@versini/auth0-react-thin 2.27.0 → 2.28.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +5 -4
  2. package/dist/auth0-context.d.ts.map +1 -1
  3. package/dist/auth0-react.cjs.js +2 -1
  4. package/dist/auth0-react.cjs.js.map +1 -1
  5. package/dist/auth0-react.esm.js +2 -1
  6. package/dist/auth0-react.esm.js.map +1 -1
  7. package/dist/auth0-react.js +7 -6
  8. package/dist/auth0-react.js.map +1 -1
  9. package/dist/auth0-react.min.js +1 -1
  10. package/dist/auth0-react.min.js.map +1 -1
  11. package/package.json +4 -4
  12. package/src/auth0-context.tsx +1 -0
package/dist/auth0-react.min.js CHANGED
@@ -1,2 +1,2 @@
1
- !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},o.apply(this,arguments)};function r(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function i(e,t,n,o){return new(n||(n=Promise))(function(r,i){function s(e){try{c(o.next(e))}catch(e){i(e)}}function a(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n(function(e){e(t)})).then(s,a)}c((o=o.apply(e,t||[])).next())})}function s(e,t){var n,o,r,i={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},s=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),"function"==typeof Symbol&&(s[Symbol.iterator]=function(){return this}),s;function a(a){return function(c){return function(a){if(n)throw new TypeError("Generator is already executing.");for(;s&&(s=0,a[0]&&(i=0)),i;)try{if(n=1,o&&(r=2&a[0]?o.return:a[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,a[1])).done)return r;switch(o=0,r&&(a=[2&a[0],r.value]),a[0]){case 0:case 1:r=a;break;case 4:return i.label++,{value:a[1],done:!1};case 5:i.label++,o=a[1],a=[0];continue;case 7:a=i.ops.pop(),i.trys.pop();continue;default:if(!(r=i.trys,(r=r.length>0&&r[r.length-1])||6!==a[0]&&2!==a[0])){i=0;continue}if(3===a[0]&&(!r||a[1]>r[0]&&a[1]<r[3])){i.label=a[1];break}if(6===a[0]&&i.label<r[1]){i.label=r[1],r=a;break}if(r&&i.label<r[2]){i.label=r[2],i.ops.push(a);break}r[2]&&i.ops.pop(),i.trys.pop();continue}a=t.call(e,i)}catch(e){a=[6,e],o=0}finally{n=r=0}if(5&a[0])throw a[1];return{value:a[0]?a[1]:void 0,done:!0}}([a,c])}}}function a(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function c(e,t,n,o){if("a"===n&&!o)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!o:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?o:"a"===n?o.call(e):o?o.value:t.get(e)}function u(e,t,n,o,r){if("m"===o)throw new TypeError("Private method is not writable");if("a"===o&&!r)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!r:!t.has(e))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===o?r.call(e,n):r?r.value=n:t.set(e,n),n}function l(e,t){this.v=e,this.k=t}function d(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,o=Array(t);n<t;n++)o[n]=e[n];return o}function h(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function p(e){return new l(e,0)}function f(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function m(e,t){return e.get(h(e,t))}function y(e,t,n){f(e,t),t.set(e,n)}function w(e,t,n){return e.set(h(e,t),n),n}function g(e,t){f(e,t),t.add(e)}function v(e,t,n){return(t=function(e){var t=function(e){if("object"!=typeof e||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function b(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,o)}return n}function _(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?b(Object(n),!0).forEach(function(t){v(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):b(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function k(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n={};for(var o in e)if({}.hasOwnProperty.call(e,o)){if(-1!==t.indexOf(o))continue;n[o]=e[o]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],-1===t.indexOf(n)&&{}.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}function S(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var o,r,i,s,a=[],c=!0,u=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;c=!1}else for(;!(c=(o=i.call(n)).done)&&(a.push(o.value),a.length!==t);c=!0);}catch(e){u=!0,r=e}finally{try{if(!c&&null!=n.return&&(s=n.return(),Object(s)!==s))return}finally{if(u)throw r}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return d(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?d(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function T(e){return function(){return new E(e.apply(this,arguments))}}function E(e){var t,n;function o(t,n){try{var i=e[t](n),s=i.value,a=s instanceof l;Promise.resolve(a?s.v:s).then(function(n){if(a){var c="return"===t&&s.k?t:"next";if(!s.k||n.done)return o(c,n);n=e[c](n).value}r(!!i.done,n)},function(e){o("throw",e)})}catch(e){r(2,e)}}function r(e,r){2===e?t.reject(r):t.resolve({value:r,done:e}),(t=t.next)?o(t.key,t.arg):n=null}this._invoke=function(e,r){return new Promise(function(i,s){var a={key:e,arg:r,resolve:i,reject:s,next:null};n?n=n.next=a:(t=n=a,o(e,r))})},"function"!=typeof e.return&&(this.return=void 0)}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError,E.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},E.prototype.next=function(e){return this._invoke("next",e)},E.prototype.throw=function(e){return this._invoke("throw",e)},E.prototype.return=function(e){return this._invoke("return",e)};const P={timeoutInSeconds:60},C=1e4,A="memory",R="Multifactor authentication required",x="online_access",I={name:"auth0-spa-js",version:"2.27.0"},O=()=>Date.now(),j="default";class W extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,W.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new W(t,n)}}class M extends W{constructor(e,t){super("invalid_configuration","".concat(e," ").concat(t)),this.suggestion=t,Object.setPrototypeOf(this,M.prototype)}}class N extends W{constructor(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,N.prototype)}}class U extends W{constructor(e,t,n,o){let r=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=r,Object.setPrototypeOf(this,U.prototype)}}class L extends W{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,L.prototype)}}class K extends L{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,K.prototype)}}class z extends W{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,z.prototype)}}class J extends W{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,J.prototype)}}class D extends W{constructor(e,t,n,o){super(e,t),this.mfa_token=n,this.mfa_requirements=o,Object.setPrototypeOf(this,D.prototype)}}class Z extends W{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(G(e,["default"]),"', scope: '").concat(G(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,Z.prototype)}}class H extends W{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(G(e,["default"]),"', missing scope: '").concat(G(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,H.prototype)}}class F extends W{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,F.prototype)}}function G(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}const V=()=>window.crypto,X=()=>{let e="";for(;e.length<43;){const t=V().getRandomValues(new Uint8Array(43-e.length));for(const n of t)e.length<43&&n<198&&(e+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~."[n%66])}return e},q=e=>btoa(e),Y=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],B=function(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return Object.keys(e).reduce((n,o)=>{if(t&&"env"===o)return n;const r=Y.find(e=>e.key===o);return r&&r.type.includes(typeof e[o])&&(n[o]=e[o]),n},{})},Q=e=>{var t=e.clientId,n=a(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter(t=>void 0!==e[t]).reduce((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]}),{}))(Object.assign({client_id:t},n))).toString()},$=async e=>{const t=V().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},ee=e=>(e=>decodeURIComponent(atob(e).split("").map(e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),te=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,e=>t[e])})(window.btoa(String.fromCharCode(...Array.from(t))))};var ne="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},oe={},re={};Object.defineProperty(re,"__esModule",{value:!0});var ie=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();re.default=function(){return ie.getInstance()};var se=ne&&ne.__awaiter||function(e,t,n,o){return new(n||(n=Promise))(function(r,i){function s(e){try{c(o.next(e))}catch(e){i(e)}}function a(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){e.done?r(e.value):new n(function(t){t(e.value)}).then(s,a)}c((o=o.apply(e,t||[])).next())})},ae=ne&&ne.__generator||function(e,t){var n,o,r,i,s={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function a(i){return function(a){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;s;)try{if(n=1,o&&(r=2&i[0]?o.return:i[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,i[1])).done)return r;switch(o=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return s.label++,{value:i[1],done:!1};case 5:s.label++,o=i[1],i=[0];continue;case 7:i=s.ops.pop(),s.trys.pop();continue;default:if(!((r=(r=s.trys).length>0&&r[r.length-1])||6!==i[0]&&2!==i[0])){s=0;continue}if(3===i[0]&&(!r||i[1]>r[0]&&i[1]<r[3])){s.label=i[1];break}if(6===i[0]&&s.label<r[1]){s.label=r[1],r=i;break}if(r&&s.label<r[2]){s.label=r[2],s.ops.push(i);break}r[2]&&s.ops.pop(),s.trys.pop();continue}i=t.call(e,s)}catch(e){i=[6,e],o=0}finally{n=r=0}if(5&i[0])throw i[1];return{value:i[0]?i[1]:void 0,done:!0}}([i,a])}}},ce=ne;Object.defineProperty(oe,"__esModule",{value:!0});var ue=re,le="browser-tabs-lock-key",de={key:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},getItem:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},clear:function(){return se(ce,void 0,void 0,function(){return ae(this,function(e){return[2,window.localStorage.clear()]})})},removeItem:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},setItem:function(e,t){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function he(e){return new Promise(function(t){return setTimeout(t,e)})}function pe(e){for(var t="",n=0;n<e;n++)t+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz"[Math.floor(61*Math.random())];return t}var fe=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+pe(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),se(this,void 0,void 0,function(){var o,r,i,s,a,c,u;return ae(this,function(l){switch(l.label){case 0:o=Date.now()+pe(4),r=Date.now()+n,i=le+"-"+t,s=void 0===this.storageHandler?de:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,he(30)]:[3,8];case 2:return l.sent(),null!==s.getItemSync(i)?[3,5]:(a=this.id+"-"+t+"-"+o,[4,he(Math.floor(25*Math.random()))]);case 3:return l.sent(),s.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:a,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,he(30)];case 4:return l.sent(),null!==(c=s.getItemSync(i))&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?de:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+pe(4),[3,1];case 8:return[2,!1]}})})},e.prototype.refreshLockWhileAcquired=function(e,t){return se(this,void 0,void 0,function(){var n=this;return ae(this,function(o){return setTimeout(function(){return se(n,void 0,void 0,function(){var n,o,r;return ae(this,function(i){switch(i.label){case 0:return[4,ue.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?de:this.storageHandler,null===(o=n.getItemSync(e))?(ue.default().unlock(t),[2]):((r=JSON.parse(o)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),ue.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(ue.default().unlock(t),[2])}})})},1e3),[2]})})},e.prototype.waitForSomethingToChange=function(t){return se(this,void 0,void 0,function(){return ae(this,function(n){switch(n.label){case 0:return[4,new Promise(function(n){var o=!1,r=Date.now(),i=!1;function s(){if(i||(window.removeEventListener("storage",s),e.removeFromWaiting(s),clearTimeout(a),i=!0),!o){o=!0;var t=50-(Date.now()-r);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",s),e.addToWaiting(s);var a=setTimeout(s,Math.max(0,t-Date.now()))})];case 1:return n.sent(),[2]}})})},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter(function(e){return e!==t}))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach(function(e){return e()})},e.prototype.releaseLock=function(e){return se(this,void 0,void 0,function(){return ae(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},e.prototype.releaseLock__private__=function(t){return se(this,void 0,void 0,function(){var n,o,r,i;return ae(this,function(s){switch(s.label){case 0:return n=void 0===this.storageHandler?de:this.storageHandler,o=le+"-"+t,null===(r=n.getItemSync(o))?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,ue.default().lock(i.iat)];case 1:s.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),ue.default().unlock(i.iat),e.notifyWaiters(),s.label=2;case 2:return[2]}})})},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,r=[],i=0;;){var s=o.keySync(i);if(null===s)break;r.push(s),i++}for(var a=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes(le)){var l=o.getItemSync(u);if(null!==l){var d=JSON.parse(l);(void 0===d.timeRefreshed&&d.timeAcquired<n||void 0!==d.timeRefreshed&&d.timeRefreshed<n)&&(o.removeItemSync(u),a=!0)}}}a&&e.notifyWaiters()},e.waiters=void 0,e}(),me=oe.default=fe;class ye{async runWithLock(e,t,n){const o=new AbortController,r=setTimeout(()=>o.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:o.signal},async e=>{if(clearTimeout(r),!e)throw new Error("Lock not available");return await n()})}catch(e){if(clearTimeout(r),"AbortError"===(null==e?void 0:e.name))throw new L;throw e}}}class we{constructor(){this.activeLocks=new Set,this.lock=new me,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}async runWithLock(e,t,n){let o=!1;for(let n=0;n<10&&!o;n++)o=await this.lock.acquireLock(e,t);if(!o)throw new L;this.activeLocks.add(e),1===this.activeLocks.size&&"undefined"!=typeof window&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),0===this.activeLocks.size&&"undefined"!=typeof window&&window.removeEventListener("pagehide",this.pagehideHandler)}}}let ge=null;function ve(){return ge||(ge=function(){return"undefined"!=typeof navigator&&"function"==typeof(null===(e=navigator.locks)||void 0===e?void 0:e.request)?new ye:new we;var e}()),ge}const be=new TextEncoder,_e=new TextDecoder;function ke(e){return"string"==typeof e?be.encode(e):_e.decode(e)}function Se(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new Ce(`${e.name} modulusLength must be at least 2048 bits`)}let Te;if(Uint8Array.prototype.toBase64)Te=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Te=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function Ee(e){return Te(e)}class Pe extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class Ce extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function Ae(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new Pe("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new Pe("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new Pe("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new Pe("unsupported CryptoKey algorithm name")}}function Re(e){return e instanceof CryptoKey}function xe(e){return Re(e)&&"public"===e.type}async function Ie(e,t,n,o,r,i){const s=null==e?void 0:e.privateKey,a=null==e?void 0:e.publicKey;if(!Re(c=s)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!xe(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==a.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==r&&"string"!=typeof r)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==i&&("object"!=typeof i||null===i||Array.isArray(i)))throw new TypeError('"additional" must be an object');const u=Object.assign(Object.create(null),i,{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:r?Ee(await crypto.subtle.digest("SHA-256",ke(r))):void 0});return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${Ee(ke(JSON.stringify(e)))}.${Ee(ke(JSON.stringify(t)))}`;return`${o}.${Ee(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Se(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Se(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new Pe}(n),n,ke(o)))}`}({alg:Ae(s),typ:"dpop+jwt",jwk:await Oe(a)},u,s)}async function Oe(e){const{kty:t,e:n,n:o,x:r,y:i,crv:s}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:s,e:n,n:o,x:r,y:i}}const je="dpop-nonce",We=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];const Me=(e,t)=>new Promise(function(n,o){const r=new MessageChannel;r.port1.onmessage=function(e){e.data.error?o(new Error(e.data.error)):n(e.data),r.port1.close()},t.postMessage(e,[r.port2])}),Ne=(e,t,n)=>{const o=new AbortController;let r;return t.signal=o.signal,Promise.race([fetch(e,t),new Promise((e,t)=>{r=setTimeout(()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))},n)})]).finally(()=>{clearTimeout(r)})},Ue=async function(e,t,n,o,r,i){let s=arguments.length>6&&void 0!==arguments[6]?arguments[6]:C;return r?(async(e,t,n,o,r,i,s,a,c,u)=>Me({type:"refresh",auth:{audience:t,scope:n},timeout:r,fetchUrl:e,fetchOptions:o,useFormData:s,useMrrt:a,skipTokenStorage:c,preserveRefreshToken:u},i))(e,t,n,o,s,r,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0,arguments.length>9?arguments[9]:void 0):(async(e,t,n)=>{const o=await Ne(e,t,n);return{ok:o.ok,json:await o.json(),headers:(r=o.headers,[...r].reduce((e,t)=>{let n=S(t,2),o=n[0],r=n[1];return e[o]=r,e},{}))};var r})(e,o,s)};async function Le(e,t,n,o,r,i,s,c,u,l,d,h){if(u){const t=await u.generateProof({url:e,method:r.method||"GET",nonce:await u.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:t})}let p,f=null;for(let a=0;a<3;a++)try{p=await Ue(e,n,o,r,i,s,t,c,d,h),f=null;break}catch(e){f=e}if(f)throw f;const m=p.json,y=m.error,w=m.error_description,g=a(m,["error","error_description"]),v=p,b=v.headers,_=v.ok;let k;if(u&&(k=b[je],k&&await u.setNonce(k)),!_){const a=w||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===y)throw new D(y,a,g.mfa_token,g.mfa_requirements);if("missing_refresh_token"===y)throw new Z(n,o);if("use_dpop_nonce"===y){if(!u||!k||l)throw new F(k);return Le(e,t,n,o,r,i,s,c,u,!0,d,h)}throw new W(y||"request_error",a)}return g}async function Ke(e,t,n){var o=e.baseUrl,r=e.timeout,i=e.audience,s=e.scope,c=e.auth0Client,u=e.useFormData,l=e.useMrrt,d=e.dpop,h=e.preserveRefreshToken,p=a(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop","preserveRefreshToken"]);const f="urn:ietf:params:oauth:grant-type:token-exchange"===p.grant_type,m="urn:okta:params:oauth:grant-type:webauthn"===p.grant_type,y="refresh_token"===p.grant_type&&l,w=f||m||y,g=Object.assign(Object.assign(Object.assign({},p),w&&i&&{audience:i}),w&&s&&{scope:s}),v=m||!u,b=v?JSON.stringify(g):Q(g),_=(k=p.grant_type,We.includes(k));var k;return await Le("".concat(o,"/oauth/token"),r,i||j,s,{method:"POST",body:b,headers:{"Content-Type":v?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(B(c||I)))}},t,u,l,_?d:void 0,void 0,n,h)}const ze=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return(o=t.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(o))).join(" ");var o},Je=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e[j]),ze(o,t)},De="@@auth0spajs@@",Ze="@@user@@";class He{constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:De,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const t=S(e.split("::"),4),n=t[0],o=t[1],r=t[2],i=t[3];return new He({clientId:o,scope:i,audience:r},n)}static fromCacheEntry(e){const t=e.scope,n=e.audience,o=e.client_id;return new He({scope:t,audience:n,clientId:o})}}class Fe{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(De))}}class Ge{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class Ve{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||O}async setIdToken(e,t,n){var o;const r=this.getIdTokenCacheKey(e);await this.cache.set(r,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(r))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var r;let i=await this.cache.get(e.toKey()),s=e;if(!i){const t=await this.getCacheKeys();if(!t)return;const r=this.matchExistingCacheKey(e,t);if(r&&(i=await this.cache.get(r),s=He.fromKey(r)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;const a=await this.nowProvider(),c=Math.floor(a/1e3);return i.expiresAt-t<c?i.body.refresh_token?this.modifiedCachedEntry(i,s):(await this.cache.remove(s.toKey()),void await(null===(r=this.keyManifest)||void 0===r?void 0:r.remove(s.toKey()))):i.body}async modifiedCachedEntry(e,t){const n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},o={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),o),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;const n=new He({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new He({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async stripRefreshToken(e){var t;const n=await this.getCacheKeys();if(n)for(const o of n){const n=await this.cache.get(o);(null===(t=null==n?void 0:n.body)||void 0===t?void 0:t.refresh_token)===e&&(delete n.body.refresh_token,await this.cache.set(o,n))}}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter(t=>!e||t.includes(e)).reduce(async(e,t)=>{await e,await this.cache.remove(t)},Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new He({clientId:e},De,Ze).toKey()}matchExistingCacheKey(e,t){return t.filter(t=>{var n;const o=He.fromKey(t),r=new Set(o.scope&&o.scope.split(" ")),i=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],s=o.scope&&i.reduce((e,t)=>e&&r.has(t),!0);return o.prefix===De&&o.clientId===e.clientId&&o.audience===e.audience&&s})[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=He.fromKey(o);if(t.prefix===De&&t.clientId===e.clientId){const e=await this.cache.get(o);if(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)return{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;const o=await this.getCacheKeys();if(!o)return[];const r=new Set;for(const i of o){const o=He.fromKey(i);if(o.prefix===De&&o.clientId===t&&o.audience===e){const e=await this.cache.get(i);(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)&&r.add(e.body.refresh_token)}}return Array.from(r)}async updateEntry(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const r=await this.getCacheKeys();if(r)for(const i of r){if(He.fromKey(i).clientId!==n)continue;const r=await this.cache.get(i);if(!(null==r?void 0:r.body))continue;const s=r.body.refresh_token;s&&(o||s===e)&&(r.body.refresh_token=t,await this.cache.set(i,r))}}}class Xe{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const qe=e=>"number"==typeof e,Ye=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var Be=ne&&ne.__assign||function(){return Be=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},Be.apply(this,arguments)};function Qe(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}var $e=function(e){return function(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),s=i.slice(1).join("=");'"'===s.charAt(0)&&(s=s.slice(1,-1));try{t[i[0].replace(o,decodeURIComponent)]=s.replace(o,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e]};function et(e,t,n){document.cookie=function(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return Qe("Expires",e.expires?e.expires.toUTCString():"")+Qe("Domain",e.domain)+Qe("Path",e.path)+Qe("Secure",e.secure)+Qe("SameSite",e.sameSite)}(n)}(e,t,Be({path:"/"},n))}var tt=et,nt=function(e,t){et(e,"",Be(Be({},t),{expires:-1}))};const ot={get(e){const t=$e(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),tt(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),nt(e,n)}},rt="_legacy_",it={get:e=>ot.get(e)||ot.get("".concat(rt).concat(e)),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),tt("".concat(rt).concat(e),JSON.stringify(t),o),ot.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),nt(e,n),ot.remove(e,t),ot.remove("".concat(rt).concat(e),t)}},st={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var at,ct=function(e){return at=at||function(e,t,n){var o=void 0===t?null:t,r=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),r=0,i=n.length;r<i;++r)o[r]=n.charCodeAt(r);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),i=r.indexOf("\n",10)+1,s=r.substring(i)+(o?"//# sourceMappingURL="+o:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxhLGk9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihpLnB1c2goby52YWx1ZSksaS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoYT1yLnJldHVybigpLE9iamVjdChhKSE9PWEpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGl9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGE9e30saT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PShlLHQpPT5hW2MoZSx0KV0sZj1lPT57T2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChyPT57bGV0IG89dChyLDIpLG49b1swXTtvWzFdPT09ZSYmZGVsZXRlIGFbbl19KX0saD1lPT57Y29uc3QgdD1uZXcgVVJMU2VhcmNoUGFyYW1zKGUpLHI9e307cmV0dXJuIHQuZm9yRWFjaCgoZSx0KT0+e3JbdF09ZX0pLHJ9LGQ9YXN5bmMgZT0+e2xldCByLG4saT1lLmRhdGEsZj1pLnRpbWVvdXQsZD1pLmF1dGgscD1pLmZldGNoVXJsLHk9aS5mZXRjaE9wdGlvbnMsZz1pLnVzZUZvcm1EYXRhLGI9aS51c2VNcnJ0LE89aS5za2lwVG9rZW5TdG9yYWdlLGs9aS5wcmVzZXJ2ZVJlZnJlc2hUb2tlbixtPXQoZS5wb3J0cywxKVswXSxqPXt9O2NvbnN0IHY9ZHx8e30sXz12LmF1ZGllbmNlLHc9di5zY29wZTt0cnl7Y29uc3QgZT1nP2goeS5ib2R5KTpKU09OLnBhcnNlKHkuYm9keSk7aWYoZS5yZWZyZXNoX3Rva2VufHwicmVmcmVzaF90b2tlbiIhPT1lLmdyYW50X3R5cGUpZS5tZmFfdG9rZW4mJihuPXUoXyx3KSwhbiYmYiYmKG49YS5sYXRlc3RfcmVmcmVzaF90b2tlbikpO2Vsc2V7aWYobj11KF8sdyksIW4mJmIpe2NvbnN0IGU9YS5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+ISFPYmplY3Qua2V5cyhhKS5maW5kKHI9PntpZigibGF0ZXN0X3JlZnJlc2hfdG9rZW4iIT09cil7Y29uc3Qgbz1sKHQsciksbj1yLnNwbGl0KCJ8IilbMV0uc3BsaXQoIiAiKSxzPWUuc3BsaXQoIiAiKS5ldmVyeShlPT5uLmluY2x1ZGVzKGUpKTtyZXR1cm4gbyYmc319KSkodyxfKTtlJiYhdCYmKG49ZSl9aWYoIW4pdGhyb3cgbmV3IG8oXyx3KTt5LmJvZHk9Zz9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpfWxldCBpLGQ7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGk9bmV3IEFib3J0Q29udHJvbGxlcix5LnNpZ25hbD1pLnNpZ25hbCk7dHJ5e2Q9YXdhaXQgUHJvbWlzZS5yYWNlKFsoUD1mLG5ldyBQcm9taXNlKGU9PnNldFRpbWVvdXQoZSxQKSkpLGZldGNoKHAsT2JqZWN0LmFzc2lnbih7fSx5KSldKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBtLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighZClyZXR1cm4gaSYmaS5hYm9ydCgpLHZvaWQgbS5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZihVPWQuaGVhZGVycyxqPVsuLi5VXS5yZWR1Y2UoKGUscik9PntsZXQgbz10KHIsMiksbj1vWzBdLHM9b1sxXTtyZXR1cm4gZVtuXT1zLGV9LHt9KSxyPWF3YWl0IGQuanNvbigpLE8pcmV0dXJuIGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4sdm9pZCBtLnBvc3RNZXNzYWdlKHtvazpkLm9rLGpzb246cixoZWFkZXJzOmp9KTtyLnJlZnJlc2hfdG9rZW4/KGImJihhLmxhdGVzdF9yZWZyZXNoX3Rva2VuPXIucmVmcmVzaF90b2tlbixTPW4sTT1yLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChlPT57bGV0IHI9dChlLDIpLG89clswXTtyWzFdPT09UyYmKGFbb109TSl9KSksKChlLHQscik9PnthW2ModCxyKV09ZX0pKHIucmVmcmVzaF90b2tlbixfLHcpLGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4pOmt8fCgoZSx0KT0+e2RlbGV0ZSBhW2MoZSx0KV19KShfLHcpLG0ucG9zdE1lc3NhZ2Uoe29rOmQub2ssanNvbjpyLGhlYWRlcnM6an0pfWNhdGNoKGUpe20ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOmp9KX12YXIgUyxNLFUsUH0scD1hc3luYyBlPT57bGV0IHI9ZS5kYXRhLG89ci50aW1lb3V0LG49ci5hdXRoLGk9ci5mZXRjaFVybCxjPXIuZmV0Y2hPcHRpb25zLHU9ci51c2VGb3JtRGF0YSxkPXQoZS5wb3J0cywxKVswXTtjb25zdCBwPShufHx7fSkuYXVkaWVuY2U7dHJ5e2NvbnN0IGU9KGU9Pntjb25zdCByPW5ldyBTZXQ7cmV0dXJuIE9iamVjdC5lbnRyaWVzKGEpLmZvckVhY2gobz0+e2xldCBuPXQobywyKSxzPW5bMF0sYT1uWzFdO2woZSxzKSYmci5hZGQoYSl9KSxBcnJheS5mcm9tKHIpfSkocCk7aWYoMD09PWUubGVuZ3RoKXJldHVybiB2b2lkIGQucG9zdE1lc3NhZ2Uoe29rOiEwfSk7Y29uc3Qgcj11P2goYy5ib2R5KTpKU09OLnBhcnNlKGMuYm9keSk7Zm9yKGNvbnN0IHQgb2YgZSl7Y29uc3QgZT11P3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7dG9rZW46dH0pKTtsZXQgbixhLGwsaDsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYobj1uZXcgQWJvcnRDb250cm9sbGVyLGE9bi5zaWduYWwpO3RyeXtoPWF3YWl0IFByb21pc2UucmFjZShbbmV3IFByb21pc2UoZT0+e2w9c2V0VGltZW91dChlLG8pfSksZmV0Y2goaSxPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sYykse2JvZHk6ZSxzaWduYWw6YX0pKV0pLmZpbmFsbHkoKCk9PmNsZWFyVGltZW91dChsKSl9Y2F0Y2goZSl7cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfSl9aWYoIWgpcmV0dXJuIG4mJm4uYWJvcnQoKSx2b2lkIGQucG9zdE1lc3NhZ2Uoe2Vycm9yOiJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCcifSk7aWYoIWgub2spe2xldCBlO3RyeXtjb25zdCB0PUpTT04ucGFyc2UoYXdhaXQgaC50ZXh0KCkpO2U9dC5lcnJvcl9kZXNjcmlwdGlvbn1jYXRjaChlKXt9cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZXx8IkhUVFAgZXJyb3IgIi5jb25jYXQoaC5zdGF0dXMpfSl9Zih0KX1kLnBvc3RNZXNzYWdlKHtvazohMH0pfWNhdGNoKGUpe2QucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZXx8IlVua25vd24gZXJyb3IgZHVyaW5nIHRva2VuIHJldm9jYXRpb24ifSl9fSx5PShlLHQpPT57aWYoIWkpcmV0dXJuITE7dHJ5e2NvbnN0IHI9bmV3IFVSTChpKS5vcmlnaW4sbz1uZXcgVVJMKGUuZmV0Y2hVcmwpO3JldHVybiBvLm9yaWdpbj09PXImJm8ucGF0aG5hbWU9PT10fWNhdGNoKGUpe3JldHVybiExfX07YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsZT0+e2NvbnN0IHI9ZS5kYXRhLG89dChlLnBvcnRzLDEpWzBdO2lmKCEoInR5cGUiaW4gcil8fCJpbml0IiE9PXIudHlwZSlyZXR1cm4idHlwZSJpbiByJiYiY2xlYXIiPT09ci50eXBlPyhhPXt9LHZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITB9KSkpOiJ0eXBlImluIHImJiJyZXZva2UiPT09ci50eXBlP3kociwiL29hdXRoL3Jldm9rZSIpP3ZvaWQgcChlKTp2b2lkKG51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpOnZvaWQoImZldGNoVXJsImluIHImJnkociwiL29hdXRoL3Rva2VuIik/ZChlKTpudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjoiaW52YWxpZF9mZXRjaF91cmwiLGVycm9yX2Rlc2NyaXB0aW9uOiJVbmF1dGhvcml6ZWQgZmV0Y2ggVVJMIn0saGVhZGVyczp7fX0pKTtpZihudWxsPT09aSl0cnl7bmV3IFVSTChyLmFsbG93ZWRCYXNlVXJsKSxpPXIuYWxsb3dlZEJhc2VVcmx9Y2F0Y2goZSl7cmV0dXJufX0pfSgpOwoK",null,false),new Worker(at,e)};class ut{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(De,"::").concat(e)}}const lt="auth0.is.authenticated",dt={memory:()=>(new Ge).enclosedCache,localstorage:()=>new Fe},ht=e=>dt[e],pt=e=>{const t=e.openUrl,n=e.onRedirect,o=a(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},ft={NONCE:"nonce",KEYPAIR:"keypair"};class mt{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(ft).forEach(t=>e.result.createObjectStore(t)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)})}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(ft.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(ft.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",e=>e.put(n,t))}findNonce(e){return this.find(ft.NONCE,this.buildKey(e))}findKeyPair(){return this.find(ft.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",e=>e.get(t))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",e=>e.getAllKeys());await Promise.all((null==n?void 0:n.filter(t).map(t=>this.executeDbRequest(e,"readwrite",e=>e.delete(t))))||[])}deleteByClientId(e,t){return this.deleteBy(e,e=>"string"==typeof e&&e.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(ft.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(ft.KEYPAIR,this.clientId)}}class yt{constructor(e){this.storage=new mt(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function(e){let t=e.keyPair,n=e.url,o=e.method,r=e.nonce,i=e.accessToken;const s=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(n);return Ie(t,s,o,r,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!xe(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await Oe(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new Pe("unsupported JWK kty")}return Ee(await crypto.subtle.digest({name:"SHA-256"},ke(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var wt;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(wt||(wt={}));class gt{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:wt.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);if(void 0===n)throw new W("missing_access_token","No access token available");let o,r;"string"==typeof n?(o=this.config.dpopNonceId?wt.DPoP:wt.Bearer,r=n):(o=n.token_type,r=n.access_token),this.setAuthorizationHeader(e,r,o),o===wt.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,je);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new F(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const r=this.buildBaseRequest(e,t);await this.prepareRequest(r,o);const i=await this.config.fetch(r);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class vt{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){const e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){const t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),o=await this._handleResponse(n),r=null!==(t=n.headers.get("location"))&&void 0!==t?t:"",i=decodeURIComponent(r.split("/").pop()||"");return Object.assign(Object.assign({},o),{id:i,location:r})}async enrollmentVerify(e){const t=e,n=t.location;t.type;const o=a(t,["location","type"]),r=await this.myAccountFetcher.fetchWithAuth("".concat(n,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},{scope:["create:me:authentication_methods"]});return this._handleResponse(r)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new bt({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new bt(t)}}class bt extends Error{constructor(e){let t=e.type,n=e.status,o=e.title,r=e.detail,i=e.validation_errors;super(r),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=r,this.validation_errors=i,Object.setPrototypeOf(this,bt.prototype)}}const _t={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}};var kt,St;let Tt;if("undefined"==typeof navigator||null===(kt=navigator.userAgent)||void 0===kt||null===(St=kt.startsWith)||void 0===St||!St.call(kt,"Mozilla/5.0 ")){const e="v3.8.6";Tt="".concat("oauth4webapi","/").concat(e)}function Et(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}const Pt="ERR_INVALID_ARG_VALUE",Ct="ERR_INVALID_ARG_TYPE";function At(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}const Rt=Symbol(),xt=Symbol(),It=Symbol(),Ot=Symbol(),jt=Symbol(),Wt=Symbol(),Mt=new TextEncoder,Nt=new TextDecoder;function Ut(e){return"string"==typeof e?Mt.encode(e):Nt.decode(e)}let Lt,Kt;if(Uint8Array.prototype.toBase64)Lt=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Lt=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function zt(e){return"string"==typeof e?Kt(e):Lt(e)}Kt=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw At("The input to be decoded is not correctly encoded.",Pt,e)}}:e=>{try{const t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw At("The input to be decoded is not correctly encoded.",Pt,e)}};class Jt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=Fn,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class Dt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function Zt(e,t,n){return new Dt(e,{code:t,cause:n})}function Ht(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function Ft(e){Et(e,Headers)&&(e=Object.fromEntries(e.entries()));const t=new Headers(null!=e?e:{});if(Tt&&!t.has("user-agent")&&t.set("user-agent",Tt),t.has("authorization"))throw At('"options.headers" must not include the "authorization" header name',Pt);return t}function Gt(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw At('"options.signal" must return or be an instance of AbortSignal',Ct);return t}}function Vt(e){return e.includes("//")?e.replace("//","/"):e}function Xt(e,t,n,o,r){try{if("number"!=typeof e||!Number.isFinite(e))throw At("".concat(n," must be a number"),Ct,r);if(e>0)return;if(t){if(0!==e)throw At("".concat(n," must be a non-negative number"),Pt,r);return}throw At("".concat(n," must be a positive number"),Pt,r)}catch(e){if(o)throw Zt(e.message,o,r);throw e}}function qt(e,t,n,o){try{if("string"!=typeof e)throw At("".concat(t," must be a string"),Ct,o);if(0===e.length)throw At("".concat(t," must not be empty"),Pt,o)}catch(e){if(n)throw Zt(e.message,n,o);throw e}}function Yt(e){!function(e,t){if(Tn(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];if(o.length>2){const e=o.pop();t+="".concat(o.join(", "),", or ").concat(e)}else 2===o.length?t+="".concat(o[0]," or ").concat(o[1]):t+=o[0];return Zt(t,Yn,e)}(e,t)}(e,"application/json")}function Bt(){return zt(crypto.getRandomValues(new Uint8Array(32)))}function Qt(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new Jt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"RSASSA-PKCS1-v1_5":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new Jt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"ECDSA":return function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new Jt("unsupported EcKeyAlgorithm namedCurve",{cause:e})}}(e);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new Jt("unsupported CryptoKey algorithm name",{cause:e})}}function $t(e){const t=null==e?void 0:e[xt];return"number"==typeof t&&Number.isFinite(t)?t:0}function en(e){const t=null==e?void 0:e[It];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function tn(){return Math.floor(Date.now()/1e3)}function nn(e){if("object"!=typeof e||null===e)throw At('"as" must be an object',Ct);qt(e.issuer,'"as.issuer"')}function on(e){if("object"!=typeof e||null===e)throw At('"client" must be an object',Ct);qt(e.client_id,'"client.client_id"')}function rn(e){return qt(e,'"clientSecret"'),(t,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",e)}}function sn(e,t){const n=(i=e)instanceof CryptoKey?{key:i}:(null==i?void 0:i.key)instanceof CryptoKey?(void 0!==i.kid&&qt(i.kid,'"kid"'),{key:i.key,kid:i.kid}):{},o=n.key,r=n.kid;var i;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw At("".concat(t," must be a CryptoKey"),Ct)}(e,t),"private"!==e.type)throw At("".concat(t," must be a private CryptoKey"),Pt)}(o,'"clientPrivateKey.key"'),async(e,n,i,s)=>{var a;const c={alg:Qt(o),kid:r},u=function(e,t){const n=tn()+$t(t);return{jti:Bt(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,n);null==t||null===(a=t[jt])||void 0===a||a.call(t,c,u),i.set("client_id",n.client_id),i.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),i.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw At('CryptoKey instances used for signing assertions must include "sign" in their "usages"',Pt);const o="".concat(zt(Ut(JSON.stringify(e))),".").concat(zt(Ut(JSON.stringify(t)))),r=zt(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:co(e)};case"RSA-PSS":switch(ao(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new Jt("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return ao(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new Jt("unsupported CryptoKey algorithm name",{cause:e})}(n),n,Ut(o)));return"".concat(o,".").concat(r)}(c,u,o))}}const an=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function cn(e,t){if(t&&"https:"!==e.protocol)throw Zt("only requests to HTTPS are allowed",Qn,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw Zt("only HTTP and HTTPS requests are allowed",$n,e)}function un(e,t,n,o){let r;if("string"!=typeof e||!(r=an(e)))throw Zt("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?oo:ro,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return cn(r,o),r}function ln(e,t,n,o){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?un(e.mtls_endpoint_aliases[t],t,n,o):un(e[t],t,n,o)}class dn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"status",void 0),v(this,"error_description",void 0),v(this,"response",void 0),this.name=this.constructor.name,this.code=Hn,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class hn extends Error{constructor(e,t){var n,o;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"error_description",void 0),this.name=this.constructor.name,this.code=Gn,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!==(n=t.cause.get("error_description"))&&void 0!==n?n:void 0,null===(o=Error.captureStackTrace)||void 0===o||o.call(Error,this,this.constructor)}}class pn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"response",void 0),v(this,"status",void 0),this.name=this.constructor.name,this.code=Zn,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}const fn="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",mn="("+fn+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"',yn="("+fn+")\\s*=\\s*("+fn+")",wn=new RegExp("^[,\\s]*("+fn+")"),gn=new RegExp("^[,\\s]*"+mn+"[,\\s]*(.*)"),vn=new RegExp("^[,\\s]*"+yn+"[,\\s]*(.*)"),bn=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function _n(e,t,n){if(e.status!==t){let t;var o;if(On(e),t=await async function(e){if(e.status>399&&e.status<500){so(e),Yt(e);try{const t=await e.clone().json();if(Ht(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await(null===(o=e.body)||void 0===o?void 0:o.cancel()),new dn("server responded with an error in the response body",{cause:t,response:e});throw Zt('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),Bn,e)}}function kn(e){if(!Un.has(e))throw At('"options.DPoP" is not a valid DPoPHandle',Pt)}const Sn=Symbol();function Tn(e){var t;return null===(t=e.headers.get("content-type"))||void 0===t?void 0:t.split(";")[0]}async function En(e,t,n,o,r){if(nn(e),on(t),!Et(o,Response))throw At('"response" must be an instance of Response',Ct);if(On(o),200!==o.status)throw Zt('"response" is not a conform UserInfo Endpoint response (unexpected HTTP status code)',Bn,o);let i;if(so(o),"application/jwt"===Tn(o)){const n=await uo(await o.text(),lo.bind(void 0,t.userinfo_signed_response_alg,e.userinfo_signing_alg_values_supported,void 0),$t(t),en(t),null==r?void 0:r[Wt]).then(jn.bind(void 0,t.client_id)).then(Mn.bind(void 0,e)),s=n.claims,a=n.jwt;Rn.set(o,a),i=s}else{if(t.userinfo_signed_response_alg)throw Zt("JWT UserInfo Response expected",Vn,o);i=await mo(o)}if(qt(i.sub,'"response" body "sub" property',qn,{body:i}),n===Sn);else if(qt(n,'"expectedSubject"'),i.sub!==n)throw Zt('unexpected "response" body "sub" property value',no,{expected:n,body:i,attribute:"sub"});return i}async function Pn(e,t,n,o,r,i,s){return await n(e,t,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==s?void 0:s[Ot])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Gt(o,null==s?void 0:s.signal)})}async function Cn(e,t,n,o,r,i){var s;const a=ln(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[Rt]));r.set("grant_type",o);const c=Ft(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(kn(i.DPoP),await i.DPoP.addProof(a,c,"POST"));const u=await Pn(e,t,n,a,r,c,i);return null==i||null===(s=i.DPoP)||void 0===s||s.cacheNonce(u,a),u}const An=new WeakMap,Rn=new WeakMap;function xn(e){if(!e.id_token)return;const t=An.get(e);if(!t)throw At('"ref" was already garbage collected or did not resolve from the proper sources',Pt);return t}async function In(e,t,n,o,r,i){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Ct);await _n(n,200,"Token Endpoint"),so(n);const s=await mo(n);if(qt(s.access_token,'"response" body "access_token" property',qn,{body:s}),qt(s.token_type,'"response" body "token_type" property',qn,{body:s}),s.token_type=s.token_type.toLowerCase(),void 0!==s.expires_in){let e="number"!=typeof s.expires_in?parseFloat(s.expires_in):s.expires_in;Xt(e,!0,'"response" body "expires_in" property',qn,{body:s}),s.expires_in=e}if(void 0!==s.refresh_token&&qt(s.refresh_token,'"response" body "refresh_token" property',qn,{body:s}),void 0!==s.scope&&"string"!=typeof s.scope)throw Zt('"response" body "scope" property must be a string',qn,{body:s});if(void 0!==s.id_token){qt(s.id_token,'"response" body "id_token" property',qn,{body:s});const i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(Xt(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=o&&o.length&&i.push(...o);const a=await uo(s.id_token,lo.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),$t(t),en(t),r).then(zn.bind(void 0,i)).then(Nn.bind(void 0,e)).then(Wn.bind(void 0,t.client_id)),c=a.claims,u=a.jwt;if(Array.isArray(c.aud)&&1!==c.aud.length){if(void 0===c.azp)throw Zt('ID Token "aud" (audience) claim includes additional untrusted audiences',to,{claims:c,claim:"aud"});if(c.azp!==t.client_id)throw Zt('unexpected ID Token "azp" (authorized party) claim value',to,{expected:t.client_id,claims:c,claim:"azp"})}void 0!==c.auth_time&&Xt(c.auth_time,!0,'ID Token "auth_time" (authentication time)',qn,{claims:c}),Rn.set(n,u),An.set(s,c)}if(void 0!==(null==i?void 0:i[s.token_type]))i[s.token_type](n,s);else if("dpop"!==s.token_type&&"bearer"!==s.token_type)throw new Jt("unsupported `token_type` value",{cause:{body:s}});return s}function On(e){let t;if(t=function(e){if(!Et(e,Response))throw At('"response" must be an instance of Response',Ct);const t=e.headers.get("www-authenticate");if(null===t)return;const n=[];let o=t;for(;o;){var r;let t=o.match(wn);const c=null===(r=t)||void 0===r?void 0:r[1].toLowerCase();if(!c)return;const u=o.substring(t[0].length);if(u&&!u.match(/^[\s,]/))return;const l=u.match(/^\s+(.*)$/),d=!!l;o=l?l[1]:void 0;const h={};let p;if(d)for(;o;){let n,r;if(t=o.match(gn)){var i=S(t,4);if(n=i[1],r=i[2],o=i[3],r.includes("\\"))try{r=JSON.parse('"'.concat(r,'"'))}catch(e){}h[n.toLowerCase()]=r}else{if(!(t=o.match(vn))){if(t=o.match(bn)){if(Object.keys(h).length)break;var s=S(t,3);p=s[1],o=s[2];break}return}var a=S(t,4);n=a[1],r=a[2],o=a[3],h[n.toLowerCase()]=r}}else o=u||void 0;const f={scheme:c,parameters:h};p&&(f.token68=p),n.push(f)}return n.length?n:void 0}(e))throw new pn("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}function jn(e,t){return void 0!==t.claims.aud?Wn(e,t):t}function Wn(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw Zt('unexpected JWT "aud" (audience) claim value',to,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw Zt('unexpected JWT "aud" (audience) claim value',to,{expected:e,claims:t.claims,claim:"aud"});return t}function Mn(e,t){return void 0!==t.claims.iss?Nn(e,t):t}function Nn(e,t){var n,o;const r=null!==(n=null===(o=e[wo])||void 0===o?void 0:o.call(e,t))&&void 0!==n?n:e.issuer;if(t.claims.iss!==r)throw Zt('unexpected JWT "iss" (issuer) claim value',to,{expected:r,claims:t.claims,claim:"iss"});return t}const Un=new WeakSet,Ln=Symbol(),Kn={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function zn(e,t){for(const n of e)if(void 0===t.claims[n])throw Zt('JWT "'.concat(n,'" (').concat(Kn[n],") claim missing"),qn,{claims:t.claims});return t}const Jn=Symbol(),Dn=Symbol();const Zn="OAUTH_WWW_AUTHENTICATE_CHALLENGE",Hn="OAUTH_RESPONSE_BODY_ERROR",Fn="OAUTH_UNSUPPORTED_OPERATION",Gn="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Vn="OAUTH_JWT_USERINFO_EXPECTED",Xn="OAUTH_PARSE_ERROR",qn="OAUTH_INVALID_RESPONSE",Yn="OAUTH_RESPONSE_IS_NOT_JSON",Bn="OAUTH_RESPONSE_IS_NOT_CONFORM",Qn="OAUTH_HTTP_REQUEST_FORBIDDEN",$n="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",eo="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",to="OAUTH_JWT_CLAIM_COMPARISON_FAILED",no="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",oo="OAUTH_MISSING_SERVER_METADATA",ro="OAUTH_INVALID_SERVER_METADATA";async function io(e){if(!Et(e,Response))throw At('"response" must be an instance of Response',Ct);await _n(e,200,"Revocation Endpoint")}function so(e){if(e.bodyUsed)throw At('"response" body has been used already',Pt)}function ao(e){const t=e.algorithm;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new Jt("unsupported ".concat(t.name," modulusLength"),{cause:e})}function co(e){switch(e.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new Jt("unsupported ECDSA namedCurve",{cause:e})}}async function uo(e,t,n,o,r){let i,s,a=e.split("."),c=a[0],u=a[1],l=a.length;if(5===l){if(void 0===r)throw new Jt("JWE decryption is not configured",{cause:e});var d=(e=await r(e)).split(".");c=d[0],u=d[1],l=d.length}if(3!==l)throw Zt("Invalid JWT",qn,e);try{i=JSON.parse(Ut(zt(c)))}catch(e){throw Zt("failed to parse JWT Header body as base64url encoded JSON",Xn,e)}if(!Ht(i))throw Zt("JWT Header must be a top level object",qn,e);if(t(i),void 0!==i.crit)throw new Jt('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{s=JSON.parse(Ut(zt(u)))}catch(e){throw Zt("failed to parse JWT Payload body as base64url encoded JSON",Xn,e)}if(!Ht(s))throw Zt("JWT Payload must be a top level object",qn,e);const h=tn()+n;if(void 0!==s.exp){if("number"!=typeof s.exp)throw Zt('unexpected JWT "exp" (expiration time) claim type',qn,{claims:s});if(s.exp<=h-o)throw Zt('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',eo,{claims:s,now:h,tolerance:o,claim:"exp"})}if(void 0!==s.iat&&"number"!=typeof s.iat)throw Zt('unexpected JWT "iat" (issued at) claim type',qn,{claims:s});if(void 0!==s.iss&&"string"!=typeof s.iss)throw Zt('unexpected JWT "iss" (issuer) claim type',qn,{claims:s});if(void 0!==s.nbf){if("number"!=typeof s.nbf)throw Zt('unexpected JWT "nbf" (not before) claim type',qn,{claims:s});if(s.nbf>h+o)throw Zt('unexpected JWT "nbf" (not before) claim value',eo,{claims:s,now:h,tolerance:o,claim:"nbf"})}if(void 0!==s.aud&&"string"!=typeof s.aud&&!Array.isArray(s.aud))throw Zt('unexpected JWT "aud" (audience) claim type',qn,{claims:s});return{header:i,claims:s,jwt:e}}function lo(e,t,n,o){if(void 0===e)if(Array.isArray(t)){if(!t.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw Zt('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?o.alg!==n:"function"==typeof n?!n(o.alg):!n.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:n,reason:"default value"})}else if("string"==typeof e?o.alg!==e:!e.