orbitchat 3.11.0 → 3.11.1

package/dist/assets/{vendor-auth-BWxE55Ta.js → vendor-auth-aD_bwYde.js}

@@ -1,4 +1,4 @@
-import{r as L,R as Sl}from"./vendor-markdown-BRX1CUPf.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(t,n){for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(t[o]=n[o])},gs(r,e)};function tp(r,e){if(typeof e!="function"&&e!==null)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");gs(r,e);function t(){this.constructor=r}r.prototype=e===null?Object.create(e):(t.prototype=e.prototype,new t)}var le=function(){return le=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++){t=arguments[n];for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])}return e},le.apply(this,arguments)};function Oc(r,e){var t={};for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&e.indexOf(n)<0&&(t[n]=r[n]);if(r!=null&&typeof Object.getOwnPropertySymbols=="function")for(var o=0,n=Object.getOwnPropertySymbols(r);o<n.length;o++)e.indexOf(n[o])<0&&Object.prototype.propertyIsEnumerable.call(r,n[o])&&(t[n[o]]=r[n[o]]);return t}function ct(r,e,t,n){function o(i){return i instanceof t?i:new t(function(s){s(i)})}return new(t||(t=Promise))(function(i,s){function a(h){try{l(n.next(h))}catch(d){s(d)}}function c(h){try{l(n.throw(h))}catch(d){s(d)}}function l(h){h.done?i(h.value):o(h.value).then(a,c)}l((n=n.apply(r,e||[])).next())})}function ht(r,e){var t={label:0,sent:function(){if(i[0]&1)throw i[1];return i[1]},trys:[],ops:[]},n,o,i,s=Object.create((typeof Iterator=="function"?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),typeof Symbol=="function"&&(s[Symbol.iterator]=function(){return this}),s;function a(l){return function(h){return c([l,h])}}function c(l){if(n)throw new TypeError("Generator is already executing.");for(;s&&(s=0,l[0]&&(t=0)),t;)try{if(n=1,o&&(i=l[0]&2?o.return:l[0]?o.throw||((i=o.return)&&i.call(o),0):o.next)&&!(i=i.call(o,l[1])).done)return i;switch(o=0,i&&(l=[l[0]&2,i.value]),l[0]){case 0:case 1:i=l;break;case 4:return t.label++,{value:l[1],done:!1};case 5:t.label++,o=l[1],l=[0];continue;case 7:l=t.ops.pop(),t.trys.pop();continue;default:if(i=t.trys,!(i=i.length>0&&i[i.length-1])&&(l[0]===6||l[0]===2)){t=0;continue}if(l[0]===3&&(!i||l[1]>i[0]&&l[1]<i[3])){t.label=l[1];break}if(l[0]===6&&t.label<i[1]){t.label=i[1],i=l;break}if(i&&t.label<i[2]){t.label=i[2],t.ops.push(l);break}i[2]&&t.ops.pop(),t.trys.pop();continue}l=e.call(r,t)}catch(h){l=[6,h],o=0}finally{n=i=0}if(l[0]&5)throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}function np(r,e,t){for(var n=0,o=e.length,i;n<o;n++)(i||!(n in e))&&(i||(i=Array.prototype.slice.call(e,0,n)),i[n]=e[n]);return r.concat(i||Array.prototype.slice.call(e))}function Ne(r,e){var t={};for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&e.indexOf(n)<0&&(t[n]=r[n]);if(r!=null&&typeof Object.getOwnPropertySymbols=="function"){var o=0;for(n=Object.getOwnPropertySymbols(r);o<n.length;o++)e.indexOf(n[o])<0&&Object.prototype.propertyIsEnumerable.call(r,n[o])&&(t[n[o]]=r[n[o]])}return t}function ho(r,e,t,n){if(typeof e=="function"?r!==e||!n:!e.has(r))throw new TypeError("Cannot read private member from an object whose class did not declare it");return t==="m"?n:t==="a"?n.call(r):n?n.value:e.get(r)}function Nc(r,e,t,n,o){if(typeof e=="function"?r!==e||!0:!e.has(r))throw new TypeError("Cannot write private member to an object whose class did not declare it");return e.set(r,t),t}function El(r,e){this.v=r,this.k=e}function xc(r,e){(e==null||e>r.length)&&(e=r.length);for(var t=0,n=Array(e);t<e;t++)n[t]=r[t];return n}function J(r,e,t){if(typeof r=="function"?r===e:r.has(e))return arguments.length<3?e:t;throw new TypeError("Private element is not present on this object")}function rp(r){return new El(r,0)}function Al(r,e){if(e.has(r))throw new TypeError("Cannot initialize the same private elements twice on an object")}function v(r,e){return r.get(J(r,e))}function j(r,e,t){Al(r,e),e.set(r,t)}function U(r,e,t){return r.set(J(r,e),t),t}function Rl(r,e){Al(r,e),e.add(r)}function I(r,e,t){return(e=(function(n){var o=(function(i,s){if(typeof i!="object"||!i)return i;var a=i[Symbol.toPrimitive];if(a!==void 0){var c=a.call(i,s);if(typeof c!="object")return c;throw new TypeError("@@toPrimitive must return a primitive value.")}return(s==="string"?String:Number)(i)})(n,"string");return typeof o=="symbol"?o:o+""})(e))in r?Object.defineProperty(r,e,{value:t,enumerable:!0,configurable:!0,writable:!0}):r[e]=t,r}function Mc(r,e){var t=Object.keys(r);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(r);e&&(n=n.filter(function(o){return Object.getOwnPropertyDescriptor(r,o).enumerable})),t.push.apply(t,n)}return t}function E(r){for(var e=1;e<arguments.length;e++){var t=arguments[e]!=null?arguments[e]:{};e%2?Mc(Object(t),!0).forEach(function(n){I(r,n,t[n])}):Object.getOwnPropertyDescriptors?Object.defineProperties(r,Object.getOwnPropertyDescriptors(t)):Mc(Object(t)).forEach(function(n){Object.defineProperty(r,n,Object.getOwnPropertyDescriptor(t,n))})}return r}function Uc(r,e){if(r==null)return{};var t,n,o=(function(s,a){if(s==null)return{};var c={};for(var l in s)if({}.hasOwnProperty.call(s,l)){if(a.indexOf(l)!==-1)continue;c[l]=s[l]}return c})(r,e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(r);for(n=0;n<i.length;n++)t=i[n],e.indexOf(t)===-1&&{}.propertyIsEnumerable.call(r,t)&&(o[t]=r[t])}return o}function Ke(r,e){return(function(t){if(Array.isArray(t))return t})(r)||(function(t,n){var o=t==null?null:typeof Symbol<"u"&&t[Symbol.iterator]||t["@@iterator"];if(o!=null){var i,s,a,c,l=[],h=!0,d=!1;try{if(a=(o=o.call(t)).next,n===0){if(Object(o)!==o)return;h=!1}else for(;!(h=(i=a.call(o)).done)&&(l.push(i.value),l.length!==n);h=!0);}catch(p){d=!0,s=p}finally{try{if(!h&&o.return!=null&&(c=o.return(),Object(c)!==c))return}finally{if(d)throw s}}return l}})(r,e)||(function(t,n){if(t){if(typeof t=="string")return xc(t,n);var o={}.toString.call(t).slice(8,-1);return o==="Object"&&t.constructor&&(o=t.constructor.name),o==="Map"||o==="Set"?Array.from(t):o==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(o)?xc(t,n):void 0}})(r,e)||(function(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
+import{r as L,R as Sl}from"./vendor-react-BbEy7z12.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(t,n){for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(t[o]=n[o])},gs(r,e)};function tp(r,e){if(typeof e!="function"&&e!==null)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");gs(r,e);function t(){this.constructor=r}r.prototype=e===null?Object.create(e):(t.prototype=e.prototype,new t)}var le=function(){return le=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++){t=arguments[n];for(var i in t)Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i])}return e},le.apply(this,arguments)};function Oc(r,e){var t={};for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&e.indexOf(n)<0&&(t[n]=r[n]);if(r!=null&&typeof Object.getOwnPropertySymbols=="function")for(var o=0,n=Object.getOwnPropertySymbols(r);o<n.length;o++)e.indexOf(n[o])<0&&Object.prototype.propertyIsEnumerable.call(r,n[o])&&(t[n[o]]=r[n[o]]);return t}function ct(r,e,t,n){function o(i){return i instanceof t?i:new t(function(s){s(i)})}return new(t||(t=Promise))(function(i,s){function a(h){try{l(n.next(h))}catch(d){s(d)}}function c(h){try{l(n.throw(h))}catch(d){s(d)}}function l(h){h.done?i(h.value):o(h.value).then(a,c)}l((n=n.apply(r,e||[])).next())})}function ht(r,e){var t={label:0,sent:function(){if(i[0]&1)throw i[1];return i[1]},trys:[],ops:[]},n,o,i,s=Object.create((typeof Iterator=="function"?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),typeof Symbol=="function"&&(s[Symbol.iterator]=function(){return this}),s;function a(l){return function(h){return c([l,h])}}function c(l){if(n)throw new TypeError("Generator is already executing.");for(;s&&(s=0,l[0]&&(t=0)),t;)try{if(n=1,o&&(i=l[0]&2?o.return:l[0]?o.throw||((i=o.return)&&i.call(o),0):o.next)&&!(i=i.call(o,l[1])).done)return i;switch(o=0,i&&(l=[l[0]&2,i.value]),l[0]){case 0:case 1:i=l;break;case 4:return t.label++,{value:l[1],done:!1};case 5:t.label++,o=l[1],l=[0];continue;case 7:l=t.ops.pop(),t.trys.pop();continue;default:if(i=t.trys,!(i=i.length>0&&i[i.length-1])&&(l[0]===6||l[0]===2)){t=0;continue}if(l[0]===3&&(!i||l[1]>i[0]&&l[1]<i[3])){t.label=l[1];break}if(l[0]===6&&t.label<i[1]){t.label=i[1],i=l;break}if(i&&t.label<i[2]){t.label=i[2],t.ops.push(l);break}i[2]&&t.ops.pop(),t.trys.pop();continue}l=e.call(r,t)}catch(h){l=[6,h],o=0}finally{n=i=0}if(l[0]&5)throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}function np(r,e,t){for(var n=0,o=e.length,i;n<o;n++)(i||!(n in e))&&(i||(i=Array.prototype.slice.call(e,0,n)),i[n]=e[n]);return r.concat(i||Array.prototype.slice.call(e))}function Ne(r,e){var t={};for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&e.indexOf(n)<0&&(t[n]=r[n]);if(r!=null&&typeof Object.getOwnPropertySymbols=="function"){var o=0;for(n=Object.getOwnPropertySymbols(r);o<n.length;o++)e.indexOf(n[o])<0&&Object.prototype.propertyIsEnumerable.call(r,n[o])&&(t[n[o]]=r[n[o]])}return t}function ho(r,e,t,n){if(typeof e=="function"?r!==e||!n:!e.has(r))throw new TypeError("Cannot read private member from an object whose class did not declare it");return t==="m"?n:t==="a"?n.call(r):n?n.value:e.get(r)}function Nc(r,e,t,n,o){if(typeof e=="function"?r!==e||!0:!e.has(r))throw new TypeError("Cannot write private member to an object whose class did not declare it");return e.set(r,t),t}function El(r,e){this.v=r,this.k=e}function xc(r,e){(e==null||e>r.length)&&(e=r.length);for(var t=0,n=Array(e);t<e;t++)n[t]=r[t];return n}function J(r,e,t){if(typeof r=="function"?r===e:r.has(e))return arguments.length<3?e:t;throw new TypeError("Private element is not present on this object")}function rp(r){return new El(r,0)}function Al(r,e){if(e.has(r))throw new TypeError("Cannot initialize the same private elements twice on an object")}function v(r,e){return r.get(J(r,e))}function j(r,e,t){Al(r,e),e.set(r,t)}function U(r,e,t){return r.set(J(r,e),t),t}function Rl(r,e){Al(r,e),e.add(r)}function I(r,e,t){return(e=(function(n){var o=(function(i,s){if(typeof i!="object"||!i)return i;var a=i[Symbol.toPrimitive];if(a!==void 0){var c=a.call(i,s);if(typeof c!="object")return c;throw new TypeError("@@toPrimitive must return a primitive value.")}return(s==="string"?String:Number)(i)})(n,"string");return typeof o=="symbol"?o:o+""})(e))in r?Object.defineProperty(r,e,{value:t,enumerable:!0,configurable:!0,writable:!0}):r[e]=t,r}function Mc(r,e){var t=Object.keys(r);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(r);e&&(n=n.filter(function(o){return Object.getOwnPropertyDescriptor(r,o).enumerable})),t.push.apply(t,n)}return t}function E(r){for(var e=1;e<arguments.length;e++){var t=arguments[e]!=null?arguments[e]:{};e%2?Mc(Object(t),!0).forEach(function(n){I(r,n,t[n])}):Object.getOwnPropertyDescriptors?Object.defineProperties(r,Object.getOwnPropertyDescriptors(t)):Mc(Object(t)).forEach(function(n){Object.defineProperty(r,n,Object.getOwnPropertyDescriptor(t,n))})}return r}function Uc(r,e){if(r==null)return{};var t,n,o=(function(s,a){if(s==null)return{};var c={};for(var l in s)if({}.hasOwnProperty.call(s,l)){if(a.indexOf(l)!==-1)continue;c[l]=s[l]}return c})(r,e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(r);for(n=0;n<i.length;n++)t=i[n],e.indexOf(t)===-1&&{}.propertyIsEnumerable.call(r,t)&&(o[t]=r[t])}return o}function Ke(r,e){return(function(t){if(Array.isArray(t))return t})(r)||(function(t,n){var o=t==null?null:typeof Symbol<"u"&&t[Symbol.iterator]||t["@@iterator"];if(o!=null){var i,s,a,c,l=[],h=!0,d=!1;try{if(a=(o=o.call(t)).next,n===0){if(Object(o)!==o)return;h=!1}else for(;!(h=(i=a.call(o)).done)&&(l.push(i.value),l.length!==n);h=!0);}catch(p){d=!0,s=p}finally{try{if(!h&&o.return!=null&&(c=o.return(),Object(c)!==c))return}finally{if(d)throw s}}return l}})(r,e)||(function(t,n){if(t){if(typeof t=="string")return xc(t,n);var o={}.toString.call(t).slice(8,-1);return o==="Object"&&t.constructor&&(o=t.constructor.name),o==="Map"||o==="Set"?Array.from(t):o==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(o)?xc(t,n):void 0}})(r,e)||(function(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
 In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function op(r){return function(){return new Sr(r.apply(this,arguments))}}function Sr(r){var e,t;function n(i,s){try{var a=r[i](s),c=a.value,l=c instanceof El;Promise.resolve(l?c.v:c).then(function(h){if(l){var d=i==="return"&&c.k?i:"next";if(!c.k||h.done)return n(d,h);h=r[d](h).value}o(!!a.done,h)},function(h){n("throw",h)})}catch(h){o(2,h)}}function o(i,s){i===2?e.reject(s):e.resolve({value:s,done:i}),(e=e.next)?n(e.key,e.arg):t=null}this._invoke=function(i,s){return new Promise(function(a,c){var l={key:i,arg:s,resolve:a,reject:c,next:null};t?t=t.next=l:(e=t=l,n(i,s))})},typeof r.return!="function"&&(this.return=void 0)}typeof SuppressedError=="function"&&SuppressedError,Sr.prototype[typeof Symbol=="function"&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},Sr.prototype.next=function(r){return this._invoke("next",r)},Sr.prototype.throw=function(r){return this._invoke("throw",r)},Sr.prototype.return=function(r){return this._invoke("return",r)};const ip={timeoutInSeconds:60},ms=1e4,Dc="memory",ys={name:"auth0-spa-js",version:"2.21.2"},Pl=()=>Date.now(),ye="default";class ne extends Error{constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,ne.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new ne(t,n)}}class na extends ne{constructor(e,t,n){let o=arguments.length>3&&arguments[3]!==void 0?arguments[3]:null;super(e,t),this.state=n,this.appState=o,Object.setPrototypeOf(this,na.prototype)}}class ra extends ne{constructor(e,t,n,o){let i=arguments.length>4&&arguments[4]!==void 0?arguments[4]:null;super(e,t),this.connection=n,this.state=o,this.appState=i,Object.setPrototypeOf(this,ra.prototype)}}class nr extends ne{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,nr.prototype)}}class oa extends nr{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,oa.prototype)}}class ia extends ne{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,ia.prototype)}}class sa extends ne{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,sa.prototype)}}class Fr extends ne{constructor(e,t,n,o){super(e,t),this.mfa_token=n,this.mfa_requirements=o,Object.setPrototypeOf(this,Fr.prototype)}}class pi extends ne{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(Ho(e,["default"]),"', scope: '").concat(Ho(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,pi.prototype)}}class aa extends ne{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(Ho(e,["default"]),"', missing scope: '").concat(Ho(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,aa.prototype)}}class fi extends ne{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,fi.prototype)}}function Ho(r){return r&&!(arguments.length>1&&arguments[1]!==void 0?arguments[1]:[]).includes(r)?r:""}const Ko=()=>window.crypto,dr=()=>{const r="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~.";let e="";for(;e.length<43;){const t=Ko().getRandomValues(new Uint8Array(43-e.length));for(const n of t)e.length<43&&n<198&&(e+=r[n%66])}return e},Oi=r=>btoa(r),sp=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],ws=function(r){let e=arguments.length>1&&arguments[1]!