@wandelbots/wandelbots-js-react-components 4.3.0 → 4.4.0

package/dist/auth0-spa-js.production.esm-D_IhPirK.cjs

@@ -1,5 +0,0 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function X(t,e){var n={};for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&e.indexOf(o)<0&&(n[o]=t[o]);if(t!=null&&typeof Object.getOwnPropertySymbols=="function"){var r=0;for(o=Object.getOwnPropertySymbols(t);r<o.length;r++)e.indexOf(o[r])<0&&Object.prototype.propertyIsEnumerable.call(t,o[r])&&(n[o[r]]=t[o[r]])}return n}const Pr={timeoutInSeconds:60},xo={name:"auth0-spa-js",version:"2.15.0"},Co=()=>Date.now();class O extends Error{constructor(e,n){super(n),this.error=e,this.error_description=n,Object.setPrototypeOf(this,O.prototype)}static fromPayload(e){let{error:n,error_description:o}=e;return new O(n,o)}}class Nt extends O{constructor(e,n,o){let r=arguments.length>3&&arguments[3]!==void 0?arguments[3]:null;super(e,n),this.state=o,this.appState=r,Object.setPrototypeOf(this,Nt.prototype)}}class Wt extends O{constructor(e,n,o,r){let i=arguments.length>4&&arguments[4]!==void 0?arguments[4]:null;super(e,n),this.connection=o,this.state=r,this.appState=i,Object.setPrototypeOf(this,Wt.prototype)}}class je extends O{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,je.prototype)}}class zt extends je{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,zt.prototype)}}class Ht extends O{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,Ht.prototype)}}class Mt extends O{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,Mt.prototype)}}class Ve extends O{constructor(e,n,o,r){super(e,n),this.mfa_token=o,this.mfa_requirements=r,Object.setPrototypeOf(this,Ve.prototype)}}class ct extends O{constructor(e,n){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(Ot(e,["default"]),"', scope: '").concat(Ot(n),"')")),this.audience=e,this.scope=n,Object.setPrototypeOf(this,ct.prototype)}}class Wn extends O{constructor(e,n){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(Ot(e,["default"]),"', missing scope: '").concat(Ot(n),"')")),this.audience=e,this.scope=n,Object.setPrototypeOf(this,Wn.prototype)}}class ut extends O{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,ut.prototype)}}function Ot(t){let e=arguments.length>1&&arguments[1]!==void 0?arguments[1]:[];return t&&!e.includes(t)?t:""}const xt=()=>window.crypto,Ge=()=>{const t="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~.";let e="";return Array.from(xt().getRandomValues(new Uint8Array(43))).forEach((n=>e+=t[n%t.length])),e},Xt=t=>btoa(t),Rr=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],jo=function(t){let e=arguments.length>1&&arguments[1]!==void 0&&arguments[1];return Object.keys(t).reduce(((n,o)=>{if(e&&o==="env")return n;const r=Rr.find((i=>i.key===o));return r&&r.type.includes(typeof t[o])&&(n[o]=t[o]),n}),{})},kn=t=>{var{clientId:e}=t,n=X(t,["clientId"]);return new URLSearchParams((o=>Object.keys(o).filter((r=>o[r]!==void 0)).reduce(((r,i)=>Object.assign(Object.assign({},r),{[i]:o[i]})),{}))(Object.assign({client_id:e},n))).toString()},$n=async t=>await xt().subtle.digest({name:"SHA-256"},new TextEncoder().encode(t)),eo=t=>(e=>decodeURIComponent(atob(e).split("").map((n=>"%"+("00"+n.charCodeAt(0).toString(16)).slice(-2))).join("")))(t.replace(/_/g,"/").replace(/-/g,"+")),to=t=>{const e=new Uint8Array(t);return(n=>{const o={"+":"-","/":"_","=":""};return n.replace(/[+/=]/g,(r=>o[r]))})(window.btoa(String.fromCharCode(...Array.from(e))))};var Ce=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},Do={},zn={};Object.defineProperty(zn,"__esModule",{value:!0});var Ir=(function(){function t(){var e=this;this.locked=new Map,this.addToLocked=function(n,o){var r=e.locked.get(n);r===void 0?o===void 0?e.locked.set(n,[]):e.locked.set(n,[o]):o!==void 0&&(r.unshift(o),e.locked.set(n,r))},this.isLocked=function(n){return e.locked.has(n)},this.lock=function(n){return new Promise((function(o,r){e.isLocked(n)?e.addToLocked(n,o):(e.addToLocked(n),o())}))},this.unlock=function(n){var o=e.locked.get(n);if(o!==void 0&&o.length!==0){var r=o.pop();e.locked.set(n,o),r!==void 0&&setTimeout(r,0)}else e.locked.delete(n)}}return t.getInstance=function(){return t.instance===void 0&&(t.instance=new t),t.instance},t})();zn.default=function(){return Ir.getInstance()};var Y=Ce&&Ce.__awaiter||function(t,e,n,o){return new(n||(n=Promise))((function(r,i){function a(u){try{c(o.next(u))}catch(l){i(l)}}function s(u){try{c(o.throw(u))}catch(l){i(l)}}function c(u){u.done?r(u.value):new n((function(l){l(u.value)})).then(a,s)}c((o=o.apply(t,e||[])).next())}))},Q=Ce&&Ce.__generator||function(t,e){var n,o,r,i,a={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]};return i={next:s(0),throw:s(1),return:s(2)},typeof Symbol=="function"&&(i[Symbol.iterator]=function(){return this}),i;function s(c){return function(u){return(function(l){if(n)throw new TypeError("Generator is already executing.");for(;a;)try{if(n=1,o&&(r=2&l[0]?o.return:l[0]?o.throw||((r=o.return)&&r.call(o),0):o.next)&&!(r=r.call(o,l[1])).done)return r;switch(o=0,r&&(l=[2&l[0],r.value]),l[0]){case 0:case 1:r=l;break;case 4:return a.label++,{value:l[1],done:!1};case 5:a.label++,o=l[1],l=[0];continue;case 7:l=a.ops.pop(),a.trys.pop();continue;default:if(r=a.trys,!((r=r.length>0&&r[r.length-1])||l[0]!==6&&l[0]!==2)){a=0;continue}if(l[0]===3&&(!r||l[1]>r[0]&&l[1]<r[3])){a.label=l[1];break}if(l[0]===6&&a.label<r[1]){a.label=r[1],r=l;break}if(r&&a.label<r[2]){a.label=r[2],a.ops.push(l);break}r[2]&&a.ops.pop(),a.trys.pop();continue}l=e.call(t,a)}catch(m){l=[6,m],o=0}finally{n=r=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}})([c,u])}}},Ze=Ce;Object.defineProperty(Do,"__esModule",{value:!0});var Ke=zn,wt={key:function(t){return Y(Ze,void 0,void 0,(function(){return Q(this,(function(e){throw new Error("Unsupported")}))}))},getItem:function(t){return Y(Ze,void 0,void 0,(function(){return Q(this,(function(e){throw new Error("Unsupported")}))}))},clear:function(){return Y(Ze,void 0,void 0,(function(){return Q(this,(function(t){return[2,window.localStorage.clear()]}))}))},removeItem:function(t){return Y(Ze,void 0,void 0,(function(){return Q(this,(function(e){throw new Error("Unsupported")}))}))},setItem:function(t,e){return Y(Ze,void 0,void 0,(function(){return Q(this,(function(n){throw new Error("Unsupported")}))}))},keySync:function(t){return window.localStorage.key(t)},getItemSync:function(t){return window.localStorage.getItem(t)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(t){return window.localStorage.removeItem(t)},setItemSync:function(t,e){return window.localStorage.setItem(t,e)}};function Yt(t){return new Promise((function(e){return setTimeout(e,t)}))}function Qt(t){for(var e="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz",n="",o=0;o<t;o++)n+=e[Math.floor(Math.random()*e.length)];return n}var Or=(function(){function t(e){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+Qt(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=e,t.waiters===void 0&&(t.waiters=[])}return t.prototype.acquireLock=function(e,n){return n===void 0&&(n=5e3),Y(this,void 0,void 0,(function(){var o,r,i,a,s,c,u;return Q(this,(function(l){switch(l.label){case 0:o=Date.now()+Qt(4),r=Date.now()+n,i="browser-tabs-lock-key-"+e,a=this.storageHandler===void 0?wt:this.storageHandler,l.label=1;case 1:return Date.now()<r?[4,Yt(30)]:[3,8];case 2:return l.sent(),a.getItemSync(i)!==null?[3,5]:(s=this.id+"-"+e+"-"+o,[4,Yt(Math.floor(25*Math.random()))]);case 3:return l.sent(),a.setItemSync(i,JSON.stringify({id:this.id,iat:o,timeoutKey:s,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,Yt(30)];case 4:return l.sent(),(c=a.getItemSync(i))!==null&&(u=JSON.parse(c)).id===this.id&&u.iat===o?(this.acquiredIatSet.add(o),this.refreshLockWhileAcquired(i,o),[2,!0]):[3,7];case 5:return t.lockCorrector(this.storageHandler===void 0?wt:this.storageHandler),[4,this.waitForSomethingToChange(r)];case 6:l.sent(),l.label=7;case 7:return o=Date.now()+Qt(4),[3,1];case 8:return[2,!1]}}))}))},t.prototype.refreshLockWhileAcquired=function(e,n){return Y(this,void 0,void 0,(function(){var o=this;return Q(this,(function(r){return setTimeout((function(){return Y(o,void 0,void 0,(function(){var i,a,s;return Q(this,(function(c){switch(c.label){case 0:return[4,Ke.default().lock(n)];case 1:return c.sent(),this.acquiredIatSet.has(n)?(i=this.storageHandler===void 0?wt:this.storageHandler,(a=i.getItemSync(e))===null?(Ke.default().unlock(n),[2]):((s=JSON.parse(a)).timeRefreshed=Date.now(),i.setItemSync(e,JSON.stringify(s)),Ke.default().unlock(n),this.refreshLockWhileAcquired(e,n),[2])):(Ke.default().unlock(n),[2])}}))}))}),1e3),[2]}))}))},t.prototype.waitForSomethingToChange=function(e){return Y(this,void 0,void 0,(function(){return Q(this,(function(n){switch(n.label){case 0:return[4,new Promise((function(o){var r=!1,i=Date.now(),a=!1;function s(){if(a||(window.removeEventListener("storage",s),t.removeFromWaiting(s),clearTimeout(c),a=!0),!r){r=!0;var u=50-(Date.now()-i);u>0?setTimeout(o,u):o(null)}}window.addEventListener("storage",s),t.addToWaiting(s);var c=setTimeout(s,Math.max(0,e-Date.now()))}))];case 1:return n.sent(),[2]}}))}))},t.addToWaiting=function(e){this.removeFromWaiting(e),t.waiters!==void 0&&t.waiters.push(e)},t.removeFromWaiting=function(e){t.waiters!==void 0&&(t.waiters=t.waiters.filter((function(n){return n!==e})))},t.notifyWaiters=function(){t.waiters!==void 0&&t.waiters.slice().forEach((function(e){return e()}))},t.prototype.releaseLock=function(e){return Y(this,void 0,void 0,(function(){return Q(this,(function(n){switch(n.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,n.sent()]}}))}))},t.prototype.releaseLock__private__=function(e){return Y(this,void 0,void 0,(function(){var n,o,r,i;return Q(this,(function(a){switch(a.label){case 0:return n=this.storageHandler===void 0?wt:this.storageHandler,o="browser-tabs-lock-key-"+e,(r=n.getItemSync(o))===null?[2]:(i=JSON.parse(r)).id!==this.id?[3,2]:[4,Ke.default().lock(i.iat)];case 1:a.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(o),Ke.default().unlock(i.iat),t.notifyWaiters(),a.label=2;case 2:return[2]}}))}))},t.lockCorrector=function(e){for(var n=Date.now()-5e3,o=e,r=[],i=0;;){var a=o.keySync(i);if(a===null)break;r.push(a),i++}for(var s=!1,c=0;c<r.length;c++){var u=r[c];if(u.includes("browser-tabs-lock-key")){var l=o.getItemSync(u);if(l!==null){var m=JSON.parse(l);(m.timeRefreshed===void 0&&m.timeAcquired<n||m.timeRefreshed!==void 0&&m.timeRefreshed<n)&&(o.removeItemSync(u),s=!0)}}}s&&t.notifyWaiters()},t.waiters=void 0,t})(),xr=Do.default=Or;class Cr{async runWithLock(e,n,o){const r=new AbortController,i=setTimeout((()=>r.abort()),n);try{return await navigator.locks.request(e,{mode:"exclusive",signal:r.signal},(async a=>{if(clearTimeout(i),!a)throw new Error("Lock not available");return await o()}))}catch(a){throw clearTimeout(i),(a==null?void 0:a.name)==="AbortError"?new je:a}}}class jr{constructor(){this.activeLocks=new Set,this.lock=new xr,this.pagehideHandler=()=>{this.activeLocks.forEach((e=>this.lock.releaseLock(e))),this.activeLocks.clear()}}async runWithLock(e,n,o){let r=!1;for(let i=0;i<10&&!r;i++)r=await this.lock.acquireLock(e,n);if(!r)throw new je;this.activeLocks.add(e),this.activeLocks.size===1&&typeof window<"u"&&window.addEventListener("pagehide",this.pagehideHandler);try{return await o()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),this.activeLocks.size===0&&typeof window<"u"&&window.removeEventListener("pagehide",this.pagehideHandler)}}}function Dr(){return typeof navigator<"u"&&typeof((t=navigator.locks)===null||t===void 0?void 0:t.request)=="function"?new Cr:new jr;var t}let $t=null;const Lr=new TextEncoder,Kr=new TextDecoder;function Qe(t){return typeof t=="string"?Lr.encode(t):Kr.decode(t)}function no(t){if(typeof t.modulusLength!="number"||t.modulusLength<2048)throw new Nr(`${t.name} modulusLength must be at least 2048 bits`)}async function Ur(t,e,n){if(n.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const o=`${$e(Qe(JSON.stringify(t)))}.${$e(Qe(JSON.stringify(e)))}`;return`${o}.${$e(await crypto.subtle.sign((function(r){switch(r.algorithm.name){case"ECDSA":return{name:r.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return no(r.algorithm),{name:r.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return no(r.algorithm),{name:r.algorithm.name};case"Ed25519":return{name:r.algorithm.name}}throw new Ie})(n),n,Qe(o)))}`}let Sn;Uint8Array.prototype.toBase64?Sn=t=>(t instanceof ArrayBuffer&&(t=new Uint8Array(t)),t.toBase64({alphabet:"base64url",omitPadding:!0})):Sn=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));const n=[];for(let o=0;o<e.byteLength;o+=32768)n.push(String.fromCharCode.apply(null,e.subarray(o,o+32768)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function $e(t){return Sn(t)}class Ie extends Error{constructor(e){var n;super(e??"operation not supported"),this.name=this.constructor.name,(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}class Nr extends Error{constructor(e){var n;super(e),this.name=this.constructor.name,(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}function Wr(t){switch(t.algorithm.name){case"RSA-PSS":return(function(e){if(e.algorithm.hash.name==="SHA-256")return"PS256";throw new Ie("unsupported RsaHashedKeyAlgorithm hash name")})(t);case"RSASSA-PKCS1-v1_5":return(function(e){if(e.algorithm.hash.name==="SHA-256")return"RS256";throw new Ie("unsupported RsaHashedKeyAlgorithm hash name")})(t);case"ECDSA":return(function(e){if(e.algorithm.namedCurve==="P-256")return"ES256";throw new Ie("unsupported EcKeyAlgorithm namedCurve")})(t);case"Ed25519":return"Ed25519";default:throw new Ie("unsupported CryptoKey algorithm name")}}function Lo(t){return t instanceof CryptoKey}function Ko(t){return Lo(t)&&t.type==="public"}async function zr(t,e,n,o,r,i){const a=t==null?void 0:t.privateKey,s=t==null?void 0:t.publicKey;if(!Lo(c=a)||c.type!=="private")throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!Ko(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(s.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof e!="string")throw new TypeError('"htu" must be a string');if(typeof n!="string")throw new TypeError('"htm" must be a string');if(o!==void 0&&typeof o!="string")throw new TypeError('"nonce" must be a string or undefined');if(r!==void 0&&typeof r!="string")throw new TypeError('"accessToken" must be a string or undefined');return Ur({alg:Wr(a),typ:"dpop+jwt",jwk:await Uo(s)},Object.assign(Object.assign({},i),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:e,ath:r?$e(await crypto.subtle.digest("SHA-256",Qe(r))):void 0}),a)}async function Uo(t){const{kty:e,e:n,n:o,x:r,y:i,crv:a}=await crypto.subtle.exportKey("jwk",t);return{kty:e,crv:a,e:n,n:o,x:r,y:i}}const Hr=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];function Mr(){return(async function(t,e){var n;let o;if(t.length===0)throw new TypeError('"alg" must be a non-empty string');switch(t){case"PS256":o={name:"RSA-PSS",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":o={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":o={name:"ECDSA",namedCurve:"P-256"};break;case"Ed25519":o={name:"Ed25519"};break;default:throw new Ie}return crypto.subtle.generateKey(o,(n=e==null?void 0:e.extractable)!==null&&n!==void 0&&n,["sign","verify"])})("ES256",{extractable:!1})}function Jr(t){return(async function(e){if(!Ko(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(e.extractable!==!0)throw new TypeError('"publicKey.extractable" must be true');const n=await Uo(e);let o;switch(n.kty){case"EC":o={crv:n.crv,kty:n.kty,x:n.x,y:n.y};break;case"OKP":o={crv:n.crv,kty:n.kty,x:n.x};break;case"RSA":o={e:n.e,kty:n.kty,n:n.n};break;default:throw new Ie("unsupported JWK kty")}return $e(await crypto.subtle.digest({name:"SHA-256"},Qe(JSON.stringify(o))))})(t.publicKey)}function Vr(t){let{keyPair:e,url:n,method:o,nonce:r,accessToken:i}=t;const a=(function(s){const c=new URL(s);return c.search="",c.hash="",c.href})(n);return zr(e,a,o,r,i)}const Fr=async(t,e)=>{const n=await fetch(t,e);return{ok:n.ok,json:await n.json(),headers:(o=n.headers,[...o].reduce(((r,i)=>{let[a,s]=i;return r[a]=s,r}),{}))};var o},Gr=async(t,e,n)=>{const o=new AbortController;let r;return e.signal=o.signal,Promise.race([Fr(t,e),new Promise(((i,a)=>{r=setTimeout((()=>{o.abort(),a(new Error("Timeout when executing 'fetch'"))}),n)}))]).finally((()=>{clearTimeout(r)}))},Zr=async(t,e,n,o,r,i,a,s)=>((c,u)=>new Promise((function(l,m){const d=new MessageChannel;d.port1.onmessage=function(h){h.data.error?m(new Error(h.data.error)):l(h.data),d.port1.close()},u.postMessage(c,[d.port2])})))({auth:{audience:e,scope:n},timeout:r,fetchUrl:t,fetchOptions:o,useFormData:a,useMrrt:s},i),qr=async function(t,e,n,o,r,i){let a=arguments.length>6&&arguments[6]!==void 0?arguments[6]:1e4,s=arguments.length>7?arguments[7]:void 0;return r?Zr(t,e,n,o,a,r,i,s):Gr(t,o,a)};async function No(t,e,n,o,r,i,a,s,c,u){if(c){const k=await c.generateProof({url:t,method:r.method||"GET",nonce:await c.getNonce()});r.headers=Object.assign(Object.assign({},r.headers),{dpop:k})}let l,m=null;for(let k=0;k<3;k++)try{l=await qr(t,n,o,r,i,a,e,s),m=null;break}catch(E){m=E}if(m)throw m;const d=l.json,{error:h,error_description:w}=d,f=X(d,["error","error_description"]),{headers:p,ok:g}=l;let b;if(c&&(b=p["dpop-nonce"],b&&await c.setNonce(b)),!g){const k=w||"HTTP error. Unable to fetch ".concat(t);if(h==="mfa_required")throw new Ve(h,k,f.mfa_token,f.mfa_requirements);if(h==="missing_refresh_token")throw new ct(n,o);if(h==="use_dpop_nonce"){if(!c||!b||u)throw new ut(b);return No(t,e,n,o,r,i,a,s,c,!0)}throw new O(h||"request_error",k)}return f}async function Br(t,e){var{baseUrl:n,timeout:o,audience:r,scope:i,auth0Client:a,useFormData:s,useMrrt:c,dpop:u}=t,l=X(t,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop"]);const m=l.grant_type==="urn:ietf:params:oauth:grant-type:token-exchange",d=l.grant_type==="refresh_token"&&c,h=Object.assign(Object.assign(Object.assign(Object.assign({},l),m&&r&&{audience:r}),m&&i&&{scope:i}),d&&{audience:r,scope:i}),w=s?kn(h):JSON.stringify(h),f=(p=l.grant_type,Hr.includes(p));var p;return await No("".concat(n,"/oauth/token"),o,r||"default",i,{method:"POST",body:w,headers:{"Content-Type":s?