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:e,reason:"client configuration"})}function ho(e,t){const n=e.getAll(t),o=n[0];if(n.length>1)throw Zt('"'.concat(t,'" parameter must be provided only once'),qn);return o}const po=Symbol(),fo=Symbol();async function mo(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Yt;try{t=await e.json()}catch(t){throw n(e),Zt('failed to parse "response" body as JSON',Xn,t)}if(!Ht(t))throw Zt('"response" body must be a top level object',qn,{body:t});return t}const yo=Symbol(),wo=Symbol(),go=new TextEncoder,vo=new TextDecoder,bo=new TextDecoder("utf-8",{fatal:!0});function _o(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.reduce((e,t)=>e+t.length,0),r=new Uint8Array(o);let i=0;for(const e of t)r.set(e,i),i+=e.length;return r}function ko(e){const t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){const o=e.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");t[n]=o}return t}const So=function(e){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))};const To=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if(o.length>2){const t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");if(null==t)e+=" Received ".concat(t);else if("function"==typeof t&&t.name)e+=" Received function ".concat(t.name);else if("object"==typeof t&&null!=t){var i;null!==(i=t.constructor)&&void 0!==i&&i.name&&(e+=" Received an instance of ".concat(t.constructor.name))}return e}("Key for the ".concat(e," algorithm must be "),t,...o)};class Eo extends Error{constructor(e,t){var n;super(e,t),v(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}v(Eo,"code","ERR_JOSE_GENERIC");class Po extends Eo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(Po,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class Co extends Eo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_EXPIRED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(Co,"code","ERR_JWT_EXPIRED");class Ao extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}v(Ao,"code","ERR_JOSE_ALG_NOT_ALLOWED");class Ro extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_NOT_SUPPORTED")}}v(Ro,"code","ERR_JOSE_NOT_SUPPORTED"),v(class extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),v(class extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class xo extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWS_INVALID")}}v(xo,"code","ERR_JWS_INVALID");class Io extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWT_INVALID")}}v(Io,"code","ERR_JWT_INVALID"),v(class extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Oo extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWKS_INVALID")}}v(Oo,"code","ERR_JWKS_INVALID");class jo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}v(jo,"code","ERR_JWKS_NO_MATCHING_KEY");class Wo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,Symbol.asyncIterator,T(function*(){})),v(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}v(Wo,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class Mo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_TIMEOUT")}}v(Mo,"code","ERR_JWKS_TIMEOUT");class No extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}v(No,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const Uo=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}};function Lo(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);const t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}const Ko="The input to be decoded is not correctly encoded.";function zo(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64("string"==typeof e?e:vo.decode(e),{alphabet:"base64url"})}catch(e){throw new TypeError(Ko,{cause:e})}let t=e;if(t instanceof Uint8Array&&(t=vo.decode(t)),t.includes("+")||t.includes("/"))throw new TypeError(Ko);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return Lo(t)}catch(e){throw new TypeError(Ko)}}function Jo(e){let t=e;return"string"==typeof t&&(t=go.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:!0}):function(e){if(Uint8Array.prototype.toBase64)return e.toBase64();const t=[];for(let n=0;n<e.length;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join(""))}(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Do(e){if("object"!=typeof e||null===e||"[object Object]"!==Object.prototype.toString.call(e))return!1;const t=Object.getPrototypeOf(e);return null===t||null===Object.getPrototypeOf(t)}function Zo(e){return Do(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(Do)}function Ho(e,t,n){try{return zo(e)}catch(e){throw new n("Failed to base64url decode the ".concat(t))}}async function Fo(e,t){var n,o,r,i;if("RSA"===t.kty&&"oth"in t&&void 0!==t.oth)throw new Ro('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new Ro('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');const s=null!==(n=null===(o=e.resolve)||void 0===o?void 0:o.call(e,{kty:t.kty,crv:t.crv}))&&void 0!==n?n:e.subtle,a=!(!t.d&&!t.priv),c=_({},t);return"AKP"!==c.kty&&delete c.alg,delete c.use,crypto.subtle.importKey("jwk",c,s,null!==(r=t.ext)&&void 0!==r?r:!a,null!==(i=t.key_ops)&&void 0!==i?i:e.usages[a?1:0])}function Go(e){return _({__proto__:null},e)}const Vo=e=>e[Symbol.toStringTag];function Xo(e,t,n){const o=e.alg,r=e.secret,i="decrypt"===n||"sign"===n;if(r&&t instanceof Uint8Array)return[qo,t];if(Do(t)){const s=function(e){const t=Go(e);if(void 0!==t.ext&&"boolean"!=typeof t.ext)throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(void 0!==t.key_ops){const e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>"string"!=typeof e)||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}(t);if("string"!=typeof s.kty)throw new TypeError(r?To(o,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):To(o,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(r?"oct"===s.kty&&"string"==typeof s.k:"oct"!==s.kty&&(i?"AKP"===s.kty&&"string"==typeof s.priv||"string"==typeof s.d:void 0===s.d&&void 0===s.priv)))throw new TypeError(r?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':"JSON Web Key for this operation must be a ".concat(i?"private":"public"," JWK"));return((e,t,n)=>{const o=e.alg;if(void 0!==t.use){const e="sign"===n||"verify"===n?"sig":"enc";if(t.use!==e)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==o)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(o,'" when present'));if(Array.isArray(t.key_ops)){var r;const o="encrypt"===n||"decrypt"===n?null===(r=e.ops)||void 0===r?void 0:r["encrypt"===n?0:1]:n;if(o&&!t.key_ops.includes(o))throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(o,'" when present'))}})(e,s,n),[Qo,t,s]}if(!(e=>Uo(e)||(e=>"KeyObject"===(null==e?void 0:e[Symbol.toStringTag]))(e))(t))throw new TypeError(r?To(o,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):To(o,t,"CryptoKey","KeyObject","JSON Web Key"));if(r){if("secret"!==t.type)throw new TypeError("".concat(Vo(t),' instances for symmetric algorithms must be of type "secret"'))}else{if("secret"===t.type)throw new TypeError("".concat(Vo(t),' instances for asymmetric algorithms must not be of type "secret"'));const e=i?"private":"public";if(("public"===t.type||"private"===t.type)&&t.type!==e){const o="sign"===n?"signing":"verify"===n?"verifying":"".concat(n.slice(0,-1),"tion");throw new TypeError("".concat(Vo(t)," instances for asymmetric algorithm ").concat(o,' must be of type "').concat(e,'"'))}}return Uo(t)?[Yo,t]:[Bo,t]}const qo=0,Yo=1,Bo=2,Qo=3;let $o;const er={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function tr(e,t,n){$o||($o=new WeakMap);const o=$o.get(e);return n&&(o?o[t]=n:$o.set(e,{[t]:n})),null!=n?n:null==o?void 0:o[t]}const nr=async(e,t,n)=>{var o;return null!==(o=tr(e,n.alg))&&void 0!==o?o:tr(e,n.alg,await Fo(n,_(_({},t),{},{alg:n.alg})))};async function or(e,t,n){const o=Xo(e,t,n);switch(o[0]){case qo:case Yo:return o[1];case Qo:{const t=o[1],n=o[2];if("oct"===n.kty)return zo(n.k);if(!Object.isFrozen(t)){const e=t.key_ops;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}return nr(t,n,e)}case Bo:{const t=o[1];return"secret"===t.type?t.export():"toCryptoKey"in t&&"function"==typeof t.toCryptoKey?((e,t)=>{var n,o,r;const i=tr(e,t.alg);if(i)return i;const s="public"===e.type,a=t.usages[s?0:1],c=e.asymmetricKeyType,u=er[null===(n=e.asymmetricKeyDetails)||void 0===n?void 0:n.namedCurve],l=null!==(o=null===(r=t.resolve)||void 0===r?void 0:r.call(t,{crv:u,asymmetricKeyType:c}))&&void 0!==o?o:t.subtle;return tr(e,t.alg,e.toCryptoKey(l,s,a))})(t,e):nr(t,t.export({format:"jwk"}),e)}}}function rr(e){const t={__proto__:null};for(const n in e)t[n]=_(_({},e[n]),{},{alg:n});return t}const ir=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],sr=[[],["deriveBits"]],ar=[[],[]];function cr(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:"SHA-".concat(e)},usages:ir,ops:["wrapKey","unwrapKey"]}}function ur(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:e=>{let t=e.kty,n=e.crv,o=e.asymmetricKeyType;if("X25519"===n||"x25519"===o)return{name:"X25519"};if("OKP"===t)throw new Ro('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:n}},usages:sr,ops:[void 0,"deriveBits"]}}function lr(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:ar,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function dr(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:ar,ops:["deriveBits","deriveBits"]}}const hr=rr({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:ar,ops:["encrypt","decrypt"]},"RSA-OAEP":cr(1),"RSA-OAEP-256":cr(256),"RSA-OAEP-384":cr(384),"RSA-OAEP-512":cr(512),"ECDH-ES":ur(),"ECDH-ES+A128KW":ur(),"ECDH-ES+A192KW":ur(),"ECDH-ES+A256KW":ur(),A128KW:lr(128),A192KW:lr(192),A256KW:lr(256),A128GCMKW:lr(128,!0),A192GCMKW:lr(192,!0),A256GCMKW:lr(256,!0),"PBES2-HS256+A128KW":dr(),"PBES2-HS384+A192KW":dr(),"PBES2-HS512+A256KW":dr()}),pr=["encrypt","decrypt"];function fr(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:ar,ops:pr,cekBits:e,ivBits:t?128:96,cbc:t}}rr({A128GCM:fr(128),A192GCM:fr(192),A256GCM:fr(256),"A128CBC-HS256":fr(256,!0),"A192CBC-HS384":fr(384,!0),"A256CBC-HS512":fr(512,!0)});const mr={__proto__:null,b64:!0};function yr(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw new TypeError('"'.concat(e,'" option must be an array of strings'));if(t)return new Set(t)}function wr(e,t,n,o,r){if(void 0!==r.crit&&void 0===(null==o?void 0:o.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!o||void 0===o.crit)return[];if(!Array.isArray(o.crit)||0===o.crit.length||o.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');const i=void 0===n?t:_(_({__proto__:null},n),t);for(const t of o.crit){if(!(t in i))throw new Ro('Extension Header Parameter "'.concat(t,'" is not recognized'));if(!Object.hasOwn(r,t)||void 0===r[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i[t]&&(!Object.hasOwn(o,t)||void 0===o[t]))throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return o.crit}function gr(e,t){if(t.includes("b64")){const t=e.b64;if("boolean"!=typeof t)throw new xo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return t}return!0}var vr,br;let _r,kr;if("undefined"==typeof navigator||null===(vr=navigator.userAgent)||void 0===vr||null===(br=vr.startsWith)||void 0===br||!br.call(vr,"Mozilla/5.0 ")){const e="v6.8.4";kr="".concat("openid-client","/").concat(e),_r={"user-agent":kr}}const Sr=e=>Tr.get(e);let Tr,Er;function Pr(e){return void 0!==e?rn(e):(Er||(Er=new WeakMap),(e,t,n,o)=>{let r;return(r=Er.get(t))||(function(e,t){if("string"!=typeof e)throw Ir("".concat(t," must be a string"),xr);if(0===e.length)throw Ir("".concat(t," must not be empty"),Rr)}(t.client_secret,'"metadata.client_secret"'),r=rn(t.client_secret),Er.set(t,r)),r(e,t,n,o)})}const Cr=Sn,Ar=Ot,Rr="ERR_INVALID_ARG_VALUE",xr="ERR_INVALID_ARG_TYPE";function Ir(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}class Or extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function jr(e,t,n){return new Or(e,{cause:t,code:n})}function Wr(e){if(e instanceof TypeError||e instanceof Or||e instanceof dn||e instanceof hn||e instanceof pn)throw e;if(e instanceof Dt)switch(e.code){case Qn:throw jr("only requests to HTTPS are allowed",e,e.code);case $n:throw jr("only requests to HTTP or HTTPS are allowed",e,e.code);case Bn:throw jr("unexpected HTTP response status code",e.cause,e.code);case Yn:throw jr("unexpected response content-type",e.cause,e.code);case Xn:throw jr("parsing error occured",e,e.code);case qn:throw jr("invalid response encountered",e,e.code);case to:throw jr("unexpected JWT claim value encountered",e,e.code);case no:throw jr("unexpected JSON attribute value encountered",e,e.code);case eo:throw jr("JWT timestamp claim value failed validation",e,e.code);default:throw jr(e.message,e,e.code)}if(e instanceof Jt)throw jr("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw jr("runtime operation error",e,Fn);case"NotSupportedError":throw jr("runtime unsupported operation",e,Fn);case"TimeoutError":throw jr("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw jr("operation aborted",e,"OAUTH_ABORT")}throw new Or("something went wrong",{cause:e})}async function Mr(e,t,n,o,r){const i=await async function(e,t){var n,o;if(!(e instanceof URL))throw Ir('"server" must be an instance of URL',xr);const r=!e.href.includes("/.well-known/"),i=null!==(n=null==t?void 0:t.timeout)&&void 0!==n?n:30,s=AbortSignal.timeout(1e3*i),a=await(r?async function(e,t){return async function(e,t,n,o){if(!(e instanceof URL))throw At('"'.concat("issuerIdentifier",'" must be an instance of URL'),Ct);cn(e,!0!==(null==o?void 0:o[Rt]));const r=n(new URL(e.href)),i=Ft(null==o?void 0:o.headers);return i.set("accept","application/json"),((null==o?void 0:o[Ot])||fetch)(r.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:Gt(r,null==o?void 0:o.signal)})}(e,0,e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":!function(e){e.pathname=Vt("".concat(e.pathname,"/").concat(".well-known/openid-configuration"))}(e);break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=Vt("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw At('"options.algorithm" must be "oidc" (default), or "oauth2"',Pt)}return e},t)}(e,{algorithm:null==t?void 0:t.algorithm,[Ot]:null==t?void 0:t[Ar],[Rt]:null==t||null===(o=t.execute)||void 0===o?void 0:o.includes(Zr),signal:s,headers:new Headers(_r)}):((null==t?void 0:t[Ar])||fetch)((cn(e,null==t||null===(c=t.execute)||void 0===c||!c.includes(Zr)),e.href),{headers:Object.fromEntries(new Headers(_({accept:"application/json"},_r)).entries()),body:void 0,method:"GET",redirect:"manual",signal:s})).then(e=>async function(e,t){const n=e;if(!(n instanceof URL)&&n!==yo)throw At('"expectedIssuerIdentifier" must be an instance of URL',Ct);if(!Et(t,Response))throw At('"response" must be an instance of Response',Ct);if(200!==t.status)throw Zt('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Bn,t);so(t);const o=await mo(t);if(qt(o.issuer,'"response" body "issuer" property',qn,{body:o}),n!==yo&&new URL(o.issuer).href!==n.href)throw Zt('"response" body "issuer" property does not match the expected value',no,{expected:n.href,body:o,attribute:"issuer"});return o}(yo,e)).catch(Wr);var c;return r&&new URL(a.issuer).href!==e.href&&(function(e,t,n){return!("https://login.microsoftonline.com"!==e.origin||null!=n&&n.algorithm&&"oidc"!==n.algorithm||(t[Nr]=!0,0))}(e,a,t)||function(e,t){return!(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)}(e,t)||(()=>{throw new Or("discovered metadata issuer does not match the expected issuer",{code:no,cause:{expected:e.href,body:a,attribute:"issuer"}})})()),a}(e,r),s=new Ur(i,t,n,o);let a=Sr(s);if(null!=r&&r[Ar]&&(a.fetch=r[Ar]),null!=r&&r.timeout&&(a.timeout=r.timeout),null!=r&&r.execute)for(const e of r.execute)e(s);return s}new TextDecoder;const Nr=Symbol();class Ur{constructor(e,t,n,o){var r,i,s,a,c;if("string"!=typeof t||!t.length)throw Ir('"clientId" must be a non-empty string',xr);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null===(r=n)||void 0===r?void 0:r.client_id)&&t!==n.client_id)throw Ir('"clientId" and "metadata.client_id" must be the same',Rr);const u=_(_({},structuredClone(n)),{},{client_id:t});let l;u[xt]=null!==(i=null===(s=n)||void 0===s?void 0:s[xt])&&void 0!==i?i:0,u[It]=null!==(a=null===(c=n)||void 0===c?void 0:c[It])&&void 0!==a?a:30,l=o||("string"==typeof u.client_secret&&u.client_secret.length?Pr(u.client_secret):(e,t,n,o)=>{n.set("client_id",t.client_id)});let d=Object.freeze(u);const h=structuredClone(e);Nr in e&&(h[wo]=t=>{let n=t.claims.tid;return e.issuer.replace("{tenantid}",n)});let p=Object.freeze(h);Tr||(Tr=new WeakMap),Tr.set(this,{__proto__:null,as:p,c:d,auth:l,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(Sr(this).as);return function(e){Object.defineProperties(e,function(e){return{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null===(t=e.code_challenge_methods_supported)||void 0===t?void 0:t.includes(n))}}}}(e))}(e),e}clientMetadata(){return structuredClone(Sr(this).c)}get timeout(){return Sr(this).timeout}set timeout(e){Sr(this).timeout=e}get[Ar](){return Sr(this).fetch}set[Ar](e){Sr(this).fetch=e}}function Lr(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return xn(this)}catch(e){return}}}}}(e))}async function Kr(e,t,n){var o;let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const i=null===(o=e.headers.get("retry-after"))||void 0===o?void 0:o.trim();if(void 0===i)return;let s;if(/^\d+$/.test(i))s=parseInt(i,10);else{const e=new Date(i);if(Number.isFinite(e.getTime())){const t=new Date,n=e.getTime()-t.getTime();n>0&&(s=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(s))throw new Dt("invalid Retry-After header value",{cause:e});s>t&&await zr(s-t,n)}function zr(e,t){return new Promise((n,o)=>{const r=e=>{try{t.throwIfAborted()}catch(e){return void o(e)}if(e<=0)return void n();const i=Math.min(e,5);setTimeout(()=>r(e-i),1e3*i)};r(e)})}async function Jr(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=n.auth,s=n.fetch,a=n.tlsOnly,c=n.timeout;return async function(e,t,n,o,r){nn(e),on(t);const i=ln(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),s=new URLSearchParams(o);s.set("client_id",t.client_id);const a=Ft(null==r?void 0:r.headers);return a.set("accept","application/json"),Pn(e,t,n,i,s,a,r)}(o,r,i,t,{[Ot]:s,[Rt]:!a,headers:new Headers(_r),signal:Yr(c)}).then(e=>async function(e,t,n){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Ct);await _n(n,200,"Backchannel Authentication Endpoint"),so(n);const o=await mo(n);qt(o.auth_req_id,'"response" body "auth_req_id" property',qn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Xt(r,!0,'"response" body "expires_in" property',qn,{body:o}),o.expires_in=r,void 0!==o.interval&&Xt(o.interval,!1,'"response" body "interval" property',qn,{body:o}),o}(o,r,e)).catch(Wr)}async function Dr(e,t,n,o){var r,i;qr(e),n=new URLSearchParams(n);let s=null!==(r=t.interval)&&void 0!==r?r:5;const a=null!==(i=null==o?void 0:o.signal)&&void 0!==i?i:AbortSignal.timeout(1e3*t.expires_in);try{await zr(s,a)}catch(e){Wr(e)}const c=Sr(e),u=c.as,l=c.c,d=c.auth,h=c.fetch,p=c.tlsOnly,f=c.nonRepudiation,m=c.timeout,y=c.decrypt,w=(r,i)=>Dr(e,_(_({},t),{},{interval:r}),n,_(_({},o),{},{signal:a,flag:i})),g=function(e,t){const n=Yr(t);if(!n)return{signal:e,cleanup(){}};const o=new AbortController,r=e=>{const t=e.target;o.abort(t.reason)};return e.aborted?o.abort(e.reason):n.aborted?o.abort(n.reason):(e.addEventListener("abort",r,{once:!0}),n.addEventListener("abort",r,{once:!0})),{signal:o.signal,cleanup(){e.removeEventListener("abort",r),n.removeEventListener("abort",r)}}}(a,m),v=await async function(e,t,n,o,r){nn(e),on(t),qt(o,'"authReqId"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("auth_req_id",o),Cn(e,t,n,"urn:openid:params:grant-type:ciba",i,r)}(u,l,d,t.auth_req_id,{[Ot]:h,[Rt]:!p,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:g.signal}).catch(Wr).finally(g.cleanup);var b;if(503===v.status&&v.headers.has("retry-after"))return await Kr(v,s,a,!0),await(null===(b=v.body)||void 0===b?void 0:b.cancel()),w(s);const k=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(u,l,v,{[Wt]:y});let S;try{S=await k}catch(e){if(Qr(e,o))return w(s,$r);if(e instanceof dn)switch(e.error){case"slow_down":s+=5;case"authorization_pending":return await Kr(e.response,s,a),w(s)}Wr(e)}return S.id_token&&await(null==f?void 0:f(v)),Lr(S),S}function Zr(e){Sr(e).tlsOnly=!1}async function Hr(e,t,n,o,r){if(qr(e),!((null==r?void 0:r.flag)===$r||t instanceof URL||function(e){try{return"Request"===Object.getPrototypeOf(e)[Symbol.toStringTag]}catch(e){return!1}}(t)))throw Ir('"currentUrl" must be an instance of URL, or Request',xr);let i,s;const a=Sr(e),c=a.as,u=a.c,l=a.auth,d=a.fetch,h=a.tlsOnly,p=a.jarm,f=a.hybrid,m=a.nonRepudiation,y=a.timeout,w=a.decrypt,g=a.implicit;if((null==r?void 0:r.flag)===$r)i=r.authResponse,s=r.redirectUri;else{if(!(t instanceof URL)){const e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":const n=new URLSearchParams(await async function(e){if("POST"!==e.method)throw At("form_post responses are expected to use the POST method",Pt,{cause:e});if("application/x-www-form-urlencoded"!==Tn(e))throw At("form_post responses are expected to use the application/x-www-form-urlencoded content-type",Pt,{cause:e});return async function(e){if(e.bodyUsed)throw At("form_post Request instances must contain a readable body",Pt,{cause:e});return e.text()}(e)}(e));if(f)t.hash=n.toString();else for(const e of n.entries()){var v=S(e,2);const n=v[0],o=v[1];t.searchParams.append(n,o)}break;default:throw Ir("unexpected Request HTTP method",Rr)}}switch(s=function(e){return(e=new URL(e)).search="",e.hash="",e.href}(t),!0){case!!p:i=await p(t,null==n?void 0:n.expectedState);break;case!!f:i=await f(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!g:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,o){if(nn(e),on(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw At('"parameters" must be an instance of URLSearchParams, or URL',Ct);if(ho(n,"response"))throw Zt('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',qn,{parameters:n});const r=ho(n,"iss"),i=ho(n,"state");if(!r&&e.authorization_response_iss_parameter_supported)throw Zt('response parameter "iss" (issuer) missing',qn,{parameters:n});if(r&&r!==e.issuer)throw Zt('unexpected "iss" (issuer) response parameter value',qn,{expected:e.issuer,parameters:n});switch(o){case void 0:case fo:if(void 0!==i)throw Zt('unexpected "state" response parameter encountered',qn,{expected:void 0,parameters:n});break;case po:break;default:if(qt(o,'"expectedState" argument'),i!==o)throw Zt(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',qn,{expected:o,parameters:n})}if(ho(n,"error"))throw new hn("authorization response from the server is an error",{cause:n});const s=ho(n,"id_token"),a=ho(n,"token");if(void 0!==s||void 0!==a)throw new Jt("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),Un.add(c),c;var c}(c,u,t.searchParams,null==n?void 0:n.expectedState)}catch(e){Wr(e)}}}const b=await async function(e,t,n,o,r,i,s){if(nn(e),on(t),!Un.has(o))throw At('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',Pt);qt(r,'"redirectUri"');const a=ho(o,"code");if(!a)throw Zt('no authorization code in "callbackParameters"',qn);const c=new URLSearchParams(null==s?void 0:s.additionalParameters);return c.set("redirect_uri",r),c.set("code",a),i!==Ln&&(qt(i,'"codeVerifier"'),c.set("code_verifier",i)),Cn(e,t,n,"authorization_code",c,s)}(c,u,l,i,s,(null==n?void 0:n.pkceCodeVerifier)||Ln,{additionalParameters:o,[Ot]:d,[Rt]:!h,DPoP:null==r?void 0:r.DPoP,headers:new Headers(_r),signal:Yr(y)}).catch(Wr);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);const k=async function(e,t,n,o){return"string"==typeof(null==o?void 0:o.expectedNonce)||"number"==typeof(null==o?void 0:o.maxAge)||null!=o&&o.requireIdToken?async function(e,t,n,o,r,i,s){const a=[];switch(o){case void 0:o=Jn;break;case Jn:break;default:qt(o,'"expectedNonce" argument'),a.push("nonce")}switch(null!=r||(r=t.default_max_age),r){case void 0:r=Dn;break;case Dn:break;default:Xt(r,!0,'"maxAge" argument'),a.push("auth_time")}const c=await In(e,t,n,a,i,s);qt(c.id_token,'"response" body "id_token" property',qn,{body:c});const u=xn(c);if(r!==Dn){const e=tn()+$t(t),n=en(t);if(u.auth_time+r<e-n)throw Zt("too much time has elapsed since the last End-User authentication",eo,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(o===Jn){if(void 0!==u.nonce)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==o)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:o,claims:u,claim:"nonce"});return c}(e,t,n,o.expectedNonce,o.maxAge,o[Wt],o.recognizedTokenTypes):async function(e,t,n,o,r){const i=await In(e,t,n,void 0,o,r),s=xn(i);if(s){if(void 0!==t.default_max_age){Xt(t.default_max_age,!0,'"client.default_max_age"');const e=tn()+$t(t),n=en(t);if(s.auth_time+t.default_max_age<e-n)throw Zt("too much time has elapsed since the last End-User authentication",eo,{claims:s,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==s.nonce)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:void 0,claims:s,claim:"nonce"})}return i}(e,t,n,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(c,u,b,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[Wt]:w});let T;try{T=await k}catch(t){if(Qr(t,r))return Hr(e,void 0,n,o,_(_({},r),{},{flag:$r,authResponse:i,redirectUri:s}));Wr(t)}return T.id_token&&await(null==m?void 0:m(b)),Lr(T),T}async function Fr(e,t,n,o){qr(e),n=new URLSearchParams(n);const r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.nonRepudiation,d=r.timeout,h=r.decrypt,p=await async function(e,t,n,o,r){nn(e),on(t),qt(o,'"refreshToken"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("refresh_token",o),Cn(e,t,n,"refresh_token",i,r)}(i,s,a,t,{[Ot]:c,[Rt]:!u,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(d)}).catch(Wr),f=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(i,s,p,{[Wt]:h});let m;try{m=await f}catch(r){if(Qr(r,o))return Fr(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return m.id_token&&await(null==l?void 0:l(p)),Lr(m),m}async function Gr(e,t,n){qr(e),t=new URLSearchParams(t);const o=Sr(e),r=o.as,i=o.c,s=o.auth,a=o.fetch,c=o.tlsOnly,u=o.timeout,l=await async function(e,t,n,o,r){return nn(e),on(t),Cn(e,t,n,"client_credentials",new URLSearchParams(o),r)}(r,i,s,t,{[Ot]:a,[Rt]:!c,DPoP:null==n?void 0:n.DPoP,headers:new Headers(_r),signal:Yr(u)}).catch(Wr),d=async function(e,t,n){return In(e,t,n,void 0,void 0,void 0)}(r,i,l);let h;try{h=await d}catch(o){if(Qr(o,n))return Gr(e,t,_(_({},n),{},{flag:$r}));Wr(o)}return Lr(h),h}function Vr(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=n.tlsOnly,s=n.hybrid,a=n.jarm,c=n.implicit,u=ln(o,"authorization_endpoint",!1,i);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",s?"code id_token":c?"id_token":"code"),c&&!t.has("nonce"))throw Ir("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",Rr);a&&t.set("response_mode","jwt")}for(const e of t.entries()){var l=S(e,2);const t=l[0],n=l[1];u.searchParams.append(t,n)}return u}async function Xr(e,t,n){qr(e);const o=Vr(e,t),r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,d=await async function(e,t,n,o,r){var i;nn(e),on(t);const s=ln(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),a=new URLSearchParams(o);a.set("client_id",t.client_id);const c=Ft(null==r?void 0:r.headers);c.set("accept","application/json"),void 0!==(null==r?void 0:r.DPoP)&&(kn(r.DPoP),await r.DPoP.addProof(s,c,"POST"));const u=await Pn(e,t,n,s,a,c,r);return null==r||null===(i=r.DPoP)||void 0===i||i.cacheNonce(u,s),u}(i,s,a,o.searchParams,{[Ot]:c,[Rt]:!u,DPoP:null==n?void 0:n.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr),h=async function(e,t,n){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Ct);await _n(n,201,"Pushed Authorization Request Endpoint"),so(n);const o=await mo(n);qt(o.request_uri,'"response" body "request_uri" property',qn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Xt(r,!0,'"response" body "expires_in" property',qn,{body:o}),o.expires_in=r,o}(i,s,d);let p;try{p=await h}catch(o){if(Qr(o,n))return Xr(e,t,_(_({},n),{},{flag:$r}));Wr(o)}return Vr(e,{request_uri:p.request_uri})}function qr(e){if(!(e instanceof Ur))throw Ir('"config" must be an instance of Configuration',xr);if(Object.getPrototypeOf(e)!==Ur.prototype)throw Ir("subclassing Configuration is not allowed",Rr)}function Yr(e){return e?AbortSignal.timeout(1e3*e):void 0}async function Br(e,t,n,o){qr(e);const r=Sr(e),i=r.as,s=r.c,a=r.fetch,c=r.tlsOnly,u=r.nonRepudiation,l=r.timeout,d=r.decrypt,h=await async function(e,t,n,o){nn(e),on(t);const r=ln(e,"userinfo_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==o?void 0:o[Rt])),i=Ft(null==o?void 0:o.headers);return t.userinfo_signed_response_alg?i.set("accept","application/jwt"):(i.set("accept","application/json"),i.append("accept","application/jwt")),async function(e,t,n,o,r,i){var s;if(qt(e,'"accessToken"'),!(n instanceof URL))throw At('"url" must be an instance of URL',Ct);cn(n,!0!==(null==i?void 0:i[Rt])),o=Ft(o),null!=i&&i.DPoP&&(kn(i.DPoP),await i.DPoP.addProof(n,o,"GET".toUpperCase(),e)),o.set("authorization","".concat(o.has("dpop")?"DPoP":"Bearer"," ").concat(e));const a=await((null==i?void 0:i[Ot])||fetch)(n.href,{duplex:Et(null,ReadableStream)?"half":void 0,body:null,headers:Object.fromEntries(o.entries()),method:"GET",redirect:"manual",signal:Gt(n,null==i?void 0:i.signal)});return null==i||null===(s=i.DPoP)||void 0===s||s.cacheNonce(a,n),a}(n,0,r,i,0,_(_({},o),{},{[xt]:$t(t)}))}(i,s,t,{[Ot]:a,[Rt]:!c,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr);let p,f=En(i,s,n,h,{[Wt]:d});try{p=await f}catch(r){if(Qr(r,o))return Br(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return"application/jwt"===Tn(h)&&await(null==u?void 0:u(h)),p}function Qr(e,t){return!(null==t||!t.DPoP||t.flag===$r)&&function(e){if(e instanceof pn){const t=e.cause,n=t[0];return 1===t.length&&"dpop"===n.scheme&&"use_dpop_nonce"===n.parameters.error}return e instanceof dn&&"use_dpop_nonce"===e.error}(e)}Object.freeze(Ur.prototype);const $r=Symbol();async function ei(e,t,n,o){qr(e);const r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,d=r.decrypt,h=r.nonRepudiation,p=await async function(e,t,n,o,r,i){return nn(e),on(t),qt(o,'"grantType"'),Cn(e,t,n,o,new URLSearchParams(r),i)}(i,s,a,t,new URLSearchParams(n),{[Ot]:c,[Rt]:!u,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr);let f;"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(f={n_a:()=>{}});const m=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(i,s,p,{[Wt]:d,recognizedTokenTypes:f});let y;try{y=await m}catch(r){if(Qr(r,o))return ei(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return y.id_token&&await(null==h?void 0:h(p)),Lr(y),y}async function ti(e,t,n){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,e.subtle,!1,[n]):(function(e,t,n){var o;const r=e.algorithm;if(r.name!==t.name)throw So(t.name);if(t.hash&&(null===(o=r.hash)||void 0===o?void 0:o.name)!==t.hash)throw So(t.hash,"algorithm.hash");if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw So(t.namedCurve,"algorithm.namedCurve");if(void 0!==t.length&&r.length!==t.length)throw So(t.length,"algorithm.length");!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(t,"."))}(e,n)}(t,e.subtle,n),e.minRsaBits&&function(e,t){const n=t.algorithm.modulusLength;if("number"!=typeof n||n<2048)throw new TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}(e.alg,t),t)}const ni=[["verify"],["sign"]];function oi(e){const t={name:"HMAC",hash:"SHA-".concat(e)};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:ni}}function ri(e,t){const n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e)};return{kty:["RSA"],subtle:n,signing:t?_(_({},n),{},{saltLength:t}):n,usages:ni,minRsaBits:2048}}function ii(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:"SHA-".concat(t)},usages:ni}}function si(){const e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:ni}}function ai(e){const t={name:"ML-DSA-".concat(e)};return{kty:["AKP"],subtle:t,signing:t,usages:ni}}const ci=rr({HS256:oi(256),HS384:oi(384),HS512:oi(512),RS256:ri(256),RS384:ri(384),RS512:ri(512),PS256:ri(256,32),PS384:ri(384,48),PS512:ri(512,64),ES256:ii("P-256",256),ES384:ii("P-384",384),ES512:ii("P-521",512),EdDSA:si(),Ed25519:si(),"ML-DSA-44":ai(44),"ML-DSA-65":ai(65),"ML-DSA-87":ai(87)});function ui(e){const t="string"==typeof e?ci[e]:void 0;if(!t)throw new Ro("alg ".concat(e," is not supported either by JOSE or your javascript runtime"));return t}async function li(e,t,n){if(e instanceof Uint8Array&&(e=vo.decode(e)),"string"!=typeof e)throw new xo("Compact JWS must be a string or Uint8Array");const o=e.split("."),r=o[0],i=o[1],s=o[2];if(3!==o.length)throw new xo("Invalid Compact JWS");const a={payload:i,protected:r,signature:s},c=function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:void 0===e?{}:function(e,t,n){let o;try{o=JSON.parse(bo.decode(zo(e)))}catch(e){throw new t(n)}if(!Do(o))throw new t(n);return o}(e,xo,"JWS Protected Header is invalid");return t}(r),u=function(e,t,n){const o=gr(e,wr(xo,mr,n[1],e,t)),r=t.alg;if("string"!=typeof r||!r)throw new xo('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(n[0]&&!n[0].has(r))throw new Ao('"alg" (Algorithm) Header Parameter value not allowed');return[o,r]}(c,c,t),l=S(u,2),d=l[0],h=l[1],p=d?i:function(e){try{return ko(e)}catch(e){throw new xo("JWS Compact Serialization payload must use only ASCII characters")}}(i);return async function(e,t,n,o,r,i,s){var a;let c=!1;"function"==typeof n&&(n=await n(r,e),c=!0);const u="string"==typeof s,l=ui(i),d=_o(void 0!==o?ko(o):new Uint8Array,ko("."),u?null!==(a=t[2])&&void 0!==a?a:t[2]=function(e,t,n){try{return ko(e)}catch(e){throw new n("The ".concat("payload"," is not a valid base64url string"))}}(s,0,xo):s),h=Ho(e.signature,"signature",xo),p=await or(l,n,"verify");if(!await async function(e,t,n,o){const r=await ti(e,t,"verify");try{return await crypto.subtle.verify(e.signing,r,n,o)}catch(e){return!1}}(l,p,h,d))throw new No;return[u?Ho(s,"payload",xo):s,r,u,p,c]}(a,t,n,r,c,h,p)}const di=e=>Math.floor(e.getTime()/1e3),hi={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},pi=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fi="check_failed";function mi(){throw new TypeError("Invalid time period format")}function yi(e){"string"!=typeof e&&mi();const t=pi.exec(e);(!t||t[4]&&t[1])&&mi();const n=parseFloat(t[2]),o=Math.round(n*hi[t[3][0].toLowerCase()]);return Number.isFinite(o)||mi(),"-"===t[1]||"ago"===t[4]?-o:o}function wi(e,t){if(!Number.isFinite(t))throw new TypeError("Invalid ".concat(e," input"));return t}function gi(e,t){if("string"!=typeof t)throw new TypeError('"'.concat(e,'" claim must be a string'))}function vi(e,t){return"number"==typeof e?wi(t,e):e instanceof Date?wi(t,di(e)):di(new Date)+yi(e)}const bi=e=>{const t=e.toLowerCase();return e.includes("/")?t:"application/".concat(t)};function _i(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];const o=e[t];if(void 0!==o||n){if("number"!=typeof o)throw new Po('"'.concat(t,'" claim must be a number'),e,t,"invalid");return o}}function ki(e,t){throw new Po('unexpected "'.concat(t,'" claim value'),e,t,fi)}function Si(e,t){let n,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{n=JSON.parse(bo.decode(t))}catch(e){}if(!Do(n))throw new Io("JWT Claims Set must be a top-level JSON object");const r=o.typ;if(void 0!==r&&("string"!=typeof e.typ||bi(e.typ)!==bi(r)))throw new Po('unexpected "typ" JWT header value',n,"typ",fi);const i=o.requiredClaims,s=void 0===i?[]:i,a=o.issuer,c=o.subject,u=o.audience,l=o.maxTokenAge,d=[...s];void 0!==l&&d.push("iat"),void 0!==u&&d.push("aud"),void 0!==c&&d.push("sub"),void 0!==a&&d.push("iss");for(const e of new Set(d.reverse()))if(!Object.hasOwn(n,e))throw new Po('missing required "'.concat(e,'" claim'),n,e,"missing");var h,p;void 0===a||(Array.isArray(a)?a:[a]).includes(n.iss)||ki(n,"iss"),void 0!==c&&n.sub!==c&&ki(n,"sub"),void 0===u||(p="string"==typeof u?[u]:u,"string"==typeof(h=n.aud)?p.includes(h):Array.isArray(h)&&p.some(e=>h.includes(e)))||ki(n,"aud");const f=o.clockTolerance;let m=0;if("string"==typeof f)m=yi(f);else if(void 0!==f){if("number"!=typeof f)throw new TypeError("Invalid clockTolerance option type");m=f}wi("clockTolerance option",m);const y=o.currentDate,w=wi("currentDate option",di(void 0===y?new Date:y)),g=_i(n,"iat",void 0!==l),v=_i(n,"nbf");if(void 0!==v&&v>w+m)throw new Po('"nbf" claim timestamp check failed',n,"nbf",fi);const b=_i(n,"exp");if(void 0!==b&&b<=w-m)throw new Co('"exp" claim timestamp check failed',n,"exp",fi);if(void 0!==l){const e=w-g;if(e-m>wi("maxTokenAge option","number"==typeof l?l:yi(l)))throw new Co('"iat" claim timestamp check failed (too far in the past)',n,"iat",fi);if(e<-m)throw new Po('"iat" claim timestamp check failed (it should be in the past)',n,"iat",fi)}return n}let Ti;function Ei(e){return Ti.get(e)}async function Pi(e,t,n,o,r){const i=S(function(e){if(void 0===e)return[void 0,""];const t=function(e,t){let n,o;try{n=JSON.stringify(t),o=JSON.parse(n)}catch(t){throw new e("JOSE Header is not valid JSON",{cause:t})}if(!Do(o))throw new e("JOSE Header is not a JSON object");return[o,n]}(xo,e);return[t[0],Jo(t[1])]}(t),2),s=i[0],a=i[1];if(!s)throw new xo("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");(function(e,t,n){return function(e,t){const n=(null!=t?t:{}).crit;if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}(xo,e),gr(e,wr(xo,mr,n,e,t))})(s,s,n)||r();const c=function(e){const t=e.alg;if("string"!=typeof t||!t)throw new xo('JWS "alg" (Algorithm) Header Parameter missing or invalid');return ui(t)}(s),u=Jo(e),l=await async function(e,t,n,o){const r=_o(ko(e),ko("."),t),i=await or(n,o,"sign");return Jo(await async function(e,t,n){const o=await ti(e,t,"sign"),r=await crypto.subtle.sign(e.signing,o,n);return new Uint8Array(r)}(n,i,r))}(a,ko(u),c,o);return"".concat(a,".").concat(u,".").concat(l)}const Ci=class{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!Do(e))throw new TypeError("JWT Claims Set MUST be an object");(Ti||(Ti=new WeakMap)).set(this,structuredClone(e))}setIssuer(e){return gi("iss",e),Ei(this).iss=e,this}setSubject(e){return gi("sub",e),Ei(this).sub=e,this}setAudience(e){return function(e){if("string"!=typeof e&&(!Array.isArray(e)||Array.from(e).some(e=>"string"!=typeof e)))throw new TypeError('"aud" claim must be a string or an array of strings')}(e),Ei(this).aud=e,this}setJti(e){return gi("jti",e),Ei(this).jti=e,this}setNotBefore(e){return Ei(this).nbf=vi(e,"setNotBefore"),this}setExpirationTime(e){return Ei(this).exp=vi(e,"setExpirationTime"),this}setIssuedAt(e){return Ei(this).iat=void 0===e?di(new Date):"string"==typeof e?wi("setIssuedAt",di(new Date)+yi(e)):vi(e,"setIssuedAt"),this}};var Ai=new WeakMap;class Ri extends Ci{constructor(){super(...arguments),y(this,Ai,void 0)}setProtectedHeader(e){return function(e){if(void 0!==e)throw new TypeError("".concat("setProtectedHeader"," can only be called once"))}(m(Ai,this)),w(Ai,this,e),this}async sign(e,t){return Pi(function(e){const t=Ei(e);for(const e of["iat","nbf","exp"]){const n=t[e];if("number"==typeof n&&!Number.isFinite(n))throw new TypeError('"'.concat(e,'" claim must be a finite number'))}return go.encode(JSON.stringify(t))}(this),m(Ai,this),null==t?void 0:t.crit,e,()=>{throw new Io("JWTs MUST NOT use unencoded payload")})}}const xi='"alg" (Algorithm)';function Ii(){throw new Ro("Invalid or unsupported ".concat(arguments.length>0&&void 0!==arguments[0]?arguments[0]:'JWK "alg" (Algorithm) Parameter'," value"))}const Oi=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},ji=e=>{const t=e.data[e.pos++];if(void 0===t)throw new Error("Unexpected end of ASN.1 input");return t},Wi=e=>{const t=ji(e);if(128&t){const n=127&t;let o=0;for(let t=0;t<n;t++)o=o<<8|ji(e);return o}return t},Mi=(e,t,n)=>{if(ji(e)!==t)throw new Error(n)},Ni=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw new Error("Unexpected end of ASN.1 input");const n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},Ui=e=>{const t=(e=>{Mi(e,6,"Expected algorithm OID");const t=Wi(e);return Ni(e,t)})(e);if(Oi(t,[43,101,110]))return"X25519";if(!Oi(t,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mi(e,6,"Expected curve OID");const n=Wi(e),o=Ni(e,n);if(Oi(o,[42,134,72,206,61,3,1,7]))return"P-256";if(Oi(o,[43,129,4,0,34]))return"P-384";if(Oi(o,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},Li=(e,t,n)=>{const o=(e=>Lo(e.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"")))(e);return(async(e,t,n,o)=>{const r=function(e){if(void 0!==e&&"boolean"!=typeof e)throw new TypeError('"extractable" option must be a boolean');return e}(null==o?void 0:o.extractable),i=function(e,t){var n,o;return null!==(n="string"==typeof e?null!==(o=ci[e])&&void 0!==o?o:hr[e]:void 0)&&void 0!==n?n:Ii(t)}(n,xi);i.secret&&Ii(xi);const s="spki"===e;let a;if(i.resolve)try{const n={data:t,pos:0};!function(e,t){if(Mi(e,48,"Invalid ".concat("spki"===t?"SPKI":"PKCS#8"," structure")),Wi(e),"pkcs8"===t){Mi(e,2,"Expected version field");const t=Wi(e);e.pos+=t}Mi(e,48,"Expected algorithm identifier"),Wi(e)}(n,e),a=i.resolve({crv:Ui(n)})}catch(e){throw new Ro("Invalid or unsupported key format")}else a=i.subtle;return crypto.subtle.importKey(e,t,a,null!=r?r:s,i.usages[s?0:1])})("pkcs8",o,t,n)};async function Ki(e,t,n){const o=e.get(t)||e.set(t,{}).get(t),r=n.alg;if(void 0===o[r]){const e=await Fo(n,_(_({},t),{},{alg:r,ext:!0}));if("public"!==e.type)throw new Oo("JSON Web Key Set members must be public keys");o[r]=e}return o[r]}function zi(e){let t;try{t=structuredClone(e)}catch(e){}if(!Zo(t))throw new Oo("JSON Web Key Set malformed");const n=new WeakMap;return Object.defineProperty(async(e,o)=>{const r=_(_({},e),null==o?void 0:o.header),i=r.alg,s=r.kid,a="string"==typeof i?ci[i]:void 0;if(!a||a.secret)throw new Ro('Unsupported "alg" value for a JSON Web Key Set');const c=t.keys.filter(e=>function(e,t,n,o){const r=Go(e),i=r.kty,s=r.key_ops,a=r.ext,c=r.kid,u=r.alg,l=r.use,d=r.crv,h=Array.isArray(s)?[...s]:s;return(void 0===a||"boolean"==typeof a)&&(void 0===h||Array.isArray(h)&&h.every((e,t)=>"string"==typeof e&&h.indexOf(e)===t)&&h.includes("verify"))&&t.kty.includes(i)&&(void 0===o||"string"==typeof o&&o===c)&&(void 0===u?"AKP"!==i:n===u)&&(void 0===l||"sig"===l)&&(!t.crv||d===t.crv)}(e,a,i,s)),u=c[0],l=c.length;if(!l)throw new jo;if(1!==l){const e=new Wo;throw e[Symbol.asyncIterator]=T(function*(){for(const e of c)try{yield yield p(Ki(n,e,a))}catch(e){}}),e}return Ki(n,u,a)},"jwks",{value:()=>structuredClone(t)})}var Ji,Di;let Zi;if("undefined"==typeof navigator||null===(Ji=navigator.userAgent)||void 0===Ji||null===(Di=Ji.startsWith)||void 0===Di||!Di.call(Ji,"Mozilla/5.0 ")){const e="v6.2.10";Zi="".concat("jose","/").concat(e)}const Hi=Symbol(),Fi=Symbol();function Gi(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Vi(e,t,n){if(Number.isNaN(e))throw new TypeError('"'.concat(n,'" option must not be NaN'));return"number"==typeof e?e:t}async function Xi(e,t,n){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Li(e,t,n)}const qi=["mfaToken"],Yi=["mfaToken"];var Bi,Qi,$i,es,ts,ns,os,rs,is,ss,as,cs,us,ls,ds,hs,ps,fs,ms,ys,ws,gs,vs,bs,_s,ks,Ss,Ts,Es,Ps,Cs,As,Rs,xs,Is,Os,js,Ws,Ms,Ns,Us,Ls,Ks,zs,Js,Ds,Zs,Hs,Fs,Gs,Vs,Xs;function qs(e){if("object"!=typeof e||null===e)return{};const t=e;return{statusCode:"number"==typeof t.statusCode?t.statusCode:void 0,headers:t.headers instanceof Headers?t.headers:void 0,body:"string"==typeof t.body?t.body:void 0}}function Ys(e){var t,n;if("object"!=typeof e||null===e)return{error:"unknown_error",error_description:String(e)};const o=e;let r;if(o.response instanceof Response)try{r=new Headers(o.response.headers),r.delete("set-cookie")}catch(e){r=void 0}const i={error:null!==(t=o.error)&&void 0!==t?t:"",error_description:null!==(n=o.error_description)&&void 0!==n?n:"",message:o.message,statusCode:"number"==typeof o.status?o.status:void 0,headers:r};if("mfa_required"===o.error&&o.cause){i.mfa_token="string"==typeof o.cause.mfa_token?o.cause.mfa_token:void 0;const e=o.cause.mfa_requirements;"object"==typeof e&&null!==e&&(i.mfa_requirements=e)}return i}var Bs=class extends Error{constructor(e,t){super(t),v(this,"code",void 0),this.name="NotSupportedError",this.code=e}},Qs=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},$s=class extends Qs{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},ea=class extends Qs{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},ta=class extends Qs{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},na=class extends Qs{constructor(e,t){super("token_by_password_error",e,t),this.name="TokenByPasswordError"}},oa=class extends Qs{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},ra=class extends Qs{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},ia=class extends Qs{constructor(e,t){super("token_revocation_error",e,t),this.name="TokenRevocationError"}},sa=class extends Qs{constructor(e,t){super("user_info_error",e,t),this.name="UserInfoError"}},aa=class extends Error{constructor(e){super(e),v(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},ca=class extends Qs{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),v(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},ua=class extends Qs{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},la=class extends Qs{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},da=class extends Qs{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},ha=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),v(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}},pa=class extends Error{constructor(e){super(e),v(this,"code","organization_validation_error"),this.name="OrganizationValidationError"}},fa=class extends Error{constructor(e){super(e||"fullResponse: true requested but no HTTP Response was captured. This is a bug in CapturingFetch."),v(this,"code","missing_captured_response_error"),this.name="MissingCapturedResponseError"}};function ma(e){try{const t=new Headers(e);return t.delete("set-cookie"),t}catch(e){return new Headers}}function ya(e,t,n){var o;const r="object"==typeof t&&null!==t?t:void 0,i=null!==(o=null==r?void 0:r.response)&&void 0!==o?o:n,s="number"==typeof(null==r?void 0:r.status)?r.status:null==i?void 0:i.status;"number"==typeof s&&(e.statusCode=s),null!=i&&i.headers&&(e.headers=ma(i.headers))}function wa(e){return Object.entries(e).filter(e=>void 0!==S(e,2)[1]).reduce((e,t)=>_(_({},e),{},{[t[0]]:t[1]}),{})}function ga(e){if(!e.trim())throw new pa("organization must not be blank")}function va(e,t){if(!e)return;const n=t.trim();if(n.startsWith("org_")){const t=e.org_id;if("string"!=typeof t)throw new pa("Organization Id (org_id) claim must be a string present in the ID token");if(t!==n)throw new pa('Organization Id (org_id) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}else{const t=e.org_name;if("string"!=typeof t)throw new pa("Organization Name (org_name) claim must be a string present in the ID token");if(t.toLowerCase()!==n.toLowerCase())throw new pa('Organization Name (org_name) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}}var ba=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},_a=class extends ba{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},ka=class extends ba{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},Sa=class extends ba{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},Ta=class extends ba{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}},Ea=class extends ba{constructor(e,t){super("mfa_verify_error",e,t),this.name="MfaVerifyError"}};function Pa(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var Ca=class e{constructor(e,t,n,o,r,i,s){v(this,"accessToken",void 0),v(this,"idToken",void 0),v(this,"refreshToken",void 0),v(this,"expiresAt",void 0),v(this,"scope",void 0),v(this,"claims",void 0),v(this,"authorizationDetails",void 0),v(this,"tokenType",void 0),v(this,"issuedTokenType",void 0),v(this,"recoveryCode",void 0),v(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=r,this.claims=i,this.authorizationDetails=s}static fromTokenEndpointResponse(t){const n=t.id_token?t.claims():void 0,o=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return o.tokenType=t.token_type,o.issuedTokenType=t.issued_token_type,o}};function Aa(e,t){if(!1===t.enabled)return e;const n={name:t.name,version:t.version},o=btoa(JSON.stringify(n));return async(t,n)=>{const r=t instanceof Request?new Headers(t.headers):new Headers;return null!=n&&n.headers&&new Headers(n.headers).forEach((e,t)=>{r.set(t,e)}),r.set("Auth0-Client",o),e(t,_(_({},n),{},{headers:r}))}}function Ra(e){var t,n;return!1===(null==e?void 0:e.enabled)?e:{enabled:!0,name:null!==(t=null==e?void 0:e.name)&&void 0!==t?t:"@auth0/auth0-auth-js",version:null!==(n=null==e?void 0:e.version)&&void 0!