+            this.#initialize(false).then(aMgr => {
                 if (aMgr.checkStateMatch(state)) {
                     aMgr.getToken(code).then(token => {
                         // Remove any altStateStorage
-                        if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage) {
-                            window.localStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
-                            window.localStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
+                        if (this.#loginProps?.altStateStorage) {
+                            window.localStorage.removeItem(this.#ssKeySessionInfo);
+                            window.localStorage.removeItem(this.#ssKeyState);
                         }
                         if (token && token.token_type) {
-                            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).call(this, token, false);
-                            if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
+                            this.#processTokenOnLogin(token, false);
+                            if (this.#loadUserinfo) {
                                 this.getUserInfo();
                             }
                             if (fnLoggedInCB) {
@@ -387,14 +910,14 @@ class AuthManager {
     }
     loginIfNecessary(loginProps) {
         const { appName, deferLogin, redirectDoneCB, locale } = loginProps;
-        __classPrivateFieldSet(this, _AuthManager_loginProps, { ...loginProps }, "f");
+        this.#loginProps = { ...loginProps };
         const noMainRedirect = !loginProps.mainRedirect;
         // We need to load state before making any decisions. If appName is not there
         //  and this is not the first time load...suspect something is wrong and we need to reload
         if (Object.keys(this.state).length <= this.stateKeysCount || !this.appName) {
             // Once appName is defined it should exceed this count.  If not there should be no
             // harm trying once more
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_loadState).call(this);
+            this.#loadState();
         }
         // If no initial redirect status of page changed...clear AuthMgr
         const currNoMainRedirect = this.noInitialRedirect;
@@ -413,9 +936,9 @@ class AuthManager {
         }
         // If custom auth no need to do any OAuth logic
         if (this.bCustomAuth) {
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
+            this.#updateLoginStatus();
             if (!window.PCore) {
-                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_customConstellationInit).call(this, () => {
+                this.#customConstellationInit(() => {
                     // Fire the SdkCustomReauth event to indicate a new authHeader is needed. Event listener should invoke sdkSetAuthHeader
                     //  to communicate the new token to sdk (and Constellation JS Engine)
                     // eslint-disable-next-line @typescript-eslint/no-use-before-define
@@ -444,7 +967,7 @@ class AuthManager {
                 window.location.replace(window.location.pathname);
             };
             // INC-B43979 had strange case where sessionStorage was empty after redirects
-            if (!this.state.sfx && !__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage) {
+            if (!this.state.sfx && !this.#loginProps?.altStateStorage) {
                 // Reload the page to trigger another login.  Invoking login method here instead didn't
                 //  resolve the issue in client environment.
                 this.clear();
@@ -453,11 +976,11 @@ class AuthManager {
             return this.authRedirectCallback(window.location.href, redirectDoneCB || cbDefault);
         }
         if (!deferLogin) {
-            return __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(() => {
-                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
+            return this.#initialize(false).then(() => {
+                this.#updateLoginStatus();
                 if (this.isLoggedIn) {
-                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_fireTokenAvailable).call(this, __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
-                    if (__classPrivateFieldGet(this, _AuthManager_loadUserinfo, "f")) {
+                    this.#fireTokenAvailable(this.#tokenInfo);
+                    if (this.#loadUserinfo) {
                         this.getUserInfo();
                     }
                 }
@@ -468,10 +991,10 @@ class AuthManager {
         }
     }
     logout() {
-        if (__classPrivateFieldGet(this, _AuthManager_beforeUnloadAdded, "f")) {
-            window.removeEventListener('beforeunload', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doBeforeUnload).bind(this));