==void 0&&arguments[1];return Object.keys(r).reduce((t,n)=>{if(e&&n==="env")return t;const o=sp.find(i=>i.key===n);return o&&o.type.includes(typeof r[n])&&(t[n]=r[n]),t},{})},Er=r=>{var e=r.clientId,t=Ne(r,["clientId"]);return new URLSearchParams((n=>Object.keys(n).filter(o=>n[o]!==void 0).reduce((o,i)=>Object.assign(Object.assign({},o),{[i]:n[i]}),{}))(Object.assign({client_id:e},t))).toString()},Lc=async r=>await Ko().subtle.digest({name:"SHA-256"},new TextEncoder().encode(r)),Hc=r=>(e=>decodeURIComponent(atob(e).split("").map(t=>"%"+("00"+t.charCodeAt(0).toString(16)).slice(-2)).join("")))(r.replace(/_/g,"/").replace(/-/g,"+")),Kc=r=>{const e=new Uint8Array(r);return(t=>{const n={"+":"-","/":"_","=":""};return t.replace(/[+/=]/g,o=>n[o])})(window.btoa(String.fromCharCode(...Array.from(e))))};var wn=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},Ol={},ca={};Object.defineProperty(ca,"__esModule",{value:!0});var ap=(function(){function r(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var o=e.locked.get(t);o===void 0?n===void 0?e.locked.set(t,[]):e.locked.set(t,[n]):n!==void 0&&(o.unshift(n),e.locked.set(t,o))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,o){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(n!==void 0&&n.length!==0){var o=n.pop();e.locked.set(t,n),o!==void 0&&setTimeout(o,0)}else e.locked.delete(t)}}return r.getInstance=function(){return r.instance===void 0&&(r.instance=new r),r.instance},r})();ca.default=function(){return ap.getInstance()};var $e=wn&&wn.__awaiter||function(r,e,t,n){return new(t||(t=Promise))(function(o,i){function s(l){try{c(n.next(l))}catch(h){i(h)}}function a(l){try{c(n.throw(l))}catch(h){i(h)}}function c(l){l.done?o(l.value):new t(function(h){h(l.value)}).then(s,a)}c((n=n.apply(r,e||[])).next())})},Xe=wn&&wn.__generator||function(r,e){var t,n,o,i,s={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:a(0),throw:a(1),return:a(2)},typeof Symbol=="function"&&(i[Symbol.iterator]=function(){return this}),i;function a(c){return function(l){return(function(h){if(t)throw new TypeError("Generator is already executing.");for(;s;)try{if(t=1,n&&(o=2&h[0]?n.return:h[0]?n.throw||((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,h[1])).done)return o;switch(n=0,o&&(h=[2&h[0],o.value]),h[0]){case 0:case 1:o=h;break;case 4:return s.label++,{value:h[1],done:!1};case 5:s.label++,n=h[1],h=[0];continue;case 7:h=s.ops.pop(),s.trys.pop();continue;default:if(o=s.trys,!((o=o.length>0&&o[o.length-1])||h[0]!==6&&h[0]!==2)){s=0;continue}if(h[0]===3&&(!o||h[1]>o[0]&&h[1]<o[3])){s.label=h[1];break}if(h[0]===6&&s.label<o[1]){s.label=o[1],o=h;break}if(o&&s.label<o[2]){s.label=o[2],s.ops.push(h);break}o[2]&&s.ops.pop(),s.trys.pop();continue}h=e.call(r,s)}catch(d){h=[6,d],n=0}finally{t=o=0}if(5&h[0])throw h[1];return{value:h[0]?h[1]:void 0,done:!0}})([c,l])}}},ur=wn;Object.defineProperty(Ol,"__esModule",{value:!0});var Sn=ca,Ni="browser-tabs-lock-key",lo={key:function(r){return $e(ur,void 0,void 0,function(){return Xe(this,function(e){throw new Error("Unsupported")})})},getItem:function(r){return $e(ur,void 0,void 0,function(){return Xe(this,function(e){throw new Error("Unsupported")})})},clear:function(){return $e(ur,void 0,void 0,function(){return Xe(this,function(r){return[2,window.localStorage.clear()]})})},removeItem:function(r){return $e(ur,void 0,void 0,function(){return Xe(this,function(e){throw new Error("Unsupported")})})},setItem:function(r,e){return $e(ur,void 0,void 0,function(){return Xe(this,function(t){throw new Error("Unsupported")})})},keySync:function(r){return window.localStorage.key(r)},getItemSync:function(r){return window.localStorage.getItem(r)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(r){return window.localStorage.removeItem(r)},setItemSync:function(r,e){return window.localStorage.setItem(r,e)}};function xi(r){return new Promise(function(e){return setTimeout(e,r)})}function Mi(r){for(var e="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz",t="",n=0;n<r;n++)t+=e[Math.floor(61*Math.random())];return t}var cp=(function(){function r(e){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+Mi(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=e,r.waiters===void 0&&(r.waiters=[])}return r.prototype.acquireLock=function(e,t){return t===void 0&&(t=5e3),$e(this,void 0,void 0,function(){var n,o,i,s,a,c,l;return Xe(this,function(h){switch(h.label){case 0:n=Date.now()+Mi(4),o=Date.now()+t,i=Ni+"-"+e,s=this.storageHandler===void 0?lo:this.storageHandler,h.label=1;case 1:return Date.now()<o?[4,xi(30)]:[3,8];case 2:return h.sent(),s.getItemSync(i)!==null?[3,5]:(a=this.id+"-"+e+"-"+n,[4,xi(Math.floor(25*Math.random()))]);case 3:return h.sent(),s.setItemSync(i,JSON.stringify({id:this.id,iat:n,timeoutKey:a,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,xi(30)];case 4:return h.sent(),(c=s.getItemSync(i))!==null&&(l=JSON.parse(c)).id===this.id&&l.iat===n?(this.acquiredIatSet.add(n),this.refreshLockWhileAcquired(i,n),[2,!0]):[3,7];case 5:return r.lockCorrector(this.storageHandler===void 0?lo:this.storageHandler),[4,this.waitForSomethingToChange(o)];case 6:h.sent(),h.label=7;case 7:return n=Date.now()+Mi(4),[3,1];case 8:return[2,!1]}})})},r.prototype.refreshLockWhileAcquired=function(e,t){return $e(this,void 0,void 0,function(){var n=this;return Xe(this,function(o){return setTimeout(function(){return $e(n,void 0,void 0,function(){var i,s,a;return Xe(this,function(c){switch(c.label){case 0:return[4,Sn.default().lock(t)];case 1:return c.sent(),this.acquiredIatSet.has(t)?(i=this.storageHandler===void 0?lo:this.storageHandler,(s=i.getItemSync(e))===null?(Sn.default().unlock(t),[2]):((a=JSON.parse(s)).timeRefreshed=Date.now(),i.setItemSync(e,JSON.stringify(a)),Sn.default().unlock(t),this.refreshLockWhileAcquired(e,t),[2])):(Sn.default().unlock(t),[2])}})})},1e3),[2]})})},r.prototype.waitForSomethingToChange=function(e){return $e(this,void 0,void 0,function(){return Xe(this,function(t){switch(t.label){case 0:return[4,new Promise(function(n){var o=!1,i=Date.now(),s=!1;function a(){if(s||(window.removeEventListener("storage",a),r.removeFromWaiting(a),clearTimeout(c),s=!0),!o){o=!0;var l=50-(Date.now()-i);l>0?setTimeout(n,l):n(null)}}window.addEventListener("storage",a),r.addToWaiting(a);var c=setTimeout(a,Math.max(0,e-Date.now()))})];case 1:return t.sent(),[2]}})})},r.addToWaiting=function(e){this.removeFromWaiting(e),r.waiters!==void 0&&r.waiters.push(e)},r.removeFromWaiting=function(e){r.waiters!==void 0&&(r.waiters=r.waiters.filter(function(t){return t!==e}))},r.notifyWaiters=function(){r.waiters!==void 0&&r.waiters.slice().forEach(function(e){return e()})},r.prototype.releaseLock=function(e){return $e(this,void 0,void 0,function(){return Xe(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},r.prototype.releaseLock__private__=function(e){return $e(this,void 0,void 0,function(){var t,n,o,i;return Xe(this,function(s){switch(s.label){case 0:return t=this.storageHandler===void 0?lo:this.storageHandler,n=Ni+"-"+e,(o=t.getItemSync(n))===null?[2]:(i=JSON.parse(o)).id!==this.id?[3,2]:[4,Sn.default().lock(i.iat)];case 1:s.sent(),this.acquiredIatSet.delete(i.iat),t.removeItemSync(n),Sn.default().unlock(i.iat),r.notifyWaiters(),s.label=2;case 2:return[2]}})})},r.lockCorrector=function(e){for(var t=Date.now()-5e3,n=e,o=[],i=0;;){var s=n.keySync(i);if(s===null)break;o.push(s),i++}for(var a=!1,c=0;c<o.length;c++){var l=o[c];if(l.includes(Ni)){var h=n.getItemSync(l);if(h!==null){var d=JSON.parse(h);(d.timeRefreshed===void 0&&d.timeAcquired<t||d.timeRefreshed!==void 0&&d.timeRefreshed<t)&&(n.removeItemSync(l),a=!0)}}}a&&r.notifyWaiters()},r.waiters=void 0,r})(),hp=Ol.default=cp;class lp{async runWithLock(e,t,n){const o=new AbortController,i=setTimeout(()=>o.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:o.signal},async s=>{if(clearTimeout(i),!s)throw new Error("Lock not available");return await n()})}catch(s){throw clearTimeout(i),(s==null?void 0:s.name)==="AbortError"?new nr:s}}}class dp{constructor(){this.activeLocks=new Set,this.lock=new hp,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}async runWithLock(e,t,n){let o=!1;for(let i=0;i<10&&!o;i++)o=await this.lock.acquireLock(e,t);if(!o)throw new nr;this.activeLocks.add(e),this.activeLocks.size===1&&typeof window<"u"&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),this.activeLocks.size===0&&typeof window<"u"&&window.removeEventListener("pagehide",this.pagehideHandler)}}}function up(){return typeof navigator<"u"&&typeof((r=navigator.locks)===null||r===void 0?void 0:r.request)=="function"?new lp:new dp;var r}let Ui=null;const pp=new TextEncoder,fp=new TextDecoder;function Nr(r){return typeof r=="string"?pp.encode(r):fp.decode(r)}function Fc(r){if(typeof r.modulusLength!="number"||r.modulusLength<2048)throw new mp(`${r.name} modulusLength must be at least 2048 bits`)}async function gp(r,e,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');const n=`${xr(Nr(JSON.stringify(r)))}.${xr(Nr(JSON.stringify(e)))}`;return`${n}.${xr(await crypto.subtle.sign((function(o){switch(o.algorithm.name){case"ECDSA":return{name:o.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Fc(o.algorithm),{name:o.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Fc(o.algorithm),{name:o.algorithm.name};case"Ed25519":return{name:o.algorithm.name}}throw new dn})(t),t,Nr(n)))}`}let vs;Uint8Array.prototype.toBase64?vs=r=>(r instanceof ArrayBuffer&&(r=new Uint8Array(r)),r.toBase64({alphabet:"base64url",omitPadding:!0})):vs=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));const t=[];for(let n=0;n<e.byteLength;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function xr(r){return vs(r)}class dn extends Error{constructor(e){var t;super(e??"operation not supported"),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}}class mp extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,(t=Error.captureStackTrace)===null||t===void 0||t.call(Error,this,this.constructor)}}function yp(r){switch(r.algorithm.name){case"RSA-PSS":return(function(e){if(e.algorithm.hash.name==="SHA-256")return"PS256";throw new dn("unsupported RsaHashedKeyAlgorithm hash name")})(r);case"RSASSA-PKCS1-v1_5":return(function(e){if(e.algorithm.hash.name==="SHA-256")return"RS256";throw new dn("unsupported RsaHashedKeyAlgorithm hash name")})(r);case"ECDSA":return(function(e){if(e.algorithm.namedCurve==="P-256")return"ES256";throw new dn("unsupported EcKeyAlgorithm namedCurve")})(r);case"Ed25519":return"Ed25519";default:throw new dn("unsupported CryptoKey algorithm name")}}function Nl(r){return r instanceof CryptoKey}function xl(r){return Nl(r)&&r.type==="public"}async function wp(r,e,t,n,o,i){const s=r==null?void 0:r.privateKey,a=r==null?void 0:r.publicKey;if(!Nl(c=s)||c.type!=="private")throw new TypeError('"keypair.privateKey" must be a private CryptoKey');var c;if(!xl(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof e!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(n!==void 0&&typeof n!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');return gp({alg:yp(s),typ:"dpop+jwt",jwk:await Ml(a)},Object.assign(Object.assign({},i),{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:t,nonce:n,htu:e,ath:o?xr(await crypto.subtle.digest("SHA-256",Nr(o))):void 0}),s)}async function Ml(r){const{kty:e,e:t,n,x:o,y:i,crv:s}=await crypto.subtle.exportKey("jwk",r);return{kty:e,crv:s,e:t,n,x:o,y:i}}const Ul="dpop-nonce",vp=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"];function bp(){return(async function(r,e){var t;let n;if(r.length===0)throw new TypeError('"alg" must be a non-empty string');switch(r){case"PS256":n={name:"RSA-PSS",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":n={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":n={name:"ECDSA",namedCurve:"P-256"};break;case"Ed25519":n={name:"Ed25519"};break;default:throw new dn}return crypto.subtle.generateKey(n,(t=e==null?void 0:e.extractable)!==null&&t!==void 0&&t,["sign","verify"])})("ES256",{extractable:!1})}function Cp(r){return(async function(e){if(!xl(e))throw new TypeError('"publicKey" must be a public CryptoKey');if(e.extractable!==!0)throw new TypeError('"publicKey.extractable" must be true');const t=await Ml(e);let n;switch(t.kty){case"EC":n={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":n={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":n={e:t.e,kty:t.kty,n:t.n};break;default:throw new dn("unsupported JWK kty")}return xr(await crypto.subtle.digest({name:"SHA-256"},Nr(JSON.stringify(n))))})(r.publicKey)}function Tp(r){let e=r.keyPair,t=r.url,n=r.method,o=r.nonce,i=r.accessToken;const s=(function(a){const c=new URL(a);return c.search="",c.hash="",c.href})(t);return wp(e,s,n,o,i)}const bs=(r,e)=>new Promise(function(t,n){const o=new MessageChannel;o.port1.onmessage=function(i){i.data.error?n(new Error(i.data.error)):t(i.data),o.port1.close()},e.postMessage(r,[o.port2])}),Dl=(r,e,t)=>{const n=new AbortController;let o;return e.signal=n.signal,Promise.race([fetch(r,e),new Promise((i,s)=>{o=setTimeout(()=>{n.abort(),s(new Error("Timeout when executing 'fetch'"))},t)})]).finally(()=>{clearTimeout(o)})},kp=async function(r,e,t,n,o,i){let s=arguments.length>6&&arguments[6]!==void 0?arguments[6]:ms;return o?(async(a,c,l,h,d,p,u,f,g)=>bs({type:"refresh",auth:{audience:c,scope:l},timeout:d,fetchUrl:a,fetchOptions:h,useFormData:u,useMrrt:f,skipTokenStorage:g},p))(r,e,t,n,s,o,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0):(async(a,c,l)=>{const h=await Dl(a,c,l);return{ok:h.ok,json:await h.json(),headers:(d=h.headers,[...d].reduce((p,u)=>{let f=Ke(u,2),g=f[0],y=f[1];return p[g]=y,p},{}))};var d})(r,n,s)};async function Ll(r,e,t,n,o,i,s,a,c,l,h){if(c){const _=await c.generateProof({url:r,method:o.method||"GET",nonce:await c.getNonce()});o.headers=Object.assign(Object.assign({},o.headers),{dpop:_})}let d,p=null;for(let _=0;_<3;_++)try{d=await kp(r,t,n,o,i,s,e,a,h),p=null;break}catch(O){p=O}if(p)throw p;const u=d.json,f=u.error,g=u.error_description,y=Ne(u,["error","error_description"]),m=d,b=m.headers,C=m.ok;let k;if(c&&(k=b[Ul],k&&await c.setNonce(k)),!C){const _=g||"HTTP error. Unable to fetch ".concat(r);if(f==="mfa_required")throw new Fr(f,_,y.mfa_token,y.mfa_requirements);if(f==="missing_refresh_token")throw new pi(t,n);if(f==="use_dpop_nonce"){if(!c||!k||l)throw new fi(k);return Ll(r,e,t,n,o,i,s,a,c,!0,h)}throw new ne(f||"request_error",_)}return y}async function jc(r,e,t){var n=r.baseUrl,o=r.timeout,i=r.audience,s=r.scope,a=r.auth0Client,c=r.useFormData,l=r.useMrrt,h=r.dpop,d=Ne(r,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop"]);const p=d.grant_type==="urn:ietf:params:oauth:grant-type:token-exchange",u=d.grant_type==="urn:okta:params:oauth:grant-type:webauthn",f=d.grant_type==="refresh_token"&&l,g=p||u||f,y=Object.assign(Object.assign(Object.assign({},d),g&&i&&{audience:i}),g&&s&&{scope:s}),m=u||!c,b=m?JSON.stringify(y):Er(y),C=(k=d.grant_type,vp.includes(k));var k;return await Ll("".concat(n,"/oauth/token"),o,i||ye,s,{method:"POST",body:b,headers:{"Content-Type":m?