@versini/auth0-react-thin 2.22.1 → 2.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/README.md +1 -1
  2. package/dist/auth0-provider.d.ts +5 -0
  3. package/dist/auth0-provider.d.ts.map +1 -1
  4. package/dist/auth0-react.cjs.js +13 -2
  5. package/dist/auth0-react.cjs.js.map +1 -1
  6. package/dist/auth0-react.esm.js +13 -2
  7. package/dist/auth0-react.esm.js.map +1 -1
  8. package/dist/auth0-react.js +12 -2
  9. package/dist/auth0-react.js.map +1 -1
  10. package/dist/auth0-react.min.js +1 -1
  11. package/dist/auth0-react.min.js.map +1 -1
  12. package/dist/with-authentication-required.d.ts.map +1 -1
  13. package/package.json +3 -3
  14. package/src/auth0-provider.tsx +5 -0
  15. package/src/with-authentication-required.tsx +8 -2
package/dist/auth0-react.min.js CHANGED
@@ -1,2 +1,2 @@
1
- !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},o.apply(this,arguments)};function r(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function i(e,t,n,o){return new(n||(n=Promise))(function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n(function(e){e(t)})).then(a,s)}c((o=o.apply(e,t||[])).next())})}function a(e,t){var n,o,r,i={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return a.next=s(0),a.throw=s(1),a.return=s(2),"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function s(s){return function(c){return function(s){if(n)throw new TypeError("Generator is already executing.");for(;a&&(a=0,s[0]&&(i=0)),i;)try{if(n=1,o&&(r=2&s[0]?o.return:s[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,s[1])).done)return r;switch(o=0,r&&(s=[2&s[0],r.value]),s[0]){case 0:case 1:r=s;break;case 4:return i.label++,{value:s[1],done:!1};case 5:i.label++,o=s[1],s=[0];continue;case 7:s=i.ops.pop(),i.trys.pop();continue;default:if(!(r=i.trys,(r=r.length>0&&r[r.length-1])||6!==s[0]&&2!==s[0])){i=0;continue}if(3===s[0]&&(!r||s[1]>r[0]&&s[1]<r[3])){i.label=s[1];break}if(6===s[0]&&i.label<r[1]){i.label=r[1],r=s;break}if(r&&i.label<r[2]){i.label=r[2],i.ops.push(s);break}r[2]&&i.ops.pop(),i.trys.pop();continue}s=t.call(e,i)}catch(e){s=[6,e],o=0}finally{n=r=0}if(5&s[0])throw s[1];return{value:s[0]?s[1]:void 0,done:!0}}([s,c])}}}function s(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function c(e,t,n,o){if("a"===n&&!o)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!o:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?o:"a"===n?o.call(e):o?o.value:t.get(e)}function u(e,t,n,o,r){if("m"===o)throw new TypeError("Private method is not writable");if("a"===o&&!r)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!r:!t.has(e))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===o?r.call(e,n):r?r.value=n:t.set(e,n),n}function l(e,t){this.v=e,this.k=t}function h(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,o=Array(t);n<t;n++)o[n]=e[n];return o}function d(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function p(e){return new l(e,0)}function f(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function m(e,t){return e.get(d(e,t))}function y(e,t,n){f(e,t),t.set(e,n)}function w(e,t,n){return e.set(d(e,t),n),n}function g(e,t){f(e,t),t.add(e)}function v(e,t,n){return(t=function(e){var t=function(e){if("object"!=typeof e||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function b(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,o)}return n}function k(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?b(Object(n),!0).forEach(function(t){v(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):b(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function _(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n={};for(var o in e)if({}.hasOwnProperty.call(e,o)){if(-1!==t.indexOf(o))continue;n[o]=e[o]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],-1===t.indexOf(n)&&{}.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}function S(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var o,r,i,a,s=[],c=!0,u=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;c=!1}else for(;!(c=(o=i.call(n)).done)&&(s.push(o.value),s.length!==t);c=!0);}catch(e){u=!0,r=e}finally{try{if(!c&&null!=n.return&&(a=n.return(),Object(a)!==a))return}finally{if(u)throw r}}return s}}(e,t)||function(e,t){if(e){if("string"==typeof e)return h(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?h(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function T(e){var t,n;function o(t,n){try{var i=e[t](n),a=i.value,s=a instanceof l;Promise.resolve(s?a.v:a).then(function(n){if(s){var c="return"===t&&a.k?t:"next";if(!a.k||n.done)return o(c,n);n=e[c](n).value}r(!!i.done,n)},function(e){o("throw",e)})}catch(e){r(2,e)}}function r(e,r){2===e?t.reject(r):t.resolve({value:r,done:e}),(t=t.next)?o(t.key,t.arg):n=null}this._invoke=function(e,r){return new Promise(function(i,a){var s={key:e,arg:r,resolve:i,reject:a,next:null};n?n=n.next=s:(t=n=s,o(e,r))})},"function"!=typeof e.return&&(this.return=void 0)}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError,T.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},T.prototype.next=function(e){return this._invoke("next",e)},T.prototype.throw=function(e){return this._invoke("throw",e)},T.prototype.return=function(e){return this._invoke("return",e)};const E={timeoutInSeconds:60},P=1e4,A="memory",R="online_access",C={name:"auth0-spa-js",version:"2.24.1"},I=()=>Date.now(),x="default";class O extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,O.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new O(t,n)}}class W extends O{constructor(e,t){super("invalid_configuration","".concat(e," ").concat(t)),this.suggestion=t,Object.setPrototypeOf(this,W.prototype)}}class j extends O{constructor(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,j.prototype)}}class U extends O{constructor(e,t,n,o){let r=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=r,Object.setPrototypeOf(this,U.prototype)}}class K extends O{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,K.prototype)}}class L extends K{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,L.prototype)}}class N extends O{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,N.prototype)}}class M extends O{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,M.prototype)}}class D extends O{constructor(e,t,n,o){super(e,t),this.mfa_token=n,this.mfa_requirements=o,Object.setPrototypeOf(this,D.prototype)}}class z extends O{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(Z(e,["default"]),"', scope: '").concat(Z(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,z.prototype)}}class J extends O{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(Z(e,["default"]),"', missing scope: '").concat(Z(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,J.prototype)}}class H extends O{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,H.prototype)}}function Z(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}const F=()=>window.crypto,V=()=>{let e="";for(;e.length<43;){const t=F().getRandomValues(new Uint8Array(43-e.length));for(const n of t)e.length<43&&n<198&&(e+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~."[n%66])}return e},G=e=>btoa(e),X=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],Y=function(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return Object.keys(e).reduce((n,o)=>{if(t&&"env"===o)return n;const r=X.find(e=>e.key===o);return r&&r.type.includes(typeof e[o])&&(n[o]=e[o]),n},{})},B=e=>{var t=e.clientId,n=s(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter(t=>void 0!==e[t]).reduce((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]}),{}))(Object.assign({client_id:t},n))).toString()},q=async e=>{const t=F().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},Q=e=>(e=>decodeURIComponent(atob(e).split("").map(e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),$=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,e=>t[e])})(window.btoa(String.fromCharCode(...Array.from(t))))};var ee="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},te={},ne={};Object.defineProperty(ne,"__esModule",{value:!0});var oe=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();ne.default=function(){return oe.getInstance()};var re=ee&&ee.__awaiter||function(e,t,n,o){return new(n||(n=Promise))(function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){e.done?r(e.value):new n(function(t){t(e.value)}).then(a,s)}c((o=o.apply(e,t||[])).next())})},ie=ee&&ee.__generator||function(e,t){var n,o,r,i,a={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:s(0),throw:s(1),return:s(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function s(i){return function(s){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;a;)try{if(n=1,o&&(r=2&i[0]?o.return:i[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,i[1])).done)return r;switch(o=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return a.label++,{value:i[1],done:!1};case 5:a.label++,o=i[1],i=[0];continue;case 7:i=a.ops.pop(),a.trys.pop();continue;default:if(!((r=(r=a.trys).length>0&&r[r.length-1])||6!==i[0]&&2!==i[0])){a=0;continue}if(3===i[0]&&(!r||i[1]>r[0]&&i[1]<r[3])){a.label=i[1];break}if(6===i[0]&&a.label<r[1]){a.label=r[1],r=i;break}if(r&&a.label<r[2]){a.label=r[2],a.ops.push(i);break}r[2]&&a.ops.pop(),a.trys.pop();continue}i=t.call(e,a)}catch(e){i=[6,e],o=0}finally{n=r=0}if(5&i[0])throw i[1];return{value:i[0]?i[1]:void 0,done:!0}}([i,s])}}},ae=ee;Object.defineProperty(te,"__esModule",{value:!0});var se=ne,ce="browser-tabs-lock-key",ue={key:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},getItem:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},clear:function(){return re(ae,void 0,void 0,function(){return ie(this,function(e){return[2,window.localStorage.clear()]})})},removeItem:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},setItem:function(e,t){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function le(e){return new Promise(function(t){return setTimeout(t,e)})}function he(e){for(var t="",n=0;n<e;n++)t+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz"[Math.floor(61*Math.random())];return t}var de=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+he(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),re(this,void 0,void 0,function(){var o,r,i,a,s,c,u;return ie(this,function(l){switch(l.label){case 0:o=Date.now()+he(4),r=Date.now()+n,i=ce+"-"+t,a=void 0===this.storageHandler?ue:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,le(30)]:[3,8];case 2:return l.sent(),null!==a.getItemSync(i)?[3,5]:(s=this.id+"-"+t+"-"+o,[4,le(Math.floor(25*Math.random()))]);case 3:return l.sent(),a.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:s,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,le(30)];case 4:return l.sent(),null!==(c=a.getItemSync(i))&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?ue:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+he(4),[3,1];case 8:return[2,!1]}})})},e.prototype.refreshLockWhileAcquired=function(e,t){return re(this,void 0,void 0,function(){var n=this;return ie(this,function(o){return setTimeout(function(){return re(n,void 0,void 0,function(){var n,o,r;return ie(this,function(i){switch(i.label){case 0:return[4,se.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?ue:this.storageHandler,null===(o=n.getItemSync(e))?(se.default().unlock(t),[2]):((r=JSON.parse(o)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),se.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(se.default().unlock(t),[2])}})})},1e3),[2]})})},e.prototype.waitForSomethingToChange=function(t){return re(this,void 0,void 0,function(){return ie(this,function(n){switch(n.label){case 0:return[4,new Promise(function(n){var o=!1,r=Date.now(),i=!1;function a(){if(i||(window.removeEventListener("storage",a),e.removeFromWaiting(a),clearTimeout(s),i=!0),!o){o=!0;var t=50-(Date.now()-r);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",a),e.addToWaiting(a);var s=setTimeout(a,Math.max(0,t-Date.now()))})];case 1:return n.sent(),[2]}})})},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter(function(e){return e!==t}))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach(function(e){return e()})},e.prototype.releaseLock=function(e){return re(this,void 0,void 0,function(){return ie(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},e.prototype.releaseLock__private__=function(t){return re(this,void 0,void 0,function(){var n,o,r,i;return ie(this,function(a){switch(a.label){case 0:return n=void 0===this.storageHandler?ue:this.storageHandler,o=ce+"-"+t,null===(r=n.getItemSync(o))?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,se.default().lock(i.iat)];case 1:a.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),se.default().unlock(i.iat),e.notifyWaiters(),a.label=2;case 2:return[2]}})})},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,r=[],i=0;;){var a=o.keySync(i);if(null===a)break;r.push(a),i++}for(var s=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes(ce)){var l=o.getItemSync(u);if(null!==l){var h=JSON.parse(l);(void 0===h.timeRefreshed&&h.timeAcquired<n||void 0!==h.timeRefreshed&&h.timeRefreshed<n)&&(o.removeItemSync(u),s=!0)}}}s&&e.notifyWaiters()},e.waiters=void 0,e}(),pe=te.default=de;class fe{async runWithLock(e,t,n){const o=new AbortController,r=setTimeout(()=>o.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:o.signal},async e=>{if(clearTimeout(r),!e)throw new Error("Lock not available");return await n()})}catch(e){if(clearTimeout(r),"AbortError"===(null==e?void 0:e.name))throw new K;throw e}}}class me{constructor(){this.activeLocks=new Set,this.lock=new pe,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}async runWithLock(e,t,n){let o=!1;for(let n=0;n<10&&!o;n++)o=await this.lock.acquireLock(e,t);if(!o)throw new K;this.activeLocks.add(e),1===this.activeLocks.size&&"undefined"!=typeof window&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),0===this.activeLocks.size&&"undefined"!=typeof window&&window.removeEventListener("pagehide",this.pagehideHandler)}}}let ye=null;const we=new TextEncoder,ge=new TextDecoder;function ve(e){return"string"==typeof e?we.encode(e):ge.decode(e)}function be(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new Te(`${e.name} modulusLength must be at least 2048 bits`)}let ke;if(Uint8Array.prototype.toBase64)ke=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;ke=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function _e(e){return ke(e)}class Se extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class Te extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function Ee(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new Se("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new Se("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new Se("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new Se("unsupported CryptoKey algorithm name")}}function Pe(e){return e instanceof CryptoKey}function Ae(e){return Pe(e)&&"public"===e.type}async function Re(e,t,n,o,r,i){const a=null==e?void 0:e.privateKey,s=null==e?void 0:e.publicKey;if(!Pe(c=a)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!Ae(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==s.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==r&&"string"!=typeof r)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==i&&("object"!=typeof i||null===i||Array.isArray(i)))throw new TypeError('"additional" must be an object');return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${_e(ve(JSON.stringify(e)))}.${_e(ve(JSON.stringify(t)))}`;return`${o}.${_e(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return be(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return be(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new Se}(n),n,ve(o)))}`}({alg:Ee(a),typ:"dpop+jwt",jwk:await Ce(s)},Object.assign(Object.assign({},i),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:r?_e(await crypto.subtle.digest("SHA-256",ve(r))):void 0}),a)}async function Ce(e){const{kty:t,e:n,n:o,x:r,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:a,e:n,n:o,x:r,y:i}}const Ie="dpop-nonce",xe=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];const Oe=(e,t)=>new Promise(function(n,o){const r=new MessageChannel;r.port1.onmessage=function(e){e.data.error?o(new Error(e.data.error)):n(e.data),r.port1.close()},t.postMessage(e,[r.port2])}),We=(e,t,n)=>{const o=new AbortController;let r;return t.signal=o.signal,Promise.race([fetch(e,t),new Promise((e,t)=>{r=setTimeout(()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))},n)})]).finally(()=>{clearTimeout(r)})},je=async function(e,t,n,o,r,i){let a=arguments.length>6&&void 0!==arguments[6]?arguments[6]:P;return r?(async(e,t,n,o,r,i,a,s,c,u)=>Oe({type:"refresh",auth:{audience:t,scope:n},timeout:r,fetchUrl:e,fetchOptions:o,useFormData:a,useMrrt:s,skipTokenStorage:c,preserveRefreshToken:u},i))(e,t,n,o,a,r,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0,arguments.length>9?arguments[9]:void 0):(async(e,t,n)=>{const o=await We(e,t,n);return{ok:o.ok,json:await o.json(),headers:(r=o.headers,[...r].reduce((e,t)=>{let n=S(t,2),o=n[0],r=n[1];return e[o]=r,e},{}))};var r})(e,o,a)};async function Ue(e,t,n,o,r,i,a,c,u,l,h,d){if(u){const t=await u.generateProof({url:e,method:r.method||"GET",nonce:await u.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:t})}let p,f=null;for(let s=0;s<3;s++)try{p=await je(e,n,o,r,i,a,t,c,h,d),f=null;break}catch(e){f=e}if(f)throw f;const m=p.json,y=m.error,w=m.error_description,g=s(m,["error","error_description"]),v=p,b=v.headers,k=v.ok;let _;if(u&&(_=b[Ie],_&&await u.setNonce(_)),!k){const s=w||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===y)throw new D(y,s,g.mfa_token,g.mfa_requirements);if("missing_refresh_token"===y)throw new z(n,o);if("use_dpop_nonce"===y){if(!u||!_||l)throw new H(_);return Ue(e,t,n,o,r,i,a,c,u,!0,h,d)}throw new O(y||"request_error",s)}return g}async function Ke(e,t,n){var o=e.baseUrl,r=e.timeout,i=e.audience,a=e.scope,c=e.auth0Client,u=e.useFormData,l=e.useMrrt,h=e.dpop,d=e.preserveRefreshToken,p=s(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop","preserveRefreshToken"]);const f="urn:ietf:params:oauth:grant-type:token-exchange"===p.grant_type,m="urn:okta:params:oauth:grant-type:webauthn"===p.grant_type,y="refresh_token"===p.grant_type&&l,w=f||m||y,g=Object.assign(Object.assign(Object.assign({},p),w&&i&&{audience:i}),w&&a&&{scope:a}),v=m||!u,b=v?JSON.stringify(g):B(g),k=(_=p.grant_type,xe.includes(_));var _;return await Ue("".concat(o,"/oauth/token"),r,i||x,a,{method:"POST",body:b,headers:{"Content-Type":v?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(Y(c||C)))}},t,u,l,k?h:void 0,void 0,n,d)}const Le=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return(o=t.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(o))).join(" ");var o},Ne=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e[x]),Le(o,t)},Me="@@auth0spajs@@",De="@@user@@";class ze{constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Me,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const t=S(e.split("::"),4),n=t[0],o=t[1],r=t[2],i=t[3];return new ze({clientId:o,scope:i,audience:r},n)}static fromCacheEntry(e){const t=e.scope,n=e.audience,o=e.client_id;return new ze({scope:t,audience:n,clientId:o})}}class Je{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(Me))}}class He{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class Ze{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||I}async setIdToken(e,t,n){var o;const r=this.getIdTokenCacheKey(e);await this.cache.set(r,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(r))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var r;let i=await this.cache.get(e.toKey()),a=e;if(!i){const t=await this.getCacheKeys();if(!t)return;const r=this.matchExistingCacheKey(e,t);if(r&&(i=await this.cache.get(r),a=ze.fromKey(r)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;const s=await this.nowProvider(),c=Math.floor(s/1e3);return i.expiresAt-t<c?i.body.refresh_token?this.modifiedCachedEntry(i,a):(await this.cache.remove(a.toKey()),void await(null===(r=this.keyManifest)||void 0===r?void 0:r.remove(a.toKey()))):i.body}async modifiedCachedEntry(e,t){const n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},o={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),o),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;const n=new ze({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new ze({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async stripRefreshToken(e){var t;const n=await this.getCacheKeys();if(n)for(const o of n){const n=await this.cache.get(o);(null===(t=null==n?void 0:n.body)||void 0===t?void 0:t.refresh_token)===e&&(delete n.body.refresh_token,await this.cache.set(o,n))}}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter(t=>!e||t.includes(e)).reduce(async(e,t)=>{await e,await this.cache.remove(t)},Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new ze({clientId:e},Me,De).toKey()}matchExistingCacheKey(e,t){return t.filter(t=>{var n;const o=ze.fromKey(t),r=new Set(o.scope&&o.scope.split(" ")),i=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],a=o.scope&&i.reduce((e,t)=>e&&r.has(t),!0);return o.prefix===Me&&o.clientId===e.clientId&&o.audience===e.audience&&a})[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=ze.fromKey(o);if(t.prefix===Me&&t.clientId===e.clientId){const e=await this.cache.get(o);if(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)return{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;const o=await this.getCacheKeys();if(!o)return[];const r=new Set;for(const i of o){const o=ze.fromKey(i);if(o.prefix===Me&&o.clientId===t&&o.audience===e){const e=await this.cache.get(i);(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)&&r.add(e.body.refresh_token)}}return Array.from(r)}async updateEntry(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const r=await this.getCacheKeys();if(r)for(const i of r){if(ze.fromKey(i).clientId!==n)continue;const r=await this.cache.get(i);if(!(null==r?void 0:r.body))continue;const a=r.body.refresh_token;a&&(o||a===e)&&(r.body.refresh_token=t,await this.cache.set(i,r))}}}class Fe{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const Ve=e=>"number"==typeof e,Ge=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var Xe=ee&&ee.__assign||function(){return Xe=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},Xe.apply(this,arguments)};function Ye(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}var Be=function(e){return function(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),a=i.slice(1).join("=");'"'===a.charAt(0)&&(a=a.slice(1,-1));try{t[i[0].replace(o,decodeURIComponent)]=a.replace(o,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e]};function qe(e,t,n){document.cookie=function(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return Ye("Expires",e.expires?e.expires.toUTCString():"")+Ye("Domain",e.domain)+Ye("Path",e.path)+Ye("Secure",e.secure)+Ye("SameSite",e.sameSite)}(n)}(e,t,Xe({path:"/"},n))}var Qe=qe,$e=function(e,t){qe(e,"",Xe(Xe({},t),{expires:-1}))};const et={get(e){const t=Be(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),Qe(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),$e(e,n)}},tt="_legacy_",nt={get:e=>et.get(e)||et.get("".concat(tt).concat(e)),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),Qe("".concat(tt).concat(e),JSON.stringify(t),o),et.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),$e(e,n),et.remove(e,t),et.remove("".concat(tt).concat(e),t)}},ot={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var rt,it=function(e){return rt=rt||function(e,t,n){var o=void 0===t?null:t,r=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),r=0,i=n.length;r<i;++r)o[r]=n.charCodeAt(r);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),i=r.indexOf("\n",10)+1,a=r.substring(i)+(o?"//# sourceMappingURL="+o:""),s=new Blob([a],{type:"application/javascript"});return URL.createObjectURL(s)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxpLGE9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihhLnB1c2goby52YWx1ZSksYS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoaT1yLnJldHVybigpLE9iamVjdChpKSE9PWkpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGF9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGk9e30sYT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PWU9PntPYmplY3QuZW50cmllcyhpKS5mb3JFYWNoKHI9PntsZXQgbz10KHIsMiksbj1vWzBdO29bMV09PT1lJiZkZWxldGUgaVtuXX0pfSxmPWU9Pntjb25zdCB0PW5ldyBVUkxTZWFyY2hQYXJhbXMoZSkscj17fTtyZXR1cm4gdC5mb3JFYWNoKChlLHQpPT57clt0XT1lfSkscn0saD1hc3luYyBlPT57bGV0IHIsbixhPWUuZGF0YSx1PWEudGltZW91dCxoPWEuYXV0aCxkPWEuZmV0Y2hVcmwscD1hLmZldGNoT3B0aW9ucyx5PWEudXNlRm9ybURhdGEsZz1hLnVzZU1ycnQsYj1hLnNraXBUb2tlblN0b3JhZ2UsTz1hLnByZXNlcnZlUmVmcmVzaFRva2VuLGs9dChlLnBvcnRzLDEpWzBdLG09e307Y29uc3Qgaj1ofHx7fSx2PWouYXVkaWVuY2UsXz1qLnNjb3BlO3RyeXtjb25zdCBlPXk/ZihwLmJvZHkpOkpTT04ucGFyc2UocC5ib2R5KTtpZighZS5yZWZyZXNoX3Rva2VuJiYicmVmcmVzaF90b2tlbiI9PT1lLmdyYW50X3R5cGUpe2lmKG49KChlLHQpPT5pW2MoZSx0KV0pKHYsXyksIW4mJmcpe2NvbnN0IGU9aS5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+ISFPYmplY3Qua2V5cyhpKS5maW5kKHI9PntpZigibGF0ZXN0X3JlZnJlc2hfdG9rZW4iIT09cil7Y29uc3Qgbz1sKHQsciksbj1yLnNwbGl0KCJ8IilbMV0uc3BsaXQoIiAiKSxzPWUuc3BsaXQoIiAiKS5ldmVyeShlPT5uLmluY2x1ZGVzKGUpKTtyZXR1cm4gbyYmc319KSkoXyx2KTtlJiYhdCYmKG49ZSl9aWYoIW4pdGhyb3cgbmV3IG8odixfKTtwLmJvZHk9eT9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpfWxldCBhLGg7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGE9bmV3IEFib3J0Q29udHJvbGxlcixwLnNpZ25hbD1hLnNpZ25hbCk7dHJ5e2g9YXdhaXQgUHJvbWlzZS5yYWNlKFsoVT11LG5ldyBQcm9taXNlKGU9PnNldFRpbWVvdXQoZSxVKSkpLGZldGNoKGQsT2JqZWN0LmFzc2lnbih7fSxwKSldKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBrLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighaClyZXR1cm4gYSYmYS5hYm9ydCgpLHZvaWQgay5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZihNPWguaGVhZGVycyxtPVsuLi5NXS5yZWR1Y2UoKGUscik9PntsZXQgbz10KHIsMiksbj1vWzBdLHM9b1sxXTtyZXR1cm4gZVtuXT1zLGV9LHt9KSxyPWF3YWl0IGguanNvbigpLGIpcmV0dXJuIGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4sdm9pZCBrLnBvc3RNZXNzYWdlKHtvazpoLm9rLGpzb246cixoZWFkZXJzOm19KTtyLnJlZnJlc2hfdG9rZW4/KGcmJihpLmxhdGVzdF9yZWZyZXNoX3Rva2VuPXIucmVmcmVzaF90b2tlbix3PW4sUz1yLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMoaSkuZm9yRWFjaChlPT57bGV0IHI9dChlLDIpLG89clswXTtyWzFdPT09dyYmKGlbb109Uyl9KSksKChlLHQscik9PntpW2ModCxyKV09ZX0pKHIucmVmcmVzaF90b2tlbix2LF8pLGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4pOk98fCgoZSx0KT0+e2RlbGV0ZSBpW2MoZSx0KV19KSh2LF8pLGsucG9zdE1lc3NhZ2Uoe29rOmgub2ssanNvbjpyLGhlYWRlcnM6bX0pfWNhdGNoKGUpe2sucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOm19KX12YXIgdyxTLE0sVX0sZD1hc3luYyBlPT57bGV0IHI9ZS5kYXRhLG89ci50aW1lb3V0LG49ci5hdXRoLGE9ci5mZXRjaFVybCxjPXIuZmV0Y2hPcHRpb25zLGg9ci51c2VGb3JtRGF0YSxkPXQoZS5wb3J0cywxKVswXTtjb25zdCBwPShufHx7fSkuYXVkaWVuY2U7dHJ5e2NvbnN0IGU9KGU9Pntjb25zdCByPW5ldyBTZXQ7cmV0dXJuIE9iamVjdC5lbnRyaWVzKGkpLmZvckVhY2gobz0+e2xldCBuPXQobywyKSxzPW5bMF0saT1uWzFdO2woZSxzKSYmci5hZGQoaSl9KSxBcnJheS5mcm9tKHIpfSkocCk7aWYoMD09PWUubGVuZ3RoKXJldHVybiB2b2lkIGQucG9zdE1lc3NhZ2Uoe29rOiEwfSk7Y29uc3Qgcj1oP2YoYy5ib2R5KTpKU09OLnBhcnNlKGMuYm9keSk7Zm9yKGNvbnN0IHQgb2YgZSl7Y29uc3QgZT1oP3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7dG9rZW46dH0pKTtsZXQgbixpLGwsZjsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYobj1uZXcgQWJvcnRDb250cm9sbGVyLGk9bi5zaWduYWwpO3RyeXtmPWF3YWl0IFByb21pc2UucmFjZShbbmV3IFByb21pc2UoZT0+e2w9c2V0VGltZW91dChlLG8pfSksZmV0Y2goYSxPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sYykse2JvZHk6ZSxzaWduYWw6aX0pKV0pLmZpbmFsbHkoKCk9PmNsZWFyVGltZW91dChsKSl9Y2F0Y2goZSl7cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfSl9aWYoIWYpcmV0dXJuIG4mJm4uYWJvcnQoKSx2b2lkIGQucG9zdE1lc3NhZ2Uoe2Vycm9yOiJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCcifSk7aWYoIWYub2spe2xldCBlO3RyeXtjb25zdCB0PUpTT04ucGFyc2UoYXdhaXQgZi50ZXh0KCkpO2U9dC5lcnJvcl9kZXNjcmlwdGlvbn1jYXRjaChlKXt9cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZXx8IkhUVFAgZXJyb3IgIi5jb25jYXQoZi5zdGF0dXMpfSl9dSh0KX1kLnBvc3RNZXNzYWdlKHtvazohMH0pfWNhdGNoKGUpe2QucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZXx8IlVua25vd24gZXJyb3IgZHVyaW5nIHRva2VuIHJldm9jYXRpb24ifSl9fSxwPShlLHQpPT57aWYoIWEpcmV0dXJuITE7dHJ5e2NvbnN0IHI9bmV3IFVSTChhKS5vcmlnaW4sbz1uZXcgVVJMKGUuZmV0Y2hVcmwpO3JldHVybiBvLm9yaWdpbj09PXImJm8ucGF0aG5hbWU9PT10fWNhdGNoKGUpe3JldHVybiExfX07YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsZT0+e2NvbnN0IHI9ZS5kYXRhLG89dChlLnBvcnRzLDEpWzBdO2lmKCEoInR5cGUiaW4gcil8fCJpbml0IiE9PXIudHlwZSlyZXR1cm4idHlwZSJpbiByJiYiY2xlYXIiPT09ci50eXBlPyhpPXt9LHZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITB9KSkpOiJ0eXBlImluIHImJiJyZXZva2UiPT09ci50eXBlP3AociwiL29hdXRoL3Jldm9rZSIpP3ZvaWQgZChlKTp2b2lkKG51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpOnZvaWQoImZldGNoVXJsImluIHImJnAociwiL29hdXRoL3Rva2VuIik/aChlKTpudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjoiaW52YWxpZF9mZXRjaF91cmwiLGVycm9yX2Rlc2NyaXB0aW9uOiJVbmF1dGhvcml6ZWQgZmV0Y2ggVVJMIn0saGVhZGVyczp7fX0pKTtpZihudWxsPT09YSl0cnl7bmV3IFVSTChyLmFsbG93ZWRCYXNlVXJsKSxhPXIuYWxsb3dlZEJhc2VVcmx9Y2F0Y2goZSl7cmV0dXJufX0pfSgpOwoK",null,false),new Worker(rt,e)};class at{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(Me,"::").concat(e)}}const st="auth0.is.authenticated",ct={memory:()=>(new He).enclosedCache,localstorage:()=>new Je},ut=e=>ct[e],lt=e=>{const t=e.openUrl,n=e.onRedirect,o=s(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},ht={NONCE:"nonce",KEYPAIR:"keypair"};class dt{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(ht).forEach(t=>e.result.createObjectStore(t)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)})}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(ht.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(ht.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",e=>e.put(n,t))}findNonce(e){return this.find(ht.NONCE,this.buildKey(e))}findKeyPair(){return this.find(ht.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",e=>e.get(t))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",e=>e.getAllKeys());await Promise.all((null==n?void 0:n.filter(t).map(t=>this.executeDbRequest(e,"readwrite",e=>e.delete(t))))||[])}deleteByClientId(e,t){return this.deleteBy(e,e=>"string"==typeof e&&e.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(ht.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(ht.KEYPAIR,this.clientId)}}class pt{constructor(e){this.storage=new dt(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function(e){let t=e.keyPair,n=e.url,o=e.method,r=e.nonce,i=e.accessToken;const a=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(n);return Re(t,a,o,r,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!Ae(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await Ce(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new Se("unsupported JWK kty")}return _e(await crypto.subtle.digest({name:"SHA-256"},ve(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var ft;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(ft||(ft={}));class mt{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:ft.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);let o,r;"string"==typeof n?(o=this.config.dpopNonceId?ft.DPoP:ft.Bearer,r=n):(o=n.token_type,r=n.access_token),this.setAuthorizationHeader(e,r,o),o===ft.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,Ie);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new H(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const r=this.buildBaseRequest(e,t);await this.prepareRequest(r,o);const i=await this.config.fetch(r);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class yt{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){const e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){const t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),o=await this._handleResponse(n),r=null!==(t=n.headers.get("location"))&&void 0!==t?t:"",i=decodeURIComponent(r.split("/").pop()||"");return Object.assign(Object.assign({},o),{id:i,location:r})}async enrollmentVerify(e){const t=e,n=t.location;t.type;const o=s(t,["location","type"]),r=await this.myAccountFetcher.fetchWithAuth("".concat(n,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},{scope:["create:me:authentication_methods"]});return this._handleResponse(r)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new wt({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new wt(t)}}class wt extends Error{constructor(e){let t=e.type,n=e.status,o=e.title,r=e.detail,i=e.validation_errors;super(r),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=r,this.validation_errors=i,Object.setPrototypeOf(this,wt.prototype)}}const gt={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}};var vt,bt;let kt;if("undefined"==typeof navigator||null===(vt=navigator.userAgent)||void 0===vt||null===(bt=vt.startsWith)||void 0===bt||!bt.call(vt,"Mozilla/5.0 ")){const e="v3.8.6";kt="".concat("oauth4webapi","/").concat(e)}function _t(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}const St="ERR_INVALID_ARG_VALUE",Tt="ERR_INVALID_ARG_TYPE";function Et(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}const Pt=Symbol(),At=Symbol(),Rt=Symbol(),Ct=Symbol(),It=Symbol(),xt=Symbol(),Ot=new TextEncoder,Wt=new TextDecoder;function jt(e){return"string"==typeof e?Ot.encode(e):Wt.decode(e)}let Ut,Kt;if(Uint8Array.prototype.toBase64)Ut=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Ut=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function Lt(e){return"string"==typeof e?Kt(e):Ut(e)}Kt=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw Et("The input to be decoded is not correctly encoded.",St,e)}}:e=>{try{const t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw Et("The input to be decoded is not correctly encoded.",St,e)}};class Nt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=Ln,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class Mt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function Dt(e,t,n){return new Mt(e,{code:t,cause:n})}function zt(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function Jt(e){_t(e,Headers)&&(e=Object.fromEntries(e.entries()));const t=new Headers(null!=e?e:{});if(kt&&!t.has("user-agent")&&t.set("user-agent",kt),t.has("authorization"))throw Et('"options.headers" must not include the "authorization" header name',St);return t}function Ht(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw Et('"options.signal" must return or be an instance of AbortSignal',Tt);return t}}function Zt(e){return e.includes("//")?e.replace("//","/"):e}function Ft(e,t,n,o,r){try{if("number"!=typeof e||!Number.isFinite(e))throw Et("".concat(n," must be a number"),Tt,r);if(e>0)return;if(t){if(0!==e)throw Et("".concat(n," must be a non-negative number"),St,r);return}throw Et("".concat(n," must be a positive number"),St,r)}catch(e){if(o)throw Dt(e.message,o,r);throw e}}function Vt(e,t,n,o){try{if("string"!=typeof e)throw Et("".concat(t," must be a string"),Tt,o);if(0===e.length)throw Et("".concat(t," must not be empty"),St,o)}catch(e){if(n)throw Dt(e.message,n,o);throw e}}function Gt(e){!function(e,t){if(bn(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];if(o.length>2){const e=o.pop();t+="".concat(o.join(", "),", or ").concat(e)}else 2===o.length?t+="".concat(o[0]," or ").concat(o[1]):t+=o[0];return Dt(t,zn,e)}(e,t)}(e,"application/json")}function Xt(){return Lt(crypto.getRandomValues(new Uint8Array(32)))}function Yt(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new Nt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"RSASSA-PKCS1-v1_5":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new Nt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"ECDSA":return function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new Nt("unsupported EcKeyAlgorithm namedCurve",{cause:e})}}(e);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new Nt("unsupported CryptoKey algorithm name",{cause:e})}}function Bt(e){const t=null==e?void 0:e[At];return"number"==typeof t&&Number.isFinite(t)?t:0}function qt(e){const t=null==e?void 0:e[Rt];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function Qt(){return Math.floor(Date.now()/1e3)}function $t(e){if("object"!=typeof e||null===e)throw Et('"as" must be an object',Tt);Vt(e.issuer,'"as.issuer"')}function en(e){if("object"!=typeof e||null===e)throw Et('"client" must be an object',Tt);Vt(e.client_id,'"client.client_id"')}function tn(e){return Vt(e,'"clientSecret"'),(t,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",e)}}function nn(e,t){const n=(i=e)instanceof CryptoKey?{key:i}:(null==i?void 0:i.key)instanceof CryptoKey?(void 0!==i.kid&&Vt(i.kid,'"kid"'),{key:i.key,kid:i.kid}):{},o=n.key,r=n.kid;var i;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw Et("".concat(t," must be a CryptoKey"),Tt)}(e,t),"private"!==e.type)throw Et("".concat(t," must be a private CryptoKey"),St)}(o,'"clientPrivateKey.key"'),async(e,n,i,a)=>{var s;const c={alg:Yt(o),kid:r},u=function(e,t){const n=Qt()+Bt(t);return{jti:Xt(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,n);null==t||null===(s=t[It])||void 0===s||s.call(t,c,u),i.set("client_id",n.client_id),i.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),i.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw Et('CryptoKey instances used for signing assertions must include "sign" in their "usages"',St);const o="".concat(Lt(jt(JSON.stringify(e))),".").concat(Lt(jt(JSON.stringify(t)))),r=Lt(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:$n(e)};case"RSA-PSS":switch(Qn(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new Nt("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return Qn(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new Nt("unsupported CryptoKey algorithm name",{cause:e})}(n),n,jt(o)));return"".concat(o,".").concat(r)}(c,u,o))}}const on=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function rn(e,t){if(t&&"https:"!==e.protocol)throw Dt("only requests to HTTPS are allowed",Hn,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw Dt("only HTTP and HTTPS requests are allowed",Zn,e)}function an(e,t,n,o){let r;if("string"!=typeof e||!(r=on(e)))throw Dt("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?Xn:Yn,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return rn(r,o),r}function sn(e,t,n,o){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?an(e.mtls_endpoint_aliases[t],t,n,o):an(e[t],t,n,o)}class cn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"status",void 0),v(this,"error_description",void 0),v(this,"response",void 0),this.name=this.constructor.name,this.code=Kn,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class un extends Error{constructor(e,t){var n,o;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"error_description",void 0),this.name=this.constructor.name,this.code=Nn,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!==(n=t.cause.get("error_description"))&&void 0!==n?n:void 0,null===(o=Error.captureStackTrace)||void 0===o||o.call(Error,this,this.constructor)}}class ln extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"response",void 0),v(this,"status",void 0),this.name=this.constructor.name,this.code=Un,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}const hn="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",dn="("+hn+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"',pn="("+hn+")\\s*=\\s*("+hn+")",fn=new RegExp("^[,\\s]*("+hn+")"),mn=new RegExp("^[,\\s]*"+dn+"[,\\s]*(.*)"),yn=new RegExp("^[,\\s]*"+pn+"[,\\s]*(.*)"),wn=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function gn(e,t,n){if(e.status!==t){let t;var o;if(function(e){let t;if(t=function(e){if(!_t(e,Response))throw Et('"response" must be an instance of Response',Tt);const t=e.headers.get("www-authenticate");if(null===t)return;const n=[];let o=t;for(;o;){var r;let t=o.match(fn);const c=null===(r=t)||void 0===r?void 0:r[1].toLowerCase();if(!c)return;const u=o.substring(t[0].length);if(u&&!u.match(/^[\s,]/))return;const l=u.match(/^\s+(.*)$/),h=!!l;o=l?l[1]:void 0;const d={};let p;if(h)for(;o;){let n,r;if(t=o.match(mn)){var i=S(t,4);if(n=i[1],r=i[2],o=i[3],r.includes("\\"))try{r=JSON.parse('"'.concat(r,'"'))}catch(e){}d[n.toLowerCase()]=r}else{if(!(t=o.match(yn))){if(t=o.match(wn)){if(Object.keys(d).length)break;var a=S(t,3);p=a[1],o=a[2];break}return}var s=S(t,4);n=s[1],r=s[2],o=s[3],d[n.toLowerCase()]=r}}else o=u||void 0;const f={scheme:c,parameters:d};p&&(f.token68=p),n.push(f)}return n.length?n:void 0}(e))throw new ln("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}(e),t=await async function(e){if(e.status>399&&e.status<500){qn(e),Gt(e);try{const t=await e.clone().json();if(zt(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await(null===(o=e.body)||void 0===o?void 0:o.cancel()),new cn("server responded with an error in the response body",{cause:t,response:e});throw Dt('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),Jn,e)}}function vn(e){if(!Cn.has(e))throw Et('"options.DPoP" is not a valid DPoPHandle',St)}function bn(e){var t;return null===(t=e.headers.get("content-type"))||void 0===t?void 0:t.split(";")[0]}async function kn(e,t,n,o,r,i,a){return await n(e,t,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==a?void 0:a[Ct])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Ht(o,null==a?void 0:a.signal)})}async function _n(e,t,n,o,r,i){var a;const s=sn(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[Pt]));r.set("grant_type",o);const c=Jt(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(vn(i.DPoP),await i.DPoP.addProof(s,c,"POST"));const u=await kn(e,t,n,s,r,c,i);return null==i||null===(a=i.DPoP)||void 0===a||a.cacheNonce(u,s),u}const Sn=new WeakMap,Tn=new WeakMap;function En(e){if(!e.id_token)return;const t=Sn.get(e);if(!t)throw Et('"ref" was already garbage collected or did not resolve from the proper sources',St);return t}async function Pn(e,t,n,o,r,i){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,200,"Token Endpoint"),qn(n);const a=await ro(n);if(Vt(a.access_token,'"response" body "access_token" property',Dn,{body:a}),Vt(a.token_type,'"response" body "token_type" property',Dn,{body:a}),a.token_type=a.token_type.toLowerCase(),void 0!