-            window.removeEventListener('pagehide', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doPageHide).bind(this));
-            __classPrivateFieldSet(this, _AuthManager_beforeUnloadAdded, false, "f");
+        if (this.#beforeUnloadAdded) {
+            window.removeEventListener('beforeunload', this.#doBeforeUnload.bind(this));
+            window.removeEventListener('pagehide', this.#doPageHide.bind(this));
+            this.#beforeUnloadAdded = false;
         }
         return new Promise(resolve => {
             const fnClearAndResolve = () => {
@@ -485,8 +1008,8 @@ class AuthManager {
                 return;
             }
             // For secure cookie there will not be an access_token so just check for token_type
-            if (__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f") && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").token_type) {
-                if (window.PCore && !__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f")) {
+            if (this.#tokenInfo && this.#tokenInfo.token_type) {
+                if (window.PCore && !this.#bOAuthCustom) {
                     window.PCore.getAuthUtils()
                         .revokeTokens()
                         .catch(err => {
@@ -498,11 +1021,11 @@ class AuthManager {
                     });
                 }
                 else {
-                    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_initialize).call(this, false).then(aMgr => {
+                    this.#initialize(false).then(aMgr => {
                         aMgr
-                            .revokeTokens(__classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie ? 'cookie' : __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token, __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").is_refresh_token_enabled
+                            .revokeTokens(this.#authConfig.secureCookie ? 'cookie' : this.#tokenInfo.access_token, this.#authConfig.secureCookie && this.#tokenInfo.is_refresh_token_enabled
                             ? 'cookie'
-                            : __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").refresh_token)
+                            : this.#tokenInfo.refresh_token)
                             .then(() => {
                             // Go to finally
                         })
@@ -518,515 +1041,6 @@ class AuthManager {
         });
     }
 }
-_AuthManager_ssKeyPrefix = new WeakMap(), _AuthManager_pegaAuth = new WeakMap(), _AuthManager_ssKeyConfigInfo = new WeakMap(), _AuthManager_ssKeySessionInfo = new WeakMap(), _AuthManager_ssKeyTokenInfo = new WeakMap(), _AuthManager_ssKeyState = new WeakMap(), _AuthManager_authConfig = new WeakMap(), _AuthManager_authDynState = new WeakMap(), _AuthManager_authHeader = new WeakMap(), _AuthManager_customTokenParamsCB = new WeakMap(), _AuthManager_bOAuthCustom = new WeakMap(), _AuthManager_tokenInfo = new WeakMap(), _AuthManager_userInfo = new WeakMap(), _AuthManager_usePASS = new WeakMap(), _AuthManager_beforeUnloadAdded = new WeakMap(), _AuthManager_tokenStorage = new WeakMap(), _AuthManager_transform = new WeakMap(), _AuthManager_foldSpot = new WeakMap(), _AuthManager_loadUserinfo = new WeakMap(), _AuthManager_loginProps = new WeakMap(), _AuthManager_promiseInitialize = new WeakMap(), _AuthManager_instances = new WeakSet(), _AuthManager_transformAndParse = function _AuthManager_transformAndParse(ssKey, ssItem, bForce = false) {
-    let obj = {};
-    try {
-        obj = JSON.parse(__classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformer).call(this, ssKey, ssItem, false, bForce));
-    }
-    catch (e) {
-        // fall thru and return empty object
-    }
-    return obj;
-}, _AuthManager_getStorage = function _AuthManager_getStorage(ssKey, sAttrib = null) {
-    let ssItem = ssKey ? window.sessionStorage.getItem(ssKey) : null;
-    let obj = {};
-    if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage &&
-        !this.isLoggedIn &&
-        !ssItem &&
-        (ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f") || ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"))) {
-        ssItem = window.localStorage.getItem(ssKey);
-    }
-    if (ssItem) {
-        try {
-            obj = JSON.parse(ssItem);
-        }
-        catch (e) {
-            obj = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformAndParse).call(this, ssKey, ssItem, true);
-        }
-    }
-    return sAttrib ? obj[sAttrib] : obj;
-}, _AuthManager_setStorage = function _AuthManager_setStorage(ssKey, obj, bVerify = false) {
-    try {
-        // Set storage only if obj is not empty, else delete the storage
-        if (!obj || isEmptyObject(obj)) {
-            window.sessionStorage.removeItem(ssKey);
-        }