==n?n:"1.15.0"}}function xa(e){let t;const n=async(n,o)=>{const r=await e(n,o);return t=r.clone(),r};return n.getCapturedResponse=()=>t,n}function Ia(e,t,n){if(!t)return e;const o=t.signal,r=t.headers,i=t.customFetch,s=i?Aa(i,n):e;return o||r?async(e,t)=>{const n=r?new Headers(e instanceof Request?e.headers:void 0):void 0;if(n&&null!=t&&t.headers&&new Headers(t.headers).forEach((e,t)=>n.set(t,e)),r)for(const e of Object.entries(r)){var i=S(e,2);const t=i[0],o=i[1],r=t.toLowerCase();"authorization"!==r&&"auth0-client"!==r&&n.set(t,o)}const a=function(e,t){if(!e)return{signal:null!=t?t:void 0};if(!t)return{signal:e};if("undefined"!=typeof AbortSignal&&"function"==typeof AbortSignal.any)return{signal:AbortSignal.any([e,t])};const n=new AbortController,o=[e,t],r=o.find(e=>e.aborted);if(r)return n.abort(r.reason),{signal:n.signal};const i=[],s=()=>{o.forEach((e,t)=>{const n=i[t];n&&e.removeEventListener("abort",n)})};return o.forEach((e,t)=>{const o=()=>{s(),n.abort(e.reason)};i[t]=o,e.addEventListener("abort",o,{once:!0})}),{signal:n.signal,cleanup:s}}(o,null==t?void 0:t.signal);try{return await s(e,_(_(_({},t),n&&{headers:n}),{},{signal:a.signal}))}finally{var c;null===(c=a.cleanup)||void 0===c||c.call(a)}}:s}var Oa={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},ja=(Bi=new WeakMap,Qi=new WeakMap,$i=new WeakMap,es=new WeakMap,ts=new WeakMap,ns=new WeakMap,os=new WeakMap,rs=new WeakSet,class{constructor(e){var t,n;g(this,rs),y(this,Bi,void 0),y(this,Qi,void 0),y(this,$i,void 0),y(this,es,void 0),y(this,ts,void 0),y(this,ns,void 0),y(this,os,void 0),w(Bi,this,"https://".concat(e.domain)),w(Qi,this,e.clientId),w($i,this,e.clientSecret),w(es,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(ts,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ns,this,e.getConfiguration),w(os,this,e.createCaptureConfiguration)}async listAuthenticators(e,t){const n="".concat(m(Bi,this),"/mfa/authenticators"),o=e.mfaToken,r=await h(rs,this,Wa).call(this,t)(n,{method:"GET",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"}});if(!r.ok){const e=await r.clone().text(),t=r.status,n=ma(r.headers);let i;try{i=JSON.parse(e)}catch(o){throw new _a("Failed to list authenticators",{error:"unknown_error",error_description:"Failed to list authenticators",statusCode:t,headers:n,body:e})}throw new _a(i.error_description||"Failed to list authenticators",_(_({},i),{},{statusCode:t,headers:n,body:e}))}return(await r.json()).map(Pa)}async enrollAuthenticator(e,t){const n="".concat(m(Bi,this),"/mfa/associate"),o=e.mfaToken,r=k(e,qi),i={authenticator_types:r.authenticatorTypes};"oobChannels"in r&&(i.oob_channels=r.oobChannels),"phoneNumber"in r&&r.phoneNumber&&(i.phone_number=r.phoneNumber),"email"in r&&r.email&&(i.email=r.email);const s=await h(rs,this,Wa).call(this,t)(n,{method:"POST",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"},body:JSON.stringify(i)});if(!s.ok){const e=await s.clone().text(),t=s.status,n=ma(s.headers);let r;try{r=JSON.parse(e)}catch(o){throw new ka("Failed to enroll authenticator",{error:"unknown_error",error_description:"Failed to enroll authenticator",statusCode:t,headers:n,body:e})}throw new ka(r.error_description||"Failed to enroll authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}return function(e){if("otp"===e.authenticator_type)return{authenticatorType:"otp",secret:e.secret,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes,id:e.id};if("oob"===e.authenticator_type)return{authenticatorType:"oob",oobChannel:e.oob_channel,oobCode:e.oob_code,bindingMethod:e.binding_method,id:e.id,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes};throw new Error("Unexpected authenticator type: ".concat(e.authenticator_type))}(await s.json())}async deleteAuthenticator(e,t){const n=e.authenticatorId,o=e.mfaToken,r="".concat(m(Bi,this),"/mfa/authenticators/").concat(encodeURIComponent(n)),i=await h(rs,this,Wa).call(this,t)(r,{method:"DELETE",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"}});if(!i.ok){const e=await i.clone().text(),t=i.status,n=ma(i.headers);let r;try{r=JSON.parse(e)}catch(o){throw new Sa("Failed to delete authenticator",{error:"unknown_error",error_description:"Failed to delete authenticator",statusCode:t,headers:n,body:e})}throw new Sa(r.error_description||"Failed to delete authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}}async challengeAuthenticator(e,t){const n="".concat(m(Bi,this),"/mfa/challenge"),o=e.mfaToken,r=k(e,Yi),i={mfa_token:o,client_id:m(Qi,this),challenge_type:r.challengeType};m($i,this)&&(i.client_secret=m($i,this)),r.authenticatorId&&(i.authenticator_id=r.authenticatorId);const s=await h(rs,this,Wa).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});if(!s.ok){const e=await s.clone().text(),t=s.status,n=ma(s.headers);let r;try{r=JSON.parse(e)}catch(o){throw new Ta("Failed to challenge authenticator",{error:"unknown_error",error_description:"Failed to challenge authenticator",statusCode:t,headers:n,body:e})}throw new Ta(r.error_description||"Failed to challenge authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}return function(e){const t={challengeType:e.challenge_type};return void 0!==e.oob_code&&(t.oobCode=e.oob_code),void 0!==e.binding_method&&(t.bindingMethod=e.binding_method),t}(await s.json())}async verify(e,t){if(!m(ns,this))throw new Error("MFA verify requires a configuration provider (getConfiguration was not set)");const n={mfa_token:e.mfaToken};if(e.audience&&(n.audience=e.audience),"otp"===e.factorType?n.otp=e.otp:"oob"===e.factorType?(n.oob_code=e.oobCode,e.bindingCode&&(n.binding_code=e.bindingCode)):"recovery-code"===e.factorType&&(n.recovery_code=e.recoveryCode),e.fullResponse){var o;if(!m(os,this))throw new Error("MFA verify fullResponse requires a capture-config factory (createCaptureConfiguration was not set)");const a=xa(null!==(o=(await m(ns,this).call(this,t))[Ar])&&void 0!==o?o:fetch),c=await m(os,this).call(this,a);try{const t=await ei(c,Oa[e.factorType],n),o=Ca.fromTokenEndpointResponse(t);t.recovery_code&&(o.recoveryCode=t.recovery_code);const r=a.getCapturedResponse();if(!r)throw new fa;return{data:o,response:r}}catch(e){var r,i,s;if(e instanceof fa)throw e;if(e instanceof Ea)throw e;const t=e,n=new Ea(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(r=t.error)&&void 0!==r?r:"mfa_verify_error",error_description:null!==(i=null!==(s=t.error_description)&&void 0!==s?s:t.message)&&void 0!==i?i:"Failed to verify MFA challenge"});throw ya(n,e,a.getCapturedResponse()),n}}const a=await m(ns,this).call(this,t);try{const t=await ei(a,Oa[e.factorType],n),o=Ca.fromTokenEndpointResponse(t);return t.recovery_code&&(o.recoveryCode=t.recovery_code),o}catch(e){var c,u,l;if(e instanceof Ea)throw e;const t=e,n=new Ea(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(c=t.error)&&void 0!==c?c:"mfa_verify_error",error_description:null!==(u=null!==(l=t.error_description)&&void 0!==l?l:t.message)&&void 0!==u?u:"Failed to verify MFA challenge"});throw ya(n,e),n}}});function Wa(e){return Ia(m(es,this),e,m(ts,this))}var Ma=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},Na=class extends Ma{constructor(e,t){super("passkey_register_error",e,t),this.name="PasskeyRegisterError"}},Ua=class extends Ma{constructor(e,t){super("passkey_challenge_error",e,t),this.name="PasskeyChallengeError"}},La=class extends Ma{constructor(e,t){super("passkey_get_token_error",e,t),this.name="PasskeyGetTokenError",this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}};function Ka(e){return e.useMtls?{}:e.clientSecret?{client_secret:e.clientSecret}:{}}var za="urn:okta:params:oauth:grant-type:webauthn",Ja=(is=new WeakMap,ss=new WeakMap,as=new WeakMap,cs=new WeakMap,us=new WeakMap,ls=new WeakMap,ds=new WeakSet,class{constructor(e){var t,n;g(this,ds),y(this,is,void 0),y(this,ss,void 0),y(this,as,void 0),y(this,cs,void 0),y(this,us,void 0),y(this,ls,void 0),w(is,this,"https://".concat(e.domain)),w(ss,this,e.clientId),w(as,this,{clientSecret:e.clientSecret,useMtls:e.useMtls}),w(cs,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(us,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ls,this,e.grantRequest)}async register(e,t){const n="".concat(m(is,this),"/passkey/register"),o=_(_(_(_(_(_(_(_({},e.email&&{email:e.email}),e.name&&{name:e.name}),e.phoneNumber&&{phone_number:e.phoneNumber}),e.username&&{username:e.username}),e.givenName&&{given_name:e.givenName}),e.familyName&&{family_name:e.familyName}),e.nickname&&{nickname:e.nickname}),e.picture&&{picture:e.picture}),r=_(_({client_id:m(ss,this)},Ka(m(as,this))),{},{user_profile:o});e.realm&&(r.realm=e.realm),e.organization&&(r.organization=e.organization),e.userMetadata&&(r.user_metadata=e.userMetadata);const i=await h(ds,this,Da).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const e=await h(ds,this,Za).call(this,i),t=new Na(e.error_description||"Failed to request signup challenge",e);throw t.statusCode=i.status,t.headers=ma(i.headers),t}return{authSession:(s=await i.json()).auth_session,authnParamsPublicKey:_({},s.authn_params_public_key)};var s}async challenge(e,t){const n="".concat(m(is,this),"/passkey/challenge"),o=_({client_id:m(ss,this)},Ka(m(as,this)));null!=e&&e.realm&&(o.realm=e.realm),null!=e&&e.organization&&(o.organization=e.organization);const r=await h(ds,this,Da).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok){const e=await h(ds,this,Za).call(this,r),t=new Ua(e.error_description||"Failed to request login challenge",e);throw t.statusCode=r.status,t.headers=ma(r.headers),t}return{authSession:(i=await r.json()).auth_session,authnParamsPublicKey:_({},i.authn_params_public_key)};var i}async getTokenByPasskey(e,t){void 0!==e.organization&&ga(e.organization);const n=new URLSearchParams({auth_session:e.authSession,authn_response:JSON.stringify(e.credential)});let o;e.realm&&n.append("realm",e.realm),e.scope&&n.append("scope",e.scope),e.audience&&n.append("audience",e.audience),e.organization&&n.append("organization",e.organization);try{o=await m(ls,this).call(this,za,n,t,e.fullResponse)}catch(e){if(e instanceof fa)throw e;const t=Ys(e),n=new La(t.error_description||"Failed to exchange passkey credential for tokens.",t);throw ya(n,e),n}if(e.fullResponse){const t=o;return e.organization&&va(t.data.claims,e.organization),t}const r=o;return e.organization&&va(r.claims,e.organization),r}});function Da(e){return Ia(m(cs,this),e,m(us,this))}async function Za(e){const t=await e.clone().text();try{return _(_({},JSON.parse(t)),{},{statusCode:e.status,headers:e.headers,body:t})}catch(n){return{error:"unknown_error",error_description:"HTTP ".concat(e.status," ").concat(e.statusText),statusCode:e.status,headers:e.headers,body:t}}}var Ha=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&(n.error||n.error_description)?{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}:void 0;const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},Fa=class extends Ha{constructor(e,t){super("passwordless_start_error",e,t),this.name="PasswordlessStartError"}},Ga=class extends Ha{constructor(e,t){super("passwordless_verify_error",e,t),this.name="PasswordlessVerifyError"}},Va=class extends Ha{constructor(e,t){super("passwordless_db_get_token_error",e,t),this.name="PasswordlessDbGetTokenError"}},Xa=class extends Ha{constructor(e,t,n,o,r){super("passwordless_challenge_error",e,n),v(this,"statusCode",void 0),v(this,"validationErrors",void 0),this.name="PasswordlessChallengeError",this.statusCode=t,this.validationErrors=o,this.headers=null!=r?r:this.headers}};function qa(e){return/^\+[1-9]\d{1,14}$/.test(e)}async function Ya(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await Xi(e.clientAssertionSigningKey,r);return{client_assertion:await new Ri({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}if(e.clientSecret)return{client_secret:e.clientSecret};throw new ha}var Ba=(hs=new WeakMap,ps=new WeakMap,fs=new WeakMap,ms=new WeakMap,ys=new WeakMap,ws=new WeakMap,gs=new WeakMap,vs=new WeakSet,class{constructor(e){var t,n;g(this,vs),y(this,hs,void 0),y(this,ps,void 0),y(this,fs,void 0),y(this,ms,void 0),y(this,ys,void 0),y(this,ws,void 0),y(this,gs,void 0),w(ps,this,e.domain),w(hs,this,"https://".concat(e.domain)),w(fs,this,e.clientId),w(ms,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(ys,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ws,this,{clientSecret:e.clientSecret,clientAssertionSigningKey:e.clientAssertionSigningKey,clientAssertionSigningAlg:e.clientAssertionSigningAlg,useMtls:e.useMtls}),w(gs,this,e.grantRequest)}async sendEmail(e,t){const n=await h(vs,this,$a).call(this,function(e){var t;const n=null!==(t=e.send)&&void 0!==t?t:"code",o={email:e.email,connection:"email",send:n};return"link"===n&&e.authParams&&(o.authParams=e.authParams),o}(e),"Failed to send passwordless email",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async sendSms(e,t){if(!qa(e.phoneNumber))throw new Fa("Phone number must be in E.164 format (e.g. +14155550100).");const n=await h(vs,this,$a).call(this,function(e){return{phone_number:e.phoneNumber,connection:"sms"}}(e),"Failed to send passwordless SMS",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async challengeWithEmail(e,t){const n=function(e){var t;return{email:e.email,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t}}(e);return h(vs,this,ec).call(this,n,"Failed to request email OTP challenge",t)}async challengeWithPhoneNumber(e,t){if(!qa(e.phoneNumber))throw new Xa("Phone number must be in E.164 format (e.g. +14155550100).",0,void 0,void 0);const n=function(e){var t;const n={phone_number:e.phoneNumber,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t};return e.deliveryMethod&&(n.delivery_method=e.deliveryMethod),n}(e);return h(vs,this,ec).call(this,n,"Failed to request phone OTP challenge",t)}async getTokenByPasswordlessDbConnection(e,t){const n=new URLSearchParams({auth_session:e.authSession,otp:e.otp});if(e.scope&&n.append("scope",e.scope),e.audience&&n.append("audience",e.audience),!m(gs,this))throw new Va("Missing grant request delegate.",Ys(new Error("missing grantRequest")));try{return await m(gs,this).call(this,"http://auth0.com/oauth/grant-type/passwordless/otp",n,t,e.fullResponse)}catch(e){if(e instanceof fa)throw e;const t=new Va("There was an error while trying to request a token.",Ys(e)),n=e;throw t.statusCode=n._statusCode,t.headers=n._headers,t}}});function Qa(e){return Ia(m(ms,this),e,m(ys,this))}async function $a(e,t,n,o){var r;const i=await Ya(m(ws,this),m(fs,this),m(ps,this)),s=_(_({client_id:m(fs,this)},e),i);let a;try{a=await h(vs,this,Qa).call(this,o)("".concat(m(hs,this),"/passwordless/start"),{method:"POST",headers:_({"Content-Type":"application/json"},n?{"x-request-language":n}:{}),body:JSON.stringify(s)})}catch(e){throw new Fa("".concat(t,": a network error occurred."))}if(a.ok)return a;const c=await a.clone().text();let u;if(204!==a.status)try{u=JSON.parse(c)}catch(e){u=void 0}const l=new Fa((null===(r=u)||void 0===r?void 0:r.error_description)||t,u);throw l.statusCode=a.status,l.headers=ma(a.headers),l.body=c,l}async function ec(e,t,n){var o,r;const i=await Ya(m(ws,this),m(fs,this),m(ps,this)),s=_(_({client_id:m(fs,this)},e),i);let a;try{a=await h(vs,this,Qa).call(this,n)("".concat(m(hs,this),"/otp/challenge"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)})}catch(e){throw new Xa("challenge error: a network error occurred.",0,void 0,void 0)}if(a.ok){let n;try{n=await a.json()}catch(e){throw new Xa("".concat(t,": could not parse the response body."),a.status,void 0,void 0,ma(a.headers))}return{authSession:n.auth_session}}const c=await a.clone().text();let u;try{u=JSON.parse(c)}catch(e){u=void 0}const l=u?_(_({},u),{},{statusCode:a.status,headers:a.headers,body:c}):{error:"",error_description:"",statusCode:a.status,headers:a.headers,body:c};throw new Xa((null===(o=u)||void 0===o?void 0:o.error_description)||t,a.status,l,null===(r=u)||void 0===r?void 0:r.validation_errors,ma(a.headers))}var tc=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},nc=class extends tc{constructor(e,t){super("signup_error",e,t),this.name="SignUpError"}},oc=class extends tc{constructor(e,t){super("change_password_error",e,t),this.name="ChangePasswordError"}};function rc(e,t,n){for(const o of t)if(null===e[o]||void 0===e[o]||""===e[o])throw new n('Required parameter "'.concat(String(o),'" was null, undefined, or empty.'))}function ic(e){var t,n;return{id:null!==(t=null!==(n=e._id)&&void 0!==n?n:e.user_id)&&void 0!==t?t:e.id,email:"string"==typeof e.email?e.email:"",emailVerified:Boolean(e.email_verified),username:e.username,givenName:e.given_name,familyName:e.family_name,name:e.name,nickname:e.nickname,picture:e.picture,userMetadata:e.user_metadata}}var sc=(bs=new WeakMap,_s=new WeakMap,ks=new WeakMap,Ss=new WeakMap,Ts=new WeakSet,class{constructor(e){var t,n;g(this,Ts),y(this,bs,void 0),y(this,_s,void 0),y(this,ks,void 0),y(this,Ss,void 0),w(bs,this,"https://".concat(e.domain)),w(_s,this,e.clientId),w(ks,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(Ss,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra())}async signUp(e,t){var n;rc(e,["email","password","connection"],nc);const o=_({client_id:null!==(n=e.clientId)&&void 0!==n?n:m(_s,this)},function(e){const t={email:e.email,password:e.password,connection:e.connection};return void 0!==e.username&&(t.username=e.username),void 0!==e.givenName&&(t.given_name=e.givenName),void 0!==e.familyName&&(t.family_name=e.familyName),void 0!==e.name&&(t.name=e.name),void 0!==e.nickname&&(t.nickname=e.nickname),void 0!==e.picture&&(t.picture=e.picture),void 0!==e.userMetadata&&(t.user_metadata=e.userMetadata),t}(e)),r=await h(Ts,this,ac).call(this,"/dbconnections/signup",o,nc,"Failed to sign up",t);if(e.fullResponse){const e=r.clone();return{data:ic(await r.json()),response:e}}return ic(await r.json())}async changePassword(e,t){var n;if(rc(e,["connection"],oc),!e.email&&!e.username)throw new oc('Either "email" or "username" is required.');const o=_({client_id:null!==(n=e.clientId)&&void 0!==n?n:m(_s,this)},function(e){const t={connection:e.connection};return void 0!==e.email&&(t.email=e.email),void 0!==e.username&&(t.username=e.username),void 0!==e.organization&&(t.organization=e.organization),t}(e)),r=await h(Ts,this,ac).call(this,"/dbconnections/change_password",o,oc,"Failed to request a password change",t);if(e.fullResponse){const e=r.clone();return{data:await r.text(),response:e}}return r.text()}});async function ac(e,t,n,o,r){const i=Ia(m(ks,this),r,m(Ss,this));let s;try{s=await i("".concat(m(bs,this)).concat(e),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}catch(e){throw new n("".concat(o,": a network error occurred."))}if(s.ok)return s;const a=await s.clone().text(),c=await async function(e){let t;try{t=await e.json()}catch(e){return}return"string"==typeof t.error?t:"string"==typeof t.code?{error:t.code,error_description:"string"==typeof t.description?t.description:""}:void 0}(s.clone()),u=new n((null==c?void 0:c.error_description)||o,null!=c?c:{error:"unknown_error",error_description:o});throw u.statusCode=s.status,u.headers=ma(s.headers),u.body=a,u}var cc=class extends Error{constructor(e,t,n){super(t),v(this,"code",void 0),v(this,"cause",void 0),this.name="AnonymousSessionError",this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},uc=new Set(["session_expired","invalid_session_token"]);async function lc(e){const t="Request failed with status ".concat(e.status);let n={};try{n=await e.json()}catch(e){}return{error:"string"==typeof n.error?n.error:"server_error",error_description:"string"==typeof n.error_description?n.error_description:t}}var dc=(Es=new WeakMap,Ps=new WeakMap,Cs=new WeakMap,As=new WeakMap,Rs=new WeakMap,xs=new WeakMap,Is=new WeakMap,Os=new WeakMap,js=new WeakSet,class{constructor(e){var t;g(this,js),y(this,Es,void 0),y(this,Ps,void 0),y(this,Cs,void 0),y(this,As,void 0),y(this,Rs,void 0),y(this,xs,void 0),y(this,Is,void 0),y(this,Os,void 0),w(Es,this,e.domain),w(Ps,this,"https://".concat(e.domain)),w(Cs,this,e.clientId),w(As,this,e.clientSecret),w(Rs,this,e.clientAssertionSigningKey),w(xs,this,e.clientAssertionSigningAlg),w(Is,this,e.useMtls),w(Os,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)})}async createSession(e){const t={client_id:m(Cs,this)};null!=e&&e.audience&&(t.audience=e.audience),null!=e&&e.scope&&(t.scope=e.scope),null!=e&&e.metadata&&(t.metadata=e.metadata);const n=await h(js,this,pc).call(this,t);if(!n.sessionToken)throw new cc("server_error","session_token missing from create session response");return{sessionToken:n.sessionToken,accessToken:n.accessToken,expiresAt:n.expiresAt,sessionTokenExpiresAt:n.sessionTokenExpiresAt,scope:n.scope}}async getAccessToken(e){if(null==e||!e.sessionToken)return this.createSession({audience:null==e?void 0:e.audience,scope:null==e?void 0:e.scope});try{return await h(js,this,hc).call(this,e.sessionToken,e)}catch(t){if(t instanceof cc&&uc.has(t.code))return _(_({},await this.createSession({audience:null==e?void 0:e.audience,scope:null==e?void 0:e.scope})),{},{sessionReplaced:!0});throw t}}async logout(){const e="".concat(m(Ps,this),"/anonymous/logout"),t={client_id:m(Cs,this)},n=await m(Os,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(t)});if(!n.ok){const e=await lc(n);throw new cc(e.error,e.error_description||"Failed to end anonymous session",e)}}});async function hc(e,t){const n={client_id:m(Cs,this),session_token:e};null!=t&&t.audience&&(n.audience=t.audience),null!=t&&t.scope&&(n.scope=t.scope);const o=await h(js,this,pc).call(this,n);return{sessionToken:e,accessToken:o.accessToken,expiresAt:o.expiresAt,sessionTokenExpiresAt:o.sessionTokenExpiresAt,scope:o.scope,sessionReplaced:!1}}async function pc(e){const t="".concat(m(Ps,this),"/anonymous/token"),n=await async function(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await Xi(e.clientAssertionSigningKey,r);return{client_assertion:await new Ri({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}return e.clientSecret?{client_secret:e.clientSecret}:{}}({clientSecret:m(As,this),clientAssertionSigningKey:m(Rs,this),clientAssertionSigningAlg:m(xs,this),useMtls:m(Is,this)},m(Cs,this),m(Es,this));Object.assign(e,n);const o=await m(Os,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(e)});if(!o.ok){const e=await lc(o);throw new cc(e.error,e.error_description||"Anonymous token request failed",e)}let r;try{r=await o.json()}catch(e){throw new cc("server_error","Invalid response from anonymous token endpoint")}return function(e){const t=Math.floor(Date.now()/1e3);if("string"!=typeof e.access_token||!e.access_token)throw new cc("server_error","access_token missing or invalid in anonymous token response");const n=e.expires_in;if("number"!=typeof n||!Number.isFinite(n))throw new cc("server_error","expires_in missing or invalid in anonymous token response");return{accessToken:e.access_token,expiresAt:t+n,scope:e.scope,sessionToken:e.session_token,sessionTokenExpiresAt:"number"==typeof e.session_expires_in&&Number.isFinite(e.session_expires_in)?t+e.session_expires_in:void 0}}(r)}var fc=(Ws=new WeakMap,Ms=new WeakMap,Ns=new WeakMap,class{constructor(e,t){y(this,Ws,new Map),y(this,Ms,void 0),y(this,Ns,void 0),w(Ns,this,Math.max(1,Math.floor(e))),w(Ms,this,Math.max(0,Math.floor(t)))}get(e){const t=m(Ws,this).get(e);if(t){if(!(Date.now()>=t.expiresAt))return m(Ws,this).delete(e),m(Ws,this).set(e,t),t.value;m(Ws,this).delete(e)}}set(e,t,n){m(Ws,this).has(e)&&m(Ws,this).delete(e);const o=null!=n&&Number.isFinite(n)&&n>0?n:m(Ms,this);for(m(Ws,this).set(e,{value:t,expiresAt:Date.now()+o});m(Ws,this).size>m(Ns,this);){const e=m(Ws,this).keys().next().value;if(void 0===e)break;m(Ws,this).delete(e)}}}),mc=new Map;function yc(e){return{ttlMs:1e3*("number"==typeof(null==e?void 0:e.ttl)?e.ttl:600),maxEntries:"number"==typeof(null==e?void 0:e.maxEntries)&&e.maxEntries>0?e.maxEntries:100}}var wc=class{static createDiscoveryCache(e){const t=(n=e.maxEntries,o=e.ttlMs,"".concat(n,":").concat(o));var n,o;let r=(i=t,mc.get(i));var i;return r||(r=new fc(e.maxEntries,e.ttlMs),mc.set(t,r)),r}static createJwksCache(){return{}}},gc="openid profile email offline_access",vc=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function bc(e){if(null==e)throw new ra("subject_token is required");if("string"!=typeof e)throw new ra("subject_token must be a string");if(0===e.trim().length)throw new ra("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new ra("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new ra("subject_token must not include the 'Bearer ' prefix")}function _c(e,t){if(t)for(const o of Object.entries(t)){var n=S(o,2);const t=n[0],r=n[1];if(!vc.has(t))if(Array.isArray(r)){if(r.length>20)throw new ra("Parameter '".concat(t,"' exceeds maximum array size of ").concat(20));r.forEach(n=>{e.append(t,n)})}else e.append(t,r)}}var kc="urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",Sc="urn:ietf:params:oauth:grant-type:token-exchange",Tc="urn:ietf:params:oauth:token-type:access_token";function Ec(e,t){return(n,o)=>{const r=null==o?void 0:o.body;if(t!==za||!(r instanceof URLSearchParams))return e(n,o);const i={};for(const e of r){var s=S(e,2);const t=s[0],n=s[1];i[t]="authn_response"===t?JSON.parse(n):n}const a=new Headers(null==o?void 0:o.headers);return a.set("Content-Type","application/json"),e(n,_(_({},o),{},{headers:a,body:JSON.stringify(i)}))}}var Pc=(Us=new WeakMap,Ls=new WeakMap,Ks=new WeakMap,zs=new WeakMap,Js=new WeakMap,Ds=new WeakMap,Zs=new WeakMap,Hs=new WeakMap,Fs=new WeakMap,Gs=new WeakMap,Vs=new WeakMap,Xs=new WeakSet,class{constructor(e){var t;if(g(this,Xs),y(this,Us,void 0),y(this,Ls,void 0),y(this,Ks,void 0),y(this,zs,void 0),y(this,Js,void 0),y(this,Ds,void 0),y(this,Zs,void 0),y(this,Hs,void 0),y(this,Fs,void 0),y(this,Gs,void 0),y(this,Vs,void 0),v(this,"mfa",void 0),v(this,"passkey",void 0),v(this,"passwordless",void 0),v(this,"database",void 0),v(this,"anonymous",void 0),w(Js,this,e),e.useMtls&&!e.customFetch)throw new Bs("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");w(Zs,this,Ra(e.telemetry)),w(Ds,this,Aa(null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)},m(Zs,this)));const n=yc(e.discoveryCache);w(Fs,this,wc.createDiscoveryCache(n)),w(Gs,this,new Map),w(Vs,this,wc.createJwksCache()),this.mfa=new ja({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),getConfiguration:async e=>(await h(Xs,this,xc).call(this,e)).configuration,createCaptureConfiguration:async e=>{const t=(await h(Xs,this,Ic).call(this)).serverMetadata;return h(Xs,this,Ac).call(this,t,e)}}),this.passkey=new Ja({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,useMtls:m(Js,this).useMtls,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),grantRequest:async(e,t,n,o)=>{const r=(await h(Xs,this,Ic).call(this)).serverMetadata,i=h(Xs,this,Rc).call(this,n);if(o){const n=xa(i),o=await h(Xs,this,Ac).call(this,r,n);o[Ar]=Ec(n,e);const s=await ei(o,e,t),a=Ca.fromTokenEndpointResponse(s),c=n.getCapturedResponse();if(!c)throw new fa;return{data:a,response:c}}const s=await h(Xs,this,Ac).call(this,r);s[Ar]=Ec(i,e);const a=await ei(s,e,t);return Ca.fromTokenEndpointResponse(a)}}),this.passwordless=new Ba({domain:m(Js,this).domain,clientId:m(Js,this).clientId,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),clientSecret:m(Js,this).clientSecret,clientAssertionSigningKey:m(Js,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(Js,this).clientAssertionSigningAlg,useMtls:m(Js,this).useMtls,grantRequest:async(e,t,n,o)=>{const r=(await h(Xs,this,xc).call(this,n)).configuration;if(o){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n),s=await ei(o,e,t),a=Ca.fromTokenEndpointResponse(s),c=n.getCapturedResponse();if(!c)throw new fa;return{data:a,response:c}}try{const n=await ei(r,e,t);return Ca.fromTokenEndpointResponse(n)}catch(e){const t=e,n={};throw ya(n,e),t._statusCode=n.statusCode,t._headers=n.headers,e}}}),this.database=new sc({domain:m(Js,this).domain,clientId:m(Js,this).clientId,customFetch:m(Ds,this),telemetryConfig:m(Zs,this)}),this.anonymous=new dc({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,clientAssertionSigningKey:m(Js,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(Js,this).clientAssertionSigningAlg,useMtls:m(Js,this).useMtls,customFetch:m(Ds,this)})}async getServerMetadata(){return(await h(Xs,this,Ic).call(this)).serverMetadata}async buildAuthorizationUrl(e){const t=(await h(Xs,this,Ic).call(this)).serverMetadata;if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new Bs("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await h(Xs,this,Lc).call(this,e)}catch(e){throw new ua(e)}}async buildLinkUserUrl(e){try{const t=await h(Xs,this,Lc).call(this,{authorizationParams:_(_({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new la(e)}}async buildUnlinkUserUrl(e){try{const t=await h(Xs,this,Lc).call(this,{authorizationParams:_(_({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new da(e)}}async backchannelAuthentication(e,t){var n;const o=await h(Xs,this,xc).call(this,t),r=o.configuration,i=o.serverMetadata,s=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),a=new URLSearchParams(_(_({scope:gc},s),{},{client_id:m(Js,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:i.issuer,sub:e.loginHint.sub})}));if(e.requestedExpiry&&a.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&a.append("authorization_details",JSON.stringify(e.authorizationDetails)),e.fullResponse){var c;const e=xa(null!==(c=r[Ar])&&void 0!==c?c:m(Ds,this)),n=await h(Xs,this,Ac).call(this,r.serverMetadata(),e);try{const t=await Jr(r,a),o=await Dr(n,t),i=e.getCapturedResponse();if(!i)throw new fa;return{data:Ca.fromTokenEndpointResponse(o),response:i}}catch(t){if(t instanceof fa)throw t;const n=new ca(t);throw ya(n,t,e.getCapturedResponse()),n}}const u=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),l=await h(Xs,this,Ac).call(this,r.serverMetadata(),u);try{const e=await Jr(r,a),t=await Dr(l,e);return Ca.fromTokenEndpointResponse(t)}catch(e){const t=new ca(e);throw ya(t,e,u.getCapturedResponse()),t}}async initiateBackchannelAuthentication(e,t){var n;const o=await h(Xs,this,xc).call(this,t),r=o.configuration,i=o.serverMetadata,s=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),a=new URLSearchParams(_(_({scope:gc},s),{},{client_id:m(Js,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:i.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&a.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&a.append("authorization_details",JSON.stringify(e.authorizationDetails));const c=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),u=await h(Xs,this,Ac).call(this,r.serverMetadata(),c);try{const e=await Jr(u,a);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(e){const t=new ca(e),n=c.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async backchannelAuthenticationGrant(e,t){var n;let o=e.authReqId;const r=(await h(Xs,this,xc).call(this,t)).configuration,i=new URLSearchParams({auth_req_id:o}),s=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const e=await ei(a,"urn:openid:params:grant-type:ciba",i);return Ca.fromTokenEndpointResponse(e)}catch(e){const t=new ca(e),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getTokenForConnection(e,t){var n;if(e.refreshToken&&e.accessToken)throw new oa("Either a refresh or access token should be specified, but not both.");const o=null!==(n=e.accessToken)&&void 0!==n?n:e.refreshToken;if(!o)throw new oa("Either a refresh or access token must be specified.");try{return await this.exchangeToken(_({connection:e.connection,subjectToken:o,subjectTokenType:e.accessToken?Tc:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint},e.fullResponse?{fullResponse:!0}:{}),t)}catch(e){if(e instanceof ra){const t=new oa(e.message,e.cause);throw t.statusCode=e.statusCode,t.headers=e.headers,t}throw e}}async exchangeToken(e,t){return e.fullResponse?"connection"in e?h(Xs,this,jc).call(this,e,t,!0):h(Xs,this,Mc).call(this,e,t,!0):"connection"in e?h(Xs,this,jc).call(this,e,t):h(Xs,this,Mc).call(this,e,t)}async getTokenByCode(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,n)).configuration;if(void 0!==t.organization&&ga(t.organization),t.fullResponse){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n);let s,a;try{const r=await Hr(o,e,{pkceCodeVerifier:t.codeVerifier});if(s=Ca.fromTokenEndpointResponse(r),a=n.getCapturedResponse(),!a)throw new fa}catch(e){if(e instanceof fa)throw e;const t=new $s("There was an error while trying to request a token.",Ys(e)),o=n.getCapturedResponse();throw t.statusCode=null==o?void 0:o.status,t.headers=o?ma(o.headers):void 0,t}return t.organization&&va(s.claims,t.organization),{data:s,response:a}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);let c;try{const n=await Hr(a,e,{pkceCodeVerifier:t.codeVerifier});c=Ca.fromTokenEndpointResponse(n)}catch(e){const t=new $s("There was an error while trying to request a token.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}return t.organization&&va(c.claims,t.organization),c}async getTokenByMagicLinkCode(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,n)).configuration;if(null!=t&&t.fullResponse){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n);try{const r=await Hr(o,e,{expectedState:null==t?void 0:t.expectedState}),i=Ca.fromTokenEndpointResponse(r),s=n.getCapturedResponse();if(!s)throw new fa;return{data:i,response:s}}catch(e){if(e instanceof fa)throw e;const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.",o=new $s(t,e),r=n.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const n=await Hr(a,e,{expectedState:null==t?void 0:t.expectedState});return Ca.fromTokenEndpointResponse(n)}catch(e){const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.",n=new $s(t,e),o=s.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}async getTokenByRefreshToken(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r=new URLSearchParams;if(e.audience&&r.append("audience",e.audience),e.scope&&r.append("scope",e.scope),e.fullResponse){var i;const t=xa(null!==(i=o[Ar])&&void 0!==i?i:m(Ds,this)),n=await h(Xs,this,Ac).call(this,o.serverMetadata(),t);try{const o=await Fr(n,e.refreshToken,r),i=Ca.fromTokenEndpointResponse(o),s=t.getCapturedResponse();if(!s)throw new fa;return{data:i,response:s}}catch(e){if(e instanceof fa)throw e;const n=new ta("The access token has expired and there was an error while trying to refresh it.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const s=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),a=await h(Xs,this,Ac).call(this,o.serverMetadata(),s);try{const t=await Fr(a,e.refreshToken,r);return Ca.fromTokenEndpointResponse(t)}catch(e){const t=new ta("The access token has expired and there was an error while trying to refresh it.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async revokeToken(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r={};e.tokenTypeHint&&(r.token_type_hint=e.tokenTypeHint);const i=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),s=await h(Xs,this,Ac).call(this,o.serverMetadata(),i);try{await async function(e,t,n){qr(e);const o=Sr(e),r=o.as,i=o.c,s=o.auth,a=o.fetch,c=o.tlsOnly,u=o.timeout;return async function(e,t,n,o,r){nn(e),on(t),qt(o,'"token"');const i=ln(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),s=new URLSearchParams(null==r?void 0:r.additionalParameters);s.set("token",o);const a=Ft(null==r?void 0:r.headers);return a.delete("accept"),Pn(e,t,n,i,s,a,r)}(r,i,s,t,{[Ot]:a,[Rt]:!c,additionalParameters:new URLSearchParams(n),headers:new Headers(_r),signal:Yr(u)}).then(io).catch(Wr)}(s,e.token,r)}catch(e){const t=new ia("An error occurred while trying to revoke the token.",Ys(e)),n=i.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getUserInfo(e,t){const n=(await h(Xs,this,xc).call(this,t,!0)).configuration;try{var o;return await Br(n,e.accessToken,null!==(o=e.expectedSubject)&&void 0!==o?o:Cr)}catch(e){throw new sa("There was an error while trying to retrieve the user info.",Ys(e))}}async getTokenByPassword(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r=new URLSearchParams({username:e.username,password:e.password});e.audience&&r.append("audience",e.audience),e.scope&&r.append("scope",e.scope),e.realm&&r.append("realm",e.realm);let i=o;if(e.auth0ForwardedFor){const t=await h(Xs,this,Uc).call(this);i=new Ur(o.serverMetadata(),m(Js,this).clientId,{client_secret:m(Js,this).clientSecret,use_mtls_endpoint_aliases:m(Js,this).useMtls},t);const n=o[Ar];i[Ar]=(t,o)=>n(t,_(_({},o),{},{headers:_(_({},o.headers),{},{"auth0-forwarded-for":e.auth0ForwardedFor})}))}if(e.fullResponse){var s;const e=xa(null!==(s=i[Ar])&&void 0!==s?s:m(Ds,this)),n=await h(Xs,this,Ac).call(this,i.serverMetadata(),e);try{const t=await ei(n,"password",r),o=Ca.fromTokenEndpointResponse(t),i=e.getCapturedResponse();if(!i)throw new fa;return{data:o,response:i}}catch(t){if(t instanceof fa)throw t;const n=new na("There was an error while trying to request a token.",Ys(t)),o=e.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const a=xa(null!==(n=i[Ar])&&void 0!==n?n:m(Ds,this)),c=await h(Xs,this,Ac).call(this,i.serverMetadata(),a);try{const e=await ei(c,"password",r);return Ca.fromTokenEndpointResponse(e)}catch(e){const t=new na("There was an error while trying to request a token.",Ys(e)),n=a.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getTokenByPasswordlessEmail(e,t){const n=new URLSearchParams({username:e.email,otp:e.code,realm:"email"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),h(Xs,this,Nc).call(this,n,t,e.fullResponse)}async getTokenByPasswordlessSms(e,t){if(!qa(e.phoneNumber))throw new Ga("Phone number must be in E.164 format (e.g. +14155550100).");const n=new URLSearchParams({username:e.phoneNumber,otp:e.code,realm:"sms"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),h(Xs,this,Nc).call(this,n,t,e.fullResponse)}async getTokenByClientCredentials(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration;if(e.fullResponse){var r;const t=xa(null!==(r=o[Ar])&&void 0!==r?r:m(Ds,this)),n=await h(Xs,this,Ac).call(this,o.serverMetadata(),t),i=new URLSearchParams({audience:e.audience});e.organization&&i.append("organization",e.organization);try{const e=await Gr(n,i),o=Ca.fromTokenEndpointResponse(e),r=t.getCapturedResponse();if(!r)throw new fa;return{data:o,response:r}}catch(e){if(e instanceof fa)throw e;const n=new ea("There was an error while trying to request a token.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const i=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),s=await h(Xs,this,Ac).call(this,o.serverMetadata(),i);try{const t=new URLSearchParams({audience:e.audience});e.organization&&t.append("organization",e.organization);const n=await Gr(s,t);return Ca.fromTokenEndpointResponse(n)}catch(e){const t=new ea("There was an error while trying to request a token.",Ys(e)),n=i.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async buildLogoutUrl(e){const t=await h(Xs,this,Ic).call(this),n=t.configuration;if(!t.serverMetadata.end_session_endpoint){const t=new URL("https://".concat(m(Js,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",m(Js,this).clientId),e.federated&&t.searchParams.set("federated",""),t}const o={post_logout_redirect_uri:e.returnTo};return e.federated&&(o.federated=""),function(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=ln(o,"end_session_endpoint",!1,n.tlsOnly);(t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id);for(const e of t.entries()){var s=S(e,2);const t=s[0],n=s[1];i.searchParams.append(t,n)}return i}(n,o)}async verifyLogoutToken(e){const t=(await h(Xs,this,Ic).call(this)).serverMetadata,n=yc(m(Js,this).discoveryCache),o=t.jwks_uri;m(Hs,this)||w(Hs,this,function(e,t){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");const n=new URL(e.href).href,o=null!=t?t:{},r=o.timeoutDuration;if("number"==typeof r&&(!Number.isInteger(r)||r<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');const i="number"==typeof r?r:5e3,s=Vi(o.cooldownDuration,3e4,"cooldownDuration"),a=Vi(o.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(o.headers);Zi&&!c.has("User-Agent")&&c.set("User-Agent",Zi),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");const u=o[Hi],l=o[Fi];let d,h,p,f=0,m=0;if(l&&"object"==typeof l){const e=l.uat,t=l.jwks;Gi(e,a)&&Zo(t)&&(d=e,p=zi(t))}const y=async()=>{if(h&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(h=void 0),!h){const e=++f,t=h=async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch;const r=await o(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(e=>{if("TimeoutError"===e.name)throw new Mo;throw e});if(200!==r.status)throw new Eo("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await r.json()}catch(e){throw new Eo("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(n,c,AbortSignal.timeout(i),u).then(t=>{const n=zi(t);if(e<=m)return;p=n;const o=Date.now();l&&(l.uat=o,l.jwks=t),d=o,m=e}).finally(()=>{h===t&&(h=void 0)})}await h};return Object.defineProperties(async(e,t)=>{p&&Gi(d,a)||await y();try{return await p(e,t)}catch(n){if(n instanceof jo&&!Gi(d,s))return await y(),p(e,t);throw n}},{coolingDown:{get:()=>Gi(d,s),enumerable:!0},fresh:{get:()=>Gi(d,a),enumerable:!0},reload:{value:y,enumerable:!0},reloading:{get:()=>!!h,enumerable:!0},jwks:{value:()=>{var e;return null===(e=p)||void 0===e?void 0:e.jwks()},enumerable:!0}})}(new URL(o),{cacheMaxAge:n.ttlMs,[Hi]:m(Ds,this),[Fi]:m(Vs,this)}));const r=(await async function(e,t,n){const o=await li(e,function(e){return[e&&yr("algorithms",e.algorithms),null==e?void 0:e.crit]}(n),t);if(!o[2])throw new Io("JWTs MUST NOT use unencoded payload");const r={payload:Si(o[1],o[0],n),protectedHeader:o[1]};return"function"==typeof t?_(_({},r),{},{key:o[3]}):r}(e.logoutToken,m(Hs,this),{issuer:t.issuer,audience:m(Js,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in r)&&!("sub"in r))throw new aa('either "sid" or "sub" (or both) claims must be present');if("sid"in r&&"string"!=typeof r.sid)throw new aa('"sid" claim must be a string');if("sub"in r&&"string"!=typeof r.sub)throw new aa('"sub" claim must be a string');if("nonce"in r)throw new aa('"nonce" claim is prohibited');if(!("events"in r))throw new aa('"events" claim is missing');if("object"!=typeof r.events||null===r.events)throw new aa('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in r.events))throw new aa('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof r.events["http://schemas.openid.net/event/backchannel-logout"])throw new aa('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:r.sid,sub:r.sub}}});function Cc(){const e=m(Js,this).domain.toLowerCase();return"".concat(e,"|mtls:").concat(m(Js,this).useMtls?"1":"0")}async function Ac(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];const o=await h(Xs,this,Uc).call(this,n),r=new Ur(e,m(Js,this).clientId,{client_secret:m(Js,this).clientSecret,use_mtls_endpoint_aliases:m(Js,this).useMtls},o);return r[Ar]=null!=t?t:m(Ds,this),r}function Rc(e){return Ia(m(Ds,this),e,m(Zs,this))}async function xc(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];const n=await h(Xs,this,Ic).call(this,t),o=n.configuration,r=n.serverMetadata;if(!e)return{configuration:o,serverMetadata:r};const i=h(Xs,this,Rc).call(this,e);return{configuration:await h(Xs,this,Ac).call(this,r,i,t),serverMetadata:r}}async function Ic(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];const t=m(e?Ls:Us,this);if(t&&m(Ks,this))return{configuration:t,serverMetadata:m(Ks,this)};const n=h(Xs,this,Cc).call(this);e||await h(Xs,this,Uc).call(this,!1);const o=m(Fs,this).get(n);if(o)return h(Xs,this,Oc).call(this,o.serverMetadata,e);const r=m(Gs,this).get(n);if(r){const t=await r;return h(Xs,this,Oc).call(this,t.serverMetadata,e)}const i=(async()=>{const e=(await Mr(new URL("https://".concat(m(Js,this).domain)),m(Js,this).clientId,{use_mtls_endpoint_aliases:m(Js,this).useMtls},(e,t,n,o)=>{n.set("client_id",t.client_id)},{[Ar]:m(Ds,this)})).serverMetadata();return m(Fs,this).set(n,{serverMetadata:e}),{serverMetadata:e}})();i.catch(()=>{}),m(Gs,this).set(n,i);try{const t=(await i).serverMetadata;return h(Xs,this,Oc).call(this,t,e)}finally{m(Gs,this).delete(n)}}async function Oc(e,t){const n=await h(Xs,this,Ac).call(this,e,void 0,t);return w(Ks,this,e),w(t?Ls:Us,this,n),{configuration:n,serverMetadata:e}}async function jc(e,t,n){var o,r,i;const s=(await h(Xs,this,xc).call(this,t)).configuration;if("audience"in e||"resource"in e)throw new ra("audience and resource parameters are not supported for Token Vault exchanges");bc(e.subjectToken);const a=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!==(o=e.subjectTokenType)&&void 0!==o?o:Tc,requested_token_type:null!==(r=e.requestedTokenType)&&void 0!==r?r:"http://auth0.com/oauth/token-type/federated-connection-access-token"});if(e.loginHint&&a.append("login_hint",e.loginHint),e.scope&&a.append("scope",e.scope),_c(a,e.extra),n){var c;const t=xa(null!==(c=s[Ar])&&void 0!==c?c:m(Ds,this)),o=await h(Xs,this,Ac).call(this,s.serverMetadata(),t);try{const e=await ei(o,kc,a),n=Ca.fromTokenEndpointResponse(e),r=t.getCapturedResponse();if(!r)throw new fa;return{data:n,response:r}}catch(n){if(n instanceof fa)throw n;const o=new ra("Failed to exchange token for connection '".concat(e.connection,"'."),Ys(n)),r=t.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}}const u=xa(null!==(i=s[Ar])&&void 0!==i?i:m(Ds,this)),l=await h(Xs,this,Ac).call(this,s.serverMetadata(),u);try{const e=await ei(l,kc,a);return Ca.fromTokenEndpointResponse(e)}catch(t){const n=new ra("Failed to exchange token for connection '".concat(e.connection,"'."),Ys(t)),o=u.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}function Wc(e,t,n){var o;if(n.organization&&va(e.claims,n.organization),n.actorToken)if(null!==(o=e.claims)&&void 0!==o&&o.act)e.act=e.claims.act;else try{e.act=function(e){if("string"!=typeof e)throw new Io("JWTs must use Compact JWS serialization, JWT must be a string");const t=e.split("."),n=t[1],o=t.length;if(5===o)throw new Io("Only JWTs using Compact JWS serialization can be decoded");if(3!==o)throw new Io("Invalid JWT");if(!n)throw new Io("JWTs must contain a payload");let r,i;try{r=zo(n)}catch(e){throw new Io("Failed to base64url decode the payload")}try{i=JSON.parse(bo.decode(r))}catch(e){throw new Io("Failed to parse the decoded payload as JSON")}if(!Do(i))throw new Io("Invalid JWT Claims Set");return i}(t.access_token).act}catch(e){}return e}async function Mc(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,t)).configuration;if(bc(e.subjectToken),void 0!==e.organization&&ga(e.organization),void 0!==e.actorToken&&void 0===e.actorTokenType)throw new ra("actorTokenType is required when actorToken is provided");const i=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});if(e.audience&&i.append("audience",e.audience),e.scope&&i.append("scope",e.scope),e.requestedTokenType&&i.append("requested_token_type",e.requestedTokenType),e.organization&&i.append("organization",e.organization),e.actorToken&&i.append("actor_token",e.actorToken),e.actorTokenType&&i.append("actor_token_type",e.actorTokenType),_c(i,e.extra),n){var s;const t=xa(null!==(s=r[Ar])&&void 0!==s?s:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),t);let a,c,u;try{if(c=await ei(o,Sc,i),a=Ca.fromTokenEndpointResponse(c),u=t.getCapturedResponse(),!u)throw new fa}catch(n){if(n instanceof fa)throw n;const o=new ra("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),Ys(n)),r=t.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}return h(Xs,this,Wc).call(this,a,c,e),{data:a,response:u}}const a=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),c=await h(Xs,this,Ac).call(this,r.serverMetadata(),a);let u,l;try{l=await ei(c,Sc,i),u=Ca.fromTokenEndpointResponse(l)}catch(t){const n=new ra("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),Ys(t)),o=a.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}return h(Xs,this,Wc).call(this,u,l,e),u}async function Nc(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,t)).configuration;if(n){var i;const t=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),n=await h(Xs,this,Ac).call(this,r.serverMetadata(),t);try{const o=await ei(n,"http://auth0.com/oauth/grant-type/passwordless/otp",e),r=Ca.fromTokenEndpointResponse(o),i=t.getCapturedResponse();if(!i)throw new fa;return{data:r,response:i}}catch(e){if(e instanceof fa)throw e;const n=new Ga("There was an error while trying to request a token.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const t=await ei(a,"http://auth0.com/oauth/grant-type/passwordless/otp",e);return Ca.fromTokenEndpointResponse(t)}catch(e){const t=new Ga("There was an error while trying to request a token.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async function Uc(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];const t=!!m(Js,this).clientSecret||!!m(Js,this).clientAssertionSigningKey||!!m(Js,this).useMtls;return e&&!t?