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(ws(a||ys)))}},e,c,l,C?h:void 0,void 0,t)}const Po=function(){for(var r=arguments.length,e=new Array(r),t=0;t<r;t++)e[t]=arguments[t];return(n=e.filter(Boolean).join(" ").trim().split(/\s+/),Array.from(new Set(n))).join(" ");var n},pr=(r,e,t)=>{let n;return t&&(n=r[t]),n||(n=r[ye]),Po(n,e)},un="@@auth0spajs@@",xn="@@user@@";class xe{constructor(e){let t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:un,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){const t=Ke(e.split("::"),4),n=t[0],o=t[1],i=t[2],s=t[3];return new xe({clientId:o,scope:s,audience:i},n)}static fromCacheEntry(e){const t=e.scope,n=e.audience,o=e.client_id;return new xe({scope:t,audience:n,clientId:o})}}class _p{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){const t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch{return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(un))}}class Hl{constructor(){this.enclosedCache=(function(){let e={};return{set(t,n){e[t]=n},get(t){const n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}})()}}class Ip{constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||Pl}async setIdToken(e,t,n){var o;const i=this.getIdTokenCacheKey(e);await this.cache.set(i,{id_token:t,decodedToken:n}),await((o=this.keyManifest)===null||o===void 0?void 0:o.add(i))}async getIdToken(e){const t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){const n=await this.get(e);return!n||!n.id_token||!n.decodedToken?void 0:{id_token:n.id_token,decodedToken:n.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){let t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:0,n=arguments.length>2&&arguments[2]!==void 0&&arguments[2],o=arguments.length>3?arguments[3]:void 0;var i;let s=await this.cache.get(e.toKey()),a=e;if(!s){const h=await this.getCacheKeys();if(!h)return;const d=this.matchExistingCacheKey(e,h);if(d&&(s=await this.cache.get(d),a=xe.fromKey(d)),!s&&n&&o!=="cache-only")return this.getEntryWithRefreshToken(e,h)}if(!s)return;const c=await this.nowProvider(),l=Math.floor(c/1e3);return s.expiresAt-t<l?s.body.refresh_token?this.modifiedCachedEntry(s,a):(await this.cache.remove(a.toKey()),void await((i=this.keyManifest)===null||i===void 0?void 0:i.remove(a.toKey()))):s.body}async modifiedCachedEntry(e,t){const n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},o={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),o),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;const n=new xe({clientId:e.client_id,scope:e.scope,audience:e.audience}),o=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),o),await((t=this.keyManifest)===null||t===void 0?void 0:t.add(n.toKey()))}async remove(e,t,n){const o=new xe({clientId:e,scope:n,audience:t});await this.cache.remove(o.toKey())}async stripRefreshToken(e){var t;const n=await this.getCacheKeys();if(n)for(const o of n){const i=await this.cache.get(o);((t=i==null?void 0:i.body)===null||t===void 0?void 0:t.refresh_token)===e&&(delete i.body.refresh_token,await this.cache.set(o,i))}}async clear(e){var t;const n=await this.getCacheKeys();n&&(await n.filter(o=>!e||o.includes(e)).reduce(async(o,i)=>{await o,await this.cache.remove(i)},Promise.resolve()),await((t=this.keyManifest)===null||t===void 0?void 0:t.clear()))}async wrapCacheEntry(e){const t=await this.nowProvider();return{body:e,expiresAt:Math.floor(t/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?(e=await this.keyManifest.get())===null||e===void 0?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new xe({clientId:e},un,xn).toKey()}matchExistingCacheKey(e,t){return t.filter(n=>{var o;const i=xe.fromKey(n),s=new Set(i.scope&&i.scope.split(" ")),a=((o=e.scope)===null||o===void 0?void 0:o.split(" "))||[],c=i.scope&&a.reduce((l,h)=>l&&s.has(h),!0);return i.prefix===un&&i.clientId===e.clientId&&i.audience===e.audience&&c})[0]}async getEntryWithRefreshToken(e,t){var n;for(const o of t){const i=xe.fromKey(o);if(i.prefix===un&&i.clientId===e.clientId){const s=await this.cache.get(o);if(!((n=s==null?void 0:s.body)===null||n===void 0)&&n.refresh_token)return{refresh_token:s.body.refresh_token,audience:s.body.audience,scope:s.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;const o=await this.getCacheKeys();if(!o)return[];const i=new Set;for(const s of o){const a=xe.fromKey(s);if(a.prefix===un&&a.clientId===t&&a.audience===e){const c=await this.cache.get(s);!((n=c==null?void 0:c.body)===null||n===void 0)&&n.refresh_token&&i.add(c.body.refresh_token)}}return Array.from(i)}async updateEntry(e,t){var n;const o=await this.getCacheKeys();if(o)for(const i of o){const s=await this.cache.get(i);((n=s==null?void 0:s.body)===null||n===void 0?void 0:n.refresh_token)===e&&(s.body.refresh_token=t,await this.cache.set(i,s))}}}class Sp{constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}}const fr=r=>typeof r=="number",Ep=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"],Ap=r=>{if(!r.id_token)throw new Error("ID token is required but missing");const e=(i=>{const s=i.split("."),a=Ke(s,3),c=a[0],l=a[1],h=a[2];if(s.length!==3||!c||!l||!h)throw new Error("ID token could not be decoded");const d=JSON.parse(Hc(l)),p={__raw:i},u={};return Object.keys(d).forEach(f=>{p[f]=d[f],Ep.includes(f)||(u[f]=d[f])}),{encoded:{header:c,payload:l,signature:h},header:JSON.parse(Hc(c)),claims:p,user:u}})(r.id_token);if(!e.claims.iss)throw new Error("Issuer (iss) claim must be a string present in the ID token");if(e.claims.iss!==r.iss)throw new Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(r.iss,'", found "').concat(e.claims.iss,'"'));if(!e.user.sub)throw new Error("Subject (sub) claim must be a string present in the ID token");if(e.header.alg!=="RS256")throw new Error('Signature algorithm of "'.concat(e.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!e.claims.aud||typeof e.claims.aud!="string"&&!Array.isArray(e.claims.aud))throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(r.aud))throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(r.aud,'" but was not one of "').concat(e.claims.aud.join(", "),'"'));if(e.claims.aud.length>1){if(!e.claims.azp)throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(e.claims.azp!==r.aud)throw new Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(r.aud,'", found "').concat(e.claims.azp,'"'))}}else if(e.claims.aud!==r.aud)throw new Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(r.aud,'" but found "').concat(e.claims.aud,'"'));if(r.nonce){if(!e.claims.nonce)throw new Error("Nonce (nonce) claim must be a string present in the ID token");if(e.claims.nonce!==r.nonce)throw new Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(r.nonce,'", found "').concat(e.claims.nonce,'"'))}if(r.max_age&&!fr(e.claims.auth_time))throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(e.claims.exp==null||!fr(e.claims.exp))throw new Error("Expiration Time (exp) claim must be a number present in the ID token");if(!fr(e.claims.iat))throw new Error("Issued At (iat) claim must be a number present in the ID token");const t=r.leeway||60,n=new Date(r.now||Date.now()),o=new Date(0);if(o.setUTCSeconds(e.claims.exp+t),n>o)throw new Error("Expiration Time (exp) claim error in the ID token; current time (".concat(n,") is after expiration time (").concat(o,")"));if(e.claims.nbf!=null&&fr(e.claims.nbf)){const i=new Date(0);if(i.setUTCSeconds(e.claims.nbf-t),n<i)throw new Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(n,") is before ").concat(i))}if(e.claims.auth_time!=null&&fr(e.claims.auth_time)){const i=new Date(0);if(i.setUTCSeconds(parseInt(e.claims.auth_time)+r.max_age+t),n>i)throw new Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(n,") is after last auth at ").concat(i))}if(r.organization){const i=r.organization.trim();if(i.startsWith("org_")){const s=i;if(!e.claims.org_id)throw new Error("Organization ID (org_id) claim must be a string present in the ID token");if(s!==e.claims.org_id)throw new Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(s,'", found "').concat(e.claims.org_id,'"'))}else{const s=i.toLowerCase();if(!e.claims.org_name)throw new Error("Organization Name (org_name) claim must be a string present in the ID token");if(s!==e.claims.org_name)throw new Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(s,'", found "').concat(e.claims.org_name,'"'))}}return e};var jr=wn&&wn.__assign||function(){return jr=Object.assign||function(r){for(var e,t=1,n=arguments.length;t<n;t++)for(var o in e=arguments[t])Object.prototype.hasOwnProperty.call(e,o)&&(r[o]=e[o]);return r},jr.apply(this,arguments)};function gr(r,e){if(!e)return"";var t="; "+r;return e===!0?t:t+"="+e}function Rp(r,e,t){return encodeURIComponent(r).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/\(/g,"%28").replace(/\)/g,"%29")+"="+encodeURIComponent(e).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+(function(n){if(typeof n.expires=="number"){var o=new Date;o.setMilliseconds(o.getMilliseconds()+864e5*n.expires),n.expires=o}return gr("Expires",n.expires?n.expires.toUTCString():"")+gr("Domain",n.domain)+gr("Path",n.path)+gr("Secure",n.secure)+gr("SameSite",n.sameSite)})(t)}function Pp(){return(function(r){for(var e={},t=r?r.split("; "):[],n=/(%[\dA-F]{2})+/gi,o=0;o<t.length;o++){var i=t[o].split("="),s=i.slice(1).join("=");s.charAt(0)==='"'&&(s=s.slice(1,-1));try{e[i[0].replace(n,decodeURIComponent)]=s.replace(n,decodeURIComponent)}catch{}}return e})(document.cookie)}var Op=function(r){return Pp()[r]};function Kl(r,e,t){document.cookie=Rp(r,e,jr({path:"/"},t))}var Fl=Kl,jl=function(r,e){Kl(r,"",jr(jr({},e),{expires:-1}))};const Mn={get(r){const e=Op(r);if(e!==void 0)return JSON.parse(e)},save(r,e,t){let n={};window.location.protocol==="https:"&&(n={secure:!0,sameSite:"none"}),t!=null&&t.daysUntilExpire&&(n.expires=t.daysUntilExpire),t!=null&&t.cookieDomain&&(n.domain=t.cookieDomain),Fl(r,JSON.stringify(e),n)},remove(r,e){let t={};e!=null&&e.cookieDomain&&(t.domain=e.cookieDomain),jl(r,t)}},Di="_legacy_",Np={get(r){return Mn.get(r)||Mn.get("".concat(Di).concat(r))},save(r,e,t){let n={};window.location.protocol==="https:"&&(n={secure:!0}),t!=null&&t.daysUntilExpire&&(n.expires=t.daysUntilExpire),t!=null&&t.cookieDomain&&(n.domain=t.cookieDomain),Fl("".concat(Di).concat(r),JSON.stringify(e),n),Mn.save(r,e,t)},remove(r,e){let t={};e!=null&&e.cookieDomain&&(t.domain=e.cookieDomain),jl(r,t),Mn.remove(r,e),Mn.remove("".concat(Di).concat(r),e)}},xp={get(r){if(typeof sessionStorage>"u")return;const e=sessionStorage.getItem(r);return e!=null?JSON.parse(e):void 0},save(r,e){sessionStorage.setItem(r,JSON.stringify(e))},remove(r){sessionStorage.removeItem(r)}};var Jt;(function(r){r.Code="code",r.ConnectCode="connect_code"})(Jt||(Jt={}));function Mp(r,e,t){var n=e===void 0?null:e,o=(function(c,l){var h=atob(c);if(l){for(var d=new Uint8Array(h.length),p=0,u=h.length;p<u;++p)d[p]=h.charCodeAt(p);return String.fromCharCode.apply(null,new Uint16Array(d.buffer))}return h})(r,t!==void 0&&t),i=o.indexOf(`
 `,10)+1,s=o.substring(i)+(n?"//# sourceMappingURL="+n:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}var zc,Wc,Jc,Li,Up=(zc="Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxpLGE9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihhLnB1c2goby52YWx1ZSksYS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoaT1yLnJldHVybigpLE9iamVjdChpKSE9PWkpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGF9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGk9e30sYT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PWU9PntPYmplY3QuZW50cmllcyhpKS5mb3JFYWNoKHI9PntsZXQgbz10KHIsMiksbj1vWzBdO29bMV09PT1lJiZkZWxldGUgaVtuXX0pfSxmPWU9Pntjb25zdCB0PW5ldyBVUkxTZWFyY2hQYXJhbXMoZSkscj17fTtyZXR1cm4gdC5mb3JFYWNoKChlLHQpPT57clt0XT1lfSkscn0sZD1hc3luYyBlPT57bGV0IHIsbixhPWUuZGF0YSx1PWEudGltZW91dCxkPWEuYXV0aCxoPWEuZmV0Y2hVcmwscD1hLmZldGNoT3B0aW9ucyx5PWEudXNlRm9ybURhdGEsZz1hLnVzZU1ycnQsYj1hLnNraXBUb2tlblN0b3JhZ2UsTz10KGUucG9ydHMsMSlbMF0saz17fTtjb25zdCBtPWR8fHt9LGo9bS5hdWRpZW5jZSx2PW0uc2NvcGU7dHJ5e2NvbnN0IGU9eT9mKHAuYm9keSk6SlNPTi5wYXJzZShwLmJvZHkpO2lmKCFlLnJlZnJlc2hfdG9rZW4mJiJyZWZyZXNoX3Rva2VuIj09PWUuZ3JhbnRfdHlwZSl7aWYobj0oKGUsdCk9PmlbYyhlLHQpXSkoaix2KSwhbiYmZyl7Y29uc3QgZT1pLmxhdGVzdF9yZWZyZXNoX3Rva2VuLHQ9KChlLHQpPT4hIU9iamVjdC5rZXlzKGkpLmZpbmQocj0+e2lmKCJsYXRlc3RfcmVmcmVzaF90b2tlbiIhPT1yKXtjb25zdCBvPWwodCxyKSxuPXIuc3BsaXQoInwiKVsxXS5zcGxpdCgiICIpLHM9ZS5zcGxpdCgiICIpLmV2ZXJ5KGU9Pm4uaW5jbHVkZXMoZSkpO3JldHVybiBvJiZzfX0pKSh2LGopO2UmJiF0JiYobj1lKX1pZighbil0aHJvdyBuZXcgbyhqLHYpO3AuYm9keT15P3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LGUpLHtyZWZyZXNoX3Rva2VuOm59KSk6SlNPTi5zdHJpbmdpZnkoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LGUpLHtyZWZyZXNoX3Rva2VuOm59KSl9bGV0IGEsZDsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYoYT1uZXcgQWJvcnRDb250cm9sbGVyLHAuc2lnbmFsPWEuc2lnbmFsKTt0cnl7ZD1hd2FpdCBQcm9taXNlLnJhY2UoWyhNPXUsbmV3IFByb21pc2UoZT0+c2V0VGltZW91dChlLE0pKSksZmV0Y2goaCxPYmplY3QuYXNzaWduKHt9LHApKV0pfWNhdGNoKGUpe3JldHVybiB2b2lkIE8ucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZX0pfWlmKCFkKXJldHVybiBhJiZhLmFib3J0KCksdm9pZCBPLnBvc3RNZXNzYWdlKHtlcnJvcjoiVGltZW91dCB3aGVuIGV4ZWN1dGluZyAnZmV0Y2gnIn0pO2lmKFM9ZC5oZWFkZXJzLGs9Wy4uLlNdLnJlZHVjZSgoZSxyKT0+e2xldCBvPXQociwyKSxuPW9bMF0scz1vWzFdO3JldHVybiBlW25dPXMsZX0se30pLHI9YXdhaXQgZC5qc29uKCksYilyZXR1cm4gZGVsZXRlIHIucmVmcmVzaF90b2tlbix2b2lkIE8ucG9zdE1lc3NhZ2Uoe29rOmQub2ssanNvbjpyLGhlYWRlcnM6a30pO3IucmVmcmVzaF90b2tlbj8oZyYmKGkubGF0ZXN0X3JlZnJlc2hfdG9rZW49ci5yZWZyZXNoX3Rva2VuLF89bix3PXIucmVmcmVzaF90b2tlbixPYmplY3QuZW50cmllcyhpKS5mb3JFYWNoKGU9PntsZXQgcj10KGUsMiksbz1yWzBdO3JbMV09PT1fJiYoaVtvXT13KX0pKSwoKGUsdCxyKT0+e2lbYyh0LHIpXT1lfSkoci5yZWZyZXNoX3Rva2VuLGosdiksZGVsZXRlIHIucmVmcmVzaF90b2tlbik6KChlLHQpPT57ZGVsZXRlIGlbYyhlLHQpXX0pKGosdiksTy5wb3N0TWVzc2FnZSh7b2s6ZC5vayxqc29uOnIsaGVhZGVyczprfSl9Y2F0Y2goZSl7Ty5wb3N0TWVzc2FnZSh7b2s6ITEsanNvbjp7ZXJyb3I6ZS5lcnJvcixlcnJvcl9kZXNjcmlwdGlvbjplLm1lc3NhZ2V9LGhlYWRlcnM6a30pfXZhciBfLHcsUyxNfSxoPWFzeW5jIGU9PntsZXQgcj1lLmRhdGEsbz1yLnRpbWVvdXQsbj1yLmF1dGgsYT1yLmZldGNoVXJsLGM9ci5mZXRjaE9wdGlvbnMsZD1yLnVzZUZvcm1EYXRhLGg9dChlLnBvcnRzLDEpWzBdO2NvbnN0IHA9KG58fHt9KS5hdWRpZW5jZTt0cnl7Y29uc3QgZT0oZT0+e2NvbnN0IHI9bmV3IFNldDtyZXR1cm4gT2JqZWN0LmVudHJpZXMoaSkuZm9yRWFjaChvPT57bGV0IG49dChvLDIpLHM9blswXSxpPW5bMV07bChlLHMpJiZyLmFkZChpKX0pLEFycmF5LmZyb20ocil9KShwKTtpZigwPT09ZS5sZW5ndGgpcmV0dXJuIHZvaWQgaC5wb3N0TWVzc2FnZSh7b2s6ITB9KTtjb25zdCByPWQ/ZihjLmJvZHkpOkpTT04ucGFyc2UoYy5ib2R5KTtmb3IoY29uc3QgdCBvZiBlKXtjb25zdCBlPWQ/cyhPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30scikse3Rva2VuOnR9KSk6SlNPTi5zdHJpbmdpZnkoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpO2xldCBuLGksbCxmOyJmdW5jdGlvbiI9PXR5cGVvZiBBYm9ydENvbnRyb2xsZXImJihuPW5ldyBBYm9ydENvbnRyb2xsZXIsaT1uLnNpZ25hbCk7dHJ5e2Y9YXdhaXQgUHJvbWlzZS5yYWNlKFtuZXcgUHJvbWlzZShlPT57bD1zZXRUaW1lb3V0KGUsbyl9KSxmZXRjaChhLE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxjKSx7Ym9keTplLHNpZ25hbDppfSkpXSkuZmluYWxseSgoKT0+Y2xlYXJUaW1lb3V0KGwpKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBoLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighZilyZXR1cm4gbiYmbi5hYm9ydCgpLHZvaWQgaC5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZighZi5vayl7bGV0IGU7dHJ5e2NvbnN0IHQ9SlNPTi5wYXJzZShhd2FpdCBmLnRleHQoKSk7ZT10LmVycm9yX2Rlc2NyaXB0aW9ufWNhdGNoKGUpe31yZXR1cm4gdm9pZCBoLnBvc3RNZXNzYWdlKHtlcnJvcjplfHwiSFRUUCBlcnJvciAiLmNvbmNhdChmLnN0YXR1cyl9KX11KHQpfWgucG9zdE1lc3NhZ2Uoe29rOiEwfSl9Y2F0Y2goZSl7aC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfHwiVW5rbm93biBlcnJvciBkdXJpbmcgdG9rZW4gcmV2b2NhdGlvbiJ9KX19LHA9KGUsdCk9PntpZighYSlyZXR1cm4hMTt0cnl7Y29uc3Qgcj1uZXcgVVJMKGEpLm9yaWdpbixvPW5ldyBVUkwoZS5mZXRjaFVybCk7cmV0dXJuIG8ub3JpZ2luPT09ciYmby5wYXRobmFtZT09PXR9Y2F0Y2goZSl7cmV0dXJuITF9fTthZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIixlPT57Y29uc3Qgcj1lLmRhdGEsbz10KGUucG9ydHMsMSlbMF07aWYoISgidHlwZSJpbiByKXx8ImluaXQiIT09ci50eXBlKXJldHVybiJ0eXBlImluIHImJiJjbGVhciI9PT1yLnR5cGU/KGk9e30sdm9pZChudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMH0pKSk6InR5cGUiaW4gciYmInJldm9rZSI9PT1yLnR5cGU/cChyLCIvb2F1dGgvcmV2b2tlIik/dm9pZCBoKGUpOnZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITEsanNvbjp7ZXJyb3I6ImludmFsaWRfZmV0Y2hfdXJsIixlcnJvcl9kZXNjcmlwdGlvbjoiVW5hdXRob3JpemVkIGZldGNoIFVSTCJ9LGhlYWRlcnM6e319KSk6dm9pZCgiZmV0Y2hVcmwiaW4gciYmcChyLCIvb2F1dGgvdG9rZW4iKT9kKGUpOm51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpO2lmKG51bGw9PT1hKXRyeXtuZXcgVVJMKHIuYWxsb3dlZEJhc2VVcmwpLGE9ci5hbGxvd2VkQmFzZVVybH1jYXRjaChlKXtyZXR1cm59fSl9KCk7Cgo=",Wc=null,Jc=!1,function(r){return Li=Li||Mp(zc,Wc,Jc),new Worker(Li,r)});const Hi={};class Dp{constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}async add(e){var t;const n=new Set(((t=await this.cache.get(this.manifestKey))===null||t===void 0?