-        else {
-            // const bClear = (ssKey === this.#ssKeyState || ssKey === this.#ssKeySessionInfo);
-            const bClear = false;
-            const sValue = bClear
-                ? JSON.stringify(obj)
-                : __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_transformer).call(this, ssKey, JSON.stringify(obj), true);
-            window.sessionStorage.setItem(ssKey, sValue);
-            if (bVerify) {
-                const sStored = window.sessionStorage.getItem(ssKey);
-                if (sStored !== sValue) {
-                    // eslint-disable-next-line no-console
-                    console.error(`Failed to properly write sessionStorage (${ssKey})`);
-                }
-            }
-            if (__classPrivateFieldGet(this, _AuthManager_loginProps, "f")?.altStateStorage &&
-                !this.isLoggedIn &&
-                (ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f") || ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"))) {
-                window.localStorage.setItem(ssKey, sValue);
-            }
-        }
-    }
-    catch (e) {
-        // eslint-disable-next-line no-console
-        console.error(`Exception ${e} on attempted write of sessionStorage (${ssKey})`);
-    }
-}, _AuthManager_calcFoldSpot = function _AuthManager_calcFoldSpot(s) {
-    const nOffset = 1;
-    const sChar = s.length > nOffset ? s.charAt(nOffset) : '2';
-    const nSpot = parseInt(sChar, 10);
-    __classPrivateFieldSet(this, _AuthManager_foldSpot, Number.isNaN(nSpot) ? 2 : (nSpot % 4) + 2, "f");
-}, _AuthManager_transformer = function _AuthManager_transformer(ssKey, s, bIn, bForce = false) {
-    const bTransform = bForce || __classPrivateFieldGet(this, _AuthManager_transform, "f");
-    const fnFold = (x) => {
-        const nLen = x.length;
-        const nExtra = nLen % __classPrivateFieldGet(this, _AuthManager_foldSpot, "f");
-        const nOffset = Math.floor(nLen / __classPrivateFieldGet(this, _AuthManager_foldSpot, "f")) + nExtra;
-        const nRem = x.length - nOffset;
-        return x.substring(bIn ? nOffset : nRem) + x.substring(0, bIn ? nOffset : nRem);
-    };
-    const bTknInfo = ssKey === __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f");
-    if (bTknInfo && !bIn && bTransform) {
-        s = window.atob(fnFold(s));
-    }
-    // eslint-disable-next-line no-nested-ternary
-    let result = bTransform ? (bIn ? window.btoa(s) : window.atob(s)) : s;
-    if (bTknInfo && bIn && bTransform) {
-        result = fnFold(window.btoa(result));
-    }
-    return result;
-}, _AuthManager_doUnloadUpdates = function _AuthManager_doUnloadUpdates() {
-    // Safari and particularly Safari on mobile devices doesn't seem to load this on first main redirect or
-    // reliably, so have moved to having PegaAuth manage writing all state props to session storage
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"), this.state);
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
-    // If tokenStorage was always, token would already be there
-    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'temp') {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
-    }
-}, _AuthManager_doBeforeUnload = function _AuthManager_doBeforeUnload() {
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doUnloadUpdates).call(this);
-}, _AuthManager_doPageHide = function _AuthManager_doPageHide() {
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doUnloadUpdates).call(this);
-}, _AuthManager_loadState = function _AuthManager_loadState() {
-    // Note: State storage key doesn't have a client id associated with it
-    const oState = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyState, "f"));
-    if (oState) {
-        Object.assign(this.state, oState);
-        if (this.state.sfx) {
-            // Setter sets up the ssKey values as well
-            this.keySuffix = this.state.sfx;
-        }
-    }
-}, _AuthManager_doOnLoad = function _AuthManager_doOnLoad() {
-    if (!this.onLoadDone) {
-        // This authConfig state doesn't collide with other calculated static state...so load it first
-        // Note: transform setting will have already been loaded into #authConfig at this point
-        __classPrivateFieldSet(this, _AuthManager_authDynState, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f")), "f");
-        __classPrivateFieldSet(this, _AuthManager_tokenInfo, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_getStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f")), "f");
-        if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") !== 'always') {
-            sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"));
-            // Finding on iOS browsers the pageHide event is sometimes not happening causing failed redirects.