==a.expires_in){let e="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;Ft(e,!0,'"response" body "expires_in" property',Dn,{body:a}),a.expires_in=e}if(void 0!==a.refresh_token&&Vt(a.refresh_token,'"response" body "refresh_token" property',Dn,{body:a}),void 0!==a.scope&&"string"!=typeof a.scope)throw Dt('"response" body "scope" property must be a string',Dn,{body:a});if(void 0!==a.id_token){Vt(a.id_token,'"response" body "id_token" property',Dn,{body:a});const i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(Ft(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=o&&o.length&&i.push(...o);const s=await async function(e,t,n,o,r){let i,a,s=e.split("."),c=s[0],u=s[1],l=s.length;if(5===l){if(void 0===r)throw new Nt("JWE decryption is not configured",{cause:e});var h=(e=await r(e)).split(".");c=h[0],u=h[1],l=h.length}if(3!==l)throw Dt("Invalid JWT",Dn,e);try{i=JSON.parse(jt(Lt(c)))}catch(e){throw Dt("failed to parse JWT Header body as base64url encoded JSON",Mn,e)}if(!zt(i))throw Dt("JWT Header must be a top level object",Dn,e);if(t(i),void 0!==i.crit)throw new Nt('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{a=JSON.parse(jt(Lt(u)))}catch(e){throw Dt("failed to parse JWT Payload body as base64url encoded JSON",Mn,e)}if(!zt(a))throw Dt("JWT Payload must be a top level object",Dn,e);const d=Qt()+n;if(void 0!==a.exp){if("number"!=typeof a.exp)throw Dt('unexpected JWT "exp" (expiration time) claim type',Dn,{claims:a});if(a.exp<=d-o)throw Dt('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',Fn,{claims:a,now:d,tolerance:o,claim:"exp"})}if(void 0!==a.iat&&"number"!=typeof a.iat)throw Dt('unexpected JWT "iat" (issued at) claim type',Dn,{claims:a});if(void 0!==a.iss&&"string"!=typeof a.iss)throw Dt('unexpected JWT "iss" (issuer) claim type',Dn,{claims:a});if(void 0!==a.nbf){if("number"!=typeof a.nbf)throw Dt('unexpected JWT "nbf" (not before) claim type',Dn,{claims:a});if(a.nbf>d+o)throw Dt('unexpected JWT "nbf" (not before) claim value',Fn,{claims:a,now:d,tolerance:o,claim:"nbf"})}if(void 0!==a.aud&&"string"!=typeof a.aud&&!Array.isArray(a.aud))throw Dt('unexpected JWT "aud" (audience) claim type',Dn,{claims:a});return{header:i,claims:a,jwt:e}}(a.id_token,eo.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),Bt(t),qt(t),r).then(On.bind(void 0,i)).then(Rn.bind(void 0,e)).then(An.bind(void 0,t.client_id)),c=s.claims,u=s.jwt;if(Array.isArray(c.aud)&&1!==c.aud.length){if(void 0===c.azp)throw Dt('ID Token "aud" (audience) claim includes additional untrusted audiences',Vn,{claims:c,claim:"aud"});if(c.azp!==t.client_id)throw Dt('unexpected ID Token "azp" (authorized party) claim value',Vn,{expected:t.client_id,claims:c,claim:"azp"})}void 0!==c.auth_time&&Ft(c.auth_time,!0,'ID Token "auth_time" (authentication time)',Dn,{claims:c}),Tn.set(n,u),Sn.set(a,c)}if(void 0!==(null==i?void 0:i[a.token_type]))i[a.token_type](n,a);else if("dpop"!==a.token_type&&"bearer"!==a.token_type)throw new Nt("unsupported `token_type` value",{cause:{body:a}});return a}function An(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw Dt('unexpected JWT "aud" (audience) claim value',Vn,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw Dt('unexpected JWT "aud" (audience) claim value',Vn,{expected:e,claims:t.claims,claim:"aud"});return t}function Rn(e,t){var n,o;const r=null!==(n=null===(o=e[ao])||void 0===o?void 0:o.call(e,t))&&void 0!==n?n:e.issuer;if(t.claims.iss!==r)throw Dt('unexpected JWT "iss" (issuer) claim value',Vn,{expected:r,claims:t.claims,claim:"iss"});return t}const Cn=new WeakSet,In=Symbol(),xn={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function On(e,t){for(const n of e)if(void 0===t.claims[n])throw Dt('JWT "'.concat(n,'" (').concat(xn[n],") claim missing"),Dn,{claims:t.claims});return t}const Wn=Symbol(),jn=Symbol();const Un="OAUTH_WWW_AUTHENTICATE_CHALLENGE",Kn="OAUTH_RESPONSE_BODY_ERROR",Ln="OAUTH_UNSUPPORTED_OPERATION",Nn="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Mn="OAUTH_PARSE_ERROR",Dn="OAUTH_INVALID_RESPONSE",zn="OAUTH_RESPONSE_IS_NOT_JSON",Jn="OAUTH_RESPONSE_IS_NOT_CONFORM",Hn="OAUTH_HTTP_REQUEST_FORBIDDEN",Zn="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",Fn="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",Vn="OAUTH_JWT_CLAIM_COMPARISON_FAILED",Gn="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",Xn="OAUTH_MISSING_SERVER_METADATA",Yn="OAUTH_INVALID_SERVER_METADATA";async function Bn(e){if(!_t(e,Response))throw Et('"response" must be an instance of Response',Tt);await gn(e,200,"Revocation Endpoint")}function qn(e){if(e.bodyUsed)throw Et('"response" body has been used already',St)}function Qn(e){const t=e.algorithm;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new Nt("unsupported ".concat(t.name," modulusLength"),{cause:e})}function $n(e){switch(e.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new Nt("unsupported ECDSA namedCurve",{cause:e})}}function eo(e,t,n,o){if(void 0===e)if(Array.isArray(t)){if(!t.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw Dt('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?o.alg!==n:"function"==typeof n?!n(o.alg):!n.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:n,reason:"default value"})}else if("string"==typeof e?o.alg!==e:!e.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:e,reason:"client configuration"})}function to(e,t){const n=e.getAll(t),o=n[0];if(n.length>1)throw Dt('"'.concat(t,'" parameter must be provided only once'),Dn);return o}const no=Symbol(),oo=Symbol();async function ro(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Gt;try{t=await e.json()}catch(t){throw n(e),Dt('failed to parse "response" body as JSON',Mn,t)}if(!zt(t))throw Dt('"response" body must be a top level object',Dn,{body:t});return t}const io=Symbol(),ao=Symbol(),so=new TextEncoder,co=new TextDecoder;function uo(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.reduce((e,t)=>e+t.length,0),r=new Uint8Array(o);let i=0;for(const e of t)r.set(e,i),i+=e.length;return r}function lo(e){const t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){const o=e.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");t[n]=o}return t}function ho(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);const t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}function po(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64("string"==typeof e?e:co.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=co.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/");try{return ho(t)}catch(e){throw new TypeError("The input to be decoded is not correctly encoded.")}}function fo(e){let t=e;return"string"==typeof t&&(t=so.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:!0}):function(e){if(Uint8Array.prototype.toBase64)return e.toBase64();const t=[];for(let n=0;n<e.length;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join(""))}(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}const mo=function(e){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))},yo=(e,t)=>e.name===t;function wo(e,t){var n;if(n=e.hash,parseInt(n.name.slice(4),10)!==t)throw mo("SHA-".concat(t),"algorithm.hash")}function go(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if((o=o.filter(Boolean)).length>2){const t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");if(null==t)e+=" Received ".concat(t);else if("function"==typeof t&&t.name)e+=" Received function ".concat(t.name);else if("object"==typeof t&&null!=t){var i;null!==(i=t.constructor)&&void 0!==i&&i.name&&(e+=" Received an instance of ".concat(t.constructor.name))}return e}const vo=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return go("Key for the ".concat(e," algorithm must be "),t,...o)};class bo extends Error{constructor(e,t){var n;super(e,t),v(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}v(bo,"code","ERR_JOSE_GENERIC");class ko extends bo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(ko,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class _o extends bo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_EXPIRED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(_o,"code","ERR_JWT_EXPIRED");class So extends bo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}v(So,"code","ERR_JOSE_ALG_NOT_ALLOWED");class To extends bo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_NOT_SUPPORTED")}}v(To,"code","ERR_JOSE_NOT_SUPPORTED"),v(class extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),v(class extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class Eo extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWS_INVALID")}}v(Eo,"code","ERR_JWS_INVALID");class Po extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWT_INVALID")}}v(Po,"code","ERR_JWT_INVALID"),v(class extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Ao extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWKS_INVALID")}}v(Ao,"code","ERR_JWKS_INVALID");class Ro extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}v(Ro,"code","ERR_JWKS_NO_MATCHING_KEY");class Co extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,Symbol.asyncIterator,void 0),v(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}v(Co,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class Io extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_TIMEOUT")}}v(Io,"code","ERR_JWKS_TIMEOUT");class xo extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}v(xo,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const Oo=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}},Wo=e=>"KeyObject"===(null==e?void 0:e[Symbol.toStringTag]),jo=e=>Oo(e)||Wo(e);function Uo(e,t){if(e)throw new TypeError("".concat(t," can only be called once"))}function Ko(e,t,n){try{return po(e)}catch(e){throw new n("Failed to base64url decode the ".concat(t))}}function Lo(e){if("object"!=typeof(t=e)||null===t||"[object Object]"!==Object.prototype.toString.call(e))return!1;var t;if(null===Object.getPrototypeOf(e))return!0;let n=e;for(;null!==Object.getPrototypeOf(n);)n=Object.getPrototypeOf(n);return Object.getPrototypeOf(e)===n}function No(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.filter(Boolean);if(0===o.length||1===o.length)return!0;let r;for(const e of o){const t=Object.keys(e);if(r&&0!==r.size)for(const e of t){if(r.has(e))return!1;r.add(e)}else r=new Set(t)}return!0}const Mo=e=>Lo(e)&&"string"==typeof e.kty;function Do(e,t){if(e.startsWith("RS")||e.startsWith("PS")){const n=t.algorithm.modulusLength;if("number"!=typeof n||n<2048)throw new TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}}function zo(e,t){const n="SHA-".concat(e.slice(-3));switch(e){case"HS256":case"HS384":case"HS512":return{hash:n,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:n,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:n,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:n,name:"ECDSA",namedCurve:t.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:e};default:throw new To("alg ".concat(e," is not supported either by JOSE or your javascript runtime"))}}async function Jo(e,t,n){if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o<t;o++)n[o-1]=arguments[o];return go("Key must be ",e,...n)}(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:"SHA-".concat(e.slice(-3)),name:"HMAC"},!1,[n])}return function(e,t,n){switch(t){case"HS256":case"HS384":case"HS512":if(!yo(e.algorithm,"HMAC"))throw mo("HMAC");wo(e.algorithm,parseInt(t.slice(2),10));break;case"RS256":case"RS384":case"RS512":if(!yo(e.algorithm,"RSASSA-PKCS1-v1_5"))throw mo("RSASSA-PKCS1-v1_5");wo(e.algorithm,parseInt(t.slice(2),10));break;case"PS256":case"PS384":case"PS512":if(!yo(e.algorithm,"RSA-PSS"))throw mo("RSA-PSS");wo(e.algorithm,parseInt(t.slice(2),10));break;case"Ed25519":case"EdDSA":if(!yo(e.algorithm,"Ed25519"))throw mo("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":if(!yo(e.algorithm,t))throw mo(t);break;case"ES256":case"ES384":case"ES512":{if(!yo(e.algorithm,"ECDSA"))throw mo("ECDSA");const n=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}(t);if(e.algorithm.namedCurve!==n)throw mo(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(t,"."))}(e,n)}(t,e,n),t}const Ho='Invalid or unsupported JWK "alg" (Algorithm) Parameter value';async function Zo(e){var t,n;if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const o=function(e){let t,n;switch(e.kty){case"AKP":switch(e.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":t={name:e.alg},n=e.priv?["sign"]:["verify"];break;default:throw new To(Ho)}break;case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(e.alg.slice(-3),10)||1)},n=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new To(Ho)}break;case"EC":switch(e.alg){case"ES256":case"ES384":case"ES512":t={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[e.alg]},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new To(Ho)}break;case"OKP":switch(e.alg){case"Ed25519":case"EdDSA":t={name:"Ed25519"},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new To(Ho)}break;default:throw new To('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:n}}(e),r=o.algorithm,i=o.keyUsages,a=k({},e);return"AKP"!==a.kty&&delete a.alg,delete a.use,crypto.subtle.importKey("jwk",a,r,null!==(t=e.ext)&&void 0!==t?t:!e.d&&!e.priv,null!==(n=e.key_ops)&&void 0!==n?n:i)}const Fo="given KeyObject instance cannot be used for this algorithm";let Vo;const Go=async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];Vo||(Vo=new WeakMap);let r=Vo.get(e);if(null!=r&&r[n])return r[n];const i=await Zo(k(k({},t),{},{alg:n}));return o&&Object.freeze(e),r?r[n]=i:Vo.set(e,{[n]:i}),i};async function Xo(e,t){if(e instanceof Uint8Array)return e;if(Oo(e))return e;if(Wo(e)){if("secret"===e.type)return e.export();if("toCryptoKey"in e&&"function"==typeof e.toCryptoKey)try{return((e,t)=>{Vo||(Vo=new WeakMap);let n=Vo.get(e);if(null!=n&&n[t])return n[t];const o="public"===e.type,r=!!o;let i;if("x25519"===e.asymmetricKeyType){switch(t){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Fo)}i=e.toCryptoKey(e.asymmetricKeyType,r,o?[]:["deriveBits"])}if("ed25519"===e.asymmetricKeyType){if("EdDSA"!==t&&"Ed25519"!==t)throw new TypeError(Fo);i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}switch(e.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError(Fo);i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}if("rsa"===e.asymmetricKeyType){let n;switch(t){case"RSA-OAEP":n="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":n="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":n="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":n="SHA-512";break;default:throw new TypeError(Fo)}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:n},r,o?["encrypt"]:["decrypt"]);i=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:n},r,[o?"verify":"sign"])}if("ec"===e.asymmetricKeyType){var a;const n=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(null===(a=e.asymmetricKeyDetails)||void 0===a?void 0:a.namedCurve);if(!n)throw new TypeError(Fo);const s={ES256:"P-256",ES384:"P-384",ES512:"P-521"};s[t]&&n===s[t]&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:n},r,[o?"verify":"sign"])),t.startsWith("ECDH-ES")&&(i=e.toCryptoKey({name:"ECDH",namedCurve:n},r,o?[]:["deriveBits"]))}if(!i)throw new TypeError(Fo);return n?n[t]=i:Vo.set(e,{[t]:i}),i})(e,t)}catch(e){if(e instanceof TypeError)throw e}let n=e.export({format:"jwk"});return Go(e,n,t)}if(Mo(e))return e.k?po(e.k):Go(e,e,t,!0);throw new Error("unreachable")}const Yo=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},Bo=e=>{const t=e.data[e.pos++];if(128&t){const n=127&t;let o=0;for(let t=0;t<n;t++)o=o<<8|e.data[e.pos++];return o}return t},qo=(e,t,n)=>{if(e.data[e.pos++]!==t)throw new Error(n)},Qo=(e,t)=>{const n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},$o=(e,t,n)=>{var o;const r=(e=>ho(e.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"")))(e);let i=n;return null!=t&&null!==(o=t.startsWith)&&void 0!==o&&o.call(t,"ECDH-ES")&&(i||(i={}),i.getNamedCurve=e=>{const t={data:e,pos:0};return function(e){qo(e,48,"Invalid PKCS#8 structure"),Bo(e),qo(e,2,"Expected version field");const t=Bo(e);e.pos+=t,qo(e,48,"Expected algorithm identifier"),Bo(e),e.pos}(t),(e=>{const t=(e=>{qo(e,6,"Expected algorithm OID");const t=Bo(e);return Qo(e,t)})(e);if(Yo(t,[43,101,110]))return"X25519";if(!Yo(t,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");qo(e,6,"Expected curve OID");const n=Bo(e),o=Qo(e,n);for(const e of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}]){const t=e.name,n=e.oid;if(Yo(o,n))return t}throw new Error("Unsupported named curve")})(t)}),(async(e,t,n,o)=>{var r;let i,a;const s="spki"===e,c=()=>s?["verify"]:["sign"];switch(n){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(n.slice(-3),10)||1)},a=s?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[n]},a=c();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{const e=o.getNamedCurve(t);i="X25519"===e?{name:"X25519"}:{name:"ECDH",namedCurve:e}}catch(e){throw new To("Invalid or unsupported key format")}a=s?[]:["deriveBits"];break;case"Ed25519":case"EdDSA":i={name:"Ed25519"},a=c();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:n},a=c();break;default:throw new To('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(e,t,i,null!==(r=null==o?void 0:o.extractable)&&void 0!==r?r:!!s,a)})("pkcs8",r,t,i)};async function er(e,t,n){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return $o(e,t,n)}function tr(e,t,n,o,r){if(void 0!==r.crit&&void 0===(null==o?void 0:o.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!o||void 0===o.crit)return new Set;if(!Array.isArray(o.crit)||0===o.crit.length||o.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i;i=void 0!==n?new Map([...Object.entries(n),...t.entries()]):t;for(const t of o.crit){if(!i.has(t))throw new To('Extension Header Parameter "'.concat(t,'" is not recognized'));if(void 0===r[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i.get(t)&&void 0===o[t])throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return new Set(o.crit)}const nr=e=>null==e?void 0:e[Symbol.toStringTag],or=(e,t,n)=>{if(void 0!==t.use){let e;switch(n){case"sign":case"verify":e="sig";break;case"encrypt":case"decrypt":e="enc"}if(t.use!==e)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==e)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(e,'" when present'));if(Array.isArray(t.key_ops)){var o,r;let i;switch(!0){case"sign"===n||"verify"===n:case"dir"===e:case e.includes("CBC-HS"):i=n;break;case e.startsWith("PBES2"):i="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(e):i=!e.includes("GCM")&&e.endsWith("KW")?"encrypt"===n?"wrapKey":"unwrapKey":n;break;case"encrypt"===n&&e.startsWith("RSA"):i="wrapKey";break;case"decrypt"===n:i=e.startsWith("RSA")?"unwrapKey":"deriveBits"}if(i&&!1===(null===(o=t.key_ops)||void 0===o||null===(r=o.includes)||void 0===r?void 0:r.call(o,i)))throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(i,'" when present'))}return!0};function rr(e,t,n){switch(e.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((e,t,n)=>{if(!(t instanceof Uint8Array)){if(Mo(t)){if((e=>"oct"===e.kty&&"string"==typeof e.k)(t)&&or(e,t,n))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!jo(t))throw new TypeError(vo(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if("secret"!==t.type)throw new TypeError("".concat(nr(t),' instances for symmetric algorithms must be of type "secret"'))}})(e,t,n);break;default:((e,t,n)=>{if(Mo(t))switch(n){case"decrypt":case"sign":if((e=>"oct"!==e.kty&&("AKP"===e.kty&&"string"==typeof e.priv||"string"==typeof e.d))(t)&&or(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if((e=>"oct"!==e.kty&&void 0===e.d&&void 0===e.priv)(t)&&or(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!jo(t))throw new TypeError(vo(e,t,"CryptoKey","KeyObject","JSON Web Key"));if("secret"===t.type)throw new TypeError("".concat(nr(t),' instances for asymmetric algorithms must not be of type "secret"'));if("public"===t.type)switch(n){case"sign":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm signing must be of type "private"'));case"decrypt":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm decryption must be of type "private"'))}if("private"===t.type)switch(n){case"verify":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm verifying must be of type "public"'));case"encrypt":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm encryption must be of type "public"'))}})(e,t,n)}}var ir,ar;let sr,cr;if("undefined"==typeof navigator||null===(ir=navigator.userAgent)||void 0===ir||null===(ar=ir.startsWith)||void 0===ar||!ar.call(ir,"Mozilla/5.0 ")){const e="v6.8.4";cr="".concat("openid-client","/").concat(e),sr={"user-agent":cr}}const ur=e=>lr.get(e);let lr,hr;function dr(e){return void 0!==e?tn(e):(hr||(hr=new WeakMap),(e,t,n,o)=>{let r;return(r=hr.get(t))||(function(e,t){if("string"!=typeof e)throw yr("".concat(t," must be a string"),mr);if(0===e.length)throw yr("".concat(t," must not be empty"),fr)}(t.client_secret,'"metadata.client_secret"'),r=tn(t.client_secret),hr.set(t,r)),r(e,t,n,o)})}const pr=Ct,fr="ERR_INVALID_ARG_VALUE",mr="ERR_INVALID_ARG_TYPE";function yr(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}class wr extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function gr(e,t,n){return new wr(e,{cause:t,code:n})}function vr(e){if(e instanceof TypeError||e instanceof wr||e instanceof cn||e instanceof un||e instanceof ln)throw e;if(e instanceof Mt)switch(e.code){case Hn:throw gr("only requests to HTTPS are allowed",e,e.code);case Zn:throw gr("only requests to HTTP or HTTPS are allowed",e,e.code);case Jn:throw gr("unexpected HTTP response status code",e.cause,e.code);case zn:throw gr("unexpected response content-type",e.cause,e.code);case Mn:throw gr("parsing error occured",e,e.code);case Dn:throw gr("invalid response encountered",e,e.code);case Vn:throw gr("unexpected JWT claim value encountered",e,e.code);case Gn:throw gr("unexpected JSON attribute value encountered",e,e.code);case Fn:throw gr("JWT timestamp claim value failed validation",e,e.code);default:throw gr(e.message,e,e.code)}if(e instanceof Nt)throw gr("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw gr("runtime operation error",e,Ln);case"NotSupportedError":throw gr("runtime unsupported operation",e,Ln);case"TimeoutError":throw gr("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw gr("operation aborted",e,"OAUTH_ABORT")}throw new wr("something went wrong",{cause:e})}async function br(e,t,n,o,r){const i=await async function(e,t){var n,o;if(!(e instanceof URL))throw yr('"server" must be an instance of URL',mr);const r=!e.href.includes("/.well-known/"),i=null!==(n=null==t?void 0:t.timeout)&&void 0!==n?n:30,a=AbortSignal.timeout(1e3*i),s=await(r?async function(e,t){return async function(e,t,n,o){if(!(e instanceof URL))throw Et('"'.concat("issuerIdentifier",'" must be an instance of URL'),Tt);rn(e,!0!==(null==o?void 0:o[Pt]));const r=n(new URL(e.href)),i=Jt(null==o?void 0:o.headers);return i.set("accept","application/json"),((null==o?void 0:o[Ct])||fetch)(r.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:Ht(r,null==o?void 0:o.signal)})}(e,0,e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":!function(e){e.pathname=Zt("".concat(e.pathname,"/").concat(".well-known/openid-configuration"))}(e);break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=Zt("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw Et('"options.algorithm" must be "oidc" (default), or "oauth2"',St)}return e},t)}(e,{algorithm:null==t?void 0:t.algorithm,[Ct]:null==t?void 0:t[pr],[Pt]:null==t||null===(o=t.execute)||void 0===o?void 0:o.includes(Rr),signal:a,headers:new Headers(sr)}):((null==t?void 0:t[pr])||fetch)((rn(e,null==t||null===(c=t.execute)||void 0===c||!c.includes(Rr)),e.href),{headers:Object.fromEntries(new Headers(k({accept:"application/json"},sr)).entries()),body:void 0,method:"GET",redirect:"manual",signal:a})).then(e=>async function(e,t){const n=e;if(!(n instanceof URL)&&n!==io)throw Et('"expectedIssuerIdentifier" must be an instance of URL',Tt);if(!_t(t,Response))throw Et('"response" must be an instance of Response',Tt);if(200!==t.status)throw Dt('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Jn,t);qn(t);const o=await ro(t);if(Vt(o.issuer,'"response" body "issuer" property',Dn,{body:o}),n!==io&&new URL(o.issuer).href!==n.href)throw Dt('"response" body "issuer" property does not match the expected value',Gn,{expected:n.href,body:o,attribute:"issuer"});return o}(io,e)).catch(vr);var c;return r&&new URL(s.issuer).href!==e.href&&(function(e,t,n){return!("https://login.microsoftonline.com"!==e.origin||null!=n&&n.algorithm&&"oidc"!==n.algorithm||(t[kr]=!0,0))}(e,s,t)||function(e,t){return!(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)}(e,t)||(()=>{throw new wr("discovered metadata issuer does not match the expected issuer",{code:Gn,cause:{expected:e.href,body:s,attribute:"issuer"}})})()),s}(e,r),a=new _r(i,t,n,o);let s=ur(a);if(null!=r&&r[pr]&&(s.fetch=r[pr]),null!=r&&r.timeout&&(s.timeout=r.timeout),null!=r&&r.execute)for(const e of r.execute)e(a);return a}new TextDecoder;const kr=Symbol();class _r{constructor(e,t,n,o){var r,i,a,s,c;if("string"!=typeof t||!t.length)throw yr('"clientId" must be a non-empty string',mr);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null===(r=n)||void 0===r?void 0:r.client_id)&&t!==n.client_id)throw yr('"clientId" and "metadata.client_id" must be the same',fr);const u=k(k({},structuredClone(n)),{},{client_id:t});let l;u[At]=null!==(i=null===(a=n)||void 0===a?void 0:a[At])&&void 0!==i?i:0,u[Rt]=null!==(s=null===(c=n)||void 0===c?void 0:c[Rt])&&void 0!==s?s:30,l=o||("string"==typeof u.client_secret&&u.client_secret.length?dr(u.client_secret):(e,t,n,o)=>{n.set("client_id",t.client_id)});let h=Object.freeze(u);const d=structuredClone(e);kr in e&&(d[ao]=t=>{let n=t.claims.tid;return e.issuer.replace("{tenantid}",n)});let p=Object.freeze(d);lr||(lr=new WeakMap),lr.set(this,{__proto__:null,as:p,c:h,auth:l,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(ur(this).as);return function(e){Object.defineProperties(e,function(e){return{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null===(t=e.code_challenge_methods_supported)||void 0===t?void 0:t.includes(n))}}}}(e))}(e),e}clientMetadata(){return structuredClone(ur(this).c)}get timeout(){return ur(this).timeout}set timeout(e){ur(this).timeout=e}get[pr](){return ur(this).fetch}set[pr](e){ur(this).fetch=e}}function Sr(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return En(this)}catch(e){return}}}}}(e))}async function Tr(e,t,n){var o;let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const i=null===(o=e.headers.get("retry-after"))||void 0===o?void 0:o.trim();if(void 0===i)return;let a;if(/^\d+$/.test(i))a=parseInt(i,10);else{const e=new Date(i);if(Number.isFinite(e.getTime())){const t=new Date,n=e.getTime()-t.getTime();n>0&&(a=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(a))throw new Mt("invalid Retry-After header value",{cause:e});a>t&&await Er(a-t,n)}function Er(e,t){return new Promise((n,o)=>{const r=e=>{try{t.throwIfAborted()}catch(e){return void o(e)}if(e<=0)return void n();const i=Math.min(e,5);setTimeout(()=>r(e-i),1e3*i)};r(e)})}async function Pr(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=n.auth,a=n.fetch,s=n.tlsOnly,c=n.timeout;return async function(e,t,n,o,r){$t(e),en(t);const i=sn(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),a=new URLSearchParams(o);a.set("client_id",t.client_id);const s=Jt(null==r?void 0:r.headers);return s.set("accept","application/json"),kn(e,t,n,i,a,s,r)}(o,r,i,t,{[Ct]:a,[Pt]:!s,headers:new Headers(sr),signal:Ur(c)}).then(e=>async function(e,t,n){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,200,"Backchannel Authentication Endpoint"),qn(n);const o=await ro(n);Vt(o.auth_req_id,'"response" body "auth_req_id" property',Dn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Ft(r,!0,'"response" body "expires_in" property',Dn,{body:o}),o.expires_in=r,void 0!==o.interval&&Ft(o.interval,!1,'"response" body "interval" property',Dn,{body:o}),o}(o,r,e)).catch(vr)}async function Ar(e,t,n,o){var r,i;jr(e),n=new URLSearchParams(n);let a=null!==(r=t.interval)&&void 0!==r?r:5;const s=null!==(i=null==o?void 0:o.signal)&&void 0!==i?i:AbortSignal.timeout(1e3*t.expires_in);try{await Er(a,s)}catch(e){vr(e)}const c=ur(e),u=c.as,l=c.c,h=c.auth,d=c.fetch,p=c.tlsOnly,f=c.nonRepudiation,m=c.timeout,y=c.decrypt,w=(r,i)=>Ar(e,k(k({},t),{},{interval:r}),n,k(k({},o),{},{signal:s,flag:i})),g=function(e,t){const n=Ur(t);if(!n)return{signal:e,cleanup(){}};const o=new AbortController,r=e=>{const t=e.target;o.abort(t.reason)};return e.aborted?o.abort(e.reason):n.aborted?o.abort(n.reason):(e.addEventListener("abort",r,{once:!0}),n.addEventListener("abort",r,{once:!0})),{signal:o.signal,cleanup(){e.removeEventListener("abort",r),n.removeEventListener("abort",r)}}}(s,m),v=await async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"authReqId"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("auth_req_id",o),_n(e,t,n,"urn:openid:params:grant-type:ciba",i,r)}(u,l,h,t.auth_req_id,{[Ct]:d,[Pt]:!p,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:g.signal}).catch(vr).finally(g.cleanup);var b;if(503===v.status&&v.headers.has("retry-after"))return await Tr(v,a,s,!0),await(null===(b=v.body)||void 0===b?void 0:b.cancel()),w(a);const _=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(u,l,v,{[xt]:y});let S;try{S=await _}catch(e){if(Kr(e,o))return w(a,Lr);if(e instanceof cn)switch(e.error){case"slow_down":a+=5;case"authorization_pending":return await Tr(e.response,a,s),w(a)}vr(e)}return S.id_token&&await(null==f?void 0:f(v)),Sr(S),S}function Rr(e){ur(e).tlsOnly=!1}async function Cr(e,t,n,o,r){if(jr(e),!((null==r?void 0:r.flag)===Lr||t instanceof URL||function(e){try{return"Request"===Object.getPrototypeOf(e)[Symbol.toStringTag]}catch(e){return!1}}(t)))throw yr('"currentUrl" must be an instance of URL, or Request',mr);let i,a;const s=ur(e),c=s.as,u=s.c,l=s.auth,h=s.fetch,d=s.tlsOnly,p=s.jarm,f=s.hybrid,m=s.nonRepudiation,y=s.timeout,w=s.decrypt,g=s.implicit;if((null==r?void 0:r.flag)===Lr)i=r.authResponse,a=r.redirectUri;else{if(!(t instanceof URL)){const e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":const n=new URLSearchParams(await async function(e){if("POST"!==e.method)throw Et("form_post responses are expected to use the POST method",St,{cause:e});if("application/x-www-form-urlencoded"!==bn(e))throw Et("form_post responses are expected to use the application/x-www-form-urlencoded content-type",St,{cause:e});return async function(e){if(e.bodyUsed)throw Et("form_post Request instances must contain a readable body",St,{cause:e});return e.text()}(e)}(e));if(f)t.hash=n.toString();else for(const e of n.entries()){var v=S(e,2);const n=v[0],o=v[1];t.searchParams.append(n,o)}break;default:throw yr("unexpected Request HTTP method",fr)}}switch(a=function(e){return(e=new URL(e)).search="",e.hash="",e.href}(t),!0){case!!p:i=await p(t,null==n?void 0:n.expectedState);break;case!!f:i=await f(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!g:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,o){if($t(e),en(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw Et('"parameters" must be an instance of URLSearchParams, or URL',Tt);if(to(n,"response"))throw Dt('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',Dn,{parameters:n});const r=to(n,"iss"),i=to(n,"state");if(!r&&e.authorization_response_iss_parameter_supported)throw Dt('response parameter "iss" (issuer) missing',Dn,{parameters:n});if(r&&r!==e.issuer)throw Dt('unexpected "iss" (issuer) response parameter value',Dn,{expected:e.issuer,parameters:n});switch(o){case void 0:case oo:if(void 0!==i)throw Dt('unexpected "state" response parameter encountered',Dn,{expected:void 0,parameters:n});break;case no:break;default:if(Vt(o,'"expectedState" argument'),i!==o)throw Dt(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',Dn,{expected:o,parameters:n})}if(to(n,"error"))throw new un("authorization response from the server is an error",{cause:n});const a=to(n,"id_token"),s=to(n,"token");if(void 0!==a||void 0!==s)throw new Nt("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),Cn.add(c),c;var c}(c,u,t.searchParams,null==n?void 0:n.expectedState)}catch(e){vr(e)}}}const b=await async function(e,t,n,o,r,i,a){if($t(e),en(t),!Cn.has(o))throw Et('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',St);Vt(r,'"redirectUri"');const s=to(o,"code");if(!s)throw Dt('no authorization code in "callbackParameters"',Dn);const c=new URLSearchParams(null==a?void 0:a.additionalParameters);return c.set("redirect_uri",r),c.set("code",s),i!==In&&(Vt(i,'"codeVerifier"'),c.set("code_verifier",i)),_n(e,t,n,"authorization_code",c,a)}(c,u,l,i,a,(null==n?void 0:n.pkceCodeVerifier)||In,{additionalParameters:o,[Ct]:h,[Pt]:!d,DPoP:null==r?void 0:r.DPoP,headers:new Headers(sr),signal:Ur(y)}).catch(vr);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);const _=async function(e,t,n,o){return"string"==typeof(null==o?void 0:o.expectedNonce)||"number"==typeof(null==o?void 0:o.maxAge)||null!=o&&o.requireIdToken?async function(e,t,n,o,r,i,a){const s=[];switch(o){case void 0:o=Wn;break;case Wn:break;default:Vt(o,'"expectedNonce" argument'),s.push("nonce")}switch(null!=r||(r=t.default_max_age),r){case void 0:r=jn;break;case jn:break;default:Ft(r,!0,'"maxAge" argument'),s.push("auth_time")}const c=await Pn(e,t,n,s,i,a);Vt(c.id_token,'"response" body "id_token" property',Dn,{body:c});const u=En(c);if(r!==jn){const e=Qt()+Bt(t),n=qt(t);if(u.auth_time+r<e-n)throw Dt("too much time has elapsed since the last End-User authentication",Fn,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(o===Wn){if(void 0!==u.nonce)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==o)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:o,claims:u,claim:"nonce"});return c}(e,t,n,o.expectedNonce,o.maxAge,o[xt],o.recognizedTokenTypes):async function(e,t,n,o,r){const i=await Pn(e,t,n,void 0,o,r),a=En(i);if(a){if(void 0!==t.default_max_age){Ft(t.default_max_age,!0,'"client.default_max_age"');const e=Qt()+Bt(t),n=qt(t);if(a.auth_time+t.default_max_age<e-n)throw Dt("too much time has elapsed since the last End-User authentication",Fn,{claims:a,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==a.nonce)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:void 0,claims:a,claim:"nonce"})}return i}(e,t,n,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(c,u,b,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[xt]:w});let T;try{T=await _}catch(t){if(Kr(t,r))return Cr(e,void 0,n,o,k(k({},r),{},{flag:Lr,authResponse:i,redirectUri:a}));vr(t)}return T.id_token&&await(null==m?void 0:m(b)),Sr(T),T}async function Ir(e,t,n,o){jr(e),n=new URLSearchParams(n);const r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.nonRepudiation,h=r.timeout,d=r.decrypt,p=await async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"refreshToken"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("refresh_token",o),_n(e,t,n,"refresh_token",i,r)}(i,a,s,t,{[Ct]:c,[Pt]:!u,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:Ur(h)}).catch(vr),f=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(i,a,p,{[xt]:d});let m;try{m=await f}catch(r){if(Kr(r,o))return Ir(e,t,n,k(k({},o),{},{flag:Lr}));vr(r)}return m.id_token&&await(null==l?void 0:l(p)),Sr(m),m}async function xr(e,t,n){jr(e),t=new URLSearchParams(t);const o=ur(e),r=o.as,i=o.c,a=o.auth,s=o.fetch,c=o.tlsOnly,u=o.timeout,l=await async function(e,t,n,o,r){return $t(e),en(t),_n(e,t,n,"client_credentials",new URLSearchParams(o),r)}(r,i,a,t,{[Ct]:s,[Pt]:!c,DPoP:null==n?void 0:n.DPoP,headers:new Headers(sr),signal:Ur(u)}).catch(vr),h=async function(e,t,n){return Pn(e,t,n,void 0,void 0,void 0)}(r,i,l);let d;try{d=await h}catch(o){if(Kr(o,n))return xr(e,t,k(k({},n),{},{flag:Lr}));vr(o)}return Sr(d),d}function Or(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=n.tlsOnly,a=n.hybrid,s=n.jarm,c=n.implicit,u=sn(o,"authorization_endpoint",!1,i);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",a?"code id_token":c?"id_token":"code"),c&&!t.has("nonce"))throw yr("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",fr);s&&t.set("response_mode","jwt")}for(const e of t.entries()){var l=S(e,2);const t=l[0],n=l[1];u.searchParams.append(t,n)}return u}async function Wr(e,t,n){jr(e);const o=Or(e,t),r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,h=await async function(e,t,n,o,r){var i;$t(e),en(t);const a=sn(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),s=new URLSearchParams(o);s.set("client_id",t.client_id);const c=Jt(null==r?void 0:r.headers);c.set("accept","application/json"),void 0!==(null==r?void 0:r.DPoP)&&(vn(r.DPoP),await r.DPoP.addProof(a,c,"POST"));const u=await kn(e,t,n,a,s,c,r);return null==r||null===(i=r.DPoP)||void 0===i||i.cacheNonce(u,a),u}(i,a,s,o.searchParams,{[Ct]:c,[Pt]:!u,DPoP:null==n?void 0:n.DPoP,headers:new Headers(sr),signal:Ur(l)}).catch(vr),d=async function(e,t,n){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,201,"Pushed Authorization Request Endpoint"),qn(n);const o=await ro(n);Vt(o.request_uri,'"response" body "request_uri" property',Dn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Ft(r,!0,'"response" body "expires_in" property',Dn,{body:o}),o.expires_in=r,o}(i,a,h);let p;try{p=await d}catch(o){if(Kr(o,n))return Wr(e,t,k(k({},n),{},{flag:Lr}));vr(o)}return Or(e,{request_uri:p.request_uri})}function jr(e){if(!(e instanceof _r))throw yr('"config" must be an instance of Configuration',mr);if(Object.getPrototypeOf(e)!==_r.prototype)throw yr("subclassing Configuration is not allowed",fr)}function Ur(e){return e?AbortSignal.timeout(1e3*e):void 0}function Kr(e,t){return!(null==t||!t.DPoP||t.flag===Lr)&&function(e){if(e instanceof ln){const t=e.cause,n=t[0];return 1===t.length&&"dpop"===n.scheme&&"use_dpop_nonce"===n.parameters.error}return e instanceof cn&&"use_dpop_nonce"===e.error}(e)}Object.freeze(_r.prototype);const Lr=Symbol();async function Nr(e,t,n,o){jr(e);const r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,h=r.decrypt,d=r.nonRepudiation,p=await async function(e,t,n,o,r,i){return $t(e),en(t),Vt(o,'"grantType"'),_n(e,t,n,o,new URLSearchParams(r),i)}(i,a,s,t,new URLSearchParams(n),{[Ct]:c,[Pt]:!u,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:Ur(l)}).catch(vr);let f;"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(f={n_a:()=>{}});const m=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(i,a,p,{[xt]:h,recognizedTokenTypes:f});let y;try{y=await m}catch(r){if(Kr(r,o))return Nr(e,t,n,k(k({},o),{},{flag:Lr}));vr(r)}return y.id_token&&await(null==d?void 0:d(p)),Sr(y),y}const Mr=e=>Math.floor(e.getTime()/1e3),Dr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function zr(e){const t=Dr.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");const n=parseFloat(t[2]);let o;switch(t[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":o=Math.round(n);break;case"minute":case"minutes":case"min":case"mins":case"m":o=Math.round(60*n);break;case"hour":case"hours":case"hr":case"hrs":case"h":o=Math.round(3600*n);break;case"day":case"days":case"d":o=Math.round(86400*n);break;case"week":case"weeks":case"w":o=Math.round(604800*n);break;default:o=Math.round(31557600*n)}return"-"===t[1]||"ago"===t[4]?-o:o}function Jr(e,t){if(!Number.isFinite(t))throw new TypeError("Invalid ".concat(e," input"));return t}const Hr=e=>e.includes("/")?e.toLowerCase():"application/".concat(e.toLowerCase());function Zr(e,t){let n,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{n=JSON.parse(co.decode(t))}catch(e){}if(!Lo(n))throw new Po("JWT Claims Set must be a top-level JSON object");const r=o.typ;if(r&&("string"!=typeof e.typ||Hr(e.typ)!==Hr(r)))throw new ko('unexpected "typ" JWT header value',n,"typ","check_failed");const i=o.requiredClaims,a=void 0===i?[]:i,s=o.issuer,c=o.subject,u=o.audience,l=o.maxTokenAge,h=[...a];void 0!==l&&h.push("iat"),void 0!==u&&h.push("aud"),void 0!==c&&h.push("sub"),void 0!==s&&h.push("iss");for(const e of new Set(h.reverse()))if(!(e in n))throw new ko('missing required "'.concat(e,'" claim'),n,e,"missing");if(s&&!(Array.isArray(s)?s:[s]).includes(n.iss))throw new ko('unexpected "iss" claim value',n,"iss","check_failed");if(c&&n.sub!==c)throw new ko('unexpected "sub" claim value',n,"sub","check_failed");if(u&&(p="string"==typeof u?[u]:u,!("string"==typeof(d=n.aud)?p.includes(d):Array.isArray(d)&&p.some(Set.prototype.has.bind(new Set(d))))))throw new ko('unexpected "aud" claim value',n,"aud","check_failed");var d,p;let f;switch(typeof o.clockTolerance){case"string":f=zr(o.clockTolerance);break;case"number":f=o.clockTolerance;break;case"undefined":f=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const m=o.currentDate,y=Mr(m||new Date);if((void 0!==n.iat||l)&&"number"!=typeof n.iat)throw new ko('"iat" claim must be a number',n,"iat","invalid");if(void 0!