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){const t=await this.cache.get(this.manifestKey);if(t){const n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(un,"::").concat(e)}}const Bc="auth0.is.authenticated",Lp={memory:()=>new Hl().enclosedCache,localstorage:()=>new _p},Gc=r=>Lp[r],Vc=r=>{const e=r.openUrl,t=r.onRedirect,n=Ne(r,["openUrl","onRedirect"]);return Object.assign(Object.assign({},n),{openUrl:e===!1||e?e:t})},Zc=(r,e)=>{const t=(e==null?void 0:e.split(" "))||[];return((r==null?void 0:r.split(" "))||[]).every(n=>t.includes(n))},nn={NONCE:"nonce",KEYPAIR:"keypair"};class Hp{constructor(e){this.clientId=e}getVersion(){return 1}createDbHandle(){const e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(nn).forEach(o=>e.result.createObjectStore(o)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){const o=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((i,s)=>{o.onsuccess=()=>i(o.result),o.onerror=()=>s(o.error)})}buildKey(e){const t=e?"_".concat(e):"auth0";return"".concat(this.clientId,"::").concat(t)}setNonce(e,t){return this.save(nn.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(nn.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",o=>o.put(n,t))}findNonce(e){return this.find(nn.NONCE,this.buildKey(e))}findKeyPair(){return this.find(nn.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",n=>n.get(t))}async deleteBy(e,t){const n=await this.executeDbRequest(e,"readonly",o=>o.getAllKeys());await Promise.all((n==null?void 0:n.filter(t).map(o=>this.executeDbRequest(e,"readwrite",i=>i.delete(o))))||[])}deleteByClientId(e,t){return this.deleteBy(e,n=>typeof n=="string"&&n.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(nn.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(nn.KEYPAIR,this.clientId)}}class Kp{constructor(e){this.storage=new Hp(e)}getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await bp(),await this.storage.setKeyPair(e)),e}async generateProof(e){const t=await this.getOrGenerateKeyPair();return Tp(Object.assign({keyPair:t},e))}async calculateThumbprint(){return Cp(await this.getOrGenerateKeyPair())}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}}var Dn;(function(r){r.Bearer="Bearer",r.DPoP="DPoP"})(Dn||(Dn={}));class Fp{constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||(typeof window>"u"?fetch:window.fetch.bind(window))})}isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw new TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return typeof e=="string"?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);const n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),o=e instanceof Request?new Request(n,e):n;return new Request(o,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:Dn.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;const n=await this.hooks.getDpopNonce(),o=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",o)}async prepareRequest(e,t){const n=await this.getAccessToken(t);let o,i;typeof n=="string"?(o=this.config.dpopNonceId?Dn.DPoP:Dn.Bearer,i=n):(o=n.token_type,i=n.access_token),this.setAuthorizationHeader(e,i,o),o===Dn.DPoP&&await this.setDpopProofHeader(e,i)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":typeof e.get=="function"?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(e.status!==401)return!1;const t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){const n=this.getHeader(e.headers,Ul);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new fi(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,o){const i=this.buildBaseRequest(e,t);await this.prepareRequest(i,o);const s=await this.config.fetch(i);return this.handleResponse(s,n)}fetchWithAuth(e,t,n){const o={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},o),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,o,n)}}class jp{constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}async connectAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){const e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){const t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){const t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;const n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),o=await this._handleResponse(n),i=(t=n.headers.get("location"))!==null&&t!==void 0?t:"",s=decodeURIComponent(i.split("/").pop()||"");return Object.assign(Object.assign({},o),{id:s,location:i})}async enrollmentVerify(e){const t=e,n=t.location;t.type;const o=Ne(t,["location","type"]),i=await this.myAccountFetcher.fetchWithAuth("".concat(n,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},{scope:["create:me:authentication_methods"]});return this._handleResponse(i)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new Fo({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new Fo(t)}}class Fo extends Error{constructor(e){let t=e.type,n=e.status,o=e.title,i=e.detail,s=e.validation_errors;super(i),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=o,this.detail=i,this.validation_errors=s,Object.setPrototypeOf(this,Fo.prototype)}}const zp={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}},Wp="http://auth0.com/oauth/grant-type/mfa-otp",Jp="http://auth0.com/oauth/grant-type/mfa-oob",Bp="http://auth0.com/oauth/grant-type/mfa-recovery-code";var uo,Ki;let Cs;(typeof navigator>"u"||(uo=navigator.userAgent)===null||uo===void 0||(Ki=uo.startsWith)===null||Ki===void 0||!Ki.call(uo,"Mozilla/5.0 "))&&(Cs="".concat("oauth4webapi","/").concat("v3.8.6"));function rr(r,e){if(r==null)return!1;try{return r instanceof e||Object.getPrototypeOf(r)[Symbol.toStringTag]===e.prototype[Symbol.toStringTag]}catch{return!1}}const Te="ERR_INVALID_ARG_VALUE",Ue="ERR_INVALID_ARG_TYPE";function Y(r,e,t){const n=new TypeError(r,{cause:t});return Object.assign(n,{code:e}),n}const We=Symbol(),Ts=Symbol(),ks=Symbol(),at=Symbol(),Rt=Symbol(),Gp=new TextEncoder,Vp=new TextDecoder;function jn(r){return typeof r=="string"?Gp.encode(r):Vp.decode(r)}let _s,zl;Uint8Array.prototype.toBase64?_s=r=>(r instanceof ArrayBuffer&&(r=new Uint8Array(r)),r.toBase64({alphabet:"base64url",omitPadding:!0})):_s=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));const t=[];for(let n=0;n<e.byteLength;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};function fn(r){return typeof r=="string"?zl(r):_s(r)}zl=Uint8Array.fromBase64?r=>{try{return Uint8Array.fromBase64(r,{alphabet:"base64url"})}catch(e){throw Y("The input to be decoded is not correctly encoded.",Te,e)}}:r=>{try{const e=atob(r.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);return t}catch(e){throw Y("The input to be decoded is not correctly encoded.",Te,e)}};class He extends Error{constructor(e,t){var n;super(e,t),I(this,"code",void 0),this.name=this.constructor.name,this.code=Es,(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}class ha extends Error{constructor(e,t){var n;super(e,t),I(this,"code",void 0),this.name=this.constructor.name,t!=null&&t.code&&(this.code=t==null?void 0:t.code),(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}function N(r,e,t){return new ha(r,{code:e,cause:t})}function Zp(r,e){if((function(t,n){if(!(t instanceof CryptoKey))throw Y("".concat(n," must be a CryptoKey"),Ue)})(r,e),r.type!=="private")throw Y("".concat(e," must be a private CryptoKey"),Te)}function jo(r){return r!==null&&typeof r=="object"&&!Array.isArray(r)}function gi(r){rr(r,Headers)&&(r=Object.fromEntries(r.entries()));const e=new Headers(r??{});if(Cs&&!e.has("user-agent")&&e.set("user-agent",Cs),e.has("authorization"))throw Y('"options.headers" must not include the "authorization" header name',Te);return e}function Wl(r,e){if(e!==void 0){if(typeof e=="function"&&(e=e(r.href)),!(e instanceof AbortSignal))throw Y('"options.signal" must return or be an instance of AbortSignal',Ue);return e}}function $c(r){return r.includes("//")?r.replace("//","/"):r}async function $p(r,e){return(async function(t,n,o,i){if(!(t instanceof URL))throw Y('"'.concat(n,'" must be an instance of URL'),Ue);la(t,(i==null?void 0:i[We])!==!0);const s=o(new URL(t.href)),a=gi(i==null?void 0:i.headers);return a.set("accept","application/json"),((i==null?void 0:i[at])||fetch)(s.href,{body:void 0,headers:Object.fromEntries(a.entries()),method:"GET",redirect:"manual",signal:Wl(s,i==null?void 0:i.signal)})})(r,"issuerIdentifier",t=>{switch(e==null?void 0:e.algorithm){case void 0:case"oidc":(function(n,o){n.pathname=$c("".concat(n.pathname,"/").concat(o))})(t,".well-known/openid-configuration");break;case"oauth2":(function(n,o){let i=arguments.length>2&&arguments[2]!==void 0&&arguments[2];n.pathname==="/"?n.pathname=o:n.pathname=$c("".concat(o,"/").concat(i?n.pathname:n.pathname.replace(/(\/)$/,"")))})(t,".well-known/oauth-authorization-server");break;default:throw Y('"options.algorithm" must be "oidc" (default), or "oauth2"',Te)}return t},e)}function $t(r,e,t,n,o){try{if(typeof r!="number"||!Number.isFinite(r))throw Y("".concat(t," must be a number"),Ue,o);if(r>0)return;if(e){if(r!==0)throw Y("".concat(t," must be a non-negative number"),Te,o);return}throw Y("".concat(t," must be a positive number"),Te,o)}catch(i){throw n?N(i.message,n,o):i}}function ae(r,e,t,n){try{if(typeof r!="string")throw Y("".concat(e," must be a string"),Ue,n);if(r.length===0)throw Y("".concat(e," must not be empty"),Te,n)}catch(o){throw t?N(o.message,t,n):o}}function Jl(r){(function(e,t){if(Zl(e)!==t)throw(function(n){let o='"response" content-type must be ';for(var i=arguments.length,s=new Array(i>1?i-1:0),a=1;a<i;a++)s[a-1]=arguments[a];if(s.length>2){const c=s.pop();o+="".concat(s.join(", "),", or ").concat(c)}else s.length===2?o+="".concat(s[0]," or ").concat(s[1]):o+=s[0];return N(o,Xl,n)})(e,t)})(r,"application/json")}function Bl(){return fn(crypto.getRandomValues(new Uint8Array(32)))}function Xp(r){switch(r.algorithm.name){case"RSA-PSS":return(function(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new He("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}})(r);case"RSASSA-PKCS1-v1_5":return(function(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new He("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}})(r);case"ECDSA":return(function(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new He("unsupported EcKeyAlgorithm namedCurve",{cause:e})}})(r);case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return r.algorithm.name;case"EdDSA":return"Ed25519";default:throw new He("unsupported CryptoKey algorithm name",{cause:r})}}function zo(r){const e=r==null?void 0:r[Ts];return typeof e=="number"&&Number.isFinite(e)?e:0}function Is(r){const e=r==null?void 0:r[ks];return typeof e=="number"&&Number.isFinite(e)&&Math.sign(e)!==-1?e:30}function Wo(){return Math.floor(Date.now()/1e3)}function nt(r){if(typeof r!="object"||r===null)throw Y('"as" must be an object',Ue);ae(r.issuer,'"as.issuer"')}function rt(r){if(typeof r!="object"||r===null)throw Y('"client" must be an object',Ue);ae(r.client_id,'"client.client_id"')}function Xc(r){return ae(r,'"clientSecret"'),(e,t,n,o)=>{n.set("client_id",t.client_id),n.set("client_secret",r)}}function Yp(r,e){const t=(i=r)instanceof CryptoKey?{key:i}:(i==null?void 0:i.key)instanceof CryptoKey?(i.kid!==void 0&&ae(i.kid,'"kid"'),{key:i.key,kid:i.kid}):{},n=t.key,o=t.kid;var i;return Zp(n,'"clientPrivateKey.key"'),async(s,a,c,l)=>{const h={alg:Xp(n),kid:o},d=(function(p,u){const f=Wo()+zo(u);return{jti:Bl(),aud:p.issuer,exp:f+60,iat:f,nbf:f,iss:u.client_id,sub:u.client_id}})(s,a);c.set("client_id",a.client_id),c.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),c.set("client_assertion",await(async function(p,u,f){if(!f.usages.includes("sign"))throw Y('CryptoKey instances used for signing assertions must include "sign" in their "usages"',Te);const g="".concat(fn(jn(JSON.stringify(p))),".").concat(fn(jn(JSON.stringify(u)))),y=fn(await crypto.subtle.sign((function(m){switch(m.algorithm.name){case"ECDSA":return{name:m.algorithm.name,hash:yf(m)};case"RSA-PSS":switch(qc(m),m.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:m.algorithm.name,saltLength:parseInt(m.algorithm.hash.name.slice(-3),10)>>3};default:throw new He("unsupported RSA-PSS hash name",{cause:m})}case"RSASSA-PKCS1-v1_5":return qc(m),m.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return m.algorithm.name}throw new He("unsupported CryptoKey algorithm name",{cause:m})})(f),f,jn(g)));return"".concat(g,".").concat(y)})(h,d,n))}}const Qp=URL.parse?(r,e)=>URL.parse(r,e):(r,e)=>{try{return new URL(r,e)}catch{return null}};function la(r,e){if(e&&r.protocol!=="https:")throw N("only requests to HTTPS are allowed",Yl,r);if(r.protocol!=="https:"&&r.protocol!=="http:")throw N("only HTTP and HTTPS requests are allowed",Ql,r)}function Yc(r,e,t,n){let o;if(typeof r!="string"||!(o=Qp(r)))throw N("authorization server metadata does not contain a valid ".concat(t?'"as.mtls_endpoint_aliases.'.concat(e,'"'):'"as.'.concat(e,'"')),r===void 0?gf:mf,{attribute:t?"mtls_endpoint_aliases.".concat(e):e});return la(o,n),o}function Xr(r,e,t,n){return t&&r.mtls_endpoint_aliases&&e in r.mtls_endpoint_aliases?Yc(r.mtls_endpoint_aliases[e],e,t,n):Yc(r[e],e,t,n)}class mi extends Error{constructor(e,t){var n;super(e,t),I(this,"cause",void 0),I(this,"code",void 0),I(this,"error",void 0),I(this,"status",void 0),I(this,"error_description",void 0),I(this,"response",void 0),this.name=this.constructor.name,this.code=pf,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}class Gl extends Error{constructor(e,t){var n,o;super(e,t),I(this,"cause",void 0),I(this,"code",void 0),I(this,"error",void 0),I(this,"error_description",void 0),this.name=this.constructor.name,this.code=ff,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=(n=t.cause.get("error_description"))!==null&&n!==void 0?n:void 0,(o=Error.captureStackTrace)===null||o===void 0||o.call(Error,this,this.constructor)}}class da extends Error{constructor(e,t){var n;super(e,t),I(this,"cause",void 0),I(this,"code",void 0),I(this,"response",void 0),I(this,"status",void 0),this.name=this.constructor.name,this.code=uf,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}const Jo="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",qp="("+Jo+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"',ef="("+Jo+")\\s*=\\s*("+Jo+")",tf=new RegExp("^[,\\s]*("+Jo+")"),nf=new RegExp("^[,\\s]*"+qp+"[,\\s]*(.