-            if (!this.iOSDevice) {
-                sessionStorage.removeItem(__classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"));
-            }
-        }
-        this.onLoadDone = true;
-    }
-}, _AuthManager_doAuthDynStateChanged = function _AuthManager_doAuthDynStateChanged() {
-    // If tokenStorage is setup for always then always persist the auth dynamic state as well
-    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always' || this.iOSDevice) {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
-    }
-}, _AuthManager_initialize = 
-/**
- * Initialize OAuth config structure members and create authMgr instance (if necessary)
- * bNew - governs whether to create new sessionStorage or load existing one
- */
-async function _AuthManager_initialize(bNew = false) {
-    if (!bNew && __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f")) {
-        return __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f");
-    }
-    __classPrivateFieldSet(this, _AuthManager_promiseInitialize, new Promise(resolve => {
-        /* if (!this.initInProgress && (bNew || isEmptyObject(this.#authConfig) || !this.#pegaAuth)) { */
-        this.initInProgress = true;
-        getSdkConfig().then(sdkConfig => {
-            const sdkConfigAuth = sdkConfig.authConfig;
-            const sdkConfigServer = sdkConfig.serverConfig;
-            const serverType = sdkConfigServer.serverType || 'infinity';
-            const bInfinity = serverType === 'infinity';
-            let pegaUrl = bInfinity
-                ? sdkConfigServer.infinityRestServerUrl
-                : sdkConfigServer.launchpadRestServerUrl;
-            // Expecting boolean true/false or undefined
-            const secureCookie = !!sdkConfigAuth.secureCookie;
-            const bNoInitialRedirect = this.noInitialRedirect;
-            const appAliasSeg = sdkConfigServer.appAlias ? `app/${sdkConfigServer.appAlias}/` : '';
-            // Construct default OAuth endpoints (if not explicitly specified)
-            if (pegaUrl) {
-                // Cope with trailing slash being present
-                if (!pegaUrl.endsWith('/')) {
-                    pegaUrl += '/';
-                }
-                if (!sdkConfigAuth.authorize) {
-                    sdkConfigAuth.authorize = bInfinity
-                        ? `${pegaUrl}PRRestService/oauth2/v1/authorize`
-                        : `${pegaUrl}uas/oauth/authorize`;
-                }
-                const infinityOAuth2Url = bInfinity
-                    ? pegaUrl + (secureCookie && appAliasSeg ? `${appAliasSeg}api/` : 'PRRestService/')
-                    : '';
-                if (!sdkConfigAuth.token) {
-                    sdkConfigAuth.token = bInfinity
-                        ? `${infinityOAuth2Url}oauth2/v1/token`
-                        : `${pegaUrl}uas/oauth/token`;
-                }
-                if (!sdkConfigAuth.revoke) {
-                    // Launchpad still does not have a revoke endpoint
-                    sdkConfigAuth.revoke = bInfinity ? `${infinityOAuth2Url}oauth2/v1/revoke` : '';
-                }
-                if (!sdkConfigAuth.redirectUri) {
-                    sdkConfigAuth.redirectUri = `${window.location.origin}${window.location.pathname}`;
-                }
-                if (!sdkConfigAuth.userinfo) {
-                    sdkConfigAuth.userinfo = bInfinity
-                        ? `${pegaUrl}${appAliasSeg}api/oauthclients/v1/userinfo/JSON`
-                        : '';
-                }
-            }
-            // Auth service alias
-            if (!sdkConfigAuth.authService) {
-                sdkConfigAuth.authService = 'pega';
-            }
-            // mashupAuthService provides way to have a different auth service for embedded
-            if (!sdkConfigAuth.mashupAuthService) {
-                sdkConfigAuth.mashupAuthService = sdkConfigAuth.authService;
-            }
-            // Construct path to auth.html (used for case when not doing a main window redirect)
-            let sNoMainRedirectUri = sdkConfigAuth.redirectUri;
-            const nLastPathSep = sNoMainRedirectUri.lastIndexOf('/');
-            sNoMainRedirectUri =
-                nLastPathSep !== -1
-                    ? `${sNoMainRedirectUri.substring(0, nLastPathSep + 1)}auth.html`
-                    : `${sNoMainRedirectUri}/auth.html`;
-            const portalGrantType = sdkConfigAuth.portalGrantType || 'authCode';
-            const mashupGrantType = sdkConfigAuth.mashupGrantType || 'authCode';
-            // Some grant types are only available with confidential registrations and require a client secret
-            const clientSecret = bNoInitialRedirect
-                ? sdkConfigAuth.mashupClientSecret
-                : sdkConfigAuth.portalClientSecret;
-            const pegaAuthConfig = {
-                serverType,
-                clientId: bNoInitialRedirect
-                    ? sdkConfigAuth.mashupClientId
-                    : sdkConfigAuth.portalClientId,
-                grantType: bNoInitialRedirect ? mashupGrantType : portalGrantType,
-                tokenUri: sdkConfigAuth.token,
-                revokeUri: sdkConfigAuth.revoke,
-                userinfoUri: sdkConfigAuth.userinfo,
-                authService: bNoInitialRedirect
-                    ? sdkConfigAuth.mashupAuthService
-                    : sdkConfigAuth.authService,
-                appAlias: sdkConfigServer.appAlias || '',
-                useLocking: true
-            };
-            if (clientSecret) {
-                pegaAuthConfig.clientSecret = clientSecret;
-            }
-            if (serverType === 'launchpad' && pegaAuthConfig.grantType === 'authCode') {
-                pegaAuthConfig.noPKCE = true;
-            }
-            // Invoke keySuffix setter
-            // Was using pegaAuthConfig.clientId as key but more secure to just use a random string as getting
-            //  both a clientId and the refresh token could yield a new access token.