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(jo(a||xo)))}},e,s,c,f?u:void 0)}const Xr=t=>Array.from(new Set(t)),Pt=function(){for(var t=arguments.length,e=new Array(t),n=0;n<t;n++)e[n]=arguments[n];return Xr(e.filter(Boolean).join(" ").trim().split(/\s+/)).join(" ")},vt=(t,e,n)=>{let o;return n&&(o=t[n]),o||(o=t.default),Pt(o,e)};class V{constructor(e){let n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:"@@auth0spajs@@",o=arguments.length>2?arguments[2]:void 0;this.prefix=n,this.suffix=o,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const[n,o,r,i]=e.split("::");return new V({clientId:o,scope:i,audience:r},n)}static fromCacheEntry(e){const{scope:n,audience:o,client_id:r}=e;return new V({scope:n,audience:o,clientId:r})}}class Wo{set(e,n){localStorage.setItem(e,JSON.stringify(n))}get(e){const n=window.localStorage.getItem(e);if(n)try{return JSON.parse(n)}catch{return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter((e=>e.startsWith("@@auth0spajs@@")))}}class Hn{constructor(){this.enclosedCache=(function(){let e={};return{set(n,o){e[n]=o},get(n){const o=e[n];if(o)return o},remove(n){delete e[n]},allKeys:()=>Object.keys(e)}})()}}class Yr{constructor(e,n,o){this.cache=e,this.keyManifest=n,this.nowProvider=o||Co}async setIdToken(e,n,o){var r;const i=this.getIdTokenCacheKey(e);await this.cache.set(i,{id_token:n,decodedToken:o}),await((r=this.keyManifest)===null||r===void 0?void 0:r.add(i))}async getIdToken(e){const n=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!n&&e.scope&&e.audience){const o=await this.get(e);return!o||!o.id_token||!o.decodedToken?void 0:{id_token:o.id_token,decodedToken:o.decodedToken}}if(n)return{id_token:n.id_token,decodedToken:n.decodedToken}}async get(e){let n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:0,o=arguments.length>2&&arguments[2]!==void 0&&arguments[2],r=arguments.length>3?arguments[3]:void 0;var i;let a=await this.cache.get(e.toKey());if(!a){const u=await this.getCacheKeys();if(!u)return;const l=this.matchExistingCacheKey(e,u);if(l&&(a=await this.cache.get(l)),!a&&o&&r!=="cache-only")return this.getEntryWithRefreshToken(e,u)}if(!a)return;const s=await this.nowProvider(),c=Math.floor(s/1e3);return a.expiresAt-n<c?a.body.refresh_token?this.modifiedCachedEntry(a,e):(await this.cache.remove(e.toKey()),void await((i=this.keyManifest)===null||i===void 0?void 0:i.remove(e.toKey()))):a.body}async modifiedCachedEntry(e,n){return e.body={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},await this.cache.set(n.toKey(),e),{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}async set(e){var n;const o=new V({clientId:e.client_id,scope:e.scope,audience:e.audience}),r=await this.wrapCacheEntry(e);await this.cache.set(o.toKey(),r),await((n=this.keyManifest)===null||n===void 0?void 0:n.add(o.toKey()))}async remove(e,n,o){const r=new V({clientId:e,scope:o,audience:n});await this.cache.remove(r.toKey())}async clear(e){var n;const o=await this.getCacheKeys();o&&(await o.filter((r=>!e||r.includes(e))).reduce((async(r,i)=>{await r,await this.cache.remove(i)}),Promise.resolve()),await((n=this.keyManifest)===null||n===void 0?void 0:n.clear()))}async wrapCacheEntry(e){const n=await this.nowProvider();return{body:e,expiresAt:Math.floor(n/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?(e=await this.keyManifest.get())===null||e===void 0?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new V({clientId:e},"@@auth0spajs@@","@@user@@").toKey()}matchExistingCacheKey(e,n){return n.filter((o=>{var r;const i=V.fromKey(o),a=new Set(i.scope&&i.scope.split(" ")),s=((r=e.scope)===null||r===void 0?void 0:r.split(" "))||[],c=i.scope&&s.reduce(((u,l)=>u&&a.has(l)),!0);return i.prefix==="@@auth0spajs@@"&&i.clientId===e.clientId&&i.audience===e.audience&&c}))[0]}async getEntryWithRefreshToken(e,n){var o;for(const r of n){const i=V.fromKey(r);if(i.prefix==="@@auth0spajs@@"&&i.clientId===e.clientId){const a=await this.cache.get(r);if(!((o=a==null?void 0:a.body)===null||o===void 0)&&o.refresh_token)return this.modifiedCachedEntry(a,e)}}}async updateEntry(e,n){var o;const r=await this.getCacheKeys();if(r)for(const i of r){const a=await this.cache.get(i);((o=a==null?void 0:a.body)===null||o===void 0?void 0:o.refresh_token)===e&&(a.body.refresh_token=n,await this.cache.set(i,a))}}}class Qr{constructor(e,n,o){this.storage=e,this.clientId=n,this.cookieDomain=o,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const qe=t=>typeof t=="number",$r=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"],ei=t=>{if(!t.id_token)throw new Error("ID token is required but missing");const e=(i=>{const a=i.split("."),[s,c,u]=a;if(a.length!==3||!s||!c||!u)throw new Error("ID token could not be decoded");const l=JSON.parse(eo(c)),m={__raw:i},d={};return Object.keys(l).forEach((h=>{m[h]=l[h],$r.includes(h)||(d[h]=l[h])})),{encoded:{header:s,payload:c,signature:u},header:JSON.parse(eo(s)),claims:m,user:d}})(t.id_token);if(!e.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(e.claims.iss!==t.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(t.iss,'", found "').concat(e.claims.iss,'"'));if(!e.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if(e.header.alg!=="RS256")throw new Error('Signature algorithm of "'.concat(e.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!e.claims.aud||typeof e.claims.aud!="string"&&!Array.isArray(e.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(t.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(t.aud,'" but was not one of "').concat(e.claims.aud.join(", "),'"'));if(e.claims.aud.length>1){if(!e.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(e.claims.azp!==t.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(t.aud,'", found "').concat(e.claims.azp,'"'))}}else if(e.claims.aud!==t.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(t.aud,'" but found "').concat(e.claims.aud,'"'));if(t.nonce){if(!e.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(e.claims.nonce!==t.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(t.nonce,'", found "').concat(e.claims.nonce,'"'))}if(t.max_age&&!qe(e.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(e.claims.exp==null||!qe(e.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!qe(e.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const n=t.leeway||60,o=new Date(t.now||Date.now()),r=new Date(0);if(r.setUTCSeconds(e.claims.exp+n),o>r)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(o,") is after expiration time (").concat(r,")"));if(e.claims.nbf!=null&&qe(e.claims.nbf)){const i=new Date(0);if(i.setUTCSeconds(e.claims.nbf-n),o<i)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(o,") is before ").concat(i))}if(e.claims.auth_time!=null&&qe(e.claims.auth_time)){const i=new Date(0);if(i.setUTCSeconds(parseInt(e.claims.auth_time)+t.max_age+n),o>i)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(o,") is after last auth at ").concat(i))}if(t.organization){const i=t.organization.trim();if(i.startsWith("org_")){const a=i;if(!e.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(a!==e.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(a,'", found "').concat(e.claims.org_id,'"'))}else{const a=i.toLowerCase();if(!e.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(a!==e.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(a,'", found "').concat(e.claims.org_name,'"'))}}return e};var ot=Ce&&Ce.__assign||function(){return ot=Object.assign||function(t){for(var e,n=1,o=arguments.length;n<o;n++)for(var r in e=arguments[n])Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r]);return t},ot.apply(this,arguments)};function Be(t,e){if(!e)return"";var n="; "+t;return e===!0?n:n+"="+e}function ti(t,e,n){return encodeURIComponent(t).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(e).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+(function(o){if(typeof o.expires=="number"){var r=new Date;r.setMilliseconds(r.getMilliseconds()+864e5*o.expires),o.expires=r}return Be("Expires",o.expires?o.expires.toUTCString():"")+Be("Domain",o.domain)+Be("Path",o.path)+Be("Secure",o.secure)+Be("SameSite",o.sameSite)})(n)}function ni(){return(function(t){for(var e={},n=t?t.split("; "):[],o=/(%[\dA-F]{2})+/gi,r=0;r<n.length;r++){var i=n[r].split("="),a=i.slice(1).join("=");a.charAt(0)==='"'&&(a=a.slice(1,-1));try{e[i[0].replace(o,decodeURIComponent)]=a.replace(o,decodeURIComponent)}catch{}}return e})(document.cookie)}var oi=function(t){return ni()[t]};function zo(t,e,n){document.cookie=ti(t,e,ot({path:"/"},n))}var Ho=zo,Mo=function(t,e){zo(t,"",ot(ot({},e),{expires:-1}))};const We={get(t){const e=oi(t);if(e!==void 0)return JSON.parse(e)},save(t,e,n){let o={};window.location.protocol==="https:"&&(o={secure:!0,sameSite:"none"}),n!=null&&n.daysUntilExpire&&(o.expires=n.daysUntilExpire),n!=null&&n.cookieDomain&&(o.domain=n.cookieDomain),Ho(t,JSON.stringify(e),o)},remove(t,e){let n={};e!=null&&e.cookieDomain&&(n.domain=e.cookieDomain),Mo(t,n)}},ri={get(t){return We.get(t)||We.get("".concat("_legacy_").concat(t))},save(t,e,n){let o={};window.location.protocol==="https:"&&(o={secure:!0}),n!=null&&n.daysUntilExpire&&(o.expires=n.daysUntilExpire),n!=null&&n.cookieDomain&&(o.domain=n.cookieDomain),Ho("".concat("_legacy_").concat(t),JSON.stringify(e),o),We.save(t,e,n)},remove(t,e){let n={};e!=null&&e.cookieDomain&&(n.domain=e.cookieDomain),Mo(t,n),We.remove(t,e),We.remove("".concat("_legacy_").concat(t),e)}},ii={get(t){if(typeof sessionStorage>"u")return;const e=sessionStorage.getItem(t);return e!=null?JSON.parse(e):void 0},save(t,e){sessionStorage.setItem(t,JSON.stringify(e))},remove(t){sessionStorage.removeItem(t)}};exports.ResponseType=void 0;(function(t){t.Code="code",t.ConnectCode="connect_code"})(exports.ResponseType||(exports.ResponseType={}));function ai(t,e,n){var o=e===void 0?null:e,r=(function(c,u){var l=atob(c);if(u){for(var m=new Uint8Array(l.length),d=0,h=l.length;d<h;++d)m[d]=l.charCodeAt(d);return String.fromCharCode.apply(null,new Uint16Array(m.buffer))}return l})(t,n!==void 0&&n),i=r.indexOf(`
-`,10)+1,a=r.substring(i)+(o?"//# sourceMappingURL="+o:""),s=new Blob([a],{type:"application/javascript"});return URL.createObjectURL(s)}var oo,ro,io,en,si=(oo="Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7Y2xhc3MgZSBleHRlbmRzIEVycm9ye2NvbnN0cnVjdG9yKHQscil7c3VwZXIociksdGhpcy5lcnJvcj10LHRoaXMuZXJyb3JfZGVzY3JpcHRpb249cixPYmplY3Quc2V0UHJvdG90eXBlT2YodGhpcyxlLnByb3RvdHlwZSl9c3RhdGljIGZyb21QYXlsb2FkKHQpe2xldHtlcnJvcjpyLGVycm9yX2Rlc2NyaXB0aW9uOnN9PXQ7cmV0dXJuIG5ldyBlKHIscyl9fWNsYXNzIHQgZXh0ZW5kcyBle2NvbnN0cnVjdG9yKGUscyl7c3VwZXIoIm1pc3NpbmdfcmVmcmVzaF90b2tlbiIsIk1pc3NpbmcgUmVmcmVzaCBUb2tlbiAoYXVkaWVuY2U6ICciLmNvbmNhdChyKGUsWyJkZWZhdWx0Il0pLCInLCBzY29wZTogJyIpLmNvbmNhdChyKHMpLCInKSIpKSx0aGlzLmF1ZGllbmNlPWUsdGhpcy5zY29wZT1zLE9iamVjdC5zZXRQcm90b3R5cGVPZih0aGlzLHQucHJvdG90eXBlKX19ZnVuY3Rpb24gcihlKXtsZXQgdD1hcmd1bWVudHMubGVuZ3RoPjEmJnZvaWQgMCE9PWFyZ3VtZW50c1sxXT9hcmd1bWVudHNbMV06W107cmV0dXJuIGUmJiF0LmluY2x1ZGVzKGUpP2U6IiJ9ImZ1bmN0aW9uIj09dHlwZW9mIFN1cHByZXNzZWRFcnJvciYmU3VwcHJlc3NlZEVycm9yO2NvbnN0IHM9ZT0+e3ZhcntjbGllbnRJZDp0fT1lLHI9ZnVuY3Rpb24oZSx0KXt2YXIgcj17fTtmb3IodmFyIHMgaW4gZSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoZSxzKSYmdC5pbmRleE9mKHMpPDAmJihyW3NdPWVbc10pO2lmKG51bGwhPWUmJiJmdW5jdGlvbiI9PXR5cGVvZiBPYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKXt2YXIgbz0wO2ZvcihzPU9iamVjdC5nZXRPd25Qcm9wZXJ0eVN5bWJvbHMoZSk7bzxzLmxlbmd0aDtvKyspdC5pbmRleE9mKHNbb10pPDAmJk9iamVjdC5wcm90b3R5cGUucHJvcGVydHlJc0VudW1lcmFibGUuY2FsbChlLHNbb10pJiYocltzW29dXT1lW3Nbb11dKX1yZXR1cm4gcn0oZSxbImNsaWVudElkIl0pO3JldHVybiBuZXcgVVJMU2VhcmNoUGFyYW1zKChlPT5PYmplY3Qua2V5cyhlKS5maWx0ZXIoKHQ9PnZvaWQgMCE9PWVbdF0pKS5yZWR1Y2UoKCh0LHIpPT5PYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sdCkse1tyXTplW3JdfSkpLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IG89e307Y29uc3Qgbj0oZSx0KT0+IiIuY29uY2F0KGUsInwiKS5jb25jYXQodCk7YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsKGFzeW5jIGU9PntsZXQgcixjLHtkYXRhOnt0aW1lb3V0OmksYXV0aDphLGZldGNoVXJsOmYsZmV0Y2hPcHRpb25zOmwsdXNlRm9ybURhdGE6cCx1c2VNcnJ0Omh9LHBvcnRzOlt1XX09ZSxkPXt9O2NvbnN0e2F1ZGllbmNlOmcsc2NvcGU6eX09YXx8e307dHJ5e2NvbnN0IGU9cD8oZT0+e2NvbnN0IHQ9bmV3IFVSTFNlYXJjaFBhcmFtcyhlKSxyPXt9O3JldHVybiB0LmZvckVhY2goKChlLHQpPT57clt0XT1lfSkpLHJ9KShsLmJvZHkpOkpTT04ucGFyc2UobC5ib2R5KTtpZighZS5yZWZyZXNoX3Rva2VuJiYicmVmcmVzaF90b2tlbiI9PT1lLmdyYW50X3R5cGUpe2lmKGM9KChlLHQpPT5vW24oZSx0KV0pKGcseSksIWMmJmgpe2NvbnN0IGU9by5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+e2NvbnN0IHI9T2JqZWN0LmtleXMobykuZmluZCgocj0+e2lmKCJsYXRlc3RfcmVmcmVzaF90b2tlbiIhPT1yKXtjb25zdCBzPSgoZSx0KT0+dC5zdGFydHNXaXRoKCIiLmNvbmNhdChlLCJ8IikpKSh0LHIpLG89ci5zcGxpdCgifCIpWzFdLnNwbGl0KCIgIiksbj1lLnNwbGl0KCIgIikuZXZlcnkoKGU9Pm8uaW5jbHVkZXMoZSkpKTtyZXR1cm4gcyYmbn19KSk7cmV0dXJuISFyfSkoeSxnKTtlJiYhdCYmKGM9ZSl9aWYoIWMpdGhyb3cgbmV3IHQoZyx5KTtsLmJvZHk9cD9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpjfSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpjfSkpfWxldCBhLGs7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGE9bmV3IEFib3J0Q29udHJvbGxlcixsLnNpZ25hbD1hLnNpZ25hbCk7dHJ5e2s9YXdhaXQgUHJvbWlzZS5yYWNlKFsoaj1pLG5ldyBQcm9taXNlKChlPT5zZXRUaW1lb3V0KGUsaikpKSksZmV0Y2goZixPYmplY3QuYXNzaWduKHt9LGwpKV0pfWNhdGNoKGUpe3JldHVybiB2b2lkIHUucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZX0pfWlmKCFrKXJldHVybiBhJiZhLmFib3J0KCksdm9pZCB1LnBvc3RNZXNzYWdlKHtlcnJvcjoiVGltZW91dCB3aGVuIGV4ZWN1dGluZyAnZmV0Y2gnIn0pO189ay5oZWFkZXJzLGQ9Wy4uLl9dLnJlZHVjZSgoKGUsdCk9PntsZXRbcixzXT10O3JldHVybiBlW3JdPXMsZX0pLHt9KSxyPWF3YWl0IGsuanNvbigpLHIucmVmcmVzaF90b2tlbj8oaCYmKG8ubGF0ZXN0X3JlZnJlc2hfdG9rZW49ci5yZWZyZXNoX3Rva2VuLE89YyxiPXIucmVmcmVzaF90b2tlbixPYmplY3QuZW50cmllcyhvKS5mb3JFYWNoKChlPT57bGV0W3Qscl09ZTtyPT09TyYmKG9bdF09Yil9KSkpLCgoZSx0LHIpPT57b1tuKHQscildPWV9KShyLnJlZnJlc2hfdG9rZW4sZyx5KSxkZWxldGUgci5yZWZyZXNoX3Rva2VuKTooKGUsdCk9PntkZWxldGUgb1tuKGUsdCldfSkoZyx5KSx1LnBvc3RNZXNzYWdlKHtvazprLm9rLGpzb246cixoZWFkZXJzOmR9KX1jYXRjaChlKXt1LnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjplLmVycm9yLGVycm9yX2Rlc2NyaXB0aW9uOmUubWVzc2FnZX0saGVhZGVyczpkfSl9dmFyIE8sYixfLGp9KSl9KCk7Cgo=",ro=null,io=!1,function(t){return en=en||ai(oo,ro,io),new Worker(en,t)});const tn={};class ci{constructor(e,n){this.cache=e,this.clientId=n,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var n;const o=new Set(((n=await this.cache.get(this.manifestKey))===null||n===void 0?void 0:n.keys)||[]);o.add(e),await this.cache.set(this.manifestKey,{keys:[...o]})}async remove(e){const n=await this.cache.get(this.manifestKey);if(n){const o=new Set(n.keys);return o.delete(e),o.size>0?await this.cache.set(this.manifestKey,{keys:[...o]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat("@@auth0spajs@@","::").concat(e)}}const ui={memory:()=>new Hn().enclosedCache,localstorage:()=>new Wo},ao=t=>ui[t],so=t=>{const{openUrl:e,onRedirect:n}=t,o=X(t,["openUrl","onRedirect"]);return Object.assign(Object.assign({},o),{openUrl:e===!1||e?e:n})},co=(t,e)=>{const n=(e==null?void 0:e.split(" "))||[];return((t==null?void 0:t.split(" "))||[]).every((o=>n.includes(o)))},_e={NONCE:"nonce",KEYPAIR:"keypair"};class li{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise(((n,o)=>{e.onupgradeneeded=()=>Object.values(_e).forEach((r=>e.result.createObjectStore(r))),e.onerror=()=>o(e.error),e.onsuccess=()=>n(e.result)}))}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,n,o){const r=o((await this.getDbHandle()).transaction(e,n).objectStore(e));return new Promise(((i,a)=>{r.onsuccess=()=>i(r.result),r.onerror=()=>a(r.error)}))}buildKey(e){const n=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(n)}setNonce(e,n){return this.save(_e.NONCE,this.buildKey(n),e)}setKeyPair(e){return this.save(_e.KEYPAIR,this.buildKey(),e)}async save(e,n,o){await this.executeDbRequest(e,"readwrite",(r=>r.put(o,n)))}findNonce(e){return this.find(_e.NONCE,this.buildKey(e))}findKeyPair(){return this.find(_e.KEYPAIR,this.buildKey())}find(e,n){return this.executeDbRequest(e,"readonly",(o=>o.get(n)))}async deleteBy(e,n){const o=await this.executeDbRequest(e,"readonly",(r=>r.getAllKeys()));o==null||o.filter(n).map((r=>this.executeDbRequest(e,"readwrite",(i=>i.delete(r)))))}deleteByClientId(e,n){return this.deleteBy(e,(o=>typeof o=="string"&&o.startsWith("".concat(n,"::"))))}clearNonces(){return this.deleteByClientId(_e.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(_e.KEYPAIR,this.clientId)}}class di{constructor(e){this.storage=new li(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,n){return this.storage.setNonce(e,n)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await Mr(),await this.storage.setKeyPair(e)),e}async generateProof(e){const n=await this.getOrGenerateKeyPair();return Vr(Object.assign({keyPair:n},e))}async calculateThumbprint(){return Jr(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var ze;(function(t){t.Bearer="Bearer",t.DPoP="DPoP"})(ze||(ze={}));class hi{constructor(e,n){this.hooks=n,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||(typeof window>"u"?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,n){if(n){if(this.isAbsoluteUrl(n))return n;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(n.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return typeof e=="string"?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,n){if(!this.config.baseUrl)return new Request(e,n);const o=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),r=e instanceof Request?new Request(o,e):o;return new Request(r,n)}setAuthorizationHeader(e,n){let o=arguments.length>2&&arguments[2]!==void 0?arguments[2]:ze.Bearer;e.headers.set("authorization","".concat(o," ").concat(n))}async setDpopProofHeader(e,n){if(!this.config.dpopNonceId)return;const o=await this.hooks.getDpopNonce(),r=await this.hooks.generateDpopProof({accessToken:n,method:e.method,nonce:o,url:e.url});e.headers.set("dpop",r)}async prepareRequest(e,n){const o=await this.getAccessToken(n);let r,i;typeof o=="string"?