*)"),rf=new RegExp("^[,\\s]*"+ef+"[,\\s]*(.*)"),of=new RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function ua(r,e,t){if(r.status!==e){let o;var n;throw(function(i){let s;if(s=(function(a){if(!rr(a,Response))throw Y('"response" must be an instance of Response',Ue);const c=a.headers.get("www-authenticate");if(c===null)return;const l=[];let h=c;for(;h;){var d;let g=h.match(tf);const y=(d=g)===null||d===void 0?void 0:d[1].toLowerCase();if(!y)return;const m=h.substring(g[0].length);if(m&&!m.match(/^[\s,]/))return;const b=m.match(/^\s+(.*)$/),C=!!b;h=b?b[1]:void 0;const k={};let _;if(C)for(;h;){let S,x;if(g=h.match(nf)){var p=Ke(g,4);if(S=p[1],x=p[2],h=p[3],x.includes("\\"))try{x=JSON.parse('"'.concat(x,'"'))}catch{}k[S.toLowerCase()]=x}else{if(!(g=h.match(rf))){if(g=h.match(of)){if(Object.keys(k).length)break;var u=Ke(g,3);_=u[1],h=u[2];break}return}var f=Ke(g,4);S=f[1],x=f[2],h=f[3],k[S.toLowerCase()]=x}}else h=m||void 0;const O={scheme:y,parameters:k};_&&(O.token68=_),l.push(O)}return l.length?l:void 0})(i))throw new da("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:s,response:i})})(r),(o=await(async function(i){if(i.status>399&&i.status<500){Qr(i),Jl(i);try{const s=await i.clone().json();if(jo(s)&&typeof s.error=="string"&&s.error.length)return s}catch{}}})(r))?(await((n=r.body)===null||n===void 0?void 0:n.cancel()),new mi("server responded with an error in the response body",{cause:o,response:r})):N('"response" is not a conform '.concat(t," response (unexpected HTTP status code)"),ga,r)}}function Vl(r){if(!fa.has(r))throw Y('"options.DPoP" is not a valid DPoPHandle',Te)}function Zl(r){var e;return(e=r.headers.get("content-type"))===null||e===void 0?void 0:e.split(";")[0]}async function pa(r,e,t,n,o,i,s){return await t(r,e,o,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((s==null?void 0:s[at])||fetch)(n.href,{body:o,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:Wl(n,s==null?void 0:s.signal)})}async function Yr(r,e,t,n,o,i){var s;const a=Xr(r,"token_endpoint",e.use_mtls_endpoint_aliases,(i==null?void 0:i[We])!==!0);o.set("grant_type",n);const c=gi(i==null?void 0:i.headers);c.set("accept","application/json"),(i==null?void 0:i.DPoP)!==void 0&&(Vl(i.DPoP),await i.DPoP.addProof(a,c,"POST"));const l=await pa(r,e,t,a,o,c,i);return i==null||(s=i.DPoP)===null||s===void 0||s.cacheNonce(l,a),l}const $l=new WeakMap,sf=new WeakMap;function Ss(r){if(!r.id_token)return;const e=$l.get(r);if(!e)throw Y('"ref" was already garbage collected or did not resolve from the proper sources',Te);return e}async function Xn(r,e,t,n,o,i){if(nt(r),rt(e),!rr(t,Response))throw Y('"response" must be an instance of Response',Ue);await ua(t,200,"Token Endpoint"),Qr(t);const s=await yi(t);if(ae(s.access_token,'"response" body "access_token" property',K,{body:s}),ae(s.token_type,'"response" body "token_type" property',K,{body:s}),s.token_type=s.token_type.toLowerCase(),s.expires_in!==void 0){let a=typeof s.expires_in!="number"?parseFloat(s.expires_in):s.expires_in;$t(a,!0,'"response" body "expires_in" property',K,{body:s}),s.expires_in=a}if(s.refresh_token!==void 0&&ae(s.refresh_token,'"response" body "refresh_token" property',K,{body:s}),s.scope!==void 0&&typeof s.scope!="string")throw N('"response" body "scope" property must be a string',K,{body:s});if(s.id_token!==void 0){ae(s.id_token,'"response" body "id_token" property',K,{body:s});const a=["aud","exp","iat","iss","sub"];e.require_auth_time===!0&&a.push("auth_time"),e.default_max_age!==void 0&&($t(e.default_max_age,!0,'"client.default_max_age"'),a.push("auth_time")),n!=null&&n.length&&a.push(...n);const c=await(async function(d,p,u,f,g){let y,m,b=d.split("."),C=b[0],k=b[1],_=b.length;if(_===5){if(g===void 0)throw new He("JWE decryption is not configured",{cause:d});var O=(d=await g(d)).split(".");C=O[0],k=O[1],_=O.length}if(_!==3)throw N("Invalid JWT",K,d);try{y=JSON.parse(jn(fn(C)))}catch(x){throw N("failed to parse JWT Header body as base64url encoded JSON",Bo,x)}if(!jo(y))throw N("JWT Header must be a top level object",K,d);if(p(y),y.crit!==void 0)throw new He('no JWT "crit" header parameter extensions are supported',{cause:{header:y}});try{m=JSON.parse(jn(fn(k)))}catch(x){throw N("failed to parse JWT Payload body as base64url encoded JSON",Bo,x)}if(!jo(m))throw N("JWT Payload must be a top level object",K,d);const S=Wo()+u;if(m.exp!==void 0){if(typeof m.exp!="number")throw N('unexpected JWT "exp" (expiration time) claim type',K,{claims:m});if(m.exp<=S-f)throw N('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',zr,{claims:m,now:S,tolerance:f,claim:"exp"})}if(m.iat!==void 0&&typeof m.iat!="number")throw N('unexpected JWT "iat" (issued at) claim type',K,{claims:m});if(m.iss!==void 0&&typeof m.iss!="string")throw N('unexpected JWT "iss" (issuer) claim type',K,{claims:m});if(m.nbf!==void 0){if(typeof m.nbf!="number")throw N('unexpected JWT "nbf" (not before) claim type',K,{claims:m});if(m.nbf>S+f)throw N('unexpected JWT "nbf" (not before) claim value',zr,{claims:m,now:S,tolerance:f,claim:"nbf"})}if(m.aud!==void 0&&typeof m.aud!="string"&&!Array.isArray(m.aud))throw N('unexpected JWT "aud" (audience) claim type',K,{claims:m});return{header:y,claims:m,jwt:d}})(s.id_token,vf.bind(void 0,e.id_token_signed_response_alg,r.id_token_signing_alg_values_supported,"RS256"),zo(e),Is(e),o).then(lf.bind(void 0,a)).then(cf.bind(void 0,r)).then(af.bind(void 0,e.client_id)),l=c.claims,h=c.jwt;if(Array.isArray(l.aud)&&l.aud.length!==1){if(l.azp===void 0)throw N('ID Token "aud" (audience) claim includes additional untrusted audiences',It,{claims:l,claim:"aud"});if(l.azp!==e.client_id)throw N('unexpected ID Token "azp" (authorized party) claim value',It,{expected:e.client_id,claims:l,claim:"azp"})}l.auth_time!==void 0&&$t(l.auth_time,!0,'ID Token "auth_time" (authentication time)',K,{claims:l}),sf.set(t,h),$l.set(s,l)}if((i==null?void 0:i[s.token_type])!==void 0)i[s.token_type](t,s);else if(s.token_type!=="dpop"&&s.token_type!=="bearer")throw new He("unsupported `token_type` value",{cause:{body:s}});return s}function af(r,e){if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(r))throw N('unexpected JWT "aud" (audience) claim value',It,{expected:r,claims:e.claims,claim:"aud"})}else if(e.claims.aud!==r)throw N('unexpected JWT "aud" (audience) claim value',It,{expected:r,claims:e.claims,claim:"aud"});return e}function cf(r,e){var t,n;const o=(t=(n=r[ql])===null||n===void 0?void 0:n.call(r,e))!==null&&t!==void 0?t:r.issuer;if(e.claims.iss!==o)throw N('unexpected JWT "iss" (issuer) claim value',It,{expected:o,claims:e.claims,claim:"iss"});return e}const fa=new WeakSet,Qc=Symbol(),hf={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function lf(r,e){for(const t of r)if(e.claims[t]===void 0)throw N('JWT "'.concat(t,'" (').concat(hf[t],") claim missing"),K,{claims:e.claims});return e}const Fi=Symbol(),ji=Symbol();async function df(r,e,t,n){return typeof(n==null?void 0:n.expectedNonce)=="string"||typeof(n==null?void 0:n.maxAge)=="number"||n!=null&&n.requireIdToken?(async function(o,i,s,a,c,l,h){const d=[];switch(a){case void 0:a=Fi;break;case Fi:break;default:ae(a,'"expectedNonce" argument'),d.push("nonce")}switch(c!=null||(c=i.default_max_age),c){case void 0:c=ji;break;case ji:break;default:$t(c,!0,'"maxAge" argument'),d.push("auth_time")}const p=await Xn(o,i,s,d,l,h);ae(p.id_token,'"response" body "id_token" property',K,{body:p});const u=Ss(p);if(c!==ji){const f=Wo()+zo(i),g=Is(i);if(u.auth_time+c<f-g)throw N("too much time has elapsed since the last End-User authentication",zr,{claims:u,now:f,tolerance:g,claim:"auth_time"})}if(a===Fi){if(u.nonce!==void 0)throw N('unexpected ID Token "nonce" claim value',It,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==a)throw N('unexpected ID Token "nonce" claim value',It,{expected:a,claims:u,claim:"nonce"});return p})(r,e,t,n.expectedNonce,n.maxAge,n[Rt],n.recognizedTokenTypes):(async function(o,i,s,a,c){const l=await Xn(o,i,s,void 0,a,c),h=Ss(l);if(h){if(i.default_max_age!==void 0){$t(i.default_max_age,!0,'"client.default_max_age"');const d=Wo()+zo(i),p=Is(i);if(h.auth_time+i.default_max_age<d-p)throw N("too much time has elapsed since the last End-User authentication",zr,{claims:h,now:d,tolerance:p,claim:"auth_time"})}if(h.nonce!==void 0)throw N('unexpected ID Token "nonce" claim value',It,{expected:void 0,claims:h,claim:"nonce"})}return l})(r,e,t,n==null?void 0:n[Rt],n==null?void 0:n.recognizedTokenTypes)}const uf="OAUTH_WWW_AUTHENTICATE_CHALLENGE",pf="OAUTH_RESPONSE_BODY_ERROR",Es="OAUTH_UNSUPPORTED_OPERATION",ff="OAUTH_AUTHORIZATION_RESPONSE_ERROR",Bo="OAUTH_PARSE_ERROR",K="OAUTH_INVALID_RESPONSE",Xl="OAUTH_RESPONSE_IS_NOT_JSON",ga="OAUTH_RESPONSE_IS_NOT_CONFORM",Yl="OAUTH_HTTP_REQUEST_FORBIDDEN",Ql="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",zr="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",It="OAUTH_JWT_CLAIM_COMPARISON_FAILED",As="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",gf="OAUTH_MISSING_SERVER_METADATA",mf="OAUTH_INVALID_SERVER_METADATA";function Qr(r){if(r.bodyUsed)throw Y('"response" body has been used already',Te)}function qc(r){const e=r.algorithm;if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new He("unsupported ".concat(e.name," modulusLength"),{cause:r})}function yf(r){switch(r.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new He("unsupported ECDSA namedCurve",{cause:r})}}async function wf(r){if(r.method!=="POST")throw Y("form_post responses are expected to use the POST method",Te,{cause:r});if(Zl(r)!=="application/x-www-form-urlencoded")throw Y("form_post responses are expected to use the application/x-www-form-urlencoded content-type",Te,{cause:r});return(async function(e){if(e.bodyUsed)throw Y("form_post Request instances must contain a readable body",Te,{cause:e});return e.text()})(r)}function vf(r,e,t,n){if(r===void 0)if(Array.isArray(e)){if(!e.includes(n.alg))throw N('unexpected JWT "alg" header parameter',K,{header:n,expected:e,reason:"authorization server metadata"})}else{if(t===void 0)throw N('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:r,issuer:e,fallback:t});if(typeof t=="string"?n.alg!==t:typeof t=="function"?!t(n.alg):!t.includes(n.alg))throw N('unexpected JWT "alg" header parameter',K,{header:n,expected:t,reason:"default value"})}else if(typeof r=="string"?n.alg!==r:!r.includes(n.alg))throw N('unexpected JWT "alg" header parameter',K,{header:n,expected:r,reason:"client configuration"})}function hn(r,e){const t=r.getAll(e),n=t[0];if(t.length>1)throw N('"'.concat(e,'" parameter must be provided only once'),K);return n}const bf=Symbol(),Cf=Symbol();function Tf(r,e,t,n){if(nt(r),rt(e),t instanceof URL&&(t=t.searchParams),!(t instanceof URLSearchParams))throw Y('"parameters" must be an instance of URLSearchParams, or URL',Ue);if(hn(t,"response"))throw N('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',K,{parameters:t});const o=hn(t,"iss"),i=hn(t,"state");if(!o&&r.authorization_response_iss_parameter_supported)throw N('response parameter "iss" (issuer) missing',K,{parameters:t});if(o&&o!==r.issuer)throw N('unexpected "iss" (issuer) response parameter value',K,{expected:r.issuer,parameters:t});switch(n){case void 0:case Cf:if(i!==void 0)throw N('unexpected "state" response parameter encountered',K,{expected:void 0,parameters:t});break;case bf:break;default:if(ae(n,'"expectedState" argument'),i!==n)throw N(i===void 0?'response parameter "state" missing':'unexpected "state" response parameter value',K,{expected:n,parameters:t})}if(hn(t,"error"))throw new Gl("authorization response from the server is an error",{cause:t});const s=hn(t,"id_token"),a=hn(t,"token");if(s!==void 0||a!==void 0)throw new He("implicit and hybrid flows are not supported");return c=new URLSearchParams(t),fa.add(c),c;var c}async function yi(r){let e,t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:Jl;try{e=await r.json()}catch(n){throw t(r),N('failed to parse "response" body as JSON',Bo,n)}if(!jo(e))throw N('"response" body must be a top level object',K,{body:e});return e}const zi=Symbol(),ql=Symbol(),eh=new TextEncoder,Yn=new TextDecoder;function Wi(r){const e=new Uint8Array(r.length);for(let t=0;t<r.length;t++){const n=r.charCodeAt(t);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[t]=n}return e}function ed(r){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(r);const e=atob(r),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);return t}function qr(r){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof r=="string"?r:Yn.decode(r),{alphabet:"base64url"});let e=r;e instanceof Uint8Array&&(e=Yn.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return ed(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}const Ft=function(r){return new TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&arguments[1]!==void 0?arguments[1]:"algorithm.name"," must be ").concat(r))},En=(r,e)=>r.name===e;function Ji(r,e){var t;if(t=r.hash,parseInt(t.name.slice(4),10)!==e)throw Ft("SHA-".concat(e),"algorithm.hash")}function kf(r,e,t){switch(e){case"HS256":case"HS384":case"HS512":if(!En(r.algorithm,"HMAC"))throw Ft("HMAC");Ji(r.algorithm,parseInt(e.slice(2),10));break;case"RS256":case"RS384":case"RS512":if(!En(r.algorithm,"RSASSA-PKCS1-v1_5"))throw Ft("RSASSA-PKCS1-v1_5");Ji(r.algorithm,parseInt(e.slice(2),10));break;case"PS256":case"PS384":case"PS512":if(!En(r.algorithm,"RSA-PSS"))throw Ft("RSA-PSS");Ji(r.algorithm,parseInt(e.slice(2),10));break;case"Ed25519":case"EdDSA":if(!En(r.algorithm,"Ed25519"))throw Ft("Ed25519");break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":if(!En(r.algorithm,e))throw Ft(e);break;case"ES256":case"ES384":case"ES512":{if(!En(r.algorithm,"ECDSA"))throw Ft("ECDSA");const n=(function(o){switch(o){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}})(e);if(r.algorithm.namedCurve!==n)throw Ft(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}(function(n,o){if(!n.usages.includes(o))throw new TypeError("CryptoKey does not support this operation, its usages must include ".concat(o,"."))})(r,t)}function td(r,e){for(var t=arguments.length,n=new Array(t>2?t-2:0),o=2;o<t;o++)n[o-2]=arguments[o];if((n=n.filter(Boolean)).length>2){const s=n.pop();r+="one of type ".concat(n.join(", "),", or ").concat(s,".")}else n.length===2?r+="one of type ".concat(n[0]," or ").concat(n[1],"."):r+="of type ".concat(n[0],".");if(e==null)r+=" Received ".concat(e);else if(typeof e=="function"&&e.name)r+=" Received function ".concat(e.name);else if(typeof e=="object"&&e!=null){var i;(i=e.constructor)!==null&&i!==void 0&&i.name&&(r+=" Received an instance of ".concat(e.constructor.name))}return r}const th=function(r,e){for(var t=arguments.length,n=new Array(t>2?t-2:0),o=2;o<t;o++)n[o-2]=arguments[o];return td("Key for the ".concat(r," algorithm must be "),e,...n)};class ge extends Error{constructor(e,t){var n;super(e,t),I(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}I(ge,"code","ERR_JOSE_GENERIC");class Je extends ge{constructor(e,t){let n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:"unspecified",o=arguments.length>3&&arguments[3]!