==n.nbf){if("number"!=typeof n.nbf)throw new ko('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>y+f)throw new ko('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(void 0!==n.exp){if("number"!=typeof n.exp)throw new ko('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=y-f)throw new _o('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){const e=y-n.iat;if(e-f>("number"==typeof l?l:zr(l)))throw new _o('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(e<0-f)throw new ko('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var Fr=new WeakMap;class Vr{constructor(e){if(y(this,Fr,void 0),!Lo(e))throw new TypeError("JWT Claims Set MUST be an object");w(Fr,this,structuredClone(e))}data(){return so.encode(JSON.stringify(m(Fr,this)))}get iss(){return m(Fr,this).iss}set iss(e){m(Fr,this).iss=e}get sub(){return m(Fr,this).sub}set sub(e){m(Fr,this).sub=e}get aud(){return m(Fr,this).aud}set aud(e){m(Fr,this).aud=e}set jti(e){m(Fr,this).jti=e}set nbf(e){"number"==typeof e?m(Fr,this).nbf=Jr("setNotBefore",e):e instanceof Date?m(Fr,this).nbf=Jr("setNotBefore",Mr(e)):m(Fr,this).nbf=Mr(new Date)+zr(e)}set exp(e){"number"==typeof e?m(Fr,this).exp=Jr("setExpirationTime",e):e instanceof Date?m(Fr,this).exp=Jr("setExpirationTime",Mr(e)):m(Fr,this).exp=Mr(new Date)+zr(e)}set iat(e){void 0===e?m(Fr,this).iat=Mr(new Date):e instanceof Date?m(Fr,this).iat=Jr("setIssuedAt",Mr(e)):m(Fr,this).iat=Jr("setIssuedAt","string"==typeof e?Mr(new Date)+zr(e):e)}}async function Gr(e,t,n){var o;const r=await async function(e,t,n){if(e instanceof Uint8Array&&(e=co.decode(e)),"string"!=typeof e)throw new Eo("Compact JWS must be a string or Uint8Array");const o=e.split("."),r=o[0],i=o[1],a=o[2];if(3!==o.length)throw new Eo("Invalid Compact JWS");const s=await async function(e,t,n){if(!Lo(e))throw new Eo("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new Eo('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new Eo("JWS Protected Header incorrect type");if(void 0===e.payload)throw new Eo("JWS Payload missing");if("string"!=typeof e.signature)throw new Eo("JWS Signature missing or incorrect type");if(void 0!==e.header&&!Lo(e.header))throw new Eo("JWS Unprotected Header incorrect type");let o={};if(e.protected)try{const t=po(e.protected);o=JSON.parse(co.decode(t))}catch(e){throw new Eo("JWS Protected Header is invalid")}if(!No(o,e.header))throw new Eo("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const r=k(k({},o),e.header);let i=!0;if(tr(Eo,new Map([["b64",!0]]),null==n?void 0:n.crit,o,r).has("b64")&&(i=o.b64,"boolean"!=typeof i))throw new Eo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const a=r.alg;if("string"!=typeof a||!a)throw new Eo('JWS "alg" (Algorithm) Header Parameter missing or invalid');const s=n&&function(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw new TypeError('"'.concat("algorithms",'" option must be an array of strings'));if(t)return new Set(t)}(0,n.algorithms);if(s&&!s.has(a))throw new So('"alg" (Algorithm) Header Parameter value not allowed');if(i){if("string"!=typeof e.payload)throw new Eo("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new Eo("JWS Payload must be a string or an Uint8Array instance");let c=!1;"function"==typeof t&&(t=await t(o,e),c=!0),rr(a,t,"verify");const u=uo(void 0!==e.protected?lo(e.protected):new Uint8Array,lo("."),"string"==typeof e.payload?i?lo(e.payload):so.encode(e.payload):e.payload),l=Ko(e.signature,"signature",Eo),h=await Xo(t,a),d=await async function(e,t,n,o){const r=await Jo(e,t,"verify");Do(e,r);const i=zo(e,r.algorithm);try{return await crypto.subtle.verify(i,r,n,o)}catch(e){return!1}}(a,h,l,u);if(!d)throw new xo;let p;p=i?Ko(e.payload,"payload",Eo):"string"==typeof e.payload?so.encode(e.payload):e.payload;const f={payload:p};return void 0!==e.protected&&(f.protectedHeader=o),void 0!==e.header&&(f.unprotectedHeader=e.header),c?k(k({},f),{},{key:h}):f}({payload:i,protected:r,signature:a},t,n),c={payload:s.payload,protectedHeader:s.protectedHeader};return"function"==typeof t?k(k({},c),{},{key:s.key}):c}(e,t,n);if(null!==(o=r.protectedHeader.crit)&&void 0!==o&&o.includes("b64")&&!1===r.protectedHeader.b64)throw new Po("JWTs MUST NOT use unencoded payload");const i={payload:Zr(r.protectedHeader,r.payload,n),protectedHeader:r.protectedHeader};return"function"==typeof t?k(k({},i),{},{key:r.key}):i}var Xr=new WeakMap,Yr=new WeakMap,Br=new WeakMap;class qr{constructor(e){if(y(this,Xr,void 0),y(this,Yr,void 0),y(this,Br,void 0),!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");w(Xr,this,e)}setProtectedHeader(e){return Uo(m(Yr,this),"setProtectedHeader"),w(Yr,this,e),this}setUnprotectedHeader(e){return Uo(m(Br,this),"setUnprotectedHeader"),w(Br,this,e),this}async sign(e,t){if(!m(Yr,this)&&!m(Br,this))throw new Eo("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!No(m(Yr,this),m(Br,this)))throw new Eo("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const n=k(k({},m(Yr,this)),m(Br,this));let o=!0;if(tr(Eo,new Map([["b64",!0]]),null==t?void 0:t.crit,m(Yr,this),n).has("b64")&&(o=m(Yr,this).b64,"boolean"!=typeof o))throw new Eo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const r=n.alg;if("string"!=typeof r||!r)throw new Eo('JWS "alg" (Algorithm) Header Parameter missing or invalid');let i,a,s,c;rr(r,e,"sign"),o?(i=fo(m(Xr,this)),a=lo(i)):(a=m(Xr,this),i=""),m(Yr,this)?(s=fo(JSON.stringify(m(Yr,this))),c=lo(s)):(s="",c=new Uint8Array);const u=uo(c,lo("."),a),l=await Xo(e,r),h=await async function(e,t,n){const o=await Jo(e,t,"sign");Do(e,o);const r=await crypto.subtle.sign(zo(e,o.algorithm),o,n);return new Uint8Array(r)}(r,l,u),d={signature:fo(h),payload:i};return m(Br,this)&&(d.header=m(Br,this)),m(Yr,this)&&(d.protected=s),d}}var Qr=new WeakMap;class $r{constructor(e){y(this,Qr,void 0),w(Qr,this,new qr(e))}setProtectedHeader(e){return m(Qr,this).setProtectedHeader(e),this}async sign(e,t){const n=await m(Qr,this).sign(e,t);if(void 0===n.payload)throw new TypeError("use the flattened module for creating JWS with b64: false");return"".concat(n.protected,".").concat(n.payload,".").concat(n.signature)}}var ei=new WeakMap,ti=new WeakMap;class ni{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};y(this,ei,void 0),y(this,ti,void 0),w(ti,this,new Vr(e))}setIssuer(e){return m(ti,this).iss=e,this}setSubject(e){return m(ti,this).sub=e,this}setAudience(e){return m(ti,this).aud=e,this}setJti(e){return m(ti,this).jti=e,this}setNotBefore(e){return m(ti,this).nbf=e,this}setExpirationTime(e){return m(ti,this).exp=e,this}setIssuedAt(e){return m(ti,this).iat=e,this}setProtectedHeader(e){return w(ei,this,e),this}async sign(e,t){var n;const o=new $r(m(ti,this).data());if(o.setProtectedHeader(m(ei,this)),Array.isArray(null===(n=m(ei,this))||void 0===n?void 0:n.crit)&&m(ei,this).crit.includes("b64")&&!1===m(ei,this).b64)throw new Po("JWTs MUST NOT use unencoded payload");return o.sign(e,t)}}function oi(e){return Lo(e)}var ri,ii,ai=new WeakMap,si=new WeakMap;class ci{constructor(e){if(y(this,ai,void 0),y(this,si,new WeakMap),!function(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(oi)}(e))throw new Ao("JSON Web Key Set malformed");w(ai,this,structuredClone(e))}jwks(){return m(ai,this)}async getKey(e,t){const n=k(k({},e),null==t?void 0:t.header),o=n.alg,r=n.kid,i=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new To('Unsupported "alg" value for a JSON Web Key Set')}}(o),a=m(ai,this).keys.filter(e=>{let t=i===e.kty;if(t&&"string"==typeof r&&(t=r===e.kid),!t||"string"!=typeof e.alg&&"AKP"!==i||(t=o===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t)switch(o){case"ES256":t="P-256"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv;break;case"Ed25519":case"EdDSA":t="Ed25519"===e.crv}return t}),s=a[0],c=a.length;if(0===c)throw new Ro;if(1!==c){const e=new Co,t=m(si,this);throw e[Symbol.asyncIterator]=function(e){return function(){return new T(e.apply(this,arguments))}}(function*(){for(const e of a)try{yield yield p(ui(t,e,o))}catch(e){}}),e}return ui(m(si,this),s,o)}}async function ui(e,t,n){const o=e.get(t)||e.set(t,{}).get(t);if(void 0===o[n]){const e=await async function(e,t){if(!Lo(e))throw new TypeError("JWK must be an object");let n;switch(null!=t||(t=e.alg),null!=n||(n=e.ext),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw new TypeError('missing "k" (Key Value) Parameter value');return po(e.k);case"RSA":if("oth"in e&&void 0!==e.oth)throw new To('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Zo(k(k({},e),{},{alg:t,ext:n}));case"AKP":if("string"!=typeof e.alg||!e.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(void 0!==t&&t!==e.alg)throw new TypeError("JWK alg and alg option value mismatch");return Zo(k(k({},e),{},{ext:n}));case"EC":case"OKP":return Zo(k(k({},e),{},{alg:t,ext:n}));default:throw new To('Unsupported "kty" (Key Type) Parameter value')}}(k(k({},t),{},{ext:!0}),n);if(e instanceof Uint8Array||"public"!==e.type)throw new Ao("JSON Web Key Set members must be public keys");o[n]=e}return o[n]}function li(e){const t=new ci(e),n=async(e,n)=>t.getKey(e,n);return Object.defineProperties(n,{jwks:{value:()=>structuredClone(t.jwks()),enumerable:!1,configurable:!1,writable:!1}}),n}let hi;if("undefined"==typeof navigator||null===(ri=navigator.userAgent)||void 0===ri||null===(ii=ri.startsWith)||void 0===ii||!ii.call(ri,"Mozilla/5.0 ")){const e="v6.2.3";hi="".concat("jose","/").concat(e)}const di=Symbol(),pi=Symbol();var fi=new WeakMap,mi=new WeakMap,yi=new WeakMap,wi=new WeakMap,gi=new WeakMap,vi=new WeakMap,bi=new WeakMap,ki=new WeakMap,_i=new WeakMap,Si=new WeakMap;class Ti{constructor(e,t){if(y(this,fi,void 0),y(this,mi,void 0),y(this,yi,void 0),y(this,wi,void 0),y(this,gi,void 0),y(this,vi,void 0),y(this,bi,void 0),y(this,ki,void 0),y(this,_i,void 0),y(this,Si,void 0),!(e instanceof URL))throw new TypeError("url must be an instance of URL");var n,o;w(fi,this,new URL(e.href)),w(mi,this,"number"==typeof(null==t?void 0:t.timeoutDuration)?null==t?void 0:t.timeoutDuration:5e3),w(yi,this,"number"==typeof(null==t?void 0:t.cooldownDuration)?null==t?void 0:t.cooldownDuration:3e4),w(wi,this,"number"==typeof(null==t?void 0:t.cacheMaxAge)?null==t?void 0:t.cacheMaxAge:6e5),w(bi,this,new Headers(null==t?void 0:t.headers)),hi&&!m(bi,this).has("User-Agent")&&m(bi,this).set("User-Agent",hi),m(bi,this).has("accept")||(m(bi,this).set("accept","application/json"),m(bi,this).append("accept","application/jwk-set+json")),w(ki,this,null==t?void 0:t[di]),void 0!==(null==t?void 0:t[pi])&&(w(Si,this,null==t?void 0:t[pi]),n=null==t?void 0:t[pi],o=m(wi,this),"object"==typeof n&&null!==n&&"uat"in n&&"number"==typeof n.uat&&!(Date.now()-n.uat>=o)&&"jwks"in n&&Lo(n.jwks)&&Array.isArray(n.jwks.keys)&&Array.prototype.every.call(n.jwks.keys,Lo)&&(w(gi,this,m(Si,this).uat),w(_i,this,li(m(Si,this).jwks))))}pendingFetch(){return!!m(vi,this)}coolingDown(){return"number"==typeof m(gi,this)&&Date.now()<m(gi,this)+m(yi,this)}fresh(){return"number"==typeof m(gi,this)&&Date.now()<m(gi,this)+m(wi,this)}jwks(){var e;return null===(e=m(_i,this))||void 0===e?void 0:e.jwks()}async getKey(e,t){m(_i,this)&&this.fresh()||await this.reload();try{return await m(_i,this).call(this,e,t)}catch(n){if(n instanceof Ro&&!1===this.coolingDown())return await this.reload(),m(_i,this).call(this,e,t);throw n}}async reload(){m(vi,this)&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&w(vi,this,void 0),m(vi,this)||w(vi,this,async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch;const r=await o(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(e=>{if("TimeoutError"===e.name)throw new Io;throw e});if(200!==r.status)throw new bo("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await r.json()}catch(e){throw new bo("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(m(fi,this).href,m(bi,this),AbortSignal.timeout(m(mi,this)),m(ki,this)).then(e=>{w(_i,this,li(e)),m(Si,this)&&(m(Si,this).uat=Date.now(),m(Si,this).jwks=e),w(gi,this,Date.now()),w(vi,this,void 0)}).catch(e=>{throw w(vi,this,void 0),e})),await m(vi,this)}}const Ei=["mfaToken"],Pi=["mfaToken"];var Ai,Ri,Ci,Ii,xi,Oi,Wi,ji,Ui,Ki,Li,Ni,Mi,Di,zi,Ji,Hi,Zi,Fi,Vi,Gi,Xi,Yi,Bi,qi,Qi,$i,ea,ta,na,oa,ra,ia,aa;function sa(e){var t,n;if("object"!=typeof e||null===e)return{error:"unknown_error",error_description:String(e)};const o=e,r={error:null!==(t=o.error)&&void 0!==t?t:"",error_description:null!==(n=o.error_description)&&void 0!==n?n:"",message:o.message};if("mfa_required"===o.error&&o.cause){r.mfa_token="string"==typeof o.cause.mfa_token?o.cause.mfa_token:void 0;const e=o.cause.mfa_requirements;"object"==typeof e&&null!==e&&(r.mfa_requirements=e)}return r}var ca=class extends Error{constructor(e,t){super(t),v(this,"code",void 0),this.name="NotSupportedError",this.code=e}},ua=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}}},la=class extends ua{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},ha=class extends ua{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},da=class extends ua{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},pa=class extends ua{constructor(e,t){super("token_by_password_error",e,t),this.name="TokenByPasswordError"}},fa=class extends ua{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},ma=class extends ua{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},ya=class extends ua{constructor(e,t){super("token_revocation_error",e,t),this.name="TokenRevocationError"}},wa=class extends Error{constructor(e){super(e),v(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},ga=class extends ua{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),v(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},va=class extends ua{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},ba=class extends ua{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},ka=class extends ua{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},_a=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),v(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}},Sa=class extends Error{constructor(e){super(e),v(this,"code","organization_validation_error"),this.name="OrganizationValidationError"}};function Ta(e){return Object.entries(e).filter(e=>void 0!==S(e,2)[1]).reduce((e,t)=>k(k({},e),{},{[t[0]]:t[1]}),{})}function Ea(e){if(!e.trim())throw new Sa("organization must not be blank")}function Pa(e,t){if(!e)return;const n=t.trim();if(n.startsWith("org_")){const t=e.org_id;if("string"!=typeof t)throw new Sa("Organization Id (org_id) claim must be a string present in the ID token");if(t!==n)throw new Sa('Organization Id (org_id) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}else{const t=e.org_name;if("string"!=typeof t)throw new Sa("Organization Name (org_name) claim must be a string present in the ID token");if(t.toLowerCase()!==n.toLowerCase())throw new Sa('Organization Name (org_name) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}}var Aa=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},Ra=class extends Aa{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},Ca=class extends Aa{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},Ia=class extends Aa{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},xa=class extends Aa{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}},Oa=class extends Aa{constructor(e,t){super("mfa_verify_error",e,t),this.name="MfaVerifyError"}};function Wa(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var ja=class e{constructor(e,t,n,o,r,i,a){v(this,"accessToken",void 0),v(this,"idToken",void 0),v(this,"refreshToken",void 0),v(this,"expiresAt",void 0),v(this,"scope",void 0),v(this,"claims",void 0),v(this,"authorizationDetails",void 0),v(this,"tokenType",void 0),v(this,"issuedTokenType",void 0),v(this,"recoveryCode",void 0),v(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=r,this.claims=i,this.authorizationDetails=a}static fromTokenEndpointResponse(t){const n=t.id_token?t.claims():void 0,o=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return o.tokenType=t.token_type,o.issuedTokenType=t.issued_token_type,o}},Ua={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},Ka=(Ai=new WeakMap,Ri=new WeakMap,Ci=new WeakMap,Ii=new WeakMap,xi=new WeakMap,class{constructor(e){var t;y(this,Ai,void 0),y(this,Ri,void 0),y(this,Ci,void 0),y(this,Ii,void 0),y(this,xi,void 0),w(Ai,this,"https://".concat(e.domain)),w(Ri,this,e.clientId),w(Ci,this,e.clientSecret),w(Ii,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(xi,this,e.getConfiguration)}async listAuthenticators(e){const t="".concat(m(Ai,this),"/mfa/authenticators"),n=e.mfaToken,o=await m(Ii,this).call(this,t,{method:"GET",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!o.ok){let t;try{t=await o.json()}catch(e){throw new Ra("Failed to list authenticators")}throw new Ra(t.error_description||"Failed to list authenticators",t)}return(await o.json()).map(Wa)}async enrollAuthenticator(e){const t="".concat(m(Ai,this),"/mfa/associate"),n=e.mfaToken,o=_(e,Ei),r={authenticator_types:o.authenticatorTypes};"oobChannels"in o&&(r.oob_channels=o.oobChannels),"phoneNumber"in o&&o.phoneNumber&&(r.phone_number=o.phoneNumber),"email"in o&&o.email&&(r.email=o.email);const i=await m(Ii,this).call(this,t,{method:"POST",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){let t;try{t=await i.json()}catch(e){throw new Ca("Failed to enroll authenticator")}throw new Ca(t.error_description||"Failed to enroll authenticator",t)}return function(e){if("otp"===e.authenticator_type)return{authenticatorType:"otp",secret:e.secret,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes,id:e.id};if("oob"===e.authenticator_type)return{authenticatorType:"oob",oobChannel:e.oob_channel,oobCode:e.oob_code,bindingMethod:e.binding_method,id:e.id,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes};throw new Error("Unexpected authenticator type: ".concat(e.authenticator_type))}(await i.json())}async deleteAuthenticator(e){const t=e.authenticatorId,n=e.mfaToken,o="".concat(m(Ai,this),"/mfa/authenticators/").concat(encodeURIComponent(t)),r=await m(Ii,this).call(this,o,{method:"DELETE",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!r.ok){let t;try{t=await r.json()}catch(e){throw new Ia("Failed to delete authenticator")}throw new Ia(t.error_description||"Failed to delete authenticator",t)}}async challengeAuthenticator(e){const t="".concat(m(Ai,this),"/mfa/challenge"),n=e.mfaToken,o=_(e,Pi),r={mfa_token:n,client_id:m(Ri,this),challenge_type:o.challengeType};m(Ci,this)&&(r.client_secret=m(Ci,this)),o.authenticatorId&&(r.authenticator_id=o.authenticatorId);const i=await m(Ii,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){let t;try{t=await i.json()}catch(e){throw new xa("Failed to challenge authenticator")}throw new xa(t.error_description||"Failed to challenge authenticator",t)}return function(e){const t={challengeType:e.challenge_type};return void 0!==e.oob_code&&(t.oobCode=e.oob_code),void 0!==e.binding_method&&(t.bindingMethod=e.binding_method),t}(await i.json())}async verify(e){if(!m(xi,this))throw new Error("MFA verify requires a configuration provider (getConfiguration was not set)");const t=await m(xi,this).call(this),n={mfa_token:e.mfaToken};e.audience&&(n.audience=e.audience),"otp"===e.factorType?n.otp=e.otp:"oob"===e.factorType?(n.oob_code=e.oobCode,e.bindingCode&&(n.binding_code=e.bindingCode)):"recovery-code"===e.factorType&&(n.recovery_code=e.recoveryCode);try{const o=await Nr(t,Ua[e.factorType],n),r=ja.fromTokenEndpointResponse(o);return o.recovery_code&&(r.recoveryCode=o.recovery_code),r}catch(e){var o,r,i;if(e instanceof Oa)throw e;const t=e;throw new Oa(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(o=t.error)&&void 0!==o?o:"mfa_verify_error",error_description:null!==(r=null!==(i=t.error_description)&&void 0!==i?i:t.message)&&void 0!==r?r:"Failed to verify MFA challenge"})}}}),La=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},Na=class extends La{constructor(e,t){super("passkey_register_error",e,t),this.name="PasskeyRegisterError"}},Ma=class extends La{constructor(e,t){super("passkey_challenge_error",e,t),this.name="PasskeyChallengeError"}},Da=class extends La{constructor(e,t){super("passkey_get_token_error",e,t),this.name="PasskeyGetTokenError",this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}},za="urn:okta:params:oauth:grant-type:webauthn",Ja=(Oi=new WeakMap,Wi=new WeakMap,ji=new WeakMap,Ui=new WeakMap,Ki=new WeakSet,class{constructor(e){var t;g(this,Ki),y(this,Oi,void 0),y(this,Wi,void 0),y(this,ji,void 0),y(this,Ui,void 0),w(Oi,this,"https://".concat(e.domain)),w(Wi,this,e.clientId),w(ji,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(Ui,this,e.grantRequest)}async register(e){const t="".concat(m(Oi,this),"/passkey/register"),n=k(k(k(k(k(k(k(k({},e.email&&{email:e.email}),e.name&&{name:e.name}),e.phoneNumber&&{phone_number:e.phoneNumber}),e.username&&{username:e.username}),e.givenName&&{given_name:e.givenName}),e.familyName&&{family_name:e.familyName}),e.nickname&&{nickname:e.nickname}),e.picture&&{picture:e.picture}),o={client_id:m(Wi,this),user_profile:n};e.realm&&(o.realm=e.realm),e.organization&&(o.organization=e.organization),e.userMetadata&&(o.user_metadata=e.userMetadata);const r=await m(ji,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok){const e=await d(Ki,this,Ha).call(this,r);throw new Na(e.error_description||"Failed to request signup challenge",e)}return{authSession:(i=await r.json()).auth_session,authnParamsPublicKey:k({},i.authn_params_public_key)};var i}async challenge(e){const t="".concat(m(Oi,this),"/passkey/challenge"),n={client_id:m(Wi,this)};null!=e&&e.realm&&(n.realm=e.realm),null!=e&&e.organization&&(n.organization=e.organization);const o=await m(ji,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(n)});if(!o.ok){const e=await d(Ki,this,Ha).call(this,o);throw new Ma(e.error_description||"Failed to request login challenge",e)}return{authSession:(r=await o.json()).auth_session,authnParamsPublicKey:k({},r.authn_params_public_key)};var r}async getTokenByPasskey(e){void 0!==e.organization&&Ea(e.organization);const t=new URLSearchParams({auth_session:e.authSession,authn_response:JSON.stringify(e.credential)});let n;e.realm&&t.append("realm",e.realm),e.scope&&t.append("scope",e.scope),e.audience&&t.append("audience",e.audience),e.organization&&t.append("organization",e.organization);try{n=await m(Ui,this).call(this,za,t)}catch(e){const t=sa(e);throw new Da(t.error_description||"Failed to exchange passkey credential for tokens.",t)}return e.organization&&Pa(n.claims,e.organization),n}});async function Ha(e){try{return await e.json()}catch(t){return{error:"unknown_error",error_description:"HTTP ".concat(e.status," ").concat(e.statusText)}}}var Za=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}}},Fa=class extends Za{constructor(e,t){super("passwordless_start_error",e,t),this.name="PasswordlessStartError"}},Va=class extends Za{constructor(e,t){super("passwordless_verify_error",e,t),this.name="PasswordlessVerifyError"}},Ga=class extends Za{constructor(e,t){super("passwordless_db_get_token_error",e,t),this.name="PasswordlessDbGetTokenError"}},Xa=class extends Za{constructor(e,t,n,o){super("passwordless_challenge_error",e,n),v(this,"statusCode",void 0),v(this,"validationErrors",void 0),this.name="PasswordlessChallengeError",this.statusCode=t,this.validationErrors=o}};function Ya(e){return/^\+[1-9]\d{1,14}$/.test(e)}async function Ba(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await er(e.clientAssertionSigningKey,r);return{client_assertion:await new ni({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}if(e.clientSecret)return{client_secret:e.clientSecret};throw new _a}var qa=(Li=new WeakMap,Ni=new WeakMap,Mi=new WeakMap,Di=new WeakMap,zi=new WeakMap,Ji=new WeakMap,Hi=new WeakSet,class{constructor(e){var t;g(this,Hi),y(this,Li,void 0),y(this,Ni,void 0),y(this,Mi,void 0),y(this,Di,void 0),y(this,zi,void 0),y(this,Ji,void 0),w(Ni,this,e.domain),w(Li,this,"https://".concat(e.domain)),w(Mi,this,e.clientId),w(Di,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(zi,this,{clientSecret:e.clientSecret,clientAssertionSigningKey:e.clientAssertionSigningKey,clientAssertionSigningAlg:e.clientAssertionSigningAlg,useMtls:e.useMtls}),w(Ji,this,e.grantRequest)}async sendEmail(e){await d(Hi,this,Qa).call(this,function(e){var t;const n=null!==(t=e.send)&&void 0!==t?t:"code",o={email:e.email,connection:"email",send:n};return"link"===n&&e.authParams&&(o.authParams=e.authParams),o}(e),"Failed to send passwordless email",e.language)}async sendSms(e){if(!Ya(e.phoneNumber))throw new Fa("Phone number must be in E.164 format (e.g. +14155550100).");await d(Hi,this,Qa).call(this,function(e){return{phone_number:e.phoneNumber,connection:"sms"}}(e),"Failed to send passwordless SMS",e.language)}async challengeWithEmail(e){const t=function(e){var t;return{email:e.email,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t}}(e);return d(Hi,this,$a).call(this,t,"Failed to request email OTP challenge")}async challengeWithPhoneNumber(e){if(!Ya(e.phoneNumber))throw new Xa("Phone number must be in E.164 format (e.g. +14155550100).",0,void 0,void 0);const t=function(e){var t;const n={phone_number:e.phoneNumber,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t};return e.deliveryMethod&&(n.delivery_method=e.deliveryMethod),n}(e);return d(Hi,this,$a).call(this,t,"Failed to request phone OTP challenge")}async getTokenByPasswordlessDbConnection(e){const t=new URLSearchParams({auth_session:e.authSession,otp:e.otp});if(e.scope&&t.append("scope",e.scope),e.audience&&t.append("audience",e.audience),!m(Ji,this))throw new Ga("Missing grant request delegate.",sa(new Error("missing grantRequest")));try{return await m(Ji,this).call(this,"http://auth0.com/oauth/grant-type/passwordless/otp",t)}catch(e){throw new Ga("There was an error while trying to request a token.",sa(e))}}});async function Qa(e,t,n){var o;const r=await Ba(m(zi,this),m(Mi,this),m(Ni,this)),i=k(k({client_id:m(Mi,this)},e),r);let a,s;try{a=await m(Di,this).call(this,"".concat(m(Li,this),"/passwordless/start"),{method:"POST",headers:k({"Content-Type":"application/json"},n?{"x-request-language":n}:{}),body:JSON.stringify(i)})}catch(e){throw new Fa("".concat(t,": a network error occurred."))}if(!a.ok){if(204!==a.status)try{s=await a.json()}catch(e){s=void 0}throw new Fa((null===(o=s)||void 0===o?void 0:o.error_description)||t,s)}}async function $a(e,t){var n,o;const r=await Ba(m(zi,this),m(Mi,this),m(Ni,this)),i=k(k({client_id:m(Mi,this)},e),r);let a,s;try{a=await m(Di,this).call(this,"".concat(m(Li,this),"/otp/challenge"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)})}catch(e){throw new Xa("challenge error: a network error occurred.",0,void 0,void 0)}if(a.ok){let n;try{n=await a.json()}catch(e){throw new Xa("".concat(t,": could not parse the response body."),a.status,void 0,void 0)}return{authSession:n.auth_session}}try{s=await a.json()}catch(e){s=void 0}throw new Xa((null===(n=s)||void 0===n?void 0:n.error_description)||t,a.status,s,null===(o=s)||void 0===o?void 0:o.validation_errors)}var es=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},ts=class extends es{constructor(e,t){super("signup_error",e,t),this.name="SignUpError"}},ns=class extends es{constructor(e,t){super("change_password_error",e,t),this.name="ChangePasswordError"}};function os(e,t,n){for(const o of t)if(null===e[o]||void 0===e[o]||""===e[o])throw new n('Required parameter "'.concat(String(o),'" was null, undefined, or empty.'))}var rs=(Zi=new WeakMap,Fi=new WeakMap,Vi=new WeakMap,Gi=new WeakSet,class{constructor(e){var t;g(this,Gi),y(this,Zi,void 0),y(this,Fi,void 0),y(this,Vi,void 0),w(Zi,this,"https://".concat(e.domain)),w(Fi,this,e.clientId),w(Vi,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)})}async signUp(e){var t;os(e,["email","password","connection"],ts);const n=k({client_id:null!==(t=e.clientId)&&void 0!==t?t:m(Fi,this)},function(e){const t={email:e.email,password:e.password,connection:e.connection};return void 0!==e.username&&(t.username=e.username),void 0!==e.givenName&&(t.given_name=e.givenName),void 0!==e.familyName&&(t.family_name=e.familyName),void 0!==e.name&&(t.name=e.name),void 0!==e.nickname&&(t.nickname=e.nickname),void 0!==e.picture&&(t.picture=e.picture),void 0!==e.userMetadata&&(t.user_metadata=e.userMetadata),t}(e)),o=await d(Gi,this,is).call(this,"/dbconnections/signup",n,ts,"Failed to sign up");return function(e){var t,n;return{id:null!==(t=null!==(n=e._id)&&void 0!==n?n:e.user_id)&&void 0!==t?t:e.id,email:"string"==typeof e.email?e.email:"",emailVerified:Boolean(e.email_verified),username:e.username,givenName:e.given_name,familyName:e.family_name,name:e.name,nickname:e.nickname,picture:e.picture,userMetadata:e.user_metadata}}(await o.json())}async changePassword(e){var t;if(os(e,["connection"],ns),!e.email&&!e.username)throw new ns('Either "email" or "username" is required.');const n=k({client_id:null!==(t=e.clientId)&&void 0!==t?t:m(Fi,this)},function(e){const t={connection:e.connection};return void 0!==e.email&&(t.email=e.email),void 0!==e.username&&(t.username=e.username),void 0!==e.organization&&(t.organization=e.organization),t}(e));return(await d(Gi,this,is).call(this,"/dbconnections/change_password",n,ns,"Failed to request a password change")).text()}});async function is(e,t,n,o){let r;try{r=await m(Vi,this).call(this,"".concat(m(Zi,this)).concat(e),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}catch(e){throw new n("".concat(o,": a network error occurred."))}if(r.ok)return r;const i=await async function(e){let t;try{t=await e.json()}catch(e){return}return"string"==typeof t.error?t:"string"==typeof t.code?{error:t.code,error_description:"string"==typeof t.description?t.description:""}:void 0}(r);throw new n((null==i?void 0:i.error_description)||o,i)}var as=(Xi=new WeakMap,Yi=new WeakMap,Bi=new WeakMap,class{constructor(e,t){y(this,Xi,new Map),y(this,Yi,void 0),y(this,Bi,void 0),w(Bi,this,Math.max(1,Math.floor(e))),w(Yi,this,Math.max(0,Math.floor(t)))}get(e){const t=m(Xi,this).get(e);if(t){if(!(Date.now()>=t.expiresAt))return m(Xi,this).delete(e),m(Xi,this).set(e,t),t.value;m(Xi,this).delete(e)}}set(e,t){for(m(Xi,this).has(e)&&m(Xi,this).delete(e),m(Xi,this).set(e,{value:t,expiresAt:Date.now()+m(Yi,this)});m(Xi,this).size>m(Bi,this);){const e=m(Xi,this).keys().next().value;if(void 0===e)break;m(Xi,this).delete(e)}}}),ss=new Map;function cs(e){return{ttlMs:1e3*("number"==typeof(null==e?void 0:e.ttl)?e.ttl:600),maxEntries:"number"==typeof(null==e?void 0:e.maxEntries)&&e.maxEntries>0?e.maxEntries:100}}var us=class{static createDiscoveryCache(e){const t=(n=e.maxEntries,o=e.ttlMs,"".concat(n,":").concat(o));var n,o;let r=(i=t,ss.get(i));var i;return r||(r=new as(e.maxEntries,e.ttlMs),ss.set(t,r)),r}static createJwksCache(){return{}}},ls="openid profile email offline_access",hs=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function ds(e){if(null==e)throw new ma("subject_token is required");if("string"!=typeof e)throw new ma("subject_token must be a string");if(0===e.trim().length)throw new ma("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new ma("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new ma("subject_token must not include the 'Bearer ' prefix")}function ps(e,t){if(t)for(const o of Object.entries(t)){var n=S(o,2);const t=n[0],r=n[1];if(!hs.has(t))if(Array.isArray(r)){if(r.length>20)throw new ma("Parameter '".concat(t,"' exceeds maximum array size of ").concat(20));r.forEach(n=>{e.append(t,n)})}else e.append(t,r)}}var fs,ms,ys="urn:ietf:params:oauth:token-type:access_token",ws=(qi=new WeakMap,Qi=new WeakMap,$i=new WeakMap,ea=new WeakMap,ta=new WeakMap,na=new WeakMap,oa=new WeakMap,ra=new WeakMap,ia=new WeakMap,aa=new WeakSet,class{constructor(e){var t,n,o,r;if(g(this,aa),y(this,qi,void 0),y(this,Qi,void 0),y(this,$i,void 0),y(this,ea,void 0),y(this,ta,void 0),y(this,na,void 0),y(this,oa,void 0),y(this,ra,void 0),y(this,ia,void 0),v(this,"mfa",void 0),v(this,"passkey",void 0),v(this,"passwordless",void 0),v(this,"database",void 0),w(ea,this,e),e.useMtls&&!e.customFetch)throw new ca("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");w(ta,this,function(e,t){if(!1===t.enabled)return e;const n={name:t.name,version:t.version},o=btoa(JSON.stringify(n));return async(t,n)=>{const r=t instanceof Request?new Headers(t.headers):new Headers;return null!=n&&n.headers&&new Headers(n.headers).forEach((e,t)=>{r.set(t,e)}),r.set("Auth0-Client",o),e(t,k(k({},n),{},{headers:r}))}}(null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)},!1===(null==(n=e.telemetry)?void 0:n.enabled)?n:{enabled:!0,name:null!==(o=null==n?void 0:n.name)&&void 0!==o?o:"@auth0/auth0-auth-js",version:null!==(r=null==n?void 0:n.version)&&void 0!==r?r:"1.12.0"}));const i=cs(e.discoveryCache);w(oa,this,us.createDiscoveryCache(i)),w(ra,this,new Map),w(ia,this,us.createJwksCache()),this.mfa=new Ka({domain:m(ea,this).domain,clientId:m(ea,this).clientId,clientSecret:m(ea,this).clientSecret,customFetch:m(ta,this),getConfiguration:async()=>(await d(aa,this,bs).call(this)).configuration}),this.passkey=new Ja({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this),grantRequest:async(e,t)=>{const n=(await d(aa,this,bs).call(this)).serverMetadata,o=await d(aa,this,vs).call(this,n);o[pr]=function(e,t){return(n,o)=>{const r=null==o?void 0:o.body;if(t!==za||!(r instanceof URLSearchParams))return e(n,o);const i={};for(const e of r){var a=S(e,2);const t=a[0],n=a[1];i[t]="authn_response"===t?JSON.parse(n):n}const s=new Headers(null==o?void 0:o.headers);return s.set("Content-Type","application/json"),e(n,k(k({},o),{},{headers:s,body:JSON.stringify(i)}))}}(m(ta,this),e);const r=await Nr(o,e,t);return ja.fromTokenEndpointResponse(r)}}),this.passwordless=new qa({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this),clientSecret:m(ea,this).clientSecret,clientAssertionSigningKey:m(ea,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(ea,this).clientAssertionSigningAlg,useMtls:m(ea,this).useMtls,grantRequest:async(e,t)=>{const n=(await d(aa,this,bs).call(this)).configuration,o=await Nr(n,e,t);return ja.fromTokenEndpointResponse(o)}}),this.database=new rs({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this)})}async getServerMetadata(){return(await d(aa,this,bs).call(this)).serverMetadata}async buildAuthorizationUrl(e){const t=(await d(aa,this,bs).call(this)).serverMetadata;if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new ca("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await d(aa,this,Es).call(this,e)}catch(e){throw new va(e)}}async buildLinkUserUrl(e){try{const t=await d(aa,this,Es).call(this,{authorizationParams:k(k({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new ba(e)}}async buildUnlinkUserUrl(e){try{const t=await d(aa,this,Es).call(this,{authorizationParams:k(k({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new ka(e)}}async backchannelAuthentication(e){const t=await d(aa,this,bs).call(this),n=t.configuration,o=t.serverMetadata,r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:o.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&i.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&i.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Pr(n,i),t=await Ar(n,e);return ja.fromTokenEndpointResponse(t)}catch(e){throw new ga(e)}}async initiateBackchannelAuthentication(e){const t=await d(aa,this,bs).call(this),n=t.configuration,o=t.serverMetadata,r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:o.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&i.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&i.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Pr(n,i);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(e){throw new ga(e)}}async backchannelAuthenticationGrant(e){let t=e.authReqId;const n=(await d(aa,this,bs).call(this)).configuration,o=new URLSearchParams({auth_req_id:t});try{const e=await Nr(n,"urn:openid:params:grant-type:ciba",o);return ja.fromTokenEndpointResponse(e)}catch(e){throw new ga(e)}}async getTokenForConnection(e){var t;if(e.refreshToken&&e.accessToken)throw new fa("Either a refresh or access token should be specified, but not both.");const n=null!==(t=e.accessToken)&&void 0!==t?t:e.refreshToken;if(!n)throw new fa("Either a refresh or access token must be specified.");try{return await this.exchangeToken({connection:e.connection,subjectToken:n,subjectTokenType:e.accessToken?ys:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint})}catch(e){if(e instanceof ma)throw new fa(e.message,e.cause);throw e}}async exchangeToken(e){return"connection"in e?d(aa,this,ks).call(this,e):d(aa,this,_s).call(this,e)}async getTokenByCode(e,t){const n=(await d(aa,this,bs).call(this)).configuration;let o;void 0!==t.organization&&Ea(t.organization);try{const r=await Cr(n,e,{pkceCodeVerifier:t.codeVerifier});o=ja.fromTokenEndpointResponse(r)}catch(e){throw new la("There was an error while trying to request a token.",sa(e))}return t.organization&&Pa(o.claims,t.organization),o}async getTokenByMagicLinkCode(e,t){const n=(await d(aa,this,bs).call(this)).configuration;try{const o=await Cr(n,e,{expectedState:null==t?void 0:t.expectedState});return ja.fromTokenEndpointResponse(o)}catch(e){const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.";throw new la(t,e)}}async getTokenByRefreshToken(e){const t=(await d(aa,this,bs).call(this)).configuration,n=new URLSearchParams;e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope);try{const o=await Ir(t,e.refreshToken,n);return ja.fromTokenEndpointResponse(o)}catch(e){throw new da("The access token has expired and there was an error while trying to refresh it.",sa(e))}}async revokeToken(e){const t=(await d(aa,this,bs).call(this)).configuration,n={};e.tokenTypeHint&&(n.token_type_hint=e.tokenTypeHint);try{await async function(e,t,n){jr(e);const o=ur(e),r=o.as,i=o.c,a=o.auth,s=o.fetch,c=o.tlsOnly,u=o.timeout;return async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"token"');const i=sn(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),a=new URLSearchParams(null==r?void 0:r.additionalParameters);a.set("token",o);const s=Jt(null==r?void 0:r.headers);return s.delete("accept"),kn(e,t,n,i,a,s,r)}(r,i,a,t,{[Ct]:s,[Pt]:!c,additionalParameters:new URLSearchParams(n),headers:new Headers(sr),signal:Ur(u)}).then(Bn).catch(vr)}(t,e.token,n)}catch(e){throw new ya("An error occurred while trying to revoke the token.",sa(e))}}async getTokenByPassword(e){const t=(await d(aa,this,bs).call(this)).configuration,n=new URLSearchParams({username:e.username,password:e.password});e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),e.realm&&n.append("realm",e.realm);let o=t;if(e.auth0ForwardedFor){const n=await d(aa,this,Ts).call(this);o=new _r(t.serverMetadata(),m(ea,this).clientId,m(ea,this).clientSecret,n),o[pr]=(t,n)=>m(ta,this).call(this,t,k(k({},n),{},{headers:k(k({},n.headers),{},{"auth0-forwarded-for":e.auth0ForwardedFor})}))}try{const e=await Nr(o,"password",n);return ja.fromTokenEndpointResponse(e)}catch(e){throw new pa("There was an error while trying to request a token.",sa(e))}}async getTokenByPasswordlessEmail(e){const t=new URLSearchParams({username:e.email,otp:e.code,realm:"email"});return e.audience&&t.append("audience",e.audience),e.scope&&t.append("scope",e.scope),d(aa,this,Ss).call(this,t)}async getTokenByPasswordlessSms(e){if(!Ya(e.phoneNumber))throw new Va("Phone number must be in E.164 format (e.g. +14155550100).");const t=new URLSearchParams({username:e.phoneNumber,otp:e.code,realm:"sms"});return e.audience&&t.append("audience",e.audience),e.scope&&t.append("scope",e.scope),d(aa,this,Ss).call(this,t)}async getTokenByClientCredentials(e){const t=(await d(aa,this,bs).call(this)).configuration;try{const n=new URLSearchParams({audience:e.audience});e.organization&&n.append("organization",e.organization);const o=await xr(t,n);return ja.fromTokenEndpointResponse(o)}catch(e){throw new ha("There was an error while trying to request a token.",sa(e))}}async buildLogoutUrl(e){const t=await d(aa,this,bs).call(this),n=t.configuration;if(!t.serverMetadata.end_session_endpoint){const t=new URL("https://".concat(m(ea,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",m(ea,this).clientId),t}return function(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=sn(o,"end_session_endpoint",!1,n.tlsOnly);(t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id);for(const e of t.entries()){var a=S(e,2);const t=a[0],n=a[1];i.searchParams.append(t,n)}return i}(n,{post_logout_redirect_uri:e.returnTo})}async verifyLogoutToken(e){const t=(await d(aa,this,bs).call(this)).serverMetadata,n=cs(m(ea,this).discoveryCache),o=t.jwks_uri;m(na,this)||w(na,this,function(e,t){const n=new Ti(e,t),o=async(e,t)=>n.getKey(e,t);return Object.defineProperties(o,{coolingDown:{get:()=>n.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>n.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>n.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>n.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>n.jwks(),enumerable:!0,configurable:!1,writable:!1}}),o}(new URL(o),{cacheMaxAge:n.ttlMs,[di]:m(ta,this),[pi]:m(ia,this)}));const r=(await Gr(e.logoutToken,m(na,this),{issuer:t.issuer,audience:m(ea,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in r)&&!("sub"in r))throw new wa('either "sid" or "sub" (or both) claims must be present');if("sid"in r&&"string"!=typeof r.sid)throw new wa('"sid" claim must be a string');if("sub"in r&&"string"!=typeof r.sub)throw new wa('"sub" claim must be a string');if("nonce"in r)throw new wa('"nonce" claim is prohibited');if(!