(e,t,n,o)=>{n.set("client_id",t.client_id)}:(m(zs,this)||w(zs,this,(async()=>{if(!m(Js,this).clientSecret&&!m(Js,this).clientAssertionSigningKey&&!m(Js,this).useMtls)throw new ha;if(m(Js,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let e=m(Js,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await Xi(e,m(Js,this).clientAssertionSigningAlg||"RS256")),e?function(e){return sn(e,void 0)}(e):Pr(m(Js,this).clientSecret)})().catch(e=>{throw w(zs,this,void 0),e})),m(zs,this))}async function Lc(e){const t=(await h(Xs,this,Ic).call(this)).configuration,n=Bt(),o=await function(e){return async function(e){return qt(e,"codeVerifier"),zt(await crypto.subtle.digest("SHA-256",Ut(e)))}(e)}(n),r=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(_(_({scope:gc},r),{},{client_id:m(Js,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await Xr(t,i):await Vr(t,i),codeVerifier:n}}var Kc,zc,Jc=new fc(1e3,6e4);class Dc extends W{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Dc.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new Dc(t,n)}}class Zc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Zc.prototype)}}class Hc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Hc.prototype)}}class Fc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Fc.prototype)}}class Gc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Gc.prototype)}}class Vc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Vc.prototype)}}class Xc{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){const t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const n of this.contexts){var t=S(n,2);const o=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(o)}}get size(){return this.contexts.size}}class qc{constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new Xc}setMFAAuthDetails(e,t,n,o){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:o})}async getAuthenticators(e){var t,n,o;const r=this.contextManager.get(e);if(!r)throw new Zc("invalid_request","MFA context not found for this MFA token");const i=null===(n=null===(t=r.mfaRequirements)||void 0===t?void 0:t.challenge)||void 0===n?void 0:n.map(e=>e.type);try{const t=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return i&&0!==i.length?t.filter(e=>!!e.type&&i.includes(e.type)):t}catch(e){if(e instanceof _a)throw new Zc(null===(o=e.cause)||void 0===o?void 0:o.error,e.message);throw e}}async enroll(e){var t;const n=function(e){const t=_t[e.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:e.mfaToken,authenticatorTypes:t.authenticatorTypes},t.oobChannels&&{oobChannels:t.oobChannels}),"phoneNumber"in e&&{phoneNumber:e.phoneNumber}),"email"in e&&{email:e.email})}(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(e){if(e instanceof ka)throw new Hc(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async challenge(e){var t;try{const t={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(t.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(t)}catch(e){if(e instanceof Ta)throw new Fc(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async getEnrollmentFactors(e){const t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new Vc("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&0!==t.mfaRequirements.enroll.length?t.mfaRequirements.enroll:[]}async verify(e){const t=this.contextManager.get(e.mfaToken);if(!t)throw new Gc("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const n=function(e){return"otp"in e&&e.otp?"http://auth0.com/oauth/grant-type/mfa-otp":"oobCode"in e&&e.oobCode?"http://auth0.com/oauth/grant-type/mfa-oob":"recoveryCode"in e&&e.recoveryCode?"http://auth0.com/oauth/grant-type/mfa-recovery-code":void 0}(e);if(!n)throw new Gc("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const o=t.scope,r=t.audience;try{const t=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:o,audience:r,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),t}catch(e){if(e instanceof Gc)throw new Gc(e.error,e.error_description);throw e}}}class Yc extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,Yc.prototype)}}class Bc{constructor(e,t){Kc.set(this,void 0),zc.set(this,void 0),u(this,Kc,e,"f"),u(this,zc,t,"f")}async signup(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.scope,n=e.audience,o=a(e,["scope","audience"]),r=await c(this,Kc,"f").register(o),i=eu(r.authnParamsPublicKey),s=await navigator.credentials.create({publicKey:i});if(!s)throw new Yc("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");const u=nu(s);return c(this,zc,"f")._requestTokenForPasskey({authSession:r.authSession,credential:u,realm:o.realm,organization:o.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e||{},n=t.scope,o=t.audience,r=a(t,["scope","audience"]),i=await c(this,Kc,"f").challenge(Object.keys(r).length>0?r:void 0),s=tu(i.authnParamsPublicKey),u=await navigator.credentials.get({publicKey:s});if(!u)throw new Yc("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");const l=ou(u);return c(this,zc,"f")._requestTokenForPasskey({authSession:i.authSession,credential:l,realm:r.realm,organization:r.organization,scope:n,audience:o})}async getSignupChallenge(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,Kc,"f").register(e);return{authSession:t.authSession,publicKey:eu(t.authnParamsPublicKey)}}async getLoginChallenge(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,Kc,"f").challenge(e);return{authSession:t.authSession,publicKey:tu(t.authnParamsPublicKey)}}async getTokenWithPasskey(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.authSession,n=e.credential,o=e.realm,r=e.organization,i=e.scope,s=e.audience,a=n.response;let u;if(a instanceof AuthenticatorAttestationResponse)u=nu(n);else{if(!(a instanceof AuthenticatorAssertionResponse))throw new Yc("passkey_invalid_credential","The provided credential is not a valid attestation or assertion response.");u=ou(n)}return c(this,zc,"f")._requestTokenForPasskey({authSession:t,credential:u,realm:o,organization:r,scope:i,audience:s})}}function Qc(e){const t=new Uint8Array(e),n=Array.from(t,e=>String.fromCharCode(e)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function $c(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t+"=".repeat((4-t.length%4)%4),o=atob(n),r=new Uint8Array(o.length);for(let e=0;e<o.length;e++)r[e]=o.charCodeAt(e);return r.buffer}function eu(e){return Object.assign(Object.assign({},e),{challenge:$c(e.challenge),user:Object.assign(Object.assign({},e.user),{id:$c(e.user.id)}),pubKeyCredParams:e.pubKeyCredParams,authenticatorSelection:e.authenticatorSelection})}function tu(e){return Object.assign(Object.assign({},e),{challenge:$c(e.challenge)})}function nu(e){var t;const n=e.response;return{id:e.id,rawId:Qc(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Qc(n.clientDataJSON),attestationObject:Qc(n.attestationObject)},clientExtensionResults:e.getClientExtensionResults()}}function ou(e){var t;const n=e.response;return{id:e.id,rawId:Qc(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Qc(n.clientDataJSON),authenticatorData:Qc(n.authenticatorData),signature:Qc(n.signature),userHandle:n.userHandle?Qc(n.userHandle):void 0},clientExtensionResults:e.getClientExtensionResults()}}function ru(e){return{get(){try{const t=window.localStorage.getItem(e);return t?JSON.parse(t):null}catch(e){return null}},set(t){try{window.localStorage.setItem(e,JSON.stringify(t))}catch(e){}},remove(){try{window.localStorage.removeItem(e)}catch(e){}}}}function iu(){let e=null;return{get:()=>e,set:t=>{e=t},remove:()=>{e=null}}}Kc=new WeakMap,zc=new WeakMap;class su{constructor(e,t){this.slots=new Map,this.baseKey="".concat("@@auth0spajs@@","::").concat(e,"::anonymous"),this.useLocalStorage="localStorage"===t&&"undefined"!=typeof window&&!!window.localStorage,this.sessionKey="".concat(this.baseKey,"::").concat("session"),this.sessionStore=this.useLocalStorage?ru(this.sessionKey):iu()}getStore(e,t){const n="".concat(this.baseKey,"::").concat(JSON.stringify([null!=e?e:"",null!=t?t:""]));return this.slots.has(n)||this.slots.set(n,this.useLocalStorage?ru(n):iu()),this.slots.get(n)}getSessionToken(){return this.sessionStore.get()}setSessionToken(e){this.sessionStore.set(e)}removeAll(){if(this.sessionStore.remove(),this.slots.forEach(e=>e.remove()),this.slots.clear(),this.useLocalStorage)try{const e=this.baseKey+"::",t=[];for(let n=0;n<window.localStorage.length;n++){const o=window.localStorage.key(n);(null==o?void 0:o.startsWith(e))&&t.push(o)}t.forEach(e=>window.localStorage.removeItem(e))}catch(e){}}}class au{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"localStorage",o=arguments.length>3?arguments[3]:void 0;this.authJsClient=e,this.clientId=t,this.cache=new su(t,n),this.lockManager=null!=o?o:ve()}async createSession(e){const t=await this.authJsClient.createSession(e);return this.cache.setSessionToken(Object.assign({sessionToken:t.sessionToken},void 0!==t.sessionTokenExpiresAt&&{sessionTokenExpiresAt:t.sessionTokenExpiresAt})),this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:t.accessToken,expiresAt:t.expiresAt},void 0!==t.scope&&{scope:t.scope})),t}async getTokenSilently(e){const t=this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope),n=t.get();return n&&n.expiresAt-60>Date.now()/1e3?n:this.lockManager.runWithLock("anonymous::".concat(this.clientId),5e3,async()=>{var n;const o=t.get();if(o&&o.expiresAt-60>Date.now()/1e3)return o;const r=null===(n=this.cache.getSessionToken())||void 0===n?void 0:n.sessionToken,i=await this.authJsClient.getAccessToken(Object.assign(Object.assign({},e),{sessionToken:r}));return this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})),!i.sessionReplaced&&this.cache.getSessionToken()||this.cache.setSessionToken(Object.assign({sessionToken:i.sessionToken},void 0!==i.sessionTokenExpiresAt&&{sessionTokenExpiresAt:i.sessionTokenExpiresAt})),Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})})}async logout(){await this.authJsClient.logout(),this.cache.removeAll()}hasSession(){var e;return!!(null===(e=this.cache.getSessionToken())||void 0===e?void 0:e.sessionToken)}getClaims(){return null}}class cu{resolveOnlineAccess(e){if("online"!==e.refreshTokenMode)return!1;if(!0!==e.useRefreshTokens)throw new M('`refreshTokenMode: "online"` requires the refresh-token grant.',"Set `useRefreshTokens: true`.");if(!0!==e.useDpop)throw new M('`refreshTokenMode: "online"` requires DPoP, which is missing or disabled.',"Set `useDpop: true` (DPoP is mandatory for online access).");return!0}warnEnterpriseConnectConfig(e){var t,n;if(!0!==e.enterpriseConnect)return;const o=null===(t=e.authorizationParams)||void 0===t?void 0:t.scope;(!0===e.useRefreshTokens||"string"==typeof o&&o.includes("offline_access"))&&console.warn("Enterprise Connect issues no refresh token; `useRefreshTokens` and `offline_access` in `scope` have no effect."),(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)&&console.warn("Enterprise Connect resolves the organization from the email domain (Home Realm Discovery); a static `organization` breaks multi-customer setups.")}constructor(e){let t,n;if(this.userCache=(new Ge).enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0,refreshTokenMode:"offline",anonymousSessionsCacheMode:"localStorage"},this.onlineAccess=this.resolveOnlineAccess(e),this.warnEnterpriseConnectConfig(e),this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!V())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===V().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),this.lockManager=ve(),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||A,!ht(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=ht(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:C,this.cookieStorage=!1===e.legacySameSiteCookie?ot:it,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieName=(e=>"auth0.".concat(e,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const r=e.useCookiesForTransactions?this.cookieStorage:st;let i="";var s;this.onlineAccess?i=x:this.options.useRefreshTokens&&(i="offline_access"),this.scope=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if("object"!=typeof e)return{[j]:ze(t,e,...o)};let i={[j]:ze(t,...o)};return Object.keys(e).forEach(n=>{const r=e[n];i[n]=ze(t,r,...o)}),i}(this.options.authorizationParams.scope,"openid",i),this.transactionManager=new Xe(r,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||O,this.cacheManager=new Ve(n,n.allKeys?void 0:new ut(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new yt(this.options.clientId):void 0,this.domainUrl=(s=this.options.domain,/^https?:\/\//.test(s)?s:"https://".concat(s)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);const a="".concat(this.domainUrl,"/me/"),c=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:a},detailedResponse:!0})}}));this.myAccount=new vt(c,a),this.authJsClient=new Pc({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new qc(this.authJsClient.mfa,this),this.anonymous=new au(this.authJsClient.anonymous,this.options.clientId,this.options.anonymousSessionsCacheMode,this.lockManager),this.passkey=new Bc(this.authJsClient.passkey,this),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&t===A&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new ct,this.worker.postMessage({type:"init",allowedBaseUrl:this.domainUrl}))}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const t=this.options.auth0Client||I,n=B(t,!0),o=encodeURIComponent(btoa(JSON.stringify(n)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(o)}_authorizeUrl(e){return this._url("/authorize?".concat(Q(e)))}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),n=S(t,3),o=n[0],r=n[1],i=n[2];if(3!==t.length||!o||!r||!i)throw new Error("ID token could not be decoded");const s=JSON.parse(ee(r)),a={__raw:e},c={};return Object.keys(s).forEach(e=>{a[e]=s[e],Ye.includes(e)||(c[e]=s[e])}),{encoded:{header:o,payload:r,signature:i},header:JSON.parse(ee(o)),claims:a,user:c}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&!qe(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!qe(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!qe(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(t.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(null!=t.claims.nbf&&qe(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(e))}if(null!=t.claims.auth_time&&qe(t.claims.auth_time)){const r=new Date(0);if(r.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>r)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(r))}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_id,'"'))}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(r=this.options.authorizationParams.max_age,"string"!=typeof r?r:parseInt(r,10)||void 0),now:o});var r}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}_extractSessionTransferToken(e){return new URLSearchParams(window.location.search).get(e)||void 0}_clearSessionTransferTokenFromUrl(e){try{const t=new URL(window.location.href);t.searchParams.has(e)&&(t.searchParams.delete(e),window.history.replaceState({},"",t.toString()))}catch(e){}}_applySessionTransferToken(e){const t=this.options.sessionTransferTokenQueryParamName;if(!t||e.session_transfer_token)return e;const n=this._extractSessionTransferToken(t);return n?(this._clearSessionTransferTokenFromUrl(t),Object.assign(Object.assign({},e),{session_transfer_token:n})):e}async _prepareAuthorizeUrl(e,t,n){var o;const r=q(X()),i=q(X()),s=X(),a=await $(s),c=te(a),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),l=((e,t,n,o,r,i,s,a,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:Je(t,n.scope,n.audience),response_type:"code",response_mode:a||"query",state:o,nonce:r,redirect_uri:s||e.authorizationParams.redirect_uri,code_challenge:i,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,r,i,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),d=this._authorizeUrl(l);return{nonce:i,code_verifier:s,scope:l.scope,audience:l.audience||j,redirect_uri:l.redirect_uri,state:r,url:d}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup","left=".concat(e,",top=").concat(t,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(),!t.popup))throw new J;const o=this._applySessionTransferToken(e.authorizationParams||{}),r=await this._prepareAuthorizeUrl(o,{response_mode:"web_message"},window.location.origin);t.popup.location.href=r.url;const i=await((e,t)=>new Promise((n,o)=>{let r;const i=setInterval(()=>{e.popup&&e.popup.closed&&(clearInterval(i),clearTimeout(s),window.removeEventListener("message",r,!1),o(new z(e.popup)))},1e3),s=setTimeout(()=>{clearInterval(i),o(new K(e.popup)),window.removeEventListener("message",r,!1)},1e3*(e.timeoutInSeconds||60));r=function(a){if(a.origin===t&&a.data&&"authorization_response"===a.data.type){if(clearTimeout(s),clearInterval(i),window.removeEventListener("message",r,!1),!1!==e.closePopup&&e.popup.close(),a.data.response.error)return o(W.fromPayload(a.data.response));n(a.data.response)}},window.addEventListener("message",r)}))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}),new URL(r.url).origin);if(r.state!==i.state)throw new W("state_mismatch","Invalid state");const s=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:r.audience,scope:r.scope,code_verifier:r.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:r.redirect_uri},{nonceIn:r.nonce,organization:s})}async getUser(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(){var t;const n=pt(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),o=n.openUrl,r=n.fragment,i=n.appState,s=a(n,["openUrl","fragment","appState"]),c=(null===(t=s.authorizationParams)||void 0===t?void 0:t.organization)||this.options.authorizationParams.organization,u=this._applySessionTransferToken(s.authorizationParams||{}),l=await this._prepareAuthorizeUrl(u),d=l.url,h=a(l,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},h),{appState:i,response_type:e.ResponseType.Code}),c&&{organization:c}));const p=r?"".concat(d,"#").concat(r):d;o?await o(p):window.location.assign(p)}async handleRedirectCallback(){const t=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===t.length)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new W("missing_transaction","Invalid state");this.transactionManager.remove();const o=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(t.join(""));return n.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(t,n){const o=t.code,r=t.state,i=t.error,s=t.error_description;if(i)throw new N(i,s||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new W("state_mismatch","Invalid state");const a=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:a}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const o=t.connect_code,r=t.state,i=t.error,s=t.error_description;if(i)throw new U(i,s||i,n.connection,r,n.appState);if(!o)throw new W("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new W("state_mismatch","Invalid state");const a=await this.myAccount.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},a),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async _maybeCreateAnonymousSession(){if(this.options.createAnonymousSessionOnFailedSilentAuth){if(this.anonymous.hasSession())return;try{await this.anonymous.getTokenSilently()}catch(e){console.debug("[auth0-spa-js] Anonymous session creation failed",e)}}}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get(lt))return void await this._maybeCreateAnonymousSession();this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(lt)}try{await this.getTokenSilently(e)}catch(e){e instanceof W&&"login_required"===e.error&&e.error_description!==R&&await this._maybeCreateAnonymousSession()}}async getTokenSilently(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Je(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),r=await this._getTokenSilently(o);return e.detailedResponse?r:null==r?void 0:r.access_token}async _getTokenSilently(e){const t=e.cacheMode,n=a(e,["cacheMode"]);if(await this._isSessionCeilingReached())return;if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||j,clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=(r=this.options.clientId,i=n.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(r,".").concat(i));var r,i;try{return await this.lockManager.runWithLock(o,5e3,async()=>{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||j,clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),o=e.id_token,r=e.token_type,i=e.access_token,s=e.oauthTokenScope,a=e.expires_in;return Object.assign(Object.assign({id_token:o,token_type:r,access_token:i},s?{scope:s}:null),{expires_in:a})})}catch(e){if(this._isInteractiveError(e)&&"popup"===this.options.interactiveErrorHandler)return await this._handleInteractiveErrorWithPopup(n);throw e}}_isInteractiveError(e){return e instanceof D||e instanceof W&&this._isIframeMfaError(e)}_isIframeMfaError(e){return"login_required"===e.error&&e.error_description===R}async _handleInteractiveErrorWithPopup(e){try{await this.loginWithPopup({authorizationParams:e.authorizationParams});const t=await this._getEntryFromCache({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||j,clientId:this.options.clientId});if(!t)throw new W("interactive_handler_cache_miss","Token not found in cache after interactive authentication");return t}catch(e){throw e}}async getTokenWithPopup(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};var n,o;const r=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Je(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},P),t),await this.loginWithPopup(r,t),(await this.cacheManager.get(new He({scope:r.authorizationParams.scope,audience:r.authorizationParams.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},n=t.federated,o=a(t,["federated"]),r=n?"&federated":"";return this._url("/v2/logout?".concat(Q(Object.assign({clientId:e.clientId},o))))+r}async revokeRefreshToken(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!this.options.useRefreshTokens)return;const t=e.audience||this.options.authorizationParams.audience||j,n=await this.cacheManager.getRefreshTokensByAudience(t,this.options.clientId);await async function(e,t){let n=e.auth0Client,o=e.useFormData,r=e.refreshTokens,i=e.audience,s=e.client_id,a=e.onRefreshTokenRevoked;const c=e.timeout||C,u="refresh_token",l="".concat(e.baseUrl,"/oauth/revoke"),d={"Content-Type":o?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(B(n||I)))};if(t){const n={client_id:s,token_type_hint:u},r=o?Q(n):JSON.stringify(n);try{return await Me({type:"revoke",timeout:c,fetchUrl:l,fetchOptions:{method:"POST",body:r,headers:d},useFormData:o,auth:{audience:null!=i?i:j}},t)}catch(e){throw new W("revoke_error",e.message)}}for(const t of r){const n={client_id:s,token_type_hint:u,token:t},r=o?Q(n):JSON.stringify(n),i=await Ne(l,{method:"POST",body:r,headers:d},c);if(!i.ok){let t,n;try{var h=JSON.parse(await i.text());t=h.error,n=h.error_description}catch(e){}throw new W(t||"revoke_error",n||"HTTP error ".concat(i.status))}await(null==a?void 0:a(t))}}({baseUrl:this.domainUrl,timeout:this.httpTimeoutMs,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,client_id:this.options.clientId,refreshTokens:n,audience:t,onRefreshTokenRevoked:e=>this.cacheManager.stripRefreshToken(e)},this.worker),this.onlineAccess&&await this._clearLocalSession()}async logout(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t;this.options.enterpriseConnect&&!0!==(null===(t=e.logoutParams)||void 0===t?void 0:t.federated)&&console.warn("Enterprise Connect logout without `federated: true` leaves the enterprise IdP session alive; the next login may silently reuse the previous user.");const n=pt(e),o=n.openUrl,r=a(n,["openUrl"]);await this._clearLocalSession(e.clientId);const i=this._buildLogoutUrl(r);o?await o(i):!1!==o&&window.location.assign(i)}async _getTokenFromIFrame(e){const t=(n=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(n));var n;try{return await this.lockManager.runWithLock(t,5e3,async()=>{const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const o=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin),r=o.url,i=o.state,s=o.nonce,a=o.code_verifier,c=o.redirect_uri,u=o.scope,l=o.audience;if(window.crossOriginIsolated)throw new W("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const d=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let h;try{h=new URL(this.domainUrl).origin}catch(e){h=this.domainUrl}const p=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise((o,r)=>{const i=window.document.createElement("iframe");i.setAttribute("width","0"),i.setAttribute("height","0"),i.style.display="none";const s=()=>{window.document.body.contains(i)&&(window.document.body.removeChild(i),window.removeEventListener("message",a,!1))};let a;const c=setTimeout(()=>{r(new L),s()},1e3*n);a=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?r(W.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",a,!1),setTimeout(s,2e3)},window.addEventListener("message",a,!1),window.document.body.appendChild(i),i.setAttribute("src",e)})}(r,h,d);if(i!==p.state)throw new W("state_mismatch","Invalid state");const f=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:a,code:p.code,grant_type:"authorization_code",redirect_uri:c,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:s,organization:t.organization});return Object.assign(Object.assign({},f),{scope:u,oauthTokenScope:f.scope,audience:l})})}catch(e){throw"login_required"===e.error&&(e instanceof W&&this._isIframeMfaError(e)&&"popup"===this.options.interactiveErrorHandler||this.logout({openUrl:!1})),e}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new He({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new Z(e.authorizationParams.audience||j,e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,r=((e,t,n,o)=>{var r;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),i=(null===(r=t.scope)||void 0===r?void 0:r.split(" "))||[],s=i.every(t=>e.includes(t));return e.length>=i.length&&s?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:r});if(await this._propagateRotatedRefreshToken(null==t?void 0:t.refresh_token,u.refresh_token),this.options.useMrrt&&(i=null==t?void 0:t.audience,s=null==t?void 0:t.scope,a=e.authorizationParams.audience,c=e.authorizationParams.scope,i!==a||!((e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every(e=>n.includes(e))})(c,s))){const t=((e,t,n)=>{const o=(null==e?void 0:e.split(" "))||[],r=n?o.filter(e=>e!==x):o,i=(null==t?void 0:t.split(" "))||[];return r.filter(e=>-1==i.indexOf(e)).join(",")})(r,u.scope,this.onlineAccess);if(t){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope),new H(e.authorizationParams.audience||"default",t)}}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||j})}catch(t){if(t.message){if(t.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),t;if((t.message.includes("Missing Refresh Token")||t.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw t}var i,s,a,c}async _propagateRotatedRefreshToken(e,t){!this.onlineAccess&&t&&e&&await this.cacheManager.updateEntry(e,t,this.options.clientId,this.options.useMrrt)}async _saveEntryInCache(e){const t=e.decodedToken.claims,n=t.session_expiry,o=t.iat;if(void 0!==n){if("number"!=typeof n)throw new W("invalid_token","Invalid session_expiry: value must be a number.");if(n>=1e10)throw new W("invalid_token","Invalid session_expiry: value appears to be in milliseconds; expected a Unix timestamp in seconds.");if(void 0===o||n<=o)throw new W("invalid_token","Invalid session_expiry: session ceiling is before or at the token issue time.")}const r=e.id_token,i=e.decodedToken,s=a(e,["id_token","decodedToken"]);this.userCache.set(Ze,{id_token:r,decodedToken:i}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(s)}async _clearLocalSession(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:this.options.clientId;var t;null===e?await this.cacheManager.clear():await this.cacheManager.clear(e),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove(Ze);try{await(null===(t=this.dpop)||void 0===t?void 0:t.clear())}catch(e){}if(this.worker)try{await Me({type:"clear"},this.worker)}catch(e){}}async _isSessionCeilingReached(){var e,t;const n=this.userCache.get(Ze),o=null!=n?n:await this.cacheManager.getIdToken(new He({clientId:this.options.clientId})),r=null===(t=null===(e=null==o?void 0:o.decodedToken)||void 0===e?void 0:e.claims)||void 0===t?void 0:t.session_expiry;if(void 0===r)return!1;const i=await this.nowProvider();return Math.floor(i/1e3)>=r-30&&(await this._clearLocalSession(),!0)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||j,t=this.scope[e],n=await this.cacheManager.getIdToken(new He({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get(Ze);return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set(Ze,n),n)}async _getEntryFromCache(e){let t=e.scope,n=e.audience,o=e.clientId,r=e.cacheMode;const i=await this.cacheManager.get(new He({scope:t,audience:n,clientId:o}),60,this.options.useMrrt,r);if(i&&i.access_token){const e=i.token_type,t=i.access_token,n=i.oauthTokenScope,o=i.expires_in,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}_storeMfaContext(e,t,n){e instanceof D&&this.mfa.setMFAAuthDetails(e.mfa_token,t,n,e.mfa_requirements)}async _requestToken(e,t){var n,o,r,i,s,a;const c=t||{},u=c.nonceIn,l=c.organization,d=c.scopesToRequest;try{const t=await Ke(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop,preserveRefreshToken:this.onlineAccess},e),{scope:d||e.scope}),this.worker);let c=await this._verifyIdToken(t.id_token,u,l);if("authorization_code"===e.grant_type){const e=await this._getIdTokenFromCache();(null===(o=null===(n=null==e?void 0:e.decodedToken)||void 0===n?void 0:n.claims)||void 0===o?void 0:o.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove(Ze))}if("authorization_code"!==e.grant_type){const e=await this._getIdTokenFromCache(),t=null===(i=null===(r=null==e?void 0:e.decodedToken)||void 0===r?void 0:r.claims)||void 0===i?void 0:i.session_expiry;void 0!==t&&(c=Object.assign(Object.assign({},c),{claims:Object.assign(Object.assign({},c.claims),{session_expiry:t})}))}return!t.refresh_token&&this.onlineAccess&&(t.refresh_token=null!==(s=e.refresh_token)&&void 0!==s?s:null===(a=await this.cacheManager.get(new He({scope:d||e.scope,audience:e.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt))||void 0===a?void 0:a.refresh_token),await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},t),{decodedToken:c,scope:e.scope,audience:e.audience||j}),t.scope?{oauthTokenScope:t.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(l||c.claims.org_id),Object.assign(Object.assign({},t),{decodedToken:c})}catch(t){throw"authorization_code"!==e.grant_type&&this._storeMfaContext(t,d||e.scope,e.audience),t}}_buildTokenExchangeParams(e){return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type}),e.actor_token&&{actor_token:e.actor_token}),e.actor_token_type&&{actor_token_type:e.actor_token_type}),{scope:Je(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}async loginWithCustomTokenExchange(e){return this._requestToken(this._buildTokenExchangeParams(e))}async customTokenExchange(e){const t=this._buildTokenExchangeParams(e);try{const n=await Ke(Object.assign(Object.assign({},t),{baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,dpop:this.dpop}),this.worker,!0);return n.id_token&&await this._verifyIdToken(n.id_token,void 0,e.organization),n}catch(e){throw this._storeMfaContext(e,t.scope,t.audience),e}}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new gt(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const n=t.openUrl,o=t.appState,r=t.connection,i=t.scopes,s=t.authorization_params,a=t.redirectUri,c=void 0===a?this.options.authorizationParams.redirect_uri||window.location.origin:a;if(!r)throw new Error("connection is required");const u=q(X()),l=X(),d=await $(l),h=te(d),p=await this.myAccount.connectAccount({connection:r,scopes:i,redirect_uri:c,state:u,code_challenge:h,code_challenge_method:"S256",authorization_params:s}),f=p.connect_uri,m=p.connect_params,y=p.auth_session;this.transactionManager.create({state:u,code_verifier:l,auth_session:y,redirect_uri:c,appState:o,connection:r,response_type:e.ResponseType.ConnectCode});const w=new URL(f);w.searchParams.set("ticket",m.ticket),n?await n(w.toString()):window.location.assign(w)}async _requestTokenForPasskey(e){const t=e.audience||this.options.authorizationParams.audience,n=e.organization||this.options.authorizationParams.organization;return this._requestToken(Object.assign(Object.assign(Object.assign({grant_type:"urn:okta:params:oauth:grant-type:webauthn",auth_session:e.authSession,authn_response:e.credential},e.realm&&{realm:e.realm}),n&&{organization:n}),{scope:Je(this.scope,e.scope,t),audience:t}))}async _requestTokenForMfa(e,t){const n=e.mfaToken,o=a(e,["mfaToken"]),r=await this.cacheManager.get(new He({scope:o.scope,audience:o.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt),i=await this._requestToken(Object.assign(Object.assign({},o),{mfa_token:n}),t);return await this._propagateRotatedRefreshToken(null==r?void 0:r.refresh_token,i.refresh_token),i}}var uu={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},lu=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},du=o(o({},uu),{buildAuthorizeUrl:lu,buildLogoutUrl:lu,getAccessTokenSilently:lu,getAccessTokenWithPopup:lu,getIdTokenClaims:lu,loginWithCustomTokenExchange:lu,customTokenExchange:lu,exchangeToken:lu,loginWithRedirect:lu,loginWithPopup:lu,connectAccountWithRedirect:lu,logout:lu,revokeRefreshToken:lu,handleRedirectCallback:lu,getDpopNonce:lu,setDpopNonce:lu,generateDpopProof:lu,createFetcher:lu,getConfiguration:lu,mfa:{getAuthenticators:lu,enroll:lu,challenge:lu,verify:lu,getEnrollmentFactors:lu},passkey:{signup:lu,login:lu},myAccount:{getFactors:lu,getAuthenticationMethods:lu,getAuthenticationMethod:lu,updateAuthenticationMethod:lu,deleteAuthenticationMethod:lu,enrollmentChallenge:lu,enrollmentVerify:lu},anonymous:{createSession:lu,getTokenSilently:lu,logout:lu,hasSession:lu,getClaims:lu}}),hu=t.createContext(du),pu=function(e){function t(n,o){var r=e.call(this,null!=o?o:n)||this;return r.error=n,r.error_description=o,Object.setPrototypeOf(r,t.prototype),r}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),fu=/[?&](?:connect_)?code=[^&]+/,mu=/[?&]state=[^&]+/,yu=/[?&]error=[^&]+/,wu=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new pu(n.error,n.error_description)}return new pu(t.error)}return new Error(e)}},gu=wu("Login failed"),vu=wu("Get access token failed"),bu=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},_u=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":case"SYNC_USER":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},ku=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},Su=function(){var e,t,n=new Promise(function(n,o){e=n,t=o});return n.catch(function(){}),{promise:n,resolve:e,reject:t}},Tu=function(e){return void 0===e&&(e=hu),t.useContext(e)},Eu=function(){return t.createElement(t.Fragment,null)},Pu=function(){return i(void 0,void 0,void 0,function(){return s(this,function(e){return[2]})})},Cu=function(){var e=window.location.pathname.replace(/^\/\/+/,"/");return"".concat(e).concat(window.location.search)};e.AnonymousSessionError=cc,e.Auth0Context=hu,e.Auth0Provider=function(n){var a=n,c=a.children,u=a.skipRedirectCallback,l=a.onRedirectCallback,d=void 0===l?ku:l,h=a.context,p=void 0===h?hu:h,f=a.client,m=r(a,["children","skipRedirectCallback","onRedirectCallback","context","client"]);f&&(m.domain||m.clientId)&&console.warn("Auth0Provider: the `client` prop takes precedence over `domain`/`clientId` and other configuration options. Remove `domain`, `clientId`, and any other Auth0Client configuration props when using the `client` prop.");var y=t.useState(function(){return null!=f?f:new cu(function(e){return bu(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.27.0"}})}(m))})[0],w=t.useReducer(_u,uu),g=w[0],v=w[1],b=t.useState(Su),_=b[0],k=b[1],S=t.useState(!1),T=S[0],E=S[1],P=t.useRef(!1),C=t.useRef(!1),A=t.useCallback(function(e){return v({type:"ERROR",error:e}),e},[]),R=t.useCallback(function(t,n){return i(void 0,void 0,void 0,function(){var o,i,a,c,l,h,p,f;return s(this,function(s){switch(s.label){case 0:return s.trys.push([0,7,,8]),o=void 0,n&&(void 0===m&&(m=window.location.search),(fu.test(m)||yu.test(m))&&mu.test(m))&&!u?[4,y.handleRedirectCallback()]:[3,3];case 1:return i=s.sent(),a=i.appState,c=void 0===a?{}:a,l=i.response_type,h=r(i,["appState","response_type"]),[4,y.getUser()];case 2:return o=s.sent(),c.response_type=l,l===e.ResponseType.ConnectCode&&(c.connectedAccount=h),d(c,o),[3,6];case 3:return[4,y.checkSession()];case 4:return s.sent(),[4,y.getUser()];case 5:o=s.sent(),s.label=6;case 6:return v({type:"INITIALISED",user:o}),t.resolve(),[3,8];case 7:return p=s.sent(),f=gu(p),A(f),E(!0),t.reject(f),[3,8];case 8:return[2]}var m})})},[y,d,u,A]);t.useEffect(function(){C.current||(C.current=!0,R(_,!0))},[R,_]),t.useEffect(function(){if(T&&!P.current&&g.isAuthenticated){P.current=!0;var e=Su();k(e),R(e,!1)}},[T,g.isAuthenticated,R]);var x=t.useCallback(function(e){return bu(e),y.loginWithRedirect(e)},[y]),I=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o;return s(this,function(r){switch(r.label){case 0:v({type:"LOGIN_POPUP_STARTED"}),r.label=1;case 1:return r.trys.push([1,3,,4]),[4,y.loginWithPopup(e,t)];case 2:return r.sent(),[3,4];case 3:return n=r.sent(),A(gu(n)),[2];case 4:return[4,y.getUser()];case 5:return o=r.sent(),v({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}})})},[y,A]),O=t.useCallback(function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return i(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,r=0,i=t.length;r<i;r++)!o&&r in t||(o||(o=Array.prototype.slice.call(t,0,r)),o[r]=t[r]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,function(e){return void 0===e&&(e={}),s(this,function(t){switch(t.label){case 0:return[4,y.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&v({type:"LOGOUT"}),[2]}})})},[y]),j=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n;return s(this,function(o){switch(o.label){case 0:return o.trys.push([0,,2,4]),[4,y.revokeRefreshToken(e)];case 1:return o.sent(),[3,4];case 2:return t=v,n={type:"SYNC_USER"},[4,y.getUser()];case 3:return t.apply(void 0,[(n.user=o.sent(),n)]),[7];case 4:return[2]}})})},[y]),W=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.getTokenSilently(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),M=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o,r,i;return s(this,function(s){switch(s.label){case 0:return s.trys.push([0,2,3,5]),[4,y.getTokenWithPopup(e,t)];case 1:return n=s.sent(),[3,5];case 2:throw o=s.sent(),vu(o);case 3:return r=v,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return r.apply(void 0,[(i.user=s.sent(),i)]),[7];case 5:return[2,n]}})})},[y]),N=t.useCallback(function(e){return y.connectAccountWithRedirect(e)},[y]),U=t.useCallback(function(){return y.getIdTokenClaims()},[y]),L=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.loginWithCustomTokenExchange(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),K=t.useCallback(function(e){return y.customTokenExchange(e)},[y]),z=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){return s(this,function(t){return[2,L(e)]})})},[L]),J=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o;return s(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,y.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw t=r.sent(),vu(t);case 3:return n=v,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,y.getUser()];case 4:return n.apply(void 0,[(o.user=r.sent(),o)]),[7];case 5:return[2]}})})},[y]),D=t.useCallback(function(e){return y.getDpopNonce(e)},[y]),Z=t.useCallback(function(e,t){return y.setDpopNonce(e,t)},[y]),H=t.useCallback(function(e){return y.generateDpopProof(e)},[y]),F=t.useCallback(function(e){return y.createFetcher(e)},[y]),G=t.useCallback(function(){return y.getConfiguration()},[y]),V=t.useMemo(function(){return y.mfa},[y]),X=t.useMemo(function(){return y.myAccount},[y]),q=t.useMemo(function(){return y.anonymous},[y]),Y=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.signup(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),B=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.login(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),Q=t.useMemo(function(){return{signup:Y,login:B}},[Y,B]),$=t.useMemo(function(){return o(o({},g),{getAccessTokenSilently:W,getAccessTokenWithPopup:M,getIdTokenClaims:U,loginWithCustomTokenExchange:L,customTokenExchange:K,exchangeToken:z,loginWithRedirect:x,loginWithPopup:I,connectAccountWithRedirect:N,logout:O,revokeRefreshToken:j,handleRedirectCallback:J,getDpopNonce:D,setDpopNonce:Z,generateDpopProof:H,createFetcher:F,getConfiguration:G,mfa:V,passkey:Q,myAccount:X,anonymous:q,_initPromise:_.promise})},[g,W,M,U,L,K,z,x,I,N,O,j,J,D,Z,H,F,G,V,Q,X,q,_]);return t.createElement(p.Provider,{value:$},c)},e.AuthenticationError=N,e.ConnectError=U,e.GenericError=W,e.InMemoryCache=Ge,e.InvalidConfigurationError=M,e.LocalStorageCache=Fe,e.MfaChallengeError=Fc,e.MfaEnrollmentError=Hc,e.MfaEnrollmentFactorsError=Vc,e.MfaError=Dc,e.MfaListAuthenticatorsError=Zc,e.MfaRequiredError=D,e.MfaVerifyError=Gc,e.MissingRefreshTokenError=Z,e.MissingScopesError=H,e.MyAccountApiError=bt,e.OAuthError=pu,e.PasskeyChallengeError=Ua,e.PasskeyError=Yc,e.PasskeyGetTokenError=La,e.PasskeyRegisterError=Na,e.PopupCancelledError=z,e.PopupOpenError=J,e.PopupTimeoutError=K,e.RefreshTokenMode={Offline:"offline",Online:"online"},e.TimeoutError=L,e.UseDpopNonceError=F,e.User=class{},e.initialContext=du,e.useAuth0=Tu,e.useAuth0Suspense=function(e){if(void 0===e&&(e=hu),"function"!=typeof t.use)throw new Error("useAuth0Suspense requires React 19 or later (React.use is unavailable).");var n=t.useContext(e);if(!n._initPromise)throw new Error("useAuth0Suspense must be used within an <Auth0Provider>.");return t.use(n._initPromise),t.useMemo(function(){return n.isLoading,n._initPromise,r(n,["isLoading","_initPromise"])},[n])},e.useEnterpriseConnect=function(e){void 0===e&&(e=hu);var n=t.useContext(e),r=n.getConfiguration,i=n.loginWithRedirect,s=t.useCallback(function(e,t){return function(e,t,n){var o;return async function(e,t,n){const o=t.toLowerCase(),r=e.replace(/^https?:\/\//,""),i="".concat(r,"|").concat(o),s=Jc.get(i);if(void 0!==s)return s;try{var a;const e=new URL("https://".concat(r,"/.well-known/webfinger"));e.searchParams.set("resource","urn:auth0:discovery:domain:".concat(o)),e.searchParams.set("rel","http://openid.net/specs/connect/1.0/issuer");let t=null!==(a=null==n?void 0:n.customFetch)&&void 0!==a?a:globalThis.fetch;null!=n&&n.telemetry&&!1!==n.telemetry.enabled&&(t=Aa(t,n.telemetry));const s=await t(e.toString());return s.ok?(Jc.set(i,!0),!0):404===s.status?(Jc.set(i,!1,15e3),!1):429===s.status&&(console.warn("[Auth0] isFederatedDomain: rate limit hit (429)"),!1)}catch(e){return!1}}(e.replace(/^https?:\/\//i,"").toLowerCase(),t.toLowerCase(),Object.assign(Object.assign({},n),{telemetry:null!==(o=null==n?void 0:n.telemetry)&&void 0!==o?o:I}))}(r().domain,e,t)},[r]);return{isFederatedDomain:s,loginWithSSO:t.useCallback(function(e,t){return i(o(o({},t),{authorizationParams:o(o({},null==t?void 0:t.authorizationParams),{login_hint:e})}))},[i])}},e.withAuth0=function(e,n){return void 0===n&&(n=hu),function(r){return t.createElement(n.Consumer,null,function(n){return t.createElement(e,o({},r,{auth0:n}))})}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(r){var a=this,c=n.returnTo,u=void 0===c?Cu:c,l=n.onRedirecting,d=void 0===l?Eu:l,h=n.onBeforeAuthentication,p=void 0===h?Pu:h,f=n.loginOptions,m=n.context,y=Tu(void 0===m?hu:m),w=y.isAuthenticated,g=y.isLoading,v=y.loginWithRedirect;return t.useEffect(function(){if(!g&&!w){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});i(a,void 0,void 0,function(){return s(this,function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,v(e)];case 2:return t.sent(),[2]}})})}},[g,w,v,p,f,u]),w?t.createElement(e,o({},r)):d()}}});
1
+ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("react")):"function"==typeof define&&define.amd?define(["exports","react"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).reactAuth0={},e.React)}(this,function(e,t){"use strict";var n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])},n(e,t)};var o=function(){return o=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},o.apply(this,arguments)};function r(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function i(e,t,n,o){return new(n||(n=Promise))(function(r,i){function s(e){try{c(o.next(e))}catch(e){i(e)}}function a(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?r(e.value):(t=e.value,t instanceof n?t:new n(function(e){e(t)})).then(s,a)}c((o=o.apply(e,t||[])).next())})}function s(e,t){var n,o,r,i={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},s=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),"function"==typeof Symbol&&(s[Symbol.iterator]=function(){return this}),s;function a(a){return function(c){return function(a){if(n)throw new TypeError("Generator is already executing.");for(;s&&(s=0,a[0]&&(i=0)),i;)try{if(n=1,o&&(r=2&a[0]?o.return:a[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,a[1])).done)return r;switch(o=0,r&&(a=[2&a[0],r.value]),a[0]){case 0:case 1:r=a;break;case 4:return i.label++,{value:a[1],done:!1};case 5:i.label++,o=a[1],a=[0];continue;case 7:a=i.ops.pop(),i.trys.pop();continue;default:if(!(r=i.trys,(r=r.length>0&&r[r.length-1])||6!==a[0]&&2!==a[0])){i=0;continue}if(3===a[0]&&(!r||a[1]>r[0]&&a[1]<r[3])){i.label=a[1];break}if(6===a[0]&&i.label<r[1]){i.label=r[1],r=a;break}if(r&&i.label<r[2]){i.label=r[2],i.ops.push(a);break}r[2]&&i.ops.pop(),i.trys.pop();continue}a=t.call(e,i)}catch(e){a=[6,e],o=0}finally{n=r=0}if(5&a[0])throw a[1];return{value:a[0]?a[1]:void 0,done:!0}}([a,c])}}}function a(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o)&&t.indexOf(o)<0&&(n[o]=e[o]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var r=0;for(o=Object.getOwnPropertySymbols(e);r<o.length;r++)t.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(e,o[r])&&(n[o[r]]=e[o[r]])}return n}function c(e,t,n,o){if("a"===n&&!o)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!o:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?o:"a"===n?o.call(e):o?o.value:t.get(e)}function u(e,t,n,o,r){if("m"===o)throw new TypeError("Private method is not writable");if("a"===o&&!r)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!r:!t.has(e))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===o?r.call(e,n):r?r.value=n:t.set(e,n),n}function l(e,t){this.v=e,this.k=t}function d(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,o=Array(t);n<t;n++)o[n]=e[n];return o}function h(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function p(e){return new l(e,0)}function f(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function m(e,t){return e.get(h(e,t))}function y(e,t,n){f(e,t),t.set(e,n)}function w(e,t,n){return e.set(h(e,t),n),n}function g(e,t){f(e,t),t.add(e)}function v(e,t,n){return(t=function(e){var t=function(e){if("object"!=typeof e||!e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e);return"symbol"==typeof t?t:t+""}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function b(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,o)}return n}function _(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?b(Object(n),!0).forEach(function(t){v(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):b(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function k(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n={};for(var o in e)if({}.hasOwnProperty.call(e,o)){if(-1!==t.indexOf(o))continue;n[o]=e[o]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],-1===t.indexOf(n)&&{}.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}function S(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var o,r,i,s,a=[],c=!0,u=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;c=!1}else for(;!(c=(o=i.call(n)).done)&&(a.push(o.value),a.length!==t);c=!0);}catch(e){u=!0,r=e}finally{try{if(!c&&null!=n.return&&(s=n.return(),Object(s)!==s))return}finally{if(u)throw r}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return d(e,t);var n={}.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?d(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function T(e){return function(){return new E(e.apply(this,arguments))}}function E(e){var t,n;function o(t,n){try{var i=e[t](n),s=i.value,a=s instanceof l;Promise.resolve(a?s.v:s).then(function(n){if(a){var c="return"===t&&s.k?t:"next";if(!s.k||n.done)return o(c,n);n=e[c](n).value}r(!!i.done,n)},function(e){o("throw",e)})}catch(e){r(2,e)}}function r(e,r){2===e?t.reject(r):t.resolve({value:r,done:e}),(t=t.next)?o(t.key,t.arg):n=null}this._invoke=function(e,r){return new Promise(function(i,s){var a={key:e,arg:r,resolve:i,reject:s,next:null};n?n=n.next=a:(t=n=a,o(e,r))})},"function"!=typeof e.return&&(this.return=void 0)}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError,E.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},E.prototype.next=function(e){return this._invoke("next",e)},E.prototype.throw=function(e){return this._invoke("throw",e)},E.prototype.return=function(e){return this._invoke("return",e)};const C={timeoutInSeconds:60},P=1e4,A="memory",R="Multifactor authentication required",x="online_access",I={name:"auth0-spa-js",version:"2.28.2"},O=()=>Date.now(),j="default";class W extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,W.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new W(t,n)}}class M extends W{constructor(e,t){super("invalid_configuration","".concat(e," ").concat(t)),this.suggestion=t,Object.setPrototypeOf(this,M.prototype)}}class N extends W{constructor(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,N.prototype)}}class U extends W{constructor(e,t,n,o){let r=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=r,Object.setPrototypeOf(this,U.prototype)}}class L extends W{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,L.prototype)}}class K extends L{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,K.prototype)}}class z extends W{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,z.prototype)}}class J extends W{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,J.prototype)}}class D extends W{constructor(e,t,n,o){super(e,t),this.mfa_token=n,this.mfa_requirements=o,Object.setPrototypeOf(this,D.prototype)}}class Z extends W{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(G(e,["default"]),"', scope: '").concat(G(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,Z.prototype)}}class H extends W{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(G(e,["default"]),"', missing scope: '").concat(G(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,H.prototype)}}class F extends W{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,F.prototype)}}function G(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}const V=()=>window.crypto,X=()=>{let e="";for(;e.length<43;){const t=V().getRandomValues(new Uint8Array(43-e.length));for(const n of t)e.length<43&&n<198&&(e+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~."[n%66])}return e},q=e=>btoa(e),Y=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],B=function(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return Object.keys(e).reduce((n,o)=>{if(t&&"env"===o)return n;const r=Y.find(e=>e.key===o);return r&&r.type.includes(typeof e[o])&&(n[o]=e[o]),n},{})},Q=e=>{var t=e.clientId,n=a(e,["clientId"]);return new URLSearchParams((e=>Object.keys(e).filter(t=>void 0!==e[t]).reduce((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]}),{}))(Object.assign({client_id:t},n))).toString()},$=async e=>{const t=V().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},ee=e=>(e=>decodeURIComponent(atob(e).split("").map(e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)).join("")))(e.replace(/_/g,"/").replace(/-/g,"+")),te=e=>{const t=new Uint8Array(e);return(e=>{const t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,e=>t[e])})(window.btoa(String.fromCharCode(...Array.from(t))))};var ne="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},oe={},re={};Object.defineProperty(re,"__esModule",{value:!0});var ie=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);void 0===o?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var o=n.pop();e.locked.set(t,n),void 0!==o&&setTimeout(o,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();re.default=function(){return ie.getInstance()};var se=ne&&ne.__awaiter||function(e,t,n,o){return new(n||(n=Promise))(function(r,i){function s(e){try{c(o.next(e))}catch(e){i(e)}}function a(e){try{c(o.throw(e))}catch(e){i(e)}}function c(e){e.done?r(e.value):new n(function(t){t(e.value)}).then(s,a)}c((o=o.apply(e,t||[])).next())})},ae=ne&&ne.__generator||function(e,t){var n,o,r,i,s={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function a(i){return function(a){return function(i){if(n)throw new TypeError("Generator is already executing.");for(;s;)try{if(n=1,o&&(r=2&i[0]?o.return:i[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,i[1])).done)return r;switch(o=0,r&&(i=[2&i[0],r.value]),i[0]){case 0:case 1:r=i;break;case 4:return s.label++,{value:i[1],done:!1};case 5:s.label++,o=i[1],i=[0];continue;case 7:i=s.ops.pop(),s.trys.pop();continue;default:if(!((r=(r=s.trys).length>0&&r[r.length-1])||6!==i[0]&&2!==i[0])){s=0;continue}if(3===i[0]&&(!r||i[1]>r[0]&&i[1]<r[3])){s.label=i[1];break}if(6===i[0]&&s.label<r[1]){s.label=r[1],r=i;break}if(r&&s.label<r[2]){s.label=r[2],s.ops.push(i);break}r[2]&&s.ops.pop(),s.trys.pop();continue}i=t.call(e,s)}catch(e){i=[6,e],o=0}finally{n=r=0}if(5&i[0])throw i[1];return{value:i[0]?i[1]:void 0,done:!0}}([i,a])}}},ce=ne;Object.defineProperty(oe,"__esModule",{value:!0});var ue=re,le="browser-tabs-lock-key",de={key:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},getItem:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},clear:function(){return se(ce,void 0,void 0,function(){return ae(this,function(e){return[2,window.localStorage.clear()]})})},removeItem:function(e){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},setItem:function(e,t){return se(ce,void 0,void 0,function(){return ae(this,function(e){throw new Error("Unsupported")})})},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function he(e){return new Promise(function(t){return setTimeout(t,e)})}function pe(e){for(var t="",n=0;n<e;n++)t+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz"[Math.floor(61*Math.random())];return t}var fe=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+pe(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),se(this,void 0,void 0,function(){var o,r,i,s,a,c,u;return ae(this,function(l){switch(l.label){case 0:o=Date.now()+pe(4),r=Date.now()+n,i=le+"-"+t,s=void 0===this.storageHandler?de:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,he(30)]:[3,8];case 2:return l.sent(),null!==s.getItemSync(i)?[3,5]:(a=this.id+"-"+t+"-"+o,[4,he(Math.floor(25*Math.random()))]);case 3:return l.sent(),s.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:a,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,he(30)];case 4:return l.sent(),null!==(c=s.getItemSync(i))&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?de:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+pe(4),[3,1];case 8:return[2,!1]}})})},e.prototype.refreshLockWhileAcquired=function(e,t){return se(this,void 0,void 0,function(){var n=this;return ae(this,function(o){return setTimeout(function(){return se(n,void 0,void 0,function(){var n,o,r;return ae(this,function(i){switch(i.label){case 0:return[4,ue.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?(n=void 0===this.storageHandler?de:this.storageHandler,null===(o=n.getItemSync(e))?(ue.default().unlock(t),[2]):((r=JSON.parse(o)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(r)),ue.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(ue.default().unlock(t),[2])}})})},1e3),[2]})})},e.prototype.waitForSomethingToChange=function(t){return se(this,void 0,void 0,function(){return ae(this,function(n){switch(n.label){case 0:return[4,new Promise(function(n){var o=!1,r=Date.now(),i=!1;function s(){if(i||(window.removeEventListener("storage",s),e.removeFromWaiting(s),clearTimeout(a),i=!0),!o){o=!0;var t=50-(Date.now()-r);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",s),e.addToWaiting(s);var a=setTimeout(s,Math.max(0,t-Date.now()))})];case 1:return n.sent(),[2]}})})},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter(function(e){return e!==t}))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach(function(e){return e()})},e.prototype.releaseLock=function(e){return se(this,void 0,void 0,function(){return ae(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},e.prototype.releaseLock__private__=function(t){return se(this,void 0,void 0,function(){var n,o,r,i;return ae(this,function(s){switch(s.label){case 0:return n=void 0===this.storageHandler?de:this.storageHandler,o=le+"-"+t,null===(r=n.getItemSync(o))?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,ue.default().lock(i.iat)];case 1:s.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),ue.default().unlock(i.iat),e.notifyWaiters(),s.label=2;case 2:return[2]}})})},e.lockCorrector=function(t){for(var n=Date.now()-5e3,o=t,r=[],i=0;;){var s=o.keySync(i);if(null===s)break;r.push(s),i++}for(var a=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes(le)){var l=o.getItemSync(u);if(null!==l){var d=JSON.parse(l);(void 0===d.timeRefreshed&&d.timeAcquired<n||void 0!==d.timeRefreshed&&d.timeRefreshed<n)&&(o.removeItemSync(u),a=!0)}}}a&&e.notifyWaiters()},e.waiters=void 0,e}(),me=oe.default=fe;class ye{async runWithLock(e,t,n){const o=new AbortController,r=setTimeout(()=>o.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:o.signal},async e=>{if(clearTimeout(r),!e)throw new Error("Lock not available");return await n()})}catch(e){if(clearTimeout(r),"AbortError"===(null==e?void 0:e.name))throw new L;throw e}}}class we{constructor(){this.activeLocks=new Set,this.lock=new me,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}async runWithLock(e,t,n){let o=!1;for(let n=0;n<10&&!o;n++)o=await this.lock.acquireLock(e,t);if(!o)throw new L;this.activeLocks.add(e),1===this.activeLocks.size&&"undefined"!=typeof window&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),0===this.activeLocks.size&&"undefined"!=typeof window&&window.removeEventListener("pagehide",this.pagehideHandler)}}}let ge=null;function ve(){return ge||(ge=function(){return"undefined"!=typeof navigator&&"function"==typeof(null===(e=navigator.locks)||void 0===e?void 0:e.request)?new ye:new we;var e}()),ge}const be=new TextEncoder,_e=new TextDecoder;function ke(e){return"string"==typeof e?be.encode(e):_e.decode(e)}function Se(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new Pe(`${e.name} modulusLength must be at least 2048 bits`)}let Te;if(Uint8Array.prototype.toBase64)Te=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Te=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function Ee(e){return Te(e)}class Ce extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class Pe extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}function Ae(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new Ce("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"RSASSA-PKCS1-v1_5":return function(e){if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new Ce("unsupported RsaHashedKeyAlgorithm hash name")}(e);case"ECDSA":return function(e){if("P-256"===e.algorithm.namedCurve)return"ES256";throw new Ce("unsupported EcKeyAlgorithm namedCurve")}(e);case"Ed25519":return"Ed25519";default:throw new Ce("unsupported CryptoKey algorithm name")}}function Re(e){return e instanceof CryptoKey}function xe(e){return Re(e)&&"public"===e.type}async function Ie(e,t,n,o,r,i){const s=null==e?void 0:e.privateKey,a=null==e?void 0:e.publicKey;if(!Re(c=s)||"private"!==c.type)throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!xe(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==a.extractable)throw new TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw new TypeError('"htu" must be a string');if("string"!=typeof n)throw new TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw new TypeError('"nonce" must be a string or undefined');if(void 0!==r&&"string"!=typeof r)throw new TypeError('"accessToken" must be a string or undefined');if(void 0!==i&&("object"!=typeof i||null===i||Array.isArray(i)))throw new TypeError('"additional" must be an object');const u=Object.assign(Object.create(null),i,{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:r?Ee(await crypto.subtle.digest("SHA-256",ke(r))):void 0});return async function(e,t,n){if(!1===n.usages.includes("sign"))throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${Ee(ke(JSON.stringify(e)))}.${Ee(ke(JSON.stringify(t)))}`;return`${o}.${Ee(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Se(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Se(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new Ce}(n),n,ke(o)))}`}({alg:Ae(s),typ:"dpop+jwt",jwk:await Oe(a)},u,s)}async function Oe(e){const{kty:t,e:n,n:o,x:r,y:i,crv:s}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:s,e:n,n:o,x:r,y:i}}const je="dpop-nonce",We=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];const Me=(e,t)=>new Promise(function(n,o){const r=new MessageChannel;r.port1.onmessage=function(e){e.data.error?o(new Error(e.data.error)):n(e.data),r.port1.close()},t.postMessage(e,[r.port2])}),Ne=(e,t,n)=>{const o=new AbortController;let r;return t.signal=o.signal,Promise.race([fetch(e,t),new Promise((e,t)=>{r=setTimeout(()=>{o.abort(),t(new Error("Timeout when executing 'fetch'"))},n)})]).finally(()=>{clearTimeout(r)})},Ue=async function(e,t,n,o,r,i){let s=arguments.length>6&&void 0!==arguments[6]?arguments[6]:P;return r?(async(e,t,n,o,r,i,s,a,c,u)=>Me({type:"refresh",auth:{audience:t,scope:n},timeout:r,fetchUrl:e,fetchOptions:o,useFormData:s,useMrrt:a,skipTokenStorage:c,preserveRefreshToken:u},i))(e,t,n,o,s,r,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0,arguments.length>9?arguments[9]:void 0):(async(e,t,n)=>{const o=await Ne(e,t,n);return{ok:o.ok,json:await o.json(),headers:(r=o.headers,[...r].reduce((e,t)=>{let n=S(t,2),o=n[0],r=n[1];return e[o]=r,e},{}))};var r})(e,o,s)};async function Le(e,t,n,o,r,i,s,c,u,l,d,h){if(u){const t=await u.generateProof({url:e,method:r.method||"GET",nonce:await u.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:t})}let p,f=null;for(let a=0;a<3;a++)try{p=await Ue(e,n,o,r,i,s,t,c,d,h),f=null;break}catch(e){f=e}if(f)throw f;const m=p.json,y=m.error,w=m.error_description,g=a(m,["error","error_description"]),v=p,b=v.headers,_=v.ok;let k;if(u&&(k=b[je],k&&await u.setNonce(k)),!_){const a=w||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===y)throw new D(y,a,g.mfa_token,g.mfa_requirements);if("missing_refresh_token"===y)throw new Z(n,o);if("use_dpop_nonce"===y){if(!u||!k||l)throw new F(k);return Le(e,t,n,o,r,i,s,c,u,!0,d,h)}throw new W(y||"request_error",a)}return g}async function Ke(e,t,n){var o=e.baseUrl,r=e.timeout,i=e.audience,s=e.scope,c=e.auth0Client,u=e.useFormData,l=e.useMrrt,d=e.dpop,h=e.preserveRefreshToken,p=a(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop","preserveRefreshToken"]);const f="urn:ietf:params:oauth:grant-type:token-exchange"===p.grant_type,m="urn:okta:params:oauth:grant-type:webauthn"===p.grant_type,y="refresh_token"===p.grant_type&&l,w=f||m||y,g=Object.assign(Object.assign(Object.assign({},p),w&&i&&{audience:i}),w&&s&&{scope:s}),v=m||!u,b=v?JSON.stringify(g):Q(g),_=(k=p.grant_type,We.includes(k));var k;return await Le("".concat(o,"/oauth/token"),r,i||j,s,{method:"POST",body:b,headers:{"Content-Type":v?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(B(c||I)))}},t,u,l,_?d:void 0,void 0,n,h)}const ze=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return(o=t.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(o))).join(" ");var o},Je=(e,t,n)=>{let o;return n&&(o=e[n]),o||(o=e[j]),ze(o,t)},De="@@auth0spajs@@",Ze="@@user@@";class He{constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:De,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const t=S(e.split("::"),4),n=t[0],o=t[1],r=t[2],i=t[3];return new He({clientId:o,scope:i,audience:r},n)}static fromCacheEntry(e){const t=e.scope,n=e.audience,o=e.client_id;return new He({scope:t,audience:n,clientId:o})}}class Fe{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(De))}}class Ge{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class Ve{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||O}async setIdToken(e,t,n){var o;const r=this.getIdTokenCacheKey(e);await this.cache.set(r,{id_token:t,decodedToken:n}),await(null===(o=this.keyManifest)||void 0===o?void 0:o.add(r))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const t=await this.get(e);if(!t)return;if(!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var r;let i=await this.cache.get(e.toKey()),s=e;if(!i){const t=await this.getCacheKeys();if(!t)return;const r=this.matchExistingCacheKey(e,t);if(r&&(i=await this.cache.get(r),s=He.fromKey(r)),!i&&n&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;const a=await this.nowProvider(),c=Math.floor(a/1e3);return i.expiresAt-t<c?i.body.refresh_token?this.modifiedCachedEntry(i,s):(await this.cache.remove(s.toKey()),void await(null===(r=this.keyManifest)||void 0===r?void 0:r.remove(s.toKey()))):i.body}async modifiedCachedEntry(e,t){const n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},o={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),o),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;const n=new He({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await(null===(t=this.keyManifest)||void 0===t?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new He({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async stripRefreshToken(e){var t;const n=await this.getCacheKeys();if(n)for(const o of n){const n=await this.cache.get(o);(null===(t=null==n?void 0:n.body)||void 0===t?void 0:t.refresh_token)===e&&(delete n.body.refresh_token,await this.cache.set(o,n))}}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter(t=>!e||t.includes(e)).reduce(async(e,t)=>{await e,await this.cache.remove(t)},Promise.resolve()),await(null===(t=this.keyManifest)||void 0===t?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null===(e=await this.keyManifest.get())||void 0===e?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new He({clientId:e},De,Ze).toKey()}matchExistingCacheKey(e,t){return t.filter(t=>{var n;const o=He.fromKey(t),r=new Set(o.scope&&o.scope.split(" ")),i=(null===(n=e.scope)||void 0===n?void 0:n.split(" "))||[],s=o.scope&&i.reduce((e,t)=>e&&r.has(t),!0);return o.prefix===De&&o.clientId===e.clientId&&o.audience===e.audience&&s})[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const t=He.fromKey(o);if(t.prefix===De&&t.clientId===e.clientId){const e=await this.cache.get(o);if(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)return{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;const o=await this.getCacheKeys();if(!o)return[];const r=new Set;for(const i of o){const o=He.fromKey(i);if(o.prefix===De&&o.clientId===t&&o.audience===e){const e=await this.cache.get(i);(null===(n=null==e?void 0:e.body)||void 0===n?void 0:n.refresh_token)&&r.add(e.body.refresh_token)}}return Array.from(r)}async updateEntry(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const r=await this.getCacheKeys();if(r)for(const i of r){if(He.fromKey(i).clientId!==n)continue;const r=await this.cache.get(i);if(!(null==r?void 0:r.body))continue;const s=r.body.refresh_token;s&&(o||s===e)&&(r.body.refresh_token=t,await this.cache.set(i,r))}}}class Xe{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const qe=e=>"number"==typeof e,Ye=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var Be=ne&&ne.__assign||function(){return Be=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e},Be.apply(this,arguments)};function Qe(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}var $e=function(e){return function(e){for(var t={},n=e?e.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),s=i.slice(1).join("=");'"'===s.charAt(0)&&(s=s.slice(1,-1));try{t[i[0].replace(o,decodeURIComponent)]=s.replace(o,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e]};function et(e,t,n){document.cookie=function(e,t,n){return encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return Qe("Expires",e.expires?e.expires.toUTCString():"")+Qe("Domain",e.domain)+Qe("Path",e.path)+Qe("Secure",e.secure)+Qe("SameSite",e.sameSite)}(n)}(e,t,Be({path:"/"},n))}var tt=et,nt=function(e,t){et(e,"",Be(Be({},t),{expires:-1}))};const ot={get(e){const t=$e(e);if(void 0!==t)return JSON.parse(t)},save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),tt(e,JSON.stringify(t),o)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),nt(e,n)}},rt="_legacy_",it={get:e=>ot.get(e)||ot.get("".concat(rt).concat(e)),save(e,t,n){let o={};"https:"===window.location.protocol&&(o={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(o.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(o.domain=n.cookieDomain),tt("".concat(rt).concat(e),JSON.stringify(t),o),ot.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),nt(e,n),ot.remove(e,t),ot.remove("".concat(rt).concat(e),t)}},st={get(e){if("undefined"==typeof sessionStorage)return;const t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};e.ResponseType=void 0,function(e){e.Code="code",e.ConnectCode="connect_code"}(e.ResponseType||(e.ResponseType={}));var at,ct=function(e){return at=at||function(e,t,n){var o=void 0===t?null:t,r=function(e,t){var n=atob(e);if(t){for(var o=new Uint8Array(n.length),r=0,i=n.length;r<i;++r)o[r]=n.charCodeAt(r);return String.fromCharCode.apply(null,new Uint16Array(o.buffer))}return n}(e,void 0!==n&&n),i=r.indexOf("\n",10)+1,s=r.substring(i)+(o?"//# sourceMappingURL="+o:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxhLGk9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihpLnB1c2goby52YWx1ZSksaS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoYT1yLnJldHVybigpLE9iamVjdChhKSE9PWEpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGl9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGE9e30saT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PShlLHQpPT5hW2MoZSx0KV0sZj1lPT57T2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChyPT57bGV0IG89dChyLDIpLG49b1swXTtvWzFdPT09ZSYmZGVsZXRlIGFbbl19KX0saD1lPT57Y29uc3QgdD1uZXcgVVJMU2VhcmNoUGFyYW1zKGUpLHI9e307cmV0dXJuIHQuZm9yRWFjaCgoZSx0KT0+e3JbdF09ZX0pLHJ9LGQ9YXN5bmMgZT0+e2xldCByLG4saT1lLmRhdGEsZj1pLnRpbWVvdXQsZD1pLmF1dGgscD1pLmZldGNoVXJsLHk9aS5mZXRjaE9wdGlvbnMsZz1pLnVzZUZvcm1EYXRhLGI9aS51c2VNcnJ0LE89aS5za2lwVG9rZW5TdG9yYWdlLGs9aS5wcmVzZXJ2ZVJlZnJlc2hUb2tlbixtPXQoZS5wb3J0cywxKVswXSxqPXt9O2NvbnN0IHY9ZHx8e30sXz12LmF1ZGllbmNlLHc9di5zY29wZTt0cnl7Y29uc3QgZT1nP2goeS5ib2R5KTpKU09OLnBhcnNlKHkuYm9keSk7aWYoZS5yZWZyZXNoX3Rva2VufHwicmVmcmVzaF90b2tlbiIhPT1lLmdyYW50X3R5cGUpZS5tZmFfdG9rZW4mJihuPXUoXyx3KSwhbiYmYiYmKG49YS5sYXRlc3RfcmVmcmVzaF90b2tlbikpO2Vsc2V7aWYobj11KF8sdyksIW4mJmIpe2NvbnN0IGU9YS5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+ISFPYmplY3Qua2V5cyhhKS5maW5kKHI9PntpZigibGF0ZXN0X3JlZnJlc2hfdG9rZW4iIT09cil7Y29uc3Qgbz1sKHQsciksbj1yLnNwbGl0KCJ8IilbMV0uc3BsaXQoIiAiKSxzPWUuc3BsaXQoIiAiKS5ldmVyeShlPT5uLmluY2x1ZGVzKGUpKTtyZXR1cm4gbyYmc319KSkodyxfKTtlJiYhdCYmKG49ZSl9aWYoIW4pdGhyb3cgbmV3IG8oXyx3KTt5LmJvZHk9Zz9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpfWxldCBpLGQ7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGk9bmV3IEFib3J0Q29udHJvbGxlcix5LnNpZ25hbD1pLnNpZ25hbCk7dHJ5e2Q9YXdhaXQgUHJvbWlzZS5yYWNlKFsoUD1mLG5ldyBQcm9taXNlKGU9PnNldFRpbWVvdXQoZSxQKSkpLGZldGNoKHAsT2JqZWN0LmFzc2lnbih7fSx5KSldKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBtLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighZClyZXR1cm4gaSYmaS5hYm9ydCgpLHZvaWQgbS5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZihVPWQuaGVhZGVycyxqPVsuLi5VXS5yZWR1Y2UoKGUscik9PntsZXQgbz10KHIsMiksbj1vWzBdLHM9b1sxXTtyZXR1cm4gZVtuXT1zLGV9LHt9KSxyPWF3YWl0IGQuanNvbigpLE8pcmV0dXJuIGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4sdm9pZCBtLnBvc3RNZXNzYWdlKHtvazpkLm9rLGpzb246cixoZWFkZXJzOmp9KTtyLnJlZnJlc2hfdG9rZW4/KGImJihhLmxhdGVzdF9yZWZyZXNoX3Rva2VuPXIucmVmcmVzaF90b2tlbixTPW4sTT1yLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChlPT57bGV0IHI9dChlLDIpLG89clswXTtyWzFdPT09UyYmKGFbb109TSl9KSksKChlLHQscik9PnthW2ModCxyKV09ZX0pKHIucmVmcmVzaF90b2tlbixfLHcpLGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4pOmt8fCgoZSx0KT0+e2RlbGV0ZSBhW2MoZSx0KV19KShfLHcpLG0ucG9zdE1lc3NhZ2Uoe29rOmQub2ssanNvbjpyLGhlYWRlcnM6an0pfWNhdGNoKGUpe20ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOmp9KX12YXIgUyxNLFUsUH0scD1hc3luYyBlPT57bGV0IHI9ZS5kYXRhLG89ci50aW1lb3V0LG49ci5hdXRoLGk9ci5mZXRjaFVybCxjPXIuZmV0Y2hPcHRpb25zLHU9ci51c2VGb3JtRGF0YSxkPXQoZS5wb3J0cywxKVswXTtjb25zdCBwPShufHx7fSkuYXVkaWVuY2U7dHJ5e2NvbnN0IGU9KGU9Pntjb25zdCByPW5ldyBTZXQ7cmV0dXJuIE9iamVjdC5lbnRyaWVzKGEpLmZvckVhY2gobz0+e2xldCBuPXQobywyKSxzPW5bMF0sYT1uWzFdO2woZSxzKSYmci5hZGQoYSl9KSxBcnJheS5mcm9tKHIpfSkocCk7aWYoMD09PWUubGVuZ3RoKXJldHVybiB2b2lkIGQucG9zdE1lc3NhZ2Uoe29rOiEwfSk7Y29uc3Qgcj11P2goYy5ib2R5KTpKU09OLnBhcnNlKGMuYm9keSk7Zm9yKGNvbnN0IHQgb2YgZSl7Y29uc3QgZT11P3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7dG9rZW46dH0pKTtsZXQgbixhLGwsaDsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYobj1uZXcgQWJvcnRDb250cm9sbGVyLGE9bi5zaWduYWwpO3RyeXtoPWF3YWl0IFByb21pc2UucmFjZShbbmV3IFByb21pc2UoZT0+e2w9c2V0VGltZW91dChlLG8pfSksZmV0Y2goaSxPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sYykse2JvZHk6ZSxzaWduYWw6YX0pKV0pLmZpbmFsbHkoKCk9PmNsZWFyVGltZW91dChsKSl9Y2F0Y2goZSl7cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfSl9aWYoIWgpcmV0dXJuIG4mJm4uYWJvcnQoKSx2b2lkIGQucG9zdE1lc3NhZ2Uoe2Vycm9yOiJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCcifSk7aWYoIWgub2spe2xldCBlO3RyeXtjb25zdCB0PUpTT04ucGFyc2UoYXdhaXQgaC50ZXh0KCkpO2U9dC5lcnJvcl9kZXNjcmlwdGlvbn1jYXRjaChlKXt9cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZXx8IkhUVFAgZXJyb3IgIi5jb25jYXQoaC5zdGF0dXMpfSl9Zih0KX1kLnBvc3RNZXNzYWdlKHtvazohMH0pfWNhdGNoKGUpe2QucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZXx8IlVua25vd24gZXJyb3IgZHVyaW5nIHRva2VuIHJldm9jYXRpb24ifSl9fSx5PShlLHQpPT57aWYoIWkpcmV0dXJuITE7dHJ5e2NvbnN0IHI9bmV3IFVSTChpKS5vcmlnaW4sbz1uZXcgVVJMKGUuZmV0Y2hVcmwpO3JldHVybiBvLm9yaWdpbj09PXImJm8ucGF0aG5hbWU9PT10fWNhdGNoKGUpe3JldHVybiExfX07YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsZT0+e2NvbnN0IHI9ZS5kYXRhLG89dChlLnBvcnRzLDEpWzBdO2lmKCEoInR5cGUiaW4gcil8fCJpbml0IiE9PXIudHlwZSlyZXR1cm4idHlwZSJpbiByJiYiY2xlYXIiPT09ci50eXBlPyhhPXt9LHZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITB9KSkpOiJ0eXBlImluIHImJiJyZXZva2UiPT09ci50eXBlP3kociwiL29hdXRoL3Jldm9rZSIpP3ZvaWQgcChlKTp2b2lkKG51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpOnZvaWQoImZldGNoVXJsImluIHImJnkociwiL29hdXRoL3Rva2VuIik/ZChlKTpudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjoiaW52YWxpZF9mZXRjaF91cmwiLGVycm9yX2Rlc2NyaXB0aW9uOiJVbmF1dGhvcml6ZWQgZmV0Y2ggVVJMIn0saGVhZGVyczp7fX0pKTtpZihudWxsPT09aSl0cnl7bmV3IFVSTChyLmFsbG93ZWRCYXNlVXJsKSxpPXIuYWxsb3dlZEJhc2VVcmx9Y2F0Y2goZSl7cmV0dXJufX0pfSgpOwoK",null,false),new Worker(at,e)};class ut{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set((null===(t=await this.cache.get(this.manifestKey))||void 0===t?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(De,"::").concat(e)}}const lt="auth0.is.authenticated",dt={memory:()=>(new Ge).enclosedCache,localstorage:()=>new Fe},ht=e=>dt[e],pt=e=>{const t=e.openUrl,n=e.onRedirect,o=a(e,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:!1===t||t?t:n})},ft={NONCE:"nonce",KEYPAIR:"keypair"};class mt{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(ft).forEach(t=>e.result.createObjectStore(t)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((e,t)=>{o.onsuccess=()=>e(o.result),o.onerror=()=>t(o.error)})}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(ft.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(ft.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",e=>e.put(n,t))}findNonce(e){return this.find(ft.NONCE,this.buildKey(e))}findKeyPair(){return this.find(ft.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",e=>e.get(t))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",e=>e.getAllKeys());await Promise.all((null==n?void 0:n.filter(t).map(t=>this.executeDbRequest(e,"readwrite",e=>e.delete(t))))||[])}deleteByClientId(e,t){return this.deleteBy(e,e=>"string"==typeof e&&e.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(ft.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(ft.KEYPAIR,this.clientId)}}class yt{constructor(e){this.storage=new mt(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let o;return o={name:"ECDSA",namedCurve:"P-256"},crypto.subtle.generateKey(o,null!==(n=null==t?void 0:t.extractable)&&void 0!==n&&n,["sign","verify"])}(0,{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return function(e){let t=e.keyPair,n=e.url,o=e.method,r=e.nonce,i=e.accessToken;const s=function(e){const t=new URL(e);return t.search="",t.hash="",t.href}(n);return Ie(t,s,o,r,i)}(Object.assign({keyPair:t},e))}async calculateThumbprint(){return function(e){return async function(e){if(!xe(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw new TypeError('"publicKey.extractable" must be true');const t=await Oe(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new Ce("unsupported JWK kty")}return Ee(await crypto.subtle.digest({name:"SHA-256"},ke(JSON.stringify(n))))}(e.publicKey)}(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var wt;!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(wt||(wt={}));class gt{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:wt.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);if(void 0===n)throw new W("missing_access_token","No access token available");let o,r;"string"==typeof n?(o=this.config.dpopNonceId?wt.DPoP:wt.Bearer,r=n):(o=n.token_type,r=n.access_token),this.setAuthorizationHeader(e,r,o),o===wt.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,je);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new F(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const r=this.buildBaseRequest(e,t);await this.prepareRequest(r,o);const i=await this.config.fetch(r);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class vt{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){const e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){const t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),o=await this._handleResponse(n),r=null!==(t=n.headers.get("location"))&&void 0!==t?t:"",i=decodeURIComponent(r.split("/").pop()||"");return Object.assign(Object.assign({},o),{id:i,location:r})}async enrollmentVerify(e){const t=e,n=t.location;t.type;const o=a(t,["location","type"]),r=await this.myAccountFetcher.fetchWithAuth("".concat(n,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},{scope:["create:me:authentication_methods"]});return this._handleResponse(r)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new bt({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new bt(t)}}class bt extends Error{constructor(e){let t=e.type,n=e.status,o=e.title,r=e.detail,i=e.validation_errors;super(r),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=r,this.validation_errors=i,Object.setPrototypeOf(this,bt.prototype)}}const _t={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}};var kt,St;let Tt;if("undefined"==typeof navigator||null===(kt=navigator.userAgent)||void 0===kt||null===(St=kt.startsWith)||void 0===St||!St.call(kt,"Mozilla/5.0 ")){const e="v3.8.6";Tt="".concat("oauth4webapi","/").concat(e)}function Et(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}const Ct="ERR_INVALID_ARG_VALUE",Pt="ERR_INVALID_ARG_TYPE";function At(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}const Rt=Symbol(),xt=Symbol(),It=Symbol(),Ot=Symbol(),jt=Symbol(),Wt=Symbol(),Mt=new TextEncoder,Nt=new TextDecoder;function Ut(e){return"string"==typeof e?Mt.encode(e):Nt.decode(e)}let Lt,Kt;if(Uint8Array.prototype.toBase64)Lt=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0}));else{const e=32768;Lt=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));const n=[];for(let o=0;o<t.byteLength;o+=e)n.push(String.fromCharCode.apply(null,t.subarray(o,o+e)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}}function zt(e){return"string"==typeof e?Kt(e):Lt(e)}Kt=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw At("The input to be decoded is not correctly encoded.",Ct,e)}}:e=>{try{const t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw At("The input to be decoded is not correctly encoded.",Ct,e)}};class Jt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=Fn,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class Dt extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function Zt(e,t,n){return new Dt(e,{code:t,cause:n})}function Ht(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function Ft(e){Et(e,Headers)&&(e=Object.fromEntries(e.entries()));const t=new Headers(null!=e?e:{});if(Tt&&!t.has("user-agent")&&t.set("user-agent",Tt),t.has("authorization"))throw At('"options.headers" must not include the "authorization" header name',Ct);return t}function Gt(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw At('"options.signal" must return or be an instance of AbortSignal',Pt);return t}}function Vt(e){return e.includes("//")?e.replace("//","/"):e}function Xt(e,t,n,o,r){try{if("number"!=typeof e||!Number.isFinite(e))throw At("".concat(n," must be a number"),Pt,r);if(e>0)return;if(t){if(0!==e)throw At("".concat(n," must be a non-negative number"),Ct,r);return}throw At("".concat(n," must be a positive number"),Ct,r)}catch(e){if(o)throw Zt(e.message,o,r);throw e}}function qt(e,t,n,o){try{if("string"!=typeof e)throw At("".concat(t," must be a string"),Pt,o);if(0===e.length)throw At("".concat(t," must not be empty"),Ct,o)}catch(e){if(n)throw Zt(e.message,n,o);throw e}}function Yt(e){!function(e,t){if(Tn(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];if(o.length>2){const e=o.pop();t+="".concat(o.join(", "),", or ").concat(e)}else 2===o.length?t+="".concat(o[0]," or ").concat(o[1]):t+=o[0];return Zt(t,Yn,e)}(e,t)}(e,"application/json")}function Bt(){return zt(crypto.getRandomValues(new Uint8Array(32)))}function Qt(e){switch(e.algorithm.name){case"RSA-PSS":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new Jt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"RSASSA-PKCS1-v1_5":return function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new Jt("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}}(e);case"ECDSA":return function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new Jt("unsupported EcKeyAlgorithm namedCurve",{cause:e})}}(e);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new Jt("unsupported CryptoKey algorithm name",{cause:e})}}function $t(e){const t=null==e?void 0:e[xt];return"number"==typeof t&&Number.isFinite(t)?t:0}function en(e){const t=null==e?void 0:e[It];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function tn(){return Math.floor(Date.now()/1e3)}function nn(e){if("object"!=typeof e||null===e)throw At('"as" must be an object',Pt);qt(e.issuer,'"as.issuer"')}function on(e){if("object"!=typeof e||null===e)throw At('"client" must be an object',Pt);qt(e.client_id,'"client.client_id"')}function rn(e){return qt(e,'"clientSecret"'),(t,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",e)}}function sn(e,t){const n=(i=e)instanceof CryptoKey?{key:i}:(null==i?void 0:i.key)instanceof CryptoKey?(void 0!==i.kid&&qt(i.kid,'"kid"'),{key:i.key,kid:i.kid}):{},o=n.key,r=n.kid;var i;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw At("".concat(t," must be a CryptoKey"),Pt)}(e,t),"private"!==e.type)throw At("".concat(t," must be a private CryptoKey"),Ct)}(o,'"clientPrivateKey.key"'),async(e,n,i,s)=>{var a;const c={alg:Qt(o),kid:r},u=function(e,t){const n=tn()+$t(t);return{jti:Bt(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,n);null==t||null===(a=t[jt])||void 0===a||a.call(t,c,u),i.set("client_id",n.client_id),i.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),i.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw At('CryptoKey instances used for signing assertions must include "sign" in their "usages"',Ct);const o="".concat(zt(Ut(JSON.stringify(e))),".").concat(zt(Ut(JSON.stringify(t)))),r=zt(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:co(e)};case"RSA-PSS":switch(ao(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new Jt("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return ao(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new Jt("unsupported CryptoKey algorithm name",{cause:e})}(n),n,Ut(o)));return"".concat(o,".").concat(r)}(c,u,o))}}const an=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function cn(e,t){if(t&&"https:"!==e.protocol)throw Zt("only requests to HTTPS are allowed",Qn,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw Zt("only HTTP and HTTPS requests are allowed",$n,e)}function un(e,t,n,o){let r;if("string"!=typeof e||!(r=an(e)))throw Zt("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?oo:ro,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return cn(r,o),r}function ln(e,t,n,o){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?un(e.mtls_endpoint_aliases[t],t,n,o):un(e[t],t,n,o)}class dn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"status",void 0),v(this,"error_description",void 0),v(this,"response",void 0),this.name=this.constructor.name,this.code=Hn,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}class hn extends Error{constructor(e,t){var n,o;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"error",void 0),v(this,"error_description",void 0),this.name=this.constructor.name,this.code=Gn,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!==(n=t.cause.get("error_description"))&&void 0!==n?n:void 0,null===(o=Error.captureStackTrace)||void 0===o||o.call(Error,this,this.constructor)}}class pn extends Error{constructor(e,t){var n;super(e,t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"response",void 0),v(this,"status",void 0),this.name=this.constructor.name,this.code=Zn,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}const fn="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",mn="("+fn+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"',yn="("+fn+")\\s*=\\s*("+fn+")",wn=new RegExp("^[,\\s]*("+fn+")"),gn=new RegExp("^[,\\s]*"+mn+"[,\\s]*(.*)"),vn=new RegExp("^[,\\s]*"+yn+"[,\\s]*(.*)"),bn=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function _n(e,t,n){if(e.status!==t){let t;var o;if(On(e),t=await async function(e){if(e.status>399&&e.status<500){so(e),Yt(e);try{const t=await e.clone().json();if(Ht(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await(null===(o=e.body)||void 0===o?void 0:o.cancel()),new dn("server responded with an error in the response body",{cause:t,response:e});throw Zt('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),Bn,e)}}function kn(e){if(!Un.has(e))throw At('"options.DPoP" is not a valid DPoPHandle',Ct)}const Sn=Symbol();function Tn(e){var t;return null===(t=e.headers.get("content-type"))||void 0===t?void 0:t.split(";")[0]}async function En(e,t,n,o,r){if(nn(e),on(t),!Et(o,Response))throw At('"response" must be an instance of Response',Pt);if(On(o),200!==o.status)throw Zt('"response" is not a conform UserInfo Endpoint response (unexpected HTTP status code)',Bn,o);let i;if(so(o),"application/jwt"===Tn(o)){const n=await uo(await o.text(),lo.bind(void 0,t.userinfo_signed_response_alg,e.userinfo_signing_alg_values_supported,void 0),$t(t),en(t),null==r?void 0:r[Wt]).then(jn.bind(void 0,t.client_id)).then(Mn.bind(void 0,e)),s=n.claims,a=n.jwt;Rn.set(o,a),i=s}else{if(t.userinfo_signed_response_alg)throw Zt("JWT UserInfo Response expected",Vn,o);i=await mo(o)}if(qt(i.sub,'"response" body "sub" property',qn,{body:i}),n===Sn);else if(qt(n,'"expectedSubject"'),i.sub!==n)throw Zt('unexpected "response" body "sub" property value',no,{expected:n,body:i,attribute:"sub"});return i}async function Cn(e,t,n,o,r,i,s){return await n(e,t,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==s?void 0:s[Ot])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Gt(o,null==s?void 0:s.signal)})}async function Pn(e,t,n,o,r,i){var s;const a=ln(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[Rt]));r.set("grant_type",o);const c=Ft(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(kn(i.DPoP),await i.DPoP.addProof(a,c,"POST"));const u=await Cn(e,t,n,a,r,c,i);return null==i||null===(s=i.DPoP)||void 0===s||s.cacheNonce(u,a),u}const An=new WeakMap,Rn=new WeakMap;function xn(e){if(!e.id_token)return;const t=An.get(e);if(!t)throw At('"ref" was already garbage collected or did not resolve from the proper sources',Ct);return t}async function In(e,t,n,o,r,i){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Pt);await _n(n,200,"Token Endpoint"),so(n);const s=await mo(n);if(qt(s.access_token,'"response" body "access_token" property',qn,{body:s}),qt(s.token_type,'"response" body "token_type" property',qn,{body:s}),s.token_type=s.token_type.toLowerCase(),void 0!==s.expires_in){let e="number"!=typeof s.expires_in?parseFloat(s.expires_in):s.expires_in;Xt(e,!0,'"response" body "expires_in" property',qn,{body:s}),s.expires_in=e}if(void 0!==s.refresh_token&&qt(s.refresh_token,'"response" body "refresh_token" property',qn,{body:s}),void 0!==s.scope&&"string"!=typeof s.scope)throw Zt('"response" body "scope" property must be a string',qn,{body:s});if(void 0!==s.id_token){qt(s.id_token,'"response" body "id_token" property',qn,{body:s});const i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(Xt(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=o&&o.length&&i.push(...o);const a=await uo(s.id_token,lo.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),$t(t),en(t),r).then(zn.bind(void 0,i)).then(Nn.bind(void 0,e)).then(Wn.bind(void 0,t.client_id)),c=a.claims,u=a.jwt;if(Array.isArray(c.aud)&&1!==c.aud.length){if(void 0===c.azp)throw Zt('ID Token "aud" (audience) claim includes additional untrusted audiences',to,{claims:c,claim:"aud"});if(c.azp!==t.client_id)throw Zt('unexpected ID Token "azp" (authorized party) claim value',to,{expected:t.client_id,claims:c,claim:"azp"})}void 0!==c.auth_time&&Xt(c.auth_time,!0,'ID Token "auth_time" (authentication time)',qn,{claims:c}),Rn.set(n,u),An.set(s,c)}if(void 0!==(null==i?void 0:i[s.token_type]))i[s.token_type](n,s);else if("dpop"!==s.token_type&&"bearer"!==s.token_type)throw new Jt("unsupported `token_type` value",{cause:{body:s}});return s}function On(e){let t;if(t=function(e){if(!Et(e,Response))throw At('"response" must be an instance of Response',Pt);const t=e.headers.get("www-authenticate");if(null===t)return;const n=[];let o=t;for(;o;){var r;let t=o.match(wn);const c=null===(r=t)||void 0===r?void 0:r[1].toLowerCase();if(!c)return;const u=o.substring(t[0].length);if(u&&!u.match(/^[\s,]/))return;const l=u.match(/^\s+(.*)$/),d=!!l;o=l?l[1]:void 0;const h={};let p;if(d)for(;o;){let n,r;if(t=o.match(gn)){var i=S(t,4);if(n=i[1],r=i[2],o=i[3],r.includes("\\"))try{r=JSON.parse('"'.concat(r,'"'))}catch(e){}h[n.toLowerCase()]=r}else{if(!(t=o.match(vn))){if(t=o.match(bn)){if(Object.keys(h).length)break;var s=S(t,3);p=s[1],o=s[2];break}return}var a=S(t,4);n=a[1],r=a[2],o=a[3],h[n.toLowerCase()]=r}}else o=u||void 0;const f={scheme:c,parameters:h};p&&(f.token68=p),n.push(f)}return n.length?n:void 0}(e))throw new pn("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}function jn(e,t){return void 0!==t.claims.aud?Wn(e,t):t}function Wn(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw Zt('unexpected JWT "aud" (audience) claim value',to,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw Zt('unexpected JWT "aud" (audience) claim value',to,{expected:e,claims:t.claims,claim:"aud"});return t}function Mn(e,t){return void 0!==t.claims.iss?Nn(e,t):t}function Nn(e,t){var n,o;const r=null!==(n=null===(o=e[wo])||void 0===o?void 0:o.call(e,t))&&void 0!==n?n:e.issuer;if(t.claims.iss!==r)throw Zt('unexpected JWT "iss" (issuer) claim value',to,{expected:r,claims:t.claims,claim:"iss"});return t}const Un=new WeakSet,Ln=Symbol(),Kn={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function zn(e,t){for(const n of e)if(void 0===t.claims[n])throw Zt('JWT "'.concat(n,'" (').concat(Kn[n],") claim missing"),qn,{claims:t.claims});return t}const Jn=Symbol(),Dn=Symbol();const Zn="OAUTH_WWW_AUTHENTICATE_CHALLENGE",Hn="OAUTH_RESPONSE_BODY_ERROR",Fn="OAUTH_UNSUPPORTED_OPERATION",Gn="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Vn="OAUTH_JWT_USERINFO_EXPECTED",Xn="OAUTH_PARSE_ERROR",qn="OAUTH_INVALID_RESPONSE",Yn="OAUTH_RESPONSE_IS_NOT_JSON",Bn="OAUTH_RESPONSE_IS_NOT_CONFORM",Qn="OAUTH_HTTP_REQUEST_FORBIDDEN",$n="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",eo="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",to="OAUTH_JWT_CLAIM_COMPARISON_FAILED",no="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",oo="OAUTH_MISSING_SERVER_METADATA",ro="OAUTH_INVALID_SERVER_METADATA";async function io(e){if(!Et(e,Response))throw At('"response" must be an instance of Response',Pt);await _n(e,200,"Revocation Endpoint")}function so(e){if(e.bodyUsed)throw At('"response" body has been used already',Ct)}function ao(e){const t=e.algorithm;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new Jt("unsupported ".concat(t.name," modulusLength"),{cause:e})}function co(e){switch(e.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new Jt("unsupported ECDSA namedCurve",{cause:e})}}async function uo(e,t,n,o,r){let i,s,a=e.split("."),c=a[0],u=a[1],l=a.length;if(5===l){if(void 0===r)throw new Jt("JWE decryption is not configured",{cause:e});var d=(e=await r(e)).split(".");c=d[0],u=d[1],l=d.length}if(3!==l)throw Zt("Invalid JWT",qn,e);try{i=JSON.parse(Ut(zt(c)))}catch(e){throw Zt("failed to parse JWT Header body as base64url encoded JSON",Xn,e)}if(!Ht(i))throw Zt("JWT Header must be a top level object",qn,e);if(t(i),void 0!==i.crit)throw new Jt('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{s=JSON.parse(Ut(zt(u)))}catch(e){throw Zt("failed to parse JWT Payload body as base64url encoded JSON",Xn,e)}if(!Ht(s))throw Zt("JWT Payload must be a top level object",qn,e);const h=tn()+n;if(void 0!==s.exp){if("number"!=typeof s.exp)throw Zt('unexpected JWT "exp" (expiration time) claim type',qn,{claims:s});if(s.exp<=h-o)throw Zt('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',eo,{claims:s,now:h,tolerance:o,claim:"exp"})}if(void 0!==s.iat&&"number"!=typeof s.iat)throw Zt('unexpected JWT "iat" (issued at) claim type',qn,{claims:s});if(void 0!==s.iss&&"string"!=typeof s.iss)throw Zt('unexpected JWT "iss" (issuer) claim type',qn,{claims:s});if(void 0!==s.nbf){if("number"!=typeof s.nbf)throw Zt('unexpected JWT "nbf" (not before) claim type',qn,{claims:s});if(s.nbf>h+o)throw Zt('unexpected JWT "nbf" (not before) claim value',eo,{claims:s,now:h,tolerance:o,claim:"nbf"})}if(void 0!==s.aud&&"string"!=typeof s.aud&&!Array.isArray(s.aud))throw Zt('unexpected JWT "aud" (audience) claim type',qn,{claims:s});return{header:i,claims:s,jwt:e}}function lo(e,t,n,o){if(void 0===e)if(Array.isArray(t)){if(!t.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw Zt('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?o.alg!==n:"function"==typeof n?!n(o.alg):!n.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:n,reason:"default value"})}else if("string"==typeof e?o.alg!==e:!e.includes(o.alg))throw Zt('unexpected JWT "alg" header parameter',qn,{header:o,expected:e,reason:"client configuration"})}function ho(e,t){const n=e.getAll(t),o=n[0];if(n.length>1)throw Zt('"'.concat(t,'" parameter must be provided only once'),qn);return o}const po=Symbol(),fo=Symbol();async function mo(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Yt;try{t=await e.json()}catch(t){throw n(e),Zt('failed to parse "response" body as JSON',Xn,t)}if(!Ht(t))throw Zt('"response" body must be a top level object',qn,{body:t});return t}const yo=Symbol(),wo=Symbol(),go=new TextEncoder,vo=new TextDecoder,bo=new TextDecoder("utf-8",{fatal:!0});function _o(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];const o=t.reduce((e,t)=>e+t.length,0),r=new Uint8Array(o);let i=0;for(const e of t)r.set(e,i),i+=e.length;return r}function ko(e){const t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){const o=e.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");t[n]=o}return t}const So=function(e){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))};const To=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if(o.length>2){const t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");if(null==t)e+=" Received ".concat(t);else if("function"==typeof t&&t.name)e+=" Received function ".concat(t.name);else if("object"==typeof t&&null!=t){var i;null!==(i=t.constructor)&&void 0!