-            // Suffix is so we might in future move to an array of suffixes based on the appName, so might store
-            //  both portal and embedded tokens/session info at same time
-            if (!this.state?.sfx) {
-                // Just using a random number to make the suffix unique on each session
-                this.keySuffix = `${Math.ceil(Math.random() * 100000000)}`;
-            }
-            __classPrivateFieldGet(this, _AuthManager_authConfig, "f").transform =
-                sdkConfigAuth.transform !== undefined ? sdkConfigAuth.transform : __classPrivateFieldGet(this, _AuthManager_transform, "f");
-            // Using property in class as authConfig may be empty at times
-            __classPrivateFieldSet(this, _AuthManager_transform, __classPrivateFieldGet(this, _AuthManager_authConfig, "f").transform, "f");
-            if (sdkConfigAuth.tokenStorage !== undefined) {
-                __classPrivateFieldSet(this, _AuthManager_tokenStorage, sdkConfigAuth.tokenStorage, "f");
-            }
-            if (sdkConfigAuth.secureCookie) {
-                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie = true;
-            }
-            // Get latest state once client ids, transform and tokenStorage have been established
-            __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doOnLoad).call(this);
-            // If no clientId is specified assume not OAuth but custom auth
-            if (pegaAuthConfig.grantType === 'none' || !pegaAuthConfig.clientId) {
-                this.bCustomAuth = true;
-                return;
-            }
-            // For some OAuth grant type scenarios we opt to pass the Orchestration Engine just an authHeader as
-            //  service broker doesn't have proper support for dealing with refreshing or revoking these:
-            //  * customBearer (except when secureCookie being used)
-            //  * confidential grant types (ones with clientSecret)
-            // (With 25.1 orchestration engine does support this if client_secret is specified on bootstrap)
-            __classPrivateFieldSet(this, _AuthManager_bOAuthCustom, (pegaAuthConfig.grantType === 'customBearer' && !secureCookie) || clientSecret, "f");
-            if (pegaAuthConfig.grantType === 'authCode') {
-                const authCodeProps = {
-                    authorizeUri: sdkConfigAuth.authorize,
-                    // If we have already specified a redirect on the authorize redirect, we need to continue to use that
-                    //  on token endpoint
-                    redirectUri: bNoInitialRedirect || this.usePopupForRestOfSession
-                        ? sNoMainRedirectUri
-                        : sdkConfigAuth.redirectUri
-                };
-                if ('silentTimeout' in sdkConfigAuth) {
-                    authCodeProps.silentTimeout = sdkConfigAuth.silentTimeout;
-                }
-                if (bNoInitialRedirect &&
-                    pegaAuthConfig.authService === 'pega' &&
-                    sdkConfigAuth.mashupUserIdentifier &&
-                    sdkConfigAuth.mashupPassword) {
-                    authCodeProps.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
-                    authCodeProps.password = sdkConfigAuth.mashupPassword;
-                }
-                if ('iframeLoginUI' in sdkConfigAuth) {
-                    authCodeProps.iframeLoginUI =
-                        sdkConfigAuth.iframeLoginUI.toString().toLowerCase() === 'true';
-                }
-                Object.assign(pegaAuthConfig, authCodeProps);
-            }
-            else if (pegaAuthConfig.grantType === 'passwordCreds') {
-                pegaAuthConfig.userIdentifier = sdkConfigAuth.mashupUserIdentifier;
-                pegaAuthConfig.password = sdkConfigAuth.mashupPassword;
-            }
-            Object.assign(__classPrivateFieldGet(this, _AuthManager_authConfig, "f"), pegaAuthConfig);
-            // Add beforeunload and page hide handlers to write out key properties that we want to survive a
-            //  browser reload
-            if (!__classPrivateFieldGet(this, _AuthManager_beforeUnloadAdded, "f") && (!__classPrivateFieldGet(this, _AuthManager_usePASS, "f") || __classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") !== 'always')) {
-                window.addEventListener('beforeunload', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doBeforeUnload).bind(this));