("events"in r))throw new wa('"events" claim is missing');if("object"!=typeof r.events||null===r.events)throw new wa('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in r.events))throw new wa('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof r.events["http://schemas.openid.net/event/backchannel-logout"])throw new wa('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:r.sid,sub:r.sub}}});function gs(){const e=m(ea,this).domain.toLowerCase();return"".concat(e,"|mtls:").concat(m(ea,this).useMtls?"1":"0")}async function vs(e){const t=await d(aa,this,Ts).call(this),n=new _r(e,m(ea,this).clientId,m(ea,this).clientSecret,t);return n[pr]=m(ta,this),n}async function bs(){if(m(qi,this)&&m(Qi,this))return{configuration:m(qi,this),serverMetadata:m(Qi,this)};const e=d(aa,this,gs).call(this),t=m(oa,this).get(e);if(t)return w(Qi,this,t.serverMetadata),w(qi,this,await d(aa,this,vs).call(this,t.serverMetadata)),{configuration:m(qi,this),serverMetadata:m(Qi,this)};const n=m(ra,this).get(e);if(n){const e=await n;return w(Qi,this,e.serverMetadata),w(qi,this,await d(aa,this,vs).call(this,e.serverMetadata)),{configuration:m(qi,this),serverMetadata:m(Qi,this)}}const o=(async()=>{const t=await d(aa,this,Ts).call(this),n=await br(new URL("https://".concat(m(ea,this).domain)),m(ea,this).clientId,{use_mtls_endpoint_aliases:m(ea,this).useMtls},t,{[pr]:m(ta,this)}),o=n.serverMetadata();return m(oa,this).set(e,{serverMetadata:o}),{configuration:n,serverMetadata:o}})(),r=o.then(e=>({serverMetadata:e.serverMetadata}));r.catch(()=>{}),m(ra,this).set(e,r);try{const e=await o,t=e.configuration,n=e.serverMetadata;w(qi,this,t),w(Qi,this,n),m(qi,this)[pr]=m(ta,this)}finally{m(ra,this).delete(e)}return{configuration:m(qi,this),serverMetadata:m(Qi,this)}}async function ks(e){var t,n;const o=(await d(aa,this,bs).call(this)).configuration;if("audience"in e||"resource"in e)throw new ma("audience and resource parameters are not supported for Token Vault exchanges");ds(e.subjectToken);const r=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!==(t=e.subjectTokenType)&&void 0!==t?t:ys,requested_token_type:null!==(n=e.requestedTokenType)&&void 0!==n?n:"http://auth0.com/oauth/token-type/federated-connection-access-token"});e.loginHint&&r.append("login_hint",e.loginHint),e.scope&&r.append("scope",e.scope),ps(r,e.extra);try{const e=await Nr(o,"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",r);return ja.fromTokenEndpointResponse(e)}catch(t){throw new ma("Failed to exchange token for connection '".concat(e.connection,"'."),sa(t))}}async function _s(e){const t=(await d(aa,this,bs).call(this)).configuration;if(ds(e.subjectToken),void 0!==e.organization&&Ea(e.organization),void 0!==e.actorToken&&void 0===e.actorTokenType)throw new ma("actorTokenType is required when actorToken is provided");const n=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});let o,r;e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),e.requestedTokenType&&n.append("requested_token_type",e.requestedTokenType),e.organization&&n.append("organization",e.organization),e.actorToken&&n.append("actor_token",e.actorToken),e.actorTokenType&&n.append("actor_token_type",e.actorTokenType),ps(n,e.extra);try{r=await Nr(t,"urn:ietf:params:oauth:grant-type:token-exchange",n),o=ja.fromTokenEndpointResponse(r)}catch(t){throw new ma("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),sa(t))}var i;if(e.organization&&Pa(o.claims,e.organization),e.actorToken)if(null!==(i=o.claims)&&void 0!==i&&i.act)o.act=o.claims.act;else try{o.act=function(e){if("string"!=typeof e)throw new Po("JWTs must use Compact JWS serialization, JWT must be a string");const t=e.split("."),n=t[1],o=t.length;if(5===o)throw new Po("Only JWTs using Compact JWS serialization can be decoded");if(3!==o)throw new Po("Invalid JWT");if(!n)throw new Po("JWTs must contain a payload");let r,i;try{r=po(n)}catch(e){throw new Po("Failed to base64url decode the payload")}try{i=JSON.parse(co.decode(r))}catch(e){throw new Po("Failed to parse the decoded payload as JSON")}if(!Lo(i))throw new Po("Invalid JWT Claims Set");return i}(r.access_token).act}catch(e){}return o}async function Ss(e){const t=(await d(aa,this,bs).call(this)).configuration;try{const n=await Nr(t,"http://auth0.com/oauth/grant-type/passwordless/otp",e);return ja.fromTokenEndpointResponse(n)}catch(e){throw new Va("There was an error while trying to request a token.",sa(e))}}async function Ts(){return m($i,this)||w($i,this,(async()=>{if(!m(ea,this).clientSecret&&!m(ea,this).clientAssertionSigningKey&&!m(ea,this).useMtls)throw new _a;if(m(ea,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let e=m(ea,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await er(e,m(ea,this).clientAssertionSigningAlg||"RS256")),e?function(e){return nn(e,void 0)}(e):dr(m(ea,this).clientSecret)})().catch(e=>{throw w($i,this,void 0),e})),m($i,this)}async function Es(e){const t=(await d(aa,this,bs).call(this)).configuration,n=Xt(),o=await function(e){return async function(e){return Vt(e,"codeVerifier"),Lt(await crypto.subtle.digest("SHA-256",jt(e)))}(e)}(n),r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await Wr(t,i):await Or(t,i),codeVerifier:n}}class Ps extends O{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Ps.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new Ps(t,n)}}class As extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,As.prototype)}}class Rs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Rs.prototype)}}class Cs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Cs.prototype)}}class Is extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Is.prototype)}}class xs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,xs.prototype)}}class Os{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){const t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const n of this.contexts){var t=S(n,2);const o=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(o)}}get size(){return this.contexts.size}}class Ws{constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new Os}setMFAAuthDetails(e,t,n,o){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:o})}async getAuthenticators(e){var t,n,o;const r=this.contextManager.get(e);if(!r)throw new As("invalid_request","MFA context not found for this MFA token");const i=null===(n=null===(t=r.mfaRequirements)||void 0===t?void 0:t.challenge)||void 0===n?void 0:n.map(e=>e.type);try{const t=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return i&&0!==i.length?t.filter(e=>!!e.type&&i.includes(e.type)):t}catch(e){if(e instanceof Ra)throw new As(null===(o=e.cause)||void 0===o?void 0:o.error,e.message);throw e}}async enroll(e){var t;const n=function(e){const t=gt[e.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:e.mfaToken,authenticatorTypes:t.authenticatorTypes},t.oobChannels&&{oobChannels:t.oobChannels}),"phoneNumber"in e&&{phoneNumber:e.phoneNumber}),"email"in e&&{email:e.email})}(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(e){if(e instanceof Ca)throw new Rs(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async challenge(e){var t;try{const t={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(t.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(t)}catch(e){if(e instanceof xa)throw new Cs(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async getEnrollmentFactors(e){const t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new xs("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&0!==t.mfaRequirements.enroll.length?t.mfaRequirements.enroll:[]}async verify(e){const t=this.contextManager.get(e.mfaToken);if(!t)throw new Is("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const n=function(e){return"otp"in e&&e.otp?"http://auth0.com/oauth/grant-type/mfa-otp":"oobCode"in e&&e.oobCode?"http://auth0.com/oauth/grant-type/mfa-oob":"recoveryCode"in e&&e.recoveryCode?"http://auth0.com/oauth/grant-type/mfa-recovery-code":void 0}(e);if(!n)throw new Is("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const o=t.scope,r=t.audience;try{const t=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:o,audience:r,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),t}catch(e){if(e instanceof Is)throw new Is(e.error,e.error_description);throw e}}}class js extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,js.prototype)}}class Us{constructor(e,t){fs.set(this,void 0),ms.set(this,void 0),u(this,fs,e,"f"),u(this,ms,t,"f")}async signup(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.scope,n=e.audience,o=s(e,["scope","audience"]),r=await c(this,fs,"f").register(o),i=Ns(r.authnParamsPublicKey),a=await navigator.credentials.create({publicKey:i});if(!a)throw new js("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");const u=Ds(a);return c(this,ms,"f")._requestTokenForPasskey({authSession:r.authSession,credential:u,realm:o.realm,organization:o.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e||{},n=t.scope,o=t.audience,r=s(t,["scope","audience"]),i=await c(this,fs,"f").challenge(Object.keys(r).length>0?r:void 0),a=Ms(i.authnParamsPublicKey),u=await navigator.credentials.get({publicKey:a});if(!u)throw new js("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");const l=zs(u);return c(this,ms,"f")._requestTokenForPasskey({authSession:i.authSession,credential:l,realm:r.realm,organization:r.organization,scope:n,audience:o})}async getSignupChallenge(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,fs,"f").register(e);return{authSession:t.authSession,publicKey:Ns(t.authnParamsPublicKey)}}async getLoginChallenge(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,fs,"f").challenge(e);return{authSession:t.authSession,publicKey:Ms(t.authnParamsPublicKey)}}async getTokenWithPasskey(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.authSession,n=e.credential,o=e.realm,r=e.organization,i=e.scope,a=e.audience,s=n.response;let u;if(s instanceof AuthenticatorAttestationResponse)u=Ds(n);else{if(!(s instanceof AuthenticatorAssertionResponse))throw new js("passkey_invalid_credential","The provided credential is not a valid attestation or assertion response.");u=zs(n)}return c(this,ms,"f")._requestTokenForPasskey({authSession:t,credential:u,realm:o,organization:r,scope:i,audience:a})}}function Ks(e){const t=new Uint8Array(e),n=Array.from(t,e=>String.fromCharCode(e)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Ls(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t+"=".repeat((4-t.length%4)%4),o=atob(n),r=new Uint8Array(o.length);for(let e=0;e<o.length;e++)r[e]=o.charCodeAt(e);return r.buffer}function Ns(e){return Object.assign(Object.assign({},e),{challenge:Ls(e.challenge),user:Object.assign(Object.assign({},e.user),{id:Ls(e.user.id)}),pubKeyCredParams:e.pubKeyCredParams,authenticatorSelection:e.authenticatorSelection})}function Ms(e){return Object.assign(Object.assign({},e),{challenge:Ls(e.challenge)})}function Ds(e){var t;const n=e.response;return{id:e.id,rawId:Ks(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Ks(n.clientDataJSON),attestationObject:Ks(n.attestationObject)},clientExtensionResults:e.getClientExtensionResults()}}function zs(e){var t;const n=e.response;return{id:e.id,rawId:Ks(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Ks(n.clientDataJSON),authenticatorData:Ks(n.authenticatorData),signature:Ks(n.signature),userHandle:n.userHandle?Ks(n.userHandle):void 0},clientExtensionResults:e.getClientExtensionResults()}}fs=new WeakMap,ms=new WeakMap;class Js{resolveOnlineAccess(e){if("online"!==e.refreshTokenMode)return!1;if(!0!==e.useRefreshTokens)throw new W('`refreshTokenMode: "online"` requires the refresh-token grant.',"Set `useRefreshTokens: true`.");if(!0!==e.useDpop)throw new W('`refreshTokenMode: "online"` requires DPoP, which is missing or disabled.',"Set `useDpop: true` (DPoP is mandatory for online access).");return!0}constructor(e){let t,n;if(this.userCache=(new He).enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0,refreshTokenMode:"offline"},this.onlineAccess=this.resolveOnlineAccess(e),this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!F())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===F().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),this.lockManager=(ye||(ye=function(){return"undefined"!=typeof navigator&&"function"==typeof(null===(e=navigator.locks)||void 0===e?void 0:e.request)?new fe:new me;var e}()),ye),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||A,!ut(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=ut(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:P,this.cookieStorage=!1===e.legacySameSiteCookie?et:nt,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieName=(e=>"auth0.".concat(e,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const r=e.useCookiesForTransactions?this.cookieStorage:ot;let i="";var a;this.onlineAccess?i=R:this.options.useRefreshTokens&&(i="offline_access"),this.scope=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if("object"!=typeof e)return{[x]:Le(t,e,...o)};let i={[x]:Le(t,...o)};return Object.keys(e).forEach(n=>{const r=e[n];i[n]=Le(t,r,...o)}),i}(this.options.authorizationParams.scope,"openid",i),this.transactionManager=new Fe(r,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||I,this.cacheManager=new Ze(n,n.allKeys?void 0:new at(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new pt(this.options.clientId):void 0,this.domainUrl=(a=this.options.domain,/^https?:\/\//.test(a)?a:"https://".concat(a)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);const s="".concat(this.domainUrl,"/me/"),c=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:s},detailedResponse:!0})}}));this.myAccount=new yt(c,s),this.authJsClient=new ws({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new Ws(this.authJsClient.mfa,this),this.passkey=new Us(this.authJsClient.passkey,this),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&t===A&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new it,this.worker.postMessage({type:"init",allowedBaseUrl:this.domainUrl}))}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const t=this.options.auth0Client||C,n=Y(t,!0),o=encodeURIComponent(btoa(JSON.stringify(n)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(o)}_authorizeUrl(e){return this._url("/authorize?".concat(B(e)))}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),n=S(t,3),o=n[0],r=n[1],i=n[2];if(3!==t.length||!o||!r||!i)throw new Error("ID token could not be decoded");const a=JSON.parse(Q(r)),s={__raw:e},c={};return Object.keys(a).forEach(e=>{s[e]=a[e],Ge.includes(e)||(c[e]=a[e])}),{encoded:{header:o,payload:r,signature:i},header:JSON.parse(Q(o)),claims:s,user:c}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&!Ve(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!Ve(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!Ve(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(t.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(null!=t.claims.nbf&&Ve(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(e))}if(null!=t.claims.auth_time&&Ve(t.claims.auth_time)){const r=new Date(0);if(r.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>r)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(r))}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_id,'"'))}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(r=this.options.authorizationParams.max_age,"string"!=typeof r?r:parseInt(r,10)||void 0),now:o});var r}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}_extractSessionTransferToken(e){return new URLSearchParams(window.location.search).get(e)||void 0}_clearSessionTransferTokenFromUrl(e){try{const t=new URL(window.location.href);t.searchParams.has(e)&&(t.searchParams.delete(e),window.history.replaceState({},"",t.toString()))}catch(e){}}_applySessionTransferToken(e){const t=this.options.sessionTransferTokenQueryParamName;if(!t||e.session_transfer_token)return e;const n=this._extractSessionTransferToken(t);return n?(this._clearSessionTransferTokenFromUrl(t),Object.assign(Object.assign({},e),{session_transfer_token:n})):e}async _prepareAuthorizeUrl(e,t,n){var o;const r=G(V()),i=G(V()),a=V(),s=await q(a),c=$(s),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),l=((e,t,n,o,r,i,a,s,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:Ne(t,n.scope,n.audience),response_type:"code",response_mode:s||"query",state:o,nonce:r,redirect_uri:a||e.authorizationParams.redirect_uri,code_challenge:i,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,r,i,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),h=this._authorizeUrl(l);return{nonce:i,code_verifier:a,scope:l.scope,audience:l.audience||x,redirect_uri:l.redirect_uri,state:r,url:h}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup","left=".concat(e,",top=").concat(t,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(),!t.popup))throw new M;const o=this._applySessionTransferToken(e.authorizationParams||{}),r=await this._prepareAuthorizeUrl(o,{response_mode:"web_message"},window.location.origin);t.popup.location.href=r.url;const i=await((e,t)=>new Promise((n,o)=>{let r;const i=setInterval(()=>{e.popup&&e.popup.closed&&(clearInterval(i),clearTimeout(a),window.removeEventListener("message",r,!1),o(new N(e.popup)))},1e3),a=setTimeout(()=>{clearInterval(i),o(new L(e.popup)),window.removeEventListener("message",r,!1)},1e3*(e.timeoutInSeconds||60));r=function(s){if(s.origin===t&&s.data&&"authorization_response"===s.data.type){if(clearTimeout(a),clearInterval(i),window.removeEventListener("message",r,!1),!1!==e.closePopup&&e.popup.close(),s.data.response.error)return o(O.fromPayload(s.data.response));n(s.data.response)}},window.addEventListener("message",r)}))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}),new URL(r.url).origin);if(r.state!==i.state)throw new O("state_mismatch","Invalid state");const a=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:r.audience,scope:r.scope,code_verifier:r.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:r.redirect_uri},{nonceIn:r.nonce,organization:a})}async getUser(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(){var t;const n=lt(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),o=n.openUrl,r=n.fragment,i=n.appState,a=s(n,["openUrl","fragment","appState"]),c=(null===(t=a.authorizationParams)||void 0===t?void 0:t.organization)||this.options.authorizationParams.organization,u=this._applySessionTransferToken(a.authorizationParams||{}),l=await this._prepareAuthorizeUrl(u),h=l.url,d=s(l,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},d),{appState:i,response_type:e.ResponseType.Code}),c&&{organization:c}));const p=r?"".concat(h,"#").concat(r):h;o?await o(p):window.location.assign(p)}async handleRedirectCallback(){const t=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===t.length)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new O("missing_transaction","Invalid state");this.transactionManager.remove();const o=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(t.join(""));return n.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(t,n){const o=t.code,r=t.state,i=t.error,a=t.error_description;if(i)throw new j(i,a||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new O("state_mismatch","Invalid state");const s=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:s}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const o=t.connect_code,r=t.state,i=t.error,a=t.error_description;if(i)throw new U(i,a||i,n.connection,r,n.appState);if(!o)throw new O("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new O("state_mismatch","Invalid state");const s=await this.myAccount.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},s),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get(st))return;this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(st)}try{await this.getTokenSilently(e)}catch(e){}}async getTokenSilently(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Ne(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),r=await this._getTokenSilently(o);return e.detailedResponse?r:null==r?void 0:r.access_token}async _getTokenSilently(e){const t=e.cacheMode,n=s(e,["cacheMode"]);if(await this._isSessionCeilingReached())return;if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||x,clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=(r=this.options.clientId,i=n.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(r,".").concat(i));var r,i;try{return await this.lockManager.runWithLock(o,5e3,async()=>{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||x,clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),o=e.id_token,r=e.token_type,i=e.access_token,a=e.oauthTokenScope,s=e.expires_in;return Object.assign(Object.assign({id_token:o,token_type:r,access_token:i},a?{scope:a}:null),{expires_in:s})})}catch(e){if(this._isInteractiveError(e)&&"popup"===this.options.interactiveErrorHandler)return await this._handleInteractiveErrorWithPopup(n);throw e}}_isInteractiveError(e){return e instanceof D||e instanceof O&&this._isIframeMfaError(e)}_isIframeMfaError(e){return"login_required"===e.error&&"Multifactor authentication required"===e.error_description}async _handleInteractiveErrorWithPopup(e){try{await this.loginWithPopup({authorizationParams:e.authorizationParams});const t=await this._getEntryFromCache({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||x,clientId:this.options.clientId});if(!t)throw new O("interactive_handler_cache_miss","Token not found in cache after interactive authentication");return t}catch(e){throw e}}async getTokenWithPopup(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};var n,o;const r=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Ne(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},E),t),await this.loginWithPopup(r,t),(await this.cacheManager.get(new ze({scope:r.authorizationParams.scope,audience:r.authorizationParams.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},n=t.federated,o=s(t,["federated"]),r=n?"&federated":"";return this._url("/v2/logout?".concat(B(Object.assign({clientId:e.clientId},o))))+r}async revokeRefreshToken(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!this.options.useRefreshTokens)return;const t=e.audience||this.options.authorizationParams.audience||x,n=await this.cacheManager.getRefreshTokensByAudience(t,this.options.clientId);await async function(e,t){let n=e.auth0Client,o=e.useFormData,r=e.refreshTokens,i=e.audience,a=e.client_id,s=e.onRefreshTokenRevoked;const c=e.timeout||P,u="refresh_token",l="".concat(e.baseUrl,"/oauth/revoke"),h={"Content-Type":o?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(Y(n||C)))};if(t){const n={client_id:a,token_type_hint:u},r=o?B(n):JSON.stringify(n);try{return await Oe({type:"revoke",timeout:c,fetchUrl:l,fetchOptions:{method:"POST",body:r,headers:h},useFormData:o,auth:{audience:null!=i?i:x}},t)}catch(e){throw new O("revoke_error",e.message)}}for(const t of r){const n={client_id:a,token_type_hint:u,token:t},r=o?B(n):JSON.stringify(n),i=await We(l,{method:"POST",body:r,headers:h},c);if(!i.ok){let t,n;try{var d=JSON.parse(await i.text());t=d.error,n=d.error_description}catch(e){}throw new O(t||"revoke_error",n||"HTTP error ".concat(i.status))}await(null==s?void 0:s(t))}}({baseUrl:this.domainUrl,timeout:this.httpTimeoutMs,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,client_id:this.options.clientId,refreshTokens:n,audience:t,onRefreshTokenRevoked:e=>this.cacheManager.stripRefreshToken(e)},this.worker),this.onlineAccess&&await this._clearLocalSession()}async logout(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};const t=lt(e),n=t.openUrl,o=s(t,["openUrl"]);await this._clearLocalSession(e.clientId);const r=this._buildLogoutUrl(o);n?await n(r):!1!==n&&window.location.assign(r)}async _getTokenFromIFrame(e){const t=(n=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(n));var n;try{return await this.lockManager.runWithLock(t,5e3,async()=>{const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const o=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin),r=o.url,i=o.state,a=o.nonce,s=o.code_verifier,c=o.redirect_uri,u=o.scope,l=o.audience;if(window.crossOriginIsolated)throw new O("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const h=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let d;try{d=new URL(this.domainUrl).origin}catch(e){d=this.domainUrl}const p=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise((o,r)=>{const i=window.document.createElement("iframe");i.setAttribute("width","0"),i.setAttribute("height","0"),i.style.display="none";const a=()=>{window.document.body.contains(i)&&(window.document.body.removeChild(i),window.removeEventListener("message",s,!1))};let s;const c=setTimeout(()=>{r(new K),a()},1e3*n);s=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?r(O.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",s,!1),setTimeout(a,2e3)},window.addEventListener("message",s,!1),window.document.body.appendChild(i),i.setAttribute("src",e)})}(r,d,h);if(i!==p.state)throw new O("state_mismatch","Invalid state");const f=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:s,code:p.code,grant_type:"authorization_code",redirect_uri:c,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:a,organization:t.organization});return Object.assign(Object.assign({},f),{scope:u,oauthTokenScope:f.scope,audience:l})})}catch(e){throw"login_required"===e.error&&(e instanceof O&&this._isIframeMfaError(e)&&"popup"===this.options.interactiveErrorHandler||this.logout({openUrl:!1})),e}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new ze({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new z(e.authorizationParams.audience||x,e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,r=((e,t,n,o)=>{var r;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),i=(null===(r=t.scope)||void 0===r?void 0:r.split(" "))||[],a=i.every(t=>e.includes(t));return e.length>=i.length&&a?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:r});if(!this.onlineAccess&&u.refresh_token&&(null==t?void 0:t.refresh_token)&&await this.cacheManager.updateEntry(t.refresh_token,u.refresh_token,this.options.clientId,this.options.useMrrt),this.options.useMrrt&&(i=null==t?void 0:t.audience,a=null==t?void 0:t.scope,s=e.authorizationParams.audience,c=e.authorizationParams.scope,i!==s||!((e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every(e=>n.includes(e))})(c,a))){const t=((e,t,n)=>{const o=(null==e?void 0:e.split(" "))||[],r=n?o.filter(e=>e!==R):o,i=(null==t?void 0:t.split(" "))||[];return r.filter(e=>-1==i.indexOf(e)).join(",")})(r,u.scope,this.onlineAccess);if(t){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope),new J(e.authorizationParams.audience||"default",t)}}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||x})}catch(t){if(t.message){if(t.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),t;if((t.message.includes("Missing Refresh Token")||t.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw t}var i,a,s,c}async _saveEntryInCache(e){const t=e.decodedToken.claims,n=t.session_expiry,o=t.iat;if(void 0!==n){if("number"!=typeof n)throw new O("invalid_token","Invalid session_expiry: value must be a number.");if(n>=1e10)throw new O("invalid_token","Invalid session_expiry: value appears to be in milliseconds; expected a Unix timestamp in seconds.");if(void 0===o||n<=o)throw new O("invalid_token","Invalid session_expiry: session ceiling is before or at the token issue time.")}const r=e.id_token,i=e.decodedToken,a=s(e,["id_token","decodedToken"]);this.userCache.set(De,{id_token:r,decodedToken:i}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(a)}async _clearLocalSession(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:this.options.clientId;var t;null===e?await this.cacheManager.clear():await this.cacheManager.clear(e),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove(De);try{await(null===(t=this.dpop)||void 0===t?void 0:t.clear())}catch(e){}if(this.worker)try{await Oe({type:"clear"},this.worker)}catch(e){}}async _isSessionCeilingReached(){var e,t;const n=this.userCache.get(De),o=null!=n?n:await this.cacheManager.getIdToken(new ze({clientId:this.options.clientId})),r=null===(t=null===(e=null==o?void 0:o.decodedToken)||void 0===e?void 0:e.claims)||void 0===t?void 0:t.session_expiry;if(void 0===r)return!1;const i=await this.nowProvider();return Math.floor(i/1e3)>=r-30&&(await this._clearLocalSession(),!0)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||x,t=this.scope[e],n=await this.cacheManager.getIdToken(new ze({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get(De);return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set(De,n),n)}async _getEntryFromCache(e){let t=e.scope,n=e.audience,o=e.clientId,r=e.cacheMode;const i=await this.cacheManager.get(new ze({scope:t,audience:n,clientId:o}),60,this.options.useMrrt,r);if(i&&i.access_token){const e=i.token_type,t=i.access_token,n=i.oauthTokenScope,o=i.expires_in,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}_storeMfaContext(e,t,n){e instanceof D&&this.mfa.setMFAAuthDetails(e.mfa_token,t,n,e.mfa_requirements)}async _requestToken(e,t){var n,o,r,i,a,s;const c=t||{},u=c.nonceIn,l=c.organization,h=c.scopesToRequest;try{const t=await Ke(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop,preserveRefreshToken:this.onlineAccess},e),{scope:h||e.scope}),this.worker);let c=await this._verifyIdToken(t.id_token,u,l);if("authorization_code"===e.grant_type){const e=await this._getIdTokenFromCache();(null===(o=null===(n=null==e?void 0:e.decodedToken)||void 0===n?void 0:n.claims)||void 0===o?void 0:o.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove(De))}if("authorization_code"!==e.grant_type){const e=await this._getIdTokenFromCache(),t=null===(i=null===(r=null==e?void 0:e.decodedToken)||void 0===r?void 0:r.claims)||void 0===i?void 0:i.session_expiry;void 0!==t&&(c=Object.assign(Object.assign({},c),{claims:Object.assign(Object.assign({},c.claims),{session_expiry:t})}))}return!t.refresh_token&&this.onlineAccess&&(t.refresh_token=null!==(a=e.refresh_token)&&void 0!==a?a:null===(s=await this.cacheManager.get(new ze({scope:h||e.scope,audience:e.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt))||void 0===s?void 0:s.refresh_token),await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},t),{decodedToken:c,scope:e.scope,audience:e.audience||x}),t.scope?{oauthTokenScope:t.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(l||c.claims.org_id),Object.assign(Object.assign({},t),{decodedToken:c})}catch(t){throw"authorization_code"!==e.grant_type&&this._storeMfaContext(t,h||e.scope,e.audience),t}}_buildTokenExchangeParams(e){return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type}),e.actor_token&&{actor_token:e.actor_token}),e.actor_token_type&&{actor_token_type:e.actor_token_type}),{scope:Ne(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}async loginWithCustomTokenExchange(e){return this._requestToken(this._buildTokenExchangeParams(e))}async customTokenExchange(e){const t=this._buildTokenExchangeParams(e);try{const n=await Ke(Object.assign(Object.assign({},t),{baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,dpop:this.dpop}),this.worker,!0);return n.id_token&&await this._verifyIdToken(n.id_token,void 0,e.organization),n}catch(e){throw this._storeMfaContext(e,t.scope,t.audience),e}}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new mt(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const n=t.openUrl,o=t.appState,r=t.connection,i=t.scopes,a=t.authorization_params,s=t.redirectUri,c=void 0===s?this.options.authorizationParams.redirect_uri||window.location.origin:s;if(!r)throw new Error("connection is required");const u=G(V()),l=V(),h=await q(l),d=$(h),p=await this.myAccount.connectAccount({connection:r,scopes:i,redirect_uri:c,state:u,code_challenge:d,code_challenge_method:"S256",authorization_params:a}),f=p.connect_uri,m=p.connect_params,y=p.auth_session;this.transactionManager.create({state:u,code_verifier:l,auth_session:y,redirect_uri:c,appState:o,connection:r,response_type:e.ResponseType.ConnectCode});const w=new URL(f);w.searchParams.set("ticket",m.ticket),n?await n(w.toString()):window.location.assign(w)}async _requestTokenForPasskey(e){const t=e.audience||this.options.authorizationParams.audience,n=e.organization||this.options.authorizationParams.organization;return this._requestToken(Object.assign(Object.assign(Object.assign({grant_type:"urn:okta:params:oauth:grant-type:webauthn",auth_session:e.authSession,authn_response:e.credential},e.realm&&{realm:e.realm}),n&&{organization:n}),{scope:Ne(this.scope,e.scope,t),audience:t}))}async _requestTokenForMfa(e,t){const n=e.mfaToken,o=s(e,["mfaToken"]);return this._requestToken(Object.assign(Object.assign({},o),{mfa_token:n}),t)}}var Hs={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},Zs=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},Fs=o(o({},Hs),{buildAuthorizeUrl:Zs,buildLogoutUrl:Zs,getAccessTokenSilently:Zs,getAccessTokenWithPopup:Zs,getIdTokenClaims:Zs,loginWithCustomTokenExchange:Zs,customTokenExchange:Zs,exchangeToken:Zs,loginWithRedirect:Zs,loginWithPopup:Zs,connectAccountWithRedirect:Zs,logout:Zs,revokeRefreshToken:Zs,handleRedirectCallback:Zs,getDpopNonce:Zs,setDpopNonce:Zs,generateDpopProof:Zs,createFetcher:Zs,getConfiguration:Zs,mfa:{getAuthenticators:Zs,enroll:Zs,challenge:Zs,verify:Zs,getEnrollmentFactors:Zs},passkey:{signup:Zs,login:Zs},myAccount:{getFactors:Zs,getAuthenticationMethods:Zs,getAuthenticationMethod:Zs,updateAuthenticationMethod:Zs,deleteAuthenticationMethod:Zs,enrollmentChallenge:Zs,enrollmentVerify:Zs}}),Vs=t.createContext(Fs),Gs=function(e){function t(n,o){var r=e.call(this,null!=o?o:n)||this;return r.error=n,r.error_description=o,Object.setPrototypeOf(r,t.prototype),r}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),Xs=/[?&](?:connect_)?code=[^&]+/,Ys=/[?&]state=[^&]+/,Bs=/[?&]error=[^&]+/,qs=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new Gs(n.error,n.error_description)}return new Gs(t.error)}return new Error(e)}},Qs=qs("Login failed"),$s=qs("Get access token failed"),ec=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},tc=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":case"SYNC_USER":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},nc=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},oc=function(e){return void 0===e&&(e=Vs),t.useContext(e)},rc=function(){return t.createElement(t.Fragment,null)},ic=function(){return i(void 0,void 0,void 0,function(){return a(this,function(e){return[2]})})},ac=function(){return"".concat(window.location.pathname).concat(window.location.search)};e.Auth0Context=Vs,e.Auth0Provider=function(n){var s=n,c=s.children,u=s.skipRedirectCallback,l=s.onRedirectCallback,h=void 0===l?nc:l,d=s.context,p=void 0===d?Vs:d,f=s.client,m=r(s,["children","skipRedirectCallback","onRedirectCallback","context","client"]);f&&(m.domain||m.clientId)&&console.warn("Auth0Provider: the `client` prop takes precedence over `domain`/`clientId` and other configuration options. Remove `domain`, `clientId`, and any other Auth0Client configuration props when using the `client` prop.");var y=t.useState(function(){return null!=f?f:new Js(function(e){return ec(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.22.1"}})}(m))})[0],w=t.useReducer(tc,Hs),g=w[0],v=w[1],b=t.useRef(!1),k=t.useCallback(function(e){return v({type:"ERROR",error:e}),e},[]);t.useEffect(function(){b.current||(b.current=!0,i(void 0,void 0,void 0,function(){var t,n,o,i,s,c,l;return a(this,function(a){switch(a.label){case 0:return a.trys.push([0,7,,8]),t=void 0,void 0===d&&(d=window.location.search),!Xs.test(d)&&!Bs.test(d)||!Ys.test(d)||u?[3,3]:[4,y.handleRedirectCallback()];case 1:return n=a.sent(),o=n.appState,i=void 0===o?{}:o,s=n.response_type,c=r(n,["appState","response_type"]),[4,y.getUser()];case 2:return t=a.sent(),i.response_type=s,s===e.ResponseType.ConnectCode&&(i.connectedAccount=c),h(i,t),[3,6];case 3:return[4,y.checkSession()];case 4:return a.sent(),[4,y.getUser()];case 5:t=a.sent(),a.label=6;case 6:return v({type:"INITIALISED",user:t}),[3,8];case 7:return l=a.sent(),k(Qs(l)),[3,8];case 8:return[2]}var d})}))},[y,h,u,k]);var _=t.useCallback(function(e){return ec(e),y.loginWithRedirect(e)},[y]),S=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o;return a(this,function(r){switch(r.label){case 0:v({type:"LOGIN_POPUP_STARTED"}),r.label=1;case 1:return r.trys.push([1,3,,4]),[4,y.loginWithPopup(e,t)];case 2:return r.sent(),[3,4];case 3:return n=r.sent(),k(Qs(n)),[2];case 4:return[4,y.getUser()];case 5:return o=r.sent(),v({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}})})},[y,k]),T=t.useCallback(function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return i(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,r=0,i=t.length;r<i;r++)!o&&r in t||(o||(o=Array.prototype.slice.call(t,0,r)),o[r]=t[r]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,function(e){return void 0===e&&(e={}),a(this,function(t){switch(t.label){case 0:return[4,y.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&v({type:"LOGOUT"}),[2]}})})},[y]),E=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n;return a(this,function(o){switch(o.label){case 0:return o.trys.push([0,,2,4]),[4,y.revokeRefreshToken(e)];case 1:return o.sent(),[3,4];case 2:return t=v,n={type:"SYNC_USER"},[4,y.getUser()];case 3:return t.apply(void 0,[(n.user=o.sent(),n)]),[7];case 4:return[2]}})})},[y]),P=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.getTokenSilently(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),A=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o,r,i;return a(this,function(a){switch(a.label){case 0:return a.trys.push([0,2,3,5]),[4,y.getTokenWithPopup(e,t)];case 1:return n=a.sent(),[3,5];case 2:throw o=a.sent(),$s(o);case 3:return r=v,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return r.apply(void 0,[(i.user=a.sent(),i)]),[7];case 5:return[2,n]}})})},[y]),R=t.useCallback(function(e){return y.connectAccountWithRedirect(e)},[y]),C=t.useCallback(function(){return y.getIdTokenClaims()},[y]),I=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.loginWithCustomTokenExchange(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),x=t.useCallback(function(e){return y.customTokenExchange(e)},[y]),O=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){return a(this,function(t){return[2,I(e)]})})},[I]),W=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o;return a(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,y.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw t=r.sent(),$s(t);case 3:return n=v,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,y.getUser()];case 4:return n.apply(void 0,[(o.user=r.sent(),o)]),[7];case 5:return[2]}})})},[y]),j=t.useCallback(function(e){return y.getDpopNonce(e)},[y]),U=t.useCallback(function(e,t){return y.setDpopNonce(e,t)},[y]),K=t.useCallback(function(e){return y.generateDpopProof(e)},[y]),L=t.useCallback(function(e){return y.createFetcher(e)},[y]),N=t.useCallback(function(){return y.getConfiguration()},[y]),M=t.useMemo(function(){return y.mfa},[y]),D=t.useMemo(function(){return y.myAccount},[y]),z=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.signup(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),J=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.login(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),H=t.useMemo(function(){return{signup:z,login:J}},[z,J]),Z=t.useMemo(function(){return o(o({},g),{getAccessTokenSilently:P,getAccessTokenWithPopup:A,getIdTokenClaims:C,loginWithCustomTokenExchange:I,customTokenExchange:x,exchangeToken:O,loginWithRedirect:_,loginWithPopup:S,connectAccountWithRedirect:R,logout:T,revokeRefreshToken:E,handleRedirectCallback:W,getDpopNonce:j,setDpopNonce:U,generateDpopProof:K,createFetcher:L,getConfiguration:N,mfa:M,passkey:H,myAccount:D})},[g,P,A,C,I,x,O,_,S,R,T,E,W,j,U,K,L,N,M,H,D]);return t.createElement(p.Provider,{value:Z},c)},e.AuthenticationError=j,e.ConnectError=U,e.GenericError=O,e.InMemoryCache=He,e.InvalidConfigurationError=W,e.LocalStorageCache=Je,e.MfaChallengeError=Cs,e.MfaEnrollmentError=Rs,e.MfaEnrollmentFactorsError=xs,e.MfaError=Ps,e.MfaListAuthenticatorsError=As,e.MfaRequiredError=D,e.MfaVerifyError=Is,e.MissingRefreshTokenError=z,e.MissingScopesError=J,e.MyAccountApiError=wt,e.OAuthError=Gs,e.PasskeyChallengeError=Ma,e.PasskeyError=js,e.PasskeyGetTokenError=Da,e.PasskeyRegisterError=Na,e.PopupCancelledError=N,e.PopupOpenError=M,e.PopupTimeoutError=L,e.RefreshTokenMode={Offline:"offline",Online:"online"},e.TimeoutError=K,e.UseDpopNonceError=H,e.User=class{},e.initialContext=Fs,e.useAuth0=oc,e.withAuth0=function(e,n){return void 0===n&&(n=Vs),function(r){return t.createElement(n.Consumer,null,function(n){return t.createElement(e,o({},r,{auth0:n}))})}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(r){var s=this,c=n.returnTo,u=void 0===c?ac:c,l=n.onRedirecting,h=void 0===l?rc:l,d=n.onBeforeAuthentication,p=void 0===d?ic:d,f=n.loginOptions,m=n.context,y=oc(void 0===m?Vs:m),w=y.isAuthenticated,g=y.isLoading,v=y.loginWithRedirect;return t.useEffect(function(){if(!g&&!w){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});i(s,void 0,void 0,function(){return a(this,function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,v(e)];case 2:return t.sent(),[2]}})})}},[g,w,v,p,f,u]),w?t.createElement(e,o({},r)):h()}}});
1
+ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},o.apply(this,arguments)};function r(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function i(e,t,n,o){return new(n||(n=Promise))(function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n(function(e){e(t)})).then(a,s)}c((o=o.apply(e,t||[])).next())})}function a(e,t){var n,o,r,i={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return a.next=s(0),a.throw=s(1),a.return=s(2),"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function s(s){return function(c){return function(s){if(n)throw new TypeError("Generator is already executing.");for(;a&&(a=0,s[0]&&(i=0)),i;)try{if(n=1,o&&(r=2&s[0]?o.return:s[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,s[1])).done)return r;switch(o=0,r&&(s=[2&s[0],r.value]),s[0]){case 0:case 1:r=s;break;case 4:return i.label++,{value:s[1],done:!1};case 5:i.label++,o=s[1],s=[0];continue;case 7:s=i.ops.pop(),i.trys.pop();continue;default:if(!(r=i.trys,(r=r.length>0&&r[r.length-1])||6!==s[0]&&2!==s[0])){i=0;continue}if(3===s[0]&&(!r||s[1]>r[0]&&s[1]<r[3])){i.label=s[1];break}if(6===s[0]&&i.label<r[1]){i.label=r[1],r=s;break}if(r&&i.label<r[2]){i.label=r[2],i.ops.push(s);break}r[2]&&i.ops.pop(),i.trys.pop();continue}s=t.call(e,i)}catch(e){s=[6,e],o=0}finally{n=r=0}if(5&s[0])throw s[1];return{value:s[0]?s[1]:void 0,done:!0}}([s,c])}}}function s(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function c(e,t,n,o){if("a"===n&&!o)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!o:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?o:"a"===n?o.call(e):o?o.value:t.get(e)}function u(e,t,n,o,r){if("m"===o)throw new TypeError("Private method is not writable");if("a"===o&&!r)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!r:!t.has(e))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===o?r.call(e,n):r?r.value=n:t.set(e,n),n}function l(e,t){this.v=e,this.k=t}function h(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,o=Array(t);n<t;n++)o[n]=e[n];return o}function d(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function p(e){return new l(e,0)}function f(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function m(e,t){return e.get(d(e,t))}function y(e,t,n){f(e,t),t.set(e,n)}function w(e,t,n){return e.set(d(e,t),n),n}function g(e,t){f(e,t),t.add(e)}function v(e,t,n){return(t=function(e){var t=function(e){if("object"!=typeof e||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function b(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,o)}return n}function k(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?b(Object(n),!0).forEach(function(t){v(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):b(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function _(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n={};for(var o in e)if({}.hasOwnProperty.call(e,o)){if(-1!==t.indexOf(o))continue;n[o]=e[o]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],-1===t.indexOf(n)&&{}.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}function S(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var o,r,i,a,s=[],c=!0,u=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;c=!1}else for(;!(c=(o=i.call(n)).done)&&(s.push(o.value),s.length!==t);c=!0);}catch(e){u=!0,r=e}finally{try{if(!c&&null!=n.return&&(a=n.return(),Object(a)!==a))return}finally{if(u)throw r}}return s}}(e,t)||function(e,t){if(e){if("string"==typeof e)return h(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?h(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function T(e){var t,n;function o(t,n){try{var i=e[t](n),a=i.value,s=a instanceof l;Promise.resolve(s?a.v:a).then(function(n){if(s){var c="return"===t&&a.k?t:"next";if(!a.k||n.done)return o(c,n);n=e[c](n).value}r(!!i.done,n)},function(e){o("throw",e)})}catch(e){r(2,e)}}function r(e,r){2===e?t.reject(r):t.resolve({value:r,done:e}),(t=t.next)?o(t.key,t.arg):n=null}this._invoke=function(e,r){return new Promise(function(i,a){var s={key:e,arg:r,resolve:i,reject:a,next:null};n?n=n.next=s:(t=n=s,o(e,r))})},"function"!=typeof e.return&&(this.return=void 0)}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError,T.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},T.prototype.next=function(e){return this._invoke("next",e)},T.prototype.throw=function(e){return this._invoke("throw",e)},T.prototype.return=function(e){return this._invoke("return",e)};const E={timeoutInSeconds:60},P=1e4,A="memory",R="online_access",C={name:"auth0-spa-js",version:"2.24.1"},I=()=>Date.now(),x="default";class O extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,O.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new O(t,n)}}class W extends O{constructor(e,t){super("invalid_configuration","".concat(e," ").concat(t)),this.suggestion=t,Object.setPrototypeOf(this,W.prototype)}}class j extends O{constructor(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,j.prototype)}}class U extends O{constructor(e,t,n,o){let r=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=r,Object.setPrototypeOf(this,U.prototype)}}class K extends O{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,K.prototype)}}class L extends K{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,L.prototype)}}class N extends O{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,N.prototype)}}class M extends O{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,M.prototype)}}class D extends O{constructor(e,t,n,o){super(e,t),this.mfa_token=n,this.mfa_requirements=o,Object.setPrototypeOf(this,D.prototype)}}class z extends O{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(Z(e,["default"]),"', scope: '").concat(Z(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,z.prototype)}}class J extends O{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(Z(e,["default"]),"', missing scope: '").concat(Z(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,J.prototype)}}class H extends O{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,H.prototype)}}function Z(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}const F=()=>window.crypto,V=()=>{let e="";for(;e.length<43;){const t=F().getRandomValues(new Uint8Array(43-e.length));for(const n of t)e.length<43&&n<198&&(e+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~."[n%66])}return e},G=e=>btoa(e),X=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],Y=function(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return Object.keys(e).reduce((n,o)=>{if(t&&"env"===o)return n;const r=X.find(e=>e.key===o);return r&&r.type.includes(typeof e[o])&&(n[o]=e[o]),n},{})},B=e=>{var t=e.clientId,n=s(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter(t=>void 0!==e[t]).reduce((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]}),{}))(Object.assign({client_id:t},n))).toString()},q=async e=>{const t=F().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},Q=e=>(e=>decodeURIComponent(atob(e).split("").map(e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),$=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,e=>t[e])})(window.btoa(String.fromCharCode(...Array.from(t))))};var ee="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},te={},ne={};Object.defineProperty(ne,"__esModule",{value:!0});var oe=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();ne.default=function(){return oe.getInstance()};var re=ee&&ee.__awaiter||function(e,t,n,o){return new(n||(n=Promise))(function(r,i){function a(e){try{c(o.next(e))}catch(e){i(e)}}function s(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){e.done?r(e.value):new n(function(t){t(e.value)}).then(a,s)}c((o=o.apply(e,t||[])).next())})},ie=ee&&ee.__generator||function(e,t){var n,o,r,i,a={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:s(0),throw:s(1),return:s(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function s(i){return function(s){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;a;)try{if(n=1,o&&(r=2&i[0]?o.return:i[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,i[1])).done)return r;switch(o=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return a.label++,{value:i[1],done:!1};case 5:a.label++,o=i[1],i=[0];continue;case 7:i=a.ops.pop(),a.trys.pop();continue;default:if(!((r=(r=a.trys).length>0&&r[r.length-1])||6!==i[0]&&2!==i[0])){a=0;continue}if(3===i[0]&&(!r||i[1]>r[0]&&i[1]<r[3])){a.label=i[1];break}if(6===i[0]&&a.label<r[1]){a.label=r[1],r=i;break}if(r&&a.label<r[2]){a.label=r[2],a.ops.push(i);break}r[2]&&a.ops.pop(),a.trys.pop();continue}i=t.call(e,a)}catch(e){i=[6,e],o=0}finally{n=r=0}if(5&i[0])throw i[1];return{value:i[0]?i[1]:void 0,done:!0}}([i,s])}}},ae=ee;Object.defineProperty(te,"__esModule",{value:!0});var se=ne,ce="browser-tabs-lock-key",ue={key:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},getItem:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},clear:function(){return re(ae,void 0,void 0,function(){return ie(this,function(e){return[2,window.localStorage.clear()]})})},removeItem:function(e){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},setItem:function(e,t){return re(ae,void 0,void 0,function(){return ie(this,function(e){throw new Error("Unsupported")})})},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function le(e){return new Promise(function(t){return setTimeout(t,e)})}function he(e){for(var t="",n=0;n<e;n++)t+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz"[Math.floor(61*Math.random())];return t}var de=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+he(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),re(this,void 0,void 0,function(){var o,r,i,a,s,c,u;return ie(this,function(l){switch(l.label){case 0:o=Date.now()+he(4),r=Date.now()+n,i=ce+"-"+t,a=void 0===this.storageHandler?ue:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,le(30)]:[3,8];case 2:return l.sent(),null!==a.getItemSync(i)?[3,5]:(s=this.id+"-"+t+"-"+o,[4,le(Math.floor(25*Math.random()))]);case 3:return l.sent(),a.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:s,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,le(30)];case 4:return l.sent(),null!==(c=a.getItemSync(i))&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?ue:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+he(4),[3,1];case 8:return[2,!1]}})})},e.prototype.refreshLockWhileAcquired=function(e,t){return re(this,void 0,void 0,function(){var n=this;return ie(this,function(o){return setTimeout(function(){return re(n,void 0,void 0,function(){var n,o,r;return ie(this,function(i){switch(i.label){case 0:return[4,se.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?ue:this.storageHandler,null===(o=n.getItemSync(e))?(se.default().unlock(t),[2]):((r=JSON.parse(o)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),se.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(se.default().unlock(t),[2])}})})},1e3),[2]})})},e.prototype.waitForSomethingToChange=function(t){return re(this,void 0,void 0,function(){return ie(this,function(n){switch(n.label){case 0:return[4,new Promise(function(n){var o=!1,r=Date.now(),i=!1;function a(){if(i||(window.removeEventListener("storage",a),e.removeFromWaiting(a),clearTimeout(s),i=!0),!o){o=!0;var t=50-(Date.now()-r);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",a),e.addToWaiting(a);var s=setTimeout(a,Math.max(0,t-Date.now()))})];case 1:return n.sent(),[2]}})})},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter(function(e){return e!==t}))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach(function(e){return e()})},e.prototype.releaseLock=function(e){return re(this,void 0,void 0,function(){return ie(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},e.prototype.releaseLock__private__=function(t){return re(this,void 0,void 0,function(){var n,o,r,i;return ie(this,function(a){switch(a.label){case 0:return n=void 0===this.storageHandler?ue:this.storageHandler,o=ce+"-"+t,null===(r=n.getItemSync(o))?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,se.default().lock(i.iat)];case 1:a.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),se.default().unlock(i.iat),e.notifyWaiters(),a.label=2;case 2:return[2]}})})},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,r=[],i=0;;){var a=o.keySync(i);if(null===a)break;r.push(a),i++}for(var s=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes(ce)){var l=o.getItemSync(u);if(null!==l){var h=JSON.parse(l);(void 0===h.timeRefreshed&&h.timeAcquired<n||void 0!==h.timeRefreshed&&h.timeRefreshed<n)&&(o.removeItemSync(u),s=!0)}}}s&&e.notifyWaiters()},e.waiters=void 0,e}(),pe=te.default=de;class fe{async runWithLock(e,t,n){const o=new AbortController,r=setTimeout(()=>o.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:o.signal},async e=>{if(clearTimeout(r),!e)throw new Error("Lock not available");return await n()})}catch(e){if(clearTimeout(r),"AbortError"===(null==e?void 0:e.name))throw new K;throw e}}}class me{constructor(){this.activeLocks=new Set,this.lock=new pe,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}async runWithLock(e,t,n){let o=!1;for(let n=0;n<10&&!o;n++)o=await this.lock.acquireLock(e,t);if(!o)throw new K;this.activeLocks.add(e),1===this.activeLocks.size&&"undefined"!=typeof window&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),0===this.activeLocks.size&&"undefined"!=typeof window&&window.removeEventListener("pagehide",this.pagehideHandler)}}}let ye=null;const we=new TextEncoder,ge=new TextDecoder;function ve(e){return"string"==typeof e?we.encode(e):ge.decode(e)}function be(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new Te(`${e.name} modulusLength must be at least 2048 bits`)}let ke;if(Uint8Array.prototype.toBase64)ke=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;ke=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function _e(e){return ke(e)}class Se extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class Te extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function Ee(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new Se("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new Se("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new Se("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new Se("unsupported CryptoKey algorithm name")}}function Pe(e){return e instanceof CryptoKey}function Ae(e){return Pe(e)&&"public"===e.type}async function Re(e,t,n,o,r,i){const a=null==e?void 0:e.privateKey,s=null==e?void 0:e.publicKey;if(!Pe(c=a)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!Ae(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==s.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==r&&"string"!=typeof r)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==i&&("object"!=typeof i||null===i||Array.isArray(i)))throw new TypeError('"additional" must be an object');return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${_e(ve(JSON.stringify(e)))}.${_e(ve(JSON.stringify(t)))}`;return`${o}.${_e(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return be(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return be(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new Se}(n),n,ve(o)))}`}({alg:Ee(a),typ:"dpop+jwt",jwk:await Ce(s)},Object.assign(Object.assign({},i),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:r?_e(await crypto.subtle.digest("SHA-256",ve(r))):void 0}),a)}async function Ce(e){const{kty:t,e:n,n:o,x:r,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:a,e:n,n:o,x:r,y:i}}const Ie="dpop-nonce",xe=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];const Oe=(e,t)=>new Promise(function(n,o){const r=new MessageChannel;r.port1.onmessage=function(e){e.data.error?o(new Error(e.data.error)):n(e.data),r.port1.close()},t.postMessage(e,[r.port2])}),We=(e,t,n)=>{const o=new AbortController;let r;return t.signal=o.signal,Promise.race([fetch(e,t),new Promise((e,t)=>{r=setTimeout(()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))},n)})]).finally(()=>{clearTimeout(r)})},je=async function(e,t,n,o,r,i){let a=arguments.length>6&&void 0!==arguments[6]?arguments[6]:P;return r?(async(e,t,n,o,r,i,a,s,c,u)=>Oe({type:"refresh",auth:{audience:t,scope:n},timeout:r,fetchUrl:e,fetchOptions:o,useFormData:a,useMrrt:s,skipTokenStorage:c,preserveRefreshToken:u},i))(e,t,n,o,a,r,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0,arguments.length>9?arguments[9]:void 0):(async(e,t,n)=>{const o=await We(e,t,n);return{ok:o.ok,json:await o.json(),headers:(r=o.headers,[...r].reduce((e,t)=>{let n=S(t,2),o=n[0],r=n[1];return e[o]=r,e},{}))};var r})(e,o,a)};async function Ue(e,t,n,o,r,i,a,c,u,l,h,d){if(u){const t=await u.generateProof({url:e,method:r.method||"GET",nonce:await u.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:t})}let p,f=null;for(let s=0;s<3;s++)try{p=await je(e,n,o,r,i,a,t,c,h,d),f=null;break}catch(e){f=e}if(f)throw f;const m=p.json,y=m.error,w=m.error_description,g=s(m,["error","error_description"]),v=p,b=v.headers,k=v.ok;let _;if(u&&(_=b[Ie],_&&await u.setNonce(_)),!k){const s=w||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===y)throw new D(y,s,g.mfa_token,g.mfa_requirements);if("missing_refresh_token"===y)throw new z(n,o);if("use_dpop_nonce"===y){if(!u||!_||l)throw new H(_);return Ue(e,t,n,o,r,i,a,c,u,!0,h,d)}throw new O(y||"request_error",s)}return g}async function Ke(e,t,n){var o=e.baseUrl,r=e.timeout,i=e.audience,a=e.scope,c=e.auth0Client,u=e.useFormData,l=e.useMrrt,h=e.dpop,d=e.preserveRefreshToken,p=s(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop","preserveRefreshToken"]);const f="urn:ietf:params:oauth:grant-type:token-exchange"===p.grant_type,m="urn:okta:params:oauth:grant-type:webauthn"===p.grant_type,y="refresh_token"===p.grant_type&&l,w=f||m||y,g=Object.assign(Object.assign(Object.assign({},p),w&&i&&{audience:i}),w&&a&&{scope:a}),v=m||!u,b=v?JSON.stringify(g):B(g),k=(_=p.grant_type,xe.includes(_));var _;return await Ue("".concat(o,"/oauth/token"),r,i||x,a,{method:"POST",body:b,headers:{"Content-Type":v?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(Y(c||C)))}},t,u,l,k?h:void 0,void 0,n,d)}const Le=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return(o=t.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(o))).join(" ");var o},Ne=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e[x]),Le(o,t)},Me="@@auth0spajs@@",De="@@user@@";class ze{constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Me,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const t=S(e.split("::"),4),n=t[0],o=t[1],r=t[2],i=t[3];return new ze({clientId:o,scope:i,audience:r},n)}static fromCacheEntry(e){const t=e.scope,n=e.audience,o=e.client_id;return new ze({scope:t,audience:n,clientId:o})}}class Je{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(Me))}}class He{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class Ze{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||I}async setIdToken(e,t,n){var o;const r=this.getIdTokenCacheKey(e);await this.cache.set(r,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(r))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var r;let i=await this.cache.get(e.toKey()),a=e;if(!i){const t=await this.getCacheKeys();if(!t)return;const r=this.matchExistingCacheKey(e,t);if(r&&(i=await this.cache.get(r),a=ze.fromKey(r)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;const s=await this.nowProvider(),c=Math.floor(s/1e3);return i.expiresAt-t<c?i.body.refresh_token?this.modifiedCachedEntry(i,a):(await this.cache.remove(a.toKey()),void await(null===(r=this.keyManifest)||void 0===r?void 0:r.remove(a.toKey()))):i.body}async modifiedCachedEntry(e,t){const n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},o={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),o),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;const n=new ze({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new ze({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async stripRefreshToken(e){var t;const n=await this.getCacheKeys();if(n)for(const o of n){const n=await this.cache.get(o);(null===(t=null==n?void 0:n.body)||void 0===t?void 0:t.refresh_token)===e&&(delete n.body.refresh_token,await this.cache.set(o,n))}}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter(t=>!e||t.includes(e)).reduce(async(e,t)=>{await e,await this.cache.remove(t)},Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new ze({clientId:e},Me,De).toKey()}matchExistingCacheKey(e,t){return t.filter(t=>{var n;const o=ze.fromKey(t),r=new Set(o.scope&&o.scope.split(" ")),i=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],a=o.scope&&i.reduce((e,t)=>e&&r.has(t),!0);return o.prefix===Me&&o.clientId===e.clientId&&o.audience===e.audience&&a})[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=ze.fromKey(o);if(t.prefix===Me&&t.clientId===e.clientId){const e=await this.cache.get(o);if(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)return{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;const o=await this.getCacheKeys();if(!o)return[];const r=new Set;for(const i of o){const o=ze.fromKey(i);if(o.prefix===Me&&o.clientId===t&&o.audience===e){const e=await this.cache.get(i);(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)&&r.add(e.body.refresh_token)}}return Array.from(r)}async updateEntry(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const r=await this.getCacheKeys();if(r)for(const i of r){if(ze.fromKey(i).clientId!==n)continue;const r=await this.cache.get(i);if(!(null==r?void 0:r.body))continue;const a=r.body.refresh_token;a&&(o||a===e)&&(r.body.refresh_token=t,await this.cache.set(i,r))}}}class Fe{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const Ve=e=>"number"==typeof e,Ge=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var Xe=ee&&ee.__assign||function(){return Xe=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},Xe.apply(this,arguments)};function Ye(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}var Be=function(e){return function(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),a=i.slice(1).join("=");'"'===a.charAt(0)&&(a=a.slice(1,-1));try{t[i[0].replace(o,decodeURIComponent)]=a.replace(o,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e]};function qe(e,t,n){document.cookie=function(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return Ye("Expires",e.expires?e.expires.toUTCString():"")+Ye("Domain",e.domain)+Ye("Path",e.path)+Ye("Secure",e.secure)+Ye("SameSite",e.sameSite)}(n)}(e,t,Xe({path:"/"},n))}var Qe=qe,$e=function(e,t){qe(e,"",Xe(Xe({},t),{expires:-1}))};const et={get(e){const t=Be(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),Qe(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),$e(e,n)}},tt="_legacy_",nt={get:e=>et.get(e)||et.get("".concat(tt).concat(e)),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),Qe("".concat(tt).concat(e),JSON.stringify(t),o),et.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),$e(e,n),et.remove(e,t),et.remove("".concat(tt).concat(e),t)}},ot={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var rt,it=function(e){return rt=rt||function(e,t,n){var o=void 0===t?null:t,r=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),r=0,i=n.length;r<i;++r)o[r]=n.charCodeAt(r);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),i=r.indexOf("\n",10)+1,a=r.substring(i)+(o?"//# sourceMappingURL="+o:""),s=new Blob([a],{type:"application/javascript"});return URL.createObjectURL(s)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxpLGE9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihhLnB1c2goby52YWx1ZSksYS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoaT1yLnJldHVybigpLE9iamVjdChpKSE9PWkpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGF9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGk9e30sYT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PWU9PntPYmplY3QuZW50cmllcyhpKS5mb3JFYWNoKHI9PntsZXQgbz10KHIsMiksbj1vWzBdO29bMV09PT1lJiZkZWxldGUgaVtuXX0pfSxmPWU9Pntjb25zdCB0PW5ldyBVUkxTZWFyY2hQYXJhbXMoZSkscj17fTtyZXR1cm4gdC5mb3JFYWNoKChlLHQpPT57clt0XT1lfSkscn0saD1hc3luYyBlPT57bGV0IHIsbixhPWUuZGF0YSx1PWEudGltZW91dCxoPWEuYXV0aCxkPWEuZmV0Y2hVcmwscD1hLmZldGNoT3B0aW9ucyx5PWEudXNlRm9ybURhdGEsZz1hLnVzZU1ycnQsYj1hLnNraXBUb2tlblN0b3JhZ2UsTz1hLnByZXNlcnZlUmVmcmVzaFRva2VuLGs9dChlLnBvcnRzLDEpWzBdLG09e307Y29uc3Qgaj1ofHx7fSx2PWouYXVkaWVuY2UsXz1qLnNjb3BlO3RyeXtjb25zdCBlPXk/ZihwLmJvZHkpOkpTT04ucGFyc2UocC5ib2R5KTtpZighZS5yZWZyZXNoX3Rva2VuJiYicmVmcmVzaF90b2tlbiI9PT1lLmdyYW50X3R5cGUpe2lmKG49KChlLHQpPT5pW2MoZSx0KV0pKHYsXyksIW4mJmcpe2NvbnN0IGU9aS5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+ISFPYmplY3Qua2V5cyhpKS5maW5kKHI9PntpZigibGF0ZXN0X3JlZnJlc2hfdG9rZW4iIT09cil7Y29uc3Qgbz1sKHQsciksbj1yLnNwbGl0KCJ8IilbMV0uc3BsaXQoIiAiKSxzPWUuc3BsaXQoIiAiKS5ldmVyeShlPT5uLmluY2x1ZGVzKGUpKTtyZXR1cm4gbyYmc319KSkoXyx2KTtlJiYhdCYmKG49ZSl9aWYoIW4pdGhyb3cgbmV3IG8odixfKTtwLmJvZHk9eT9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpfWxldCBhLGg7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGE9bmV3IEFib3J0Q29udHJvbGxlcixwLnNpZ25hbD1hLnNpZ25hbCk7dHJ5e2g9YXdhaXQgUHJvbWlzZS5yYWNlKFsoVT11LG5ldyBQcm9taXNlKGU9PnNldFRpbWVvdXQoZSxVKSkpLGZldGNoKGQsT2JqZWN0LmFzc2lnbih7fSxwKSldKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBrLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighaClyZXR1cm4gYSYmYS5hYm9ydCgpLHZvaWQgay5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZihNPWguaGVhZGVycyxtPVsuLi5NXS5yZWR1Y2UoKGUscik9PntsZXQgbz10KHIsMiksbj1vWzBdLHM9b1sxXTtyZXR1cm4gZVtuXT1zLGV9LHt9KSxyPWF3YWl0IGguanNvbigpLGIpcmV0dXJuIGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4sdm9pZCBrLnBvc3RNZXNzYWdlKHtvazpoLm9rLGpzb246cixoZWFkZXJzOm19KTtyLnJlZnJlc2hfdG9rZW4/KGcmJihpLmxhdGVzdF9yZWZyZXNoX3Rva2VuPXIucmVmcmVzaF90b2tlbix3PW4sUz1yLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMoaSkuZm9yRWFjaChlPT57bGV0IHI9dChlLDIpLG89clswXTtyWzFdPT09dyYmKGlbb109Uyl9KSksKChlLHQscik9PntpW2ModCxyKV09ZX0pKHIucmVmcmVzaF90b2tlbix2LF8pLGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4pOk98fCgoZSx0KT0+e2RlbGV0ZSBpW2MoZSx0KV19KSh2LF8pLGsucG9zdE1lc3NhZ2Uoe29rOmgub2ssanNvbjpyLGhlYWRlcnM6bX0pfWNhdGNoKGUpe2sucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOm19KX12YXIgdyxTLE0sVX0sZD1hc3luYyBlPT57bGV0IHI9ZS5kYXRhLG89ci50aW1lb3V0LG49ci5hdXRoLGE9ci5mZXRjaFVybCxjPXIuZmV0Y2hPcHRpb25zLGg9ci51c2VGb3JtRGF0YSxkPXQoZS5wb3J0cywxKVswXTtjb25zdCBwPShufHx7fSkuYXVkaWVuY2U7dHJ5e2NvbnN0IGU9KGU9Pntjb25zdCByPW5ldyBTZXQ7cmV0dXJuIE9iamVjdC5lbnRyaWVzKGkpLmZvckVhY2gobz0+e2xldCBuPXQobywyKSxzPW5bMF0saT1uWzFdO2woZSxzKSYmci5hZGQoaSl9KSxBcnJheS5mcm9tKHIpfSkocCk7aWYoMD09PWUubGVuZ3RoKXJldHVybiB2b2lkIGQucG9zdE1lc3NhZ2Uoe29rOiEwfSk7Y29uc3Qgcj1oP2YoYy5ib2R5KTpKU09OLnBhcnNlKGMuYm9keSk7Zm9yKGNvbnN0IHQgb2YgZSl7Y29uc3QgZT1oP3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7dG9rZW46dH0pKTtsZXQgbixpLGwsZjsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYobj1uZXcgQWJvcnRDb250cm9sbGVyLGk9bi5zaWduYWwpO3RyeXtmPWF3YWl0IFByb21pc2UucmFjZShbbmV3IFByb21pc2UoZT0+e2w9c2V0VGltZW91dChlLG8pfSksZmV0Y2goYSxPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sYykse2JvZHk6ZSxzaWduYWw6aX0pKV0pLmZpbmFsbHkoKCk9PmNsZWFyVGltZW91dChsKSl9Y2F0Y2goZSl7cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfSl9aWYoIWYpcmV0dXJuIG4mJm4uYWJvcnQoKSx2b2lkIGQucG9zdE1lc3NhZ2Uoe2Vycm9yOiJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCcifSk7aWYoIWYub2spe2xldCBlO3RyeXtjb25zdCB0PUpTT04ucGFyc2UoYXdhaXQgZi50ZXh0KCkpO2U9dC5lcnJvcl9kZXNjcmlwdGlvbn1jYXRjaChlKXt9cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZXx8IkhUVFAgZXJyb3IgIi5jb25jYXQoZi5zdGF0dXMpfSl9dSh0KX1kLnBvc3RNZXNzYWdlKHtvazohMH0pfWNhdGNoKGUpe2QucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZXx8IlVua25vd24gZXJyb3IgZHVyaW5nIHRva2VuIHJldm9jYXRpb24ifSl9fSxwPShlLHQpPT57aWYoIWEpcmV0dXJuITE7dHJ5e2NvbnN0IHI9bmV3IFVSTChhKS5vcmlnaW4sbz1uZXcgVVJMKGUuZmV0Y2hVcmwpO3JldHVybiBvLm9yaWdpbj09PXImJm8ucGF0aG5hbWU9PT10fWNhdGNoKGUpe3JldHVybiExfX07YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsZT0+e2NvbnN0IHI9ZS5kYXRhLG89dChlLnBvcnRzLDEpWzBdO2lmKCEoInR5cGUiaW4gcil8fCJpbml0IiE9PXIudHlwZSlyZXR1cm4idHlwZSJpbiByJiYiY2xlYXIiPT09ci50eXBlPyhpPXt9LHZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITB9KSkpOiJ0eXBlImluIHImJiJyZXZva2UiPT09ci50eXBlP3AociwiL29hdXRoL3Jldm9rZSIpP3ZvaWQgZChlKTp2b2lkKG51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpOnZvaWQoImZldGNoVXJsImluIHImJnAociwiL29hdXRoL3Rva2VuIik/aChlKTpudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjoiaW52YWxpZF9mZXRjaF91cmwiLGVycm9yX2Rlc2NyaXB0aW9uOiJVbmF1dGhvcml6ZWQgZmV0Y2ggVVJMIn0saGVhZGVyczp7fX0pKTtpZihudWxsPT09YSl0cnl7bmV3IFVSTChyLmFsbG93ZWRCYXNlVXJsKSxhPXIuYWxsb3dlZEJhc2VVcmx9Y2F0Y2goZSl7cmV0dXJufX0pfSgpOwoK",null,false),new Worker(rt,e)};class at{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(Me,"::").concat(e)}}const st="auth0.is.authenticated",ct={memory:()=>(new He).enclosedCache,localstorage:()=>new Je},ut=e=>ct[e],lt=e=>{const t=e.openUrl,n=e.onRedirect,o=s(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},ht={NONCE:"nonce",KEYPAIR:"keypair"};class dt{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(ht).forEach(t=>e.result.createObjectStore(t)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)})}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(ht.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(ht.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",e=>e.put(n,t))}findNonce(e){return this.find(ht.NONCE,this.buildKey(e))}findKeyPair(){return this.find(ht.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",e=>e.get(t))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",e=>e.getAllKeys());await Promise.all((null==n?void 0:n.filter(t).map(t=>this.executeDbRequest(e,"readwrite",e=>e.delete(t))))||[])}deleteByClientId(e,t){return this.deleteBy(e,e=>"string"==typeof e&&e.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(ht.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(ht.KEYPAIR,this.clientId)}}class pt{constructor(e){this.storage=new dt(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function(e){let t=e.keyPair,n=e.url,o=e.method,r=e.nonce,i=e.accessToken;const a=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(n);return Re(t,a,o,r,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!Ae(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await Ce(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new Se("unsupported JWK kty")}return _e(await crypto.subtle.digest({name:"SHA-256"},ve(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var ft;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(ft||(ft={}));class mt{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:ft.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);let o,r;"string"==typeof n?(o=this.config.dpopNonceId?ft.DPoP:ft.Bearer,r=n):(o=n.token_type,r=n.access_token),this.setAuthorizationHeader(e,r,o),o===ft.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,Ie);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new H(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const r=this.buildBaseRequest(e,t);await this.prepareRequest(r,o);const i=await this.config.fetch(r);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class yt{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){const e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){const t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),o=await this._handleResponse(n),r=null!==(t=n.headers.get("location"))&&void 0!==t?t:"",i=decodeURIComponent(r.split("/").pop()||"");return Object.assign(Object.assign({},o),{id:i,location:r})}async enrollmentVerify(e){const t=e,n=t.location;t.type;const o=s(t,["location","type"]),r=await this.myAccountFetcher.fetchWithAuth("".concat(n,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},{scope:["create:me:authentication_methods"]});return this._handleResponse(r)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new wt({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new wt(t)}}class wt extends Error{constructor(e){let t=e.type,n=e.status,o=e.title,r=e.detail,i=e.validation_errors;super(r),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=r,this.validation_errors=i,Object.setPrototypeOf(this,wt.prototype)}}const gt={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}};var vt,bt;let kt;if("undefined"==typeof navigator||null===(vt=navigator.userAgent)||void 0===vt||null===(bt=vt.startsWith)||void 0===bt||!bt.call(vt,"Mozilla/5.0 ")){const e="v3.8.6";kt="".concat("oauth4webapi","/").concat(e)}function _t(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}const St="ERR_INVALID_ARG_VALUE",Tt="ERR_INVALID_ARG_TYPE";function Et(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}const Pt=Symbol(),At=Symbol(),Rt=Symbol(),Ct=Symbol(),It=Symbol(),xt=Symbol(),Ot=new TextEncoder,Wt=new TextDecoder;function jt(e){return"string"==typeof e?Ot.encode(e):Wt.decode(e)}let Ut,Kt;if(Uint8Array.prototype.toBase64)Ut=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Ut=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function Lt(e){return"string"==typeof e?Kt(e):Ut(e)}Kt=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw Et("The input to be decoded is not correctly encoded.",St,e)}}:e=>{try{const t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw Et("The input to be decoded is not correctly encoded.",St,e)}};class Nt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=Ln,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class Mt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function Dt(e,t,n){return new Mt(e,{code:t,cause:n})}function zt(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function Jt(e){_t(e,Headers)&&(e=Object.fromEntries(e.entries()));const t=new Headers(null!=e?e:{});if(kt&&!t.has("user-agent")&&t.set("user-agent",kt),t.has("authorization"))throw Et('"options.headers" must not include the "authorization" header name',St);return t}function Ht(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw Et('"options.signal" must return or be an instance of AbortSignal',Tt);return t}}function Zt(e){return e.includes("//")?e.replace("//","/"):e}function Ft(e,t,n,o,r){try{if("number"!=typeof e||!Number.isFinite(e))throw Et("".concat(n," must be a number"),Tt,r);if(e>0)return;if(t){if(0!==e)throw Et("".concat(n," must be a non-negative number"),St,r);return}throw Et("".concat(n," must be a positive number"),St,r)}catch(e){if(o)throw Dt(e.message,o,r);throw e}}function Vt(e,t,n,o){try{if("string"!=typeof e)throw Et("".concat(t," must be a string"),Tt,o);if(0===e.length)throw Et("".concat(t," must not be empty"),St,o)}catch(e){if(n)throw Dt(e.message,n,o);throw e}}function Gt(e){!function(e,t){if(bn(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];if(o.length>2){const e=o.pop();t+="".concat(o.join(", "),", or ").concat(e)}else 2===o.length?t+="".concat(o[0]," or ").concat(o[1]):t+=o[0];return Dt(t,zn,e)}(e,t)}(e,"application/json")}function Xt(){return Lt(crypto.getRandomValues(new Uint8Array(32)))}function Yt(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new Nt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"RSASSA-PKCS1-v1_5":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new Nt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"ECDSA":return function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new Nt("unsupported EcKeyAlgorithm namedCurve",{cause:e})}}(e);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new Nt("unsupported CryptoKey algorithm name",{cause:e})}}function Bt(e){const t=null==e?void 0:e[At];return"number"==typeof t&&Number.isFinite(t)?t:0}function qt(e){const t=null==e?void 0:e[Rt];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function Qt(){return Math.floor(Date.now()/1e3)}function $t(e){if("object"!=typeof e||null===e)throw Et('"as" must be an object',Tt);Vt(e.issuer,'"as.issuer"')}function en(e){if("object"!=typeof e||null===e)throw Et('"client" must be an object',Tt);Vt(e.client_id,'"client.client_id"')}function tn(e){return Vt(e,'"clientSecret"'),(t,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",e)}}function nn(e,t){const n=(i=e)instanceof CryptoKey?{key:i}:(null==i?void 0:i.key)instanceof CryptoKey?(void 0!==i.kid&&Vt(i.kid,'"kid"'),{key:i.key,kid:i.kid}):{},o=n.key,r=n.kid;var i;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw Et("".concat(t," must be a CryptoKey"),Tt)}(e,t),"private"!==e.type)throw Et("".concat(t," must be a private CryptoKey"),St)}(o,'"clientPrivateKey.key"'),async(e,n,i,a)=>{var s;const c={alg:Yt(o),kid:r},u=function(e,t){const n=Qt()+Bt(t);return{jti:Xt(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,n);null==t||null===(s=t[It])||void 0===s||s.call(t,c,u),i.set("client_id",n.client_id),i.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),i.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw Et('CryptoKey instances used for signing assertions must include "sign" in their "usages"',St);const o="".concat(Lt(jt(JSON.stringify(e))),".").concat(Lt(jt(JSON.stringify(t)))),r=Lt(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:$n(e)};case"RSA-PSS":switch(Qn(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new Nt("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return Qn(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new Nt("unsupported CryptoKey algorithm name",{cause:e})}(n),n,jt(o)));return"".concat(o,".").concat(r)}(c,u,o))}}const on=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function rn(e,t){if(t&&"https:"!==e.protocol)throw Dt("only requests to HTTPS are allowed",Hn,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw Dt("only HTTP and HTTPS requests are allowed",Zn,e)}function an(e,t,n,o){let r;if("string"!=typeof e||!(r=on(e)))throw Dt("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?Xn:Yn,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return rn(r,o),r}function sn(e,t,n,o){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?an(e.mtls_endpoint_aliases[t],t,n,o):an(e[t],t,n,o)}class cn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"status",void 0),v(this,"error_description",void 0),v(this,"response",void 0),this.name=this.constructor.name,this.code=Kn,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class un extends Error{constructor(e,t){var n,o;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"error_description",void 0),this.name=this.constructor.name,this.code=Nn,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!==(n=t.cause.get("error_description"))&&void 0!==n?n:void 0,null===(o=Error.captureStackTrace)||void 0===o||o.call(Error,this,this.constructor)}}class ln extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"response",void 0),v(this,"status",void 0),this.name=this.constructor.name,this.code=Un,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}const hn="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",dn="("+hn+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"',pn="("+hn+")\\s*=\\s*("+hn+")",fn=new RegExp("^[,\\s]*("+hn+")"),mn=new RegExp("^[,\\s]*"+dn+"[,\\s]*(.*)"),yn=new RegExp("^[,\\s]*"+pn+"[,\\s]*(.*)"),wn=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function gn(e,t,n){if(e.status!==t){let t;var o;if(function(e){let t;if(t=function(e){if(!_t(e,Response))throw Et('"response" must be an instance of Response',Tt);const t=e.headers.get("www-authenticate");if(null===t)return;const n=[];let o=t;for(;o;){var r;let t=o.match(fn);const c=null===(r=t)||void 0===r?void 0:r[1].toLowerCase();if(!c)return;const u=o.substring(t[0].length);if(u&&!u.match(/^[\s,]/))return;const l=u.match(/^\s+(.*)$/),h=!!l;o=l?l[1]:void 0;const d={};let p;if(h)for(;o;){let n,r;if(t=o.match(mn)){var i=S(t,4);if(n=i[1],r=i[2],o=i[3],r.includes("\\"))try{r=JSON.parse('"'.concat(r,'"'))}catch(e){}d[n.toLowerCase()]=r}else{if(!(t=o.match(yn))){if(t=o.match(wn)){if(Object.keys(d).length)break;var a=S(t,3);p=a[1],o=a[2];break}return}var s=S(t,4);n=s[1],r=s[2],o=s[3],d[n.toLowerCase()]=r}}else o=u||void 0;const f={scheme:c,parameters:d};p&&(f.token68=p),n.push(f)}return n.length?n:void 0}(e))throw new ln("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}(e),t=await async function(e){if(e.status>399&&e.status<500){qn(e),Gt(e);try{const t=await e.clone().json();if(zt(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await(null===(o=e.body)||void 0===o?void 0:o.cancel()),new cn("server responded with an error in the response body",{cause:t,response:e});throw Dt('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),Jn,e)}}function vn(e){if(!Cn.has(e))throw Et('"options.DPoP" is not a valid DPoPHandle',St)}function bn(e){var t;return null===(t=e.headers.get("content-type"))||void 0===t?void 0:t.split(";")[0]}async function kn(e,t,n,o,r,i,a){return await n(e,t,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==a?void 0:a[Ct])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Ht(o,null==a?void 0:a.signal)})}async function _n(e,t,n,o,r,i){var a;const s=sn(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[Pt]));r.set("grant_type",o);const c=Jt(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(vn(i.DPoP),await i.DPoP.addProof(s,c,"POST"));const u=await kn(e,t,n,s,r,c,i);return null==i||null===(a=i.DPoP)||void 0===a||a.cacheNonce(u,s),u}const Sn=new WeakMap,Tn=new WeakMap;function En(e){if(!e.id_token)return;const t=Sn.get(e);if(!t)throw Et('"ref" was already garbage collected or did not resolve from the proper sources',St);return t}async function Pn(e,t,n,o,r,i){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,200,"Token Endpoint"),qn(n);const a=await ro(n);if(Vt(a.access_token,'"response" body "access_token" property',Dn,{body:a}),Vt(a.token_type,'"response" body "token_type" property',Dn,{body:a}),a.token_type=a.token_type.toLowerCase(),void 0!==a.expires_in){let e="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;Ft(e,!0,'"response" body "expires_in" property',Dn,{body:a}),a.expires_in=e}if(void 0!