==i&&i.name&&(e+=" Received an instance of ".concat(t.constructor.name))}return e}("Key for the ".concat(e," algorithm must be "),t,...o)};class Eo extends Error{constructor(e,t){var n;super(e,t),v(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}v(Eo,"code","ERR_JOSE_GENERIC");class Co extends Eo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(Co,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class Po extends Eo{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),v(this,"code","ERR_JWT_EXPIRED"),v(this,"claim",void 0),v(this,"reason",void 0),v(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}v(Po,"code","ERR_JWT_EXPIRED");class Ao extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}v(Ao,"code","ERR_JOSE_ALG_NOT_ALLOWED");class Ro extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JOSE_NOT_SUPPORTED")}}v(Ro,"code","ERR_JOSE_NOT_SUPPORTED"),v(class extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),v(class extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class xo extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWS_INVALID")}}v(xo,"code","ERR_JWS_INVALID");class Io extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWT_INVALID")}}v(Io,"code","ERR_JWT_INVALID"),v(class extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Oo extends Eo{constructor(){super(...arguments),v(this,"code","ERR_JWKS_INVALID")}}v(Oo,"code","ERR_JWKS_INVALID");class jo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}v(jo,"code","ERR_JWKS_NO_MATCHING_KEY");class Wo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),v(this,Symbol.asyncIterator,T(function*(){})),v(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}v(Wo,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class Mo extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWKS_TIMEOUT")}}v(Mo,"code","ERR_JWKS_TIMEOUT");class No extends Eo{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),v(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}v(No,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const Uo=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}};function Lo(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);const t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}const Ko="The input to be decoded is not correctly encoded.";function zo(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64("string"==typeof e?e:vo.decode(e),{alphabet:"base64url"})}catch(e){throw new TypeError(Ko,{cause:e})}let t=e;if(t instanceof Uint8Array&&(t=vo.decode(t)),t.includes("+")||t.includes("/"))throw new TypeError(Ko);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return Lo(t)}catch(e){throw new TypeError(Ko)}}function Jo(e){let t=e;return"string"==typeof t&&(t=go.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:!0}):function(e){if(Uint8Array.prototype.toBase64)return e.toBase64();const t=[];for(let n=0;n<e.length;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join(""))}(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Do(e){if("object"!=typeof e||null===e||"[object Object]"!==Object.prototype.toString.call(e))return!1;const t=Object.getPrototypeOf(e);return null===t||null===Object.getPrototypeOf(t)}function Zo(e){return Do(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(Do)}function Ho(e,t,n){try{return zo(e)}catch(e){throw new n("Failed to base64url decode the ".concat(t))}}async function Fo(e,t){var n,o,r,i;if("RSA"===t.kty&&"oth"in t&&void 0!==t.oth)throw new Ro('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new Ro('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');const s=null!==(n=null===(o=e.resolve)||void 0===o?void 0:o.call(e,{kty:t.kty,crv:t.crv}))&&void 0!==n?n:e.subtle,a=!(!t.d&&!t.priv),c=_({},t);return"AKP"!==c.kty&&delete c.alg,delete c.use,crypto.subtle.importKey("jwk",c,s,null!==(r=t.ext)&&void 0!==r?r:!a,null!==(i=t.key_ops)&&void 0!==i?i:e.usages[a?1:0])}function Go(e){return _({__proto__:null},e)}const Vo=e=>e[Symbol.toStringTag];function Xo(e,t,n){const o=e.alg,r=e.secret,i="decrypt"===n||"sign"===n;if(r&&t instanceof Uint8Array)return[qo,t];if(Do(t)){const s=function(e){const t=Go(e);if(void 0!==t.ext&&"boolean"!=typeof t.ext)throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(void 0!==t.key_ops){const e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>"string"!=typeof e)||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}(t);if("string"!=typeof s.kty)throw new TypeError(r?To(o,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):To(o,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(r?"oct"===s.kty&&"string"==typeof s.k:"oct"!==s.kty&&(i?"AKP"===s.kty&&"string"==typeof s.priv||"string"==typeof s.d:void 0===s.d&&void 0===s.priv)))throw new TypeError(r?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':"JSON Web Key for this operation must be a ".concat(i?"private":"public"," JWK"));return((e,t,n)=>{const o=e.alg;if(void 0!==t.use){const e="sign"===n||"verify"===n?"sig":"enc";if(t.use!==e)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==o)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(o,'" when present'));if(Array.isArray(t.key_ops)){var r;const o="encrypt"===n||"decrypt"===n?null===(r=e.ops)||void 0===r?void 0:r["encrypt"===n?0:1]:n;if(o&&!t.key_ops.includes(o))throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(o,'" when present'))}})(e,s,n),[Qo,t,s]}if(!(e=>Uo(e)||(e=>"KeyObject"===(null==e?void 0:e[Symbol.toStringTag]))(e))(t))throw new TypeError(r?To(o,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):To(o,t,"CryptoKey","KeyObject","JSON Web Key"));if(r){if("secret"!==t.type)throw new TypeError("".concat(Vo(t),' instances for symmetric algorithms must be of type "secret"'))}else{if("secret"===t.type)throw new TypeError("".concat(Vo(t),' instances for asymmetric algorithms must not be of type "secret"'));const e=i?"private":"public";if(("public"===t.type||"private"===t.type)&&t.type!==e){const o="sign"===n?"signing":"verify"===n?"verifying":"".concat(n.slice(0,-1),"tion");throw new TypeError("".concat(Vo(t)," instances for asymmetric algorithm ").concat(o,' must be of type "').concat(e,'"'))}}return Uo(t)?[Yo,t]:[Bo,t]}const qo=0,Yo=1,Bo=2,Qo=3;let $o;const er={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function tr(e,t,n){$o||($o=new WeakMap);const o=$o.get(e);return n&&(o?o[t]=n:$o.set(e,{[t]:n})),null!=n?n:null==o?void 0:o[t]}const nr=async(e,t,n)=>{var o;return null!==(o=tr(e,n.alg))&&void 0!==o?o:tr(e,n.alg,await Fo(n,_(_({},t),{},{alg:n.alg})))};async function or(e,t,n){const o=Xo(e,t,n);switch(o[0]){case qo:case Yo:return o[1];case Qo:{const t=o[1],n=o[2];if("oct"===n.kty)return zo(n.k);if(!Object.isFrozen(t)){const e=t.key_ops;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}return nr(t,n,e)}case Bo:{const t=o[1];return"secret"===t.type?t.export():"toCryptoKey"in t&&"function"==typeof t.toCryptoKey?((e,t)=>{var n,o,r;const i=tr(e,t.alg);if(i)return i;const s="public"===e.type,a=t.usages[s?0:1],c=e.asymmetricKeyType,u=er[null===(n=e.asymmetricKeyDetails)||void 0===n?void 0:n.namedCurve],l=null!==(o=null===(r=t.resolve)||void 0===r?void 0:r.call(t,{crv:u,asymmetricKeyType:c}))&&void 0!==o?o:t.subtle;return tr(e,t.alg,e.toCryptoKey(l,s,a))})(t,e):nr(t,t.export({format:"jwk"}),e)}}}function rr(e){const t={__proto__:null};for(const n in e)t[n]=_(_({},e[n]),{},{alg:n});return t}const ir=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],sr=[[],["deriveBits"]],ar=[[],[]];function cr(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:"SHA-".concat(e)},usages:ir,ops:["wrapKey","unwrapKey"]}}function ur(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:e=>{let t=e.kty,n=e.crv,o=e.asymmetricKeyType;if("X25519"===n||"x25519"===o)return{name:"X25519"};if("OKP"===t)throw new Ro('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:n}},usages:sr,ops:[void 0,"deriveBits"]}}function lr(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:ar,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function dr(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:ar,ops:["deriveBits","deriveBits"]}}const hr=rr({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:ar,ops:["encrypt","decrypt"]},"RSA-OAEP":cr(1),"RSA-OAEP-256":cr(256),"RSA-OAEP-384":cr(384),"RSA-OAEP-512":cr(512),"ECDH-ES":ur(),"ECDH-ES+A128KW":ur(),"ECDH-ES+A192KW":ur(),"ECDH-ES+A256KW":ur(),A128KW:lr(128),A192KW:lr(192),A256KW:lr(256),A128GCMKW:lr(128,!0),A192GCMKW:lr(192,!0),A256GCMKW:lr(256,!0),"PBES2-HS256+A128KW":dr(),"PBES2-HS384+A192KW":dr(),"PBES2-HS512+A256KW":dr()}),pr=["encrypt","decrypt"];function fr(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:ar,ops:pr,cekBits:e,ivBits:t?128:96,cbc:t}}rr({A128GCM:fr(128),A192GCM:fr(192),A256GCM:fr(256),"A128CBC-HS256":fr(256,!0),"A192CBC-HS384":fr(384,!0),"A256CBC-HS512":fr(512,!0)});const mr={__proto__:null,b64:!0};function yr(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw new TypeError('"'.concat(e,'" option must be an array of strings'));if(t)return new Set(t)}function wr(e,t,n,o,r){if(void 0!==r.crit&&void 0===(null==o?void 0:o.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!o||void 0===o.crit)return[];if(!Array.isArray(o.crit)||0===o.crit.length||o.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');const i=void 0===n?t:_(_({__proto__:null},n),t);for(const t of o.crit){if(!(t in i))throw new Ro('Extension Header Parameter "'.concat(t,'" is not recognized'));if(!Object.hasOwn(r,t)||void 0===r[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i[t]&&(!Object.hasOwn(o,t)||void 0===o[t]))throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return o.crit}function gr(e,t){if(t.includes("b64")){const t=e.b64;if("boolean"!=typeof t)throw new xo('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return t}return!0}var vr,br;let _r,kr;if("undefined"==typeof navigator||null===(vr=navigator.userAgent)||void 0===vr||null===(br=vr.startsWith)||void 0===br||!br.call(vr,"Mozilla/5.0 ")){const e="v6.8.4";kr="".concat("openid-client","/").concat(e),_r={"user-agent":kr}}const Sr=e=>Tr.get(e);let Tr,Er;function Cr(e){return void 0!==e?rn(e):(Er||(Er=new WeakMap),(e,t,n,o)=>{let r;return(r=Er.get(t))||(function(e,t){if("string"!=typeof e)throw Ir("".concat(t," must be a string"),xr);if(0===e.length)throw Ir("".concat(t," must not be empty"),Rr)}(t.client_secret,'"metadata.client_secret"'),r=rn(t.client_secret),Er.set(t,r)),r(e,t,n,o)})}const Pr=Sn,Ar=Ot,Rr="ERR_INVALID_ARG_VALUE",xr="ERR_INVALID_ARG_TYPE";function Ir(e,t,n){const o=new TypeError(e,{cause:n});return Object.assign(o,{code:t}),o}class Or extends Error{constructor(e,t){var n;super(e,t),v(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null===(n=Error.captureStackTrace)||void 0===n||n.call(Error,this,this.constructor)}}function jr(e,t,n){return new Or(e,{cause:t,code:n})}function Wr(e){if(e instanceof TypeError||e instanceof Or||e instanceof dn||e instanceof hn||e instanceof pn)throw e;if(e instanceof Dt)switch(e.code){case Qn:throw jr("only requests to HTTPS are allowed",e,e.code);case $n:throw jr("only requests to HTTP or HTTPS are allowed",e,e.code);case Bn:throw jr("unexpected HTTP response status code",e.cause,e.code);case Yn:throw jr("unexpected response content-type",e.cause,e.code);case Xn:throw jr("parsing error occured",e,e.code);case qn:throw jr("invalid response encountered",e,e.code);case to:throw jr("unexpected JWT claim value encountered",e,e.code);case no:throw jr("unexpected JSON attribute value encountered",e,e.code);case eo:throw jr("JWT timestamp claim value failed validation",e,e.code);default:throw jr(e.message,e,e.code)}if(e instanceof Jt)throw jr("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw jr("runtime operation error",e,Fn);case"NotSupportedError":throw jr("runtime unsupported operation",e,Fn);case"TimeoutError":throw jr("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw jr("operation aborted",e,"OAUTH_ABORT")}throw new Or("something went wrong",{cause:e})}async function Mr(e,t,n,o,r){const i=await async function(e,t){var n,o;if(!(e instanceof URL))throw Ir('"server" must be an instance of URL',xr);const r=!e.href.includes("/.well-known/"),i=null!==(n=null==t?void 0:t.timeout)&&void 0!==n?n:30,s=AbortSignal.timeout(1e3*i),a=await(r?async function(e,t){return async function(e,t,n,o){if(!(e instanceof URL))throw At('"'.concat("issuerIdentifier",'" must be an instance of URL'),Pt);cn(e,!0!==(null==o?void 0:o[Rt]));const r=n(new URL(e.href)),i=Ft(null==o?void 0:o.headers);return i.set("accept","application/json"),((null==o?void 0:o[Ot])||fetch)(r.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:Gt(r,null==o?void 0:o.signal)})}(e,0,e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":!function(e){e.pathname=Vt("".concat(e.pathname,"/").concat(".well-known/openid-configuration"))}(e);break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=Vt("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw At('"options.algorithm" must be "oidc" (default), or "oauth2"',Ct)}return e},t)}(e,{algorithm:null==t?void 0:t.algorithm,[Ot]:null==t?void 0:t[Ar],[Rt]:null==t||null===(o=t.execute)||void 0===o?void 0:o.includes(Zr),signal:s,headers:new Headers(_r)}):((null==t?void 0:t[Ar])||fetch)((cn(e,null==t||null===(c=t.execute)||void 0===c||!c.includes(Zr)),e.href),{headers:Object.fromEntries(new Headers(_({accept:"application/json"},_r)).entries()),body:void 0,method:"GET",redirect:"manual",signal:s})).then(e=>async function(e,t){const n=e;if(!(n instanceof URL)&&n!==yo)throw At('"expectedIssuerIdentifier" must be an instance of URL',Pt);if(!Et(t,Response))throw At('"response" must be an instance of Response',Pt);if(200!==t.status)throw Zt('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Bn,t);so(t);const o=await mo(t);if(qt(o.issuer,'"response" body "issuer" property',qn,{body:o}),n!==yo&&new URL(o.issuer).href!==n.href)throw Zt('"response" body "issuer" property does not match the expected value',no,{expected:n.href,body:o,attribute:"issuer"});return o}(yo,e)).catch(Wr);var c;return r&&new URL(a.issuer).href!==e.href&&(function(e,t,n){return!("https://login.microsoftonline.com"!==e.origin||null!=n&&n.algorithm&&"oidc"!==n.algorithm||(t[Nr]=!0,0))}(e,a,t)||function(e,t){return!(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)}(e,t)||(()=>{throw new Or("discovered metadata issuer does not match the expected issuer",{code:no,cause:{expected:e.href,body:a,attribute:"issuer"}})})()),a}(e,r),s=new Ur(i,t,n,o);let a=Sr(s);if(null!=r&&r[Ar]&&(a.fetch=r[Ar]),null!=r&&r.timeout&&(a.timeout=r.timeout),null!=r&&r.execute)for(const e of r.execute)e(s);return s}new TextDecoder;const Nr=Symbol();class Ur{constructor(e,t,n,o){var r,i,s,a,c;if("string"!=typeof t||!t.length)throw Ir('"clientId" must be a non-empty string',xr);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null===(r=n)||void 0===r?void 0:r.client_id)&&t!==n.client_id)throw Ir('"clientId" and "metadata.client_id" must be the same',Rr);const u=_(_({},structuredClone(n)),{},{client_id:t});let l;u[xt]=null!==(i=null===(s=n)||void 0===s?void 0:s[xt])&&void 0!==i?i:0,u[It]=null!==(a=null===(c=n)||void 0===c?void 0:c[It])&&void 0!==a?a:30,l=o||("string"==typeof u.client_secret&&u.client_secret.length?Cr(u.client_secret):(e,t,n,o)=>{n.set("client_id",t.client_id)});let d=Object.freeze(u);const h=structuredClone(e);Nr in e&&(h[wo]=t=>{let n=t.claims.tid;return e.issuer.replace("{tenantid}",n)});let p=Object.freeze(h);Tr||(Tr=new WeakMap),Tr.set(this,{__proto__:null,as:p,c:d,auth:l,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(Sr(this).as);return function(e){Object.defineProperties(e,function(e){return{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null===(t=e.code_challenge_methods_supported)||void 0===t?void 0:t.includes(n))}}}}(e))}(e),e}clientMetadata(){return structuredClone(Sr(this).c)}get timeout(){return Sr(this).timeout}set timeout(e){Sr(this).timeout=e}get[Ar](){return Sr(this).fetch}set[Ar](e){Sr(this).fetch=e}}function Lr(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return xn(this)}catch(e){return}}}}}(e))}async function Kr(e,t,n){var o;let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];const i=null===(o=e.headers.get("retry-after"))||void 0===o?void 0:o.trim();if(void 0===i)return;let s;if(/^\d+$/.test(i))s=parseInt(i,10);else{const e=new Date(i);if(Number.isFinite(e.getTime())){const t=new Date,n=e.getTime()-t.getTime();n>0&&(s=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(s))throw new Dt("invalid Retry-After header value",{cause:e});s>t&&await zr(s-t,n)}function zr(e,t){return new Promise((n,o)=>{const r=e=>{try{t.throwIfAborted()}catch(e){return void o(e)}if(e<=0)return void n();const i=Math.min(e,5);setTimeout(()=>r(e-i),1e3*i)};r(e)})}async function Jr(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=n.auth,s=n.fetch,a=n.tlsOnly,c=n.timeout;return async function(e,t,n,o,r){nn(e),on(t);const i=ln(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),s=new URLSearchParams(o);s.set("client_id",t.client_id);const a=Ft(null==r?void 0:r.headers);return a.set("accept","application/json"),Cn(e,t,n,i,s,a,r)}(o,r,i,t,{[Ot]:s,[Rt]:!a,headers:new Headers(_r),signal:Yr(c)}).then(e=>async function(e,t,n){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Pt);await _n(n,200,"Backchannel Authentication Endpoint"),so(n);const o=await mo(n);qt(o.auth_req_id,'"response" body "auth_req_id" property',qn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Xt(r,!0,'"response" body "expires_in" property',qn,{body:o}),o.expires_in=r,void 0!==o.interval&&Xt(o.interval,!1,'"response" body "interval" property',qn,{body:o}),o}(o,r,e)).catch(Wr)}async function Dr(e,t,n,o){var r,i;qr(e),n=new URLSearchParams(n);let s=null!==(r=t.interval)&&void 0!==r?r:5;const a=null!==(i=null==o?void 0:o.signal)&&void 0!==i?i:AbortSignal.timeout(1e3*t.expires_in);try{await zr(s,a)}catch(e){Wr(e)}const c=Sr(e),u=c.as,l=c.c,d=c.auth,h=c.fetch,p=c.tlsOnly,f=c.nonRepudiation,m=c.timeout,y=c.decrypt,w=(r,i)=>Dr(e,_(_({},t),{},{interval:r}),n,_(_({},o),{},{signal:a,flag:i})),g=function(e,t){const n=Yr(t);if(!n)return{signal:e,cleanup(){}};const o=new AbortController,r=e=>{const t=e.target;o.abort(t.reason)};return e.aborted?o.abort(e.reason):n.aborted?o.abort(n.reason):(e.addEventListener("abort",r,{once:!0}),n.addEventListener("abort",r,{once:!0})),{signal:o.signal,cleanup(){e.removeEventListener("abort",r),n.removeEventListener("abort",r)}}}(a,m),v=await async function(e,t,n,o,r){nn(e),on(t),qt(o,'"authReqId"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("auth_req_id",o),Pn(e,t,n,"urn:openid:params:grant-type:ciba",i,r)}(u,l,d,t.auth_req_id,{[Ot]:h,[Rt]:!p,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:g.signal}).catch(Wr).finally(g.cleanup);var b;if(503===v.status&&v.headers.has("retry-after"))return await Kr(v,s,a,!0),await(null===(b=v.body)||void 0===b?void 0:b.cancel()),w(s);const k=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(u,l,v,{[Wt]:y});let S;try{S=await k}catch(e){if(Qr(e,o))return w(s,$r);if(e instanceof dn)switch(e.error){case"slow_down":s+=5;case"authorization_pending":return await Kr(e.response,s,a),w(s)}Wr(e)}return S.id_token&&await(null==f?void 0:f(v)),Lr(S),S}function Zr(e){Sr(e).tlsOnly=!1}async function Hr(e,t,n,o,r){if(qr(e),!((null==r?void 0:r.flag)===$r||t instanceof URL||function(e){try{return"Request"===Object.getPrototypeOf(e)[Symbol.toStringTag]}catch(e){return!1}}(t)))throw Ir('"currentUrl" must be an instance of URL, or Request',xr);let i,s;const a=Sr(e),c=a.as,u=a.c,l=a.auth,d=a.fetch,h=a.tlsOnly,p=a.jarm,f=a.hybrid,m=a.nonRepudiation,y=a.timeout,w=a.decrypt,g=a.implicit;if((null==r?void 0:r.flag)===$r)i=r.authResponse,s=r.redirectUri;else{if(!(t instanceof URL)){const e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":const n=new URLSearchParams(await async function(e){if("POST"!==e.method)throw At("form_post responses are expected to use the POST method",Ct,{cause:e});if("application/x-www-form-urlencoded"!==Tn(e))throw At("form_post responses are expected to use the application/x-www-form-urlencoded content-type",Ct,{cause:e});return async function(e){if(e.bodyUsed)throw At("form_post Request instances must contain a readable body",Ct,{cause:e});return e.text()}(e)}(e));if(f)t.hash=n.toString();else for(const e of n.entries()){var v=S(e,2);const n=v[0],o=v[1];t.searchParams.append(n,o)}break;default:throw Ir("unexpected Request HTTP method",Rr)}}switch(s=function(e){return(e=new URL(e)).search="",e.hash="",e.href}(t),!0){case!!p:i=await p(t,null==n?void 0:n.expectedState);break;case!!f:i=await f(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!g:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,o){if(nn(e),on(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw At('"parameters" must be an instance of URLSearchParams, or URL',Pt);if(ho(n,"response"))throw Zt('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',qn,{parameters:n});const r=ho(n,"iss"),i=ho(n,"state");if(!r&&e.authorization_response_iss_parameter_supported)throw Zt('response parameter "iss" (issuer) missing',qn,{parameters:n});if(r&&r!==e.issuer)throw Zt('unexpected "iss" (issuer) response parameter value',qn,{expected:e.issuer,parameters:n});switch(o){case void 0:case fo:if(void 0!==i)throw Zt('unexpected "state" response parameter encountered',qn,{expected:void 0,parameters:n});break;case po:break;default:if(qt(o,'"expectedState" argument'),i!==o)throw Zt(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',qn,{expected:o,parameters:n})}if(ho(n,"error"))throw new hn("authorization response from the server is an error",{cause:n});const s=ho(n,"id_token"),a=ho(n,"token");if(void 0!==s||void 0!==a)throw new Jt("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),Un.add(c),c;var c}(c,u,t.searchParams,null==n?void 0:n.expectedState)}catch(e){Wr(e)}}}const b=await async function(e,t,n,o,r,i,s){if(nn(e),on(t),!Un.has(o))throw At('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',Ct);qt(r,'"redirectUri"');const a=ho(o,"code");if(!a)throw Zt('no authorization code in "callbackParameters"',qn);const c=new URLSearchParams(null==s?void 0:s.additionalParameters);return c.set("redirect_uri",r),c.set("code",a),i!==Ln&&(qt(i,'"codeVerifier"'),c.set("code_verifier",i)),Pn(e,t,n,"authorization_code",c,s)}(c,u,l,i,s,(null==n?void 0:n.pkceCodeVerifier)||Ln,{additionalParameters:o,[Ot]:d,[Rt]:!h,DPoP:null==r?void 0:r.DPoP,headers:new Headers(_r),signal:Yr(y)}).catch(Wr);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);const k=async function(e,t,n,o){return"string"==typeof(null==o?void 0:o.expectedNonce)||"number"==typeof(null==o?void 0:o.maxAge)||null!=o&&o.requireIdToken?async function(e,t,n,o,r,i,s){const a=[];switch(o){case void 0:o=Jn;break;case Jn:break;default:qt(o,'"expectedNonce" argument'),a.push("nonce")}switch(null!=r||(r=t.default_max_age),r){case void 0:r=Dn;break;case Dn:break;default:Xt(r,!0,'"maxAge" argument'),a.push("auth_time")}const c=await In(e,t,n,a,i,s);qt(c.id_token,'"response" body "id_token" property',qn,{body:c});const u=xn(c);if(r!==Dn){const e=tn()+$t(t),n=en(t);if(u.auth_time+r<e-n)throw Zt("too much time has elapsed since the last End-User authentication",eo,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(o===Jn){if(void 0!==u.nonce)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==o)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:o,claims:u,claim:"nonce"});return c}(e,t,n,o.expectedNonce,o.maxAge,o[Wt],o.recognizedTokenTypes):async function(e,t,n,o,r){const i=await In(e,t,n,void 0,o,r),s=xn(i);if(s){if(void 0!==t.default_max_age){Xt(t.default_max_age,!0,'"client.default_max_age"');const e=tn()+$t(t),n=en(t);if(s.auth_time+t.default_max_age<e-n)throw Zt("too much time has elapsed since the last End-User authentication",eo,{claims:s,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==s.nonce)throw Zt('unexpected ID Token "nonce" claim value',to,{expected:void 0,claims:s,claim:"nonce"})}return i}(e,t,n,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(c,u,b,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[Wt]:w});let T;try{T=await k}catch(t){if(Qr(t,r))return Hr(e,void 0,n,o,_(_({},r),{},{flag:$r,authResponse:i,redirectUri:s}));Wr(t)}return T.id_token&&await(null==m?void 0:m(b)),Lr(T),T}async function Fr(e,t,n,o){qr(e),n=new URLSearchParams(n);const r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.nonRepudiation,d=r.timeout,h=r.decrypt,p=await async function(e,t,n,o,r){nn(e),on(t),qt(o,'"refreshToken"');const i=new URLSearchParams(null==r?void 0:r.additionalParameters);return i.set("refresh_token",o),Pn(e,t,n,"refresh_token",i,r)}(i,s,a,t,{[Ot]:c,[Rt]:!u,additionalParameters:n,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(d)}).catch(Wr),f=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(i,s,p,{[Wt]:h});let m;try{m=await f}catch(r){if(Qr(r,o))return Fr(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return m.id_token&&await(null==l?void 0:l(p)),Lr(m),m}async function Gr(e,t,n){qr(e),t=new URLSearchParams(t);const o=Sr(e),r=o.as,i=o.c,s=o.auth,a=o.fetch,c=o.tlsOnly,u=o.timeout,l=await async function(e,t,n,o,r){return nn(e),on(t),Pn(e,t,n,"client_credentials",new URLSearchParams(o),r)}(r,i,s,t,{[Ot]:a,[Rt]:!c,DPoP:null==n?void 0:n.DPoP,headers:new Headers(_r),signal:Yr(u)}).catch(Wr),d=async function(e,t,n){return In(e,t,n,void 0,void 0,void 0)}(r,i,l);let h;try{h=await d}catch(o){if(Qr(o,n))return Gr(e,t,_(_({},n),{},{flag:$r}));Wr(o)}return Lr(h),h}function Vr(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=n.tlsOnly,s=n.hybrid,a=n.jarm,c=n.implicit,u=ln(o,"authorization_endpoint",!1,i);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",s?"code id_token":c?"id_token":"code"),c&&!t.has("nonce"))throw Ir("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",Rr);a&&t.set("response_mode","jwt")}for(const e of t.entries()){var l=S(e,2);const t=l[0],n=l[1];u.searchParams.append(t,n)}return u}async function Xr(e,t,n){qr(e);const o=Vr(e,t),r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,d=await async function(e,t,n,o,r){var i;nn(e),on(t);const s=ln(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),a=new URLSearchParams(o);a.set("client_id",t.client_id);const c=Ft(null==r?void 0:r.headers);c.set("accept","application/json"),void 0!==(null==r?void 0:r.DPoP)&&(kn(r.DPoP),await r.DPoP.addProof(s,c,"POST"));const u=await Cn(e,t,n,s,a,c,r);return null==r||null===(i=r.DPoP)||void 0===i||i.cacheNonce(u,s),u}(i,s,a,o.searchParams,{[Ot]:c,[Rt]:!u,DPoP:null==n?void 0:n.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr),h=async function(e,t,n){if(nn(e),on(t),!Et(n,Response))throw At('"response" must be an instance of Response',Pt);await _n(n,201,"Pushed Authorization Request Endpoint"),so(n);const o=await mo(n);qt(o.request_uri,'"response" body "request_uri" property',qn,{body:o});let r="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;return Xt(r,!0,'"response" body "expires_in" property',qn,{body:o}),o.expires_in=r,o}(i,s,d);let p;try{p=await h}catch(o){if(Qr(o,n))return Xr(e,t,_(_({},n),{},{flag:$r}));Wr(o)}return Vr(e,{request_uri:p.request_uri})}function qr(e){if(!(e instanceof Ur))throw Ir('"config" must be an instance of Configuration',xr);if(Object.getPrototypeOf(e)!==Ur.prototype)throw Ir("subclassing Configuration is not allowed",Rr)}function Yr(e){return e?AbortSignal.timeout(1e3*e):void 0}async function Br(e,t,n,o){qr(e);const r=Sr(e),i=r.as,s=r.c,a=r.fetch,c=r.tlsOnly,u=r.nonRepudiation,l=r.timeout,d=r.decrypt,h=await async function(e,t,n,o){nn(e),on(t);const r=ln(e,"userinfo_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==o?void 0:o[Rt])),i=Ft(null==o?void 0:o.headers);return t.userinfo_signed_response_alg?i.set("accept","application/jwt"):(i.set("accept","application/json"),i.append("accept","application/jwt")),async function(e,t,n,o,r,i){var s;if(qt(e,'"accessToken"'),!(n instanceof URL))throw At('"url" must be an instance of URL',Pt);cn(n,!0!==(null==i?void 0:i[Rt])),o=Ft(o),null!=i&&i.DPoP&&(kn(i.DPoP),await i.DPoP.addProof(n,o,"GET".toUpperCase(),e)),o.set("authorization","".concat(o.has("dpop")?"DPoP":"Bearer"," ").concat(e));const a=await((null==i?void 0:i[Ot])||fetch)(n.href,{duplex:Et(null,ReadableStream)?"half":void 0,body:null,headers:Object.fromEntries(o.entries()),method:"GET",redirect:"manual",signal:Gt(n,null==i?void 0:i.signal)});return null==i||null===(s=i.DPoP)||void 0===s||s.cacheNonce(a,n),a}(n,0,r,i,0,_(_({},o),{},{[xt]:$t(t)}))}(i,s,t,{[Ot]:a,[Rt]:!c,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr);let p,f=En(i,s,n,h,{[Wt]:d});try{p=await f}catch(r){if(Qr(r,o))return Br(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return"application/jwt"===Tn(h)&&await(null==u?void 0:u(h)),p}function Qr(e,t){return!(null==t||!t.DPoP||t.flag===$r)&&function(e){if(e instanceof pn){const t=e.cause,n=t[0];return 1===t.length&&"dpop"===n.scheme&&"use_dpop_nonce"===n.parameters.error}return e instanceof dn&&"use_dpop_nonce"===e.error}(e)}Object.freeze(Ur.prototype);const $r=Symbol();async function ei(e,t,n,o){qr(e);const r=Sr(e),i=r.as,s=r.c,a=r.auth,c=r.fetch,u=r.tlsOnly,l=r.timeout,d=r.decrypt,h=r.nonRepudiation,p=await async function(e,t,n,o,r,i){return nn(e),on(t),qt(o,'"grantType"'),Pn(e,t,n,o,new URLSearchParams(r),i)}(i,s,a,t,new URLSearchParams(n),{[Ot]:c,[Rt]:!u,DPoP:null==o?void 0:o.DPoP,headers:new Headers(_r),signal:Yr(l)}).catch(Wr);let f;"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(f={n_a:()=>{}});const m=async function(e,t,n,o){return In(e,t,n,void 0,null==o?void 0:o[Wt],null==o?void 0:o.recognizedTokenTypes)}(i,s,p,{[Wt]:d,recognizedTokenTypes:f});let y;try{y=await m}catch(r){if(Qr(r,o))return ei(e,t,n,_(_({},o),{},{flag:$r}));Wr(r)}return y.id_token&&await(null==h?void 0:h(p)),Lr(y),y}async function ti(e,t,n){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,e.subtle,!1,[n]):(function(e,t,n){var o;const r=e.algorithm;if(r.name!==t.name)throw So(t.name);if(t.hash&&(null===(o=r.hash)||void 0===o?void 0:o.name)!==t.hash)throw So(t.hash,"algorithm.hash");if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw So(t.namedCurve,"algorithm.namedCurve");if(void 0!==t.length&&r.length!==t.length)throw So(t.length,"algorithm.length");!function(e,t){if(t&&!e.usages.includes(t))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(t,"."))}(e,n)}(t,e.subtle,n),e.minRsaBits&&function(e,t){const n=t.algorithm.modulusLength;if("number"!=typeof n||n<2048)throw new TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}(e.alg,t),t)}const ni=[["verify"],["sign"]];function oi(e){const t={name:"HMAC",hash:"SHA-".concat(e)};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:ni}}function ri(e,t){const n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e)};return{kty:["RSA"],subtle:n,signing:t?_(_({},n),{},{saltLength:t}):n,usages:ni,minRsaBits:2048}}function ii(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:"SHA-".concat(t)},usages:ni}}function si(){const e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:ni}}function ai(e){const t={name:"ML-DSA-".concat(e)};return{kty:["AKP"],subtle:t,signing:t,usages:ni}}const ci=rr({HS256:oi(256),HS384:oi(384),HS512:oi(512),RS256:ri(256),RS384:ri(384),RS512:ri(512),PS256:ri(256,32),PS384:ri(384,48),PS512:ri(512,64),ES256:ii("P-256",256),ES384:ii("P-384",384),ES512:ii("P-521",512),EdDSA:si(),Ed25519:si(),"ML-DSA-44":ai(44),"ML-DSA-65":ai(65),"ML-DSA-87":ai(87)});function ui(e){const t="string"==typeof e?ci[e]:void 0;if(!t)throw new Ro("alg ".concat(e," is not supported either by JOSE or your javascript runtime"));return t}async function li(e,t,n){if(e instanceof Uint8Array&&(e=vo.decode(e)),"string"!=typeof e)throw new xo("Compact JWS must be a string or Uint8Array");const o=e.split("."),r=o[0],i=o[1],s=o[2];if(3!==o.length)throw new xo("Invalid Compact JWS");const a={payload:i,protected:r,signature:s},c=function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:void 0===e?{}:function(e,t,n){let o;try{o=JSON.parse(bo.decode(zo(e)))}catch(e){throw new t(n)}if(!Do(o))throw new t(n);return o}(e,xo,"JWS Protected Header is invalid");return t}(r),u=function(e,t,n){const o=gr(e,wr(xo,mr,n[1],e,t)),r=t.alg;if("string"!=typeof r||!r)throw new xo('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(n[0]&&!n[0].has(r))throw new Ao('"alg" (Algorithm) Header Parameter value not allowed');return[o,r]}(c,c,t),l=S(u,2),d=l[0],h=l[1],p=d?i:function(e){try{return ko(e)}catch(e){throw new xo("JWS Compact Serialization payload must use only ASCII characters")}}(i);return async function(e,t,n,o,r,i,s){var a;let c=!1;"function"==typeof n&&(n=await n(r,e),c=!0);const u="string"==typeof s,l=ui(i),d=_o(void 0!==o?ko(o):new Uint8Array,ko("."),u?null!==(a=t[2])&&void 0!==a?a:t[2]=function(e,t,n){try{return ko(e)}catch(e){throw new n("The ".concat("payload"," is not a valid base64url string"))}}(s,0,xo):s),h=Ho(e.signature,"signature",xo),p=await or(l,n,"verify");if(!await async function(e,t,n,o){const r=await ti(e,t,"verify");try{return await crypto.subtle.verify(e.signing,r,n,o)}catch(e){return!1}}(l,p,h,d))throw new No;return[u?Ho(s,"payload",xo):s,r,u,p,c]}(a,t,n,r,c,h,p)}const di=e=>Math.floor(e.getTime()/1e3),hi={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},pi=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fi="check_failed";function mi(){throw new TypeError("Invalid time period format")}function yi(e){"string"!=typeof e&&mi();const t=pi.exec(e);(!t||t[4]&&t[1])&&mi();const n=parseFloat(t[2]),o=Math.round(n*hi[t[3][0].toLowerCase()]);return Number.isFinite(o)||mi(),"-"===t[1]||"ago"===t[4]?-o:o}function wi(e,t){if(!Number.isFinite(t))throw new TypeError("Invalid ".concat(e," input"));return t}function gi(e,t){if("string"!=typeof t)throw new TypeError('"'.concat(e,'" claim must be a string'))}function vi(e,t){return"number"==typeof e?wi(t,e):e instanceof Date?wi(t,di(e)):di(new Date)+yi(e)}const bi=e=>{const t=e.toLowerCase();return e.includes("/")?t:"application/".concat(t)};function _i(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];const o=e[t];if(void 0!==o||n){if("number"!=typeof o)throw new Co('"'.concat(t,'" claim must be a number'),e,t,"invalid");return o}}function ki(e,t){throw new Co('unexpected "'.concat(t,'" claim value'),e,t,fi)}function Si(e,t){let n,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{n=JSON.parse(bo.decode(t))}catch(e){}if(!Do(n))throw new Io("JWT Claims Set must be a top-level JSON object");const r=o.typ;if(void 0!==r&&("string"!=typeof e.typ||bi(e.typ)!==bi(r)))throw new Co('unexpected "typ" JWT header value',n,"typ",fi);const i=o.requiredClaims,s=void 0===i?[]:i,a=o.issuer,c=o.subject,u=o.audience,l=o.maxTokenAge,d=[...s];void 0!==l&&d.push("iat"),void 0!==u&&d.push("aud"),void 0!==c&&d.push("sub"),void 0!==a&&d.push("iss");for(const e of new Set(d.reverse()))if(!Object.hasOwn(n,e))throw new Co('missing required "'.concat(e,'" claim'),n,e,"missing");var h,p;void 0===a||(Array.isArray(a)?a:[a]).includes(n.iss)||ki(n,"iss"),void 0!==c&&n.sub!==c&&ki(n,"sub"),void 0===u||(p="string"==typeof u?[u]:u,"string"==typeof(h=n.aud)?p.includes(h):Array.isArray(h)&&p.some(e=>h.includes(e)))||ki(n,"aud");const f=o.clockTolerance;let m=0;if("string"==typeof f)m=yi(f);else if(void 0!==f){if("number"!=typeof f)throw new TypeError("Invalid clockTolerance option type");m=f}wi("clockTolerance option",m);const y=o.currentDate,w=wi("currentDate option",di(void 0===y?new Date:y)),g=_i(n,"iat",void 0!==l),v=_i(n,"nbf");if(void 0!==v&&v>w+m)throw new Co('"nbf" claim timestamp check failed',n,"nbf",fi);const b=_i(n,"exp");if(void 0!==b&&b<=w-m)throw new Po('"exp" claim timestamp check failed',n,"exp",fi);if(void 0!==l){const e=w-g;if(e-m>wi("maxTokenAge option","number"==typeof l?l:yi(l)))throw new Po('"iat" claim timestamp check failed (too far in the past)',n,"iat",fi);if(e<-m)throw new Co('"iat" claim timestamp check failed (it should be in the past)',n,"iat",fi)}return n}let Ti;function Ei(e){return Ti.get(e)}async function Ci(e,t,n,o,r){const i=S(function(e){if(void 0===e)return[void 0,""];const t=function(e,t){let n,o;try{n=JSON.stringify(t),o=JSON.parse(n)}catch(t){throw new e("JOSE Header is not valid JSON",{cause:t})}if(!Do(o))throw new e("JOSE Header is not a JSON object");return[o,n]}(xo,e);return[t[0],Jo(t[1])]}(t),2),s=i[0],a=i[1];if(!s)throw new xo("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");(function(e,t,n){return function(e,t){const n=(null!=t?t:{}).crit;if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}(xo,e),gr(e,wr(xo,mr,n,e,t))})(s,s,n)||r();const c=function(e){const t=e.alg;if("string"!=typeof t||!t)throw new xo('JWS "alg" (Algorithm) Header Parameter missing or invalid');return ui(t)}(s),u=Jo(e),l=await async function(e,t,n,o){const r=_o(ko(e),ko("."),t),i=await or(n,o,"sign");return Jo(await async function(e,t,n){const o=await ti(e,t,"sign"),r=await crypto.subtle.sign(e.signing,o,n);return new Uint8Array(r)}(n,i,r))}(a,ko(u),c,o);return"".concat(a,".").concat(u,".").concat(l)}const Pi=class{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!Do(e))throw new TypeError("JWT Claims Set MUST be an object");(Ti||(Ti=new WeakMap)).set(this,structuredClone(e))}setIssuer(e){return gi("iss",e),Ei(this).iss=e,this}setSubject(e){return gi("sub",e),Ei(this).sub=e,this}setAudience(e){return function(e){if("string"!=typeof e&&(!Array.isArray(e)||Array.from(e).some(e=>"string"!=typeof e)))throw new TypeError('"aud" claim must be a string or an array of strings')}(e),Ei(this).aud=e,this}setJti(e){return gi("jti",e),Ei(this).jti=e,this}setNotBefore(e){return Ei(this).nbf=vi(e,"setNotBefore"),this}setExpirationTime(e){return Ei(this).exp=vi(e,"setExpirationTime"),this}setIssuedAt(e){return Ei(this).iat=void 0===e?di(new Date):"string"==typeof e?wi("setIssuedAt",di(new Date)+yi(e)):vi(e,"setIssuedAt"),this}};var Ai=new WeakMap;class Ri extends Pi{constructor(){super(...arguments),y(this,Ai,void 0)}setProtectedHeader(e){return function(e){if(void 0!==e)throw new TypeError("".concat("setProtectedHeader"," can only be called once"))}(m(Ai,this)),w(Ai,this,e),this}async sign(e,t){return Ci(function(e){const t=Ei(e);for(const e of["iat","nbf","exp"]){const n=t[e];if("number"==typeof n&&!Number.isFinite(n))throw new TypeError('"'.concat(e,'" claim must be a finite number'))}return go.encode(JSON.stringify(t))}(this),m(Ai,this),null==t?void 0:t.crit,e,()=>{throw new Io("JWTs MUST NOT use unencoded payload")})}}const xi='"alg" (Algorithm)';function Ii(){throw new Ro("Invalid or unsupported ".concat(arguments.length>0&&void 0!==arguments[0]?arguments[0]:'JWK "alg" (Algorithm) Parameter'," value"))}const Oi=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},ji=e=>{const t=e.data[e.pos++];if(void 0===t)throw new Error("Unexpected end of ASN.1 input");return t},Wi=e=>{const t=ji(e);if(128&t){const n=127&t;let o=0;for(let t=0;t<n;t++)o=o<<8|ji(e);return o}return t},Mi=(e,t,n)=>{if(ji(e)!==t)throw new Error(n)},Ni=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw new Error("Unexpected end of ASN.1 input");const n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},Ui=e=>{const t=(e=>{Mi(e,6,"Expected algorithm OID");const t=Wi(e);return Ni(e,t)})(e);if(Oi(t,[43,101,110]))return"X25519";if(!Oi(t,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mi(e,6,"Expected curve OID");const n=Wi(e),o=Ni(e,n);if(Oi(o,[42,134,72,206,61,3,1,7]))return"P-256";if(Oi(o,[43,129,4,0,34]))return"P-384";if(Oi(o,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},Li=(e,t,n)=>{const o=(e=>Lo(e.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"")))(e);return(async(e,t,n,o)=>{const r=function(e){if(void 0!==e&&"boolean"!=typeof e)throw new TypeError('"extractable" option must be a boolean');return e}(null==o?void 0:o.extractable),i=function(e,t){var n,o;return null!==(n="string"==typeof e?null!==(o=ci[e])&&void 0!==o?o:hr[e]:void 0)&&void 0!==n?n:Ii(t)}(n,xi);i.secret&&Ii(xi);const s="spki"===e;let a;if(i.resolve)try{const n={data:t,pos:0};!function(e,t){if(Mi(e,48,"Invalid ".concat("spki"===t?"SPKI":"PKCS#8"," structure")),Wi(e),"pkcs8"===t){Mi(e,2,"Expected version field");const t=Wi(e);e.pos+=t}Mi(e,48,"Expected algorithm identifier"),Wi(e)}(n,e),a=i.resolve({crv:Ui(n)})}catch(e){throw new Ro("Invalid or unsupported key format")}else a=i.subtle;return crypto.subtle.importKey(e,t,a,null!=r?r:s,i.usages[s?0:1])})("pkcs8",o,t,n)};async function Ki(e,t,n){const o=e.get(t)||e.set(t,{}).get(t),r=n.alg;if(void 0===o[r]){const e=await Fo(n,_(_({},t),{},{alg:r,ext:!0}));if("public"!==e.type)throw new Oo("JSON Web Key Set members must be public keys");o[r]=e}return o[r]}function zi(e){let t;try{t=structuredClone(e)}catch(e){}if(!Zo(t))throw new Oo("JSON Web Key Set malformed");const n=new WeakMap;return Object.defineProperty(async(e,o)=>{const r=_(_({},e),null==o?void 0:o.header),i=r.alg,s=r.kid,a="string"==typeof i?ci[i]:void 0;if(!a||a.secret)throw new Ro('Unsupported "alg" value for a JSON Web Key Set');const c=t.keys.filter(e=>function(e,t,n,o){const r=Go(e),i=r.kty,s=r.key_ops,a=r.ext,c=r.kid,u=r.alg,l=r.use,d=r.crv,h=Array.isArray(s)?[...s]:s;return(void 0===a||"boolean"==typeof a)&&(void 0===h||Array.isArray(h)&&h.every((e,t)=>"string"==typeof e&&h.indexOf(e)===t)&&h.includes("verify"))&&t.kty.includes(i)&&(void 0===o||"string"==typeof o&&o===c)&&(void 0===u?"AKP"!==i:n===u)&&(void 0===l||"sig"===l)&&(!t.crv||d===t.crv)}(e,a,i,s)),u=c[0],l=c.length;if(!l)throw new jo;if(1!==l){const e=new Wo;throw e[Symbol.asyncIterator]=T(function*(){for(const e of c)try{yield yield p(Ki(n,e,a))}catch(e){}}),e}return Ki(n,u,a)},"jwks",{value:()=>structuredClone(t)})}var Ji,Di;let Zi;if("undefined"==typeof navigator||null===(Ji=navigator.userAgent)||void 0===Ji||null===(Di=Ji.startsWith)||void 0===Di||!Di.call(Ji,"Mozilla/5.0 ")){const e="v6.2.10";Zi="".concat("jose","/").concat(e)}const Hi=Symbol(),Fi=Symbol();function Gi(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Vi(e,t,n){if(Number.isNaN(e))throw new TypeError('"'.concat(n,'" option must not be NaN'));return"number"==typeof e?e:t}async function Xi(e,t,n){if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Li(e,t,n)}const qi=["mfaToken"],Yi=["mfaToken"];var Bi,Qi,$i,es,ts,ns,os,rs,is,ss,as,cs,us,ls,ds,hs,ps,fs,ms,ys,ws,gs,vs,bs,_s,ks,Ss,Ts,Es,Cs,Ps,As,Rs,xs,Is,Os,js,Ws,Ms,Ns,Us,Ls,Ks,zs,Js,Ds,Zs,Hs,Fs,Gs,Vs,Xs;function qs(e){if("object"!=typeof e||null===e)return{};const t=e;return{statusCode:"number"==typeof t.statusCode?t.statusCode:void 0,headers:t.headers instanceof Headers?t.headers:void 0,body:"string"==typeof t.body?t.body:void 0}}function Ys(e){var t,n;if("object"!=typeof e||null===e)return{error:"unknown_error",error_description:String(e)};const o=e;let r;if(o.response instanceof Response)try{r=new Headers(o.response.headers),r.delete("set-cookie")}catch(e){r=void 0}const i={error:null!==(t=o.error)&&void 0!==t?t:"",error_description:null!==(n=o.error_description)&&void 0!==n?n:"",message:o.message,statusCode:"number"==typeof o.status?o.status:void 0,headers:r};if("mfa_required"===o.error&&o.cause){i.mfa_token="string"==typeof o.cause.mfa_token?o.cause.mfa_token:void 0;const e=o.cause.mfa_requirements;"object"==typeof e&&null!==e&&(i.mfa_requirements=e)}return i}var Bs=class extends Error{constructor(e,t){super(t),v(this,"code",void 0),this.name="NotSupportedError",this.code=e}},Qs=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},$s=class extends Qs{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},ea=class extends Qs{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},ta=class extends Qs{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},na=class extends Qs{constructor(e,t){super("token_by_password_error",e,t),this.name="TokenByPasswordError"}},oa=class extends Qs{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},ra=class extends Qs{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},ia=class extends Qs{constructor(e,t){super("token_revocation_error",e,t),this.name="TokenRevocationError"}},sa=class extends Qs{constructor(e,t){super("user_info_error",e,t),this.name="UserInfoError"}},aa=class extends Error{constructor(e){super(e),v(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},ca=class extends Qs{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),v(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},ua=class extends Qs{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},la=class extends Qs{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},da=class extends Qs{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},ha=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),v(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}},pa=class extends Error{constructor(e){super(e),v(this,"code","organization_validation_error"),this.name="OrganizationValidationError"}},fa=class extends Error{constructor(e){super(e||"fullResponse: true requested but no HTTP Response was captured. This is a bug in CapturingFetch."),v(this,"code","missing_captured_response_error"),this.name="MissingCapturedResponseError"}};function ma(e){try{const t=new Headers(e);return t.delete("set-cookie"),t}catch(e){return new Headers}}function ya(e,t,n){var o;const r="object"==typeof t&&null!==t?t:void 0,i=null!==(o=null==r?void 0:r.response)&&void 0!==o?o:n,s="number"==typeof(null==r?void 0:r.status)?r.status:null==i?void 0:i.status;"number"==typeof s&&(e.statusCode=s),null!=i&&i.headers&&(e.headers=ma(i.headers))}function wa(e){return Object.entries(e).filter(e=>void 0!==S(e,2)[1]).reduce((e,t)=>_(_({},e),{},{[t[0]]:t[1]}),{})}function ga(e){if(!e.trim())throw new pa("organization must not be blank")}function va(e,t){if(!e)return;const n=t.trim();if(n.startsWith("org_")){const t=e.org_id;if("string"!=typeof t)throw new pa("Organization Id (org_id) claim must be a string present in the ID token");if(t!==n)throw new pa('Organization Id (org_id) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}else{const t=e.org_name;if("string"!=typeof t)throw new pa("Organization Name (org_name) claim must be a string present in the ID token");if(t.toLowerCase()!==n.toLowerCase())throw new pa('Organization Name (org_name) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}}var ba=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},_a=class extends ba{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},ka=class extends ba{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},Sa=class extends ba{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},Ta=class extends ba{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}},Ea=class extends ba{constructor(e,t){super("mfa_verify_error",e,t),this.name="MfaVerifyError"}};function Ca(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var Pa=class e{constructor(e,t,n,o,r,i,s){v(this,"accessToken",void 0),v(this,"idToken",void 0),v(this,"refreshToken",void 0),v(this,"expiresAt",void 0),v(this,"scope",void 0),v(this,"claims",void 0),v(this,"authorizationDetails",void 0),v(this,"tokenType",void 0),v(this,"issuedTokenType",void 0),v(this,"recoveryCode",void 0),v(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=r,this.claims=i,this.authorizationDetails=s}static fromTokenEndpointResponse(t){const n=t.id_token?t.claims():void 0,o=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return o.tokenType=t.token_type,o.issuedTokenType=t.issued_token_type,o}};function Aa(e,t){if(!1===t.enabled)return e;const n={name:t.name,version:t.version},o=btoa(JSON.stringify(n));return async(t,n)=>{const r=t instanceof Request?new Headers(t.headers):new Headers;return null!=n&&n.headers&&new Headers(n.headers).forEach((e,t)=>{r.set(t,e)}),r.set("Auth0-Client",o),e(t,_(_({},n),{},{headers:r}))}}function Ra(e){var t,n;return!1===(null==e?void 0:e.enabled)?e:{enabled:!0,name:null!==(t=null==e?void 0:e.name)&&void 0!==t?t:"@auth0/auth0-auth-js",version:null!==(n=null==e?void 0:e.version)&&void 0!==n?n:"1.16.1"}}function xa(e){let t;const n=async(n,o)=>{const r=await e(n,o);return t=r.clone(),r};return n.getCapturedResponse=()=>t,n}function Ia(e,t,n){if(!t)return e;const o=t.signal,r=t.headers,i=t.customFetch,s=i?Aa(i,n):e;return o||r?async(e,t)=>{const n=r?new Headers(e instanceof Request?e.headers:void 0):void 0;if(n&&null!=t&&t.headers&&new Headers(t.headers).forEach((e,t)=>n.set(t,e)),r)for(const e of Object.entries(r)){var i=S(e,2);const t=i[0],o=i[1],r=t.toLowerCase();"authorization"!==r&&"auth0-client"!==r&&n.set(t,o)}const a=function(e,t){if(!e)return{signal:null!=t?t:void 0};if(!t)return{signal:e};if("undefined"!