-                window.addEventListener('pagehide', __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doPageHide).bind(this));
-                __classPrivateFieldSet(this, _AuthManager_beforeUnloadAdded, true, "f");
-            }
-            // Initialize PegaAuth OAuth 2.0 client library
-            if (__classPrivateFieldGet(this, _AuthManager_usePASS, "f")) {
-                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authConfig, "f"));
-                __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f"));
-                __classPrivateFieldSet(this, _AuthManager_pegaAuth, new PegaAuth(__classPrivateFieldGet(this, _AuthManager_ssKeyConfigInfo, "f"), __classPrivateFieldGet(this, _AuthManager_ssKeySessionInfo, "f")), "f");
-            }
-            else {
-                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").fnDynStateChangedCB = __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_doAuthDynStateChanged).bind(this);
-                __classPrivateFieldSet(this, _AuthManager_pegaAuth, new PegaAuth(__classPrivateFieldGet(this, _AuthManager_authConfig, "f"), __classPrivateFieldGet(this, _AuthManager_authDynState, "f")), "f");
-            }
-            this.initInProgress = false;
-            resolve(__classPrivateFieldGet(this, _AuthManager_pegaAuth, "f"));
-        });
-    }), "f");
-    return __classPrivateFieldGet(this, _AuthManager_promiseInitialize, "f");
-}, _AuthManager_constellationInit = function _AuthManager_constellationInit(tokenInfo, authTokenUpdated, fnReauth) {
-    const constellationBootConfig = {};
-    const sdkConfigServer = SdkConfigAccess.getSdkConfigServer();
-    const sdkConfigAuth = SdkConfigAccess.getSdkConfigAuth();
-    const authConfig = __classPrivateFieldGet(this, _AuthManager_authConfig, "f");
-    // Set up constellationConfig with data that bootstrapWithAuthHeader expects
-    constellationBootConfig.customRendering = true;
-    constellationBootConfig.restServerUrl = sdkConfigServer.infinityRestServerUrl;
-    // NOTE: Needs a trailing slash! So add one if not provided
-    if (!sdkConfigServer.sdkContentServerUrl.endsWith('/')) {
-        sdkConfigServer.sdkContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}/`;
-    }
-    constellationBootConfig.staticContentServerUrl = `${sdkConfigServer.sdkContentServerUrl}constellation/`;
-    if (!constellationBootConfig.staticContentServerUrl.endsWith('/')) {
-        constellationBootConfig.staticContentServerUrl = `${constellationBootConfig.staticContentServerUrl}/`;
-    }
-    // If appAlias specified, use it
-    if (sdkConfigServer.appAlias) {
-        constellationBootConfig.appAlias = sdkConfigServer.appAlias;
-    }
-    // Determine whether to send credentials with DX API transactions
-    if (sdkConfigAuth.customCookies) {
-        constellationBootConfig.customCookies = true;
-    }
-    if (__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f") || !tokenInfo) {
-        if (tokenInfo) {
-            __classPrivateFieldSet(this, _AuthManager_authHeader, `${tokenInfo.token_type} ${tokenInfo.access_token}`, "f");
-        }
-        if (__classPrivateFieldGet(this, _AuthManager_authHeader, "f")) {
-            constellationBootConfig.authorizationHeader = __classPrivateFieldGet(this, _AuthManager_authHeader, "f");
-        }
-    }
-    else {
-        // Pass in auth info to Constellation
-        constellationBootConfig.authInfo = {
-            authType: 'OAuth2.0',
-            tokenInfo,
-            // Set whether we want constellation to try to do a full re-Auth or not ()
-            // true doesn't seem to be working in SDK scenario so always passing false for now
-            popupReauth: false /* !this.noInitialRedirect */,
-            client_id: authConfig.clientId,
-            client_secret: authConfig.clientSecret,
-            authentication_service: authConfig.authService,
-            redirect_uri: authConfig.redirectUri,
-            endPoints: {
-                authorize: authConfig.authorizeUri,
-                token: authConfig.tokenUri,
-                revoke: authConfig.revokeUri
-            },
-            secureCookie: authConfig.secureCookie,
-            onTokenRetrieval: authTokenUpdated
-        };
-    }
-    // Turn off dynamic load components (should be able to do it here instead of after load?)