==void 0?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),I(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),I(this,"claim",void 0),I(this,"reason",void 0),I(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}I(Je,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class Rs extends ge{constructor(e,t){let n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:"unspecified",o=arguments.length>3&&arguments[3]!==void 0?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:o,payload:t}}),I(this,"code","ERR_JWT_EXPIRED"),I(this,"claim",void 0),I(this,"reason",void 0),I(this,"payload",void 0),this.claim=n,this.reason=o,this.payload=t}}I(Rs,"code","ERR_JWT_EXPIRED");class nd extends ge{constructor(){super(...arguments),I(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}I(nd,"code","ERR_JOSE_ALG_NOT_ALLOWED");class Le extends ge{constructor(){super(...arguments),I(this,"code","ERR_JOSE_NOT_SUPPORTED")}}I(Le,"code","ERR_JOSE_NOT_SUPPORTED");I(class extends ge{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),I(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED");I(class extends ge{constructor(){super(...arguments),I(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class ce extends ge{constructor(){super(...arguments),I(this,"code","ERR_JWS_INVALID")}}I(ce,"code","ERR_JWS_INVALID");class dt extends ge{constructor(){super(...arguments),I(this,"code","ERR_JWT_INVALID")}}I(dt,"code","ERR_JWT_INVALID");I(class extends ge{constructor(){super(...arguments),I(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class ma extends ge{constructor(){super(...arguments),I(this,"code","ERR_JWKS_INVALID")}}I(ma,"code","ERR_JWKS_INVALID");class ya extends ge{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),I(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}I(ya,"code","ERR_JWKS_NO_MATCHING_KEY");class rd extends ge{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),I(this,Symbol.asyncIterator,void 0),I(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}I(rd,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class od extends ge{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),I(this,"code","ERR_JWKS_TIMEOUT")}}I(od,"code","ERR_JWKS_TIMEOUT");class id extends ge{constructor(){super(arguments.length>0&&arguments[0]!==void 0?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),I(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}I(id,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");const sd=r=>{if((r==null?void 0:r[Symbol.toStringTag])==="CryptoKey")return!0;try{return r instanceof CryptoKey}catch{return!1}},ad=r=>(r==null?void 0:r[Symbol.toStringTag])==="KeyObject",nh=r=>sd(r)||ad(r);function rh(r,e,t){try{return qr(r)}catch{throw new t("Failed to base64url decode the ".concat(e))}}function Pt(r){if(typeof(e=r)!="object"||e===null||Object.prototype.toString.call(r)!=="[object Object]")return!1;var e;if(Object.getPrototypeOf(r)===null)return!0;let t=r;for(;Object.getPrototypeOf(t)!==null;)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(r)===t}const Ps=r=>Pt(r)&&typeof r.kty=="string";async function _f(r,e,t){if(e instanceof Uint8Array){if(!r.startsWith("HS"))throw new TypeError((function(n){for(var o=arguments.length,i=new Array(o>1?o-1:0),s=1;s<o;s++)i[s-1]=arguments[s];return td("Key must be ",n,...i)})(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:"SHA-".concat(r.slice(-3)),name:"HMAC"},!1,[t])}return kf(e,r,t),e}async function If(r,e,t,n){const o=await _f(r,e,"verify");(function(s,a){if(s.startsWith("RS")||s.startsWith("PS")){const c=a.algorithm.modulusLength;if(typeof c!="number"||c<2048)throw new TypeError("".concat(s," requires key modulusLength to be 2048 bits or larger"))}})(r,o);const i=(function(s,a){const c="SHA-".concat(s.slice(-3));switch(s){case"HS256":case"HS384":case"HS512":return{hash:c,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:c,name:"RSA-PSS",saltLength:parseInt(s.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:c,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:c,name:"ECDSA",namedCurve:a.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:s};default:throw new Le("alg ".concat(s," is not supported either by JOSE or your javascript runtime"))}})(r,o.algorithm);try{return await crypto.subtle.verify(i,o,t,n)}catch{return!1}}const po='Invalid or unsupported JWK "alg" (Algorithm) Parameter value';async function Oo(r){var e,t;if(!r.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');const n=(function(a){let c,l;switch(a.kty){case"AKP":switch(a.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":c={name:a.alg},l=a.priv?["sign"]:["verify"];break;default:throw new Le(po)}break;case"RSA":switch(a.alg){case"PS256":case"PS384":case"PS512":c={name:"RSA-PSS",hash:"SHA-".concat(a.alg.slice(-3))},l=a.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":c={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(a.alg.slice(-3))},l=a.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":c={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(a.alg.slice(-3),10)||1)},l=a.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new Le(po)}break;case"EC":switch(a.alg){case"ES256":case"ES384":case"ES512":c={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[a.alg]},l=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":c={name:"ECDH",namedCurve:a.crv},l=a.d?["deriveBits"]:[];break;default:throw new Le(po)}break;case"OKP":switch(a.alg){case"Ed25519":case"EdDSA":c={name:"Ed25519"},l=a.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":c={name:a.crv},l=a.d?["deriveBits"]:[];break;default:throw new Le(po)}break;default:throw new Le('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:c,keyUsages:l}})(r),o=n.algorithm,i=n.keyUsages,s=E({},r);return s.kty!=="AKP"&&delete s.alg,delete s.use,crypto.subtle.importKey("jwk",s,o,(e=r.ext)!==null&&e!==void 0?e:!r.d&&!r.priv,(t=r.key_ops)!==null&&t!==void 0?t:i)}const An="given KeyObject instance cannot be used for this algorithm";let Vt;const oh=async function(r,e,t){let n=arguments.length>3&&arguments[3]!==void 0&&arguments[3];Vt||(Vt=new WeakMap);let o=Vt.get(r);if(o!=null&&o[t])return o[t];const i=await Oo(E(E({},e),{},{alg:t}));return n&&Object.freeze(r),o?o[t]=i:Vt.set(r,{[t]:i}),i};async function Sf(r,e){if(r instanceof Uint8Array||sd(r))return r;if(ad(r)){if(r.type==="secret")return r.export();if("toCryptoKey"in r&&typeof r.toCryptoKey=="function")try{return((n,o)=>{Vt||(Vt=new WeakMap);let i=Vt.get(n);if(i!=null&&i[o])return i[o];const s=n.type==="public",a=!!s;let c;if(n.asymmetricKeyType==="x25519"){switch(o){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(An)}c=n.toCryptoKey(n.asymmetricKeyType,a,s?[]:["deriveBits"])}if(n.asymmetricKeyType==="ed25519"){if(o!=="EdDSA"&&o!=="Ed25519")throw new TypeError(An);c=n.toCryptoKey(n.asymmetricKeyType,a,[s?"verify":"sign"])}switch(n.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":if(o!==n.asymmetricKeyType.toUpperCase())throw new TypeError(An);c=n.toCryptoKey(n.asymmetricKeyType,a,[s?"verify":"sign"])}if(n.asymmetricKeyType==="rsa"){let h;switch(o){case"RSA-OAEP":h="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":h="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":h="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":h="SHA-512";break;default:throw new TypeError(An)}if(o.startsWith("RSA-OAEP"))return n.toCryptoKey({name:"RSA-OAEP",hash:h},a,s?["encrypt"]:["decrypt"]);c=n.toCryptoKey({name:o.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:h},a,[s?"verify":"sign"])}if(n.asymmetricKeyType==="ec"){var l;const h=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get((l=n.asymmetricKeyDetails)===null||l===void 0?void 0:l.namedCurve);if(!h)throw new TypeError(An);const d={ES256:"P-256",ES384:"P-384",ES512:"P-521"};d[o]&&h===d[o]&&(c=n.toCryptoKey({name:"ECDSA",namedCurve:h},a,[s?"verify":"sign"])),o.startsWith("ECDH-ES")&&(c=n.toCryptoKey({name:"ECDH",namedCurve:h},a,s?[]:["deriveBits"]))}if(!c)throw new TypeError(An);return i?i[o]=c:Vt.set(n,{[o]:c}),c})(r,e)}catch(n){if(n instanceof TypeError)throw n}let t=r.export({format:"jwk"});return oh(r,t,e)}if(Ps(r))return r.k?qr(r.k):oh(r,r,e,!0);throw new Error("unreachable")}const Bi=(r,e)=>{if(r.byteLength!==e.length)return!1;for(let t=0;t<r.byteLength;t++)if(r[t]!==e[t])return!1;return!0},Mr=r=>{const e=r.data[r.pos++];if(128&e){const t=127&e;let n=0;for(let o=0;o<t;o++)n=n<<8|r.data[r.pos++];return n}return e},Ur=(r,e,t)=>{if(r.data[r.pos++]!==e)throw new Error(t)},ih=(r,e)=>{const t=r.data.subarray(r.pos,r.pos+e);return r.pos+=e,t},Ef=r=>{const e=(o=>{Ur(o,6,"Expected algorithm OID");const i=Mr(o);return ih(o,i)})(r);if(Bi(e,[43,101,110]))return"X25519";if(!Bi(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Ur(r,6,"Expected curve OID");const t=Mr(r),n=ih(r,t);for(const o of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}]){const i=o.name,s=o.oid;if(Bi(n,s))return i}throw new Error("Unsupported named curve")},Af=async(r,e,t,n)=>{var o;let i,s;const a=()=>["sign"];switch(t){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:"SHA-".concat(t.slice(-3))},s=a();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(t.slice(-3))},s=a();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:"SHA-".concat(parseInt(t.slice(-3),10)||1)},s=["decrypt","unwrapKey"];break;case"ES256":case"ES384":case"ES512":i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t]},s=a();break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":try{const c=n.getNamedCurve(e);i=c==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:c}}catch{throw new Le("Invalid or unsupported key format")}s=["deriveBits"];break;case"Ed25519":case"EdDSA":i={name:"Ed25519"},s=a();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:t},s=a();break;default:throw new Le('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(r,e,i,(o=n==null?void 0:n.extractable)!==null&&o!==void 0?o:!1,s)},Rf=(r,e,t)=>{var n;const o=((s,a)=>ed(s.replace(a,"")))(r,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);let i=t;return e!=null&&(n=e.startsWith)!==null&&n!==void 0&&n.call(e,"ECDH-ES")&&(i||(i={}),i.getNamedCurve=s=>{const a={data:s,pos:0};return(function(c){Ur(c,48,"Invalid PKCS#8 structure"),Mr(c),Ur(c,2,"Expected version field");const l=Mr(c);c.pos+=l,Ur(c,48,"Expected algorithm identifier"),Mr(c)})(a),Ef(a)}),Af("pkcs8",o,e,i)},Rn=r=>r==null?void 0:r[Symbol.toStringTag],Gi=(r,e,t)=>{if(e.use!==void 0){let i;switch(t){case"sign":case"verify":i="sig";break;case"encrypt":case"decrypt":i="enc"}if(e.use!==i)throw new TypeError('Invalid key for this operation, its "use" must be "'.concat(i,'" when present'))}if(e.alg!==void 0&&e.alg!==r)throw new TypeError('Invalid key for this operation, its "alg" must be "'.concat(r,'" when present'));if(Array.isArray(e.key_ops)){var n,o;let i;switch(!0){case t==="verify":case r==="dir":case r.includes("CBC-HS"):i=t;break;case r.startsWith("PBES2"):i="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(r):i=!r.includes("GCM")&&r.endsWith("KW")?"unwrapKey":t;break;case t==="encrypt":i="wrapKey";break;case t==="decrypt":i=r.startsWith("RSA")?"unwrapKey":"deriveBits"}if(i&&((n=e.key_ops)===null||n===void 0||(o=n.includes)===null||o===void 0?void 0:o.call(n,i))===!1)throw new TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(i,'" when present'))}return!0};function Pf(r,e,t){switch(r.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":((n,o,i)=>{if(!(o instanceof Uint8Array)){if(Ps(o)){if((s=>s.kty==="oct"&&typeof s.k=="string")(o)&&Gi(n,o,i))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!nh(o))throw new TypeError(th(n,o,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(o.type!=="secret")throw new TypeError("".concat(Rn(o),' instances for symmetric algorithms must be of type "secret"'))}})(r,e,t);break;default:((n,o,i)=>{if(Ps(o))switch(i){case"decrypt":case"sign":if((s=>s.kty!=="oct"&&(s.kty==="AKP"&&typeof s.priv=="string"||typeof s.d=="string"))(o)&&Gi(n,o,i))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if((s=>s.kty!=="oct"&&s.d===void 0&&s.priv===void 0)(o)&&Gi(n,o,i))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!nh(o))throw new TypeError(th(n,o,"CryptoKey","KeyObject","JSON Web Key"));if(o.type==="secret")throw new TypeError("".concat(Rn(o),' instances for asymmetric algorithms must not be of type "secret"'));if(o.type==="public")switch(i){case"sign":throw new TypeError("".concat(Rn(o),' instances for asymmetric algorithm signing must be of type "private"'));case"decrypt":throw new TypeError("".concat(Rn(o),' instances for asymmetric algorithm decryption must be of type "private"'))}if(o.type==="private")switch(i){case"verify":throw new TypeError("".concat(Rn(o),' instances for asymmetric algorithm verifying must be of type "public"'));case"encrypt":throw new TypeError("".concat(Rn(o),' instances for asymmetric algorithm encryption must be of type "public"'))}})(r,e,t)}}var fo,Vi;let wt,sh;(typeof navigator>"u"||(fo=navigator.userAgent)===null||fo===void 0||(Vi=fo.startsWith)===null||Vi===void 0||!Vi.call(fo,"Mozilla/5.0 "))&&(sh="".concat("openid-client","/").concat("v6.8.4"),wt={"user-agent":sh});const fe=r=>No.get(r);let No,go;function cd(r){return r!==void 0?Xc(r):(go||(go=new WeakMap),(e,t,n,o)=>{let i;return(i=go.get(t))||((function(s,a){if(typeof s!="string")throw vt("".concat(a," must be a string"),to);if(s.length===0)throw vt("".concat(a," must not be empty"),eo)})(t.client_secret,'"metadata.client_secret"'),i=Xc(t.client_secret),go.set(t,i)),i(e,t,n,o)})}const et=at,eo="ERR_INVALID_ARG_VALUE",to="ERR_INVALID_ARG_TYPE";function vt(r,e,t){const n=new TypeError(r,{cause:t});return Object.assign(n,{code:e}),n}function Of(r){return(async function(e){return ae(e,"codeVerifier"),fn(await crypto.subtle.digest("SHA-256",jn(e)))})(r)}function Nf(){return Bl()}class Go extends Error{constructor(e,t){var n;super(e,t),I(this,"code",void 0),this.name=this.constructor.name,this.code=t==null?void 0:t.code,(n=Error.captureStackTrace)===null||n===void 0||n.call(Error,this,this.constructor)}}function _e(r,e,t){return new Go(r,{cause:e,code:t})}function ke(r){if(r instanceof TypeError||r instanceof Go||r instanceof mi||r instanceof Gl||r instanceof da)throw r;if(r instanceof ha)switch(r.code){case Yl:throw _e("only requests to HTTPS are allowed",r,r.code);case Ql:throw _e("only requests to HTTP or HTTPS are allowed",r,r.code);case ga:throw _e("unexpected HTTP response status code",r.cause,r.code);case Xl:throw _e("unexpected response content-type",r.cause,r.code);case Bo:throw _e("parsing error occured",r,r.code);case K:throw _e("invalid response encountered",r,r.code);case It:throw _e("unexpected JWT claim value encountered",r,r.code);case As:throw _e("unexpected JSON attribute value encountered",r,r.code);case zr:throw _e("JWT timestamp claim value failed validation",r,r.code);default:throw _e(r.message,r,r.code)}if(r instanceof He)throw _e("unsupported operation",r,r.code);if(r instanceof DOMException)switch(r.name){case"OperationError":throw _e("runtime operation error",r,Es);case"NotSupportedError":throw _e("runtime unsupported operation",r,Es);case"TimeoutError":throw _e("operation timed out",r,"OAUTH_TIMEOUT");case"AbortError":throw _e("operation aborted",r,"OAUTH_ABORT")}throw new Go("something went wrong",{cause:r})}async function xf(r,e,t,n,o){const i=await(async function(c,l){var h,d;if(!