(r=this.config.dpopNonceId?ze.DPoP:ze.Bearer,i=o):(r=o.token_type,i=o.access_token),this.setAuthorizationHeader(e,i,r),r===ze.DPoP&&await this.setDpopProofHeader(e,i)}getHeader(e,n){return Array.isArray(e)?new Headers(e).get(n)||"":typeof e.get=="function"?e.get(n)||"":e[n]||""}hasUseDpopNonceError(e){if(e.status!==401)return!1;const n=this.getHeader(e.headers,"www-authenticate");return n.includes("invalid_dpop_nonce")||n.includes("use_dpop_nonce")}async handleResponse(e,n){const o=this.getHeader(e.headers,"dpop-nonce");if(o&&await this.hooks.setDpopNonce(o),!this.hasUseDpopNonceError(e))return e;if(!o||!n.onUseDpopNonceError)throw new ut(o);return n.onUseDpopNonceError()}async internalFetchWithAuth(e,n,o,r){const i=this.buildBaseRequest(e,n);await this.prepareRequest(i,r);const a=await this.config.fetch(i);return this.handleResponse(a,o)}fetchWithAuth(e,n,o){const r={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,n,Object.assign(Object.assign({},r),{onUseDpopNonceError:void 0}),o)};return this.internalFetchWithAuth(e,n,r,o)}}class pi{constructor(e,n){this.myAccountFetcher=e,this.apiBase=n}async connectAccount(e){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(n)}async completeAccount(e){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});return this._handleResponse(n)}async _handleResponse(e){let n;try{n=await e.text(),n=JSON.parse(n)}catch(o){throw new rt({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:n||String(o)})}if(e.ok)return n;throw new rt(n)}}class rt extends Error{constructor(e){let{type:n,status:o,title:r,detail:i,validation_errors:a}=e;super(i),this.name="MyAccountApiError",this.type=n,this.status=o,this.title=r,this.detail=i,this.validation_errors=a,Object.setPrototypeOf(this,rt.prototype)}}const mi={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}},fi="http://auth0.com/oauth/grant-type/mfa-otp",yi="http://auth0.com/oauth/grant-type/mfa-oob",gi="http://auth0.com/oauth/grant-type/mfa-recovery-code";function Jo(t,e){this.v=t,this.k=e}function j(t,e,n){if(typeof t=="function"?t===e:t.has(e))return arguments.length<3?e:n;throw new TypeError("Private element is not present on this object")}function wi(t){return new Jo(t,0)}function Vo(t,e){if(e.has(t))throw new TypeError("Cannot initialize the same private elements twice on an object")}function v(t,e){return t.get(j(t,e))}function L(t,e,n){Vo(t,e),e.set(t,n)}function x(t,e,n){return t.set(j(t,e),n),n}function _(t,e,n){return(e=(function(o){var r=(function(i,a){if(typeof i!="object"||!i)return i;var s=i[Symbol.toPrimitive];if(s!==void 0){var c=s.call(i,a);if(typeof c!="object")return c;throw new TypeError("@@toPrimitive must return a primitive value.")}return(a==="string"?String:Number)(i)})(o,"string");return typeof r=="symbol"?r:r+""})(e))in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function uo(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(t);e&&(o=o.filter((function(r){return Object.getOwnPropertyDescriptor(t,r).enumerable}))),n.push.apply(n,o)}return n}function S(t){for(var e=1;e<arguments.length;e++){var n=arguments[e]!=null?arguments[e]:{};e%2?uo(Object(n),!0).forEach((function(o){_(t,o,n[o])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(n)):uo(Object(n)).forEach((function(o){Object.defineProperty(t,o,Object.getOwnPropertyDescriptor(n,o))}))}return t}function lo(t,e){if(t==null)return{};var n,o,r=(function(a,s){if(a==null)return{};var c={};for(var u in a)if({}.hasOwnProperty.call(a,u)){if(s.indexOf(u)!==-1)continue;c[u]=a[u]}return c})(t,e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(t);for(o=0;o<i.length;o++)n=i[o],e.indexOf(n)===-1&&{}.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}function vi(t){return function(){return new Ye(t.apply(this,arguments))}}function Ye(t){var e,n;function o(i,a){try{var s=t[i](a),c=s.value,u=c instanceof Jo;Promise.resolve(u?c.v:c).then((function(l){if(u){var m=i==="return"?"return":"next";if(!c.k||l.done)return o(m,l);l=t[m](l).value}r(s.done?"return":"normal",l)}),(function(l){o("throw",l)}))}catch(l){r("throw",l)}}function r(i,a){switch(i){case"return":e.resolve({value:a,done:!0});break;case"throw":e.reject(a);break;default:e.resolve({value:a,done:!1})}(e=e.next)?o(e.key,e.arg):n=null}this._invoke=function(i,a){return new Promise((function(s,c){var u={key:i,arg:a,resolve:s,reject:c,next:null};n?n=n.next=u:(e=n=u,o(i,a))}))},typeof t.return!="function"&&(this.return=void 0)}var bt,nn;let En;Ye.prototype[typeof Symbol=="function"&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},Ye.prototype.next=function(t){return this._invoke("next",t)},Ye.prototype.throw=function(t){return this._invoke("throw",t)},Ye.prototype.return=function(t){return this._invoke("return",t)},(typeof navigator>"u"||(bt=navigator.userAgent)===null||bt===void 0||(nn=bt.startsWith)===null||nn===void 0||!nn.call(bt,"Mozilla/5.0 "))&&(En="".concat("oauth4webapi","/").concat("v3.8.3"));function Fe(t,e){if(t==null)return!1;try{return t instanceof e||Object.getPrototypeOf(t)[Symbol.toStringTag]===e.prototype[Symbol.toStringTag]}catch{return!1}}function R(t,e,n){const o=new TypeError(t,{cause:n});return Object.assign(o,{code:e}),o}const q=Symbol(),Tn=Symbol(),An=Symbol(),te=Symbol(),ce=Symbol(),bi=new TextEncoder,_i=new TextDecoder;function Me(t){return typeof t=="string"?bi.encode(t):_i.decode(t)}let Pn,Fo;Uint8Array.prototype.toBase64?Pn=t=>(t instanceof ArrayBuffer&&(t=new Uint8Array(t)),t.toBase64({alphabet:"base64url",omitPadding:!0})):Pn=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));const n=[];for(let o=0;o<e.byteLength;o+=32768)n.push(String.fromCharCode.apply(null,e.subarray(o,o+32768)));return btoa(n.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function xe(t){return typeof t=="string"?Fo(t):Pn(t)}Fo=Uint8Array.fromBase64?t=>{try{return Uint8Array.fromBase64(t,{alphabet:"base64url"})}catch(e){throw R("The input to be decoded is not correctly encoded.","ERR_INVALID_ARG_VALUE",e)}}:t=>{try{const e=atob(t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(e.length);for(let o=0;o<e.length;o++)n[o]=e.charCodeAt(o);return n}catch(e){throw R("The input to be decoded is not correctly encoded.","ERR_INVALID_ARG_VALUE",e)}};class G extends Error{constructor(e,n){var o;super(e,n),_(this,"code",void 0),this.name=this.constructor.name,this.code=On,(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}class Mn extends Error{constructor(e,n){var o;super(e,n),_(this,"code",void 0),this.name=this.constructor.name,n!=null&&n.code&&(this.code=n==null?void 0:n.code),(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}function T(t,e,n){return new Mn(t,{code:e,cause:n})}function ki(t,e){if((function(n,o){if(!(n instanceof CryptoKey))throw R("".concat(o," must be a CryptoKey"),"ERR_INVALID_ARG_TYPE")})(t,e),t.type!=="private")throw R("".concat(e," must be a private CryptoKey"),"ERR_INVALID_ARG_VALUE")}function Ct(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function Jt(t){Fe(t,Headers)&&(t=Object.fromEntries(t.entries()));const e=new Headers(t??{});if(En&&!e.has("user-agent")&&e.set("user-agent",En),e.has("authorization"))throw R('"options.headers" must not include the "authorization" header name',"ERR_INVALID_ARG_VALUE");return e}function Go(t,e){if(e!==void 0){if(typeof e=="function"&&(e=e(t.href)),!(e instanceof AbortSignal))throw R('"options.signal" must return or be an instance of AbortSignal',"ERR_INVALID_ARG_TYPE");return e}}function ho(t){return t.includes("//")?t.replace("//","/"):t}async function Si(t,e){return(async function(n,o,r,i){if(!(n instanceof URL))throw R('"'.concat(o,'" must be an instance of URL'),"ERR_INVALID_ARG_TYPE");Jn(n,(i==null?void 0:i[q])!==!0);const a=r(new URL(n.href)),s=Jt(i==null?void 0:i.headers);return s.set("accept","application/json"),((i==null?void 0:i[te])||fetch)(a.href,{body:void 0,headers:Object.fromEntries(s.entries()),method:"GET",redirect:"manual",signal:Go(a,i==null?void 0:i.signal)})})(t,"issuerIdentifier",(n=>{switch(e==null?void 0:e.algorithm){case void 0:case"oidc":(function(o,r){o.pathname=ho("".concat(o.pathname,"/").concat(r))})(n,".well-known/openid-configuration");break;case"oauth2":(function(o,r){let i=arguments.length>2&&arguments[2]!==void 0&&arguments[2];o.pathname==="/"?o.pathname=r:o.pathname=ho("".concat(r,"/").concat(i?o.pathname:o.pathname.replace(/(\/)$/,"")))})(n,".well-known/oauth-authorization-server");break;default:throw R('"options.algorithm" must be "oidc" (default), or "oauth2"',"ERR_INVALID_ARG_VALUE")}return n}),e)}function we(t,e,n,o,r){try{if(typeof t!="number"||!Number.isFinite(t))throw R("".concat(n," must be a number"),"ERR_INVALID_ARG_TYPE",r);if(t>0)return;if(e){if(t!==0)throw R("".concat(n," must be a non-negative number"),"ERR_INVALID_ARG_VALUE",r);return}throw R("".concat(n," must be a positive number"),"ERR_INVALID_ARG_VALUE",r)}catch(i){throw o?T(i.message,o,r):i}}function D(t,e,n,o){try{if(typeof t!="string")throw R("".concat(e," must be a string"),"ERR_INVALID_ARG_TYPE",o);if(t.length===0)throw R("".concat(e," must not be empty"),"ERR_INVALID_ARG_VALUE",o)}catch(r){throw n?T(r.message,n,o):r}}function Zo(t){(function(e,n){if(Yo(e)!==n)throw(function(o){let r='"response" content-type must be ';for(var i=arguments.length,a=new Array(i>1?i-1:0),s=1;s<i;s++)a[s-1]=arguments[s];if(a.length>2){const c=a.pop();r+="".concat(a.join(", "),", or ").concat(c)}else a.length===2?r+="".concat(a[0]," or ").concat(a[1]):r+=a[0];return T(r,$o,o)})(e,n)})(t,"application/json")}function qo(){return xe(crypto.getRandomValues(new Uint8Array(32)))}function Ei(t){switch(t.algorithm.name){case"RSA-PSS":return(function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new G("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}})(t);case"RSASSA-PKCS1-v1_5":return(function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new G("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}})(t);case"ECDSA":return(function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new G("unsupported EcKeyAlgorithm namedCurve",{cause:e})}})(t);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return t.algorithm.name;case"EdDSA":return"Ed25519";default:throw new G("unsupported CryptoKey algorithm name",{cause:t})}}function jt(t){const e=t==null?void 0:t[Tn];return typeof e=="number"&&Number.isFinite(e)?e:0}function Rn(t){const e=t==null?void 0:t[An];return typeof e=="number"&&Number.isFinite(e)&&Math.sign(e)!==-1?e:30}function Dt(){return Math.floor(Date.now()/1e3)}function $(t){if(typeof t!="object"||t===null)throw R('"as" must be an object',"ERR_INVALID_ARG_TYPE");D(t.issuer,'"as.issuer"')}function ee(t){if(typeof t!="object"||t===null)throw R('"client" must be an object',"ERR_INVALID_ARG_TYPE");D(t.client_id,'"client.client_id"')}function po(t){return D(t,'"clientSecret"'),(e,n,o,r)=>{o.set("client_id",n.client_id),o.set("client_secret",t)}}function Ti(t,e){const{key:n,kid:o}=(r=t)instanceof CryptoKey?{key:r}:(r==null?void 0:r.key)instanceof CryptoKey?(r.kid!==void 0&&D(r.kid,'"kid"'),{key:r.key,kid:r.kid}):{};var r;return ki(n,'"clientPrivateKey.key"'),async(i,a,s,c)=>{const u={alg:Ei(n),kid:o},l=(function(m,d){const h=Dt()+jt(d);return{jti:qo(),aud:m.issuer,exp:h+60,iat:h,nbf:h,iss:d.client_id,sub:d.client_id}})(i,a);s.set("client_id",a.client_id),s.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),s.set("client_assertion",await(async function(m,d,h){if(!h.usages.includes("sign"))throw R('CryptoKey instances used for signing assertions must include "sign" in their "usages"',"ERR_INVALID_ARG_VALUE");const w="".concat(xe(Me(JSON.stringify(m))),".").concat(xe(Me(JSON.stringify(d)))),f=xe(await crypto.subtle.sign((function(p){switch(p.algorithm.name){case"ECDSA":return{name:p.algorithm.name,hash:Ji(p)};case"RSA-PSS":switch(yo(p),p.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:p.algorithm.name,saltLength:parseInt(p.algorithm.hash.name.slice(-3),10)>>3};default:throw new G("unsupported RSA-PSS hash name",{cause:p})}case"RSASSA-PKCS1-v1_5":return yo(p),p.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return p.algorithm.name}throw new G("unsupported CryptoKey algorithm name",{cause:p})})(h),h,Me(w)));return"".concat(w,".").concat(f)})(u,l,n))}}const Ai=URL.parse?(t,e)=>URL.parse(t,e):(t,e)=>{try{return new URL(t,e)}catch{return null}};function Jn(t,e){if(e&&t.protocol!=="https:")throw T("only requests to HTTPS are allowed",er,t);if(t.protocol!=="https:"&&t.protocol!=="http:")throw T("only HTTP and HTTPS requests are allowed",tr,t)}function mo(t,e,n,o){let r;if(typeof t!="string"||!(r=Ai(t)))throw T("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(e,'"'):'"as.'.concat(e,'"')),t===void 0?Hi:Mi,{attribute:n?"mtls_endpoint_aliases.".concat(e):e});return Jn(r,o),r}function lt(t,e,n,o){return n&&t.mtls_endpoint_aliases&&e in t.mtls_endpoint_aliases?mo(t.mtls_endpoint_aliases[e],e,n,o):mo(t[e],e,n,o)}class Vt extends Error{constructor(e,n){var o;super(e,n),_(this,"cause",void 0),_(this,"code",void 0),_(this,"error",void 0),_(this,"status",void 0),_(this,"error_description",void 0),_(this,"response",void 0),this.name=this.constructor.name,this.code=Wi,this.cause=n.cause,this.error=n.cause.error,this.status=n.response.status,this.error_description=n.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:n.response}),(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}class Bo extends Error{constructor(e,n){var o,r;super(e,n),_(this,"cause",void 0),_(this,"code",void 0),_(this,"error",void 0),_(this,"error_description",void 0),this.name=this.constructor.name,this.code=zi,this.cause=n.cause,this.error=n.cause.get("error"),this.error_description=(o=n.cause.get("error_description"))!==null&&o!==void 0?o:void 0,(r=Error.captureStackTrace)===null||r===void 0||r.call(Error,this,this.constructor)}}class Vn extends Error{constructor(e,n){var o;super(e,n),_(this,"cause",void 0),_(this,"code",void 0),_(this,"response",void 0),_(this,"status",void 0),this.name=this.constructor.name,this.code=Ni,this.cause=n.cause,this.status=n.response.status,this.response=n.response,Object.defineProperty(this,"response",{enumerable:!1}),(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}const Pi="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",Ri=new RegExp("^[,\\s]*("+Pi+")"),Ii=new RegExp('^[,\\s]*([a-zA-Z0-9!#$%&\\\'\\*\\+\\-\\.\\^_`\\|~]+)\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"[,\\s]*(.*)'),Oi=new RegExp("^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)[,\\s]*(.*)"),xi=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function Fn(t,e,n){if(t.status!==e){let r;var o;throw(function(i){let a;if(a=(function(s){if(!Fe(s,Response))throw R('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");const c=s.headers.get("www-authenticate");if(c===null)return;const u=[];let l=c;for(;l;){var m;let d=l.match(Ri);const h=(m=d)===null||m===void 0?void 0:m[1].toLowerCase();if(!h)return;const w=l.substring(d[0].length);if(w&&!w.match(/^[\s,]/))return;const f=w.match(/^\s+(.*)$/),p=!!f;l=f?f[1]:void 0;const g={};let b;if(p)for(;l;){let E,y;if(d=l.match(Ii)){if([,E,y,l]=d,y.includes("\\"))try{y=JSON.parse('"'.concat(y,'"'))}catch{}g[E.toLowerCase()]=y}else{if(!(d=l.match(Oi))){if(d=l.match(xi)){if(Object.keys(g).length)break;[,b,l]=d;break}return}[,E,y,l]=d,g[E.toLowerCase()]=y}}else l=w||void 0;const k={scheme:h,parameters:g};b&&(k.token68=b),u.push(k)}return u.length?u:void 0})(i))throw new Vn("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:a,response:i})})(t),(r=await(async function(i){if(i.status>399&&i.status<500){ht(i),Zo(i);try{const a=await i.clone().json();if(Ct(a)&&typeof a.error=="string"&&a.error.length)return a}catch{}}})(t))?(await((o=t.body)===null||o===void 0?void 0:o.cancel()),new Vt("server responded with an error in the response body",{cause:r,response:t})):T('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),qn,t)}}function Xo(t){if(!Zn.has(t))throw R('"options.DPoP" is not a valid DPoPHandle',"ERR_INVALID_ARG_VALUE")}function Yo(t){var e;return(e=t.headers.get("content-type"))===null||e===void 0?void 0:e.split(";")[0]}async function Gn(t,e,n,o,r,i,a){return await n(t,e,r,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((a==null?void 0:a[te])||fetch)(o.href,{body:r,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Go(o,a==null?void 0:a.signal)})}async function dt(t,e,n,o,r,i){var a;const s=lt(t,"token_endpoint",e.use_mtls_endpoint_aliases,(i==null?void 0:i[q])!==!0);r.set("grant_type",o);const c=Jt(i==null?void 0:i.headers);c.set("accept","application/json"),(i==null?void 0:i.DPoP)!==void 0&&(Xo(i.DPoP),await i.DPoP.addProof(s,c,"POST"));const u=await Gn(t,e,n,s,r,c,i);return i==null||(a=i.DPoP)===null||a===void 0||a.cacheNonce(u,s),u}const Qo=new WeakMap,Ci=new WeakMap;function In(t){if(!t.id_token)return;const e=Qo.get(t);if(!e)throw R('"ref" was already garbage collected or did not resolve from the proper sources',"ERR_INVALID_ARG_VALUE");return e}async function Je(t,e,n,o,r,i){if($(t),ee(e),!Fe(n,Response))throw R('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await Fn(n,200,"Token Endpoint"),ht(n);const a=await Ft(n);if(D(a.access_token,'"response" body "access_token" property',A,{body:a}),D(a.token_type,'"response" body "token_type" property',A,{body:a}),a.token_type=a.token_type.toLowerCase(),a.expires_in!==void 0){let s=typeof a.expires_in!="number"?parseFloat(a.expires_in):a.expires_in;we(s,!0,'"response" body "expires_in" property',A,{body:a}),a.expires_in=s}if(a.refresh_token!==void 0&&D(a.refresh_token,'"response" body "refresh_token" property',A,{body:a}),a.scope!==void 0&&typeof a.scope!="string")throw T('"response" body "scope" property must be a string',A,{body:a});if(a.id_token!