-    constellationBootConfig.dynamicLoadComponents = false;
-    // Set envType if appropriate
-    if (authConfig.serverType === 'launchpad') {
-        constellationBootConfig.envType = 'LAUNCHPAD';
-    }
-    // Set locale override if specified
-    const localeOverride = this.locale;
-    if (localeOverride) {
-        constellationBootConfig.locale = localeOverride;
-    }
-    // Set additional headers if specified
-    const additionalHeaders = __classPrivateFieldGet(this, _AuthManager_loginProps, "f").additionalHeaders;
-    if (additionalHeaders) {
-        constellationBootConfig.additionalHeaders = additionalHeaders;
-    }
-    if (this.bC11NBootstrapInProgress) {
-        return;
-    }
-    this.bC11NBootstrapInProgress = true;
-    // Note that staticContentServerUrl already ends with a slash (see above), so no slash added.
-    // In order to have this import succeed needed to use the webpackIgnore magic comment tag.
-    // See:  https://webpack.js.org/api/module-methods/
-    import(
-    /* webpackIgnore: true */ `${constellationBootConfig.staticContentServerUrl}bootstrap-shell.js?v=${Date.now()}`).then(bootstrapShell => {
-        // NOTE: once this callback is done, we lose the ability to access loadMashup.
-        //  So, create a reference to it
-        window.myLoadMashup = bootstrapShell.loadMashup;
-        window.myLoadPortal = bootstrapShell.loadPortal;
-        window.myLoadDefaultPortal = bootstrapShell.loadDefaultPortal;
-        bootstrapShell
-            .bootstrapWithAuthHeader(constellationBootConfig, 'pega-root')
-            .then(() => {
-            // eslint-disable-next-line no-console
-            console.log('ConstellationJS bootstrap successful!');
-            this.bC11NBootstrapInProgress = false;
-            // Setup listener for the reauth event
-            if (!__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f") && tokenInfo) {
-                PCore.getPubSubUtils().subscribe(PCore.getConstants().PUB_SUB_EVENTS.EVENT_FULL_REAUTH, fnReauth, 'authFullReauth');
-            }
-            else {
-                // customReauth event introduced with 8.8
-                const sEvent = PCore.getConstants().PUB_SUB_EVENTS.EVENT_CUSTOM_REAUTH;
-                if (sEvent) {
-                    PCore.getPubSubUtils().subscribe(sEvent, fnReauth, 'doReauth');
-                }
-            }
-            // Fire SdkConstellationReady event so bridge and app route can do expected post PCore initializations
-            const event = new CustomEvent('SdkConstellationReady', {});
-            document.dispatchEvent(event);
-        })
-            .catch(e => {
-            // Assume error caught is because token is not valid and attempt a full reauth
-            // eslint-disable-next-line no-console
-            console.error(`ConstellationJS bootstrap failed. ${e}`);
-            this.bC11NBootstrapInProgress = false;
-            fnReauth();
-        });
-    });
-    /* Ends here */
-}, _AuthManager_customConstellationInit = function _AuthManager_customConstellationInit(fnReauth) {
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_constellationInit).call(this, null, null, fnReauth);
-}, _AuthManager_fireTokenAvailable = function _AuthManager_fireTokenAvailable(token, bLoadC11N = true) {
-    if (!token) {
-        // This is used on page reload to load the token from sessionStorage and carry on
-        token = __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f");
-        if (!token) {
-            return;
-        }
-    }
-    __classPrivateFieldSet(this, _AuthManager_tokenInfo, token, "f");
-    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always') {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
-    }
-    __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_updateLoginStatus).call(this);
-    // this.isLoggedIn is getting updated in updateLoginStatus
-    this.isLoggedIn = true;
-    this.usePopupForRestOfSession = true;
-    if (!window.PCore && bLoadC11N) {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_constellationInit).call(this, token, __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_authTokenUpdated).bind(this), __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_authFullReauth).bind(this));
-    }