==a.refresh_token&&Vt(a.refresh_token,'"response" body "refresh_token" property',Dn,{body:a}),void 0!==a.scope&&"string"!=typeof a.scope)throw Dt('"response" body "scope" property must be a string',Dn,{body:a});if(void 0!==a.id_token){Vt(a.id_token,'"response" body "id_token" property',Dn,{body:a});const i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(Ft(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=o&&o.length&&i.push(...o);const s=await async function(e,t,n,o,r){let i,a,s=e.split("."),c=s[0],u=s[1],l=s.length;if(5===l){if(void 0===r)throw new Nt("JWE decryption is not configured",{cause:e});var h=(e=await r(e)).split(".");c=h[0],u=h[1],l=h.length}if(3!==l)throw Dt("Invalid JWT",Dn,e);try{i=JSON.parse(jt(Lt(c)))}catch(e){throw Dt("failed to parse JWT Header body as base64url encoded JSON",Mn,e)}if(!zt(i))throw Dt("JWT Header must be a top level object",Dn,e);if(t(i),void 0!==i.crit)throw new Nt('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{a=JSON.parse(jt(Lt(u)))}catch(e){throw Dt("failed to parse JWT Payload body as base64url encoded JSON",Mn,e)}if(!zt(a))throw Dt("JWT Payload must be a top level object",Dn,e);const d=Qt()+n;if(void 0!==a.exp){if("number"!=typeof a.exp)throw Dt('unexpected JWT "exp" (expiration time) claim type',Dn,{claims:a});if(a.exp<=d-o)throw Dt('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',Fn,{claims:a,now:d,tolerance:o,claim:"exp"})}if(void 0!==a.iat&&"number"!=typeof a.iat)throw Dt('unexpected JWT "iat" (issued at) claim type',Dn,{claims:a});if(void 0!==a.iss&&"string"!=typeof a.iss)throw Dt('unexpected JWT "iss" (issuer) claim type',Dn,{claims:a});if(void 0!==a.nbf){if("number"!=typeof a.nbf)throw Dt('unexpected JWT "nbf" (not before) claim type',Dn,{claims:a});if(a.nbf>d+o)throw Dt('unexpected JWT "nbf" (not before) claim value',Fn,{claims:a,now:d,tolerance:o,claim:"nbf"})}if(void 0!==a.aud&&"string"!=typeof a.aud&&!Array.isArray(a.aud))throw Dt('unexpected JWT "aud" (audience) claim type',Dn,{claims:a});return{header:i,claims:a,jwt:e}}(a.id_token,eo.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),Bt(t),qt(t),r).then(On.bind(void 0,i)).then(Rn.bind(void 0,e)).then(An.bind(void 0,t.client_id)),c=s.claims,u=s.jwt;if(Array.isArray(c.aud)&&1!==c.aud.length){if(void 0===c.azp)throw Dt('ID Token "aud" (audience) claim includes additional untrusted audiences',Vn,{claims:c,claim:"aud"});if(c.azp!==t.client_id)throw Dt('unexpected ID Token "azp" (authorized party) claim value',Vn,{expected:t.client_id,claims:c,claim:"azp"})}void 0!==c.auth_time&&Ft(c.auth_time,!0,'ID Token "auth_time" (authentication time)',Dn,{claims:c}),Tn.set(n,u),Sn.set(a,c)}if(void 0!==(null==i?void 0:i[a.token_type]))i[a.token_type](n,a);else if("dpop"!==a.token_type&&"bearer"!==a.token_type)throw new Nt("unsupported `token_type` value",{cause:{body:a}});return a}function An(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw Dt('unexpected JWT "aud" (audience) claim value',Vn,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw Dt('unexpected JWT "aud" (audience) claim value',Vn,{expected:e,claims:t.claims,claim:"aud"});return t}function Rn(e,t){var n,o;const r=null!==(n=null===(o=e[ao])||void 0===o?void 0:o.call(e,t))&&void 0!==n?n:e.issuer;if(t.claims.iss!==r)throw Dt('unexpected JWT "iss" (issuer) claim value',Vn,{expected:r,claims:t.claims,claim:"iss"});return t}const Cn=new WeakSet,In=Symbol(),xn={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function On(e,t){for(const n of e)if(void 0===t.claims[n])throw Dt('JWT "'.concat(n,'" (').concat(xn[n],") claim missing"),Dn,{claims:t.claims});return t}const Wn=Symbol(),jn=Symbol();const Un="OAUTH_WWW_AUTHENTICATE_CHALLENGE",Kn="OAUTH_RESPONSE_BODY_ERROR",Ln="OAUTH_UNSUPPORTED_OPERATION",Nn="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Mn="OAUTH_PARSE_ERROR",Dn="OAUTH_INVALID_RESPONSE",zn="OAUTH_RESPONSE_IS_NOT_JSON",Jn="OAUTH_RESPONSE_IS_NOT_CONFORM",Hn="OAUTH_HTTP_REQUEST_FORBIDDEN",Zn="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",Fn="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",Vn="OAUTH_JWT_CLAIM_COMPARISON_FAILED",Gn="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",Xn="OAUTH_MISSING_SERVER_METADATA",Yn="OAUTH_INVALID_SERVER_METADATA";async function Bn(e){if(!_t(e,Response))throw Et('"response" must be an instance of Response',Tt);await gn(e,200,"Revocation Endpoint")}function qn(e){if(e.bodyUsed)throw Et('"response" body has been used already',St)}function Qn(e){const t=e.algorithm;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new Nt("unsupported ".concat(t.name," modulusLength"),{cause:e})}function $n(e){switch(e.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new Nt("unsupported ECDSA namedCurve",{cause:e})}}function eo(e,t,n,o){if(void 0===e)if(Array.isArray(t)){if(!t.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw Dt('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?o.alg!==n:"function"==typeof n?!n(o.alg):!n.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:n,reason:"default value"})}else if("string"==typeof e?o.alg!==e:!e.includes(o.alg))throw Dt('unexpected JWT "alg" header parameter',Dn,{header:o,expected:e,reason:"client configuration"})}function to(e,t){const n=e.getAll(t),o=n[0];if(n.length>1)throw Dt('"'.concat(t,'" parameter must be provided only once'),Dn);return o}const no=Symbol(),oo=Symbol();async function ro(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Gt;try{t=await e.json()}catch(t){throw n(e),Dt('failed to parse "response" body as JSON',Mn,t)}if(!zt(t))throw Dt('"response" body must be a top level object',Dn,{body:t});return t}const io=Symbol(),ao=Symbol(),so=new TextEncoder,co=new TextDecoder;function uo(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.reduce((e,t)=>e+t.length,0),r=new Uint8Array(o);let i=0;for(const e of t)r.set(e,i),i+=e.length;return r}function lo(e){const t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){const o=e.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");t[n]=o}return t}function ho(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);const t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}function po(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64("string"==typeof e?e:co.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=co.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/");try{return ho(t)}catch(e){throw new TypeError("The input to be decoded is not correctly encoded.")}}function fo(e){let t=e;return"string"==typeof t&&(t=so.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:!0}):function(e){if(Uint8Array.prototype.toBase64)return e.toBase64();const t=[];for(let n=0;n<e.length;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join(""))}(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}const mo=function(e){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))},yo=(e,t)=>e.name===t;function wo(e,t){var n;if(n=e.hash,parseInt(n.name.slice(4),10)!==t)throw mo("SHA-".concat(t),"algorithm.hash")}function go(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if((o=o.filter(Boolean)).length>2){const t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");if(null==t)e+=" Received ".concat(t);else if("function"==typeof t&&t.name)e+=" Received function ".concat(t.name);else if("object"==typeof t&&null!=t){var i;null!==(i=t.constructor)&&void 0!==i&&i.name&&(e+=" Received an instance of ".concat(t.constructor.name))}return e}const vo=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return go("Key for the ".concat(e," algorithm must be "),t,...o)};class bo extends Error{constructor(e,t){var n;super(e,t),v(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}v(bo,"code","ERR_JOSE_GENERIC");class ko extends bo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(ko,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class _o extends bo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_EXPIRED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(_o,"code","ERR_JWT_EXPIRED");class So extends bo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}v(So,"code","ERR_JOSE_ALG_NOT_ALLOWED");class To extends bo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_NOT_SUPPORTED")}}v(To,"code","ERR_JOSE_NOT_SUPPORTED"),v(class extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),v(class extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class Eo extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWS_INVALID")}}v(Eo,"code","ERR_JWS_INVALID");class Po extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWT_INVALID")}}v(Po,"code","ERR_JWT_INVALID"),v(class extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Ao extends bo{constructor(){super(...arguments),v(this,"code","ERR_JWKS_INVALID")}}v(Ao,"code","ERR_JWKS_INVALID");class Ro extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}v(Ro,"code","ERR_JWKS_NO_MATCHING_KEY");class Co extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,Symbol.asyncIterator,void 0),v(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}v(Co,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class Io extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_TIMEOUT")}}v(Io,"code","ERR_JWKS_TIMEOUT");class xo extends bo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}v(xo,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const Oo=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}},Wo=e=>"KeyObject"===(null==e?void 0:e[Symbol.toStringTag]),jo=e=>Oo(e)||Wo(e);function Uo(e,t){if(e)throw new TypeError("".concat(t," can only be called once"))}function Ko(e,t,n){try{return po(e)}catch(e){throw new n("Failed to base64url decode the ".concat(t))}}function Lo(e){if("object"!=typeof(t=e)||null===t||"[object Object]"!==Object.prototype.toString.call(e))return!1;var t;if(null===Object.getPrototypeOf(e))return!0;let n=e;for(;null!==Object.getPrototypeOf(n);)n=Object.getPrototypeOf(n);return Object.getPrototypeOf(e)===n}function No(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.filter(Boolean);if(0===o.length||1===o.length)return!0;let r;for(const e of o){const t=Object.keys(e);if(r&&0!==r.size)for(const e of t){if(r.has(e))return!1;r.add(e)}else r=new Set(t)}return!0}const Mo=e=>Lo(e)&&"string"==typeof e.kty;function Do(e,t){if(e.startsWith("RS")||e.startsWith("PS")){const n=t.algorithm.modulusLength;if("number"!=typeof n||n<2048)throw new TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}}function zo(e,t){const n="SHA-".concat(e.slice(-3));switch(e){case"HS256":case"HS384":case"HS512":return{hash:n,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:n,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:n,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:n,name:"ECDSA",namedCurve:t.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:e};default:throw new To("alg ".concat(e," is not supported either by JOSE or your javascript runtime"))}}async function Jo(e,t,n){if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o<t;o++)n[o-1]=arguments[o];return go("Key must be ",e,...n)}(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:"SHA-".concat(e.slice(-3)),name:"HMAC"},!1,[n])}return function(e,t,n){switch(t){case"HS256":case"HS384":case"HS512":if(!yo(e.algorithm,"HMAC"))throw mo("HMAC");wo(e.algorithm,parseInt(t.slice(2),10));break;case"RS256":case"RS384":case"RS512":if(!yo(e.algorithm,"RSASSA-PKCS1-v1_5"))throw mo("RSASSA-PKCS1-v1_5");wo(e.algorithm,parseInt(t.slice(2),10));break;case"PS256":case"PS384":case"PS512":if(!yo(e.algorithm,"RSA-PSS"))throw mo("RSA-PSS");wo(e.algorithm,parseInt(t.slice(2),10));break;case"Ed25519":case"EdDSA":if(!yo(e.algorithm,"Ed25519"))throw mo("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":if(!yo(e.algorithm,t))throw mo(t);break;case"ES256":case"ES384":case"ES512":{if(!yo(e.algorithm,"ECDSA"))throw mo("ECDSA");const n=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}(t);if(e.algorithm.namedCurve!==n)throw mo(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(t,"."))}(e,n)}(t,e,n),t}const Ho='Invalid or unsupported JWK "alg" (Algorithm) Parameter value';async function Zo(e){var t,n;if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const o=function(e){let t,n;switch(e.kty){case"AKP":switch(e.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":t={name:e.alg},n=e.priv?["sign"]:["verify"];break;default:throw new To(Ho)}break;case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e.alg.slice(-3))},n=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(e.alg.slice(-3),10)||1)},n=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new To(Ho)}break;case"EC":switch(e.alg){case"ES256":case"ES384":case"ES512":t={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[e.alg]},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new To(Ho)}break;case"OKP":switch(e.alg){case"Ed25519":case"EdDSA":t={name:"Ed25519"},n=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},n=e.d?["deriveBits"]:[];break;default:throw new To(Ho)}break;default:throw new To('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:n}}(e),r=o.algorithm,i=o.keyUsages,a=k({},e);return"AKP"!==a.kty&&delete a.alg,delete a.use,crypto.subtle.importKey("jwk",a,r,null!==(t=e.ext)&&void 0!==t?t:!e.d&&!e.priv,null!==(n=e.key_ops)&&void 0!==n?n:i)}const Fo="given KeyObject instance cannot be used for this algorithm";let Vo;const Go=async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];Vo||(Vo=new WeakMap);let r=Vo.get(e);if(null!=r&&r[n])return r[n];const i=await Zo(k(k({},t),{},{alg:n}));return o&&Object.freeze(e),r?r[n]=i:Vo.set(e,{[n]:i}),i};async function Xo(e,t){if(e instanceof Uint8Array)return e;if(Oo(e))return e;if(Wo(e)){if("secret"===e.type)return e.export();if("toCryptoKey"in e&&"function"==typeof e.toCryptoKey)try{return((e,t)=>{Vo||(Vo=new WeakMap);let n=Vo.get(e);if(null!=n&&n[t])return n[t];const o="public"===e.type,r=!!o;let i;if("x25519"===e.asymmetricKeyType){switch(t){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Fo)}i=e.toCryptoKey(e.asymmetricKeyType,r,o?[]:["deriveBits"])}if("ed25519"===e.asymmetricKeyType){if("EdDSA"!==t&&"Ed25519"!==t)throw new TypeError(Fo);i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}switch(e.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError(Fo);i=e.toCryptoKey(e.asymmetricKeyType,r,[o?"verify":"sign"])}if("rsa"===e.asymmetricKeyType){let n;switch(t){case"RSA-OAEP":n="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":n="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":n="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":n="SHA-512";break;default:throw new TypeError(Fo)}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:n},r,o?["encrypt"]:["decrypt"]);i=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:n},r,[o?"verify":"sign"])}if("ec"===e.asymmetricKeyType){var a;const n=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(null===(a=e.asymmetricKeyDetails)||void 0===a?void 0:a.namedCurve);if(!n)throw new TypeError(Fo);const s={ES256:"P-256",ES384:"P-384",ES512:"P-521"};s[t]&&n===s[t]&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:n},r,[o?"verify":"sign"])),t.startsWith("ECDH-ES")&&(i=e.toCryptoKey({name:"ECDH",namedCurve:n},r,o?[]:["deriveBits"]))}if(!i)throw new TypeError(Fo);return n?n[t]=i:Vo.set(e,{[t]:i}),i})(e,t)}catch(e){if(e instanceof TypeError)throw e}let n=e.export({format:"jwk"});return Go(e,n,t)}if(Mo(e))return e.k?po(e.k):Go(e,e,t,!0);throw new Error("unreachable")}const Yo=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},Bo=e=>{const t=e.data[e.pos++];if(128&t){const n=127&t;let o=0;for(let t=0;t<n;t++)o=o<<8|e.data[e.pos++];return o}return t},qo=(e,t,n)=>{if(e.data[e.pos++]!==t)throw new Error(n)},Qo=(e,t)=>{const n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},$o=(e,t,n)=>{var o;const r=(e=>ho(e.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"")))(e);let i=n;return null!=t&&null!==(o=t.startsWith)&&void 0!==o&&o.call(t,"ECDH-ES")&&(i||(i={}),i.getNamedCurve=e=>{const t={data:e,pos:0};return function(e){qo(e,48,"Invalid PKCS#8 structure"),Bo(e),qo(e,2,"Expected version field");const t=Bo(e);e.pos+=t,qo(e,48,"Expected algorithm identifier"),Bo(e),e.pos}(t),(e=>{const t=(e=>{qo(e,6,"Expected algorithm OID");const t=Bo(e);return Qo(e,t)})(e);if(Yo(t,[43,101,110]))return"X25519";if(!Yo(t,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");qo(e,6,"Expected curve OID");const n=Bo(e),o=Qo(e,n);for(const e of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}]){const t=e.name,n=e.oid;if(Yo(o,n))return t}throw new Error("Unsupported named curve")})(t)}),(async(e,t,n,o)=>{var r;let i,a;const s="spki"===e,c=()=>s?["verify"]:["sign"];switch(n){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(n.slice(-3))},a=c();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(n.slice(-3),10)||1)},a=s?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[n]},a=c();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{const e=o.getNamedCurve(t);i="X25519"===e?{name:"X25519"}:{name:"ECDH",namedCurve:e}}catch(e){throw new To("Invalid or unsupported key format")}a=s?[]:["deriveBits"];break;case"Ed25519":case"EdDSA":i={name:"Ed25519"},a=c();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:n},a=c();break;default:throw new To('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(e,t,i,null!==(r=null==o?void 0:o.extractable)&&void 0!==r?r:!!s,a)})("pkcs8",r,t,i)};async function er(e,t,n){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return $o(e,t,n)}function tr(e,t,n,o,r){if(void 0!==r.crit&&void 0===(null==o?void 0:o.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!o||void 0===o.crit)return new Set;if(!Array.isArray(o.crit)||0===o.crit.length||o.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i;i=void 0!==n?new Map([...Object.entries(n),...t.entries()]):t;for(const t of o.crit){if(!i.has(t))throw new To('Extension Header Parameter "'.concat(t,'" is not recognized'));if(void 0===r[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i.get(t)&&void 0===o[t])throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return new Set(o.crit)}const nr=e=>null==e?void 0:e[Symbol.toStringTag],or=(e,t,n)=>{if(void 0!==t.use){let e;switch(n){case"sign":case"verify":e="sig";break;case"encrypt":case"decrypt":e="enc"}if(t.use!==e)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==e)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(e,'" when present'));if(Array.isArray(t.key_ops)){var o,r;let i;switch(!0){case"sign"===n||"verify"===n:case"dir"===e:case e.includes("CBC-HS"):i=n;break;case e.startsWith("PBES2"):i="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(e):i=!e.includes("GCM")&&e.endsWith("KW")?"encrypt"===n?"wrapKey":"unwrapKey":n;break;case"encrypt"===n&&e.startsWith("RSA"):i="wrapKey";break;case"decrypt"===n:i=e.startsWith("RSA")?"unwrapKey":"deriveBits"}if(i&&!1===(null===(o=t.key_ops)||void 0===o||null===(r=o.includes)||void 0===r?void 0:r.call(o,i)))throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(i,'" when present'))}return!0};function rr(e,t,n){switch(e.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((e,t,n)=>{if(!(t instanceof Uint8Array)){if(Mo(t)){if((e=>"oct"===e.kty&&"string"==typeof e.k)(t)&&or(e,t,n))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!jo(t))throw new TypeError(vo(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if("secret"!==t.type)throw new TypeError("".concat(nr(t),' instances for symmetric algorithms must be of type "secret"'))}})(e,t,n);break;default:((e,t,n)=>{if(Mo(t))switch(n){case"decrypt":case"sign":if((e=>"oct"!==e.kty&&("AKP"===e.kty&&"string"==typeof e.priv||"string"==typeof e.d))(t)&&or(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if((e=>"oct"!==e.kty&&void 0===e.d&&void 0===e.priv)(t)&&or(e,t,n))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!jo(t))throw new TypeError(vo(e,t,"CryptoKey","KeyObject","JSON Web Key"));if("secret"===t.type)throw new TypeError("".concat(nr(t),' instances for asymmetric algorithms must not be of type "secret"'));if("public"===t.type)switch(n){case"sign":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm signing must be of type "private"'));case"decrypt":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm decryption must be of type "private"'))}if("private"===t.type)switch(n){case"verify":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm verifying must be of type "public"'));case"encrypt":throw new TypeError("".concat(nr(t),' instances for asymmetric algorithm encryption must be of type "public"'))}})(e,t,n)}}var ir,ar;let sr,cr;if("undefined"==typeof navigator||null===(ir=navigator.userAgent)||void 0===ir||null===(ar=ir.startsWith)||void 0===ar||!ar.call(ir,"Mozilla/5.0 ")){const e="v6.8.4";cr="".concat("openid-client","/").concat(e),sr={"user-agent":cr}}const ur=e=>lr.get(e);let lr,hr;function dr(e){return void 0!==e?tn(e):(hr||(hr=new WeakMap),(e,t,n,o)=>{let r;return(r=hr.get(t))||(function(e,t){if("string"!=typeof e)throw yr("".concat(t," must be a string"),mr);if(0===e.length)throw yr("".concat(t," must not be empty"),fr)}(t.client_secret,'"metadata.client_secret"'),r=tn(t.client_secret),hr.set(t,r)),r(e,t,n,o)})}const pr=Ct,fr="ERR_INVALID_ARG_VALUE",mr="ERR_INVALID_ARG_TYPE";function yr(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}class wr extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function gr(e,t,n){return new wr(e,{cause:t,code:n})}function vr(e){if(e instanceof TypeError||e instanceof wr||e instanceof cn||e instanceof un||e instanceof ln)throw e;if(e instanceof Mt)switch(e.code){case Hn:throw gr("only requests to HTTPS are allowed",e,e.code);case Zn:throw gr("only requests to HTTP or HTTPS are allowed",e,e.code);case Jn:throw gr("unexpected HTTP response status code",e.cause,e.code);case zn:throw gr("unexpected response content-type",e.cause,e.code);case Mn:throw gr("parsing error occured",e,e.code);case Dn:throw gr("invalid response encountered",e,e.code);case Vn:throw gr("unexpected JWT claim value encountered",e,e.code);case Gn:throw gr("unexpected JSON attribute value encountered",e,e.code);case Fn:throw gr("JWT timestamp claim value failed validation",e,e.code);default:throw gr(e.message,e,e.code)}if(e instanceof Nt)throw gr("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw gr("runtime operation error",e,Ln);case"NotSupportedError":throw gr("runtime unsupported operation",e,Ln);case"TimeoutError":throw gr("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw gr("operation aborted",e,"OAUTH_ABORT")}throw new wr("something went wrong",{cause:e})}async function br(e,t,n,o,r){const i=await async function(e,t){var n,o;if(!(e instanceof URL))throw yr('"server" must be an instance of URL',mr);const r=!e.href.includes("/.well-known/"),i=null!==(n=null==t?void 0:t.timeout)&&void 0!==n?n:30,a=AbortSignal.timeout(1e3*i),s=await(r?async function(e,t){return async function(e,t,n,o){if(!(e instanceof URL))throw Et('"'.concat("issuerIdentifier",'" must be an instance of URL'),Tt);rn(e,!0!==(null==o?void 0:o[Pt]));const r=n(new URL(e.href)),i=Jt(null==o?void 0:o.headers);return i.set("accept","application/json"),((null==o?void 0:o[Ct])||fetch)(r.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:Ht(r,null==o?void 0:o.signal)})}(e,0,e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":!function(e){e.pathname=Zt("".concat(e.pathname,"/").concat(".well-known/openid-configuration"))}(e);break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=Zt("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw Et('"options.algorithm" must be "oidc" (default), or "oauth2"',St)}return e},t)}(e,{algorithm:null==t?void 0:t.algorithm,[Ct]:null==t?void 0:t[pr],[Pt]:null==t||null===(o=t.execute)||void 0===o?void 0:o.includes(Rr),signal:a,headers:new Headers(sr)}):((null==t?void 0:t[pr])||fetch)((rn(e,null==t||null===(c=t.execute)||void 0===c||!c.includes(Rr)),e.href),{headers:Object.fromEntries(new Headers(k({accept:"application/json"},sr)).entries()),body:void 0,method:"GET",redirect:"manual",signal:a})).then(e=>async function(e,t){const n=e;if(!(n instanceof URL)&&n!==io)throw Et('"expectedIssuerIdentifier" must be an instance of URL',Tt);if(!_t(t,Response))throw Et('"response" must be an instance of Response',Tt);if(200!==t.status)throw Dt('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Jn,t);qn(t);const o=await ro(t);if(Vt(o.issuer,'"response" body "issuer" property',Dn,{body:o}),n!==io&&new URL(o.issuer).href!==n.href)throw Dt('"response" body "issuer" property does not match the expected value',Gn,{expected:n.href,body:o,attribute:"issuer"});return o}(io,e)).catch(vr);var c;return r&&new URL(s.issuer).href!==e.href&&(function(e,t,n){return!("https://login.microsoftonline.com"!==e.origin||null!=n&&n.algorithm&&"oidc"!==n.algorithm||(t[kr]=!0,0))}(e,s,t)||function(e,t){return!(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)}(e,t)||(()=>{throw new wr("discovered metadata issuer does not match the expected issuer",{code:Gn,cause:{expected:e.href,body:s,attribute:"issuer"}})})()),s}(e,r),a=new _r(i,t,n,o);let s=ur(a);if(null!=r&&r[pr]&&(s.fetch=r[pr]),null!=r&&r.timeout&&(s.timeout=r.timeout),null!=r&&r.execute)for(const e of r.execute)e(a);return a}new TextDecoder;const kr=Symbol();class _r{constructor(e,t,n,o){var r,i,a,s,c;if("string"!=typeof t||!t.length)throw yr('"clientId" must be a non-empty string',mr);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null===(r=n)||void 0===r?void 0:r.client_id)&&t!==n.client_id)throw yr('"clientId" and "metadata.client_id" must be the same',fr);const u=k(k({},structuredClone(n)),{},{client_id:t});let l;u[At]=null!==(i=null===(a=n)||void 0===a?void 0:a[At])&&void 0!==i?i:0,u[Rt]=null!==(s=null===(c=n)||void 0===c?void 0:c[Rt])&&void 0!==s?s:30,l=o||("string"==typeof u.client_secret&&u.client_secret.length?dr(u.client_secret):(e,t,n,o)=>{n.set("client_id",t.client_id)});let h=Object.freeze(u);const d=structuredClone(e);kr in e&&(d[ao]=t=>{let n=t.claims.tid;return e.issuer.replace("{tenantid}",n)});let p=Object.freeze(d);lr||(lr=new WeakMap),lr.set(this,{__proto__:null,as:p,c:h,auth:l,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(ur(this).as);return function(e){Object.defineProperties(e,function(e){return{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null===(t=e.code_challenge_methods_supported)||void 0===t?void 0:t.includes(n))}}}}(e))}(e),e}clientMetadata(){return structuredClone(ur(this).c)}get timeout(){return ur(this).timeout}set timeout(e){ur(this).timeout=e}get[pr](){return ur(this).fetch}set[pr](e){ur(this).fetch=e}}function Sr(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return En(this)}catch(e){return}}}}}(e))}async function Tr(e,t,n){var o;let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const i=null===(o=e.headers.get("retry-after"))||void 0===o?void 0:o.trim();if(void 0===i)return;let a;if(/^\d+$/.test(i))a=parseInt(i,10);else{const e=new Date(i);if(Number.isFinite(e.getTime())){const t=new Date,n=e.getTime()-t.getTime();n>0&&(a=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(a))throw new Mt("invalid Retry-After header value",{cause:e});a>t&&await Er(a-t,n)}function Er(e,t){return new Promise((n,o)=>{const r=e=>{try{t.throwIfAborted()}catch(e){return void o(e)}if(e<=0)return void n();const i=Math.min(e,5);setTimeout(()=>r(e-i),1e3*i)};r(e)})}async function Pr(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=n.auth,a=n.fetch,s=n.tlsOnly,c=n.timeout;return async function(e,t,n,o,r){$t(e),en(t);const i=sn(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),a=new URLSearchParams(o);a.set("client_id",t.client_id);const s=Jt(null==r?void 0:r.headers);return s.set("accept","application/json"),kn(e,t,n,i,a,s,r)}(o,r,i,t,{[Ct]:a,[Pt]:!s,headers:new Headers(sr),signal:Ur(c)}).then(e=>async function(e,t,n){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,200,"Backchannel Authentication Endpoint"),qn(n);const o=await ro(n);Vt(o.auth_req_id,'"response" body "auth_req_id" property',Dn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Ft(r,!0,'"response" body "expires_in" property',Dn,{body:o}),o.expires_in=r,void 0!==o.interval&&Ft(o.interval,!1,'"response" body "interval" property',Dn,{body:o}),o}(o,r,e)).catch(vr)}async function Ar(e,t,n,o){var r,i;jr(e),n=new URLSearchParams(n);let a=null!==(r=t.interval)&&void 0!==r?r:5;const s=null!==(i=null==o?void 0:o.signal)&&void 0!==i?i:AbortSignal.timeout(1e3*t.expires_in);try{await Er(a,s)}catch(e){vr(e)}const c=ur(e),u=c.as,l=c.c,h=c.auth,d=c.fetch,p=c.tlsOnly,f=c.nonRepudiation,m=c.timeout,y=c.decrypt,w=(r,i)=>Ar(e,k(k({},t),{},{interval:r}),n,k(k({},o),{},{signal:s,flag:i})),g=function(e,t){const n=Ur(t);if(!n)return{signal:e,cleanup(){}};const o=new AbortController,r=e=>{const t=e.target;o.abort(t.reason)};return e.aborted?o.abort(e.reason):n.aborted?o.abort(n.reason):(e.addEventListener("abort",r,{once:!0}),n.addEventListener("abort",r,{once:!0})),{signal:o.signal,cleanup(){e.removeEventListener("abort",r),n.removeEventListener("abort",r)}}}(s,m),v=await async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"authReqId"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("auth_req_id",o),_n(e,t,n,"urn:openid:params:grant-type:ciba",i,r)}(u,l,h,t.auth_req_id,{[Ct]:d,[Pt]:!p,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:g.signal}).catch(vr).finally(g.cleanup);var b;if(503===v.status&&v.headers.has("retry-after"))return await Tr(v,a,s,!0),await(null===(b=v.body)||void 0===b?void 0:b.cancel()),w(a);const _=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(u,l,v,{[xt]:y});let S;try{S=await _}catch(e){if(Kr(e,o))return w(a,Lr);if(e instanceof cn)switch(e.error){case"slow_down":a+=5;case"authorization_pending":return await Tr(e.response,a,s),w(a)}vr(e)}return S.id_token&&await(null==f?void 0:f(v)),Sr(S),S}function Rr(e){ur(e).tlsOnly=!1}async function Cr(e,t,n,o,r){if(jr(e),!((null==r?void 0:r.flag)===Lr||t instanceof URL||function(e){try{return"Request"===Object.getPrototypeOf(e)[Symbol.toStringTag]}catch(e){return!1}}(t)))throw yr('"currentUrl" must be an instance of URL, or Request',mr);let i,a;const s=ur(e),c=s.as,u=s.c,l=s.auth,h=s.fetch,d=s.tlsOnly,p=s.jarm,f=s.hybrid,m=s.nonRepudiation,y=s.timeout,w=s.decrypt,g=s.implicit;if((null==r?void 0:r.flag)===Lr)i=r.authResponse,a=r.redirectUri;else{if(!(t instanceof URL)){const e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":const n=new URLSearchParams(await async function(e){if("POST"!==e.method)throw Et("form_post responses are expected to use the POST method",St,{cause:e});if("application/x-www-form-urlencoded"!==bn(e))throw Et("form_post responses are expected to use the application/x-www-form-urlencoded content-type",St,{cause:e});return async function(e){if(e.bodyUsed)throw Et("form_post Request instances must contain a readable body",St,{cause:e});return e.text()}(e)}(e));if(f)t.hash=n.toString();else for(const e of n.entries()){var v=S(e,2);const n=v[0],o=v[1];t.searchParams.append(n,o)}break;default:throw yr("unexpected Request HTTP method",fr)}}switch(a=function(e){return(e=new URL(e)).search="",e.hash="",e.href}(t),!0){case!!p:i=await p(t,null==n?void 0:n.expectedState);break;case!!f:i=await f(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!g:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,o){if($t(e),en(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw Et('"parameters" must be an instance of URLSearchParams, or URL',Tt);if(to(n,"response"))throw Dt('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',Dn,{parameters:n});const r=to(n,"iss"),i=to(n,"state");if(!r&&e.authorization_response_iss_parameter_supported)throw Dt('response parameter "iss" (issuer) missing',Dn,{parameters:n});if(r&&r!==e.issuer)throw Dt('unexpected "iss" (issuer) response parameter value',Dn,{expected:e.issuer,parameters:n});switch(o){case void 0:case oo:if(void 0!==i)throw Dt('unexpected "state" response parameter encountered',Dn,{expected:void 0,parameters:n});break;case no:break;default:if(Vt(o,'"expectedState" argument'),i!==o)throw Dt(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',Dn,{expected:o,parameters:n})}if(to(n,"error"))throw new un("authorization response from the server is an error",{cause:n});const a=to(n,"id_token"),s=to(n,"token");if(void 0!==a||void 0!==s)throw new Nt("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),Cn.add(c),c;var c}(c,u,t.searchParams,null==n?void 0:n.expectedState)}catch(e){vr(e)}}}const b=await async function(e,t,n,o,r,i,a){if($t(e),en(t),!Cn.has(o))throw Et('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',St);Vt(r,'"redirectUri"');const s=to(o,"code");if(!s)throw Dt('no authorization code in "callbackParameters"',Dn);const c=new URLSearchParams(null==a?void 0:a.additionalParameters);return c.set("redirect_uri",r),c.set("code",s),i!==In&&(Vt(i,'"codeVerifier"'),c.set("code_verifier",i)),_n(e,t,n,"authorization_code",c,a)}(c,u,l,i,a,(null==n?void 0:n.pkceCodeVerifier)||In,{additionalParameters:o,[Ct]:h,[Pt]:!d,DPoP:null==r?void 0:r.DPoP,headers:new Headers(sr),signal:Ur(y)}).catch(vr);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);const _=async function(e,t,n,o){return"string"==typeof(null==o?void 0:o.expectedNonce)||"number"==typeof(null==o?void 0:o.maxAge)||null!=o&&o.requireIdToken?async function(e,t,n,o,r,i,a){const s=[];switch(o){case void 0:o=Wn;break;case Wn:break;default:Vt(o,'"expectedNonce" argument'),s.push("nonce")}switch(null!=r||(r=t.default_max_age),r){case void 0:r=jn;break;case jn:break;default:Ft(r,!0,'"maxAge" argument'),s.push("auth_time")}const c=await Pn(e,t,n,s,i,a);Vt(c.id_token,'"response" body "id_token" property',Dn,{body:c});const u=En(c);if(r!==jn){const e=Qt()+Bt(t),n=qt(t);if(u.auth_time+r<e-n)throw Dt("too much time has elapsed since the last End-User authentication",Fn,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(o===Wn){if(void 0!==u.nonce)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==o)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:o,claims:u,claim:"nonce"});return c}(e,t,n,o.expectedNonce,o.maxAge,o[xt],o.recognizedTokenTypes):async function(e,t,n,o,r){const i=await Pn(e,t,n,void 0,o,r),a=En(i);if(a){if(void 0!==t.default_max_age){Ft(t.default_max_age,!0,'"client.default_max_age"');const e=Qt()+Bt(t),n=qt(t);if(a.auth_time+t.default_max_age<e-n)throw Dt("too much time has elapsed since the last End-User authentication",Fn,{claims:a,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==a.nonce)throw Dt('unexpected ID Token "nonce" claim value',Vn,{expected:void 0,claims:a,claim:"nonce"})}return i}(e,t,n,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(c,u,b,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[xt]:w});let T;try{T=await _}catch(t){if(Kr(t,r))return Cr(e,void 0,n,o,k(k({},r),{},{flag:Lr,authResponse:i,redirectUri:a}));vr(t)}return T.id_token&&await(null==m?void 0:m(b)),Sr(T),T}async function Ir(e,t,n,o){jr(e),n=new URLSearchParams(n);const r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.nonRepudiation,h=r.timeout,d=r.decrypt,p=await async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"refreshToken"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("refresh_token",o),_n(e,t,n,"refresh_token",i,r)}(i,a,s,t,{[Ct]:c,[Pt]:!u,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:Ur(h)}).catch(vr),f=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(i,a,p,{[xt]:d});let m;try{m=await f}catch(r){if(Kr(r,o))return Ir(e,t,n,k(k({},o),{},{flag:Lr}));vr(r)}return m.id_token&&await(null==l?void 0:l(p)),Sr(m),m}async function xr(e,t,n){jr(e),t=new URLSearchParams(t);const o=ur(e),r=o.as,i=o.c,a=o.auth,s=o.fetch,c=o.tlsOnly,u=o.timeout,l=await async function(e,t,n,o,r){return $t(e),en(t),_n(e,t,n,"client_credentials",new URLSearchParams(o),r)}(r,i,a,t,{[Ct]:s,[Pt]:!c,DPoP:null==n?void 0:n.DPoP,headers:new Headers(sr),signal:Ur(u)}).catch(vr),h=async function(e,t,n){return Pn(e,t,n,void 0,void 0,void 0)}(r,i,l);let d;try{d=await h}catch(o){if(Kr(o,n))return xr(e,t,k(k({},n),{},{flag:Lr}));vr(o)}return Sr(d),d}function Or(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=n.tlsOnly,a=n.hybrid,s=n.jarm,c=n.implicit,u=sn(o,"authorization_endpoint",!1,i);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",a?"code id_token":c?"id_token":"code"),c&&!t.has("nonce"))throw yr("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",fr);s&&t.set("response_mode","jwt")}for(const e of t.entries()){var l=S(e,2);const t=l[0],n=l[1];u.searchParams.append(t,n)}return u}async function Wr(e,t,n){jr(e);const o=Or(e,t),r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,h=await async function(e,t,n,o,r){var i;$t(e),en(t);const a=sn(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),s=new URLSearchParams(o);s.set("client_id",t.client_id);const c=Jt(null==r?void 0:r.headers);c.set("accept","application/json"),void 0!==(null==r?void 0:r.DPoP)&&(vn(r.DPoP),await r.DPoP.addProof(a,c,"POST"));const u=await kn(e,t,n,a,s,c,r);return null==r||null===(i=r.DPoP)||void 0===i||i.cacheNonce(u,a),u}(i,a,s,o.searchParams,{[Ct]:c,[Pt]:!u,DPoP:null==n?void 0:n.DPoP,headers:new Headers(sr),signal:Ur(l)}).catch(vr),d=async function(e,t,n){if($t(e),en(t),!_t(n,Response))throw Et('"response" must be an instance of Response',Tt);await gn(n,201,"Pushed Authorization Request Endpoint"),qn(n);const o=await ro(n);Vt(o.request_uri,'"response" body "request_uri" property',Dn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Ft(r,!0,'"response" body "expires_in" property',Dn,{body:o}),o.expires_in=r,o}(i,a,h);let p;try{p=await d}catch(o){if(Kr(o,n))return Wr(e,t,k(k({},n),{},{flag:Lr}));vr(o)}return Or(e,{request_uri:p.request_uri})}function jr(e){if(!(e instanceof _r))throw yr('"config" must be an instance of Configuration',mr);if(Object.getPrototypeOf(e)!==_r.prototype)throw yr("subclassing Configuration is not allowed",fr)}function Ur(e){return e?AbortSignal.timeout(1e3*e):void 0}function Kr(e,t){return!(null==t||!t.DPoP||t.flag===Lr)&&function(e){if(e instanceof ln){const t=e.cause,n=t[0];return 1===t.length&&"dpop"===n.scheme&&"use_dpop_nonce"===n.parameters.error}return e instanceof cn&&"use_dpop_nonce"===e.error}(e)}Object.freeze(_r.prototype);const Lr=Symbol();async function Nr(e,t,n,o){jr(e);const r=ur(e),i=r.as,a=r.c,s=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,h=r.decrypt,d=r.nonRepudiation,p=await async function(e,t,n,o,r,i){return $t(e),en(t),Vt(o,'"grantType"'),_n(e,t,n,o,new URLSearchParams(r),i)}(i,a,s,t,new URLSearchParams(n),{[Ct]:c,[Pt]:!u,DPoP:null==o?void 0:o.DPoP,headers:new Headers(sr),signal:Ur(l)}).catch(vr);let f;"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(f={n_a:()=>{}});const m=async function(e,t,n,o){return Pn(e,t,n,void 0,null==o?void 0:o[xt],null==o?void 0:o.recognizedTokenTypes)}(i,a,p,{[xt]:h,recognizedTokenTypes:f});let y;try{y=await m}catch(r){if(Kr(r,o))return Nr(e,t,n,k(k({},o),{},{flag:Lr}));vr(r)}return y.id_token&&await(null==d?void 0:d(p)),Sr(y),y}const Mr=e=>Math.floor(e.getTime()/1e3),Dr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function zr(e){const t=Dr.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");const n=parseFloat(t[2]);let o;switch(t[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":o=Math.round(n);break;case"minute":case"minutes":case"min":case"mins":case"m":o=Math.round(60*n);break;case"hour":case"hours":case"hr":case"hrs":case"h":o=Math.round(3600*n);break;case"day":case"days":case"d":o=Math.round(86400*n);break;case"week":case"weeks":case"w":o=Math.round(604800*n);break;default:o=Math.round(31557600*n)}return"-"===t[1]||"ago"===t[4]?-o:o}function Jr(e,t){if(!Number.isFinite(t))throw new TypeError("Invalid ".concat(e," input"));return t}const Hr=e=>e.includes("/")?e.toLowerCase():"application/".concat(e.toLowerCase());function Zr(e,t){let n,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{n=JSON.parse(co.decode(t))}catch(e){}if(!Lo(n))throw new Po("JWT Claims Set must be a top-level JSON object");const r=o.typ;if(r&&("string"!=typeof e.typ||Hr(e.typ)!==Hr(r)))throw new ko('unexpected "typ" JWT header value',n,"typ","check_failed");const i=o.requiredClaims,a=void 0===i?[]:i,s=o.issuer,c=o.subject,u=o.audience,l=o.maxTokenAge,h=[...a];void 0!==l&&h.push("iat"),void 0!==u&&h.push("aud"),void 0!==c&&h.push("sub"),void 0!==s&&h.push("iss");for(const e of new Set(h.reverse()))if(!(e in n))throw new ko('missing required "'.concat(e,'" claim'),n,e,"missing");if(s&&!(Array.isArray(s)?s:[s]).includes(n.iss))throw new ko('unexpected "iss" claim value',n,"iss","check_failed");if(c&&n.sub!==c)throw new ko('unexpected "sub" claim value',n,"sub","check_failed");if(u&&(p="string"==typeof u?[u]:u,!("string"==typeof(d=n.aud)?p.includes(d):Array.isArray(d)&&p.some(Set.prototype.has.bind(new Set(d))))))throw new ko('unexpected "aud" claim value',n,"aud","check_failed");var d,p;let f;switch(typeof o.clockTolerance){case"string":f=zr(o.clockTolerance);break;case"number":f=o.clockTolerance;break;case"undefined":f=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const m=o.currentDate,y=Mr(m||new Date);if((void 0!==n.iat||l)&&"number"!=typeof n.iat)throw new ko('"iat" claim must be a number',n,"iat","invalid");if(void 0!==n.nbf){if("number"!=typeof n.nbf)throw new ko('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>y+f)throw new ko('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(void 0!==n.exp){if("number"!