==void 0){D(a.id_token,'"response" body "id_token" property',A,{body:a});const s=["aud","exp","iat","iss","sub"];e.require_auth_time===!0&&s.push("auth_time"),e.default_max_age!==void 0&&(we(e.default_max_age,!0,'"client.default_max_age"'),s.push("auth_time")),o!=null&&o.length&&s.push(...o);const{claims:c,jwt:u}=await(async function(l,m,d,h,w){let f,p,{0:g,1:b,length:k}=l.split(".");if(k===5){if(w===void 0)throw new G("JWE decryption is not configured",{cause:l});l=await w(l),{0:g,1:b,length:k}=l.split(".")}if(k!==3)throw T("Invalid JWT",A,l);try{f=JSON.parse(Me(xe(g)))}catch(y){throw T("failed to parse JWT Header body as base64url encoded JSON",Lt,y)}if(!Ct(f))throw T("JWT Header must be a top level object",A,l);if(m(f),f.crit!==void 0)throw new G('no JWT "crit" header parameter extensions are supported',{cause:{header:f}});try{p=JSON.parse(Me(xe(b)))}catch(y){throw T("failed to parse JWT Payload body as base64url encoded JSON",Lt,y)}if(!Ct(p))throw T("JWT Payload must be a top level object",A,l);const E=Dt()+d;if(p.exp!==void 0){if(typeof p.exp!="number")throw T('unexpected JWT "exp" (expiration time) claim type',A,{claims:p});if(p.exp<=E-h)throw T('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',it,{claims:p,now:E,tolerance:h,claim:"exp"})}if(p.iat!==void 0&&typeof p.iat!="number")throw T('unexpected JWT "iat" (issued at) claim type',A,{claims:p});if(p.iss!==void 0&&typeof p.iss!="string")throw T('unexpected JWT "iss" (issuer) claim type',A,{claims:p});if(p.nbf!==void 0){if(typeof p.nbf!="number")throw T('unexpected JWT "nbf" (not before) claim type',A,{claims:p});if(p.nbf>E+h)throw T('unexpected JWT "nbf" (not before) claim value',it,{claims:p,now:E,tolerance:h,claim:"nbf"})}if(p.aud!==void 0&&typeof p.aud!="string"&&!Array.isArray(p.aud))throw T('unexpected JWT "aud" (audience) claim type',A,{claims:p});return{header:f,claims:p,jwt:l}})(a.id_token,Fi.bind(void 0,e.id_token_signed_response_alg,t.id_token_signing_alg_values_supported,"RS256"),jt(e),Rn(e),r).then(Ki.bind(void 0,s)).then(Di.bind(void 0,t)).then(ji.bind(void 0,e.client_id));if(Array.isArray(c.aud)&&c.aud.length!==1){if(c.azp===void 0)throw T('ID Token "aud" (audience) claim includes additional untrusted audiences',se,{claims:c,claim:"aud"});if(c.azp!==e.client_id)throw T('unexpected ID Token "azp" (authorized party) claim value',se,{expected:e.client_id,claims:c,claim:"azp"})}c.auth_time!==void 0&&we(c.auth_time,!0,'ID Token "auth_time" (authentication time)',A,{claims:c}),Ci.set(n,u),Qo.set(a,c)}if((i==null?void 0:i[a.token_type])!==void 0)i[a.token_type](n,a);else if(a.token_type!=="dpop"&&a.token_type!=="bearer")throw new G("unsupported `token_type` value",{cause:{body:a}});return a}function ji(t,e){if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(t))throw T('unexpected JWT "aud" (audience) claim value',se,{expected:t,claims:e.claims,claim:"aud"})}else if(e.claims.aud!==t)throw T('unexpected JWT "aud" (audience) claim value',se,{expected:t,claims:e.claims,claim:"aud"});return e}function Di(t,e){var n,o;const r=(n=(o=t[nr])===null||o===void 0?void 0:o.call(t,e))!==null&&n!==void 0?n:t.issuer;if(e.claims.iss!==r)throw T('unexpected JWT "iss" (issuer) claim value',se,{expected:r,claims:e.claims,claim:"iss"});return e}const Zn=new WeakSet,fo=Symbol(),Li={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function Ki(t,e){for(const n of t)if(e.claims[n]===void 0)throw T('JWT "'.concat(n,'" (').concat(Li[n],") claim missing"),A,{claims:e.claims});return e}const on=Symbol(),rn=Symbol();async function Ui(t,e,n,o){return typeof(o==null?void 0:o.expectedNonce)=="string"||typeof(o==null?void 0:o.maxAge)=="number"||o!=null&&o.requireIdToken?(async function(r,i,a,s,c,u,l){const m=[];switch(s){case void 0:s=on;break;case on:break;default:D(s,'"expectedNonce" argument'),m.push("nonce")}switch(c!=null||(c=i.default_max_age),c){case void 0:c=rn;break;case rn:break;default:we(c,!0,'"maxAge" argument'),m.push("auth_time")}const d=await Je(r,i,a,m,u,l);D(d.id_token,'"response" body "id_token" property',A,{body:d});const h=In(d);if(c!==rn){const w=Dt()+jt(i),f=Rn(i);if(h.auth_time+c<w-f)throw T("too much time has elapsed since the last End-User authentication",it,{claims:h,now:w,tolerance:f,claim:"auth_time"})}if(s===on){if(h.nonce!==void 0)throw T('unexpected ID Token "nonce" claim value',se,{expected:void 0,claims:h,claim:"nonce"})}else if(h.nonce!==s)throw T('unexpected ID Token "nonce" claim value',se,{expected:s,claims:h,claim:"nonce"});return d})(t,e,n,o.expectedNonce,o.maxAge,o[ce],o.recognizedTokenTypes):(async function(r,i,a,s,c){const u=await Je(r,i,a,void 0,s,c),l=In(u);if(l){if(i.default_max_age!==void 0){we(i.default_max_age,!0,'"client.default_max_age"');const m=Dt()+jt(i),d=Rn(i);if(l.auth_time+i.default_max_age<m-d)throw T("too much time has elapsed since the last End-User authentication",it,{claims:l,now:m,tolerance:d,claim:"auth_time"})}if(l.nonce!==void 0)throw T('unexpected ID Token "nonce" claim value',se,{expected:void 0,claims:l,claim:"nonce"})}return u})(t,e,n,o==null?void 0:o[ce],o==null?void 0:o.recognizedTokenTypes)}const Ni="OAUTH_WWW_AUTHENTICATE_CHALLENGE",Wi="OAUTH_RESPONSE_BODY_ERROR",On="OAUTH_UNSUPPORTED_OPERATION",zi="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Lt="OAUTH_PARSE_ERROR",A="OAUTH_INVALID_RESPONSE",$o="OAUTH_RESPONSE_IS_NOT_JSON",qn="OAUTH_RESPONSE_IS_NOT_CONFORM",er="OAUTH_HTTP_REQUEST_FORBIDDEN",tr="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",it="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",se="OAUTH_JWT_CLAIM_COMPARISON_FAILED",xn="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",Hi="OAUTH_MISSING_SERVER_METADATA",Mi="OAUTH_INVALID_SERVER_METADATA";function ht(t){if(t.bodyUsed)throw R('"response" body has been used already',"ERR_INVALID_ARG_VALUE")}function yo(t){const{algorithm:e}=t;if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new G("unsupported ".concat(e.name," modulusLength"),{cause:t})}function Ji(t){const{algorithm:e}=t;switch(e.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new G("unsupported ECDSA namedCurve",{cause:t})}}async function Vi(t){if(t.method!=="POST")throw R("form_post responses are expected to use the POST method","ERR_INVALID_ARG_VALUE",{cause:t});if(Yo(t)!=="application/x-www-form-urlencoded")throw R("form_post responses are expected to use the application/x-www-form-urlencoded content-type","ERR_INVALID_ARG_VALUE",{cause:t});return(async function(e){if(e.bodyUsed)throw R("form_post Request instances must contain a readable body","ERR_INVALID_ARG_VALUE",{cause:e});return e.text()})(t)}function Fi(t,e,n,o){if(t===void 0)if(Array.isArray(e)){if(!e.includes(o.alg))throw T('unexpected JWT "alg" header parameter',A,{header:o,expected:e,reason:"authorization server metadata"})}else{if(n===void 0)throw T('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:t,issuer:e,fallback:n});if(typeof n=="string"?o.alg!==n:typeof n=="function"?!n(o.alg):!n.includes(o.alg))throw T('unexpected JWT "alg" header parameter',A,{header:o,expected:n,reason:"default value"})}else if(typeof t=="string"?o.alg!==t:!t.includes(o.alg))throw T('unexpected JWT "alg" header parameter',A,{header:o,expected:t,reason:"client configuration"})}function Pe(t,e){const{0:n,length:o}=t.getAll(e);if(o>1)throw T('"'.concat(e,'" parameter must be provided only once'),A);return n}const Gi=Symbol(),Zi=Symbol();function qi(t,e,n,o){if($(t),ee(e),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw R('"parameters" must be an instance of URLSearchParams, or URL',"ERR_INVALID_ARG_TYPE");if(Pe(n,"response"))throw T('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',A,{parameters:n});const r=Pe(n,"iss"),i=Pe(n,"state");if(!r&&t.authorization_response_iss_parameter_supported)throw T('response parameter "iss" (issuer) missing',A,{parameters:n});if(r&&r!==t.issuer)throw T('unexpected "iss" (issuer) response parameter value',A,{expected:t.issuer,parameters:n});switch(o){case void 0:case Zi:if(i!==void 0)throw T('unexpected "state" response parameter encountered',A,{expected:void 0,parameters:n});break;case Gi:break;default:if(D(o,'"expectedState" argument'),i!==o)throw T(i===void 0?'response parameter "state" missing':'unexpected "state" response parameter value',A,{expected:o,parameters:n})}if(Pe(n,"error"))throw new Bo("authorization response from the server is an error",{cause:n});const a=Pe(n,"id_token"),s=Pe(n,"token");if(a!==void 0||s!==void 0)throw new G("implicit and hybrid flows are not supported");return c=new URLSearchParams(n),Zn.add(c),c;var c}async function Ft(t){let e,n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:Zo;try{e=await t.json()}catch(o){throw n(t),T('failed to parse "response" body as JSON',Lt,o)}if(!Ct(e))throw T('"response" body must be a top level object',A,{body:e});return e}const an=Symbol(),nr=Symbol(),go=new TextEncoder,at=new TextDecoder;function sn(t){const e=new Uint8Array(t.length);for(let n=0;n<t.length;n++){const o=t.charCodeAt(n);if(o>127)throw new TypeError("non-ASCII string encountered in encode()");e[n]=o}return e}function or(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);const e=atob(t),n=new Uint8Array(e.length);for(let o=0;o<e.length;o++)n[o]=e.charCodeAt(o);return n}function et(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:at.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=at.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return or(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}class W extends Error{constructor(e,n){var o;super(e,n),_(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}_(W,"code","ERR_JOSE_GENERIC");class B extends W{constructor(e,n){let o=arguments.length>2&&arguments[2]!==void 0?arguments[2]:"unspecified",r=arguments.length>3&&arguments[3]!==void 0?arguments[3]:"unspecified";super(e,{cause:{claim:o,reason:r,payload:n}}),_(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),_(this,"claim",void 0),_(this,"reason",void 0),_(this,"payload",void 0),this.claim=o,this.reason=r,this.payload=n}}_(B,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class Cn extends W{constructor(e,n){let o=arguments.length>2&&arguments[2]!==void 0?arguments[2]:"unspecified",r=arguments.length>3&&arguments[3]!==void 0?arguments[3]:"unspecified";super(e,{cause:{claim:o,reason:r,payload:n}}),_(this,"code","ERR_JWT_EXPIRED"),_(this,"claim",void 0),_(this,"reason",void 0),_(this,"payload",void 0),this.claim=o,this.reason=r,this.payload=n}}_(Cn,"code","ERR_JWT_EXPIRED");class rr extends W{constructor(){super(...arguments),_(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}_(rr,"code","ERR_JOSE_ALG_NOT_ALLOWED");class F extends W{constructor(){super(...arguments),_(this,"code","ERR_JOSE_NOT_SUPPORTED")}}_(F,"code","ERR_JOSE_NOT_SUPPORTED");_(class extends W{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),_(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED");_(class extends W{constructor(){super(...arguments),_(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class K extends W{constructor(){super(...arguments),_(this,"code","ERR_JWS_INVALID")}}_(K,"code","ERR_JWS_INVALID");class jn extends W{constructor(){super(...arguments),_(this,"code","ERR_JWT_INVALID")}}_(jn,"code","ERR_JWT_INVALID");_(class extends W{constructor(){super(...arguments),_(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class Bn extends W{constructor(){super(...arguments),_(this,"code","ERR_JWKS_INVALID")}}_(Bn,"code","ERR_JWKS_INVALID");class Xn extends W{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),_(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}_(Xn,"code","ERR_JWKS_NO_MATCHING_KEY");class ir extends W{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),_(this,Symbol.asyncIterator,void 0),_(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}_(ir,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class ar extends W{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),_(this,"code","ERR_JWKS_TIMEOUT")}}_(ar,"code","ERR_JWKS_TIMEOUT");class sr extends W{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),_(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}_(sr,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const ne=function(t){let e=arguments.length>1&&arguments[1]!==void 0?arguments[1]:"algorithm.name";return new TypeError("CryptoKey does not support this operation, its ".concat(e," must be ").concat(t))},Ue=(t,e)=>t.name===e;function cn(t){return parseInt(t.name.slice(4),10)}function Bi(t,e,n){switch(e){case"HS256":case"HS384":case"HS512":{if(!Ue(t.algorithm,"HMAC"))throw ne("HMAC");const o=parseInt(e.slice(2),10);if(cn(t.algorithm.hash)!==o)throw ne("SHA-".concat(o),"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!Ue(t.algorithm,"RSASSA-PKCS1-v1_5"))throw ne("RSASSA-PKCS1-v1_5");const o=parseInt(e.slice(2),10);if(cn(t.algorithm.hash)!==o)throw ne("SHA-".concat(o),"algorithm.hash");break}case"PS256":case"PS384":case"PS512":{if(!Ue(t.algorithm,"RSA-PSS"))throw ne("RSA-PSS");const o=parseInt(e.slice(2),10);if(cn(t.algorithm.hash)!==o)throw ne("SHA-".concat(o),"algorithm.hash");break}case"Ed25519":case"EdDSA":if(!Ue(t.algorithm,"Ed25519"))throw ne("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":if(!Ue(t.algorithm,e))throw ne(e);break;case"ES256":case"ES384":case"ES512":{if(!Ue(t.algorithm,"ECDSA"))throw ne("ECDSA");const o=(function(r){switch(r){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}})(e);if(t.algorithm.namedCurve!==o)throw ne(o,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}(function(o,r){if(!o.usages.includes(r))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(r,"."))})(t,n)}function cr(t,e){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];if((o=o.filter(Boolean)).length>2){const a=o.pop();t+="one of type ".concat(o.join(", "),", or ").concat(a,".")}else o.length===2?t+="one of type ".concat(o[0]," or ").concat(o[1],"."):t+="of type ".concat(o[0],".");if(e==null)t+=" Received ".concat(e);else if(typeof e=="function"&&e.name)t+=" Received function ".concat(e.name);else if(typeof e=="object"&&e!=null){var i;(i=e.constructor)!==null&&i!==void 0&&i.name&&(t+=" Received an instance of ".concat(e.constructor.name))}return t}const wo=function(t,e){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return cr("Key for the ".concat(t," algorithm must be "),e,...o)},ur=t=>{if((t==null?void 0:t[Symbol.toStringTag])==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},lr=t=>(t==null?void 0:t[Symbol.toStringTag])==="KeyObject",vo=t=>ur(t)||lr(t);function be(t){if(typeof(e=t)!="object"||e===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;var e;if(Object.getPrototypeOf(t)===null)return!0;let n=t;for(;Object.getPrototypeOf(n)!==null;)n=Object.getPrototypeOf(n);return Object.getPrototypeOf(t)===n}const un=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let n=0;n<t.byteLength;n++)if(t[n]!==e[n])return!1;return!0},tt=t=>{const e=t.data[t.pos++];if(128&e){const n=127&e;let o=0;for(let r=0;r<n;r++)o=o<<8|t.data[t.pos++];return o}return e},nt=(t,e,n)=>{if(t.data[t.pos++]!==e)throw new Error(n)},bo=(t,e)=>{const n=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,n},Xi=t=>{const e=(r=>{nt(r,6,"Expected algorithm OID");const i=tt(r);return bo(r,i)})(t);if(un(e,[43,101,110]))return"X25519";if(!un(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");nt(t,6,"Expected curve OID");const n=tt(t),o=bo(t,n);for(const{name:r,oid:i}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(un(o,i))return r;throw new Error("Unsupported named curve")},Yi=async(t,e,n,o)=>{var r;let i,a;const s=()=>["sign"];switch(n){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:"SHA-".concat(n.slice(-3))},a=s();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(n.slice(-3))},a=s();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(n.slice(-3),10)||1)},a=["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[n]},a=s();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{const c=o.getNamedCurve(e);i=c==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:c}}catch{throw new F("Invalid or unsupported key format")}a=["deriveBits"];break;case"Ed25519":case"EdDSA":i={name:"Ed25519"},a=s();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:n},a=s();break;default:throw new F('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(t,e,i,(r=o==null?void 0:o.extractable)!==null&&r!==void 0?r:!1,a)},Qi=(t,e,n)=>{var o;const r=((a,s)=>or(a.replace(s,"")))(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);let i=n;return e!=null&&(o=e.startsWith)!==null&&o!==void 0&&o.call(e,"ECDH-ES")&&(i||(i={}),i.getNamedCurve=a=>{const s={data:a,pos:0};return(function(c){nt(c,48,"Invalid PKCS#8 structure"),tt(c),nt(c,2,"Expected version field");const u=tt(c);c.pos+=u,nt(c,48,"Expected algorithm identifier"),tt(c)})(s),Xi(s)}),Yi("pkcs8",r,e,i)};async function Rt(t){var e,n;if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const{algorithm:o,keyUsages:r}=(function(a){let s,c;switch(a.kty){case"AKP":switch(a.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":s={name:a.alg},c=a.priv?["sign"]:["verify"];break;default:throw new F('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"RSA":switch(a.alg){case"PS256":case"PS384":case"PS512":s={name:"RSA-PSS",hash:"SHA-".concat(a.alg.slice(-3))},c=a.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":s={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(a.alg.slice(-3))},c=a.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(a.alg.slice(-3),10)||1)},c=a.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new F('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"EC":switch(a.alg){case"ES256":s={name:"ECDSA",namedCurve:"P-256"},c=a.d?["sign"]:["verify"];break;case"ES384":s={name:"ECDSA",namedCurve:"P-384"},c=a.d?["sign"]:["verify"];break;case"ES512":s={name:"ECDSA",namedCurve:"P-521"},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":s={name:"ECDH",namedCurve:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new F('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"OKP":switch(a.alg){case"Ed25519":case"EdDSA":s={name:"Ed25519"},c=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":s={name:a.crv},c=a.d?