=typeof AbortSignal&&"function"==typeof AbortSignal.any)return{signal:AbortSignal.any([e,t])};const n=new AbortController,o=[e,t],r=o.find(e=>e.aborted);if(r)return n.abort(r.reason),{signal:n.signal};const i=[],s=()=>{o.forEach((e,t)=>{const n=i[t];n&&e.removeEventListener("abort",n)})};return o.forEach((e,t)=>{const o=()=>{s(),n.abort(e.reason)};i[t]=o,e.addEventListener("abort",o,{once:!0})}),{signal:n.signal,cleanup:s}}(o,null==t?void 0:t.signal);try{return await s(e,_(_(_({},t),n&&{headers:n}),{},{signal:a.signal}))}finally{var c;null===(c=a.cleanup)||void 0===c||c.call(a)}}:s}var Oa={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},ja=(Bi=new WeakMap,Qi=new WeakMap,$i=new WeakMap,es=new WeakMap,ts=new WeakMap,ns=new WeakMap,os=new WeakMap,rs=new WeakSet,class{constructor(e){var t,n;g(this,rs),y(this,Bi,void 0),y(this,Qi,void 0),y(this,$i,void 0),y(this,es,void 0),y(this,ts,void 0),y(this,ns,void 0),y(this,os,void 0),w(Bi,this,"https://".concat(e.domain)),w(Qi,this,e.clientId),w($i,this,e.clientSecret),w(es,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(ts,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ns,this,e.getConfiguration),w(os,this,e.createCaptureConfiguration)}async listAuthenticators(e,t){const n="".concat(m(Bi,this),"/mfa/authenticators"),o=e.mfaToken,r=await h(rs,this,Wa).call(this,t)(n,{method:"GET",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"}});if(!r.ok){const e=await r.clone().text(),t=r.status,n=ma(r.headers);let i;try{i=JSON.parse(e)}catch(o){throw new _a("Failed to list authenticators",{error:"unknown_error",error_description:"Failed to list authenticators",statusCode:t,headers:n,body:e})}throw new _a(i.error_description||"Failed to list authenticators",_(_({},i),{},{statusCode:t,headers:n,body:e}))}return(await r.json()).map(Ca)}async enrollAuthenticator(e,t){const n="".concat(m(Bi,this),"/mfa/associate"),o=e.mfaToken,r=k(e,qi),i={authenticator_types:r.authenticatorTypes};"oobChannels"in r&&(i.oob_channels=r.oobChannels),"phoneNumber"in r&&r.phoneNumber&&(i.phone_number=r.phoneNumber),"email"in r&&r.email&&(i.email=r.email);const s=await h(rs,this,Wa).call(this,t)(n,{method:"POST",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"},body:JSON.stringify(i)});if(!s.ok){const e=await s.clone().text(),t=s.status,n=ma(s.headers);let r;try{r=JSON.parse(e)}catch(o){throw new ka("Failed to enroll authenticator",{error:"unknown_error",error_description:"Failed to enroll authenticator",statusCode:t,headers:n,body:e})}throw new ka(r.error_description||"Failed to enroll authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}return function(e){if("otp"===e.authenticator_type)return{authenticatorType:"otp",secret:e.secret,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes,id:e.id};if("oob"===e.authenticator_type)return{authenticatorType:"oob",oobChannel:e.oob_channel,oobCode:e.oob_code,bindingMethod:e.binding_method,id:e.id,barcodeUri:e.barcode_uri,recoveryCodes:e.recovery_codes};throw new Error("Unexpected authenticator type: ".concat(e.authenticator_type))}(await s.json())}async deleteAuthenticator(e,t){const n=e.authenticatorId,o=e.mfaToken,r="".concat(m(Bi,this),"/mfa/authenticators/").concat(encodeURIComponent(n)),i=await h(rs,this,Wa).call(this,t)(r,{method:"DELETE",headers:{Authorization:"Bearer ".concat(o),"Content-Type":"application/json"}});if(!i.ok){const e=await i.clone().text(),t=i.status,n=ma(i.headers);let r;try{r=JSON.parse(e)}catch(o){throw new Sa("Failed to delete authenticator",{error:"unknown_error",error_description:"Failed to delete authenticator",statusCode:t,headers:n,body:e})}throw new Sa(r.error_description||"Failed to delete authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}}async challengeAuthenticator(e,t){const n="".concat(m(Bi,this),"/mfa/challenge"),o=e.mfaToken,r=k(e,Yi),i={mfa_token:o,client_id:m(Qi,this),challenge_type:r.challengeType};m($i,this)&&(i.client_secret=m($i,this)),r.authenticatorId&&(i.authenticator_id=r.authenticatorId);const s=await h(rs,this,Wa).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});if(!s.ok){const e=await s.clone().text(),t=s.status,n=ma(s.headers);let r;try{r=JSON.parse(e)}catch(o){throw new Ta("Failed to challenge authenticator",{error:"unknown_error",error_description:"Failed to challenge authenticator",statusCode:t,headers:n,body:e})}throw new Ta(r.error_description||"Failed to challenge authenticator",_(_({},r),{},{statusCode:t,headers:n,body:e}))}return function(e){const t={challengeType:e.challenge_type};return void 0!==e.oob_code&&(t.oobCode=e.oob_code),void 0!==e.binding_method&&(t.bindingMethod=e.binding_method),t}(await s.json())}async verify(e,t){if(!m(ns,this))throw new Error("MFA verify requires a configuration provider (getConfiguration was not set)");const n={mfa_token:e.mfaToken};if(e.audience&&(n.audience=e.audience),"otp"===e.factorType?n.otp=e.otp:"oob"===e.factorType?(n.oob_code=e.oobCode,e.bindingCode&&(n.binding_code=e.bindingCode)):"recovery-code"===e.factorType&&(n.recovery_code=e.recoveryCode),e.fullResponse){var o;if(!m(os,this))throw new Error("MFA verify fullResponse requires a capture-config factory (createCaptureConfiguration was not set)");const a=xa(null!==(o=(await m(ns,this).call(this,t))[Ar])&&void 0!==o?o:fetch),c=await m(os,this).call(this,a);try{const t=await ei(c,Oa[e.factorType],n),o=Pa.fromTokenEndpointResponse(t);t.recovery_code&&(o.recoveryCode=t.recovery_code);const r=a.getCapturedResponse();if(!r)throw new fa;return{data:o,response:r}}catch(e){var r,i,s;if(e instanceof fa)throw e;if(e instanceof Ea)throw e;const t=e,n=new Ea(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(r=t.error)&&void 0!==r?r:"mfa_verify_error",error_description:null!==(i=null!==(s=t.error_description)&&void 0!==s?s:t.message)&&void 0!==i?i:"Failed to verify MFA challenge"});throw ya(n,e,a.getCapturedResponse()),n}}const a=await m(ns,this).call(this,t);try{const t=await ei(a,Oa[e.factorType],n),o=Pa.fromTokenEndpointResponse(t);return t.recovery_code&&(o.recoveryCode=t.recovery_code),o}catch(e){var c,u,l;if(e instanceof Ea)throw e;const t=e,n=new Ea(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!==(c=t.error)&&void 0!==c?c:"mfa_verify_error",error_description:null!==(u=null!==(l=t.error_description)&&void 0!==l?l:t.message)&&void 0!==u?u:"Failed to verify MFA challenge"});throw ya(n,e),n}}});function Wa(e){return Ia(m(es,this),e,m(ts,this))}var Ma=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},Na=class extends Ma{constructor(e,t){super("passkey_register_error",e,t),this.name="PasskeyRegisterError"}},Ua=class extends Ma{constructor(e,t){super("passkey_challenge_error",e,t),this.name="PasskeyChallengeError"}},La=class extends Ma{constructor(e,t){super("passkey_get_token_error",e,t),this.name="PasskeyGetTokenError",this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}};function Ka(e){return e.useMtls?{}:e.clientSecret?{client_secret:e.clientSecret}:{}}var za="urn:okta:params:oauth:grant-type:webauthn",Ja=(is=new WeakMap,ss=new WeakMap,as=new WeakMap,cs=new WeakMap,us=new WeakMap,ls=new WeakMap,ds=new WeakSet,class{constructor(e){var t,n;g(this,ds),y(this,is,void 0),y(this,ss,void 0),y(this,as,void 0),y(this,cs,void 0),y(this,us,void 0),y(this,ls,void 0),w(is,this,"https://".concat(e.domain)),w(ss,this,e.clientId),w(as,this,{clientSecret:e.clientSecret,useMtls:e.useMtls}),w(cs,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(us,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ls,this,e.grantRequest)}async register(e,t){const n="".concat(m(is,this),"/passkey/register"),o=_(_(_(_(_(_(_(_({},e.email&&{email:e.email}),e.name&&{name:e.name}),e.phoneNumber&&{phone_number:e.phoneNumber}),e.username&&{username:e.username}),e.givenName&&{given_name:e.givenName}),e.familyName&&{family_name:e.familyName}),e.nickname&&{nickname:e.nickname}),e.picture&&{picture:e.picture}),r=_(_({client_id:m(ss,this)},Ka(m(as,this))),{},{user_profile:o});e.realm&&(r.realm=e.realm),e.organization&&(r.organization=e.organization),e.userMetadata&&(r.user_metadata=e.userMetadata);const i=await h(ds,this,Da).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const e=await h(ds,this,Za).call(this,i),t=new Na(e.error_description||"Failed to request signup challenge",e);throw t.statusCode=i.status,t.headers=ma(i.headers),t}return{authSession:(s=await i.json()).auth_session,authnParamsPublicKey:_({},s.authn_params_public_key)};var s}async challenge(e,t){const n="".concat(m(is,this),"/passkey/challenge"),o=_({client_id:m(ss,this)},Ka(m(as,this)));null!=e&&e.realm&&(o.realm=e.realm),null!=e&&e.organization&&(o.organization=e.organization);const r=await h(ds,this,Da).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok){const e=await h(ds,this,Za).call(this,r),t=new Ua(e.error_description||"Failed to request login challenge",e);throw t.statusCode=r.status,t.headers=ma(r.headers),t}return{authSession:(i=await r.json()).auth_session,authnParamsPublicKey:_({},i.authn_params_public_key)};var i}async getTokenByPasskey(e,t){void 0!==e.organization&&ga(e.organization);const n=new URLSearchParams({auth_session:e.authSession,authn_response:JSON.stringify(e.credential)});let o;e.realm&&n.append("realm",e.realm),e.scope&&n.append("scope",e.scope),e.audience&&n.append("audience",e.audience),e.organization&&n.append("organization",e.organization);try{o=await m(ls,this).call(this,za,n,t,e.fullResponse)}catch(e){if(e instanceof fa)throw e;const t=Ys(e),n=new La(t.error_description||"Failed to exchange passkey credential for tokens.",t);throw ya(n,e),n}if(e.fullResponse){const t=o;return e.organization&&va(t.data.claims,e.organization),t}const r=o;return e.organization&&va(r.claims,e.organization),r}});function Da(e){return Ia(m(cs,this),e,m(us,this))}async function Za(e){const t=await e.clone().text();try{return _(_({},JSON.parse(t)),{},{statusCode:e.status,headers:e.headers,body:t})}catch(n){return{error:"unknown_error",error_description:"HTTP ".concat(e.status," ").concat(e.statusText),statusCode:e.status,headers:e.headers,body:t}}}var Ha=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&(n.error||n.error_description)?{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}:void 0;const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},Fa=class extends Ha{constructor(e,t){super("passwordless_start_error",e,t),this.name="PasswordlessStartError"}},Ga=class extends Ha{constructor(e,t){super("passwordless_verify_error",e,t),this.name="PasswordlessVerifyError"}},Va=class extends Ha{constructor(e,t){super("passwordless_db_get_token_error",e,t),this.name="PasswordlessDbGetTokenError"}},Xa=class extends Ha{constructor(e,t,n,o,r){super("passwordless_challenge_error",e,n),v(this,"statusCode",void 0),v(this,"validationErrors",void 0),this.name="PasswordlessChallengeError",this.statusCode=t,this.validationErrors=o,this.headers=null!=r?r:this.headers}};function qa(e){return/^\+[1-9]\d{1,14}$/.test(e)}async function Ya(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await Xi(e.clientAssertionSigningKey,r);return{client_assertion:await new Ri({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}if(e.clientSecret)return{client_secret:e.clientSecret};throw new ha}var Ba=(hs=new WeakMap,ps=new WeakMap,fs=new WeakMap,ms=new WeakMap,ys=new WeakMap,ws=new WeakMap,gs=new WeakMap,vs=new WeakSet,class{constructor(e){var t,n;g(this,vs),y(this,hs,void 0),y(this,ps,void 0),y(this,fs,void 0),y(this,ms,void 0),y(this,ys,void 0),y(this,ws,void 0),y(this,gs,void 0),w(ps,this,e.domain),w(hs,this,"https://".concat(e.domain)),w(fs,this,e.clientId),w(ms,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(ys,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra()),w(ws,this,{clientSecret:e.clientSecret,clientAssertionSigningKey:e.clientAssertionSigningKey,clientAssertionSigningAlg:e.clientAssertionSigningAlg,useMtls:e.useMtls}),w(gs,this,e.grantRequest)}async sendEmail(e,t){const n=await h(vs,this,$a).call(this,function(e){var t;const n=null!==(t=e.send)&&void 0!==t?t:"code",o={email:e.email,connection:"email",send:n};return"link"===n&&e.authParams&&(o.authParams=e.authParams),o}(e),"Failed to send passwordless email",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async sendSms(e,t){if(!qa(e.phoneNumber))throw new Fa("Phone number must be in E.164 format (e.g. +14155550100).");const n=await h(vs,this,$a).call(this,function(e){return{phone_number:e.phoneNumber,connection:"sms"}}(e),"Failed to send passwordless SMS",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async challengeWithEmail(e,t){const n=function(e){var t;return{email:e.email,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t}}(e);return h(vs,this,ec).call(this,n,"Failed to request email OTP challenge",t)}async challengeWithPhoneNumber(e,t){if(!qa(e.phoneNumber))throw new Xa("Phone number must be in E.164 format (e.g. +14155550100).",0,void 0,void 0);const n=function(e){var t;const n={phone_number:e.phoneNumber,connection:e.connection,allow_signup:null!==(t=e.allowSignup)&&void 0!==t&&t};return e.deliveryMethod&&(n.delivery_method=e.deliveryMethod),n}(e);return h(vs,this,ec).call(this,n,"Failed to request phone OTP challenge",t)}async getTokenByPasswordlessDbConnection(e,t){const n=new URLSearchParams({auth_session:e.authSession,otp:e.otp});if(e.scope&&n.append("scope",e.scope),e.audience&&n.append("audience",e.audience),!m(gs,this))throw new Va("Missing grant request delegate.",Ys(new Error("missing grantRequest")));try{return await m(gs,this).call(this,"http://auth0.com/oauth/grant-type/passwordless/otp",n,t,e.fullResponse)}catch(e){if(e instanceof fa)throw e;const t=new Va("There was an error while trying to request a token.",Ys(e)),n=e;throw t.statusCode=n._statusCode,t.headers=n._headers,t}}});function Qa(e){return Ia(m(ms,this),e,m(ys,this))}async function $a(e,t,n,o){var r;const i=await Ya(m(ws,this),m(fs,this),m(ps,this)),s=_(_({client_id:m(fs,this)},e),i);let a;try{a=await h(vs,this,Qa).call(this,o)("".concat(m(hs,this),"/passwordless/start"),{method:"POST",headers:_({"Content-Type":"application/json"},n?{"x-request-language":n}:{}),body:JSON.stringify(s)})}catch(e){throw new Fa("".concat(t,": a network error occurred."))}if(a.ok)return a;const c=await a.clone().text();let u;if(204!==a.status)try{u=JSON.parse(c)}catch(e){u=void 0}const l=new Fa((null===(r=u)||void 0===r?void 0:r.error_description)||t,u);throw l.statusCode=a.status,l.headers=ma(a.headers),l.body=c,l}async function ec(e,t,n){var o,r;const i=await Ya(m(ws,this),m(fs,this),m(ps,this)),s=_(_({client_id:m(fs,this)},e),i);let a;try{a=await h(vs,this,Qa).call(this,n)("".concat(m(hs,this),"/otp/challenge"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)})}catch(e){throw new Xa("challenge error: a network error occurred.",0,void 0,void 0)}if(a.ok){let n;try{n=await a.json()}catch(e){throw new Xa("".concat(t,": could not parse the response body."),a.status,void 0,void 0,ma(a.headers))}return{authSession:n.auth_session}}const c=await a.clone().text();let u;try{u=JSON.parse(c)}catch(e){u=void 0}const l=u?_(_({},u),{},{statusCode:a.status,headers:a.headers,body:c}):{error:"",error_description:"",statusCode:a.status,headers:a.headers,body:c};throw new Xa((null===(o=u)||void 0===o?void 0:o.error_description)||t,a.status,l,null===(r=u)||void 0===r?void 0:r.validation_errors,ma(a.headers))}var tc=class extends Error{constructor(e,t,n){super(t),v(this,"cause",void 0),v(this,"code",void 0),v(this,"statusCode",void 0),v(this,"headers",void 0),v(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};const o=qs(n);this.statusCode=o.statusCode,this.headers=o.headers,this.body=o.body}},nc=class extends tc{constructor(e,t){super("signup_error",e,t),this.name="SignUpError"}},oc=class extends tc{constructor(e,t){super("change_password_error",e,t),this.name="ChangePasswordError"}};function rc(e,t,n){for(const o of t)if(null===e[o]||void 0===e[o]||""===e[o])throw new n('Required parameter "'.concat(String(o),'" was null, undefined, or empty.'))}function ic(e){var t,n;return{id:null!==(t=null!==(n=e._id)&&void 0!==n?n:e.user_id)&&void 0!==t?t:e.id,email:"string"==typeof e.email?e.email:"",emailVerified:Boolean(e.email_verified),username:e.username,givenName:e.given_name,familyName:e.family_name,name:e.name,nickname:e.nickname,picture:e.picture,userMetadata:e.user_metadata}}var sc=(bs=new WeakMap,_s=new WeakMap,ks=new WeakMap,Ss=new WeakMap,Ts=new WeakSet,class{constructor(e){var t,n;g(this,Ts),y(this,bs,void 0),y(this,_s,void 0),y(this,ks,void 0),y(this,Ss,void 0),w(bs,this,"https://".concat(e.domain)),w(_s,this,e.clientId),w(ks,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)}),w(Ss,this,null!==(n=e.telemetryConfig)&&void 0!==n?n:Ra())}async signUp(e,t){var n;rc(e,["email","password","connection"],nc);const o=_({client_id:null!==(n=e.clientId)&&void 0!==n?n:m(_s,this)},function(e){const t={email:e.email,password:e.password,connection:e.connection};return void 0!==e.username&&(t.username=e.username),void 0!==e.givenName&&(t.given_name=e.givenName),void 0!==e.familyName&&(t.family_name=e.familyName),void 0!==e.name&&(t.name=e.name),void 0!==e.nickname&&(t.nickname=e.nickname),void 0!==e.picture&&(t.picture=e.picture),void 0!==e.userMetadata&&(t.user_metadata=e.userMetadata),t}(e)),r=await h(Ts,this,ac).call(this,"/dbconnections/signup",o,nc,"Failed to sign up",t);if(e.fullResponse){const e=r.clone();return{data:ic(await r.json()),response:e}}return ic(await r.json())}async changePassword(e,t){var n;if(rc(e,["connection"],oc),!e.email&&!e.username)throw new oc('Either "email" or "username" is required.');const o=_({client_id:null!==(n=e.clientId)&&void 0!==n?n:m(_s,this)},function(e){const t={connection:e.connection};return void 0!==e.email&&(t.email=e.email),void 0!==e.username&&(t.username=e.username),void 0!==e.organization&&(t.organization=e.organization),t}(e)),r=await h(Ts,this,ac).call(this,"/dbconnections/change_password",o,oc,"Failed to request a password change",t);if(e.fullResponse){const e=r.clone();return{data:await r.text(),response:e}}return r.text()}});async function ac(e,t,n,o,r){const i=Ia(m(ks,this),r,m(Ss,this));let s;try{s=await i("".concat(m(bs,this)).concat(e),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}catch(e){throw new n("".concat(o,": a network error occurred."))}if(s.ok)return s;const a=await s.clone().text(),c=await async function(e){let t;try{t=await e.json()}catch(e){return}return"string"==typeof t.error?t:"string"==typeof t.code?{error:t.code,error_description:"string"==typeof t.description?t.description:""}:void 0}(s.clone()),u=new n((null==c?void 0:c.error_description)||o,null!=c?c:{error:"unknown_error",error_description:o});throw u.statusCode=s.status,u.headers=ma(s.headers),u.body=a,u}var cc=class extends Error{constructor(e,t,n){super(t),v(this,"code",void 0),v(this,"cause",void 0),this.name="AnonymousSessionError",this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}};async function uc(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var o;const r=null!==(o=e.clientAssertionSigningAlg)&&void 0!==o?o:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await Xi(e.clientAssertionSigningKey,r);return{client_assertion:await new Ri({}).setProtectedHeader({alg:r}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}return e.clientSecret?{client_secret:e.clientSecret}:{}}async function lc(e){const t="Request failed with status ".concat(e.status);let n={};try{n=await e.json()}catch(e){}return{error:"string"==typeof n.error?n.error:"server_error",error_description:"string"==typeof n.error_description?n.error_description:t}}var dc=(Es=new WeakMap,Cs=new WeakMap,Ps=new WeakMap,As=new WeakMap,Rs=new WeakMap,xs=new WeakMap,Is=new WeakMap,Os=new WeakMap,js=new WeakSet,class{constructor(e){var t;g(this,js),y(this,Es,void 0),y(this,Cs,void 0),y(this,Ps,void 0),y(this,As,void 0),y(this,Rs,void 0),y(this,xs,void 0),y(this,Is,void 0),y(this,Os,void 0),w(Es,this,e.domain),w(Cs,this,"https://".concat(e.domain)),w(Ps,this,e.clientId),w(As,this,e.clientSecret),w(Rs,this,e.clientAssertionSigningKey),w(xs,this,e.clientAssertionSigningAlg),w(Is,this,e.useMtls),w(Os,this,null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)})}async createSession(e){const t={client_id:m(Ps,this)};null!=e&&e.audience&&(t.audience=e.audience),null!=e&&e.scope&&(t.scope=e.scope),null!=e&&e.metadata&&(t.metadata=e.metadata);const n=await h(js,this,pc).call(this,t);if(!n.sessionToken)throw new cc("server_error","session_token missing from create session response");return{sessionToken:n.sessionToken,accessToken:n.accessToken,expiresAt:n.expiresAt,sessionTokenExpiresAt:n.sessionTokenExpiresAt,scope:n.scope}}async getAccessToken(e){return null!=e&&e.sessionToken?h(js,this,hc).call(this,e.sessionToken,e):this.createSession({audience:null==e?void 0:e.audience,scope:null==e?void 0:e.scope})}async logout(){const e="".concat(m(Cs,this),"/anonymous/logout"),t={client_id:m(Ps,this)},n=await m(Os,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(t)});if(!n.ok){const e=await lc(n);throw new cc(e.error,e.error_description||"Failed to end anonymous session",e)}}async mintTransferToken(e){const t="".concat(m(Cs,this),"/anonymous/token"),n={client_id:m(Ps,this),session_token:e,audience:"urn:auth0:anon_transfer"};try{const e=await uc({clientSecret:m(As,this),clientAssertionSigningKey:m(Rs,this),clientAssertionSigningAlg:m(xs,this),useMtls:m(Is,this)},m(Ps,this),m(Es,this));Object.assign(n,e);const o=await m(Os,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},redirect:"error",body:JSON.stringify(n)});if(!o.ok)return null;const r=await o.json();return"string"==typeof r.anon_transfer_token?r.anon_transfer_token:null}catch(e){return null}}});async function hc(e,t){const n={client_id:m(Ps,this),session_token:e};null!=t&&t.audience&&(n.audience=t.audience),null!=t&&t.scope&&(n.scope=t.scope);const o=await h(js,this,pc).call(this,n);return{sessionToken:e,accessToken:o.accessToken,expiresAt:o.expiresAt,sessionTokenExpiresAt:o.sessionTokenExpiresAt,scope:o.scope}}async function pc(e){const t="".concat(m(Cs,this),"/anonymous/token"),n=await uc({clientSecret:m(As,this),clientAssertionSigningKey:m(Rs,this),clientAssertionSigningAlg:m(xs,this),useMtls:m(Is,this)},m(Ps,this),m(Es,this));Object.assign(e,n);const o=await m(Os,this).call(this,t,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(e)});if(!o.ok){const e=await lc(o);throw new cc(e.error,e.error_description||"Anonymous token request failed",e)}let r;try{r=await o.json()}catch(e){throw new cc("server_error","Invalid response from anonymous token endpoint")}return function(e){const t=Math.floor(Date.now()/1e3);if("string"!=typeof e.access_token||!e.access_token)throw new cc("server_error","access_token missing or invalid in anonymous token response");const n=e.expires_in;if("number"!=typeof n||!Number.isFinite(n))throw new cc("server_error","expires_in missing or invalid in anonymous token response");return{accessToken:e.access_token,expiresAt:t+n,scope:e.scope,sessionToken:e.session_token,sessionTokenExpiresAt:"number"==typeof e.session_expires_in&&Number.isFinite(e.session_expires_in)?t+e.session_expires_in:void 0}}(r)}var fc=(Ws=new WeakMap,Ms=new WeakMap,Ns=new WeakMap,class{constructor(e,t){y(this,Ws,new Map),y(this,Ms,void 0),y(this,Ns,void 0),w(Ns,this,Math.max(1,Math.floor(e))),w(Ms,this,Math.max(0,Math.floor(t)))}get(e){const t=m(Ws,this).get(e);if(t){if(!(Date.now()>=t.expiresAt))return m(Ws,this).delete(e),m(Ws,this).set(e,t),t.value;m(Ws,this).delete(e)}}set(e,t,n){m(Ws,this).has(e)&&m(Ws,this).delete(e);const o=null!=n&&Number.isFinite(n)&&n>0?n:m(Ms,this);for(m(Ws,this).set(e,{value:t,expiresAt:Date.now()+o});m(Ws,this).size>m(Ns,this);){const e=m(Ws,this).keys().next().value;if(void 0===e)break;m(Ws,this).delete(e)}}}),mc=new Map;function yc(e){return{ttlMs:1e3*("number"==typeof(null==e?void 0:e.ttl)?e.ttl:600),maxEntries:"number"==typeof(null==e?void 0:e.maxEntries)&&e.maxEntries>0?e.maxEntries:100}}var wc=class{static createDiscoveryCache(e){const t=(n=e.maxEntries,o=e.ttlMs,"".concat(n,":").concat(o));var n,o;let r=(i=t,mc.get(i));var i;return r||(r=new fc(e.maxEntries,e.ttlMs),mc.set(t,r)),r}static createJwksCache(){return{}}},gc="openid profile email offline_access",vc=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function bc(e){if(null==e)throw new ra("subject_token is required");if("string"!=typeof e)throw new ra("subject_token must be a string");if(0===e.trim().length)throw new ra("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new ra("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new ra("subject_token must not include the 'Bearer ' prefix")}function _c(e,t){if(t)for(const o of Object.entries(t)){var n=S(o,2);const t=n[0],r=n[1];if(!vc.has(t))if(Array.isArray(r)){if(r.length>20)throw new ra("Parameter '".concat(t,"' exceeds maximum array size of ").concat(20));r.forEach(n=>{e.append(t,n)})}else e.append(t,r)}}var kc="urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",Sc="urn:ietf:params:oauth:grant-type:token-exchange",Tc="urn:ietf:params:oauth:token-type:access_token";function Ec(e,t){return(n,o)=>{const r=null==o?void 0:o.body;if(t!==za||!(r instanceof URLSearchParams))return e(n,o);const i={};for(const e of r){var s=S(e,2);const t=s[0],n=s[1];i[t]="authn_response"===t?JSON.parse(n):n}const a=new Headers(null==o?void 0:o.headers);return a.set("Content-Type","application/json"),e(n,_(_({},o),{},{headers:a,body:JSON.stringify(i)}))}}var Cc=(Us=new WeakMap,Ls=new WeakMap,Ks=new WeakMap,zs=new WeakMap,Js=new WeakMap,Ds=new WeakMap,Zs=new WeakMap,Hs=new WeakMap,Fs=new WeakMap,Gs=new WeakMap,Vs=new WeakMap,Xs=new WeakSet,class{constructor(e){var t;if(g(this,Xs),y(this,Us,void 0),y(this,Ls,void 0),y(this,Ks,void 0),y(this,zs,void 0),y(this,Js,void 0),y(this,Ds,void 0),y(this,Zs,void 0),y(this,Hs,void 0),y(this,Fs,void 0),y(this,Gs,void 0),y(this,Vs,void 0),v(this,"mfa",void 0),v(this,"passkey",void 0),v(this,"passwordless",void 0),v(this,"database",void 0),v(this,"anonymous",void 0),w(Js,this,e),e.useMtls&&!e.customFetch)throw new Bs("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");w(Zs,this,Ra(e.telemetry)),w(Ds,this,Aa(null!==(t=e.customFetch)&&void 0!==t?t:function(){return fetch(...arguments)},m(Zs,this)));const n=yc(e.discoveryCache);w(Fs,this,wc.createDiscoveryCache(n)),w(Gs,this,new Map),w(Vs,this,wc.createJwksCache()),this.mfa=new ja({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),getConfiguration:async e=>(await h(Xs,this,xc).call(this,e)).configuration,createCaptureConfiguration:async e=>{const t=(await h(Xs,this,Ic).call(this)).serverMetadata;return h(Xs,this,Ac).call(this,t,e)}}),this.passkey=new Ja({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,useMtls:m(Js,this).useMtls,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),grantRequest:async(e,t,n,o)=>{const r=(await h(Xs,this,Ic).call(this)).serverMetadata,i=h(Xs,this,Rc).call(this,n);if(o){const n=xa(i),o=await h(Xs,this,Ac).call(this,r,n);o[Ar]=Ec(n,e);const s=await ei(o,e,t),a=Pa.fromTokenEndpointResponse(s),c=n.getCapturedResponse();if(!c)throw new fa;return{data:a,response:c}}const s=await h(Xs,this,Ac).call(this,r);s[Ar]=Ec(i,e);const a=await ei(s,e,t);return Pa.fromTokenEndpointResponse(a)}}),this.passwordless=new Ba({domain:m(Js,this).domain,clientId:m(Js,this).clientId,customFetch:m(Ds,this),telemetryConfig:m(Zs,this),clientSecret:m(Js,this).clientSecret,clientAssertionSigningKey:m(Js,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(Js,this).clientAssertionSigningAlg,useMtls:m(Js,this).useMtls,grantRequest:async(e,t,n,o)=>{const r=(await h(Xs,this,xc).call(this,n)).configuration;if(o){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n),s=await ei(o,e,t),a=Pa.fromTokenEndpointResponse(s),c=n.getCapturedResponse();if(!c)throw new fa;return{data:a,response:c}}try{const n=await ei(r,e,t);return Pa.fromTokenEndpointResponse(n)}catch(e){const t=e,n={};throw ya(n,e),t._statusCode=n.statusCode,t._headers=n.headers,e}}}),this.database=new sc({domain:m(Js,this).domain,clientId:m(Js,this).clientId,customFetch:m(Ds,this),telemetryConfig:m(Zs,this)}),this.anonymous=new dc({domain:m(Js,this).domain,clientId:m(Js,this).clientId,clientSecret:m(Js,this).clientSecret,clientAssertionSigningKey:m(Js,this).clientAssertionSigningKey,clientAssertionSigningAlg:m(Js,this).clientAssertionSigningAlg,useMtls:m(Js,this).useMtls,customFetch:m(Ds,this)})}async getServerMetadata(){return(await h(Xs,this,Ic).call(this)).serverMetadata}async buildAuthorizationUrl(e){const t=(await h(Xs,this,Ic).call(this)).serverMetadata;if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new Bs("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await h(Xs,this,Lc).call(this,e)}catch(e){throw new ua(e)}}async buildLinkUserUrl(e){try{const t=await h(Xs,this,Lc).call(this,{authorizationParams:_(_({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new la(e)}}async buildUnlinkUserUrl(e){try{const t=await h(Xs,this,Lc).call(this,{authorizationParams:_(_({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new da(e)}}async backchannelAuthentication(e,t){var n;const o=await h(Xs,this,xc).call(this,t),r=o.configuration,i=o.serverMetadata,s=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),a=new URLSearchParams(_(_({scope:gc},s),{},{client_id:m(Js,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:i.issuer,sub:e.loginHint.sub})}));if(e.requestedExpiry&&a.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&a.append("authorization_details",JSON.stringify(e.authorizationDetails)),e.fullResponse){var c;const e=xa(null!==(c=r[Ar])&&void 0!==c?c:m(Ds,this)),n=await h(Xs,this,Ac).call(this,r.serverMetadata(),e);try{const t=await Jr(r,a),o=await Dr(n,t),i=e.getCapturedResponse();if(!i)throw new fa;return{data:Pa.fromTokenEndpointResponse(o),response:i}}catch(t){if(t instanceof fa)throw t;const n=new ca(t);throw ya(n,t,e.getCapturedResponse()),n}}const u=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),l=await h(Xs,this,Ac).call(this,r.serverMetadata(),u);try{const e=await Jr(r,a),t=await Dr(l,e);return Pa.fromTokenEndpointResponse(t)}catch(e){const t=new ca(e);throw ya(t,e,u.getCapturedResponse()),t}}async initiateBackchannelAuthentication(e,t){var n;const o=await h(Xs,this,xc).call(this,t),r=o.configuration,i=o.serverMetadata,s=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),a=new URLSearchParams(_(_({scope:gc},s),{},{client_id:m(Js,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:i.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&a.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&a.append("authorization_details",JSON.stringify(e.authorizationDetails));const c=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),u=await h(Xs,this,Ac).call(this,r.serverMetadata(),c);try{const e=await Jr(u,a);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(e){const t=new ca(e),n=c.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async backchannelAuthenticationGrant(e,t){var n;let o=e.authReqId;const r=(await h(Xs,this,xc).call(this,t)).configuration,i=new URLSearchParams({auth_req_id:o}),s=xa(null!==(n=r[Ar])&&void 0!==n?n:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const e=await ei(a,"urn:openid:params:grant-type:ciba",i);return Pa.fromTokenEndpointResponse(e)}catch(e){const t=new ca(e),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getTokenForConnection(e,t){var n;if(e.refreshToken&&e.accessToken)throw new oa("Either a refresh or access token should be specified, but not both.");const o=null!==(n=e.accessToken)&&void 0!==n?n:e.refreshToken;if(!o)throw new oa("Either a refresh or access token must be specified.");try{return await this.exchangeToken(_({connection:e.connection,subjectToken:o,subjectTokenType:e.accessToken?Tc:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint},e.fullResponse?{fullResponse:!0}:{}),t)}catch(e){if(e instanceof ra){const t=new oa(e.message,e.cause);throw t.statusCode=e.statusCode,t.headers=e.headers,t}throw e}}async exchangeToken(e,t){return e.fullResponse?"connection"in e?h(Xs,this,jc).call(this,e,t,!0):h(Xs,this,Mc).call(this,e,t,!0):"connection"in e?h(Xs,this,jc).call(this,e,t):h(Xs,this,Mc).call(this,e,t)}async getTokenByCode(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,n)).configuration;if(void 0!==t.organization&&ga(t.organization),t.fullResponse){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n);let s,a;try{const r=await Hr(o,e,{pkceCodeVerifier:t.codeVerifier});if(s=Pa.fromTokenEndpointResponse(r),a=n.getCapturedResponse(),!a)throw new fa}catch(e){if(e instanceof fa)throw e;const t=new $s("There was an error while trying to request a token.",Ys(e)),o=n.getCapturedResponse();throw t.statusCode=null==o?void 0:o.status,t.headers=o?ma(o.headers):void 0,t}return t.organization&&va(s.claims,t.organization),{data:s,response:a}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);let c;try{const n=await Hr(a,e,{pkceCodeVerifier:t.codeVerifier});c=Pa.fromTokenEndpointResponse(n)}catch(e){const t=new $s("There was an error while trying to request a token.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}return t.organization&&va(c.claims,t.organization),c}async getTokenByMagicLinkCode(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,n)).configuration;if(null!=t&&t.fullResponse){var i;const n=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),n);try{const r=await Hr(o,e,{expectedState:null==t?void 0:t.expectedState}),i=Pa.fromTokenEndpointResponse(r),s=n.getCapturedResponse();if(!s)throw new fa;return{data:i,response:s}}catch(e){if(e instanceof fa)throw e;const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.",o=new $s(t,e),r=n.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const n=await Hr(a,e,{expectedState:null==t?void 0:t.expectedState});return Pa.fromTokenEndpointResponse(n)}catch(e){const t=e instanceof Error&&e.message?e.message:"There was an error while trying to request a token.",n=new $s(t,e),o=s.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}async getTokenByRefreshToken(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r=new URLSearchParams;if(e.audience&&r.append("audience",e.audience),e.scope&&r.append("scope",e.scope),e.fullResponse){var i;const t=xa(null!==(i=o[Ar])&&void 0!==i?i:m(Ds,this)),n=await h(Xs,this,Ac).call(this,o.serverMetadata(),t);try{const o=await Fr(n,e.refreshToken,r),i=Pa.fromTokenEndpointResponse(o),s=t.getCapturedResponse();if(!s)throw new fa;return{data:i,response:s}}catch(e){if(e instanceof fa)throw e;const n=new ta("The access token has expired and there was an error while trying to refresh it.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const s=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),a=await h(Xs,this,Ac).call(this,o.serverMetadata(),s);try{const t=await Fr(a,e.refreshToken,r);return Pa.fromTokenEndpointResponse(t)}catch(e){const t=new ta("The access token has expired and there was an error while trying to refresh it.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async revokeToken(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r={};e.tokenTypeHint&&(r.token_type_hint=e.tokenTypeHint);const i=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),s=await h(Xs,this,Ac).call(this,o.serverMetadata(),i);try{await async function(e,t,n){qr(e);const o=Sr(e),r=o.as,i=o.c,s=o.auth,a=o.fetch,c=o.tlsOnly,u=o.timeout;return async function(e,t,n,o,r){nn(e),on(t),qt(o,'"token"');const i=ln(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[Rt])),s=new URLSearchParams(null==r?void 0:r.additionalParameters);s.set("token",o);const a=Ft(null==r?void 0:r.headers);return a.delete("accept"),Cn(e,t,n,i,s,a,r)}(r,i,s,t,{[Ot]:a,[Rt]:!c,additionalParameters:new URLSearchParams(n),headers:new Headers(_r),signal:Yr(u)}).then(io).catch(Wr)}(s,e.token,r)}catch(e){const t=new ia("An error occurred while trying to revoke the token.",Ys(e)),n=i.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getUserInfo(e,t){const n=(await h(Xs,this,xc).call(this,t,!0)).configuration;try{var o;return await Br(n,e.accessToken,null!==(o=e.expectedSubject)&&void 0!==o?o:Pr)}catch(e){throw new sa("There was an error while trying to retrieve the user info.",Ys(e))}}async getTokenByPassword(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration,r=new URLSearchParams({username:e.username,password:e.password});e.audience&&r.append("audience",e.audience),e.scope&&r.append("scope",e.scope),e.realm&&r.append("realm",e.realm);let i=o;if(e.auth0ForwardedFor){const t=await h(Xs,this,Uc).call(this);i=new Ur(o.serverMetadata(),m(Js,this).clientId,{client_secret:m(Js,this).clientSecret,use_mtls_endpoint_aliases:m(Js,this).useMtls},t);const n=o[Ar];i[Ar]=(t,o)=>n(t,_(_({},o),{},{headers:_(_({},o.headers),{},{"auth0-forwarded-for":e.auth0ForwardedFor})}))}if(e.fullResponse){var s;const e=xa(null!==(s=i[Ar])&&void 0!==s?s:m(Ds,this)),n=await h(Xs,this,Ac).call(this,i.serverMetadata(),e);try{const t=await ei(n,"password",r),o=Pa.fromTokenEndpointResponse(t),i=e.getCapturedResponse();if(!i)throw new fa;return{data:o,response:i}}catch(t){if(t instanceof fa)throw t;const n=new na("There was an error while trying to request a token.",Ys(t)),o=e.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const a=xa(null!==(n=i[Ar])&&void 0!==n?n:m(Ds,this)),c=await h(Xs,this,Ac).call(this,i.serverMetadata(),a);try{const e=await ei(c,"password",r);return Pa.fromTokenEndpointResponse(e)}catch(e){const t=new na("There was an error while trying to request a token.",Ys(e)),n=a.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async getTokenByPasswordlessEmail(e,t){const n=new URLSearchParams({username:e.email,otp:e.code,realm:"email"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),h(Xs,this,Nc).call(this,n,t,e.fullResponse)}async getTokenByPasswordlessSms(e,t){if(!qa(e.phoneNumber))throw new Ga("Phone number must be in E.164 format (e.g. +14155550100).");const n=new URLSearchParams({username:e.phoneNumber,otp:e.code,realm:"sms"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),h(Xs,this,Nc).call(this,n,t,e.fullResponse)}async getTokenByClientCredentials(e,t){var n;const o=(await h(Xs,this,xc).call(this,t)).configuration;if(e.fullResponse){var r;const t=xa(null!==(r=o[Ar])&&void 0!==r?r:m(Ds,this)),n=await h(Xs,this,Ac).call(this,o.serverMetadata(),t),i=new URLSearchParams({audience:e.audience});e.organization&&i.append("organization",e.organization);try{const e=await Gr(n,i),o=Pa.fromTokenEndpointResponse(e),r=t.getCapturedResponse();if(!r)throw new fa;return{data:o,response:r}}catch(e){if(e instanceof fa)throw e;const n=new ea("There was an error while trying to request a token.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const i=xa(null!==(n=o[Ar])&&void 0!==n?n:m(Ds,this)),s=await h(Xs,this,Ac).call(this,o.serverMetadata(),i);try{const t=new URLSearchParams({audience:e.audience});e.organization&&t.append("organization",e.organization);const n=await Gr(s,t);return Pa.fromTokenEndpointResponse(n)}catch(e){const t=new ea("There was an error while trying to request a token.",Ys(e)),n=i.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async buildLogoutUrl(e){const t=await h(Xs,this,Ic).call(this),n=t.configuration;if(!t.serverMetadata.end_session_endpoint){const t=new URL("https://".concat(m(Js,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",m(Js,this).clientId),e.federated&&t.searchParams.set("federated",""),t}const o={post_logout_redirect_uri:e.returnTo};return e.federated&&(o.federated=""),function(e,t){qr(e);const n=Sr(e),o=n.as,r=n.c,i=ln(o,"end_session_endpoint",!1,n.tlsOnly);(t=new URLSearchParams(t)).has("client_id")||t.set("client_id",r.client_id);for(const e of t.entries()){var s=S(e,2);const t=s[0],n=s[1];i.searchParams.append(t,n)}return i}(n,o)}async verifyLogoutToken(e){const t=(await h(Xs,this,Ic).call(this)).serverMetadata,n=yc(m(Js,this).discoveryCache),o=t.jwks_uri;m(Hs,this)||w(Hs,this,function(e,t){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");const n=new URL(e.href).href,o=null!=t?t:{},r=o.timeoutDuration;if("number"==typeof r&&(!Number.isInteger(r)||r<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');const i="number"==typeof r?r:5e3,s=Vi(o.cooldownDuration,3e4,"cooldownDuration"),a=Vi(o.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(o.headers);Zi&&!c.has("User-Agent")&&c.set("User-Agent",Zi),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");const u=o[Hi],l=o[Fi];let d,h,p,f=0,m=0;if(l&&"object"==typeof l){const e=l.uat,t=l.jwks;Gi(e,a)&&Zo(t)&&(d=e,p=zi(t))}const y=async()=>{if(h&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(h=void 0),!h){const e=++f,t=h=async function(e,t,n){let o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch;const r=await o(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(e=>{if("TimeoutError"===e.name)throw new Mo;throw e});if(200!==r.status)throw new Eo("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await r.json()}catch(e){throw new Eo("Failed to parse the JSON Web Key Set HTTP response as JSON")}}(n,c,AbortSignal.timeout(i),u).then(t=>{const n=zi(t);if(e<=m)return;p=n;const o=Date.now();l&&(l.uat=o,l.jwks=t),d=o,m=e}).finally(()=>{h===t&&(h=void 0)})}await h};return Object.defineProperties(async(e,t)=>{p&&Gi(d,a)||await y();try{return await p(e,t)}catch(n){if(n instanceof jo&&!Gi(d,s))return await y(),p(e,t);throw n}},{coolingDown:{get:()=>Gi(d,s),enumerable:!0},fresh:{get:()=>Gi(d,a),enumerable:!0},reload:{value:y,enumerable:!0},reloading:{get:()=>!!h,enumerable:!0},jwks:{value:()=>{var e;return null===(e=p)||void 0===e?void 0:e.jwks()},enumerable:!0}})}(new URL(o),{cacheMaxAge:n.ttlMs,[Hi]:m(Ds,this),[Fi]:m(Vs,this)}));const r=(await async function(e,t,n){const o=await li(e,function(e){return[e&&yr("algorithms",e.algorithms),null==e?void 0:e.crit]}(n),t);if(!o[2])throw new Io("JWTs MUST NOT use unencoded payload");const r={payload:Si(o[1],o[0],n),protectedHeader:o[1]};return"function"==typeof t?_(_({},r),{},{key:o[3]}):r}(e.logoutToken,m(Hs,this),{issuer:t.issuer,audience:m(Js,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in r)&&!("sub"in r))throw new aa('either "sid" or "sub" (or both) claims must be present');if("sid"in r&&"string"!=typeof r.sid)throw new aa('"sid" claim must be a string');if("sub"in r&&"string"!=typeof r.sub)throw new aa('"sub" claim must be a string');if("nonce"in r)throw new aa('"nonce" claim is prohibited');if(!("events"in r))throw new aa('"events" claim is missing');if("object"!=typeof r.events||null===r.events)throw new aa('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in r.events))throw new aa('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof r.events["http://schemas.openid.net/event/backchannel-logout"])throw new aa('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:r.sid,sub:r.sub}}});function Pc(){const e=m(Js,this).domain.toLowerCase();return"".concat(e,"|mtls:").concat(m(Js,this).useMtls?"1":"0")}async function Ac(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];const o=await h(Xs,this,Uc).call(this,n),r=new Ur(e,m(Js,this).clientId,{client_secret:m(Js,this).clientSecret,use_mtls_endpoint_aliases:m(Js,this).useMtls},o);return r[Ar]=null!=t?t:m(Ds,this),r}function Rc(e){return Ia(m(Ds,this),e,m(Zs,this))}async function xc(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];const n=await h(Xs,this,Ic).call(this,t),o=n.configuration,r=n.serverMetadata;if(!e)return{configuration:o,serverMetadata:r};const i=h(Xs,this,Rc).call(this,e);return{configuration:await h(Xs,this,Ac).call(this,r,i,t),serverMetadata:r}}async function Ic(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];const t=m(e?Ls:Us,this);if(t&&m(Ks,this))return{configuration:t,serverMetadata:m(Ks,this)};const n=h(Xs,this,Pc).call(this);e||await h(Xs,this,Uc).call(this,!1);const o=m(Fs,this).get(n);if(o)return h(Xs,this,Oc).call(this,o.serverMetadata,e);const r=m(Gs,this).get(n);if(r){const t=await r;return h(Xs,this,Oc).call(this,t.serverMetadata,e)}const i=(async()=>{const e=(await Mr(new URL("https://".concat(m(Js,this).domain)),m(Js,this).clientId,{use_mtls_endpoint_aliases:m(Js,this).useMtls},(e,t,n,o)=>{n.set("client_id",t.client_id)},{[Ar]:m(Ds,this)})).serverMetadata();return m(Fs,this).set(n,{serverMetadata:e}),{serverMetadata:e}})();i.catch(()=>{}),m(Gs,this).set(n,i);try{const t=(await i).serverMetadata;return h(Xs,this,Oc).call(this,t,e)}finally{m(Gs,this).delete(n)}}async function Oc(e,t){const n=await h(Xs,this,Ac).call(this,e,void 0,t);return w(Ks,this,e),w(t?Ls:Us,this,n),{configuration:n,serverMetadata:e}}async function jc(e,t,n){var o,r,i;const s=(await h(Xs,this,xc).call(this,t)).configuration;if("audience"in e||"resource"in e)throw new ra("audience and resource parameters are not supported for Token Vault exchanges");bc(e.subjectToken);const a=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!==(o=e.subjectTokenType)&&void 0!==o?o:Tc,requested_token_type:null!==(r=e.requestedTokenType)&&void 0!==r?r:"http://auth0.com/oauth/token-type/federated-connection-access-token"});if(e.loginHint&&a.append("login_hint",e.loginHint),e.scope&&a.append("scope",e.scope),_c(a,e.extra),n){var c;const t=xa(null!==(c=s[Ar])&&void 0!==c?c:m(Ds,this)),o=await h(Xs,this,Ac).call(this,s.serverMetadata(),t);try{const e=await ei(o,kc,a),n=Pa.fromTokenEndpointResponse(e),r=t.getCapturedResponse();if(!r)throw new fa;return{data:n,response:r}}catch(n){if(n instanceof fa)throw n;const o=new ra("Failed to exchange token for connection '".concat(e.connection,"'."),Ys(n)),r=t.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}}const u=xa(null!==(i=s[Ar])&&void 0!==i?i:m(Ds,this)),l=await h(Xs,this,Ac).call(this,s.serverMetadata(),u);try{const e=await ei(l,kc,a);return Pa.fromTokenEndpointResponse(e)}catch(t){const n=new ra("Failed to exchange token for connection '".concat(e.connection,"'."),Ys(t)),o=u.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}function Wc(e,t,n){var o;if(n.organization&&va(e.claims,n.organization),n.actorToken)if(null!==(o=e.claims)&&void 0!==o&&o.act)e.act=e.claims.act;else try{e.act=function(e){if("string"!=typeof e)throw new Io("JWTs must use Compact JWS serialization, JWT must be a string");const t=e.split("."),n=t[1],o=t.length;if(5===o)throw new Io("Only JWTs using Compact JWS serialization can be decoded");if(3!==o)throw new Io("Invalid JWT");if(!n)throw new Io("JWTs must contain a payload");let r,i;try{r=zo(n)}catch(e){throw new Io("Failed to base64url decode the payload")}try{i=JSON.parse(bo.decode(r))}catch(e){throw new Io("Failed to parse the decoded payload as JSON")}if(!Do(i))throw new Io("Invalid JWT Claims Set");return i}(t.access_token).act}catch(e){}return e}async function Mc(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,t)).configuration;if(bc(e.subjectToken),void 0!==e.organization&&ga(e.organization),void 0!==e.actorToken&&void 0===e.actorTokenType)throw new ra("actorTokenType is required when actorToken is provided");const i=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});if(e.audience&&i.append("audience",e.audience),e.scope&&i.append("scope",e.scope),e.requestedTokenType&&i.append("requested_token_type",e.requestedTokenType),e.organization&&i.append("organization",e.organization),e.actorToken&&i.append("actor_token",e.actorToken),e.actorTokenType&&i.append("actor_token_type",e.actorTokenType),_c(i,e.extra),n){var s;const t=xa(null!==(s=r[Ar])&&void 0!==s?s:m(Ds,this)),o=await h(Xs,this,Ac).call(this,r.serverMetadata(),t);let a,c,u;try{if(c=await ei(o,Sc,i),a=Pa.fromTokenEndpointResponse(c),u=t.getCapturedResponse(),!u)throw new fa}catch(n){if(n instanceof fa)throw n;const o=new ra("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),Ys(n)),r=t.getCapturedResponse();throw o.statusCode=null==r?void 0:r.status,o.headers=r?ma(r.headers):void 0,o}return h(Xs,this,Wc).call(this,a,c,e),{data:a,response:u}}const a=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),c=await h(Xs,this,Ac).call(this,r.serverMetadata(),a);let u,l;try{l=await ei(c,Sc,i),u=Pa.fromTokenEndpointResponse(l)}catch(t){const n=new ra("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),Ys(t)),o=a.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}return h(Xs,this,Wc).call(this,u,l,e),u}async function Nc(e,t,n){var o;const r=(await h(Xs,this,xc).call(this,t)).configuration;if(n){var i;const t=xa(null!==(i=r[Ar])&&void 0!==i?i:m(Ds,this)),n=await h(Xs,this,Ac).call(this,r.serverMetadata(),t);try{const o=await ei(n,"http://auth0.com/oauth/grant-type/passwordless/otp",e),r=Pa.fromTokenEndpointResponse(o),i=t.getCapturedResponse();if(!i)throw new fa;return{data:r,response:i}}catch(e){if(e instanceof fa)throw e;const n=new Ga("There was an error while trying to request a token.",Ys(e)),o=t.getCapturedResponse();throw n.statusCode=null==o?void 0:o.status,n.headers=o?ma(o.headers):void 0,n}}const s=xa(null!==(o=r[Ar])&&void 0!==o?o:m(Ds,this)),a=await h(Xs,this,Ac).call(this,r.serverMetadata(),s);try{const t=await ei(a,"http://auth0.com/oauth/grant-type/passwordless/otp",e);return Pa.fromTokenEndpointResponse(t)}catch(e){const t=new Ga("There was an error while trying to request a token.",Ys(e)),n=s.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?ma(n.headers):void 0,t}}async function Uc(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];const t=!!m(Js,this).clientSecret||!!m(Js,this).clientAssertionSigningKey||!!m(Js,this).useMtls;return e&&!t?