=typeof n.exp)throw new ko('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=y-f)throw new _o('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){const e=y-n.iat;if(e-f>("number"==typeof l?l:zr(l)))throw new _o('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(e<0-f)throw new ko('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var Fr=new WeakMap;class Vr{constructor(e){if(y(this,Fr,void 0),!Lo(e))throw new TypeError("JWT Claims Set MUST be an object");w(Fr,this,structuredClone(e))}data(){return so.encode(JSON.stringify(m(Fr,this)))}get iss(){return m(Fr,this).iss}set iss(e){m(Fr,this).iss=e}get sub(){return m(Fr,this).sub}set sub(e){m(Fr,this).sub=e}get aud(){return m(Fr,this).aud}set aud(e){m(Fr,this).aud=e}set jti(e){m(Fr,this).jti=e}set nbf(e){"number"==typeof e?m(Fr,this).nbf=Jr("setNotBefore",e):e instanceof Date?m(Fr,this).nbf=Jr("setNotBefore",Mr(e)):m(Fr,this).nbf=Mr(new Date)+zr(e)}set exp(e){"number"==typeof e?m(Fr,this).exp=Jr("setExpirationTime",e):e instanceof Date?m(Fr,this).exp=Jr("setExpirationTime",Mr(e)):m(Fr,this).exp=Mr(new Date)+zr(e)}set iat(e){void 0===e?m(Fr,this).iat=Mr(new Date):e instanceof Date?m(Fr,this).iat=Jr("setIssuedAt",Mr(e)):m(Fr,this).iat=Jr("setIssuedAt","string"==typeof e?Mr(new Date)+zr(e):e)}}async function Gr(e,t,n){var o;const r=await async function(e,t,n){if(e instanceof Uint8Array&&(e=co.decode(e)),"string"!=typeof e)throw new Eo("Compact JWS must be a string or Uint8Array");const o=e.split("."),r=o[0],i=o[1],a=o[2];if(3!==o.length)throw new Eo("Invalid Compact JWS");const s=await async function(e,t,n){if(!Lo(e))throw new Eo("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new Eo('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new Eo("JWS Protected Header incorrect type");if(void 0===e.payload)throw new Eo("JWS Payload missing");if("string"!=typeof e.signature)throw new Eo("JWS Signature missing or incorrect type");if(void 0!==e.header&&!Lo(e.header))throw new Eo("JWS Unprotected Header incorrect type");let o={};if(e.protected)try{const t=po(e.protected);o=JSON.parse(co.decode(t))}catch(e){throw new Eo("JWS Protected Header is invalid")}if(!No(o,e.header))throw new Eo("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const r=k(k({},o),e.header);let i=!0;if(tr(Eo,new Map([["b64",!0]]),null==n?void 0:n.crit,o,r).has("b64")&&(i=o.b64,"boolean"!=typeof i))throw new Eo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const a=r.alg;if("string"!=typeof a||!a)throw new Eo('JWS "alg" (Algorithm) Header Parameter missing or invalid');const s=n&&function(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw new TypeError('"'.concat("algorithms",'" option must be an array of strings'));if(t)return new Set(t)}(0,n.algorithms);if(s&&!s.has(a))throw new So('"alg" (Algorithm) Header Parameter value not allowed');if(i){if("string"!=typeof e.payload)throw new Eo("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new Eo("JWS Payload must be a string or an Uint8Array instance");let c=!1;"function"==typeof t&&(t=await t(o,e),c=!0),rr(a,t,"verify");const u=uo(void 0!==e.protected?lo(e.protected):new Uint8Array,lo("."),"string"==typeof e.payload?i?lo(e.payload):so.encode(e.payload):e.payload),l=Ko(e.signature,"signature",Eo),h=await Xo(t,a),d=await async function(e,t,n,o){const r=await Jo(e,t,"verify");Do(e,r);const i=zo(e,r.algorithm);try{return await crypto.subtle.verify(i,r,n,o)}catch(e){return!1}}(a,h,l,u);if(!d)throw new xo;let p;p=i?Ko(e.payload,"payload",Eo):"string"==typeof e.payload?so.encode(e.payload):e.payload;const f={payload:p};return void 0!==e.protected&&(f.protectedHeader=o),void 0!==e.header&&(f.unprotectedHeader=e.header),c?k(k({},f),{},{key:h}):f}({payload:i,protected:r,signature:a},t,n),c={payload:s.payload,protectedHeader:s.protectedHeader};return"function"==typeof t?k(k({},c),{},{key:s.key}):c}(e,t,n);if(null!==(o=r.protectedHeader.crit)&&void 0!==o&&o.includes("b64")&&!1===r.protectedHeader.b64)throw new Po("JWTs MUST NOT use unencoded payload");const i={payload:Zr(r.protectedHeader,r.payload,n),protectedHeader:r.protectedHeader};return"function"==typeof t?k(k({},i),{},{key:r.key}):i}var Xr=new WeakMap,Yr=new WeakMap,Br=new WeakMap;class qr{constructor(e){if(y(this,Xr,void 0),y(this,Yr,void 0),y(this,Br,void 0),!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");w(Xr,this,e)}setProtectedHeader(e){return Uo(m(Yr,this),"setProtectedHeader"),w(Yr,this,e),this}setUnprotectedHeader(e){return Uo(m(Br,this),"setUnprotectedHeader"),w(Br,this,e),this}async sign(e,t){if(!m(Yr,this)&&!m(Br,this))throw new Eo("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!No(m(Yr,this),m(Br,this)))throw new Eo("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const n=k(k({},m(Yr,this)),m(Br,this));let o=!0;if(tr(Eo,new Map([["b64",!0]]),null==t?void 0:t.crit,m(Yr,this),n).has("b64")&&(o=m(Yr,this).b64,"boolean"!=typeof o))throw new Eo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const r=n.alg;if("string"!=typeof r||!r)throw new Eo('JWS "alg" (Algorithm) Header Parameter missing or invalid');let i,a,s,c;rr(r,e,"sign"),o?(i=fo(m(Xr,this)),a=lo(i)):(a=m(Xr,this),i=""),m(Yr,this)?(s=fo(JSON.stringify(m(Yr,this))),c=lo(s)):(s="",c=new Uint8Array);const u=uo(c,lo("."),a),l=await Xo(e,r),h=await async function(e,t,n){const o=await Jo(e,t,"sign");Do(e,o);const r=await crypto.subtle.sign(zo(e,o.algorithm),o,n);return new Uint8Array(r)}(r,l,u),d={signature:fo(h),payload:i};return m(Br,this)&&(d.header=m(Br,this)),m(Yr,this)&&(d.protected=s),d}}var Qr=new WeakMap;class $r{constructor(e){y(this,Qr,void 0),w(Qr,this,new qr(e))}setProtectedHeader(e){return m(Qr,this).setProtectedHeader(e),this}async sign(e,t){const n=await m(Qr,this).sign(e,t);if(void 0===n.payload)throw new TypeError("use the flattened module for creating JWS with b64: false");return"".concat(n.protected,".").concat(n.payload,".").concat(n.signature)}}var ei=new WeakMap,ti=new WeakMap;class ni{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};y(this,ei,void 0),y(this,ti,void 0),w(ti,this,new Vr(e))}setIssuer(e){return m(ti,this).iss=e,this}setSubject(e){return m(ti,this).sub=e,this}setAudience(e){return m(ti,this).aud=e,this}setJti(e){return m(ti,this).jti=e,this}setNotBefore(e){return m(ti,this).nbf=e,this}setExpirationTime(e){return m(ti,this).exp=e,this}setIssuedAt(e){return m(ti,this).iat=e,this}setProtectedHeader(e){return w(ei,this,e),this}async sign(e,t){var n;const o=new $r(m(ti,this).data());if(o.setProtectedHeader(m(ei,this)),Array.isArray(null===(n=m(ei,this))||void 0===n?void 0:n.crit)&&m(ei,this).crit.includes("b64")&&!1===m(ei,this).b64)throw new Po("JWTs MUST NOT use unencoded payload");return o.sign(e,t)}}function oi(e){return Lo(e)}var ri,ii,ai=new WeakMap,si=new WeakMap;class ci{constructor(e){if(y(this,ai,void 0),y(this,si,new WeakMap),!function(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(oi)}(e))throw new Ao("JSON Web Key Set malformed");w(ai,this,structuredClone(e))}jwks(){return m(ai,this)}async getKey(e,t){const n=k(k({},e),null==t?void 0:t.header),o=n.alg,r=n.kid,i=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new To('Unsupported "alg" value for a JSON Web Key Set')}}(o),a=m(ai,this).keys.filter(e=>{let t=i===e.kty;if(t&&"string"==typeof r&&(t=r===e.kid),!t||"string"!=typeof e.alg&&"AKP"!==i||(t=o===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t)switch(o){case"ES256":t="P-256"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv;break;case"Ed25519":case"EdDSA":t="Ed25519"===e.crv}return t}),s=a[0],c=a.length;if(0===c)throw new Ro;if(1!==c){const e=new Co,t=m(si,this);throw e[Symbol.asyncIterator]=function(e){return function(){return new T(e.apply(this,arguments))}}(function*(){for(const e of a)try{yield yield p(ui(t,e,o))}catch(e){}}),e}return ui(m(si,this),s,o)}}async function ui(e,t,n){const o=e.get(t)||e.set(t,{}).get(t);if(void 0===o[n]){const e=await async function(e,t){if(!Lo(e))throw new TypeError("JWK must be an object");let n;switch(null!=t||(t=e.alg),null!=n||(n=e.ext),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw new TypeError('missing "k" (Key Value) Parameter value');return po(e.k);case"RSA":if("oth"in e&&void 0!==e.oth)throw new To('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Zo(k(k({},e),{},{alg:t,ext:n}));case"AKP":if("string"!=typeof e.alg||!e.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(void 0!==t&&t!==e.alg)throw new TypeError("JWK alg and alg option value mismatch");return Zo(k(k({},e),{},{ext:n}));case"EC":case"OKP":return Zo(k(k({},e),{},{alg:t,ext:n}));default:throw new To('Unsupported "kty" (Key Type) Parameter value')}}(k(k({},t),{},{ext:!0}),n);if(e instanceof Uint8Array||"public"!==e.type)throw new Ao("JSON Web Key Set members must be public keys");o[n]=e}return o[n]}function li(e){const t=new ci(e),n=async(e,n)=>t.getKey(e,n);return Object.defineProperties(n,{jwks:{value:()=>structuredClone(t.jwks()),enumerable:!1,configurable:!1,writable:!1}}),n}let hi;if("undefined"==typeof navigator||null===(ri=navigator.userAgent)||void 0===ri||null===(ii=ri.startsWith)||void 0===ii||!ii.call(ri,"Mozilla/5.0 ")){const e="v6.2.3";hi="".concat("jose","/").concat(e)}const di=Symbol(),pi=Symbol();var fi=new WeakMap,mi=new WeakMap,yi=new WeakMap,wi=new WeakMap,gi=new WeakMap,vi=new WeakMap,bi=new WeakMap,ki=new WeakMap,_i=new WeakMap,Si=new WeakMap;class Ti{constructor(e,t){if(y(this,fi,void 0),y(this,mi,void 0),y(this,yi,void 0),y(this,wi,void 0),y(this,gi,void 0),y(this,vi,void 0),y(this,bi,void 0),y(this,ki,void 0),y(this,_i,void 0),y(this,Si,void 0),!(e instanceof URL))throw new TypeError("url must be an instance of URL");var n,o;w(fi,this,new URL(e.href)),w(mi,this,"number"==typeof(null==t?void 0:t.timeoutDuration)?null==t?void 0:t.timeoutDuration:5e3),w(yi,this,"number"==typeof(null==t?void 0:t.cooldownDuration)?null==t?void 0:t.cooldownDuration:3e4),w(wi,this,"number"==typeof(null==t?void 0:t.cacheMaxAge)?null==t?void 0:t.cacheMaxAge:6e5),w(bi,this,new Headers(null==t?void 0:t.headers)),hi&&!m(bi,this).has("User-Agent")&&m(bi,this).set("User-Agent",hi),m(bi,this).has("accept")||(m(bi,this).set("accept","application/json"),m(bi,this).append("accept","application/jwk-set+json")),w(ki,this,null==t?void 0:t[di]),void 0!==(null==t?void 0:t[pi])&&(w(Si,this,null==t?void 0:t[pi]),n=null==t?void 0:t[pi],o=m(wi,this),"object"==typeof n&&null!==n&&"uat"in n&&"number"==typeof n.uat&&!(Date.now()-n.uat>=o)&&"jwks"in n&&Lo(n.jwks)&&Array.isArray(n.jwks.keys)&&Array.prototype.every.call(n.jwks.keys,Lo)&&(w(gi,this,m(Si,this).uat),w(_i,this,li(m(Si,this).jwks))))}pendingFetch(){return!!m(vi,this)}coolingDown(){return"number"==typeof m(gi,this)&&Date.now()<m(gi,this)+m(yi,this)}fresh(){return"number"==typeof m(gi,this)&&Date.now()<m(gi,this)+m(wi,this)}jwks(){var e;return null===(e=m(_i,this))||void 0===e?void 0:e.jwks()}async getKey(e,t){m(_i,this)&&this.fresh()||await this.reload();try{return await m(_i,this).call(this,e,t)}catch(n){if(n instanceof Ro&&!1===this.coolingDown())return await this.reload(),m(_i,this).call(this,e,t);throw n}}async reload(){m(vi,this)&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&w(vi,this,void 0),m(vi,this)||w(vi,this,async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch;const r=await o(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(e=>{if("TimeoutError"===e.name)throw new Io;throw e});if(200!==r.status)throw new bo("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await r.json()}catch(e){throw new bo("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(m(fi,this).href,m(bi,this),AbortSignal.timeout(m(mi,this)),m(ki,this)).then(e=>{w(_i,this,li(e)),m(Si,this)&&(m(Si,this).uat=Date.now(),m(Si,this).jwks=e),w(gi,this,Date.now()),w(vi,this,void 0)}).catch(e=>{throw w(vi,this,void 0),e})),await m(vi,this)}}const Ei=["mfaToken"],Pi=["mfaToken"];var Ai,Ri,Ci,Ii,xi,Oi,Wi,ji,Ui,Ki,Li,Ni,Mi,Di,zi,Ji,Hi,Zi,Fi,Vi,Gi,Xi,Yi,Bi,qi,Qi,$i,ea,ta,na,oa,ra,ia,aa;function sa(e){var t,n;if("object"!=typeof e||null===e)return{error:"unknown_error",error_description:String(e)};const o=e,r={error:null!==(t=o.error)&&void 0!==t?t:"",error_description:null!==(n=o.error_description)&&void 0!==n?n:"",message:o.message};if("mfa_required"===o.error&&o.cause){r.mfa_token="string"==typeof o.cause.mfa_token?o.cause.mfa_token:void 0;const e=o.cause.mfa_requirements;"object"==typeof e&&null!==e&&(r.mfa_requirements=e)}return r}var ca=class extends Error{constructor(e,t){super(t),v(this,"code",void 0),this.name="NotSupportedError",this.code=e}},ua=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}}},la=class extends ua{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},ha=class extends ua{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},da=class extends ua{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},pa=class extends ua{constructor(e,t){super("token_by_password_error",e,t),this.name="TokenByPasswordError"}},fa=class extends ua{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},ma=class extends ua{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},ya=class extends ua{constructor(e,t){super("token_revocation_error",e,t),this.name="TokenRevocationError"}},wa=class extends Error{constructor(e){super(e),v(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},ga=class extends ua{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),v(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},va=class extends ua{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},ba=class extends ua{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},ka=class extends ua{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},_a=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),v(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}},Sa=class extends Error{constructor(e){super(e),v(this,"code","organization_validation_error"),this.name="OrganizationValidationError"}};function Ta(e){return Object.entries(e).filter(e=>void 0!==S(e,2)[1]).reduce((e,t)=>k(k({},e),{},{[t[0]]:t[1]}),{})}function Ea(e){if(!e.trim())throw new Sa("organization must not be blank")}function Pa(e,t){if(!e)return;const n=t.trim();if(n.startsWith("org_")){const t=e.org_id;if("string"!=typeof t)throw new Sa("Organization Id (org_id) claim must be a string present in the ID token");if(t!==n)throw new Sa('Organization Id (org_id) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}else{const t=e.org_name;if("string"!=typeof t)throw new Sa("Organization Name (org_name) claim must be a string present in the ID token");if(t.toLowerCase()!==n.toLowerCase())throw new Sa('Organization Name (org_name) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}}var Aa=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},Ra=class extends Aa{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},Ca=class extends Aa{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},Ia=class extends Aa{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},xa=class extends Aa{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}},Oa=class extends Aa{constructor(e,t){super("mfa_verify_error",e,t),this.name="MfaVerifyError"}};function Wa(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var ja=class e{constructor(e,t,n,o,r,i,a){v(this,"accessToken",void 0),v(this,"idToken",void 0),v(this,"refreshToken",void 0),v(this,"expiresAt",void 0),v(this,"scope",void 0),v(this,"claims",void 0),v(this,"authorizationDetails",void 0),v(this,"tokenType",void 0),v(this,"issuedTokenType",void 0),v(this,"recoveryCode",void 0),v(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=r,this.claims=i,this.authorizationDetails=a}static fromTokenEndpointResponse(t){const n=t.id_token?t.claims():void 0,o=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return o.tokenType=t.token_type,o.issuedTokenType=t.issued_token_type,o}},Ua={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},Ka=(Ai=new WeakMap,Ri=new WeakMap,Ci=new WeakMap,Ii=new WeakMap,xi=new WeakMap,class{constructor(e){var t;y(this,Ai,void 0),y(this,Ri,void 0),y(this,Ci,void 0),y(this,Ii,void 0),y(this,xi,void 0),w(Ai,this,"https://".concat(e.domain)),w(Ri,this,e.clientId),w(Ci,this,e.clientSecret),w(Ii,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(xi,this,e.getConfiguration)}async listAuthenticators(e){const t="".concat(m(Ai,this),"/mfa/authenticators"),n=e.mfaToken,o=await m(Ii,this).call(this,t,{method:"GET",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!o.ok){let t;try{t=await o.json()}catch(e){throw new Ra("Failed to list authenticators")}throw new Ra(t.error_description||"Failed to list authenticators",t)}return(await o.json()).map(Wa)}async enrollAuthenticator(e){const t="".concat(m(Ai,this),"/mfa/associate"),n=e.mfaToken,o=_(e,Ei),r={authenticator_types:o.authenticatorTypes};"oobChannels"in o&&(r.oob_channels=o.oobChannels),"phoneNumber"in o&&o.phoneNumber&&(r.phone_number=o.phoneNumber),"email"in o&&o.email&&(r.email=o.email);const i=await m(Ii,this).call(this,t,{method:"POST",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){let t;try{t=await i.json()}catch(e){throw new Ca("Failed to enroll authenticator")}throw new Ca(t.error_description||"Failed to enroll authenticator",t)}return function(e){if("otp"===e.authenticator_type)return{authenticatorType:"otp",secret:e.secret,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes,id:e.id};if("oob"===e.authenticator_type)return{authenticatorType:"oob",oobChannel:e.oob_channel,oobCode:e.oob_code,bindingMethod:e.binding_method,id:e.id,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes};throw new Error("Unexpected authenticator type: ".concat(e.authenticator_type))}(await i.json())}async deleteAuthenticator(e){const t=e.authenticatorId,n=e.mfaToken,o="".concat(m(Ai,this),"/mfa/authenticators/").concat(encodeURIComponent(t)),r=await m(Ii,this).call(this,o,{method:"DELETE",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!r.ok){let t;try{t=await r.json()}catch(e){throw new Ia("Failed to delete authenticator")}throw new Ia(t.error_description||"Failed to delete authenticator",t)}}async challengeAuthenticator(e){const t="".concat(m(Ai,this),"/mfa/challenge"),n=e.mfaToken,o=_(e,Pi),r={mfa_token:n,client_id:m(Ri,this),challenge_type:o.challengeType};m(Ci,this)&&(r.client_secret=m(Ci,this)),o.authenticatorId&&(r.authenticator_id=o.authenticatorId);const i=await m(Ii,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){let t;try{t=await i.json()}catch(e){throw new xa("Failed to challenge authenticator")}throw new xa(t.error_description||"Failed to challenge authenticator",t)}return function(e){const t={challengeType:e.challenge_type};return void 0!==e.oob_code&&(t.oobCode=e.oob_code),void 0!==e.binding_method&&(t.bindingMethod=e.binding_method),t}(await i.json())}async verify(e){if(!m(xi,this))throw new Error("MFA verify requires a configuration provider (getConfiguration was not set)");const t=await m(xi,this).call(this),n={mfa_token:e.mfaToken};e.audience&&(n.audience=e.audience),"otp"===e.factorType?n.otp=e.otp:"oob"===e.factorType?(n.oob_code=e.oobCode,e.bindingCode&&(n.binding_code=e.bindingCode)):"recovery-code"===e.factorType&&(n.recovery_code=e.recoveryCode);try{const o=await Nr(t,Ua[e.factorType],n),r=ja.fromTokenEndpointResponse(o);return o.recovery_code&&(r.recoveryCode=o.recovery_code),r}catch(e){var o,r,i;if(e instanceof Oa)throw e;const t=e;throw new Oa(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(o=t.error)&&void 0!==o?o:"mfa_verify_error",error_description:null!==(r=null!==(i=t.error_description)&&void 0!==i?i:t.message)&&void 0!==r?r:"Failed to verify MFA challenge"})}}}),La=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},Na=class extends La{constructor(e,t){super("passkey_register_error",e,t),this.name="PasskeyRegisterError"}},Ma=class extends La{constructor(e,t){super("passkey_challenge_error",e,t),this.name="PasskeyChallengeError"}},Da=class extends La{constructor(e,t){super("passkey_get_token_error",e,t),this.name="PasskeyGetTokenError",this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}},za="urn:okta:params:oauth:grant-type:webauthn",Ja=(Oi=new WeakMap,Wi=new WeakMap,ji=new WeakMap,Ui=new WeakMap,Ki=new WeakSet,class{constructor(e){var t;g(this,Ki),y(this,Oi,void 0),y(this,Wi,void 0),y(this,ji,void 0),y(this,Ui,void 0),w(Oi,this,"https://".concat(e.domain)),w(Wi,this,e.clientId),w(ji,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(Ui,this,e.grantRequest)}async register(e){const t="".concat(m(Oi,this),"/passkey/register"),n=k(k(k(k(k(k(k(k({},e.email&&{email:e.email}),e.name&&{name:e.name}),e.phoneNumber&&{phone_number:e.phoneNumber}),e.username&&{username:e.username}),e.givenName&&{given_name:e.givenName}),e.familyName&&{family_name:e.familyName}),e.nickname&&{nickname:e.nickname}),e.picture&&{picture:e.picture}),o={client_id:m(Wi,this),user_profile:n};e.realm&&(o.realm=e.realm),e.organization&&(o.organization=e.organization),e.userMetadata&&(o.user_metadata=e.userMetadata);const r=await m(ji,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok){const e=await d(Ki,this,Ha).call(this,r);throw new Na(e.error_description||"Failed to request signup challenge",e)}return{authSession:(i=await r.json()).auth_session,authnParamsPublicKey:k({},i.authn_params_public_key)};var i}async challenge(e){const t="".concat(m(Oi,this),"/passkey/challenge"),n={client_id:m(Wi,this)};null!=e&&e.realm&&(n.realm=e.realm),null!=e&&e.organization&&(n.organization=e.organization);const o=await m(ji,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(n)});if(!o.ok){const e=await d(Ki,this,Ha).call(this,o);throw new Ma(e.error_description||"Failed to request login challenge",e)}return{authSession:(r=await o.json()).auth_session,authnParamsPublicKey:k({},r.authn_params_public_key)};var r}async getTokenByPasskey(e){void 0!==e.organization&&Ea(e.organization);const t=new URLSearchParams({auth_session:e.authSession,authn_response:JSON.stringify(e.credential)});let n;e.realm&&t.append("realm",e.realm),e.scope&&t.append("scope",e.scope),e.audience&&t.append("audience",e.audience),e.organization&&t.append("organization",e.organization);try{n=await m(Ui,this).call(this,za,t)}catch(e){const t=sa(e);throw new Da(t.error_description||"Failed to exchange passkey credential for tokens.",t)}return e.organization&&Pa(n.claims,e.organization),n}});async function Ha(e){try{return await e.json()}catch(t){return{error:"unknown_error",error_description:"HTTP ".concat(e.status," ").concat(e.statusText)}}}var Za=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}}},Fa=class extends Za{constructor(e,t){super("passwordless_start_error",e,t),this.name="PasswordlessStartError"}},Va=class extends Za{constructor(e,t){super("passwordless_verify_error",e,t),this.name="PasswordlessVerifyError"}},Ga=class extends Za{constructor(e,t){super("passwordless_db_get_token_error",e,t),this.name="PasswordlessDbGetTokenError"}},Xa=class extends Za{constructor(e,t,n,o){super("passwordless_challenge_error",e,n),v(this,"statusCode",void 0),v(this,"validationErrors",void 0),this.name="PasswordlessChallengeError",this.statusCode=t,this.validationErrors=o}};function Ya(e){return/^\+[1-9]\d{1,14}$/.test(e)}async function Ba(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await er(e.clientAssertionSigningKey,r);return{client_assertion:await new ni({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}if(e.clientSecret)return{client_secret:e.clientSecret};throw new _a}var qa=(Li=new WeakMap,Ni=new WeakMap,Mi=new WeakMap,Di=new WeakMap,zi=new WeakMap,Ji=new WeakMap,Hi=new WeakSet,class{constructor(e){var t;g(this,Hi),y(this,Li,void 0),y(this,Ni,void 0),y(this,Mi,void 0),y(this,Di,void 0),y(this,zi,void 0),y(this,Ji,void 0),w(Ni,this,e.domain),w(Li,this,"https://".concat(e.domain)),w(Mi,this,e.clientId),w(Di,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(zi,this,{clientSecret:e.clientSecret,clientAssertionSigningKey:e.clientAssertionSigningKey,clientAssertionSigningAlg:e.clientAssertionSigningAlg,useMtls:e.useMtls}),w(Ji,this,e.grantRequest)}async sendEmail(e){await d(Hi,this,Qa).call(this,function(e){var t;const n=null!==(t=e.send)&&void 0!==t?t:"code",o={email:e.email,connection:"email",send:n};return"link"===n&&e.authParams&&(o.authParams=e.authParams),o}(e),"Failed to send passwordless email",e.language)}async sendSms(e){if(!Ya(e.phoneNumber))throw new Fa("Phone number must be in E.164 format (e.g. +14155550100).");await d(Hi,this,Qa).call(this,function(e){return{phone_number:e.phoneNumber,connection:"sms"}}(e),"Failed to send passwordless SMS",e.language)}async challengeWithEmail(e){const t=function(e){var t;return{email:e.email,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t}}(e);return d(Hi,this,$a).call(this,t,"Failed to request email OTP challenge")}async challengeWithPhoneNumber(e){if(!Ya(e.phoneNumber))throw new Xa("Phone number must be in E.164 format (e.g. +14155550100).",0,void 0,void 0);const t=function(e){var t;const n={phone_number:e.phoneNumber,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t};return e.deliveryMethod&&(n.delivery_method=e.deliveryMethod),n}(e);return d(Hi,this,$a).call(this,t,"Failed to request phone OTP challenge")}async getTokenByPasswordlessDbConnection(e){const t=new URLSearchParams({auth_session:e.authSession,otp:e.otp});if(e.scope&&t.append("scope",e.scope),e.audience&&t.append("audience",e.audience),!m(Ji,this))throw new Ga("Missing grant request delegate.",sa(new Error("missing grantRequest")));try{return await m(Ji,this).call(this,"http://auth0.com/oauth/grant-type/passwordless/otp",t)}catch(e){throw new Ga("There was an error while trying to request a token.",sa(e))}}});async function Qa(e,t,n){var o;const r=await Ba(m(zi,this),m(Mi,this),m(Ni,this)),i=k(k({client_id:m(Mi,this)},e),r);let a,s;try{a=await m(Di,this).call(this,"".concat(m(Li,this),"/passwordless/start"),{method:"POST",headers:k({"Content-Type":"application/json"},n?{"x-request-language":n}:{}),body:JSON.stringify(i)})}catch(e){throw new Fa("".concat(t,": a network error occurred."))}if(!a.ok){if(204!==a.status)try{s=await a.json()}catch(e){s=void 0}throw new Fa((null===(o=s)||void 0===o?void 0:o.error_description)||t,s)}}async function $a(e,t){var n,o;const r=await Ba(m(zi,this),m(Mi,this),m(Ni,this)),i=k(k({client_id:m(Mi,this)},e),r);let a,s;try{a=await m(Di,this).call(this,"".concat(m(Li,this),"/otp/challenge"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)})}catch(e){throw new Xa("challenge error: a network error occurred.",0,void 0,void 0)}if(a.ok){let n;try{n=await a.json()}catch(e){throw new Xa("".concat(t,": could not parse the response body."),a.status,void 0,void 0)}return{authSession:n.auth_session}}try{s=await a.json()}catch(e){s=void 0}throw new Xa((null===(n=s)||void 0===n?void 0:n.error_description)||t,a.status,s,null===(o=s)||void 0===o?void 0:o.validation_errors)}var es=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},ts=class extends es{constructor(e,t){super("signup_error",e,t),this.name="SignUpError"}},ns=class extends es{constructor(e,t){super("change_password_error",e,t),this.name="ChangePasswordError"}};function os(e,t,n){for(const o of t)if(null===e[o]||void 0===e[o]||""===e[o])throw new n('Required parameter "'.concat(String(o),'" was null, undefined, or empty.'))}var rs=(Zi=new WeakMap,Fi=new WeakMap,Vi=new WeakMap,Gi=new WeakSet,class{constructor(e){var t;g(this,Gi),y(this,Zi,void 0),y(this,Fi,void 0),y(this,Vi,void 0),w(Zi,this,"https://".concat(e.domain)),w(Fi,this,e.clientId),w(Vi,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)})}async signUp(e){var t;os(e,["email","password","connection"],ts);const n=k({client_id:null!==(t=e.clientId)&&void 0!==t?t:m(Fi,this)},function(e){const t={email:e.email,password:e.password,connection:e.connection};return void 0!==e.username&&(t.username=e.username),void 0!==e.givenName&&(t.given_name=e.givenName),void 0!==e.familyName&&(t.family_name=e.familyName),void 0!==e.name&&(t.name=e.name),void 0!==e.nickname&&(t.nickname=e.nickname),void 0!==e.picture&&(t.picture=e.picture),void 0!==e.userMetadata&&(t.user_metadata=e.userMetadata),t}(e)),o=await d(Gi,this,is).call(this,"/dbconnections/signup",n,ts,"Failed to sign up");return function(e){var t,n;return{id:null!==(t=null!==(n=e._id)&&void 0!==n?n:e.user_id)&&void 0!==t?t:e.id,email:"string"==typeof e.email?e.email:"",emailVerified:Boolean(e.email_verified),username:e.username,givenName:e.given_name,familyName:e.family_name,name:e.name,nickname:e.nickname,picture:e.picture,userMetadata:e.user_metadata}}(await o.json())}async changePassword(e){var t;if(os(e,["connection"],ns),!e.email&&!e.username)throw new ns('Either "email" or "username" is required.');const n=k({client_id:null!==(t=e.clientId)&&void 0!==t?t:m(Fi,this)},function(e){const t={connection:e.connection};return void 0!==e.email&&(t.email=e.email),void 0!==e.username&&(t.username=e.username),void 0!==e.organization&&(t.organization=e.organization),t}(e));return(await d(Gi,this,is).call(this,"/dbconnections/change_password",n,ns,"Failed to request a password change")).text()}});async function is(e,t,n,o){let r;try{r=await m(Vi,this).call(this,"".concat(m(Zi,this)).concat(e),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}catch(e){throw new n("".concat(o,": a network error occurred."))}if(r.ok)return r;const i=await async function(e){let t;try{t=await e.json()}catch(e){return}return"string"==typeof t.error?t:"string"==typeof t.code?{error:t.code,error_description:"string"==typeof t.description?t.description:""}:void 0}(r);throw new n((null==i?void 0:i.error_description)||o,i)}var as=(Xi=new WeakMap,Yi=new WeakMap,Bi=new WeakMap,class{constructor(e,t){y(this,Xi,new Map),y(this,Yi,void 0),y(this,Bi,void 0),w(Bi,this,Math.max(1,Math.floor(e))),w(Yi,this,Math.max(0,Math.floor(t)))}get(e){const t=m(Xi,this).get(e);if(t){if(!(Date.now()>=t.expiresAt))return m(Xi,this).delete(e),m(Xi,this).set(e,t),t.value;m(Xi,this).delete(e)}}set(e,t){for(m(Xi,this).has(e)&&m(Xi,this).delete(e),m(Xi,this).set(e,{value:t,expiresAt:Date.now()+m(Yi,this)});m(Xi,this).size>m(Bi,this);){const e=m(Xi,this).keys().next().value;if(void 0===e)break;m(Xi,this).delete(e)}}}),ss=new Map;function cs(e){return{ttlMs:1e3*("number"==typeof(null==e?void 0:e.ttl)?e.ttl:600),maxEntries:"number"==typeof(null==e?void 0:e.maxEntries)&&e.maxEntries>0?e.maxEntries:100}}var us=class{static createDiscoveryCache(e){const t=(n=e.maxEntries,o=e.ttlMs,"".concat(n,":").concat(o));var n,o;let r=(i=t,ss.get(i));var i;return r||(r=new as(e.maxEntries,e.ttlMs),ss.set(t,r)),r}static createJwksCache(){return{}}},ls="openid profile email offline_access",hs=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function ds(e){if(null==e)throw new ma("subject_token is required");if("string"!=typeof e)throw new ma("subject_token must be a string");if(0===e.trim().length)throw new ma("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new ma("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new ma("subject_token must not include the 'Bearer ' prefix")}function ps(e,t){if(t)for(const o of Object.entries(t)){var n=S(o,2);const t=n[0],r=n[1];if(!hs.has(t))if(Array.isArray(r)){if(r.length>20)throw new ma("Parameter '".concat(t,"' exceeds maximum array size of ").concat(20));r.forEach(n=>{e.append(t,n)})}else e.append(t,r)}}var fs,ms,ys="urn:ietf:params:oauth:token-type:access_token",ws=(qi=new WeakMap,Qi=new WeakMap,$i=new WeakMap,ea=new WeakMap,ta=new WeakMap,na=new WeakMap,oa=new WeakMap,ra=new WeakMap,ia=new WeakMap,aa=new WeakSet,class{constructor(e){var t,n,o,r;if(g(this,aa),y(this,qi,void 0),y(this,Qi,void 0),y(this,$i,void 0),y(this,ea,void 0),y(this,ta,void 0),y(this,na,void 0),y(this,oa,void 0),y(this,ra,void 0),y(this,ia,void 0),v(this,"mfa",void 0),v(this,"passkey",void 0),v(this,"passwordless",void 0),v(this,"database",void 0),w(ea,this,e),e.useMtls&&!e.customFetch)throw new ca("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");w(ta,this,function(e,t){if(!1===t.enabled)return e;const n={name:t.name,version:t.version},o=btoa(JSON.stringify(n));return async(t,n)=>{const r=t instanceof Request?new Headers(t.headers):new Headers;return null!=n&&n.headers&&new Headers(n.headers).forEach((e,t)=>{r.set(t,e)}),r.set("Auth0-Client",o),e(t,k(k({},n),{},{headers:r}))}}(null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)},!1===(null==(n=e.telemetry)?void 0:n.enabled)?n:{enabled:!0,name:null!==(o=null==n?void 0:n.name)&&void 0!==o?o:"@auth0/auth0-auth-js",version:null!==(r=null==n?void 0:n.version)&&void 0!==r?r:"1.12.0"}));const i=cs(e.discoveryCache);w(oa,this,us.createDiscoveryCache(i)),w(ra,this,new Map),w(ia,this,us.createJwksCache()),this.mfa=new Ka({domain:m(ea,this).domain,clientId:m(ea,this).clientId,clientSecret:m(ea,this).clientSecret,customFetch:m(ta,this),getConfiguration:async()=>(await d(aa,this,bs).call(this)).configuration}),this.passkey=new Ja({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this),grantRequest:async(e,t)=>{const n=(await d(aa,this,bs).call(this)).serverMetadata,o=await d(aa,this,vs).call(this,n);o[pr]=function(e,t){return(n,o)=>{const r=null==o?void 0:o.body;if(t!==za||!(r instanceof URLSearchParams))return e(n,o);const i={};for(const e of r){var a=S(e,2);const t=a[0],n=a[1];i[t]="authn_response"===t?JSON.parse(n):n}const s=new Headers(null==o?void 0:o.headers);return s.set("Content-Type","application/json"),e(n,k(k({},o),{},{headers:s,body:JSON.stringify(i)}))}}(m(ta,this),e);const r=await Nr(o,e,t);return ja.fromTokenEndpointResponse(r)}}),this.passwordless=new qa({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this),clientSecret:m(ea,this).clientSecret,clientAssertionSigningKey:m(ea,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(ea,this).clientAssertionSigningAlg,useMtls:m(ea,this).useMtls,grantRequest:async(e,t)=>{const n=(await d(aa,this,bs).call(this)).configuration,o=await Nr(n,e,t);return ja.fromTokenEndpointResponse(o)}}),this.database=new rs({domain:m(ea,this).domain,clientId:m(ea,this).clientId,customFetch:m(ta,this)})}async getServerMetadata(){return(await d(aa,this,bs).call(this)).serverMetadata}async buildAuthorizationUrl(e){const t=(await d(aa,this,bs).call(this)).serverMetadata;if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new ca("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await d(aa,this,Es).call(this,e)}catch(e){throw new va(e)}}async buildLinkUserUrl(e){try{const t=await d(aa,this,Es).call(this,{authorizationParams:k(k({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new ba(e)}}async buildUnlinkUserUrl(e){try{const t=await d(aa,this,Es).call(this,{authorizationParams:k(k({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new ka(e)}}async backchannelAuthentication(e){const t=await d(aa,this,bs).call(this),n=t.configuration,o=t.serverMetadata,r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:o.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&i.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&i.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Pr(n,i),t=await Ar(n,e);return ja.fromTokenEndpointResponse(t)}catch(e){throw new ga(e)}}async initiateBackchannelAuthentication(e){const t=await d(aa,this,bs).call(this),n=t.configuration,o=t.serverMetadata,r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:o.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&i.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&i.append("authorization_details",JSON.stringify(e.authorizationDetails));try{const e=await Pr(n,i);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(e){throw new ga(e)}}async backchannelAuthenticationGrant(e){let t=e.authReqId;const n=(await d(aa,this,bs).call(this)).configuration,o=new URLSearchParams({auth_req_id:t});try{const e=await Nr(n,"urn:openid:params:grant-type:ciba",o);return ja.fromTokenEndpointResponse(e)}catch(e){throw new ga(e)}}async getTokenForConnection(e){var t;if(e.refreshToken&&e.accessToken)throw new fa("Either a refresh or access token should be specified, but not both.");const n=null!==(t=e.accessToken)&&void 0!==t?t:e.refreshToken;if(!n)throw new fa("Either a refresh or access token must be specified.");try{return await this.exchangeToken({connection:e.connection,subjectToken:n,subjectTokenType:e.accessToken?ys:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint})}catch(e){if(e instanceof ma)throw new fa(e.message,e.cause);throw e}}async exchangeToken(e){return"connection"in e?d(aa,this,ks).call(this,e):d(aa,this,_s).call(this,e)}async getTokenByCode(e,t){const n=(await d(aa,this,bs).call(this)).configuration;let o;void 0!==t.organization&&Ea(t.organization);try{const r=await Cr(n,e,{pkceCodeVerifier:t.codeVerifier});o=ja.fromTokenEndpointResponse(r)}catch(e){throw new la("There was an error while trying to request a token.",sa(e))}return t.organization&&Pa(o.claims,t.organization),o}async getTokenByMagicLinkCode(e,t){const n=(await d(aa,this,bs).call(this)).configuration;try{const o=await Cr(n,e,{expectedState:null==t?void 0:t.expectedState});return ja.fromTokenEndpointResponse(o)}catch(e){const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.";throw new la(t,e)}}async getTokenByRefreshToken(e){const t=(await d(aa,this,bs).call(this)).configuration,n=new URLSearchParams;e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope);try{const o=await Ir(t,e.refreshToken,n);return ja.fromTokenEndpointResponse(o)}catch(e){throw new da("The access token has expired and there was an error while trying to refresh it.",sa(e))}}async revokeToken(e){const t=(await d(aa,this,bs).call(this)).configuration,n={};e.tokenTypeHint&&(n.token_type_hint=e.tokenTypeHint);try{await async function(e,t,n){jr(e);const o=ur(e),r=o.as,i=o.c,a=o.auth,s=o.fetch,c=o.tlsOnly,u=o.timeout;return async function(e,t,n,o,r){$t(e),en(t),Vt(o,'"token"');const i=sn(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Pt])),a=new URLSearchParams(null==r?void 0:r.additionalParameters);a.set("token",o);const s=Jt(null==r?void 0:r.headers);return s.delete("accept"),kn(e,t,n,i,a,s,r)}(r,i,a,t,{[Ct]:s,[Pt]:!c,additionalParameters:new URLSearchParams(n),headers:new Headers(sr),signal:Ur(u)}).then(Bn).catch(vr)}(t,e.token,n)}catch(e){throw new ya("An error occurred while trying to revoke the token.",sa(e))}}async getTokenByPassword(e){const t=(await d(aa,this,bs).call(this)).configuration,n=new URLSearchParams({username:e.username,password:e.password});e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),e.realm&&n.append("realm",e.realm);let o=t;if(e.auth0ForwardedFor){const n=await d(aa,this,Ts).call(this);o=new _r(t.serverMetadata(),m(ea,this).clientId,m(ea,this).clientSecret,n),o[pr]=(t,n)=>m(ta,this).call(this,t,k(k({},n),{},{headers:k(k({},n.headers),{},{"auth0-forwarded-for":e.auth0ForwardedFor})}))}try{const e=await Nr(o,"password",n);return ja.fromTokenEndpointResponse(e)}catch(e){throw new pa("There was an error while trying to request a token.",sa(e))}}async getTokenByPasswordlessEmail(e){const t=new URLSearchParams({username:e.email,otp:e.code,realm:"email"});return e.audience&&t.append("audience",e.audience),e.scope&&t.append("scope",e.scope),d(aa,this,Ss).call(this,t)}async getTokenByPasswordlessSms(e){if(!Ya(e.phoneNumber))throw new Va("Phone number must be in E.164 format (e.g. +14155550100).");const t=new URLSearchParams({username:e.phoneNumber,otp:e.code,realm:"sms"});return e.audience&&t.append("audience",e.audience),e.scope&&t.append("scope",e.scope),d(aa,this,Ss).call(this,t)}async getTokenByClientCredentials(e){const t=(await d(aa,this,bs).call(this)).configuration;try{const n=new URLSearchParams({audience:e.audience});e.organization&&n.append("organization",e.organization);const o=await xr(t,n);return ja.fromTokenEndpointResponse(o)}catch(e){throw new ha("There was an error while trying to request a token.",sa(e))}}async buildLogoutUrl(e){const t=await d(aa,this,bs).call(this),n=t.configuration;if(!t.serverMetadata.end_session_endpoint){const t=new URL("https://".concat(m(ea,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",m(ea,this).clientId),t}return function(e,t){jr(e);const n=ur(e),o=n.as,r=n.c,i=sn(o,"end_session_endpoint",!1,n.tlsOnly);(t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id);for(const e of t.entries()){var a=S(e,2);const t=a[0],n=a[1];i.searchParams.append(t,n)}return i}(n,{post_logout_redirect_uri:e.returnTo})}async verifyLogoutToken(e){const t=(await d(aa,this,bs).call(this)).serverMetadata,n=cs(m(ea,this).discoveryCache),o=t.jwks_uri;m(na,this)||w(na,this,function(e,t){const n=new Ti(e,t),o=async(e,t)=>n.getKey(e,t);return Object.defineProperties(o,{coolingDown:{get:()=>n.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>n.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>n.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>n.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>n.jwks(),enumerable:!0,configurable:!1,writable:!1}}),o}(new URL(o),{cacheMaxAge:n.ttlMs,[di]:m(ta,this),[pi]:m(ia,this)}));const r=(await Gr(e.logoutToken,m(na,this),{issuer:t.issuer,audience:m(ea,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in r)&&!("sub"in r))throw new wa('either "sid" or "sub" (or both) claims must be present');if("sid"in r&&"string"!=typeof r.sid)throw new wa('"sid" claim must be a string');if("sub"in r&&"string"!=typeof r.sub)throw new wa('"sub" claim must be a string');if("nonce"in r)throw new wa('"nonce" claim is prohibited');if(!("events"in r))throw new wa('"events" claim is missing');if("object"!