["deriveBits"]:[];break;default:throw new F('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;default:throw new F('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:s,keyUsages:c}})(t),i=S({},t);return i.kty!=="AKP"&&delete i.alg,delete i.use,crypto.subtle.importKey("jwk",i,o,(e=t.ext)!==null&&e!==void 0?e:!t.d&&!t.priv,(n=t.key_ops)!==null&&n!==void 0?n:r)}const Dn=t=>be(t)&&typeof t.kty=="string";let ye;const _o=async function(t,e,n){let o=arguments.length>3&&arguments[3]!==void 0&&arguments[3];ye||(ye=new WeakMap);let r=ye.get(t);if(r!=null&&r[n])return r[n];const i=await Rt(S(S({},e),{},{alg:n}));return o&&Object.freeze(t),r?r[n]=i:ye.set(t,{[n]:i}),i};async function $i(t,e){if(t instanceof Uint8Array||ur(t))return t;if(lr(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return((o,r)=>{ye||(ye=new WeakMap);let i=ye.get(o);if(i!=null&&i[r])return i[r];const a=o.type==="public",s=!!a;let c;if(o.asymmetricKeyType==="x25519"){switch(r){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}c=o.toCryptoKey(o.asymmetricKeyType,s,a?[]:["deriveBits"])}if(o.asymmetricKeyType==="ed25519"){if(r!=="EdDSA"&&r!=="Ed25519")throw new TypeError("given KeyObject instance cannot be used for this algorithm");c=o.toCryptoKey(o.asymmetricKeyType,s,[a?"verify":"sign"])}switch(o.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(r!==o.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");c=o.toCryptoKey(o.asymmetricKeyType,s,[a?"verify":"sign"])}if(o.asymmetricKeyType==="rsa"){let l;switch(r){case"RSA-OAEP":l="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":l="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":l="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":l="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(r.startsWith("RSA-OAEP"))return o.toCryptoKey({name:"RSA-OAEP",hash:l},s,a?["encrypt"]:["decrypt"]);c=o.toCryptoKey({name:r.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:l},s,[a?"verify":"sign"])}if(o.asymmetricKeyType==="ec"){var u;const l=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get((u=o.asymmetricKeyDetails)===null||u===void 0?void 0:u.namedCurve);if(!l)throw new TypeError("given KeyObject instance cannot be used for this algorithm");r==="ES256"&&l==="P-256"&&(c=o.toCryptoKey({name:"ECDSA",namedCurve:l},s,[a?"verify":"sign"])),r==="ES384"&&l==="P-384"&&(c=o.toCryptoKey({name:"ECDSA",namedCurve:l},s,[a?"verify":"sign"])),r==="ES512"&&l==="P-521"&&(c=o.toCryptoKey({name:"ECDSA",namedCurve:l},s,[a?"verify":"sign"])),r.startsWith("ECDH-ES")&&(c=o.toCryptoKey({name:"ECDH",namedCurve:l},s,a?[]:["deriveBits"]))}if(!c)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return i?i[r]=c:ye.set(o,{[r]:c}),c})(t,e)}catch(o){if(o instanceof TypeError)throw o}let n=t.export({format:"jwk"});return _o(t,n,e)}if(Dn(t))return t.k?et(t.k):_o(t,t,e,!0);throw new Error("unreachable")}const Ne=t=>t==null?void 0:t[Symbol.toStringTag],ln=(t,e,n)=>{if(e.use!==void 0){let i;switch(n){case"sign":case"verify":i="sig";break;case"encrypt":case"decrypt":i="enc"}if(e.use!==i)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(i,'" when present'))}if(e.alg!==void 0&&e.alg!==t)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(t,'" when present'));if(Array.isArray(e.key_ops)){var o,r;let i;switch(!0){case n==="verify":case t==="dir":case t.includes("CBC-HS"):i=n;break;case t.startsWith("PBES2"):i="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(t):i=!t.includes("GCM")&&t.endsWith("KW")?"unwrapKey":n;break;case n==="encrypt":i="wrapKey";break;case n==="decrypt":i=t.startsWith("RSA")?"unwrapKey":"deriveBits"}if(i&&((o=e.key_ops)===null||o===void 0||(r=o.includes)===null||r===void 0?void 0:r.call(o,i))===!1)throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(i,'" when present'))}return!0};function ea(t,e,n){switch(t.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((o,r,i)=>{if(!(r instanceof Uint8Array)){if(Dn(r)){if((a=>a.kty==="oct"&&typeof a.k=="string")(r)&&ln(o,r,i))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!vo(r))throw new TypeError(wo(o,r,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(r.type!=="secret")throw new TypeError("".concat(Ne(r),' instances for symmetric algorithms must be of type "secret"'))}})(t,e,n);break;default:((o,r,i)=>{if(Dn(r))switch(i){case"decrypt":case"sign":if((a=>a.kty!=="oct"&&(a.kty==="AKP"&&typeof a.priv=="string"||typeof a.d=="string"))(r)&&ln(o,r,i))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if((a=>a.kty!=="oct"&&a.d===void 0&&a.priv===void 0)(r)&&ln(o,r,i))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!vo(r))throw new TypeError(wo(o,r,"CryptoKey","KeyObject","JSON Web Key"));if(r.type==="secret")throw new TypeError("".concat(Ne(r),' instances for asymmetric algorithms must not be of type "secret"'));if(r.type==="public")switch(i){case"sign":throw new TypeError("".concat(Ne(r),' instances for asymmetric algorithm signing must be of type "private"'));case"decrypt":throw new TypeError("".concat(Ne(r),' instances for asymmetric algorithm decryption must be of type "private"'))}if(r.type==="private")switch(i){case"verify":throw new TypeError("".concat(Ne(r),' instances for asymmetric algorithm verifying must be of type "public"'));case"encrypt":throw new TypeError("".concat(Ne(r),' instances for asymmetric algorithm encryption must be of type "public"'))}})(t,e,n)}}var _t,dn;let re,ko;(typeof navigator>"u"||(_t=navigator.userAgent)===null||_t===void 0||(dn=_t.startsWith)===null||dn===void 0||!dn.call(_t,"Mozilla/5.0 "))&&(ko="".concat("openid-client","/").concat("v6.8.1"),re={"user-agent":ko});const N=t=>It.get(t);let It,kt;function dr(t){return t!==void 0?po(t):(kt||(kt=new WeakMap),(e,n,o,r)=>{let i;return(i=kt.get(n))||((function(a,s){if(typeof a!="string")throw ie("".concat(s," must be a string"),mt);if(a.length===0)throw ie("".concat(s," must not be empty"),pt)})(n.client_secret,'"metadata.client_secret"'),i=po(n.client_secret),kt.set(n,i)),i(e,n,o,r)})}const ge=te,pt="ERR_INVALID_ARG_VALUE",mt="ERR_INVALID_ARG_TYPE";function ie(t,e,n){const o=new TypeError(t,{cause:n});return Object.assign(o,{code:e}),o}function ta(t){return(async function(e){return D(e,"codeVerifier"),xe(await crypto.subtle.digest("SHA-256",Me(e)))})(t)}function na(){return qo()}class Kt extends Error{constructor(e,n){var o;super(e,n),_(this,"code",void 0),this.name=this.constructor.name,this.code=n==null?void 0:n.code,(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}function z(t,e,n){return new Kt(t,{cause:e,code:n})}function H(t){if(t instanceof TypeError||t instanceof Kt||t instanceof Vt||t instanceof Bo||t instanceof Vn)throw t;if(t instanceof Mn)switch(t.code){case er:throw z("only requests to HTTPS are allowed",t,t.code);case tr:throw z("only requests to HTTP or HTTPS are allowed",t,t.code);case qn:throw z("unexpected HTTP response status code",t.cause,t.code);case $o:throw z("unexpected response content-type",t.cause,t.code);case Lt:throw z("parsing error occured",t,t.code);case A:throw z("invalid response encountered",t,t.code);case se:throw z("unexpected JWT claim value encountered",t,t.code);case xn:throw z("unexpected JSON attribute value encountered",t,t.code);case it:throw z("JWT timestamp claim value failed validation",t,t.code);default:throw z(t.message,t,t.code)}if(t instanceof G)throw z("unsupported operation",t,t.code);if(t instanceof DOMException)switch(t.name){case"OperationError":throw z("runtime operation error",t,On);case"NotSupportedError":throw z("runtime unsupported operation",t,On);case"TimeoutError":throw z("operation timed out",t,"OAUTH_TIMEOUT");case"AbortError":throw z("operation aborted",t,"OAUTH_ABORT")}throw new Kt("something went wrong",{cause:t})}async function oa(t,e,n,o,r){const i=await(async function(c,u){var l,m;if(!(c instanceof URL))throw ie('"server" must be an instance of URL',mt);const d=!c.href.includes("/.well-known/"),h=(l=u==null?void 0:u.timeout)!==null&&l!==void 0?l:30,w=AbortSignal.timeout(1e3*h),f=await(d?Si(c,{algorithm:u==null?void 0:u.algorithm,[te]:u==null?void 0:u[ge],[q]:u==null||(m=u.execute)===null||m===void 0?void 0:m.includes(To),signal:w,headers:new Headers(re)}):((u==null?void 0:u[ge])||fetch)((Jn(c,u==null||(p=u.execute)===null||p===void 0||!p.includes(To)),c.href),{headers:Object.fromEntries(new Headers(S({accept:"application/json"},re)).entries()),body:void 0,method:"GET",redirect:"manual",signal:w})).then((g=>(async function(b,k){const E=b;if(!(E instanceof URL)&&E!==an)throw R('"expectedIssuerIdentifier" must be an instance of URL',"ERR_INVALID_ARG_TYPE");if(!Fe(k,Response))throw R('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");if(k.status!==200)throw T('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',qn,k);ht(k);const y=await Ft(k);if(D(y.issuer,'"response" body "issuer" property',A,{body:y}),E!==an&&new URL(y.issuer).href!==E.href)throw T('"response" body "issuer" property does not match the expected value',xn,{expected:E.href,body:y,attribute:"issuer"});return y})(an,g))).catch(H);var p;return d&&new URL(f.issuer).href!==c.href&&((function(g,b,k){return!(g.origin!=="https://login.microsoftonline.com"||k!=null&&k.algorithm&&k.algorithm!=="oidc"||(b[hr]=!0,0))})(c,f,u)||(function(g,b){return!(!g.hostname.endsWith(".b2clogin.com")||b!=null&&b.algorithm&&b.algorithm!=="oidc")})(c,u)||(()=>{throw new Kt("discovered metadata issuer does not match the expected issuer",{code:xn,cause:{expected:c.href,body:f,attribute:"issuer"}})})()),f})(t,r),a=new Ut(i,e,n,o);let s=N(a);if(r!=null&&r[ge]&&(s.fetch=r[ge]),r!=null&&r.timeout&&(s.timeout=r.timeout),r!=null&&r.execute)for(const c of r.execute)c(a);return a}new TextDecoder;const hr=Symbol();class Ut{constructor(e,n,o,r){var i,a,s,c,u;if(typeof n!="string"||!n.length)throw ie('"clientId" must be a non-empty string',mt);if(typeof o=="string"&&(o={client_secret:o}),((i=o)===null||i===void 0?void 0:i.client_id)!==void 0&&n!==o.client_id)throw ie('"clientId" and "metadata.client_id" must be the same',pt);const l=S(S({},structuredClone(o)),{},{client_id:n});let m;l[Tn]=(a=(s=o)===null||s===void 0?void 0:s[Tn])!==null&&a!==void 0?a:0,l[An]=(c=(u=o)===null||u===void 0?void 0:u[An])!==null&&c!==void 0?c:30,m=r||(typeof l.client_secret=="string"&&l.client_secret.length?dr(l.client_secret):(f,p,g,b)=>{g.set("client_id",p.client_id)});let d=Object.freeze(l);const h=structuredClone(e);hr in e&&(h[nr]=f=>{let{claims:{tid:p}}=f;return e.issuer.replace("{tenantid}",p)});let w=Object.freeze(h);It||(It=new WeakMap),It.set(this,{__proto__:null,as:w,c:d,auth:m,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(N(this).as);return(function(n){Object.defineProperties(n,(function(o){return{supportsPKCE:{__proto__:null,value(){var r;let i=arguments.length>0&&arguments[0]!==void 0?arguments[0]:"S256";return((r=o.code_challenge_methods_supported)===null||r===void 0?void 0:r.includes(i))===!0}}}})(n))})(e),e}clientMetadata(){return structuredClone(N(this).c)}get timeout(){return N(this).timeout}set timeout(e){N(this).timeout=e}get[ge](){return N(this).fetch}set[ge](e){N(this).fetch=e}}function ft(t){Object.defineProperties(t,(function(e){let n;if(e.expires_in!==void 0){const o=new Date;o.setSeconds(o.getSeconds()+e.expires_in),n=o.getTime()}return{expiresIn:{__proto__:null,value(){if(n){const o=Date.now();return n>o?Math.floor((n-o)/1e3):0}}},claims:{__proto__:null,value(){try{return In(this)}catch{return}}}}})(t))}async function So(t,e,n){var o;let r=arguments.length>3&&arguments[3]!==void 0&&arguments[3];const i=(o=t.headers.get("retry-after"))===null||o===void 0?void 0:o.trim();if(i===void 0)return;let a;if(/^\d+$/.test(i))a=parseInt(i,10);else{const s=new Date(i);if(Number.isFinite(s.getTime())){const c=new Date,u=s.getTime()-c.getTime();u>0&&(a=Math.ceil(u/1e3))}}if(r&&!Number.isFinite(a))throw new Mn("invalid Retry-After header value",{cause:t});a>e&&await pr(a-e,n)}function pr(t,e){return new Promise(((n,o)=>{const r=i=>{try{e.throwIfAborted()}catch(s){return void o(s)}if(i<=0)return void n();const a=Math.min(i,5);setTimeout((()=>r(i-a)),1e3*a)};r(t)}))}async function Eo(t,e){le(t);const{as:n,c:o,auth:r,fetch:i,tlsOnly:a,timeout:s}=N(t);return(async function(c,u,l,m,d){$(c),ee(u);const h=lt(c,"backchannel_authentication_endpoint",u.use_mtls_endpoint_aliases,(d==null?void 0:d[q])!==!0),w=new URLSearchParams(m);w.set("client_id",u.client_id);const f=Jt(d==null?void 0:d.headers);return f.set("accept","application/json"),Gn(c,u,l,h,w,f,d)})(n,o,r,e,{[te]:i,[q]:!a,headers:new Headers(re),signal:De(s)}).then((c=>(async function(u,l,m){if($(u),ee(l),!Fe(m,Response))throw R('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await Fn(m,200,"Backchannel Authentication Endpoint"),ht(m);const d=await Ft(m);D(d.auth_req_id,'"response" body "auth_req_id" property',A,{body:d});let h=typeof d.expires_in!="number"?parseFloat(d.expires_in):d.expires_in;return we(h,!0,'"response" body "expires_in" property',A,{body:d}),d.expires_in=h,d.interval!==void 0&&we(d.interval,!1,'"response" body "interval" property',A,{body:d}),d})(n,o,c))).catch(H)}async function mr(t,e,n,o){var r,i;le(t),n=new URLSearchParams(n);let a=(r=e.interval)!==null&&r!==void 0?r:5;const s=(i=o==null?void 0:o.signal)!==null&&i!==void 0?i:AbortSignal.timeout(1e3*e.expires_in);try{await pr(a,s)}catch(y){H(y)}const{as:c,c:u,auth:l,fetch:m,tlsOnly:d,nonRepudiation:h,timeout:w,decrypt:f}=N(t),p=(y,P)=>mr(t,S(S({},e),{},{interval:y}),n,S(S({},o),{},{signal:s,flag:P})),g=await(async function(y,P,J,U,he){$(y),ee(P),D(U,'"authReqId"');const M=new URLSearchParams(he==null?void 0:he.additionalParameters);return M.set("auth_req_id",U),dt(y,P,J,"urn:openid:params:grant-type:ciba",M,he)})(c,u,l,e.auth_req_id,{[te]:m,[q]:!d,additionalParameters:n,DPoP:o==null?void 0:o.DPoP,headers:new Headers(re),signal:s.aborted?s:De(w)}).catch(H);var b;if(g.status===503&&g.headers.has("retry-after"))return await So(g,a,s,!0),await((b=g.body)===null||b===void 0?void 0:b.cancel()),p(a);const k=(async function(y,P,J,U){return Je(y,P,J,void 0,U==null?void 0:U[ce],U==null?void 0:U.recognizedTokenTypes)})(c,u,g,{[ce]:f});let E;try{E=await k}catch(y){if(yt(y,o))return p(a,ve);if(y instanceof Vt)switch(y.error){case"slow_down":a+=5;case"authorization_pending":return await So(y.response,a,s),p(a)}H(y)}return E.id_token&&await(h==null?void 0:h(g)),ft(E),E}function To(t){N(t).tlsOnly=!1}async function fr(t,e,n,o,r){if(le(t),!((r==null?void 0:r.flag)===ve||e instanceof URL||(function(y,P){try{return Object.getPrototypeOf(y)[Symbol.toStringTag]===P}catch{return!1}})(e,"Request")))throw ie('"currentUrl" must be an instance of URL, or Request',mt);let i,a;const{as:s,c,auth:u,fetch:l,tlsOnly:m,jarm:d,hybrid:h,nonRepudiation:w,timeout:f,decrypt:p,implicit:g}=N(t);if((r==null?void 0:r.flag)===ve)i=r.authResponse,a=r.redirectUri;else{if(!(e instanceof URL)){const y=e;switch(e=new URL(e.url),y.method){case"GET":break;case"POST":const P=new URLSearchParams(await Vi(y));if(h)e.hash=P.toString();else for(const[J,U]of P.entries())e.searchParams.append(J,U);break;default:throw ie("unexpected Request HTTP method",pt)}}switch(a=(function(y){return(y=new URL(y)).search="",y.hash="",y.href})(e),!0){case!!d:i=await d(e,n==null?void 0:n.expectedState);break;case!!h:i=await h(e,n==null?void 0:n.expectedNonce,n==null?void 0:n.expectedState,n==null?void 0:n.maxAge);break;case!!g:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=qi(s,c,e.searchParams,n==null?void 0:n.expectedState)}catch(y){H(y)}}}const b=await(async function(y,P,J,U,he,M,Le){if($(y),ee(P),!Zn.has(U))throw R('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',"ERR_INVALID_ARG_VALUE");D(he,'"redirectUri"');const Qn=Pe(U,"code");if(!Qn)throw T('no authorization code in "callbackParameters"',A);const gt=new URLSearchParams(Le==null?void 0:Le.additionalParameters);return gt.set("redirect_uri",he),gt.set("code",Qn),M!==fo&&(D(M,'"codeVerifier"'),gt.set("code_verifier",M)),dt(y,P,J,"authorization_code",gt,Le)})(s,c,u,i,a,(n==null?void 0:n.pkceCodeVerifier)||fo,{additionalParameters:o,[te]:l,[q]:!m,DPoP:r==null?void 0:r.DPoP,headers:new Headers(re),signal:De(f)}).catch(H);typeof(n==null?void 0:n.expectedNonce)!="string"&&typeof(n==null?void 0:n.maxAge)!="number"||(n.idTokenExpected=!0);const k=Ui(s,c,b,{expectedNonce:n==null?void 0:n.expectedNonce,maxAge:n==null?void 0:n.maxAge,requireIdToken:n==null?void 0:n.idTokenExpected,[ce]:p});let E;try{E=await k}catch(y){if(yt(y,r))return fr(t,void 0,n,o,S(S({},r),{},{flag:ve,authResponse:i,redirectUri:a}));H(y)}return E.id_token&&await(w==null?void 0:w(b)),ft(E),E}async function yr(t,e,n,o){le(t),n=new URLSearchParams(n);const{as:r,c:i,auth:a,fetch:s,tlsOnly:c,nonRepudiation:u,timeout:l,decrypt:m}=N(t),d=await(async function(f,p,g,b,k){$(f),ee(p),D(b,'"refreshToken"');const E=new URLSearchParams(k==null?void 0:k.additionalParameters);return E.set("refresh_token",b),dt(f,p,g,"refresh_token",E,k)})(r,i,a,e,{[te]:s,[q]:!c,additionalParameters:n,DPoP:o==null?void 0:o.DPoP,headers:new Headers(re),signal:De(l)}).catch(H),h=(async function(f,p,g,b){return Je(f,p,g,void 0,b==null?void 0:b[ce],b==null?void 0:b.recognizedTokenTypes)})(r,i,d,{[ce]:m});let w;try{w=await h}catch(f){if(yt(f,o))return yr(t,e,n,S(S({},o),{},{flag:ve}));H(f)}return w.id_token&&await(u==null?void 0:u(d)),ft(w),w}async function gr(t,e,n){le(t),e=new URLSearchParams(e);const{as:o,c:r,auth:i,fetch:a,tlsOnly:s,timeout:c}=N(t),u=await(async function(d,h,w,f,p){return $(d),ee(h),dt(d,h,w,"client_credentials",new URLSearchParams(f),p)})(o,r,i,e,{[te]:a,[q]:!s,DPoP:n==null?void 0:n.DPoP,headers:new Headers(re),signal:De(c)}).catch(H),l=(async function(d,h,w,f){return Je(d,h,w,void 0,void 0,void 0)})(o,r,u);let m;try{m=await l}catch(d){if(yt(d,n))return gr(t,e,S(S({},n),{},{flag:ve}));H(d)}return ft(m),m}function Ln(t,e){le(t);const{as:n,c:o,tlsOnly:r,hybrid:i,jarm:a,implicit:s}=N(t),c=lt(n,"authorization_endpoint",!1,r);if((e=new URLSearchParams(e)).has("client_id")||e.set("client_id",o.client_id),!e.has("request_uri")&&!e.has("request")){if(e.has("response_type")||e.set("response_type",i?"code id_token":s?"id_token":"code"),s&&!e.has("nonce"))throw ie("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",pt);a&&e.set("response_mode","jwt")}for(const[u,l]of e.entries())c.searchParams.append(u,l);return c}async function wr(t,e,n){le(t);const o=Ln(t,e),{as:r,c:i,auth:a,fetch:s,tlsOnly:c,timeout:u}=N(t),l=await(async function(h,w,f,p,g){var b;$(h),ee(w);const k=lt(h,"pushed_authorization_request_endpoint",w.use_mtls_endpoint_aliases,(g==null?void 0:g[q])!