(c instanceof URL))throw vt('"server" must be an instance of URL',to);const p=!c.href.includes("/.well-known/"),u=(h=l==null?void 0:l.timeout)!==null&&h!==void 0?h:30,f=AbortSignal.timeout(1e3*u),g=await(p?$p(c,{algorithm:l==null?void 0:l.algorithm,[at]:l==null?void 0:l[et],[We]:l==null||(d=l.execute)===null||d===void 0?void 0:d.includes(hh),signal:f,headers:new Headers(wt)}):((l==null?void 0:l[et])||fetch)((la(c,l==null||(y=l.execute)===null||y===void 0||!y.includes(hh)),c.href),{headers:Object.fromEntries(new Headers(E({accept:"application/json"},wt)).entries()),body:void 0,method:"GET",redirect:"manual",signal:f})).then(m=>(async function(b,C){const k=b;if(!(k instanceof URL)&&k!==zi)throw Y('"expectedIssuerIdentifier" must be an instance of URL',Ue);if(!rr(C,Response))throw Y('"response" must be an instance of Response',Ue);if(C.status!==200)throw N('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',ga,C);Qr(C);const _=await yi(C);if(ae(_.issuer,'"response" body "issuer" property',K,{body:_}),k!==zi&&new URL(_.issuer).href!==k.href)throw N('"response" body "issuer" property does not match the expected value',As,{expected:k.href,body:_,attribute:"issuer"});return _})(zi,m)).catch(ke);var y;return p&&new URL(g.issuer).href!==c.href&&((function(m,b,C){return!(m.origin!=="https://login.microsoftonline.com"||C!=null&&C.algorithm&&C.algorithm!=="oidc"||(b[hd]=!0,0))})(c,g,l)||(function(m,b){return!(!m.hostname.endsWith(".b2clogin.com")||b!=null&&b.algorithm&&b.algorithm!=="oidc")})(c,l)||(()=>{throw new Go("discovered metadata issuer does not match the expected issuer",{code:As,cause:{expected:c.href,body:g,attribute:"issuer"}})})()),g})(r,o),s=new Qn(i,e,t,n);let a=fe(s);if(o!=null&&o[et]&&(a.fetch=o[et]),o!=null&&o.timeout&&(a.timeout=o.timeout),o!=null&&o.execute)for(const c of o.execute)c(s);return s}new TextDecoder;const hd=Symbol();class Qn{constructor(e,t,n,o){var i,s,a,c,l;if(typeof t!="string"||!t.length)throw vt('"clientId" must be a non-empty string',to);if(typeof n=="string"&&(n={client_secret:n}),((i=n)===null||i===void 0?void 0:i.client_id)!==void 0&&t!==n.client_id)throw vt('"clientId" and "metadata.client_id" must be the same',eo);const h=E(E({},structuredClone(n)),{},{client_id:t});let d;h[Ts]=(s=(a=n)===null||a===void 0?void 0:a[Ts])!==null&&s!==void 0?s:0,h[ks]=(c=(l=n)===null||l===void 0?void 0:l[ks])!==null&&c!==void 0?c:30,d=o||(typeof h.client_secret=="string"&&h.client_secret.length?cd(h.client_secret):(g,y,m,b)=>{m.set("client_id",y.client_id)});let p=Object.freeze(h);const u=structuredClone(e);hd in e&&(u[ql]=g=>{let y=g.claims.tid;return e.issuer.replace("{tenantid}",y)});let f=Object.freeze(u);No||(No=new WeakMap),No.set(this,{__proto__:null,as:f,c:p,auth:d,tlsOnly:!0,jwksCache:{}})}serverMetadata(){const e=structuredClone(fe(this).as);return(function(t){Object.defineProperties(t,(function(n){return{supportsPKCE:{__proto__:null,value(){var o;let i=arguments.length>0&&arguments[0]!==void 0?arguments[0]:"S256";return((o=n.code_challenge_methods_supported)===null||o===void 0?void 0:o.includes(i))===!0}}}})(t))})(e),e}clientMetadata(){return structuredClone(fe(this).c)}get timeout(){return fe(this).timeout}set timeout(e){fe(this).timeout=e}get[et](){return fe(this).fetch}set[et](e){fe(this).fetch=e}}function no(r){Object.defineProperties(r,(function(e){let t;if(e.expires_in!==void 0){const n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){const n=Date.now();return t>n?Math.floor((t-n)/1e3):0}}},claims:{__proto__:null,value(){try{return Ss(this)}catch{return}}}}})(r))}async function ah(r,e,t){var n;let o=arguments.length>3&&arguments[3]!==void 0&&arguments[3];const i=(n=r.headers.get("retry-after"))===null||n===void 0?void 0:n.trim();if(i===void 0)return;let s;if(/^\d+$/.test(i))s=parseInt(i,10);else{const a=new Date(i);if(Number.isFinite(a.getTime())){const c=new Date,l=a.getTime()-c.getTime();l>0&&(s=Math.ceil(l/1e3))}}if(o&&!Number.isFinite(s))throw new ha("invalid Retry-After header value",{cause:r});s>e&&await ld(s-e,t)}function ld(r,e){return new Promise((t,n)=>{const o=i=>{try{e.throwIfAborted()}catch(a){return void n(a)}if(i<=0)return void t();const s=Math.min(i,5);setTimeout(()=>o(i-s),1e3*s)};o(r)})}async function ch(r,e){xt(r);const t=fe(r),n=t.as,o=t.c,i=t.auth,s=t.fetch,a=t.tlsOnly,c=t.timeout;return(async function(l,h,d,p,u){nt(l),rt(h);const f=Xr(l,"backchannel_authentication_endpoint",h.use_mtls_endpoint_aliases,(u==null?void 0:u[We])!==!0),g=new URLSearchParams(p);g.set("client_id",h.client_id);const y=gi(u==null?void 0:u.headers);return y.set("accept","application/json"),pa(l,h,d,f,g,y,u)})(n,o,i,e,{[at]:s,[We]:!a,headers:new Headers(wt),signal:_n(c)}).then(l=>(async function(h,d,p){if(nt(h),rt(d),!rr(p,Response))throw Y('"response" must be an instance of Response',Ue);await ua(p,200,"Backchannel Authentication Endpoint"),Qr(p);const u=await yi(p);ae(u.auth_req_id,'"response" body "auth_req_id" property',K,{body:u});let f=typeof u.expires_in!="number"?parseFloat(u.expires_in):u.expires_in;return $t(f,!0,'"response" body "expires_in" property',K,{body:u}),u.expires_in=f,u.interval!==void 0&&$t(u.interval,!1,'"response" body "interval" property',K,{body:u}),u})(n,o,l)).catch(ke)}async function dd(r,e,t,n){var o,i;xt(r),t=new URLSearchParams(t);let s=(o=e.interval)!==null&&o!==void 0?o:5;const a=(i=n==null?void 0:n.signal)!==null&&i!==void 0?i:AbortSignal.timeout(1e3*e.expires_in);try{await ld(s,a)}catch(S){ke(S)}const c=fe(r),l=c.as,h=c.c,d=c.auth,p=c.fetch,u=c.tlsOnly,f=c.nonRepudiation,g=c.timeout,y=c.decrypt,m=(S,x)=>dd(r,E(E({},e),{},{interval:S}),t,E(E({},n),{},{signal:a,flag:x})),b=(function(S,x){const te=_n(x);if(!te)return{signal:S,cleanup(){}};const re=new AbortController,Q=Pe=>{const Mt=Pe.target;re.abort(Mt.reason)};return S.aborted?re.abort(S.reason):te.aborted?re.abort(te.reason):(S.addEventListener("abort",Q,{once:!0}),te.addEventListener("abort",Q,{once:!0})),{signal:re.signal,cleanup(){S.removeEventListener("abort",Q),te.removeEventListener("abort",Q)}}})(a,g),C=await(async function(S,x,te,re,Q){nt(S),rt(x),ae(re,'"authReqId"');const Pe=new URLSearchParams(Q==null?void 0:Q.additionalParameters);return Pe.set("auth_req_id",re),Yr(S,x,te,"urn:openid:params:grant-type:ciba",Pe,Q)})(l,h,d,e.auth_req_id,{[at]:p,[We]:!u,additionalParameters:t,DPoP:n==null?void 0:n.DPoP,headers:new Headers(wt),signal:b.signal}).catch(ke).finally(b.cleanup);var k;if(C.status===503&&C.headers.has("retry-after"))return await ah(C,s,a,!0),await((k=C.body)===null||k===void 0?void 0:k.cancel()),m(s);const _=(async function(S,x,te,re){return Xn(S,x,te,void 0,re==null?void 0:re[Rt],re==null?void 0:re.recognizedTokenTypes)})(l,h,C,{[Rt]:y});let O;try{O=await _}catch(S){if(or(S,n))return m(s,St);if(S instanceof mi)switch(S.error){case"slow_down":s+=5;case"authorization_pending":return await ah(S.response,s,a),m(s)}ke(S)}return O.id_token&&await(f==null?void 0:f(C)),no(O),O}function hh(r){fe(r).tlsOnly=!1}async function ud(r,e,t,n,o){if(xt(r),!((o==null?void 0:o.flag)===St||e instanceof URL||(function(S,x){try{return Object.getPrototypeOf(S)[Symbol.toStringTag]===x}catch{return!1}})(e,"Request")))throw vt('"currentUrl" must be an instance of URL, or Request',to);let i,s;const a=fe(r),c=a.as,l=a.c,h=a.auth,d=a.fetch,p=a.tlsOnly,u=a.jarm,f=a.hybrid,g=a.nonRepudiation,y=a.timeout,m=a.decrypt,b=a.implicit;if((o==null?void 0:o.flag)===St)i=o.authResponse,s=o.redirectUri;else{if(!(e instanceof URL)){const S=e;switch(e=new URL(e.url),S.method){case"GET":break;case"POST":const x=new URLSearchParams(await wf(S));if(f)e.hash=x.toString();else for(const te of x.entries()){var C=Ke(te,2);const re=C[0],Q=C[1];e.searchParams.append(re,Q)}break;default:throw vt("unexpected Request HTTP method",eo)}}switch(s=(function(S){return(S=new URL(S)).search="",S.hash="",S.href})(e),!0){case!!u:i=await u(e,t==null?void 0:t.expectedState);break;case!!f:i=await f(e,t==null?void 0:t.expectedNonce,t==null?void 0:t.expectedState,t==null?void 0:t.maxAge);break;case!!b:throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=Tf(c,l,e.searchParams,t==null?void 0:t.expectedState)}catch(S){ke(S)}}}const k=await(async function(S,x,te,re,Q,Pe,Mt){if(nt(S),rt(x),!fa.has(re))throw Y('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',Te);ae(Q,'"redirectUri"');const lr=hn(re,"code");if(!lr)throw N('no authorization code in "callbackParameters"',K);const tn=new URLSearchParams(Mt==null?void 0:Mt.additionalParameters);return tn.set("redirect_uri",Q),tn.set("code",lr),Pe!==Qc&&(ae(Pe,'"codeVerifier"'),tn.set("code_verifier",Pe)),Yr(S,x,te,"authorization_code",tn,Mt)})(c,l,h,i,s,(t==null?void 0:t.pkceCodeVerifier)||Qc,{additionalParameters:n,[at]:d,[We]:!p,DPoP:o==null?void 0:o.DPoP,headers:new Headers(wt),signal:_n(y)}).catch(ke);typeof(t==null?void 0:t.expectedNonce)!="string"&&typeof(t==null?void 0:t.maxAge)!="number"||(t.idTokenExpected=!0);const _=df(c,l,k,{expectedNonce:t==null?void 0:t.expectedNonce,maxAge:t==null?void 0:t.maxAge,requireIdToken:t==null?void 0:t.idTokenExpected,[Rt]:m});let O;try{O=await _}catch(S){if(or(S,o))return ud(r,void 0,t,n,E(E({},o),{},{flag:St,authResponse:i,redirectUri:s}));ke(S)}return O.id_token&&await(g==null?void 0:g(k)),no(O),O}async function pd(r,e,t,n){xt(r),t=new URLSearchParams(t);const o=fe(r),i=o.as,s=o.c,a=o.auth,c=o.fetch,l=o.tlsOnly,h=o.nonRepudiation,d=o.timeout,p=o.decrypt,u=await(async function(y,m,b,C,k){nt(y),rt(m),ae(C,'"refreshToken"');const _=new URLSearchParams(k==null?void 0:k.additionalParameters);return _.set("refresh_token",C),Yr(y,m,b,"refresh_token",_,k)})(i,s,a,e,{[at]:c,[We]:!l,additionalParameters:t,DPoP:n==null?void 0:n.DPoP,headers:new Headers(wt),signal:_n(d)}).catch(ke),f=(async function(y,m,b,C){return Xn(y,m,b,void 0,C==null?void 0:C[Rt],C==null?void 0:C.recognizedTokenTypes)})(i,s,u,{[Rt]:p});let g;try{g=await f}catch(y){if(or(y,n))return pd(r,e,t,E(E({},n),{},{flag:St}));ke(y)}return g.id_token&&await(h==null?void 0:h(u)),no(g),g}async function fd(r,e,t){xt(r),e=new URLSearchParams(e);const n=fe(r),o=n.as,i=n.c,s=n.auth,a=n.fetch,c=n.tlsOnly,l=n.timeout,h=await(async function(u,f,g,y,m){return nt(u),rt(f),Yr(u,f,g,"client_credentials",new URLSearchParams(y),m)})(o,i,s,e,{[at]:a,[We]:!c,DPoP:t==null?void 0:t.DPoP,headers:new Headers(wt),signal:_n(l)}).catch(ke),d=(async function(u,f,g,y){return Xn(u,f,g,void 0,void 0,void 0)})(o,i,h);let p;try{p=await d}catch(u){if(or(u,t))return fd(r,e,E(E({},t),{},{flag:St}));ke(u)}return no(p),p}function Os(r,e){xt(r);const t=fe(r),n=t.as,o=t.c,i=t.tlsOnly,s=t.hybrid,a=t.jarm,c=t.implicit,l=Xr(n,"authorization_endpoint",!1,i);if((e=new URLSearchParams(e)).has("client_id")||e.set("client_id",o.client_id),!e.has("request_uri")&&!e.has("request")){if(e.has("response_type")||e.set("response_type",s?"code id_token":c?"id_token":"code"),c&&!e.has("nonce"))throw vt("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",eo);a&&e.set("response_mode","jwt")}for(const d of e.entries()){var h=Ke(d,2);const p=h[0],u=h[1];l.searchParams.append(p,u)}return l}async function gd(r,e,t){xt(r);const n=Os(r,e),o=fe(r),i=o.as,s=o.c,a=o.auth,c=o.fetch,l=o.tlsOnly,h=o.timeout,d=await(async function(f,g,y,m,b){var C;nt(f),rt(g);const k=Xr(f,"pushed_authorization_request_endpoint",g.use_mtls_endpoint_aliases,(b==null?void 0:b[We])!==!0),_=new URLSearchParams(m);_.set("client_id",g.client_id);const O=gi(b==null?void 0:b.headers);O.set("accept","application/json"),(b==null?void 0:b.DPoP)!==void 0&&(Vl(b.DPoP),await b.DPoP.addProof(k,O,"POST"));const S=await pa(f,g,y,k,_,O,b);return b==null||(C=b.DPoP)===null||C===void 0||C.cacheNonce(S,k),S})(i,s,a,n.searchParams,{[at]:c,[We]:!l,DPoP:t==null?void 0:t.DPoP,headers:new Headers(wt),signal:_n(h)}).catch(ke),p=(async function(f,g,y){if(nt(f),rt(g),!rr(y,Response))throw Y('"response" must be an instance of Response',Ue);await ua(y,201,"Pushed Authorization Request Endpoint"),Qr(y);const m=await yi(y);ae(m.request_uri,'"response" body "request_uri" property',K,{body:m});let b=typeof m.expires_in!="number"?parseFloat(m.expires_in):m.expires_in;return $t(b,!0,'"response" body "expires_in" property',K,{body:m}),m.expires_in=b,m})(i,s,d);let u;try{u=await p}catch(f){if(or(f,t))return gd(r,e,E(E({},t),{},{flag:St}));ke(f)}return Os(r,{request_uri:u.request_uri})}function xt(r){if(!(r instanceof Qn))throw vt('"config" must be an instance of Configuration',to);if(Object.getPrototypeOf(r)!==Qn.prototype)throw vt("subclassing Configuration is not allowed",eo)}function _n(r){return r?AbortSignal.timeout(1e3*r):void 0}function or(r,e){return!(e==null||!e.DPoP||e.flag===St)&&(function(t){if(t instanceof da){const n=t.cause,o=n[0];return n.length===1&&o.scheme==="dpop"&&o.parameters.error==="use_dpop_nonce"}return t instanceof mi&&t.error==="use_dpop_nonce"})(r)}Object.freeze(Qn.prototype);const St=Symbol();async function gn(r,e,t,n){xt(r);const o=fe(r),i=o.as,s=o.c,a=o.auth,c=o.fetch,l=o.tlsOnly,h=o.timeout,d=o.decrypt,p=o.nonRepudiation,u=await(async function(m,b,C,k,_,O){return nt(m),rt(b),ae(k,'"grantType"'),Yr(m,b,C,k,new URLSearchParams(_),O)})(i,s,a,e,new URLSearchParams(t),{[at]:c,[We]:!l,DPoP:n==null?void 0:n.DPoP,headers:new Headers(wt),signal:_n(h)}).catch(ke);let f;e==="urn:ietf:params:oauth:grant-type:token-exchange"&&(f={n_a:()=>{}});const g=(async function(m,b,C,k){return Xn(m,b,C,void 0,k==null?void 0:k[Rt],k==null?void 0:k.recognizedTokenTypes)})(i,s,u,{[Rt]:d,recognizedTokenTypes:f});let y;try{y=await g}catch(m){if(or(m,n))return gn(r,e,t,E(E({},n),{},{flag:St}));ke(m)}return y.id_token&&await(p==null?void 0:p(u)),no(y),y}async function Mf(r,e,t){if(!Pt(r))throw new ce("Flattened JWS must be an object");if(r.protected===void 0&&r.header===void 0)throw new ce('Flattened JWS must have either of the "protected" or "header" members');if(r.protected!==void 0&&typeof r.protected!="string")throw new ce("JWS Protected Header incorrect type");if(r.payload===void 0)throw new ce("JWS Payload missing");if(typeof r.signature!="string")throw new ce("JWS Signature missing or incorrect type");if(r.header!==void 0&&!Pt(r.header))throw new ce("JWS Unprotected Header incorrect type");let n={};if(r.protected)try{const g=qr(r.protected);n=JSON.parse(Yn.decode(g))}catch{throw new ce("JWS Protected Header is invalid")}if(!(function(){for(var g=arguments.length,y=new Array(g),m=0;m<g;m++)y[m]=arguments[m];const b=y.filter(Boolean);if(b.length===0||b.length===1)return!0;let C;for(const k of b){const _=Object.keys(k);if(C&&C.size!==0)for(const O of _){if(C.has(O))return!1;C.add(O)}else C=new Set(_)}return!0})(n,r.header))throw new ce("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const o=E(E({},n),r.header),i=(function(g,y,m,b,C){if(C.crit!==void 0&&(b==null?void 0:b.crit)===void 0)throw new g('"crit" (Critical) Header Parameter MUST be integrity protected');if(!b||b.crit===void 0)return new Set;if(!Array.isArray(b.crit)||b.crit.length===0||b.crit.some(_=>typeof _!="string"||_.length===0))throw new g('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let k;k=m!