=typeof r.events||null===r.events)throw new wa('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in r.events))throw new wa('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof r.events["http://schemas.openid.net/event/backchannel-logout"])throw new wa('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:r.sid,sub:r.sub}}});function gs(){const e=m(ea,this).domain.toLowerCase();return"".concat(e,"|mtls:").concat(m(ea,this).useMtls?"1":"0")}async function vs(e){const t=await d(aa,this,Ts).call(this),n=new _r(e,m(ea,this).clientId,m(ea,this).clientSecret,t);return n[pr]=m(ta,this),n}async function bs(){if(m(qi,this)&&m(Qi,this))return{configuration:m(qi,this),serverMetadata:m(Qi,this)};const e=d(aa,this,gs).call(this),t=m(oa,this).get(e);if(t)return w(Qi,this,t.serverMetadata),w(qi,this,await d(aa,this,vs).call(this,t.serverMetadata)),{configuration:m(qi,this),serverMetadata:m(Qi,this)};const n=m(ra,this).get(e);if(n){const e=await n;return w(Qi,this,e.serverMetadata),w(qi,this,await d(aa,this,vs).call(this,e.serverMetadata)),{configuration:m(qi,this),serverMetadata:m(Qi,this)}}const o=(async()=>{const t=await d(aa,this,Ts).call(this),n=await br(new URL("https://".concat(m(ea,this).domain)),m(ea,this).clientId,{use_mtls_endpoint_aliases:m(ea,this).useMtls},t,{[pr]:m(ta,this)}),o=n.serverMetadata();return m(oa,this).set(e,{serverMetadata:o}),{configuration:n,serverMetadata:o}})(),r=o.then(e=>({serverMetadata:e.serverMetadata}));r.catch(()=>{}),m(ra,this).set(e,r);try{const e=await o,t=e.configuration,n=e.serverMetadata;w(qi,this,t),w(Qi,this,n),m(qi,this)[pr]=m(ta,this)}finally{m(ra,this).delete(e)}return{configuration:m(qi,this),serverMetadata:m(Qi,this)}}async function ks(e){var t,n;const o=(await d(aa,this,bs).call(this)).configuration;if("audience"in e||"resource"in e)throw new ma("audience and resource parameters are not supported for Token Vault exchanges");ds(e.subjectToken);const r=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!==(t=e.subjectTokenType)&&void 0!==t?t:ys,requested_token_type:null!==(n=e.requestedTokenType)&&void 0!==n?n:"http://auth0.com/oauth/token-type/federated-connection-access-token"});e.loginHint&&r.append("login_hint",e.loginHint),e.scope&&r.append("scope",e.scope),ps(r,e.extra);try{const e=await Nr(o,"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",r);return ja.fromTokenEndpointResponse(e)}catch(t){throw new ma("Failed to exchange token for connection '".concat(e.connection,"'."),sa(t))}}async function _s(e){const t=(await d(aa,this,bs).call(this)).configuration;if(ds(e.subjectToken),void 0!==e.organization&&Ea(e.organization),void 0!==e.actorToken&&void 0===e.actorTokenType)throw new ma("actorTokenType is required when actorToken is provided");const n=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});let o,r;e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),e.requestedTokenType&&n.append("requested_token_type",e.requestedTokenType),e.organization&&n.append("organization",e.organization),e.actorToken&&n.append("actor_token",e.actorToken),e.actorTokenType&&n.append("actor_token_type",e.actorTokenType),ps(n,e.extra);try{r=await Nr(t,"urn:ietf:params:oauth:grant-type:token-exchange",n),o=ja.fromTokenEndpointResponse(r)}catch(t){throw new ma("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),sa(t))}var i;if(e.organization&&Pa(o.claims,e.organization),e.actorToken)if(null!==(i=o.claims)&&void 0!==i&&i.act)o.act=o.claims.act;else try{o.act=function(e){if("string"!=typeof e)throw new Po("JWTs must use Compact JWS serialization, JWT must be a string");const t=e.split("."),n=t[1],o=t.length;if(5===o)throw new Po("Only JWTs using Compact JWS serialization can be decoded");if(3!==o)throw new Po("Invalid JWT");if(!n)throw new Po("JWTs must contain a payload");let r,i;try{r=po(n)}catch(e){throw new Po("Failed to base64url decode the payload")}try{i=JSON.parse(co.decode(r))}catch(e){throw new Po("Failed to parse the decoded payload as JSON")}if(!Lo(i))throw new Po("Invalid JWT Claims Set");return i}(r.access_token).act}catch(e){}return o}async function Ss(e){const t=(await d(aa,this,bs).call(this)).configuration;try{const n=await Nr(t,"http://auth0.com/oauth/grant-type/passwordless/otp",e);return ja.fromTokenEndpointResponse(n)}catch(e){throw new Va("There was an error while trying to request a token.",sa(e))}}async function Ts(){return m($i,this)||w($i,this,(async()=>{if(!m(ea,this).clientSecret&&!m(ea,this).clientAssertionSigningKey&&!m(ea,this).useMtls)throw new _a;if(m(ea,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let e=m(ea,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await er(e,m(ea,this).clientAssertionSigningAlg||"RS256")),e?function(e){return nn(e,void 0)}(e):dr(m(ea,this).clientSecret)})().catch(e=>{throw w($i,this,void 0),e})),m($i,this)}async function Es(e){const t=(await d(aa,this,bs).call(this)).configuration,n=Xt(),o=await function(e){return async function(e){return Vt(e,"codeVerifier"),Lt(await crypto.subtle.digest("SHA-256",jt(e)))}(e)}(n),r=Ta(k(k({},m(ea,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(k(k({scope:ls},r),{},{client_id:m(ea,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await Wr(t,i):await Or(t,i),codeVerifier:n}}class Ps extends O{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Ps.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new Ps(t,n)}}class As extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,As.prototype)}}class Rs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Rs.prototype)}}class Cs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Cs.prototype)}}class Is extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Is.prototype)}}class xs extends Ps{constructor(e,t){super(e,t),Object.setPrototypeOf(this,xs.prototype)}}class Os{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){const t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const n of this.contexts){var t=S(n,2);const o=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(o)}}get size(){return this.contexts.size}}class Ws{constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new Os}setMFAAuthDetails(e,t,n,o){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:o})}async getAuthenticators(e){var t,n,o;const r=this.contextManager.get(e);if(!r)throw new As("invalid_request","MFA context not found for this MFA token");const i=null===(n=null===(t=r.mfaRequirements)||void 0===t?void 0:t.challenge)||void 0===n?void 0:n.map(e=>e.type);try{const t=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return i&&0!==i.length?t.filter(e=>!!e.type&&i.includes(e.type)):t}catch(e){if(e instanceof Ra)throw new As(null===(o=e.cause)||void 0===o?void 0:o.error,e.message);throw e}}async enroll(e){var t;const n=function(e){const t=gt[e.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:e.mfaToken,authenticatorTypes:t.authenticatorTypes},t.oobChannels&&{oobChannels:t.oobChannels}),"phoneNumber"in e&&{phoneNumber:e.phoneNumber}),"email"in e&&{email:e.email})}(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(e){if(e instanceof Ca)throw new Rs(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async challenge(e){var t;try{const t={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(t.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(t)}catch(e){if(e instanceof xa)throw new Cs(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async getEnrollmentFactors(e){const t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new xs("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&0!==t.mfaRequirements.enroll.length?t.mfaRequirements.enroll:[]}async verify(e){const t=this.contextManager.get(e.mfaToken);if(!t)throw new Is("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const n=function(e){return"otp"in e&&e.otp?"http://auth0.com/oauth/grant-type/mfa-otp":"oobCode"in e&&e.oobCode?"http://auth0.com/oauth/grant-type/mfa-oob":"recoveryCode"in e&&e.recoveryCode?"http://auth0.com/oauth/grant-type/mfa-recovery-code":void 0}(e);if(!n)throw new Is("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const o=t.scope,r=t.audience;try{const t=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:o,audience:r,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),t}catch(e){if(e instanceof Is)throw new Is(e.error,e.error_description);throw e}}}class js extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,js.prototype)}}class Us{constructor(e,t){fs.set(this,void 0),ms.set(this,void 0),u(this,fs,e,"f"),u(this,ms,t,"f")}async signup(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.scope,n=e.audience,o=s(e,["scope","audience"]),r=await c(this,fs,"f").register(o),i=Ns(r.authnParamsPublicKey),a=await navigator.credentials.create({publicKey:i});if(!a)throw new js("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");const u=Ds(a);return c(this,ms,"f")._requestTokenForPasskey({authSession:r.authSession,credential:u,realm:o.realm,organization:o.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e||{},n=t.scope,o=t.audience,r=s(t,["scope","audience"]),i=await c(this,fs,"f").challenge(Object.keys(r).length>0?r:void 0),a=Ms(i.authnParamsPublicKey),u=await navigator.credentials.get({publicKey:a});if(!u)throw new js("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");const l=zs(u);return c(this,ms,"f")._requestTokenForPasskey({authSession:i.authSession,credential:l,realm:r.realm,organization:r.organization,scope:n,audience:o})}async getSignupChallenge(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,fs,"f").register(e);return{authSession:t.authSession,publicKey:Ns(t.authnParamsPublicKey)}}async getLoginChallenge(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,fs,"f").challenge(e);return{authSession:t.authSession,publicKey:Ms(t.authnParamsPublicKey)}}async getTokenWithPasskey(e){if(!window.PublicKeyCredential)throw new js("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.authSession,n=e.credential,o=e.realm,r=e.organization,i=e.scope,a=e.audience,s=n.response;let u;if(s instanceof AuthenticatorAttestationResponse)u=Ds(n);else{if(!(s instanceof AuthenticatorAssertionResponse))throw new js("passkey_invalid_credential","The provided credential is not a valid attestation or assertion response.");u=zs(n)}return c(this,ms,"f")._requestTokenForPasskey({authSession:t,credential:u,realm:o,organization:r,scope:i,audience:a})}}function Ks(e){const t=new Uint8Array(e),n=Array.from(t,e=>String.fromCharCode(e)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Ls(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t+"=".repeat((4-t.length%4)%4),o=atob(n),r=new Uint8Array(o.length);for(let e=0;e<o.length;e++)r[e]=o.charCodeAt(e);return r.buffer}function Ns(e){return Object.assign(Object.assign({},e),{challenge:Ls(e.challenge),user:Object.assign(Object.assign({},e.user),{id:Ls(e.user.id)}),pubKeyCredParams:e.pubKeyCredParams,authenticatorSelection:e.authenticatorSelection})}function Ms(e){return Object.assign(Object.assign({},e),{challenge:Ls(e.challenge)})}function Ds(e){var t;const n=e.response;return{id:e.id,rawId:Ks(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Ks(n.clientDataJSON),attestationObject:Ks(n.attestationObject)},clientExtensionResults:e.getClientExtensionResults()}}function zs(e){var t;const n=e.response;return{id:e.id,rawId:Ks(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Ks(n.clientDataJSON),authenticatorData:Ks(n.authenticatorData),signature:Ks(n.signature),userHandle:n.userHandle?Ks(n.userHandle):void 0},clientExtensionResults:e.getClientExtensionResults()}}fs=new WeakMap,ms=new WeakMap;class Js{resolveOnlineAccess(e){if("online"!==e.refreshTokenMode)return!1;if(!0!==e.useRefreshTokens)throw new W('`refreshTokenMode: "online"` requires the refresh-token grant.',"Set `useRefreshTokens: true`.");if(!0!==e.useDpop)throw new W('`refreshTokenMode: "online"` requires DPoP, which is missing or disabled.',"Set `useDpop: true` (DPoP is mandatory for online access).");return!0}constructor(e){let t,n;if(this.userCache=(new He).enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0,refreshTokenMode:"offline"},this.onlineAccess=this.resolveOnlineAccess(e),this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!F())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===F().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),this.lockManager=(ye||(ye=function(){return"undefined"!=typeof navigator&&"function"==typeof(null===(e=navigator.locks)||void 0===e?void 0:e.request)?new fe:new me;var e}()),ye),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||A,!ut(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=ut(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:P,this.cookieStorage=!1===e.legacySameSiteCookie?et:nt,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieName=(e=>"auth0.".concat(e,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const r=e.useCookiesForTransactions?this.cookieStorage:ot;let i="";var a;this.onlineAccess?i=R:this.options.useRefreshTokens&&(i="offline_access"),this.scope=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if("object"!=typeof e)return{[x]:Le(t,e,...o)};let i={[x]:Le(t,...o)};return Object.keys(e).forEach(n=>{const r=e[n];i[n]=Le(t,r,...o)}),i}(this.options.authorizationParams.scope,"openid",i),this.transactionManager=new Fe(r,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||I,this.cacheManager=new Ze(n,n.allKeys?void 0:new at(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new pt(this.options.clientId):void 0,this.domainUrl=(a=this.options.domain,/^https?:\/\//.test(a)?a:"https://".concat(a)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);const s="".concat(this.domainUrl,"/me/"),c=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:s},detailedResponse:!0})}}));this.myAccount=new yt(c,s),this.authJsClient=new ws({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new Ws(this.authJsClient.mfa,this),this.passkey=new Us(this.authJsClient.passkey,this),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&t===A&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new it,this.worker.postMessage({type:"init",allowedBaseUrl:this.domainUrl}))}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const t=this.options.auth0Client||C,n=Y(t,!0),o=encodeURIComponent(btoa(JSON.stringify(n)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(o)}_authorizeUrl(e){return this._url("/authorize?".concat(B(e)))}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),n=S(t,3),o=n[0],r=n[1],i=n[2];if(3!==t.length||!o||!r||!i)throw new Error("ID token could not be decoded");const a=JSON.parse(Q(r)),s={__raw:e},c={};return Object.keys(a).forEach(e=>{s[e]=a[e],Ge.includes(e)||(c[e]=a[e])}),{encoded:{header:o,payload:r,signature:i},header:JSON.parse(Q(o)),claims:s,user:c}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&!Ve(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!Ve(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!Ve(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(t.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(null!=t.claims.nbf&&Ve(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(e))}if(null!=t.claims.auth_time&&Ve(t.claims.auth_time)){const r=new Date(0);if(r.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>r)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(r))}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_id,'"'))}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(r=this.options.authorizationParams.max_age,"string"!=typeof r?r:parseInt(r,10)||void 0),now:o});var r}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}_extractSessionTransferToken(e){return new URLSearchParams(window.location.search).get(e)||void 0}_clearSessionTransferTokenFromUrl(e){try{const t=new URL(window.location.href);t.searchParams.has(e)&&(t.searchParams.delete(e),window.history.replaceState({},"",t.toString()))}catch(e){}}_applySessionTransferToken(e){const t=this.options.sessionTransferTokenQueryParamName;if(!t||e.session_transfer_token)return e;const n=this._extractSessionTransferToken(t);return n?(this._clearSessionTransferTokenFromUrl(t),Object.assign(Object.assign({},e),{session_transfer_token:n})):e}async _prepareAuthorizeUrl(e,t,n){var o;const r=G(V()),i=G(V()),a=V(),s=await q(a),c=$(s),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),l=((e,t,n,o,r,i,a,s,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:Ne(t,n.scope,n.audience),response_type:"code",response_mode:s||"query",state:o,nonce:r,redirect_uri:a||e.authorizationParams.redirect_uri,code_challenge:i,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,r,i,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),h=this._authorizeUrl(l);return{nonce:i,code_verifier:a,scope:l.scope,audience:l.audience||x,redirect_uri:l.redirect_uri,state:r,url:h}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup","left=".concat(e,",top=").concat(t,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(),!t.popup))throw new M;const o=this._applySessionTransferToken(e.authorizationParams||{}),r=await this._prepareAuthorizeUrl(o,{response_mode:"web_message"},window.location.origin);t.popup.location.href=r.url;const i=await((e,t)=>new Promise((n,o)=>{let r;const i=setInterval(()=>{e.popup&&e.popup.closed&&(clearInterval(i),clearTimeout(a),window.removeEventListener("message",r,!1),o(new N(e.popup)))},1e3),a=setTimeout(()=>{clearInterval(i),o(new L(e.popup)),window.removeEventListener("message",r,!1)},1e3*(e.timeoutInSeconds||60));r=function(s){if(s.origin===t&&s.data&&"authorization_response"===s.data.type){if(clearTimeout(a),clearInterval(i),window.removeEventListener("message",r,!1),!1!==e.closePopup&&e.popup.close(),s.data.response.error)return o(O.fromPayload(s.data.response));n(s.data.response)}},window.addEventListener("message",r)}))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}),new URL(r.url).origin);if(r.state!==i.state)throw new O("state_mismatch","Invalid state");const a=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:r.audience,scope:r.scope,code_verifier:r.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:r.redirect_uri},{nonceIn:r.nonce,organization:a})}async getUser(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(){var t;const n=lt(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),o=n.openUrl,r=n.fragment,i=n.appState,a=s(n,["openUrl","fragment","appState"]),c=(null===(t=a.authorizationParams)||void 0===t?void 0:t.organization)||this.options.authorizationParams.organization,u=this._applySessionTransferToken(a.authorizationParams||{}),l=await this._prepareAuthorizeUrl(u),h=l.url,d=s(l,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},d),{appState:i,response_type:e.ResponseType.Code}),c&&{organization:c}));const p=r?"".concat(h,"#").concat(r):h;o?await o(p):window.location.assign(p)}async handleRedirectCallback(){const t=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===t.length)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new O("missing_transaction","Invalid state");this.transactionManager.remove();const o=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(t.join(""));return n.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(t,n){const o=t.code,r=t.state,i=t.error,a=t.error_description;if(i)throw new j(i,a||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new O("state_mismatch","Invalid state");const s=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:s}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const o=t.connect_code,r=t.state,i=t.error,a=t.error_description;if(i)throw new U(i,a||i,n.connection,r,n.appState);if(!o)throw new O("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new O("state_mismatch","Invalid state");const s=await this.myAccount.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},s),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get(st))return;this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(st)}try{await this.getTokenSilently(e)}catch(e){}}async getTokenSilently(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Ne(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),r=await this._getTokenSilently(o);return e.detailedResponse?r:null==r?void 0:r.access_token}async _getTokenSilently(e){const t=e.cacheMode,n=s(e,["cacheMode"]);if(await this._isSessionCeilingReached())return;if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||x,clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=(r=this.options.clientId,i=n.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(r,".").concat(i));var r,i;try{return await this.lockManager.runWithLock(o,5e3,async()=>{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||x,clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),o=e.id_token,r=e.token_type,i=e.access_token,a=e.oauthTokenScope,s=e.expires_in;return Object.assign(Object.assign({id_token:o,token_type:r,access_token:i},a?{scope:a}:null),{expires_in:s})})}catch(e){if(this._isInteractiveError(e)&&"popup"===this.options.interactiveErrorHandler)return await this._handleInteractiveErrorWithPopup(n);throw e}}_isInteractiveError(e){return e instanceof D||e instanceof O&&this._isIframeMfaError(e)}_isIframeMfaError(e){return"login_required"===e.error&&"Multifactor authentication required"===e.error_description}async _handleInteractiveErrorWithPopup(e){try{await this.loginWithPopup({authorizationParams:e.authorizationParams});const t=await this._getEntryFromCache({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||x,clientId:this.options.clientId});if(!t)throw new O("interactive_handler_cache_miss","Token not found in cache after interactive authentication");return t}catch(e){throw e}}async getTokenWithPopup(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};var n,o;const r=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Ne(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},E),t),await this.loginWithPopup(r,t),(await this.cacheManager.get(new ze({scope:r.authorizationParams.scope,audience:r.authorizationParams.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},n=t.federated,o=s(t,["federated"]),r=n?"&federated":"";return this._url("/v2/logout?".concat(B(Object.assign({clientId:e.clientId},o))))+r}async revokeRefreshToken(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!this.options.useRefreshTokens)return;const t=e.audience||this.options.authorizationParams.audience||x,n=await this.cacheManager.getRefreshTokensByAudience(t,this.options.clientId);await async function(e,t){let n=e.auth0Client,o=e.useFormData,r=e.refreshTokens,i=e.audience,a=e.client_id,s=e.onRefreshTokenRevoked;const c=e.timeout||P,u="refresh_token",l="".concat(e.baseUrl,"/oauth/revoke"),h={"Content-Type":o?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(Y(n||C)))};if(t){const n={client_id:a,token_type_hint:u},r=o?B(n):JSON.stringify(n);try{return await Oe({type:"revoke",timeout:c,fetchUrl:l,fetchOptions:{method:"POST",body:r,headers:h},useFormData:o,auth:{audience:null!=i?i:x}},t)}catch(e){throw new O("revoke_error",e.message)}}for(const t of r){const n={client_id:a,token_type_hint:u,token:t},r=o?B(n):JSON.stringify(n),i=await We(l,{method:"POST",body:r,headers:h},c);if(!i.ok){let t,n;try{var d=JSON.parse(await i.text());t=d.error,n=d.error_description}catch(e){}throw new O(t||"revoke_error",n||"HTTP error ".concat(i.status))}await(null==s?void 0:s(t))}}({baseUrl:this.domainUrl,timeout:this.httpTimeoutMs,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,client_id:this.options.clientId,refreshTokens:n,audience:t,onRefreshTokenRevoked:e=>this.cacheManager.stripRefreshToken(e)},this.worker),this.onlineAccess&&await this._clearLocalSession()}async logout(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};const t=lt(e),n=t.openUrl,o=s(t,["openUrl"]);await this._clearLocalSession(e.clientId);const r=this._buildLogoutUrl(o);n?await n(r):!1!==n&&window.location.assign(r)}async _getTokenFromIFrame(e){const t=(n=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(n));var n;try{return await this.lockManager.runWithLock(t,5e3,async()=>{const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const o=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin),r=o.url,i=o.state,a=o.nonce,s=o.code_verifier,c=o.redirect_uri,u=o.scope,l=o.audience;if(window.crossOriginIsolated)throw new O("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const h=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let d;try{d=new URL(this.domainUrl).origin}catch(e){d=this.domainUrl}const p=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise((o,r)=>{const i=window.document.createElement("iframe");i.setAttribute("width","0"),i.setAttribute("height","0"),i.style.display="none";const a=()=>{window.document.body.contains(i)&&(window.document.body.removeChild(i),window.removeEventListener("message",s,!1))};let s;const c=setTimeout(()=>{r(new K),a()},1e3*n);s=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?r(O.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",s,!1),setTimeout(a,2e3)},window.addEventListener("message",s,!1),window.document.body.appendChild(i),i.setAttribute("src",e)})}(r,d,h);if(i!==p.state)throw new O("state_mismatch","Invalid state");const f=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:s,code:p.code,grant_type:"authorization_code",redirect_uri:c,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:a,organization:t.organization});return Object.assign(Object.assign({},f),{scope:u,oauthTokenScope:f.scope,audience:l})})}catch(e){throw"login_required"===e.error&&(e instanceof O&&this._isIframeMfaError(e)&&"popup"===this.options.interactiveErrorHandler||this.logout({openUrl:!1})),e}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new ze({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new z(e.authorizationParams.audience||x,e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,r=((e,t,n,o)=>{var r;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),i=(null===(r=t.scope)||void 0===r?void 0:r.split(" "))||[],a=i.every(t=>e.includes(t));return e.length>=i.length&&a?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:r});if(!this.onlineAccess&&u.refresh_token&&(null==t?void 0:t.refresh_token)&&await this.cacheManager.updateEntry(t.refresh_token,u.refresh_token,this.options.clientId,this.options.useMrrt),this.options.useMrrt&&(i=null==t?void 0:t.audience,a=null==t?void 0:t.scope,s=e.authorizationParams.audience,c=e.authorizationParams.scope,i!==s||!((e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every(e=>n.includes(e))})(c,a))){const t=((e,t,n)=>{const o=(null==e?void 0:e.split(" "))||[],r=n?o.filter(e=>e!==R):o,i=(null==t?void 0:t.split(" "))||[];return r.filter(e=>-1==i.indexOf(e)).join(",")})(r,u.scope,this.onlineAccess);if(t){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope),new J(e.authorizationParams.audience||"default",t)}}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||x})}catch(t){if(t.message){if(t.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),t;if((t.message.includes("Missing Refresh Token")||t.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw t}var i,a,s,c}async _saveEntryInCache(e){const t=e.decodedToken.claims,n=t.session_expiry,o=t.iat;if(void 0!==n){if("number"!=typeof n)throw new O("invalid_token","Invalid session_expiry: value must be a number.");if(n>=1e10)throw new O("invalid_token","Invalid session_expiry: value appears to be in milliseconds; expected a Unix timestamp in seconds.");if(void 0===o||n<=o)throw new O("invalid_token","Invalid session_expiry: session ceiling is before or at the token issue time.")}const r=e.id_token,i=e.decodedToken,a=s(e,["id_token","decodedToken"]);this.userCache.set(De,{id_token:r,decodedToken:i}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(a)}async _clearLocalSession(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:this.options.clientId;var t;null===e?await this.cacheManager.clear():await this.cacheManager.clear(e),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove(De);try{await(null===(t=this.dpop)||void 0===t?void 0:t.clear())}catch(e){}if(this.worker)try{await Oe({type:"clear"},this.worker)}catch(e){}}async _isSessionCeilingReached(){var e,t;const n=this.userCache.get(De),o=null!=n?n:await this.cacheManager.getIdToken(new ze({clientId:this.options.clientId})),r=null===(t=null===(e=null==o?void 0:o.decodedToken)||void 0===e?void 0:e.claims)||void 0===t?void 0:t.session_expiry;if(void 0===r)return!1;const i=await this.nowProvider();return Math.floor(i/1e3)>=r-30&&(await this._clearLocalSession(),!0)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||x,t=this.scope[e],n=await this.cacheManager.getIdToken(new ze({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get(De);return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set(De,n),n)}async _getEntryFromCache(e){let t=e.scope,n=e.audience,o=e.clientId,r=e.cacheMode;const i=await this.cacheManager.get(new ze({scope:t,audience:n,clientId:o}),60,this.options.useMrrt,r);if(i&&i.access_token){const e=i.token_type,t=i.access_token,n=i.oauthTokenScope,o=i.expires_in,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}_storeMfaContext(e,t,n){e instanceof D&&this.mfa.setMFAAuthDetails(e.mfa_token,t,n,e.mfa_requirements)}async _requestToken(e,t){var n,o,r,i,a,s;const c=t||{},u=c.nonceIn,l=c.organization,h=c.scopesToRequest;try{const t=await Ke(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop,preserveRefreshToken:this.onlineAccess},e),{scope:h||e.scope}),this.worker);let c=await this._verifyIdToken(t.id_token,u,l);if("authorization_code"===e.grant_type){const e=await this._getIdTokenFromCache();(null===(o=null===(n=null==e?void 0:e.decodedToken)||void 0===n?void 0:n.claims)||void 0===o?void 0:o.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove(De))}if("authorization_code"!==e.grant_type){const e=await this._getIdTokenFromCache(),t=null===(i=null===(r=null==e?void 0:e.decodedToken)||void 0===r?void 0:r.claims)||void 0===i?void 0:i.session_expiry;void 0!==t&&(c=Object.assign(Object.assign({},c),{claims:Object.assign(Object.assign({},c.claims),{session_expiry:t})}))}return!t.refresh_token&&this.onlineAccess&&(t.refresh_token=null!==(a=e.refresh_token)&&void 0!==a?a:null===(s=await this.cacheManager.get(new ze({scope:h||e.scope,audience:e.audience||x,clientId:this.options.clientId}),void 0,this.options.useMrrt))||void 0===s?void 0:s.refresh_token),await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},t),{decodedToken:c,scope:e.scope,audience:e.audience||x}),t.scope?{oauthTokenScope:t.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(l||c.claims.org_id),Object.assign(Object.assign({},t),{decodedToken:c})}catch(t){throw"authorization_code"!==e.grant_type&&this._storeMfaContext(t,h||e.scope,e.audience),t}}_buildTokenExchangeParams(e){return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type}),e.actor_token&&{actor_token:e.actor_token}),e.actor_token_type&&{actor_token_type:e.actor_token_type}),{scope:Ne(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}async loginWithCustomTokenExchange(e){return this._requestToken(this._buildTokenExchangeParams(e))}async customTokenExchange(e){const t=this._buildTokenExchangeParams(e);try{const n=await Ke(Object.assign(Object.assign({},t),{baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,dpop:this.dpop}),this.worker,!0);return n.id_token&&await this._verifyIdToken(n.id_token,void 0,e.organization),n}catch(e){throw this._storeMfaContext(e,t.scope,t.audience),e}}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new mt(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const n=t.openUrl,o=t.appState,r=t.connection,i=t.scopes,a=t.authorization_params,s=t.redirectUri,c=void 0===s?this.options.authorizationParams.redirect_uri||window.location.origin:s;if(!r)throw new Error("connection is required");const u=G(V()),l=V(),h=await q(l),d=$(h),p=await this.myAccount.connectAccount({connection:r,scopes:i,redirect_uri:c,state:u,code_challenge:d,code_challenge_method:"S256",authorization_params:a}),f=p.connect_uri,m=p.connect_params,y=p.auth_session;this.transactionManager.create({state:u,code_verifier:l,auth_session:y,redirect_uri:c,appState:o,connection:r,response_type:e.ResponseType.ConnectCode});const w=new URL(f);w.searchParams.set("ticket",m.ticket),n?await n(w.toString()):window.location.assign(w)}async _requestTokenForPasskey(e){const t=e.audience||this.options.authorizationParams.audience,n=e.organization||this.options.authorizationParams.organization;return this._requestToken(Object.assign(Object.assign(Object.assign({grant_type:"urn:okta:params:oauth:grant-type:webauthn",auth_session:e.authSession,authn_response:e.credential},e.realm&&{realm:e.realm}),n&&{organization:n}),{scope:Ne(this.scope,e.scope,t),audience:t}))}async _requestTokenForMfa(e,t){const n=e.mfaToken,o=s(e,["mfaToken"]);return this._requestToken(Object.assign(Object.assign({},o),{mfa_token:n}),t)}}var Hs={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},Zs=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},Fs=o(o({},Hs),{buildAuthorizeUrl:Zs,buildLogoutUrl:Zs,getAccessTokenSilently:Zs,getAccessTokenWithPopup:Zs,getIdTokenClaims:Zs,loginWithCustomTokenExchange:Zs,customTokenExchange:Zs,exchangeToken:Zs,loginWithRedirect:Zs,loginWithPopup:Zs,connectAccountWithRedirect:Zs,logout:Zs,revokeRefreshToken:Zs,handleRedirectCallback:Zs,getDpopNonce:Zs,setDpopNonce:Zs,generateDpopProof:Zs,createFetcher:Zs,getConfiguration:Zs,mfa:{getAuthenticators:Zs,enroll:Zs,challenge:Zs,verify:Zs,getEnrollmentFactors:Zs},passkey:{signup:Zs,login:Zs},myAccount:{getFactors:Zs,getAuthenticationMethods:Zs,getAuthenticationMethod:Zs,updateAuthenticationMethod:Zs,deleteAuthenticationMethod:Zs,enrollmentChallenge:Zs,enrollmentVerify:Zs}}),Vs=t.createContext(Fs),Gs=function(e){function t(n,o){var r=e.call(this,null!=o?o:n)||this;return r.error=n,r.error_description=o,Object.setPrototypeOf(r,t.prototype),r}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),Xs=/[?&](?:connect_)?code=[^&]+/,Ys=/[?&]state=[^&]+/,Bs=/[?&]error=[^&]+/,qs=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new Gs(n.error,n.error_description)}return new Gs(t.error)}return new Error(e)}},Qs=qs("Login failed"),$s=qs("Get access token failed"),ec=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},tc=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":case"SYNC_USER":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},nc=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},oc=function(e){return void 0===e&&(e=Vs),t.useContext(e)},rc=function(){return t.createElement(t.Fragment,null)},ic=function(){return i(void 0,void 0,void 0,function(){return a(this,function(e){return[2]})})},ac=function(){var e=window.location.pathname.replace(/^\/\/+/,"/");return"".concat(e).concat(window.location.search)};e.Auth0Context=Vs,e.Auth0Provider=function(n){var s=n,c=s.children,u=s.skipRedirectCallback,l=s.onRedirectCallback,h=void 0===l?nc:l,d=s.context,p=void 0===d?Vs:d,f=s.client,m=r(s,["children","skipRedirectCallback","onRedirectCallback","context","client"]);f&&(m.domain||m.clientId)&&console.warn("Auth0Provider: the `client` prop takes precedence over `domain`/`clientId` and other configuration options. Remove `domain`, `clientId`, and any other Auth0Client configuration props when using the `client` prop.");var y=t.useState(function(){return null!=f?f:new Js(function(e){return ec(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.23.0"}})}(m))})[0],w=t.useReducer(tc,Hs),g=w[0],v=w[1],b=t.useRef(!1),k=t.useCallback(function(e){return v({type:"ERROR",error:e}),e},[]);t.useEffect(function(){b.current||(b.current=!0,i(void 0,void 0,void 0,function(){var t,n,o,i,s,c,l;return a(this,function(a){switch(a.label){case 0:return a.trys.push([0,7,,8]),t=void 0,void 0===d&&(d=window.location.search),!Xs.test(d)&&!Bs.test(d)||!Ys.test(d)||u?[3,3]:[4,y.handleRedirectCallback()];case 1:return n=a.sent(),o=n.appState,i=void 0===o?{}:o,s=n.response_type,c=r(n,["appState","response_type"]),[4,y.getUser()];case 2:return t=a.sent(),i.response_type=s,s===e.ResponseType.ConnectCode&&(i.connectedAccount=c),h(i,t),[3,6];case 3:return[4,y.checkSession()];case 4:return a.sent(),[4,y.getUser()];case 5:t=a.sent(),a.label=6;case 6:return v({type:"INITIALISED",user:t}),[3,8];case 7:return l=a.sent(),k(Qs(l)),[3,8];case 8:return[2]}var d})}))},[y,h,u,k]);var _=t.useCallback(function(e){return ec(e),y.loginWithRedirect(e)},[y]),S=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o;return a(this,function(r){switch(r.label){case 0:v({type:"LOGIN_POPUP_STARTED"}),r.label=1;case 1:return r.trys.push([1,3,,4]),[4,y.loginWithPopup(e,t)];case 2:return r.sent(),[3,4];case 3:return n=r.sent(),k(Qs(n)),[2];case 4:return[4,y.getUser()];case 5:return o=r.sent(),v({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}})})},[y,k]),T=t.useCallback(function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return i(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,r=0,i=t.length;r<i;r++)!o&&r in t||(o||(o=Array.prototype.slice.call(t,0,r)),o[r]=t[r]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,function(e){return void 0===e&&(e={}),a(this,function(t){switch(t.label){case 0:return[4,y.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&v({type:"LOGOUT"}),[2]}})})},[y]),E=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n;return a(this,function(o){switch(o.label){case 0:return o.trys.push([0,,2,4]),[4,y.revokeRefreshToken(e)];case 1:return o.sent(),[3,4];case 2:return t=v,n={type:"SYNC_USER"},[4,y.getUser()];case 3:return t.apply(void 0,[(n.user=o.sent(),n)]),[7];case 4:return[2]}})})},[y]),P=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.getTokenSilently(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),A=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o,r,i;return a(this,function(a){switch(a.label){case 0:return a.trys.push([0,2,3,5]),[4,y.getTokenWithPopup(e,t)];case 1:return n=a.sent(),[3,5];case 2:throw o=a.sent(),$s(o);case 3:return r=v,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return r.apply(void 0,[(i.user=a.sent(),i)]),[7];case 5:return[2,n]}})})},[y]),R=t.useCallback(function(e){return y.connectAccountWithRedirect(e)},[y]),C=t.useCallback(function(){return y.getIdTokenClaims()},[y]),I=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.loginWithCustomTokenExchange(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),x=t.useCallback(function(e){return y.customTokenExchange(e)},[y]),O=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){return a(this,function(t){return[2,I(e)]})})},[I]),W=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o;return a(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,y.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw t=r.sent(),$s(t);case 3:return n=v,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,y.getUser()];case 4:return n.apply(void 0,[(o.user=r.sent(),o)]),[7];case 5:return[2]}})})},[y]),j=t.useCallback(function(e){return y.getDpopNonce(e)},[y]),U=t.useCallback(function(e,t){return y.setDpopNonce(e,t)},[y]),K=t.useCallback(function(e){return y.generateDpopProof(e)},[y]),L=t.useCallback(function(e){return y.createFetcher(e)},[y]),N=t.useCallback(function(){return y.getConfiguration()},[y]),M=t.useMemo(function(){return y.mfa},[y]),D=t.useMemo(function(){return y.myAccount},[y]),z=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.signup(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),J=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return a(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.login(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),$s(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),H=t.useMemo(function(){return{signup:z,login:J}},[z,J]),Z=t.useMemo(function(){return o(o({},g),{getAccessTokenSilently:P,getAccessTokenWithPopup:A,getIdTokenClaims:C,loginWithCustomTokenExchange:I,customTokenExchange:x,exchangeToken:O,loginWithRedirect:_,loginWithPopup:S,connectAccountWithRedirect:R,logout:T,revokeRefreshToken:E,handleRedirectCallback:W,getDpopNonce:j,setDpopNonce:U,generateDpopProof:K,createFetcher:L,getConfiguration:N,mfa:M,passkey:H,myAccount:D})},[g,P,A,C,I,x,O,_,S,R,T,E,W,j,U,K,L,N,M,H,D]);return t.createElement(p.Provider,{value:Z},c)},e.AuthenticationError=j,e.ConnectError=U,e.GenericError=O,e.InMemoryCache=He,e.InvalidConfigurationError=W,e.LocalStorageCache=Je,e.MfaChallengeError=Cs,e.MfaEnrollmentError=Rs,e.MfaEnrollmentFactorsError=xs,e.MfaError=Ps,e.MfaListAuthenticatorsError=As,e.MfaRequiredError=D,e.MfaVerifyError=Is,e.MissingRefreshTokenError=z,e.MissingScopesError=J,e.MyAccountApiError=wt,e.OAuthError=Gs,e.PasskeyChallengeError=Ma,e.PasskeyError=js,e.PasskeyGetTokenError=Da,e.PasskeyRegisterError=Na,e.PopupCancelledError=N,e.PopupOpenError=M,e.PopupTimeoutError=L,e.RefreshTokenMode={Offline:"offline",Online:"online"},e.TimeoutError=K,e.UseDpopNonceError=H,e.User=class{},e.initialContext=Fs,e.useAuth0=oc,e.withAuth0=function(e,n){return void 0===n&&(n=Vs),function(r){return t.createElement(n.Consumer,null,function(n){return t.createElement(e,o({},r,{auth0:n}))})}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(r){var s=this,c=n.returnTo,u=void 0===c?ac:c,l=n.onRedirecting,h=void 0===l?rc:l,d=n.onBeforeAuthentication,p=void 0===d?ic:d,f=n.loginOptions,m=n.context,y=oc(void 0===m?Vs:m),w=y.isAuthenticated,g=y.isLoading,v=y.loginWithRedirect;return t.useEffect(function(){if(!g&&!w){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});i(s,void 0,void 0,function(){return a(this,function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,v(e)];case 2:return t.sent(),[2]}})})}},[g,w,v,p,f,u]),w?t.createElement(e,o({},r)):h()}}});
2
2
  //# sourceMappingURL=auth0-react.min.js.map