==!0),E=new URLSearchParams(p);E.set("client_id",w.client_id);const y=Jt(g==null?void 0:g.headers);y.set("accept","application/json"),(g==null?void 0:g.DPoP)!==void 0&&(Xo(g.DPoP),await g.DPoP.addProof(k,y,"POST"));const P=await Gn(h,w,f,k,E,y,g);return g==null||(b=g.DPoP)===null||b===void 0||b.cacheNonce(P,k),P})(r,i,a,o.searchParams,{[te]:s,[q]:!c,DPoP:n==null?void 0:n.DPoP,headers:new Headers(re),signal:De(u)}).catch(H),m=(async function(h,w,f){if($(h),ee(w),!Fe(f,Response))throw R('"response" must be an instance of Response',"ERR_INVALID_ARG_TYPE");await Fn(f,201,"Pushed Authorization Request Endpoint"),ht(f);const p=await Ft(f);D(p.request_uri,'"response" body "request_uri" property',A,{body:p});let g=typeof p.expires_in!="number"?parseFloat(p.expires_in):p.expires_in;return we(g,!0,'"response" body "expires_in" property',A,{body:p}),p.expires_in=g,p})(r,i,l);let d;try{d=await m}catch(h){if(yt(h,n))return wr(t,e,S(S({},n),{},{flag:ve}));H(h)}return Ln(t,{request_uri:d.request_uri})}function le(t){if(!(t instanceof Ut))throw ie('"config" must be an instance of Configuration',mt);if(Object.getPrototypeOf(t)!==Ut.prototype)throw ie("subclassing Configuration is not allowed",pt)}function De(t){return t?AbortSignal.timeout(1e3*t):void 0}function yt(t,e){return!(e==null||!e.DPoP||e.flag===ve)&&(function(n){if(n instanceof Vn){const{0:o,length:r}=n.cause;return r===1&&o.scheme==="dpop"&&o.parameters.error==="use_dpop_nonce"}return n instanceof Vt&&n.error==="use_dpop_nonce"})(t)}Object.freeze(Ut.prototype);const ve=Symbol();async function Yn(t,e,n,o){le(t);const{as:r,c:i,auth:a,fetch:s,tlsOnly:c,timeout:u,decrypt:l}=N(t),m=await(async function(d,h,w,f,p,g){return $(d),ee(h),D(f,'"grantType"'),dt(d,h,w,f,new URLSearchParams(p),g)})(r,i,a,e,new URLSearchParams(n),{[te]:s,[q]:!c,DPoP:void 0,headers:new Headers(re),signal:De(u)}).then((d=>{let h;return e==="urn:ietf:params:oauth:grant-type:token-exchange"&&(h={n_a:()=>{}}),(async function(w,f,p,g){return Je(w,f,p,void 0,g==null?void 0:g[ce],g==null?void 0:g.recognizedTokenTypes)})(r,i,d,{[ce]:l,recognizedTokenTypes:h})})).catch(H);return ft(m),m}async function ra(t,e,n){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError((function(o){for(var r=arguments.length,i=new Array(r>1?r-1:0),a=1;a<r;a++)i[a-1]=arguments[a];return cr("Key must be ",o,...i)})(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:"SHA-".concat(t.slice(-3)),name:"HMAC"},!1,[n])}return Bi(e,t,n),e}async function ia(t,e,n,o){const r=await ra(t,e,"verify");(function(a,s){if(a.startsWith("RS")||a.startsWith("PS")){const{modulusLength:c}=s.algorithm;if(typeof c!="number"||c<2048)throw new TypeError("".concat(a," requires key modulusLength to be 2048 bits or larger"))}})(t,r);const i=(function(a,s){const c="SHA-".concat(a.slice(-3));switch(a){case"HS256":case"HS384":case"HS512":return{hash:c,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:c,name:"RSA-PSS",saltLength:parseInt(a.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:c,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:c,name:"ECDSA",namedCurve:s.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:a};default:throw new F("alg ".concat(a," is not supported either by JOSE or your javascript runtime"))}})(t,r.algorithm);try{return await crypto.subtle.verify(i,r,n,o)}catch{return!1}}async function aa(t,e,n){if(!be(t))throw new K("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new K('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new K("JWS Protected Header incorrect type");if(t.payload===void 0)throw new K("JWS Payload missing");if(typeof t.signature!="string")throw new K("JWS Signature missing or incorrect type");if(t.header!==void 0&&!be(t.header))throw new K("JWS Unprotected Header incorrect type");let o={};if(t.protected)try{const f=et(t.protected);o=JSON.parse(at.decode(f))}catch{throw new K("JWS Protected Header is invalid")}if(!(function(){for(var f=arguments.length,p=new Array(f),g=0;g<f;g++)p[g]=arguments[g];const b=p.filter(Boolean);if(b.length===0||b.length===1)return!0;let k;for(const E of b){const y=Object.keys(E);if(k&&k.size!==0)for(const P of y){if(k.has(P))return!1;k.add(P)}else k=new Set(y)}return!0})(o,t.header))throw new K("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const r=S(S({},o),t.header),i=(function(f,p,g,b,k){if(k.crit!==void 0&&(b==null?void 0:b.crit)===void 0)throw new f('"crit" (Critical) Header Parameter MUST be integrity protected');if(!b||b.crit===void 0)return new Set;if(!Array.isArray(b.crit)||b.crit.length===0||b.crit.some((y=>typeof y!="string"||y.length===0)))throw new f('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let E;E=g!==void 0?new Map([...Object.entries(g),...p.entries()]):p;for(const y of b.crit){if(!E.has(y))throw new F('Extension Header Parameter "'.concat(y,'" is not recognized'));if(k[y]===void 0)throw new f('Extension Header Parameter "'.concat(y,'" is missing'));if(E.get(y)&&b[y]===void 0)throw new f('Extension Header Parameter "'.concat(y,'" MUST be integrity protected'))}return new Set(b.crit)})(K,new Map([["b64",!0]]),n==null?void 0:n.crit,o,r);let a=!0;if(i.has("b64")&&(a=o.b64,typeof a!="boolean"))throw new K('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:s}=r;if(typeof s!="string"||!s)throw new K('JWS "alg" (Algorithm) Header Parameter missing or invalid');const c=n&&(function(f,p){if(p!==void 0&&(!Array.isArray(p)||p.some((g=>typeof g!="string"))))throw new TypeError('"'.concat(f,'" option must be an array of strings'));if(p)return new Set(p)})("algorithms",n.algorithms);if(c&&!c.has(s))throw new rr('"alg" (Algorithm) Header Parameter value not allowed');if(a){if(typeof t.payload!="string")throw new K("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new K("JWS Payload must be a string or an Uint8Array instance");let u=!1;typeof e=="function"&&(e=await e(o,t),u=!0),ea(s,e,"verify");const l=(function(){for(var f=arguments.length,p=new Array(f),g=0;g<f;g++)p[g]=arguments[g];const b=p.reduce(((y,P)=>{let{length:J}=P;return y+J}),0),k=new Uint8Array(b);let E=0;for(const y of p)k.set(y,E),E+=y.length;return k})(t.protected!==void 0?sn(t.protected):new Uint8Array,sn("."),typeof t.payload=="string"?a?sn(t.payload):go.encode(t.payload):t.payload);let m;try{m=et(t.signature)}catch{throw new K("Failed to base64url decode the signature")}const d=await $i(e,s);if(!await ia(s,d,m,l))throw new sr;let h;if(a)try{h=et(t.payload)}catch{throw new K("Failed to base64url decode the payload")}else h=typeof t.payload=="string"?go.encode(t.payload):t.payload;const w={payload:h};return t.protected!==void 0&&(w.protectedHeader=o),t.header!==void 0&&(w.unprotectedHeader=t.header),u?S(S({},w),{},{key:d}):w}const sa=t=>Math.floor(t.getTime()/1e3),ca=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function Ao(t){const e=ca.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");const n=parseFloat(e[2]);let o;switch(e[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":o=Math.round(n);break;case"minute":case"minutes":case"min":case"mins":case"m":o=Math.round(60*n);break;case"hour":case"hours":case"hr":case"hrs":case"h":o=Math.round(3600*n);break;case"day":case"days":case"d":o=Math.round(86400*n);break;case"week":case"weeks":case"w":o=Math.round(604800*n);break;default:o=Math.round(31557600*n)}return e[1]==="-"||e[4]==="ago"?-o:o}const Po=t=>t.includes("/")?t.toLowerCase():"application/".concat(t.toLowerCase()),ua=(t,e)=>typeof t=="string"?e.includes(t):!!Array.isArray(t)&&e.some(Set.prototype.has.bind(new Set(t)));async function la(t,e,n){var o;const r=await(async function(s,c,u){if(s instanceof Uint8Array&&(s=at.decode(s)),typeof s!="string")throw new K("Compact JWS must be a string or Uint8Array");const{0:l,1:m,2:d,length:h}=s.split(".");if(h!==3)throw new K("Invalid Compact JWS");const w=await aa({payload:m,protected:l,signature:d},c,u),f={payload:w.payload,protectedHeader:w.protectedHeader};return typeof c=="function"?S(S({},f),{},{key:w.key}):f})(t,e,n);if((o=r.protectedHeader.crit)!==null&&o!==void 0&&o.includes("b64")&&r.protectedHeader.b64===!1)throw new jn("JWTs MUST NOT use unencoded payload");const i=(function(s,c){let u,l=arguments.length>2&&arguments[2]!==void 0?arguments[2]:{};try{u=JSON.parse(at.decode(c))}catch{}if(!be(u))throw new jn("JWT Claims Set must be a top-level JSON object");const{typ:m}=l;if(m&&(typeof s.typ!="string"||Po(s.typ)!==Po(m)))throw new B('unexpected "typ" JWT header value',u,"typ","check_failed");const{requiredClaims:d=[],issuer:h,subject:w,audience:f,maxTokenAge:p}=l,g=[...d];p!==void 0&&g.push("iat"),f!==void 0&&g.push("aud"),w!==void 0&&g.push("sub"),h!==void 0&&g.push("iss");for(const y of new Set(g.reverse()))if(!(y in u))throw new B('missing required "'.concat(y,'" claim'),u,y,"missing");if(h&&!(Array.isArray(h)?h:[h]).includes(u.iss))throw new B('unexpected "iss" claim value',u,"iss","check_failed");if(w&&u.sub!==w)throw new B('unexpected "sub" claim value',u,"sub","check_failed");if(f&&!ua(u.aud,typeof f=="string"?[f]:f))throw new B('unexpected "aud" claim value',u,"aud","check_failed");let b;switch(typeof l.clockTolerance){case"string":b=Ao(l.clockTolerance);break;case"number":b=l.clockTolerance;break;case"undefined":b=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const{currentDate:k}=l,E=sa(k||new Date);if((u.iat!==void 0||p)&&typeof u.iat!="number")throw new B('"iat" claim must be a number',u,"iat","invalid");if(u.nbf!==void 0){if(typeof u.nbf!="number")throw new B('"nbf" claim must be a number',u,"nbf","invalid");if(u.nbf>E+b)throw new B('"nbf" claim timestamp check failed',u,"nbf","check_failed")}if(u.exp!==void 0){if(typeof u.exp!="number")throw new B('"exp" claim must be a number',u,"exp","invalid");if(u.exp<=E-b)throw new Cn('"exp" claim timestamp check failed',u,"exp","check_failed")}if(p){const y=E-u.iat;if(y-b>(typeof p=="number"?p:Ao(p)))throw new Cn('"iat" claim timestamp check failed (too far in the past)',u,"iat","check_failed");if(y<0-b)throw new B('"iat" claim timestamp check failed (it should be in the past)',u,"iat","check_failed")}return u})(r.protectedHeader,r.payload,n),a={payload:i,protectedHeader:r.protectedHeader};return typeof e=="function"?S(S({},a),{},{key:r.key}):a}function da(t){return be(t)}var St,hn,Et=new WeakMap,pn=new WeakMap;class ha{constructor(e){if(L(this,Et,void 0),L(this,pn,new WeakMap),!(function(n){return n&&typeof n=="object"&&Array.isArray(n.keys)&&n.keys.every(da)})(e))throw new Bn("JSON Web Key Set malformed");x(Et,this,structuredClone(e))}jwks(){return v(Et,this)}async getKey(e,n){const{alg:o,kid:r}=S(S({},e),n==null?void 0:n.header),i=(function(u){switch(typeof u=="string"&&u.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new F('Unsupported "alg" value for a JSON Web Key Set')}})(o),a=v(Et,this).keys.filter((u=>{let l=i===u.kty;if(l&&typeof r=="string"&&(l=r===u.kid),!l||typeof u.alg!="string"&&i!=="AKP"||(l=o===u.alg),l&&typeof u.use=="string"&&(l=u.use==="sig"),l&&Array.isArray(u.key_ops)&&(l=u.key_ops.includes("verify")),l)switch(o){case"ES256":l=u.crv==="P-256";break;case"ES384":l=u.crv==="P-384";break;case"ES512":l=u.crv==="P-521";break;case"Ed25519":case"EdDSA":l=u.crv==="Ed25519"}return l})),{0:s,length:c}=a;if(c===0)throw new Xn;if(c!==1){const u=new ir,l=v(pn,this);throw u[Symbol.asyncIterator]=vi((function*(){for(const m of a)try{yield yield wi(Ro(l,m,o))}catch{}})),u}return Ro(v(pn,this),s,o)}}async function Ro(t,e,n){const o=t.get(e)||t.set(e,{}).get(e);if(o[n]===void 0){const r=await(async function(i,a,s){var c;if(!be(i))throw new TypeError("JWK must be an object");let u;switch(a!=null||(a=i.alg),u!=null||(u=(c=void 0)!==null&&c!==void 0?c:i.ext),i.kty){case"oct":if(typeof i.k!="string"||!i.k)throw new TypeError('missing "k" (Key Value) Parameter value');return et(i.k);case"RSA":if("oth"in i&&i.oth!==void 0)throw new F('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Rt(S(S({},i),{},{alg:a,ext:u}));case"AKP":if(typeof i.alg!="string"||!i.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(a!==void 0&&a!==i.alg)throw new TypeError("JWK alg and alg option value mismatch");return Rt(S(S({},i),{},{ext:u}));case"EC":case"OKP":return Rt(S(S({},i),{},{alg:a,ext:u}));default:throw new F('Unsupported "kty" (Key Type) Parameter value')}})(S(S({},e),{},{ext:!0}),n);if(r instanceof Uint8Array||r.type!=="public")throw new Bn("JSON Web Key Set members must be public keys");o[n]=r}return o[n]}function Io(t){const e=new ha(t),n=async(o,r)=>e.getKey(o,r);return Object.defineProperties(n,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),n}let Kn;(typeof navigator>"u"||(St=navigator.userAgent)===null||St===void 0||(hn=St.startsWith)===null||hn===void 0||!hn.call(St,"Mozilla/5.0 "))&&(Kn="".concat("jose","/").concat("v6.1.3"));const vr=Symbol(),mn=Symbol();var fn=new WeakMap,yn=new WeakMap,gn=new WeakMap,Tt=new WeakMap,ke=new WeakMap,ae=new WeakMap,pe=new WeakMap,wn=new WeakMap,Se=new WeakMap,Ee=new WeakMap;class pa{constructor(e,n){if(L(this,fn,void 0),L(this,yn,void 0),L(this,gn,void 0),L(this,Tt,void 0),L(this,ke,void 0),L(this,ae,void 0),L(this,pe,void 0),L(this,wn,void 0),L(this,Se,void 0),L(this,Ee,void 0),!(e instanceof URL))throw new TypeError("url must be an instance of URL");var o,r;x(fn,this,new URL(e.href)),x(yn,this,typeof(n==null?void 0:n.timeoutDuration)=="number"?n==null?void 0:n.timeoutDuration:5e3),x(gn,this,typeof(n==null?void 0:n.cooldownDuration)=="number"?n==null?void 0:n.cooldownDuration:3e4),x(Tt,this,typeof(n==null?void 0:n.cacheMaxAge)=="number"?n==null?void 0:n.cacheMaxAge:6e5),x(pe,this,new Headers(n==null?void 0:n.headers)),Kn&&!v(pe,this).has("User-Agent")&&v(pe,this).set("User-Agent",Kn),v(pe,this).has("accept")||(v(pe,this).set("accept","application/json"),v(pe,this).append("accept","application/jwk-set+json")),x(wn,this,n==null?void 0:n[vr]),(n==null?void 0:n[mn])!==void 0&&(x(Ee,this,n==null?void 0:n[mn]),o=n==null?void 0:n[mn],r=v(Tt,this),typeof o=="object"&&o!==null&&"uat"in o&&typeof o.uat=="number"&&!(Date.now()-o.uat>=r)&&"jwks"in o&&be(o.jwks)&&Array.isArray(o.jwks.keys)&&Array.prototype.every.call(o.jwks.keys,be)&&(x(ke,this,v(Ee,this).uat),x(Se,this,Io(v(Ee,this).jwks))))}pendingFetch(){return!!v(ae,this)}coolingDown(){return typeof v(ke,this)=="number"&&Date.now()<v(ke,this)+v(gn,this)}fresh(){return typeof v(ke,this)=="number"&&Date.now()<v(ke,this)+v(Tt,this)}jwks(){var e;return(e=v(Se,this))===null||e===void 0?void 0:e.jwks()}async getKey(e,n){v(Se,this)&&this.fresh()||await this.reload();try{return await v(Se,this).call(this,e,n)}catch(o){if(o instanceof Xn&&this.coolingDown()===!1)return await this.reload(),v(Se,this).call(this,e,n);throw o}}async reload(){v(ae,this)&&(typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel")&&x(ae,this,void 0),v(ae,this)||x(ae,this,(async function(e,n,o){const i=await(arguments.length>3&&arguments[3]!==void 0?arguments[3]:fetch)(e,{method:"GET",signal:o,redirect:"manual",headers:n}).catch((a=>{throw a.name==="TimeoutError"?new ar:a}));if(i.status!==200)throw new W("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new W("Failed to parse the JSON Web Key Set HTTP response as JSON")}})(v(fn,this).href,v(pe,this),AbortSignal.timeout(v(yn,this)),v(wn,this)).then((e=>{x(Se,this,Io(e)),v(Ee,this)&&(v(Ee,this).uat=Date.now(),v(Ee,this).jwks=e),x(ke,this,Date.now()),x(ae,this,void 0)})).catch((e=>{throw x(ae,this,void 0),e}))),await v(ae,this)}}const ma=["mfaToken"],fa=["mfaToken"];var Te,At,Ae,fe,He,I,Xe,C,Oo=class extends Error{constructor(t,e){super(e),_(this,"code",void 0),this.name="NotSupportedError",this.code=t}},de=class extends Error{constructor(t,e,n){super(e),_(this,"cause",void 0),_(this,"code",void 0),this.code=t,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},ya=class extends de{constructor(t,e){super("token_by_code_error",t,e),this.name="TokenByCodeError"}},ga=class extends de{constructor(t,e){super("token_by_client_credentials_error",t,e),this.name="TokenByClientCredentialsError"}},wa=class extends de{constructor(t,e){super("token_by_refresh_token_error",t,e),this.name="TokenByRefreshTokenError"}},vn=class extends de{constructor(t,e){super("token_for_connection_error",t,e),this.name="TokenForConnectionErrorCode"}},oe=class extends de{constructor(t,e){super("token_exchange_error",t,e),this.name="TokenExchangeError"}},me=class extends Error{constructor(t){super(t),_(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},bn=class extends de{constructor(t){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",t),_(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},va=class extends de{constructor(t){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",t),this.name="BuildAuthorizationUrlError"}},ba=class extends de{constructor(t){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",t),this.name="BuildLinkUserUrlError"}},_a=class extends de{constructor(t){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",t),this.name="BuildUnlinkUserUrlError"}},ka=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),_(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}};function Un(t){return Object.entries(t).filter((e=>{let[,n]=e;return n!