(e,t,n,o)=>{n.set("client_id",t.client_id)}:(m(zs,this)||w(zs,this,(async()=>{if(!m(Js,this).clientSecret&&!m(Js,this).clientAssertionSigningKey&&!m(Js,this).useMtls)throw new ha;if(m(Js,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let e=m(Js,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await Xi(e,m(Js,this).clientAssertionSigningAlg||"RS256")),e?function(e){return sn(e,void 0)}(e):Cr(m(Js,this).clientSecret)})().catch(e=>{throw w(zs,this,void 0),e})),m(zs,this))}async function Lc(e){const t=(await h(Xs,this,Ic).call(this)).configuration,n=Bt(),o=await function(e){return async function(e){return qt(e,"codeVerifier"),zt(await crypto.subtle.digest("SHA-256",Ut(e)))}(e)}(n),r=wa(_(_({},m(Js,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(_(_({scope:gc},r),{},{client_id:m(Js,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await Xr(t,i):await Vr(t,i),codeVerifier:n}}var Kc,zc,Jc=new fc(1e3,6e4);class Dc extends W{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Dc.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new Dc(t,n)}}class Zc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Zc.prototype)}}class Hc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Hc.prototype)}}class Fc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Fc.prototype)}}class Gc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Gc.prototype)}}class Vc extends Dc{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Vc.prototype)}}class Xc{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){const t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const n of this.contexts){var t=S(n,2);const o=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(o)}}get size(){return this.contexts.size}}class qc{constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new Xc}setMFAAuthDetails(e,t,n,o){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:o})}async getAuthenticators(e){var t,n,o;const r=this.contextManager.get(e);if(!r)throw new Zc("invalid_request","MFA context not found for this MFA token");const i=null===(n=null===(t=r.mfaRequirements)||void 0===t?void 0:t.challenge)||void 0===n?void 0:n.map(e=>e.type);try{const t=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return i&&0!==i.length?t.filter(e=>!!e.type&&i.includes(e.type)):t}catch(e){if(e instanceof _a)throw new Zc(null===(o=e.cause)||void 0===o?void 0:o.error,e.message);throw e}}async enroll(e){var t;const n=function(e){const t=_t[e.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:e.mfaToken,authenticatorTypes:t.authenticatorTypes},t.oobChannels&&{oobChannels:t.oobChannels}),"phoneNumber"in e&&{phoneNumber:e.phoneNumber}),"email"in e&&{email:e.email})}(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(e){if(e instanceof ka)throw new Hc(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async challenge(e){var t;try{const t={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(t.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(t)}catch(e){if(e instanceof Ta)throw new Fc(null===(t=e.cause)||void 0===t?void 0:t.error,e.message);throw e}}async getEnrollmentFactors(e){const t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new Vc("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&0!==t.mfaRequirements.enroll.length?t.mfaRequirements.enroll:[]}async verify(e){const t=this.contextManager.get(e.mfaToken);if(!t)throw new Gc("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const n=function(e){return"otp"in e&&e.otp?"http://auth0.com/oauth/grant-type/mfa-otp":"oobCode"in e&&e.oobCode?"http://auth0.com/oauth/grant-type/mfa-oob":"recoveryCode"in e&&e.recoveryCode?"http://auth0.com/oauth/grant-type/mfa-recovery-code":void 0}(e);if(!n)throw new Gc("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const o=t.scope,r=t.audience;try{const t=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:o,audience:r,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),t}catch(e){if(e instanceof Gc)throw new Gc(e.error,e.error_description);throw e}}}class Yc extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,Yc.prototype)}}class Bc{constructor(e,t){Kc.set(this,void 0),zc.set(this,void 0),u(this,Kc,e,"f"),u(this,zc,t,"f")}async signup(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.scope,n=e.audience,o=a(e,["scope","audience"]),r=await c(this,Kc,"f").register(o),i=eu(r.authnParamsPublicKey),s=await navigator.credentials.create({publicKey:i});if(!s)throw new Yc("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");const u=nu(s);return c(this,zc,"f")._requestTokenForPasskey({authSession:r.authSession,credential:u,realm:o.realm,organization:o.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e||{},n=t.scope,o=t.audience,r=a(t,["scope","audience"]),i=await c(this,Kc,"f").challenge(Object.keys(r).length>0?r:void 0),s=tu(i.authnParamsPublicKey),u=await navigator.credentials.get({publicKey:s});if(!u)throw new Yc("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");const l=ou(u);return c(this,zc,"f")._requestTokenForPasskey({authSession:i.authSession,credential:l,realm:r.realm,organization:r.organization,scope:n,audience:o})}async getSignupChallenge(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,Kc,"f").register(e);return{authSession:t.authSession,publicKey:eu(t.authnParamsPublicKey)}}async getLoginChallenge(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=await c(this,Kc,"f").challenge(e);return{authSession:t.authSession,publicKey:tu(t.authnParamsPublicKey)}}async getTokenWithPasskey(e){if(!window.PublicKeyCredential)throw new Yc("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.authSession,n=e.credential,o=e.realm,r=e.organization,i=e.scope,s=e.audience,a=n.response;let u;if(a instanceof AuthenticatorAttestationResponse)u=nu(n);else{if(!(a instanceof AuthenticatorAssertionResponse))throw new Yc("passkey_invalid_credential","The provided credential is not a valid attestation or assertion response.");u=ou(n)}return c(this,zc,"f")._requestTokenForPasskey({authSession:t,credential:u,realm:o,organization:r,scope:i,audience:s})}}function Qc(e){const t=new Uint8Array(e),n=Array.from(t,e=>String.fromCharCode(e)).join("");return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function $c(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t+"=".repeat((4-t.length%4)%4),o=atob(n),r=new Uint8Array(o.length);for(let e=0;e<o.length;e++)r[e]=o.charCodeAt(e);return r.buffer}function eu(e){return Object.assign(Object.assign({},e),{challenge:$c(e.challenge),user:Object.assign(Object.assign({},e.user),{id:$c(e.user.id)}),pubKeyCredParams:e.pubKeyCredParams,authenticatorSelection:e.authenticatorSelection})}function tu(e){return Object.assign(Object.assign({},e),{challenge:$c(e.challenge)})}function nu(e){var t;const n=e.response;return{id:e.id,rawId:Qc(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Qc(n.clientDataJSON),attestationObject:Qc(n.attestationObject)},clientExtensionResults:e.getClientExtensionResults()}}function ou(e){var t;const n=e.response;return{id:e.id,rawId:Qc(e.rawId),type:e.type,authenticatorAttachment:null!==(t=e.authenticatorAttachment)&&void 0!==t?t:void 0,response:{clientDataJSON:Qc(n.clientDataJSON),authenticatorData:Qc(n.authenticatorData),signature:Qc(n.signature),userHandle:n.userHandle?Qc(n.userHandle):void 0},clientExtensionResults:e.getClientExtensionResults()}}function ru(e){return{get(){try{const t=window.localStorage.getItem(e);return t?JSON.parse(t):null}catch(e){return null}},set(t){try{window.localStorage.setItem(e,JSON.stringify(t))}catch(e){}},remove(){try{window.localStorage.removeItem(e)}catch(e){}}}}function iu(){let e=null;return{get:()=>e,set:t=>{e=t},remove:()=>{e=null}}}Kc=new WeakMap,zc=new WeakMap;class su{constructor(e,t){this.slots=new Map,this.baseKey="".concat("@@auth0spajs@@","::").concat(e,"::anonymous"),this.useLocalStorage="localStorage"===t&&"undefined"!=typeof window&&!!window.localStorage,this.sessionKey="".concat(this.baseKey,"::").concat("session"),this.sessionStore=this.useLocalStorage?ru(this.sessionKey):iu();const n="".concat(this.baseKey,"::").concat("session_expired");this.expiredStore=this.useLocalStorage?ru(n):iu()}getStore(e,t){const n="".concat(this.baseKey,"::").concat(JSON.stringify([null!=e?e:"",null!=t?t:""]));return this.slots.has(n)||this.slots.set(n,this.useLocalStorage?ru(n):iu()),this.slots.get(n)}getSessionToken(){return this.sessionStore.get()}setSessionToken(e){this.sessionStore.set(e),this.expiredStore.remove()}isSessionExpired(){return!!this.expiredStore.get()}markSessionExpired(){this.expiredStore.set(!0)}removeAll(){if(this.sessionStore.remove(),this.expiredStore.remove(),this.slots.forEach(e=>e.remove()),this.slots.clear(),this.useLocalStorage)try{const e=this.baseKey+"::",t=[];for(let n=0;n<window.localStorage.length;n++){const o=window.localStorage.key(n);(null==o?void 0:o.startsWith(e))&&t.push(o)}t.forEach(e=>window.localStorage.removeItem(e))}catch(e){}}}class au{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"localStorage",o=arguments.length>3?arguments[3]:void 0;this.authJsClient=e,this.clientId=t,this.cache=new su(t,n),this.lockManager=null!=o?o:ve()}async createSession(e){const t=await this.authJsClient.createSession(e);return this.cache.setSessionToken(Object.assign({sessionToken:t.sessionToken},void 0!==t.sessionTokenExpiresAt&&{sessionTokenExpiresAt:t.sessionTokenExpiresAt})),this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:t.accessToken,expiresAt:t.expiresAt},void 0!==t.scope&&{scope:t.scope})),t}async getTokenSilently(e){const t=this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope),n=t.get();return n&&n.expiresAt-60>Date.now()/1e3?n:this.lockManager.runWithLock("anonymous::".concat(this.clientId),5e3,async()=>{var n;if(this.cache.isSessionExpired())throw new cc("session_expired","The anonymous session has expired. Call createSession() to start a new one.");const o=t.get();if(o&&o.expiresAt-60>Date.now()/1e3)return o;const r=null===(n=this.cache.getSessionToken())||void 0===n?void 0:n.sessionToken;let i;try{i=await this.authJsClient.getAccessToken(Object.assign(Object.assign({},e),{sessionToken:r}))}catch(e){throw e instanceof cc&&("session_expired"===e.code||"invalid_session_token"===e.code)&&(this.cache.removeAll(),this.cache.markSessionExpired()),e}return this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})),this.cache.getSessionToken()||this.cache.setSessionToken(Object.assign({sessionToken:i.sessionToken},void 0!==i.sessionTokenExpiresAt&&{sessionTokenExpiresAt:i.sessionTokenExpiresAt})),Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})})}async mintTransferToken(){const e=this.cache.getSessionToken();return(null==e?void 0:e.sessionToken)?this.authJsClient.mintTransferToken(e.sessionToken):null}async logout(){await this.authJsClient.logout(),this.cache.removeAll()}hasSession(){var e;return!!(null===(e=this.cache.getSessionToken())||void 0===e?void 0:e.sessionToken)}getClaims(){return null}}class cu{resolveOnlineAccess(e){if("online"!==e.refreshTokenMode)return!1;if(!0!==e.useRefreshTokens)throw new M('`refreshTokenMode: "online"` requires the refresh-token grant.',"Set `useRefreshTokens: true`.");if(!0!==e.useDpop)throw new M('`refreshTokenMode: "online"` requires DPoP, which is missing or disabled.',"Set `useDpop: true` (DPoP is mandatory for online access).");return!0}warnEnterpriseConnectConfig(e){var t,n;if(!0!==e.enterpriseConnect)return;const o=null===(t=e.authorizationParams)||void 0===t?void 0:t.scope;(!0===e.useRefreshTokens||"string"==typeof o&&o.includes("offline_access"))&&console.warn("Enterprise Connect issues no refresh token; `useRefreshTokens` and `offline_access` in `scope` have no effect."),(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)&&console.warn("Enterprise Connect resolves the organization from the email domain (Home Realm Discovery); a static `organization` breaks multi-customer setups.")}constructor(e){let t,n;if(this.userCache=(new Ge).enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0,refreshTokenMode:"offline",anonymousSessionsCacheMode:"localStorage"},this.onlineAccess=this.resolveOnlineAccess(e),this.warnEnterpriseConnectConfig(e),this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!V())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===V().subtle)throw new Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),this.lockManager=ve(),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||A,!ht(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=ht(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:P,this.cookieStorage=!1===e.legacySameSiteCookie?ot:it,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieName=(e=>"auth0.".concat(e,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const r=e.useCookiesForTransactions?this.cookieStorage:st;let i="";var s;this.onlineAccess?i=x:this.options.useRefreshTokens&&(i="offline_access"),this.scope=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if("object"!=typeof e)return{[j]:ze(t,e,...o)};let i={[j]:ze(t,...o)};return Object.keys(e).forEach(n=>{const r=e[n];i[n]=ze(t,r,...o)}),i}(this.options.authorizationParams.scope,"openid",i),this.transactionManager=new Xe(r,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||O,this.cacheManager=new Ve(n,n.allKeys?void 0:new ut(n,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new yt(this.options.clientId):void 0,this.domainUrl=(s=this.options.domain,/^https?:\/\//.test(s)?s:"https://".concat(s)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);const a="".concat(this.domainUrl,"/me/"),c=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:a},detailedResponse:!0})}}));this.myAccount=new vt(c,a),this.authJsClient=new Cc({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new qc(this.authJsClient.mfa,this),this.anonymous=new au(this.authJsClient.anonymous,this.options.clientId,this.options.anonymousSessionsCacheMode,this.lockManager),this.passkey=new Bc(this.authJsClient.passkey,this),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&t===A&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new ct,this.worker.postMessage({type:"init",allowedBaseUrl:this.domainUrl}))}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const t=this.options.auth0Client||I,n=B(t,!0),o=encodeURIComponent(btoa(JSON.stringify(n)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(o)}_authorizeUrl(e){return this._url("/authorize?".concat(Q(e)))}async _verifyIdToken(e,t,n){const o=await this.nowProvider();return(e=>{if(!e.id_token)throw new Error("ID token is required but missing");const t=(e=>{const t=e.split("."),n=S(t,3),o=n[0],r=n[1],i=n[2];if(3!==t.length||!o||!r||!i)throw new Error("ID token could not be decoded");const s=JSON.parse(ee(r)),a={__raw:e},c={};return Object.keys(s).forEach(e=>{a[e]=s[e],Ye.includes(e)||(c[e]=s[e])}),{encoded:{header:o,payload:r,signature:i},header:JSON.parse(ee(o)),claims:a,user:c}})(e.id_token);if(!t.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw new Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&!qe(t.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||!qe(t.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!qe(t.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=e.leeway||60,o=new Date(e.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(t.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(null!=t.claims.nbf&&qe(t.claims.nbf)){const e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),o<e)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(e))}if(null!=t.claims.auth_time&&qe(t.claims.auth_time)){const r=new Date(0);if(r.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),o>r)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(r))}if(e.organization){const n=e.organization.trim();if(n.startsWith("org_")){const e=n;if(!t.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(e!==t.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_id,'"'))}else{const e=n.toLowerCase();if(!t.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:(r=this.options.authorizationParams.max_age,"string"!=typeof r?r:parseInt(r,10)||void 0),now:o});var r}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}_extractSessionTransferToken(e){return new URLSearchParams(window.location.search).get(e)||void 0}_clearSessionTransferTokenFromUrl(e){try{const t=new URL(window.location.href);t.searchParams.has(e)&&(t.searchParams.delete(e),window.history.replaceState({},"",t.toString()))}catch(e){}}_applySessionTransferToken(e){const t=this.options.sessionTransferTokenQueryParamName;if(!t||e.session_transfer_token)return e;const n=this._extractSessionTransferToken(t);return n?(this._clearSessionTransferTokenFromUrl(t),Object.assign(Object.assign({},e),{session_transfer_token:n})):e}async _applyAnonTransferToken(e){const t=await this.anonymous.mintTransferToken();return t?Object.assign(Object.assign({},e),{anon_transfer_token:t}):e}async _prepareAuthorizeUrl(e,t,n){var o;const r=q(X()),i=q(X()),s=X(),a=await $(s),c=te(a),u=await(null===(o=this.dpop)||void 0===o?void 0:o.calculateThumbprint()),l=((e,t,n,o,r,i,s,a,c)=>Object.assign(Object.assign(Object.assign({client_id:e.clientId},e.authorizationParams),n),{scope:Je(t,n.scope,n.audience),response_type:"code",response_mode:a||"query",state:o,nonce:r,redirect_uri:s||e.authorizationParams.redirect_uri,code_challenge:i,code_challenge_method:"S256",dpop_jkt:c}))(this.options,this.scope,e,r,i,c,e.redirect_uri||this.options.authorizationParams.redirect_uri||n,null==t?void 0:t.response_mode,u),d=this._authorizeUrl(l);return{nonce:i,code_verifier:s,scope:l.scope,audience:l.audience||j,redirect_uri:l.redirect_uri,state:r,url:d}}async loginWithPopup(e,t){var n;if(e=e||{},!(t=t||{}).popup&&(t.popup=(()=>{const e=window.screenX+(window.innerWidth-400)/2,t=window.screenY+(window.innerHeight-600)/2;return window.open("","auth0:authorize:popup","left=".concat(e,",top=").concat(t,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(),!t.popup))throw new J;const o=await this._applyAnonTransferToken(this._applySessionTransferToken(e.authorizationParams||{})),r=await this._prepareAuthorizeUrl(o,{response_mode:"web_message"},window.location.origin);t.popup.location.href=r.url;const i=await((e,t)=>new Promise((n,o)=>{let r;const i=setInterval(()=>{e.popup&&e.popup.closed&&(clearInterval(i),clearTimeout(s),window.removeEventListener("message",r,!1),o(new z(e.popup)))},1e3),s=setTimeout(()=>{clearInterval(i),o(new K(e.popup)),window.removeEventListener("message",r,!1)},1e3*(e.timeoutInSeconds||60));r=function(a){if(a.origin===t&&a.data&&"authorization_response"===a.data.type){if(clearTimeout(s),clearInterval(i),window.removeEventListener("message",r,!1),!1!==e.closePopup&&e.popup.close(),a.data.response.error)return o(W.fromPayload(a.data.response));n(a.data.response)}},window.addEventListener("message",r)}))(Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}),new URL(r.url).origin);if(r.state!==i.state)throw new W("state_mismatch","Invalid state");const s=(null===(n=e.authorizationParams)||void 0===n?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:r.audience,scope:r.scope,code_verifier:r.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:r.redirect_uri},{nonceIn:r.nonce,organization:s})}async getUser(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.user}async getIdTokenClaims(){var e;if(await this._isSessionCeilingReached())return;const t=await this._getIdTokenFromCache();return null===(e=null==t?void 0:t.decodedToken)||void 0===e?void 0:e.claims}async loginWithRedirect(){var t;const n=pt(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),o=n.openUrl,r=n.fragment,i=n.appState,s=a(n,["openUrl","fragment","appState"]),c=(null===(t=s.authorizationParams)||void 0===t?void 0:t.organization)||this.options.authorizationParams.organization,u=await this._applyAnonTransferToken(this._applySessionTransferToken(s.authorizationParams||{})),l=await this._prepareAuthorizeUrl(u),d=l.url,h=a(l,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},h),{appState:i,response_type:e.ResponseType.Code}),c&&{organization:c}));const p=r?"".concat(d,"#").concat(r):d;o?await o(p):window.location.assign(p)}async handleRedirectCallback(){const t=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===t.length)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new W("missing_transaction","Invalid state");this.transactionManager.remove();const o=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));const t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(t.join(""));return n.response_type===e.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(t,n){const o=t.code,r=t.state,i=t.error,s=t.error_description;if(i)throw new N(i,s||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new W("state_mismatch","Invalid state");const a=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:a}),{appState:n.appState,response_type:e.ResponseType.Code}}async _handleConnectAccountRedirectCallback(t,n){const o=t.connect_code,r=t.state,i=t.error,s=t.error_description;if(i)throw new U(i,s||i,n.connection,r,n.appState);if(!o)throw new W("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new W("state_mismatch","Invalid state");const a=await this.myAccount.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},a),{appState:n.appState,response_type:e.ResponseType.ConnectCode})}async _maybeCreateAnonymousSession(){if(this.options.createAnonymousSessionOnFailedSilentAuth){if(this.anonymous.hasSession())return;try{await this.anonymous.getTokenSilently()}catch(e){console.debug("[auth0-spa-js] Anonymous session creation failed",e)}}}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get(lt))return void await this._maybeCreateAnonymousSession();this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(lt)}try{await this.getTokenSilently(e)}catch(e){e instanceof W&&"login_required"===e.error&&e.error_description!==R&&await this._maybeCreateAnonymousSession()}}async getTokenSilently(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t,n;const o=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Je(this.scope,null===(t=e.authorizationParams)||void 0===t?void 0:t.scope,(null===(n=e.authorizationParams)||void 0===n?void 0:n.audience)||this.options.authorizationParams.audience)})}),r=await this._getTokenSilently(o);return e.detailedResponse?r:null==r?void 0:r.access_token}async _getTokenSilently(e){const t=e.cacheMode,n=a(e,["cacheMode"]);if(await this._isSessionCeilingReached())return;if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||j,clientId:this.options.clientId,cacheMode:t});if(e)return e}if("cache-only"===t)return;const o=(r=this.options.clientId,i=n.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(r,".").concat(i));var r,i;try{return await this.lockManager.runWithLock(o,5e3,async()=>{if("off"!==t){const e=await this._getEntryFromCache({scope:n.authorizationParams.scope,audience:n.authorizationParams.audience||j,clientId:this.options.clientId});if(e)return e}const e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(n):await this._getTokenFromIFrame(n),o=e.id_token,r=e.token_type,i=e.access_token,s=e.oauthTokenScope,a=e.expires_in;return Object.assign(Object.assign({id_token:o,token_type:r,access_token:i},s?{scope:s}:null),{expires_in:a})})}catch(e){if(this._isInteractiveError(e)&&"popup"===this.options.interactiveErrorHandler)return await this._handleInteractiveErrorWithPopup(n);throw e}}_isInteractiveError(e){return e instanceof D||e instanceof W&&this._isIframeMfaError(e)}_isIframeMfaError(e){return"login_required"===e.error&&e.error_description===R}async _handleInteractiveErrorWithPopup(e){try{await this.loginWithPopup({authorizationParams:e.authorizationParams});const t=await this._getEntryFromCache({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||j,clientId:this.options.clientId});if(!t)throw new W("interactive_handler_cache_miss","Token not found in cache after interactive authentication");return t}catch(e){throw e}}async getTokenWithPopup(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};var n,o;const r=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:Je(this.scope,null===(n=e.authorizationParams)||void 0===n?void 0:n.scope,(null===(o=e.authorizationParams)||void 0===o?void 0:o.audience)||this.options.authorizationParams.audience)})});return t=Object.assign(Object.assign({},C),t),await this.loginWithPopup(r,t),(await this.cacheManager.get(new He({scope:r.authorizationParams.scope,audience:r.authorizationParams.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const t=e.logoutParams||{},n=t.federated,o=a(t,["federated"]),r=n?"&federated":"";return this._url("/v2/logout?".concat(Q(Object.assign({clientId:e.clientId},o))))+r}async revokeRefreshToken(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!this.options.useRefreshTokens)return;const t=e.audience||this.options.authorizationParams.audience||j,n=await this.cacheManager.getRefreshTokensByAudience(t,this.options.clientId);await async function(e,t){let n=e.auth0Client,o=e.useFormData,r=e.refreshTokens,i=e.audience,s=e.client_id,a=e.onRefreshTokenRevoked;const c=e.timeout||P,u="refresh_token",l="".concat(e.baseUrl,"/oauth/revoke"),d={"Content-Type":o?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(B(n||I)))};if(t){const n={client_id:s,token_type_hint:u},r=o?Q(n):JSON.stringify(n);try{return await Me({type:"revoke",timeout:c,fetchUrl:l,fetchOptions:{method:"POST",body:r,headers:d},useFormData:o,auth:{audience:null!=i?i:j}},t)}catch(e){throw new W("revoke_error",e.message)}}for(const t of r){const n={client_id:s,token_type_hint:u,token:t},r=o?Q(n):JSON.stringify(n),i=await Ne(l,{method:"POST",body:r,headers:d},c);if(!i.ok){let t,n;try{var h=JSON.parse(await i.text());t=h.error,n=h.error_description}catch(e){}throw new W(t||"revoke_error",n||"HTTP error ".concat(i.status))}await(null==a?void 0:a(t))}}({baseUrl:this.domainUrl,timeout:this.httpTimeoutMs,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,client_id:this.options.clientId,refreshTokens:n,audience:t,onRefreshTokenRevoked:e=>this.cacheManager.stripRefreshToken(e)},this.worker),this.onlineAccess&&await this._clearLocalSession()}async logout(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};var t;this.options.enterpriseConnect&&!0!==(null===(t=e.logoutParams)||void 0===t?void 0:t.federated)&&console.warn("Enterprise Connect logout without `federated: true` leaves the enterprise IdP session alive; the next login may silently reuse the previous user.");const n=pt(e),o=n.openUrl,r=a(n,["openUrl"]);await this._clearLocalSession(e.clientId);const i=this._buildLogoutUrl(r);o?await o(i):!1!==o&&window.location.assign(i)}async _getTokenFromIFrame(e){const t=(n=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(n));var n;try{return await this.lockManager.runWithLock(t,5e3,async()=>{const t=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),n=this.cookieStorage.get(this.orgHintCookieName);n&&!t.organization&&(t.organization=n);const o=await this._prepareAuthorizeUrl(t,{response_mode:"web_message"},window.location.origin),r=o.url,i=o.state,s=o.nonce,a=o.code_verifier,c=o.redirect_uri,u=o.scope,l=o.audience;if(window.crossOriginIsolated)throw new W("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const d=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let h;try{h=new URL(this.domainUrl).origin}catch(e){h=this.domainUrl}const p=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise((o,r)=>{const i=window.document.createElement("iframe");i.setAttribute("width","0"),i.setAttribute("height","0"),i.style.display="none";const s=()=>{window.document.body.contains(i)&&(window.document.body.removeChild(i),window.removeEventListener("message",a,!1))};let a;const c=setTimeout(()=>{r(new L),s()},1e3*n);a=function(e){if(e.origin!=t)return;if(!e.data||"authorization_response"!==e.data.type)return;const n=e.source;n&&n.close(),e.data.response.error?r(W.fromPayload(e.data.response)):o(e.data.response),clearTimeout(c),window.removeEventListener("message",a,!1),setTimeout(s,2e3)},window.addEventListener("message",a,!1),window.document.body.appendChild(i),i.setAttribute("src",e)})}(r,h,d);if(i!==p.state)throw new W("state_mismatch","Invalid state");const f=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:a,code:p.code,grant_type:"authorization_code",redirect_uri:c,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:s,organization:t.organization});return Object.assign(Object.assign({},f),{scope:u,oauthTokenScope:f.scope,audience:l})})}catch(e){throw"login_required"===e.error&&(e instanceof W&&this._isIframeMfaError(e)&&"popup"===this.options.interactiveErrorHandler||this.logout({openUrl:!1})),e}}async _getTokenUsingRefreshToken(e){const t=await this.cacheManager.get(new He({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(t&&t.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new Z(e.authorizationParams.audience||j,e.authorizationParams.scope)}const n=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,o="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,r=((e,t,n,o)=>{var r;if(e&&n&&o){if(t.audience!==n)return t.scope;const e=o.split(" "),i=(null===(r=t.scope)||void 0===r?void 0:r.split(" "))||[],s=i.every(t=>e.includes(t));return e.length>=i.length&&s?o:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==t?void 0:t.audience,null==t?void 0:t.scope);try{const u=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:t&&t.refresh_token,redirect_uri:n}),o&&{timeout:o}),{scopesToRequest:r});if(await this._propagateRotatedRefreshToken(null==t?void 0:t.refresh_token,u.refresh_token),this.options.useMrrt&&(i=null==t?void 0:t.audience,s=null==t?void 0:t.scope,a=e.authorizationParams.audience,c=e.authorizationParams.scope,i!==a||!((e,t)=>{const n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every(e=>n.includes(e))})(c,s))){const t=((e,t,n)=>{const o=(null==e?void 0:e.split(" "))||[],r=n?o.filter(e=>e!==x):o,i=(null==t?void 0:t.split(" "))||[];return r.filter(e=>-1==i.indexOf(e)).join(",")})(r,u.scope,this.onlineAccess);if(t){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope),new H(e.authorizationParams.audience||"default",t)}}return Object.assign(Object.assign({},u),{scope:e.authorizationParams.scope,oauthTokenScope:u.scope,audience:e.authorizationParams.audience||j})}catch(t){if(t.message){if(t.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),t;if((t.message.includes("Missing Refresh Token")||t.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw t}var i,s,a,c}async _propagateRotatedRefreshToken(e,t){!this.onlineAccess&&t&&e&&await this.cacheManager.updateEntry(e,t,this.options.clientId,this.options.useMrrt)}async _saveEntryInCache(e){const t=e.decodedToken.claims,n=t.session_expiry,o=t.iat;if(void 0!==n){if("number"!=typeof n)throw new W("invalid_token","Invalid session_expiry: value must be a number.");if(n>=1e10)throw new W("invalid_token","Invalid session_expiry: value appears to be in milliseconds; expected a Unix timestamp in seconds.");if(void 0===o||n<=o)throw new W("invalid_token","Invalid session_expiry: session ceiling is before or at the token issue time.")}const r=e.id_token,i=e.decodedToken,s=a(e,["id_token","decodedToken"]);this.userCache.set(Ze,{id_token:r,decodedToken:i}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(s)}async _clearLocalSession(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:this.options.clientId;var t;null===e?await this.cacheManager.clear():await this.cacheManager.clear(e),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove(Ze);try{await(null===(t=this.dpop)||void 0===t?void 0:t.clear())}catch(e){}if(this.worker)try{await Me({type:"clear"},this.worker)}catch(e){}}async _isSessionCeilingReached(){var e,t;const n=this.userCache.get(Ze),o=null!=n?n:await this.cacheManager.getIdToken(new He({clientId:this.options.clientId})),r=null===(t=null===(e=null==o?void 0:o.decodedToken)||void 0===e?void 0:e.claims)||void 0===t?void 0:t.session_expiry;if(void 0===r)return!1;const i=await this.nowProvider();return Math.floor(i/1e3)>=r-30&&(await this._clearLocalSession(),!0)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||j,t=this.scope[e],n=await this.cacheManager.getIdToken(new He({clientId:this.options.clientId,audience:e,scope:t})),o=this.userCache.get(Ze);return n&&n.id_token===(null==o?void 0:o.id_token)?o:(this.userCache.set(Ze,n),n)}async _getEntryFromCache(e){let t=e.scope,n=e.audience,o=e.clientId,r=e.cacheMode;const i=await this.cacheManager.get(new He({scope:t,audience:n,clientId:o}),60,this.options.useMrrt,r);if(i&&i.access_token){const e=i.token_type,t=i.access_token,n=i.oauthTokenScope,o=i.expires_in,r=await this._getIdTokenFromCache();return r&&Object.assign(Object.assign({id_token:r.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:o})}}_storeMfaContext(e,t,n){e instanceof D&&this.mfa.setMFAAuthDetails(e.mfa_token,t,n,e.mfa_requirements)}async _requestToken(e,t){var n,o,r,i,s,a;const c=t||{},u=c.nonceIn,l=c.organization,d=c.scopesToRequest;try{const t=await Ke(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop,preserveRefreshToken:this.onlineAccess},e),{scope:d||e.scope}),this.worker);let c=await this._verifyIdToken(t.id_token,u,l);if("authorization_code"===e.grant_type){const e=await this._getIdTokenFromCache();(null===(o=null===(n=null==e?void 0:e.decodedToken)||void 0===n?void 0:n.claims)||void 0===o?void 0:o.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove(Ze))}if("authorization_code"!==e.grant_type){const e=await this._getIdTokenFromCache(),t=null===(i=null===(r=null==e?void 0:e.decodedToken)||void 0===r?void 0:r.claims)||void 0===i?void 0:i.session_expiry;void 0!==t&&(c=Object.assign(Object.assign({},c),{claims:Object.assign(Object.assign({},c.claims),{session_expiry:t})}))}return!t.refresh_token&&this.onlineAccess&&(t.refresh_token=null!==(s=e.refresh_token)&&void 0!==s?s:null===(a=await this.cacheManager.get(new He({scope:d||e.scope,audience:e.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt))||void 0===a?void 0:a.refresh_token),await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},t),{decodedToken:c,scope:e.scope,audience:e.audience||j}),t.scope?{oauthTokenScope:t.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(l||c.claims.org_id),Object.assign(Object.assign({},t),{decodedToken:c})}catch(t){throw"authorization_code"!==e.grant_type&&this._storeMfaContext(t,d||e.scope,e.audience),t}}_buildTokenExchangeParams(e){return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type}),e.actor_token&&{actor_token:e.actor_token}),e.actor_token_type&&{actor_token_type:e.actor_token_type}),{scope:Je(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}async loginWithCustomTokenExchange(e){return this._requestToken(this._buildTokenExchangeParams(e))}async customTokenExchange(e){const t=this._buildTokenExchangeParams(e);try{const n=await Ke(Object.assign(Object.assign({},t),{baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,dpop:this.dpop}),this.worker,!0);return n.id_token&&await this._verifyIdToken(n.id_token,void 0,e.organization),n}catch(e){throw this._storeMfaContext(e,t.scope,t.audience),e}}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new gt(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null===(t=null==e?void 0:e.scope)||void 0===t?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(t){const n=t.openUrl,o=t.appState,r=t.connection,i=t.scopes,s=t.authorization_params,a=t.redirectUri,c=void 0===a?this.options.authorizationParams.redirect_uri||window.location.origin:a;if(!r)throw new Error("connection is required");const u=q(X()),l=X(),d=await $(l),h=te(d),p=await this.myAccount.connectAccount({connection:r,scopes:i,redirect_uri:c,state:u,code_challenge:h,code_challenge_method:"S256",authorization_params:s}),f=p.connect_uri,m=p.connect_params,y=p.auth_session;this.transactionManager.create({state:u,code_verifier:l,auth_session:y,redirect_uri:c,appState:o,connection:r,response_type:e.ResponseType.ConnectCode});const w=new URL(f);w.searchParams.set("ticket",m.ticket),n?await n(w.toString()):window.location.assign(w)}async _requestTokenForPasskey(e){const t=e.audience||this.options.authorizationParams.audience,n=e.organization||this.options.authorizationParams.organization;return this._requestToken(Object.assign(Object.assign(Object.assign({grant_type:"urn:okta:params:oauth:grant-type:webauthn",auth_session:e.authSession,authn_response:e.credential},e.realm&&{realm:e.realm}),n&&{organization:n}),{scope:Je(this.scope,e.scope,t),audience:t}))}async _requestTokenForMfa(e,t){const n=e.mfaToken,o=a(e,["mfaToken"]),r=await this.cacheManager.get(new He({scope:o.scope,audience:o.audience||j,clientId:this.options.clientId}),void 0,this.options.useMrrt),i=await this._requestToken(Object.assign(Object.assign({},o),{mfa_token:n}),t);return await this._propagateRotatedRefreshToken(null==r?void 0:r.refresh_token,i.refresh_token),i}}var uu={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},lu=function(){throw new Error("You forgot to wrap your component in <Auth0Provider>.")},du=o(o({},uu),{buildAuthorizeUrl:lu,buildLogoutUrl:lu,getAccessTokenSilently:lu,getAccessTokenWithPopup:lu,getIdTokenClaims:lu,loginWithCustomTokenExchange:lu,customTokenExchange:lu,exchangeToken:lu,loginWithRedirect:lu,loginWithPopup:lu,connectAccountWithRedirect:lu,logout:lu,revokeRefreshToken:lu,handleRedirectCallback:lu,getDpopNonce:lu,setDpopNonce:lu,generateDpopProof:lu,createFetcher:lu,getConfiguration:lu,mfa:{getAuthenticators:lu,enroll:lu,challenge:lu,verify:lu,getEnrollmentFactors:lu},passkey:{signup:lu,login:lu},myAccount:{getFactors:lu,getAuthenticationMethods:lu,getAuthenticationMethod:lu,updateAuthenticationMethod:lu,deleteAuthenticationMethod:lu,enrollmentChallenge:lu,enrollmentVerify:lu},anonymous:{createSession:lu,getTokenSilently:lu,logout:lu,hasSession:lu,getClaims:lu,mintTransferToken:lu}}),hu=t.createContext(du),pu=function(e){function t(n,o){var r=e.call(this,null!=o?o:n)||this;return r.error=n,r.error_description=o,Object.setPrototypeOf(r,t.prototype),r}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}(t,e),t}(Error),fu=/[?&](?:connect_)?code=[^&]+/,mu=/[?&]state=[^&]+/,yu=/[?&]error=[^&]+/,wu=function(e){return function(t){if(t instanceof Error)return t;if(null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error){if("error_description"in t&&"string"==typeof t.error_description){var n=t;return new pu(n.error,n.error_description)}return new pu(t.error)}return new Error(e)}},gu=wu("Login failed"),vu=wu("Get access token failed"),bu=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!==(t=e.authorizationParams)&&void 0!==t?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null===(n=null==e?void 0:e.authorizationParams)||void 0===n?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},_u=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return o(o({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return o(o({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":case"SYNC_USER":return e.user===t.user?e:o(o({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return o(o({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return o(o({},e),{isLoading:!1,error:t.error})}},ku=function(e){var t;window.history.replaceState({},document.title,null!==(t=e.returnTo)&&void 0!==t?t:window.location.pathname)},Su=function(){var e,t,n=new Promise(function(n,o){e=n,t=o});return n.catch(function(){}),{promise:n,resolve:e,reject:t}},Tu=function(e){return void 0===e&&(e=hu),t.useContext(e)},Eu=function(){return t.createElement(t.Fragment,null)},Cu=function(){return i(void 0,void 0,void 0,function(){return s(this,function(e){return[2]})})},Pu=function(){var e=window.location.pathname.replace(/^\/\/+/,"/");return"".concat(e).concat(window.location.search)};e.AnonymousSessionError=cc,e.Auth0Context=hu,e.Auth0Provider=function(n){var a=n,c=a.children,u=a.skipRedirectCallback,l=a.onRedirectCallback,d=void 0===l?ku:l,h=a.context,p=void 0===h?hu:h,f=a.client,m=r(a,["children","skipRedirectCallback","onRedirectCallback","context","client"]);f&&(m.domain||m.clientId)&&console.warn("Auth0Provider: the `client` prop takes precedence over `domain`/`clientId` and other configuration options. Remove `domain`, `clientId`, and any other Auth0Client configuration props when using the `client` prop.");var y=t.useState(function(){return null!=f?f:new cu(function(e){return bu(e),o(o({},e),{auth0Client:{name:"auth0-react",version:"2.28.2"}})}(m))})[0],w=t.useReducer(_u,uu),g=w[0],v=w[1],b=t.useState(Su),_=b[0],k=b[1],S=t.useState(!1),T=S[0],E=S[1],C=t.useRef(!1),P=t.useRef(!1),A=t.useCallback(function(e){return v({type:"ERROR",error:e}),e},[]),R=t.useCallback(function(t,n){return i(void 0,void 0,void 0,function(){var o,i,a,c,l,h,p,f;return s(this,function(s){switch(s.label){case 0:return s.trys.push([0,7,,8]),o=void 0,n&&(void 0===m&&(m=window.location.search),(fu.test(m)||yu.test(m))&&mu.test(m))&&!u?[4,y.handleRedirectCallback()]:[3,3];case 1:return i=s.sent(),a=i.appState,c=void 0===a?{}:a,l=i.response_type,h=r(i,["appState","response_type"]),[4,y.getUser()];case 2:return o=s.sent(),c.response_type=l,l===e.ResponseType.ConnectCode&&(c.connectedAccount=h),d(c,o),[3,6];case 3:return[4,y.checkSession()];case 4:return s.sent(),[4,y.getUser()];case 5:o=s.sent(),s.label=6;case 6:return v({type:"INITIALISED",user:o}),t.resolve(),[3,8];case 7:return p=s.sent(),f=gu(p),A(f),E(!0),t.reject(f),[3,8];case 8:return[2]}var m})})},[y,d,u,A]);t.useEffect(function(){P.current||(P.current=!0,R(_,!0))},[R,_]),t.useEffect(function(){if(T&&!C.current&&g.isAuthenticated){C.current=!0;var e=Su();k(e),R(e,!1)}},[T,g.isAuthenticated,R]);var x=t.useCallback(function(e){return bu(e),y.loginWithRedirect(e)},[y]),I=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o;return s(this,function(r){switch(r.label){case 0:v({type:"LOGIN_POPUP_STARTED"}),r.label=1;case 1:return r.trys.push([1,3,,4]),[4,y.loginWithPopup(e,t)];case 2:return r.sent(),[3,4];case 3:return n=r.sent(),A(gu(n)),[2];case 4:return[4,y.getUser()];case 5:return o=r.sent(),v({type:"LOGIN_POPUP_COMPLETE",user:o}),[2]}})})},[y,A]),O=t.useCallback(function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return i(void 0,function(e,t,n){if(n||2===arguments.length)for(var o,r=0,i=t.length;r<i;r++)!o&&r in t||(o||(o=Array.prototype.slice.call(t,0,r)),o[r]=t[r]);return e.concat(o||Array.prototype.slice.call(t))}([],e,!0),void 0,function(e){return void 0===e&&(e={}),s(this,function(t){switch(t.label){case 0:return[4,y.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&v({type:"LOGOUT"}),[2]}})})},[y]),j=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n;return s(this,function(o){switch(o.label){case 0:return o.trys.push([0,,2,4]),[4,y.revokeRefreshToken(e)];case 1:return o.sent(),[3,4];case 2:return t=v,n={type:"SYNC_USER"},[4,y.getUser()];case 3:return t.apply(void 0,[(n.user=o.sent(),n)]),[7];case 4:return[2]}})})},[y]),W=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.getTokenSilently(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),M=t.useCallback(function(e,t){return i(void 0,void 0,void 0,function(){var n,o,r,i;return s(this,function(s){switch(s.label){case 0:return s.trys.push([0,2,3,5]),[4,y.getTokenWithPopup(e,t)];case 1:return n=s.sent(),[3,5];case 2:throw o=s.sent(),vu(o);case 3:return r=v,i={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return r.apply(void 0,[(i.user=s.sent(),i)]),[7];case 5:return[2,n]}})})},[y]),N=t.useCallback(function(e){return y.connectAccountWithRedirect(e)},[y]),U=t.useCallback(function(){return y.getIdTokenClaims()},[y]),L=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.loginWithCustomTokenExchange(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),K=t.useCallback(function(e){return y.customTokenExchange(e)},[y]),z=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){return s(this,function(t){return[2,L(e)]})})},[L]),J=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o;return s(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,y.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw t=r.sent(),vu(t);case 3:return n=v,o={type:"HANDLE_REDIRECT_COMPLETE"},[4,y.getUser()];case 4:return n.apply(void 0,[(o.user=r.sent(),o)]),[7];case 5:return[2]}})})},[y]),D=t.useCallback(function(e){return y.getDpopNonce(e)},[y]),Z=t.useCallback(function(e,t){return y.setDpopNonce(e,t)},[y]),H=t.useCallback(function(e){return y.generateDpopProof(e)},[y]),F=t.useCallback(function(e){return y.createFetcher(e)},[y]),G=t.useCallback(function(){return y.getConfiguration()},[y]),V=t.useMemo(function(){return y.mfa},[y]),X=t.useMemo(function(){return y.myAccount},[y]),q=t.useMemo(function(){return y.anonymous},[y]),Y=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.signup(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),B=t.useCallback(function(e){return i(void 0,void 0,void 0,function(){var t,n,o,r;return s(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,y.passkey.login(e)];case 1:return t=i.sent(),[3,5];case 2:throw n=i.sent(),vu(n);case 3:return o=v,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,y.getUser()];case 4:return o.apply(void 0,[(r.user=i.sent(),r)]),[7];case 5:return[2,t]}})})},[y]),Q=t.useMemo(function(){return{signup:Y,login:B}},[Y,B]),$=t.useMemo(function(){return o(o({},g),{getAccessTokenSilently:W,getAccessTokenWithPopup:M,getIdTokenClaims:U,loginWithCustomTokenExchange:L,customTokenExchange:K,exchangeToken:z,loginWithRedirect:x,loginWithPopup:I,connectAccountWithRedirect:N,logout:O,revokeRefreshToken:j,handleRedirectCallback:J,getDpopNonce:D,setDpopNonce:Z,generateDpopProof:H,createFetcher:F,getConfiguration:G,mfa:V,passkey:Q,myAccount:X,anonymous:q,_initPromise:_.promise})},[g,W,M,U,L,K,z,x,I,N,O,j,J,D,Z,H,F,G,V,Q,X,q,_]);return t.createElement(p.Provider,{value:$},c)},e.AuthenticationError=N,e.ConnectError=U,e.GenericError=W,e.InMemoryCache=Ge,e.InvalidConfigurationError=M,e.LocalStorageCache=Fe,e.MfaChallengeError=Fc,e.MfaEnrollmentError=Hc,e.MfaEnrollmentFactorsError=Vc,e.MfaError=Dc,e.MfaListAuthenticatorsError=Zc,e.MfaRequiredError=D,e.MfaVerifyError=Gc,e.MissingRefreshTokenError=Z,e.MissingScopesError=H,e.MyAccountApiError=bt,e.OAuthError=pu,e.PasskeyChallengeError=Ua,e.PasskeyError=Yc,e.PasskeyGetTokenError=La,e.PasskeyRegisterError=Na,e.PopupCancelledError=z,e.PopupOpenError=J,e.PopupTimeoutError=K,e.RefreshTokenMode={Offline:"offline",Online:"online"},e.TimeoutError=L,e.UseDpopNonceError=F,e.User=class{},e.initialContext=du,e.useAuth0=Tu,e.useAuth0Suspense=function(e){if(void 0===e&&(e=hu),"function"!=typeof t.use)throw new Error("useAuth0Suspense requires React 19 or later (React.use is unavailable).");var n=t.useContext(e);if(!n._initPromise)throw new Error("useAuth0Suspense must be used within an <Auth0Provider>.");return t.use(n._initPromise),t.useMemo(function(){return n.isLoading,n._initPromise,r(n,["isLoading","_initPromise"])},[n])},e.useEnterpriseConnect=function(e){void 0===e&&(e=hu);var n=t.useContext(e),r=n.getConfiguration,i=n.loginWithRedirect,s=t.useCallback(function(e,t){return function(e,t,n){var o;return async function(e,t,n){const o=t.toLowerCase(),r=e.replace(/^https?:\/\//,""),i="".concat(r,"|").concat(o),s=Jc.get(i);if(void 0!==s)return s;try{var a;const e=new URL("https://".concat(r,"/.well-known/webfinger"));e.searchParams.set("resource","urn:auth0:discovery:domain:".concat(o)),e.searchParams.set("rel","http://openid.net/specs/connect/1.0/issuer");let t=null!==(a=null==n?void 0:n.customFetch)&&void 0!==a?a:globalThis.fetch;null!=n&&n.telemetry&&!1!==n.telemetry.enabled&&(t=Aa(t,n.telemetry));const s=await t(e.toString());return s.ok?(Jc.set(i,!0),!0):404===s.status?(Jc.set(i,!1,15e3),!1):429===s.status&&(console.warn("[Auth0] isFederatedDomain: rate limit hit (429)"),!1)}catch(e){return!1}}(e.replace(/^https?:\/\//i,"").toLowerCase(),t.toLowerCase(),Object.assign(Object.assign({},n),{telemetry:null!==(o=null==n?void 0:n.telemetry)&&void 0!==o?o:I}))}(r().domain,e,t)},[r]);return{isFederatedDomain:s,loginWithSSO:t.useCallback(function(e,t){return i(o(o({},t),{authorizationParams:o(o({},null==t?void 0:t.authorizationParams),{login_hint:e})}))},[i])}},e.withAuth0=function(e,n){return void 0===n&&(n=hu),function(r){return t.createElement(n.Consumer,null,function(n){return t.createElement(e,o({},r,{auth0:n}))})}},e.withAuthenticationRequired=function(e,n){return void 0===n&&(n={}),function(r){var a=this,c=n.returnTo,u=void 0===c?Pu:c,l=n.onRedirecting,d=void 0===l?Eu:l,h=n.onBeforeAuthentication,p=void 0===h?Cu:h,f=n.loginOptions,m=n.context,y=Tu(void 0===m?hu:m),w=y.isAuthenticated,g=y.isLoading,v=y.loginWithRedirect;return t.useEffect(function(){if(!g&&!w){var e=o(o({},f),{appState:o(o({},null==f?void 0:f.appState),{returnTo:"function"==typeof u?u():u})});i(a,void 0,void 0,function(){return s(this,function(t){switch(t.label){case 0:return[4,p()];case 1:return t.sent(),[4,v(e)];case 2:return t.sent(),[2]}})})}},[g,w,v,p,f,u]),w?t.createElement(e,o({},r)):d()}}});
2
2
  //# sourceMappingURL=auth0-react.min.js.map