-    /*
-    // Create and dispatch the SdkLoggedIn event to trigger constellationInit
-    const event = new CustomEvent('SdkLoggedIn', { detail: { authConfig, tokenInfo: token } });
-    document.dispatchEvent(event);
-    */
-}, _AuthManager_processTokenOnLogin = function _AuthManager_processTokenOnLogin(token, bLoadC11N = true) {
-    __classPrivateFieldSet(this, _AuthManager_tokenInfo, token, "f");
-    if (__classPrivateFieldGet(this, _AuthManager_tokenStorage, "f") === 'always') {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_setStorage).call(this, __classPrivateFieldGet(this, _AuthManager_ssKeyTokenInfo, "f"), __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f"));
-    }
-    if (__classPrivateFieldGet(this, _AuthManager_bOAuthCustom, "f")) {
-        // authHeader setter will also set #authHeader and invoke getAuthUtils().setAuthorizationHeader
-        this.authHeader = `${token.token_type} ${token.access_token}`;
-    }
-    if (window.PCore && !__classPrivateFieldGet(this, _AuthManager_authHeader, "f")) {
-        PCore.getAuthUtils().setTokens(token);
-    }
-    else {
-        __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_fireTokenAvailable).call(this, token, bLoadC11N);
-    }
-}, _AuthManager_doCustomTokenParamsCB = function _AuthManager_doCustomTokenParamsCB() {
-    if (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").grantType === 'customBearer' && __classPrivateFieldGet(this, _AuthManager_customTokenParamsCB, "f")) {
-        try {
-            const customTokenParams = __classPrivateFieldGet(this, _AuthManager_customTokenParamsCB, "f").call(this);
-            if (customTokenParams) {
-                __classPrivateFieldGet(this, _AuthManager_authConfig, "f").customTokenParams = customTokenParams;
-            }
-        }
-        catch (e) {
-            // eslint-disable-next-line no-console
-            console.error(`Error on customTokenParams callback. ${e}`);
-        }
-    }
-}, _AuthManager_updateLoginStatus = function _AuthManager_updateLoginStatus() {
-    if (!__classPrivateFieldGet(this, _AuthManager_authHeader, "f") && __classPrivateFieldGet(this, _AuthManager_tokenInfo, "f")?.access_token) {
-        // Use setter to set this securely
-        this.authHeader = `${__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").token_type} ${__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f").access_token}`;
-    }
-    this.isLoggedIn =
-        !!(__classPrivateFieldGet(this, _AuthManager_authHeader, "f") && __classPrivateFieldGet(this, _AuthManager_authHeader, "f").length > 0) ||
-            (__classPrivateFieldGet(this, _AuthManager_authConfig, "f").secureCookie && Object.keys(__classPrivateFieldGet(this, _AuthManager_tokenInfo, "f") || {}).length > 0);
-}, _AuthManager_authFullReauth = function _AuthManager_authFullReauth() {
-    const bHandleHere = true; // Other alternative is to raise an event and have someone else handle it
-    if (this.reauthStart) {
-        const reauthIgnoreInterval = 300000; // 5 minutes
-        const currTime = Date.now();
-        const bReauthInProgress = currTime - this.reauthStart <= reauthIgnoreInterval;
-        if (bReauthInProgress) {
-            return;
-        }
-    }
-    if (bHandleHere) {
-        // Don't want to do a full clear of authMgr as will loose state props (like sessionIndex).  Rather just clear the tokens
-        this.clear(true);
-        // eslint-disable-next-line @typescript-eslint/no-use-before-define
-        login(true);
-    }
-    else {
-        // Fire the SdkFullReauth event to indicate a new token is needed (PCore.getAuthUtils.setTokens method
-        //  should be used to communicate the new token to Constellation JS Engine.
-        const event = new CustomEvent('SdkFullReauth', {
-            detail: __classPrivateFieldGet(this, _AuthManager_instances, "m", _AuthManager_processTokenOnLogin).bind(this)
-        });
-        document.dispatchEvent(event);
-    }
-}, _AuthManager_authTokenUpdated = function _AuthManager_authTokenUpdated(tokenInfo) {
-    __classPrivateFieldSet(this, _AuthManager_tokenInfo, tokenInfo, "f");
-};
 const gAuthMgr = new AuthManager();
 // TODO: Cope with 401 and refresh token if possible (or just hope that it succeeds during login)
 /**