==void 0})).reduce(((e,n)=>S(S({},e),{},{[n[0]]:n[1]})),{})}var Gt=class extends Error{constructor(t,e,n){super(e),_(this,"cause",void 0),_(this,"code",void 0),this.code=t,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},br=class extends Gt{constructor(t,e){super("mfa_list_authenticators_error",t,e),this.name="MfaListAuthenticatorsError"}},_r=class extends Gt{constructor(t,e){super("mfa_enrollment_error",t,e),this.name="MfaEnrollmentError"}},Sa=class extends Gt{constructor(t,e){super("mfa_delete_authenticator_error",t,e),this.name="MfaDeleteAuthenticatorError"}},kr=class extends Gt{constructor(t,e){super("mfa_challenge_error",t,e),this.name="MfaChallengeError"}};function Ea(t){return{id:t.id,authenticatorType:t.authenticator_type,active:t.active,name:t.name,oobChannels:t.oob_channels,type:t.type}}var Ta=(Te=new WeakMap,At=new WeakMap,Ae=new WeakMap,class{constructor(t){var e;L(this,Te,void 0),L(this,At,void 0),L(this,Ae,void 0),x(Te,this,"https://".concat(t.domain)),x(At,this,t.clientId),x(Ae,this,(e=t.customFetch)!==null&&e!==void 0?e:function(){return fetch(...arguments)})}async listAuthenticators(t){const e="".concat(v(Te,this),"/mfa/authenticators"),{mfaToken:n}=t,o=await v(Ae,this).call(this,e,{method:"GET",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!o.ok){const r=await o.json();throw new br(r.error_description||"Failed to list authenticators",r)}return(await o.json()).map(Ea)}async enrollAuthenticator(t){const e="".concat(v(Te,this),"/mfa/associate"),{mfaToken:n}=t,o=lo(t,ma),r={authenticator_types:o.authenticatorTypes};"oobChannels"in o&&(r.oob_channels=o.oobChannels),"phoneNumber"in o&&o.phoneNumber&&(r.phone_number=o.phoneNumber),"email"in o&&o.email&&(r.email=o.email);const i=await v(Ae,this).call(this,e,{method:"POST",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const a=await i.json();throw new _r(a.error_description||"Failed to enroll authenticator",a)}return(function(a){if(a.authenticator_type==="otp")return{authenticatorType:"otp",secret:a.secret,barcodeUri:a.barcode_uri,recoveryCodes:a.recovery_codes,id:a.id};if(a.authenticator_type==="oob")return{authenticatorType:"oob",oobChannel:a.oob_channel,oobCode:a.oob_code,bindingMethod:a.binding_method,id:a.id};throw new Error("Unexpected authenticator type: ".concat(a.authenticator_type))})(await i.json())}async deleteAuthenticator(t){const{authenticatorId:e,mfaToken:n}=t,o="".concat(v(Te,this),"/mfa/authenticators/").concat(encodeURIComponent(e)),r=await v(Ae,this).call(this,o,{method:"DELETE",headers:{Authorization:"Bearer ".concat(n),"Content-Type":"application/json"}});if(!r.ok){const i=await r.json();throw new Sa(i.error_description||"Failed to delete authenticator",i)}}async challengeAuthenticator(t){const e="".concat(v(Te,this),"/mfa/challenge"),{mfaToken:n}=t,o=lo(t,fa),r={mfa_token:n,client_id:v(At,this),challenge_type:o.challengeType};o.authenticatorId&&(r.authenticator_id=o.authenticatorId);const i=await v(Ae,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!i.ok){const a=await i.json();throw new kr(a.error_description||"Failed to challenge authenticator",a)}return(function(a){const s={challengeType:a.challenge_type};return a.oob_code!==void 0&&(s.oobCode=a.oob_code),a.binding_method!==void 0&&(s.bindingMethod=a.binding_method),s})(await i.json())}}),Re=class Sr{constructor(e,n,o,r,i,a,s){_(this,"accessToken",void 0),_(this,"idToken",void 0),_(this,"refreshToken",void 0),_(this,"expiresAt",void 0),_(this,"scope",void 0),_(this,"claims",void 0),_(this,"authorizationDetails",void 0),_(this,"tokenType",void 0),_(this,"issuedTokenType",void 0),this.accessToken=e,this.idToken=o,this.refreshToken=r,this.expiresAt=n,this.scope=i,this.claims=a,this.authorizationDetails=s}static fromTokenEndpointResponse(e){const n=e.id_token?e.claims():void 0,o=new Sr(e.access_token,Math.floor(Date.now()/1e3)+Number(e.expires_in),e.id_token,e.refresh_token,e.scope,n,e.authorization_details);return o.tokenType=e.token_type,o.issuedTokenType=e.issued_token_type,o}},Nn="openid profile email offline_access",Aa=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function Er(t){if(t==null)throw new oe("subject_token is required");if(typeof t!="string")throw new oe("subject_token must be a string");if(t.trim().length===0)throw new oe("subject_token cannot be blank or whitespace");if(t!==t.trim())throw new oe("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(t))throw new oe("subject_token must not include the 'Bearer ' prefix")}function Tr(t,e){if(e){for(const[n,o]of Object.entries(e))if(!Aa.has(n))if(Array.isArray(o)){if(o.length>20)throw new oe("Parameter '".concat(n,"' exceeds maximum array size of ").concat(20));o.forEach((r=>{t.append(n,r)}))}else t.append(n,o)}}var Pa=(fe=new WeakMap,He=new WeakMap,I=new WeakMap,Xe=new WeakMap,C=new WeakSet,class{constructor(t){if((function(e,n){Vo(e,n),n.add(e)})(this,C),L(this,fe,void 0),L(this,He,void 0),L(this,I,void 0),L(this,Xe,void 0),_(this,"mfa",void 0),x(I,this,t),t.useMtls&&!t.customFetch)throw new Oo("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");this.mfa=new Ta({domain:v(I,this).domain,clientId:v(I,this).clientId,customFetch:v(I,this).customFetch})}async buildAuthorizationUrl(t){const{serverMetadata:e}=await j(C,this,Z).call(this);if(t!=null&&t.pushedAuthorizationRequests&&!e.pushed_authorization_request_endpoint)throw new Oo("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await j(C,this,_n).call(this,t)}catch(n){throw new va(n)}}async buildLinkUserUrl(t){try{const e=await j(C,this,_n).call(this,{authorizationParams:S(S({},t.authorizationParams),{},{requested_connection:t.connection,requested_connection_scope:t.connectionScope,scope:"openid link_account offline_access",id_token_hint:t.idToken})});return{linkUserUrl:e.authorizationUrl,codeVerifier:e.codeVerifier}}catch(e){throw new ba(e)}}async buildUnlinkUserUrl(t){try{const e=await j(C,this,_n).call(this,{authorizationParams:S(S({},t.authorizationParams),{},{requested_connection:t.connection,scope:"openid unlink_account",id_token_hint:t.idToken})});return{unlinkUserUrl:e.authorizationUrl,codeVerifier:e.codeVerifier}}catch(e){throw new _a(e)}}async backchannelAuthentication(t){const{configuration:e,serverMetadata:n}=await j(C,this,Z).call(this),o=Un(S(S({},v(I,this).authorizationParams),t==null?void 0:t.authorizationParams)),r=new URLSearchParams(S(S({scope:Nn},o),{},{client_id:v(I,this).clientId,binding_message:t.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:t.loginHint.sub})}));t.requestedExpiry&&r.append("requested_expiry",t.requestedExpiry.toString()),t.authorizationDetails&&r.append("authorization_details",JSON.stringify(t.authorizationDetails));try{const i=await Eo(e,r),a=await mr(e,i);return Re.fromTokenEndpointResponse(a)}catch(i){throw new bn(i)}}async initiateBackchannelAuthentication(t){const{configuration:e,serverMetadata:n}=await j(C,this,Z).call(this),o=Un(S(S({},v(I,this).authorizationParams),t==null?void 0:t.authorizationParams)),r=new URLSearchParams(S(S({scope:Nn},o),{},{client_id:v(I,this).clientId,binding_message:t.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:t.loginHint.sub})}));t.requestedExpiry&&r.append("requested_expiry",t.requestedExpiry.toString()),t.authorizationDetails&&r.append("authorization_details",JSON.stringify(t.authorizationDetails));try{const i=await Eo(e,r);return{authReqId:i.auth_req_id,expiresIn:i.expires_in,interval:i.interval}}catch(i){throw new bn(i)}}async backchannelAuthenticationGrant(t){let{authReqId:e}=t;const{configuration:n}=await j(C,this,Z).call(this),o=new URLSearchParams({auth_req_id:e});try{const r=await Yn(n,"urn:openid:params:grant-type:ciba",o);return Re.fromTokenEndpointResponse(r)}catch(r){throw new bn(r)}}async getTokenForConnection(t){var e;if(t.refreshToken&&t.accessToken)throw new vn("Either a refresh or access token should be specified, but not both.");const n=(e=t.accessToken)!==null&&e!==void 0?e:t.refreshToken;if(!n)throw new vn("Either a refresh or access token must be specified.");try{return await this.exchangeToken({connection:t.connection,subjectToken:n,subjectTokenType:t.accessToken?"urn:ietf:params:oauth:token-type:access_token":"urn:ietf:params:oauth:token-type:refresh_token",loginHint:t.loginHint})}catch(o){throw o instanceof oe?new vn(o.message,o.cause):o}}async exchangeToken(t){return"connection"in t?j(C,this,Ra).call(this,t):j(C,this,Ia).call(this,t)}async getTokenByCode(t,e){const{configuration:n}=await j(C,this,Z).call(this);try{const o=await fr(n,t,{pkceCodeVerifier:e.codeVerifier});return Re.fromTokenEndpointResponse(o)}catch(o){throw new ya("There was an error while trying to request a token.",o)}}async getTokenByRefreshToken(t){const{configuration:e}=await j(C,this,Z).call(this);try{const n=await yr(e,t.refreshToken);return Re.fromTokenEndpointResponse(n)}catch(n){throw new wa("The access token has expired and there was an error while trying to refresh it.",n)}}async getTokenByClientCredentials(t){const{configuration:e}=await j(C,this,Z).call(this);try{const n=new URLSearchParams({audience:t.audience});t.organization&&n.append("organization",t.organization);const o=await gr(e,n);return Re.fromTokenEndpointResponse(o)}catch(n){throw new ga("There was an error while trying to request a token.",n)}}async buildLogoutUrl(t){const{configuration:e,serverMetadata:n}=await j(C,this,Z).call(this);if(!n.end_session_endpoint){const o=new URL("https://".concat(v(I,this).domain,"/v2/logout"));return o.searchParams.set("returnTo",t.returnTo),o.searchParams.set("client_id",v(I,this).clientId),o}return(function(o,r){le(o);const{as:i,c:a,tlsOnly:s}=N(o),c=lt(i,"end_session_endpoint",!1,s);(r=new URLSearchParams(r)).has("client_id")||r.set("client_id",a.client_id);for(const[u,l]of r.entries())c.searchParams.append(u,l);return c})(e,{post_logout_redirect_uri:t.returnTo})}async verifyLogoutToken(t){const{serverMetadata:e}=await j(C,this,Z).call(this);v(Xe,this)||x(Xe,this,(function(o,r){const i=new pa(o,r),a=async(s,c)=>i.getKey(s,c);return Object.defineProperties(a,{coolingDown:{get:()=>i.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>i.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>i.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>i.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>i.jwks(),enumerable:!0,configurable:!1,writable:!1}}),a})(new URL(e.jwks_uri),{[vr]:v(I,this).customFetch}));const{payload:n}=await la(t.logoutToken,v(Xe,this),{issuer:e.issuer,audience:v(I,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]});if(!("sid"in n)&&!("sub"in n))throw new me('either "sid" or "sub" (or both) claims must be present');if("sid"in n&&typeof n.sid!="string")throw new me('"sid" claim must be a string');if("sub"in n&&typeof n.sub!="string")throw new me('"sub" claim must be a string');if("nonce"in n)throw new me('"nonce" claim is prohibited');if(!("events"in n))throw new me('"events" claim is missing');if(typeof n.events!="object"||n.events===null)throw new me('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in n.events))throw new me('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if(typeof n.events["http://schemas.openid.net/event/backchannel-logout"]!="object")throw new me('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:n.sid,sub:n.sub}}});async function Z(){if(v(fe,this)&&v(He,this))return{configuration:v(fe,this),serverMetadata:v(He,this)};const t=await j(C,this,Oa).call(this);return x(fe,this,await oa(new URL("https://".concat(v(I,this).domain)),v(I,this).clientId,{use_mtls_endpoint_aliases:v(I,this).useMtls},t,{[ge]:v(I,this).customFetch})),x(He,this,v(fe,this).serverMetadata()),v(fe,this)[ge]=v(I,this).customFetch||fetch,{configuration:v(fe,this),serverMetadata:v(He,this)}}async function Ra(t){var e,n;const{configuration:o}=await j(C,this,Z).call(this);if("audience"in t||"resource"in t)throw new oe("audience and resource parameters are not supported for Token Vault exchanges");Er(t.subjectToken);const r=new URLSearchParams({connection:t.connection,subject_token:t.subjectToken,subject_token_type:(e=t.subjectTokenType)!==null&&e!==void 0?e:"urn:ietf:params:oauth:token-type:access_token",requested_token_type:(n=t.requestedTokenType)!==null&&n!==void 0?n:"http://auth0.com/oauth/token-type/federated-connection-access-token"});t.loginHint&&r.append("login_hint",t.loginHint),t.scope&&r.append("scope",t.scope),Tr(r,t.extra);try{const i=await Yn(o,"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",r);return Re.fromTokenEndpointResponse(i)}catch(i){throw new oe("Failed to exchange token for connection '".concat(t.connection,"'."),i)}}async function Ia(t){const{configuration:e}=await j(C,this,Z).call(this);Er(t.subjectToken);const n=new URLSearchParams({subject_token_type:t.subjectTokenType,subject_token:t.subjectToken});t.audience&&n.append("audience",t.audience),t.scope&&n.append("scope",t.scope),t.requestedTokenType&&n.append("requested_token_type",t.requestedTokenType),t.organization&&n.append("organization",t.organization),Tr(n,t.extra);try{const o=await Yn(e,"urn:ietf:params:oauth:grant-type:token-exchange",n);return Re.fromTokenEndpointResponse(o)}catch(o){throw new oe("Failed to exchange token of type '".concat(t.subjectTokenType,"'").concat(t.audience?" for audience '".concat(t.audience,"'"):"","."),o)}}async function Oa(){if(!v(I,this).clientSecret&&!v(I,this).clientAssertionSigningKey&&!v(I,this).useMtls)throw new ka;if(v(I,this).useMtls)return(e,n,o,r)=>{o.set("client_id",n.client_id)};let t=v(I,this).clientAssertionSigningKey;return!t||t instanceof CryptoKey||(t=await(async function(e,n,o){if(typeof e!="string"||e.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Qi(e,n,o)})(t,v(I,this).clientAssertionSigningAlg||"RS256")),t?(function(e,n){return Ti(e)})(t):dr(v(I,this).clientSecret)}async function _n(t){const{configuration:e}=await j(C,this,Z).call(this),n=na(),o=await ta(n),r=Un(S(S({},v(I,this).authorizationParams),t==null?void 0:t.authorizationParams)),i=new URLSearchParams(S(S({scope:Nn},r),{},{client_id:v(I,this).clientId,code_challenge:o,code_challenge_method:"S256"}));return{authorizationUrl:t!=null&&t.pushedAuthorizationRequests?await wr(e,i):await Ln(e,i),codeVerifier:n}}class ue extends O{constructor(e,n){super(e,n),Object.setPrototypeOf(this,ue.prototype)}static fromPayload(e){let{error:n,error_description:o}=e;return new ue(n,o)}}class st extends ue{constructor(e,n){super(e,n),Object.setPrototypeOf(this,st.prototype)}}class Zt extends ue{constructor(e,n){super(e,n),Object.setPrototypeOf(this,Zt.prototype)}}class qt extends ue{constructor(e,n){super(e,n),Object.setPrototypeOf(this,qt.prototype)}}class Oe extends ue{constructor(e,n){super(e,n),Object.setPrototypeOf(this,Oe.prototype)}}class Bt extends ue{constructor(e,n){super(e,n),Object.setPrototypeOf(this,Bt.prototype)}}class xa{constructor(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,n){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},n),{createdAt:Date.now()}))}get(e){const n=this.contexts.get(e);if(n){if(!(Date.now()-n.createdAt>this.ttlMs))return n;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const[n,o]of this.contexts)e-o.createdAt>this.ttlMs&&this.contexts.delete(n)}get size(){return this.contexts.size}}class Ar{constructor(e,n){this.authJsMfaClient=e,this.auth0Client=n,this.contextManager=new xa}setMFAAuthDetails(e,n,o,r){this.contextManager.set(e,{scope:n,audience:o,mfaRequirements:r})}async getAuthenticators(e){var n,o;const r=this.contextManager.get(e);if(!(!((n=r==null?void 0:r.mfaRequirements)===null||n===void 0)&&n.challenge)||r.mfaRequirements.challenge.length===0)throw new st("invalid_request","challengeType is required and must contain at least one challenge type, please check mfa_required error payload");const i=r.mfaRequirements.challenge.map((a=>a.type));try{return(await this.authJsMfaClient.listAuthenticators({mfaToken:e})).filter((a=>!!a.type&&i.includes(a.type)))}catch(a){throw a instanceof br?new st((o=a.cause)===null||o===void 0?void 0:o.error,a.message):a}}async enroll(e){var n;const o=(function(r){const i=mi[r.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:r.mfaToken,authenticatorTypes:i.authenticatorTypes},i.oobChannels&&{oobChannels:i.oobChannels}),"phoneNumber"in r&&{phoneNumber:r.phoneNumber}),"email"in r&&{email:r.email})})(e);try{return await this.authJsMfaClient.enrollAuthenticator(o)}catch(r){throw r instanceof _r?new Zt((n=r.cause)===null||n===void 0?void 0:n.error,r.message):r}}async challenge(e){var n;try{const o={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(o.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(o)}catch(o){throw o instanceof kr?new qt((n=o.cause)===null||n===void 0?void 0:n.error,o.message):o}}async getEnrollmentFactors(e){const n=this.contextManager.get(e);if(!n||!n.mfaRequirements)throw new Bt("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return n.mfaRequirements.enroll&&n.mfaRequirements.enroll.length!==0?n.mfaRequirements.enroll:[]}async verify(e){const n=this.contextManager.get(e.mfaToken);if(!n)throw new Oe("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const o=(function(a){return"otp"in a&&a.otp?fi:"oobCode"in a&&a.oobCode?yi:"recoveryCode"in a&&a.recoveryCode?gi:void 0})(e);if(!o)throw new Oe("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const r=n.scope,i=n.audience;try{const a=await this.auth0Client._requestTokenForMfa({grant_type:o,mfaToken:e.mfaToken,scope:r,audience:i,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),a}catch(a){if(a instanceof Ve)this.setMFAAuthDetails(a.mfa_token,r,i,a.mfa_requirements);else if(a instanceof Oe)throw new Oe(a.error,a.error_description);throw a}}}class Ca{constructor(e){let n,o;if(this.userCache=new Hn().enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0},this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),typeof window<"u"&&(()=>{if(!xt())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(xt().subtle===void 0)throw new Error(`
-      auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.
-    `)})(),this.lockManager=($t||($t=Dr()),$t),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)o=e.cache;else{if(n=e.cacheLocation||"memory",!ao(n))throw new Error('Invalid cache location "'.concat(n,'"'));o=ao(n)()}var r;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:1e4,this.cookieStorage=e.legacySameSiteCookie===!1?We:ri,this.orgHintCookieName=(r=this.options.clientId,"auth0.".concat(r,".organization_hint")),this.isAuthenticatedCookieName=(u=>"auth0.".concat(u,".is.authenticated"))(this.options.clientId),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;const i=e.useCookiesForTransactions?this.cookieStorage:ii;var a;this.scope=(function(u,l){for(var m=arguments.length,d=new Array(m>2?m-2:0),h=2;h<m;h++)d[h-2]=arguments[h];if(typeof u!="object")return{default:Pt(l,u,...d)};let w={default:Pt(l,...d)};return Object.keys(u).forEach((f=>{const p=u[f];w[f]=Pt(l,p,...d)})),w})(this.options.authorizationParams.scope,"openid",this.options.useRefreshTokens?"offline_access":""),this.transactionManager=new Qr(i,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||Co,this.cacheManager=new Yr(o,o.allKeys?void 0:new ci(o,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new di(this.options.clientId):void 0,this.domainUrl=(a=this.options.domain,/^https?:\/\//.test(a)?a:"https://".concat(a)),this.tokenIssuer=((u,l)=>u?u.startsWith("https://")?u:"https://".concat(u,"/"):"".concat(l,"/"))(this.options.issuer,this.domainUrl);const s="".concat(this.domainUrl,"/me/"),c=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:()=>this.getTokenSilently({authorizationParams:{scope:"create:me:connected_accounts",audience:s},detailedResponse:!0})}));this.myAccountApi=new pi(c,s),this.authJsClient=new Pa({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new Ar(this.authJsClient.mfa,this),typeof window<"u"&&window.Worker&&this.options.useRefreshTokens&&n==="memory"&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new si)}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){const n=this.options.auth0Client||xo,o=jo(n,!0),r=encodeURIComponent(btoa(JSON.stringify(o)));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(r)}_authorizeUrl(e){return this._url("/authorize?".concat(kn(e)))}async _verifyIdToken(e,n,o){const r=await this.nowProvider();return ei({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:n,organization:o,leeway:this.options.leeway,max_age:(i=this.options.authorizationParams.max_age,typeof i!="string"?i:parseInt(i,10)||void 0),now:r});var i}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}async _prepareAuthorizeUrl(e,n,o){var r;const i=Xt(Ge()),a=Xt(Ge()),s=Ge(),c=await $n(s),u=to(c),l=await((r=this.dpop)===null||r===void 0?void 0:r.calculateThumbprint()),m=((h,w,f,p,g,b,k,E,y)=>Object.assign(Object.assign(Object.assign({client_id:h.clientId},h.authorizationParams),f),{scope:vt(w,f.scope,f.audience),response_type:"code",response_mode:E||"query",state:p,nonce:g,redirect_uri:k||h.authorizationParams.redirect_uri,code_challenge:b,code_challenge_method:"S256",dpop_jkt:y}))(this.options,this.scope,e,i,a,u,e.redirect_uri||this.options.authorizationParams.redirect_uri||o,n==null?void 0:n.response_mode,l),d=this._authorizeUrl(m);return{nonce:a,code_verifier:s,scope:m.scope,audience:m.audience||"default",redirect_uri:m.redirect_uri,state:i,url:d}}async loginWithPopup(e,n){var o;if(e=e||{},!(n=n||{}).popup&&(n.popup=(s=>{const c=window.screenX+(window.innerWidth-400)/2,u=window.screenY+(window.innerHeight-600)/2;return window.open(s,"auth0:authorize:popup","left=".concat(c,",top=").concat(u,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(""),!n.popup))throw new Mt;const r=await this._prepareAuthorizeUrl(e.authorizationParams||{},{response_mode:"web_message"},window.location.origin);n.popup.location.href=r.url;const i=await(s=>new Promise(((c,u)=>{let l;const m=setInterval((()=>{s.popup&&s.popup.closed&&(clearInterval(m),clearTimeout(d),window.removeEventListener("message",l,!1),u(new Ht(s.popup)))}),1e3),d=setTimeout((()=>{clearInterval(m),u(new zt(s.popup)),window.removeEventListener("message",l,!1)}),1e3*(s.timeoutInSeconds||60));l=function(h){if(h.data&&h.data.type==="authorization_response"){if(clearTimeout(d),clearInterval(m),window.removeEventListener("message",l,!1),s.closePopup!==!1&&s.popup.close(),h.data.response.error)return u(O.fromPayload(h.data.response));c(h.data.response)}},window.addEventListener("message",l)})))(Object.assign(Object.assign({},n),{timeoutInSeconds:n.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}));if(r.state!==i.state)throw new O("state_mismatch","Invalid state");const a=((o=e.authorizationParams)===null||o===void 0?void 0:o.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:r.audience,scope:r.scope,code_verifier:r.code_verifier,grant_type:"authorization_code",code:i.code,redirect_uri:r.redirect_uri},{nonceIn:r.nonce,organization:a})}async getUser(){var e;const n=await this._getIdTokenFromCache();return(e=n==null?void 0:n.decodedToken)===null||e===void 0?void 0:e.user}async getIdTokenClaims(){var e;const n=await this._getIdTokenFromCache();return(e=n==null?void 0:n.decodedToken)===null||e===void 0?void 0:e.claims}async loginWithRedirect(){var e;const n=so(arguments.length>0&&arguments[0]!==void 0?arguments[0]:{}),{openUrl:o,fragment:r,appState:i}=n,a=X(n,["openUrl","fragment","appState"]),s=((e=a.authorizationParams)===null||e===void 0?void 0:e.organization)||this.options.authorizationParams.organization,c=await this._prepareAuthorizeUrl(a.authorizationParams||{}),{url:u}=c,l=X(c,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},l),{appState:i,response_type:exports.ResponseType.Code}),s&&{organization:s}));const m=r?"".concat(u,"#").concat(r):u;o?await o(m):window.location.assign(m)}async handleRedirectCallback(){const e=(arguments.length>0&&arguments[0]!==void 0?arguments[0]:window.location.href).split("?").slice(1);if(e.length===0)throw new Error("There are no query params available for parsing.");const n=this.transactionManager.get();if(!n)throw new O("missing_transaction","Invalid state");this.transactionManager.remove();const o=(r=>{r.indexOf("#")>-1&&(r=r.substring(0,r.indexOf("#")));const i=new URLSearchParams(r);return{state:i.get("state"),code:i.get("code")||void 0,connect_code:i.get("connect_code")||void 0,error:i.get("error")||void 0,error_description:i.get("error_description")||void 0}})(e.join(""));return n.response_type===exports.ResponseType.ConnectCode?this._handleConnectAccountRedirectCallback(o,n):this._handleLoginRedirectCallback(o,n)}async _handleLoginRedirectCallback(e,n){const{code:o,state:r,error:i,error_description:a}=e;if(i)throw new Nt(i,a||i,r,n.appState);if(!n.code_verifier||n.state&&n.state!==r)throw new O("state_mismatch","Invalid state");const s=n.organization,c=n.nonce,u=n.redirect_uri;return await this._requestToken(Object.assign({audience:n.audience,scope:n.scope,code_verifier:n.code_verifier,grant_type:"authorization_code",code:o},u?{redirect_uri:u}:{}),{nonceIn:c,organization:s}),{appState:n.appState,response_type:exports.ResponseType.Code}}async _handleConnectAccountRedirectCallback(e,n){const{connect_code:o,state:r,error:i,error_description:a}=e;if(i)throw new Wt(i,a||i,n.connection,r,n.appState);if(!o)throw new O("missing_connect_code","Missing connect code");if(!(n.code_verifier&&n.state&&n.auth_session&&n.redirect_uri&&n.state===r))throw new O("state_mismatch","Invalid state");const s=await this.myAccountApi.completeAccount({auth_session:n.auth_session,connect_code:o,redirect_uri:n.redirect_uri,code_verifier:n.code_verifier});return Object.assign(Object.assign({},s),{appState:n.appState,response_type:exports.ResponseType.ConnectCode})}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get("auth0.is.authenticated"))return;this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove("auth0.is.authenticated")}try{await this.getTokenSilently(e)}catch{}}async getTokenSilently(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};var n,o;const r=Object.assign(Object.assign({cacheMode:"on"},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:vt(this.scope,(n=e.authorizationParams)===null||n===void 0?void 0:n.scope,((o=e.authorizationParams)===null||o===void 0?void 0:o.audience)||this.options.authorizationParams.audience)})}),i=await((a,s)=>{let c=tn[s];return c||(c=a().finally((()=>{delete tn[s],c=null})),tn[s]=c),c})((()=>this._getTokenSilently(r)),"".concat(this.options.clientId,"::").concat(r.authorizationParams.audience,"::").concat(r.authorizationParams.scope));return e.detailedResponse?i:i==null?void 0:i.access_token}async _getTokenSilently(e){const{cacheMode:n}=e,o=X(e,["cacheMode"]);if(n!=="off"){const s=await this._getEntryFromCache({scope:o.authorizationParams.scope,audience:o.authorizationParams.audience||"default",clientId:this.options.clientId,cacheMode:n});if(s)return s}if(n==="cache-only")return;const r=(i=this.options.clientId,a=o.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(i,".").concat(a));var i,a;return await this.lockManager.runWithLock(r,5e3,(async()=>{if(n!=="off"){const h=await this._getEntryFromCache({scope:o.authorizationParams.scope,audience:o.authorizationParams.audience||"default",clientId:this.options.clientId});if(h)return h}const s=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(o):await this._getTokenFromIFrame(o),{id_token:c,token_type:u,access_token:l,oauthTokenScope:m,expires_in:d}=s;return Object.assign(Object.assign({id_token:c,token_type:u,access_token:l},m?{scope:m}:null),{expires_in:d})}))}async getTokenWithPopup(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{},n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{};var o,r;const i=Object.assign(Object.assign({},e),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),e.authorizationParams),{scope:vt(this.scope,(o=e.authorizationParams)===null||o===void 0?void 0:o.scope,((r=e.authorizationParams)===null||r===void 0?void 0:r.audience)||this.options.authorizationParams.audience)})});return n=Object.assign(Object.assign({},Pr),n),await this.loginWithPopup(i,n),(await this.cacheManager.get(new V({scope:i.authorizationParams.scope,audience:i.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){e.clientId!==null?e.clientId=e.clientId||this.options.clientId:delete e.clientId;const n=e.logoutParams||{},{federated:o}=n,r=X(n,["federated"]),i=o?"&federated":"";return this._url("/v2/logout?".concat(kn(Object.assign({clientId:e.clientId},r))))+i}async logout(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};var n;const o=so(e),{openUrl:r}=o,i=X(o,["openUrl"]);e.clientId===null?await this.cacheManager.clear():await this.cacheManager.clear(e.clientId||this.options.clientId),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove("@@user@@"),await((n=this.dpop)===null||n===void 0?void 0:n.clear());const a=this._buildLogoutUrl(i);r?await r(a):r!==!1&&window.location.assign(a)}async _getTokenFromIFrame(e){const n=(o=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(o));var o;try{return await this.lockManager.runWithLock(n,5e3,(async()=>{const r=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),i=this.cookieStorage.get(this.orgHintCookieName);i&&!r.organization&&(r.organization=i);const{url:a,state:s,nonce:c,code_verifier:u,redirect_uri:l,scope:m,audience:d}=await this._prepareAuthorizeUrl(r,{response_mode:"web_message"},window.location.origin);if(window.crossOriginIsolated)throw new O("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");const h=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;let w;try{w=new URL(this.domainUrl).origin}catch{w=this.domainUrl}const f=await(function(g,b){let k=arguments.length>2&&arguments[2]!==void 0?arguments[2]:60;return new Promise(((E,y)=>{const P=window.document.createElement("iframe");P.setAttribute("width","0"),P.setAttribute("height","0"),P.style.display="none";const J=()=>{window.document.body.contains(P)&&(window.document.body.removeChild(P),window.removeEventListener("message",U,!1))};let U;const he=setTimeout((()=>{y(new je),J()}),1e3*k);U=function(M){if(M.origin!=b||!M.data||M.data.type!=="authorization_response")return;const Le=M.source;Le&&Le.close(),M.data.response.error?y(O.fromPayload(M.data.response)):E(M.data.response),clearTimeout(he),window.removeEventListener("message",U,!1),setTimeout(J,2e3)},window.addEventListener("message",U,!1),window.document.body.appendChild(P),P.setAttribute("src",g)}))})(a,w,h);if(s!==f.state)throw new O("state_mismatch","Invalid state");const p=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:u,code:f.code,grant_type:"authorization_code",redirect_uri:l,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:c,organization:r.organization});return Object.assign(Object.assign({},p),{scope:m,oauthTokenScope:p.scope,audience:d})}))}catch(r){throw r.error==="login_required"&&this.logout({openUrl:!1}),r}}async _getTokenUsingRefreshToken(e){var n,o;const r=await this.cacheManager.get(new V({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||"default",clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(r&&r.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new ct(e.authorizationParams.audience||"default",e.authorizationParams.scope)}const i=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,a=typeof e.timeoutInSeconds=="number"?1e3*e.timeoutInSeconds:null,s=((d,h,w,f)=>{var p;if(d&&w&&f){if(h.audience!==w)return h.scope;const g=f.split(" "),b=((p=h.scope)===null||p===void 0?void 0:p.split(" "))||[],k=b.every((E=>g.includes(E)));return g.length>=b.length&&k?f:h.scope}return h.scope})(this.options.useMrrt,e.authorizationParams,r==null?void 0:r.audience,r==null?void 0:r.scope);try{const d=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:r&&r.refresh_token,redirect_uri:i}),a&&{timeout:a}),{scopesToRequest:s});if(d.refresh_token&&(r!=null&&r.refresh_token)&&await this.cacheManager.updateEntry(r.refresh_token,d.refresh_token),this.options.useMrrt&&(c=r==null?void 0:r.audience,u=r==null?void 0:r.scope,l=e.authorizationParams.audience,m=e.authorizationParams.scope,(c!==l||!co(m,u))&&!co(s,d.scope))){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope);const h=((w,f)=>{const p=(w==null?void 0:w.split(" "))||[],g=(f==null?void 0:f.split(" "))||[];return p.filter((b=>g.indexOf(b)==-1)).join(",")})(s,d.scope);throw new Wn(e.authorizationParams.audience||"default",h)}return Object.assign(Object.assign({},d),{scope:e.authorizationParams.scope,oauthTokenScope:d.scope,audience:e.authorizationParams.audience||"default"})}catch(d){if(d.message){if(d.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),d;if((d.message.includes("Missing Refresh Token")||d.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw d instanceof Ve&&this.mfa.setMFAAuthDetails(d.mfa_token,(n=e.authorizationParams)===null||n===void 0?void 0:n.scope,(o=e.authorizationParams)===null||o===void 0?void 0:o.audience,d.mfa_requirements),d}var c,u,l,m}async _saveEntryInCache(e){const{id_token:n,decodedToken:o}=e,r=X(e,["id_token","decodedToken"]);this.userCache.set("@@user@@",{id_token:n,decodedToken:o}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(r)}async _getIdTokenFromCache(){const e=this.options.authorizationParams.audience||"default",n=this.scope[e],o=await this.cacheManager.getIdToken(new V({clientId:this.options.clientId,audience:e,scope:n})),r=this.userCache.get("@@user@@");return o&&o.id_token===(r==null?void 0:r.id_token)?r:(this.userCache.set("@@user@@",o),o)}async _getEntryFromCache(e){let{scope:n,audience:o,clientId:r,cacheMode:i}=e;const a=await this.cacheManager.get(new V({scope:n,audience:o,clientId:r}),60,this.options.useMrrt,i);if(a&&a.access_token){const{token_type:s,access_token:c,oauthTokenScope:u,expires_in:l}=a,m=await this._getIdTokenFromCache();return m&&Object.assign(Object.assign({id_token:m.id_token,token_type:s||"Bearer",access_token:c},u?{scope:u}:null),{expires_in:l})}}async _requestToken(e,n){var o,r;const{nonceIn:i,organization:a,scopesToRequest:s}=n||{},c=await Br(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop},e),{scope:s||e.scope}),this.worker),u=await this._verifyIdToken(c.id_token,i,a);if(e.grant_type==="authorization_code"){const l=await this._getIdTokenFromCache();!((r=(o=l==null?void 0:l.decodedToken)===null||o===void 0?void 0:o.claims)===null||r===void 0)&&r.sub&&l.decodedToken.claims.sub!==u.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove("@@user@@"))}return await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},c),{decodedToken:u,scope:e.scope,audience:e.audience||"default"}),c.scope?{oauthTokenScope:c.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(a||u.claims.org_id),Object.assign(Object.assign({},c),{decodedToken:u})}async loginWithCustomTokenExchange(e){return this._requestToken(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type,scope:vt(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization}))}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw new Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,n){return this._assertDpop(this.dpop),this.dpop.setNonce(e,n)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};return new hi(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:n=>{var o;return this.getTokenSilently({authorizationParams:{scope:(o=n==null?void 0:n.scope)===null||o===void 0?void 0:o.join(" "),audience:n==null?void 0:n.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:n=>this.setDpopNonce(n,e.dpopNonceId),generateDpopProof:n=>this.generateDpopProof(n)})}async connectAccountWithRedirect(e){const{openUrl:n,appState:o,connection:r,scopes:i,authorization_params:a,redirectUri:s=this.options.authorizationParams.redirect_uri||window.location.origin}=e;if(!r)throw new Error("connection is required");const c=Xt(Ge()),u=Ge(),l=await $n(u),m=to(l),{connect_uri:d,connect_params:h,auth_session:w}=await this.myAccountApi.connectAccount({connection:r,scopes:i,redirect_uri:s,state:c,code_challenge:m,code_challenge_method:"S256",authorization_params:a});this.transactionManager.create({state:c,code_verifier:u,auth_session:w,redirect_uri:s,appState:o,connection:r,response_type:exports.ResponseType.ConnectCode});const f=new URL(d);f.searchParams.set("ticket",h.ticket),n?await n(f.toString()):window.location.assign(f)}async _requestTokenForMfa(e,n){const{mfaToken:o}=e,r=X(e,["mfaToken"]);return this._requestToken(Object.assign(Object.assign({},r),{mfa_token:o}),n)}}exports.Auth0Client=Ca;exports.AuthenticationError=Nt;exports.CacheKey=V;exports.ConnectError=Wt;exports.GenericError=O;exports.InMemoryCache=Hn;exports.LocalStorageCache=Wo;exports.MfaApiClient=Ar;exports.MfaChallengeError=qt;exports.MfaEnrollmentError=Zt;exports.MfaEnrollmentFactorsError=Bt;exports.MfaError=ue;exports.MfaListAuthenticatorsError=st;exports.MfaRequiredError=Ve;exports.MfaVerifyError=Oe;exports.MissingRefreshTokenError=ct;exports.MyAccountApiError=rt;exports.PopupCancelledError=Ht;exports.PopupOpenError=Mt;exports.PopupTimeoutError=zt;exports.TimeoutError=je;exports.UseDpopNonceError=ut;
-//# sourceMappingURL=auth0-spa-js.production.esm-D_IhPirK.cjs.map