==void 0?new Map([...Object.entries(m),...y.entries()]):y;for(const _ of b.crit){if(!k.has(_))throw new Le('Extension Header Parameter "'.concat(_,'" is not recognized'));if(C[_]===void 0)throw new g('Extension Header Parameter "'.concat(_,'" is missing'));if(k.get(_)&&b[_]===void 0)throw new g('Extension Header Parameter "'.concat(_,'" MUST be integrity protected'))}return new Set(b.crit)})(ce,new Map([["b64",!0]]),t==null?void 0:t.crit,n,o);let s=!0;if(i.has("b64")&&(s=n.b64,typeof s!="boolean"))throw new ce('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const a=o.alg;if(typeof a!="string"||!a)throw new ce('JWS "alg" (Algorithm) Header Parameter missing or invalid');const c=t&&(function(g,y){if(y!==void 0&&(!Array.isArray(y)||y.some(m=>typeof m!="string")))throw new TypeError('"'.concat(g,'" option must be an array of strings'));if(y)return new Set(y)})("algorithms",t.algorithms);if(c&&!c.has(a))throw new nd('"alg" (Algorithm) Header Parameter value not allowed');if(s){if(typeof r.payload!="string")throw new ce("JWS Payload must be a string")}else if(typeof r.payload!="string"&&!(r.payload instanceof Uint8Array))throw new ce("JWS Payload must be a string or an Uint8Array instance");let l=!1;typeof e=="function"&&(e=await e(n,r),l=!0),Pf(a,e,"verify");const h=(function(){for(var g=arguments.length,y=new Array(g),m=0;m<g;m++)y[m]=arguments[m];const b=y.reduce((_,O)=>_+O.length,0),C=new Uint8Array(b);let k=0;for(const _ of y)C.set(_,k),k+=_.length;return C})(r.protected!==void 0?Wi(r.protected):new Uint8Array,Wi("."),typeof r.payload=="string"?s?Wi(r.payload):eh.encode(r.payload):r.payload),d=rh(r.signature,"signature",ce),p=await Sf(e,a);if(!await If(a,p,d,h))throw new id;let u;u=s?rh(r.payload,"payload",ce):typeof r.payload=="string"?eh.encode(r.payload):r.payload;const f={payload:u};return r.protected!==void 0&&(f.protectedHeader=n),r.header!==void 0&&(f.unprotectedHeader=r.header),l?E(E({},f),{},{key:p}):f}const Uf=86400,Df=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;function lh(r){const e=Df.exec(r);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");const t=parseFloat(e[2]);let n;switch(e[3].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":n=Math.round(t);break;case"minute":case"minutes":case"min":case"mins":case"m":n=Math.round(60*t);break;case"hour":case"hours":case"hr":case"hrs":case"h":n=Math.round(3600*t);break;case"day":case"days":case"d":n=Math.round(t*Uf);break;case"week":case"weeks":case"w":n=Math.round(604800*t);break;default:n=Math.round(31557600*t)}return e[1]==="-"||e[4]==="ago"?-n:n}const dh=r=>r.includes("/")?r.toLowerCase():"application/".concat(r.toLowerCase());function Lf(r,e){let t,n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:{};try{t=JSON.parse(Yn.decode(e))}catch{}if(!Pt(t))throw new dt("JWT Claims Set must be a top-level JSON object");const o=n.typ;if(o&&(typeof r.typ!="string"||dh(r.typ)!==dh(o)))throw new Je('unexpected "typ" JWT header value',t,"typ","check_failed");const i=n.requiredClaims,s=i===void 0?[]:i,a=n.issuer,c=n.subject,l=n.audience,h=n.maxTokenAge,d=[...s];h!==void 0&&d.push("iat"),l!==void 0&&d.push("aud"),c!==void 0&&d.push("sub"),a!==void 0&&d.push("iss");for(const b of new Set(d.reverse()))if(!(b in t))throw new Je('missing required "'.concat(b,'" claim'),t,b,"missing");if(a&&!(Array.isArray(a)?a:[a]).includes(t.iss))throw new Je('unexpected "iss" claim value',t,"iss","check_failed");if(c&&t.sub!==c)throw new Je('unexpected "sub" claim value',t,"sub","check_failed");if(l&&(p=t.aud,u=typeof l=="string"?[l]:l,!(typeof p=="string"?u.includes(p):Array.isArray(p)&&u.some(Set.prototype.has.bind(new Set(p))))))throw new Je('unexpected "aud" claim value',t,"aud","check_failed");var p,u;let f;switch(typeof n.clockTolerance){case"string":f=lh(n.clockTolerance);break;case"number":f=n.clockTolerance;break;case"undefined":f=0;break;default:throw new TypeError("Invalid clockTolerance option type")}const g=n.currentDate,y=(m=g||new Date,Math.floor(m.getTime()/1e3));var m;if((t.iat!==void 0||h)&&typeof t.iat!="number")throw new Je('"iat" claim must be a number',t,"iat","invalid");if(t.nbf!==void 0){if(typeof t.nbf!="number")throw new Je('"nbf" claim must be a number',t,"nbf","invalid");if(t.nbf>y+f)throw new Je('"nbf" claim timestamp check failed',t,"nbf","check_failed")}if(t.exp!==void 0){if(typeof t.exp!="number")throw new Je('"exp" claim must be a number',t,"exp","invalid");if(t.exp<=y-f)throw new Rs('"exp" claim timestamp check failed',t,"exp","check_failed")}if(h){const b=y-t.iat;if(b-f>(typeof h=="number"?h:lh(h)))throw new Rs('"iat" claim timestamp check failed (too far in the past)',t,"iat","check_failed");if(b<0-f)throw new Je('"iat" claim timestamp check failed (it should be in the past)',t,"iat","check_failed")}return t}async function Hf(r,e,t){var n;const o=await(async function(s,a,c){if(s instanceof Uint8Array&&(s=Yn.decode(s)),typeof s!="string")throw new ce("Compact JWS must be a string or Uint8Array");const l=s.split("."),h=l[0],d=l[1],p=l[2];if(l.length!==3)throw new ce("Invalid Compact JWS");const u=await Mf({payload:d,protected:h,signature:p},a,c),f={payload:u.payload,protectedHeader:u.protectedHeader};return typeof a=="function"?E(E({},f),{},{key:u.key}):f})(r,e,t);if((n=o.protectedHeader.crit)!==null&&n!==void 0&&n.includes("b64")&&o.protectedHeader.b64===!1)throw new dt("JWTs MUST NOT use unencoded payload");const i={payload:Lf(o.protectedHeader,o.payload,t),protectedHeader:o.protectedHeader};return typeof e=="function"?E(E({},i),{},{key:o.key}):i}function Kf(r){return Pt(r)}var mo,Zi,yo=new WeakMap,$i=new WeakMap;class Ff{constructor(e){if(j(this,yo,void 0),j(this,$i,new WeakMap),!(function(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(Kf)})(e))throw new ma("JSON Web Key Set malformed");U(yo,this,structuredClone(e))}jwks(){return v(yo,this)}async getKey(e,t){const n=E(E({},e),t==null?void 0:t.header),o=n.alg,i=n.kid,s=(function(h){switch(typeof h=="string"&&h.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new Le('Unsupported "alg" value for a JSON Web Key Set')}})(o),a=v(yo,this).keys.filter(h=>{let d=s===h.kty;if(d&&typeof i=="string"&&(d=i===h.kid),!d||typeof h.alg!="string"&&s!=="AKP"||(d=o===h.alg),d&&typeof h.use=="string"&&(d=h.use==="sig"),d&&Array.isArray(h.key_ops)&&(d=h.key_ops.includes("verify")),d)switch(o){case"ES256":d=h.crv==="P-256";break;case"ES384":d=h.crv==="P-384";break;case"ES512":d=h.crv==="P-521";break;case"Ed25519":case"EdDSA":d=h.crv==="Ed25519"}return d}),c=a[0],l=a.length;if(l===0)throw new ya;if(l!==1){const h=new rd,d=v($i,this);throw h[Symbol.asyncIterator]=op(function*(){for(const p of a)try{yield yield rp(uh(d,p,o))}catch{}}),h}return uh(v($i,this),c,o)}}async function uh(r,e,t){const n=r.get(e)||r.set(e,{}).get(e);if(n[t]===void 0){const o=await(async function(i,s,a){var c;if(!Pt(i))throw new TypeError("JWK must be an object");let l;switch(s!=null||(s=i.alg),l!=null||(l=(c=void 0)!==null&&c!==void 0?c:i.ext),i.kty){case"oct":if(typeof i.k!="string"||!i.k)throw new TypeError('missing "k" (Key Value) Parameter value');return qr(i.k);case"RSA":if("oth"in i&&i.oth!==void 0)throw new Le('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Oo(E(E({},i),{},{alg:s,ext:l}));case"AKP":if(typeof i.alg!="string"||!i.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(s!==void 0&&s!==i.alg)throw new TypeError("JWK alg and alg option value mismatch");return Oo(E(E({},i),{},{ext:l}));case"EC":case"OKP":return Oo(E(E({},i),{},{alg:s,ext:l}));default:throw new Le('Unsupported "kty" (Key Type) Parameter value')}})(E(E({},e),{},{ext:!0}),t);if(o instanceof Uint8Array||o.type!=="public")throw new ma("JSON Web Key Set members must be public keys");n[t]=o}return n[t]}function ph(r){const e=new Ff(r),t=async(n,o)=>e.getKey(n,o);return Object.defineProperties(t,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),t}let Ns;(typeof navigator>"u"||(mo=navigator.userAgent)===null||mo===void 0||(Zi=mo.startsWith)===null||Zi===void 0||!Zi.call(mo,"Mozilla/5.0 "))&&(Ns="".concat("jose","/").concat("v6.2.3"));const md=Symbol(),xo=Symbol();var Xi=new WeakMap,Yi=new WeakMap,Qi=new WeakMap,wo=new WeakMap,rn=new WeakMap,Ct=new WeakMap,Lt=new WeakMap,qi=new WeakMap,on=new WeakMap,sn=new WeakMap;class jf{constructor(e,t){if(j(this,Xi,void 0),j(this,Yi,void 0),j(this,Qi,void 0),j(this,wo,void 0),j(this,rn,void 0),j(this,Ct,void 0),j(this,Lt,void 0),j(this,qi,void 0),j(this,on,void 0),j(this,sn,void 0),!(e instanceof URL))throw new TypeError("url must be an instance of URL");var n,o;U(Xi,this,new URL(e.href)),U(Yi,this,typeof(t==null?void 0:t.timeoutDuration)=="number"?t==null?void 0:t.timeoutDuration:5e3),U(Qi,this,typeof(t==null?void 0:t.cooldownDuration)=="number"?t==null?void 0:t.cooldownDuration:3e4),U(wo,this,typeof(t==null?void 0:t.cacheMaxAge)=="number"?t==null?void 0:t.cacheMaxAge:6e5),U(Lt,this,new Headers(t==null?void 0:t.headers)),Ns&&!v(Lt,this).has("User-Agent")&&v(Lt,this).set("User-Agent",Ns),v(Lt,this).has("accept")||(v(Lt,this).set("accept","application/json"),v(Lt,this).append("accept","application/jwk-set+json")),U(qi,this,t==null?void 0:t[md]),(t==null?void 0:t[xo])!==void 0&&(U(sn,this,t==null?void 0:t[xo]),n=t==null?void 0:t[xo],o=v(wo,this),typeof n=="object"&&n!==null&&"uat"in n&&typeof n.uat=="number"&&!(Date.now()-n.uat>=o)&&"jwks"in n&&Pt(n.jwks)&&Array.isArray(n.jwks.keys)&&Array.prototype.every.call(n.jwks.keys,Pt)&&(U(rn,this,v(sn,this).uat),U(on,this,ph(v(sn,this).jwks))))}pendingFetch(){return!!v(Ct,this)}coolingDown(){return typeof v(rn,this)=="number"&&Date.now()<v(rn,this)+v(Qi,this)}fresh(){return typeof v(rn,this)=="number"&&Date.now()<v(rn,this)+v(wo,this)}jwks(){var e;return(e=v(on,this))===null||e===void 0?void 0:e.jwks()}async getKey(e,t){v(on,this)&&this.fresh()||await this.reload();try{return await v(on,this).call(this,e,t)}catch(n){if(n instanceof ya&&this.coolingDown()===!1)return await this.reload(),v(on,this).call(this,e,t);throw n}}async reload(){v(Ct,this)&&(typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel")&&U(Ct,this,void 0),v(Ct,this)||U(Ct,this,(async function(e,t,n){const i=await(arguments.length>3&&arguments[3]!==void 0?arguments[3]:fetch)(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(s=>{throw s.name==="TimeoutError"?new od:s});if(i.status!==200)throw new ge("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new ge("Failed to parse the JSON Web Key Set HTTP response as JSON")}})(v(Xi,this).href,v(Lt,this),AbortSignal.timeout(v(Yi,this)),v(qi,this)).then(e=>{U(on,this,ph(e)),v(sn,this)&&(v(sn,this).uat=Date.now(),v(sn,this).jwks=e),U(rn,this,Date.now()),U(Ct,this,void 0)}).catch(e=>{throw U(Ct,this,void 0),e})),await v(Ct,this)}}const zf=["mfaToken"],Wf=["mfaToken"];var an,vo,mr,cn,yr,wr,vr,br,bo,Co,Fe,To,ko,Be,lt,Ln,F,Ve,Cr,Dr,zn,_o,X;function pn(r){var e,t;if(typeof r!="object"||r===null)return{error:"unknown_error",error_description:String(r)};const n=r,o={error:(e=n.error)!==null&&e!==void 0?e:"",error_description:(t=n.error_description)!==null&&t!==void 0?t:"",message:n.message};if(n.error==="mfa_required"&&n.cause){o.mfa_token=typeof n.cause.mfa_token=="string"?n.cause.mfa_token:void 0;const i=n.cause.mfa_requirements;typeof i=="object"&&i!==null&&(o.mfa_requirements=i)}return o}var fh=class extends Error{constructor(r,e){super(e),I(this,"code",void 0),this.name="NotSupportedError",this.code=r}},bt=class extends Error{constructor(r,e,t){super(e),I(this,"cause",void 0),I(this,"code",void 0),this.code=r,this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}},Jf=class extends bt{constructor(r,e){super("token_by_code_error",r,e),this.name="TokenByCodeError"}},Bf=class extends bt{constructor(r,e){super("token_by_client_credentials_error",r,e),this.name="TokenByClientCredentialsError"}},Gf=class extends bt{constructor(r,e){super("token_by_refresh_token_error",r,e),this.name="TokenByRefreshTokenError"}},Vf=class extends bt{constructor(r,e){super("token_by_password_error",r,e),this.name="TokenByPasswordError"}},es=class extends bt{constructor(r,e){super("token_for_connection_error",r,e),this.name="TokenForConnectionErrorCode"}},Qe=class extends bt{constructor(r,e){super("token_exchange_error",r,e),this.name="TokenExchangeError"}},Ht=class extends Error{constructor(r){super(r),I(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},ts=class extends bt{constructor(r){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",r),I(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},Zf=class extends bt{constructor(r){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",r),this.name="BuildAuthorizationUrlError"}},$f=class extends bt{constructor(r){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",r),this.name="BuildLinkUserUrlError"}},Xf=class extends bt{constructor(r){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",r),this.name="BuildUnlinkUserUrlError"}},Yf=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),I(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}};function xs(r){return Object.entries(r).filter(e=>Ke(e,2)[1]!==void 0).reduce((e,t)=>E(E({},e),{},{[t[0]]:t[1]}),{})}var ro=class extends Error{constructor(r,e,t){super(e),I(this,"cause",void 0),I(this,"code",void 0),this.code=r,this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message}}},Ms=class extends ro{constructor(r,e){super("mfa_list_authenticators_error",r,e),this.name="MfaListAuthenticatorsError"}},Us=class extends ro{constructor(r,e){super("mfa_enrollment_error",r,e),this.name="MfaEnrollmentError"}},gh=class extends ro{constructor(r,e){super("mfa_delete_authenticator_error",r,e),this.name="MfaDeleteAuthenticatorError"}},Ds=class extends ro{constructor(r,e){super("mfa_challenge_error",r,e),this.name="MfaChallengeError"}},mh=class extends ro{constructor(r,e){super("mfa_verify_error",r,e),this.name="MfaVerifyError"}};function Qf(r){return{id:r.id,authenticatorType:r.authenticator_type,active:r.active,name:r.name,oobChannels:r.oob_channels,type:r.type}}var ut=class yd{constructor(e,t,n,o,i,s,a){I(this,"accessToken",void 0),I(this,"idToken",void 0),I(this,"refreshToken",void 0),I(this,"expiresAt",void 0),I(this,"scope",void 0),I(this,"claims",void 0),I(this,"authorizationDetails",void 0),I(this,"tokenType",void 0),I(this,"issuedTokenType",void 0),I(this,"recoveryCode",void 0),I(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=o,this.expiresAt=t,this.scope=i,this.claims=s,this.authorizationDetails=a}static fromTokenEndpointResponse(e){const t=e.id_token?e.claims():void 0,n=new yd(e.access_token,Math.floor(Date.now()/1e3)+Number(e.expires_in),e.id_token,e.refresh_token,e.scope,t,e.authorization_details);return n.tokenType=e.token_type,n.issuedTokenType=e.issued_token_type,n}},qf={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},eg=(an=new WeakMap,vo=new WeakMap,mr=new WeakMap,cn=new WeakMap,yr=new WeakMap,class{constructor(r){var e;j(this,an,void 0),j(this,vo,void 0),j(this,mr,void 0),j(this,cn,void 0),j(this,yr,void 0),U(an,this,"https://".concat(r.domain)),U(vo,this,r.clientId),U(mr,this,r.clientSecret),U(cn,this,(e=r.customFetch)!==null&&e!==void 0?e:function(){return fetch(...arguments)}),U(yr,this,r.getConfiguration)}async listAuthenticators(r){const e="".concat(v(an,this),"/mfa/authenticators"),t=r.mfaToken,n=await v(cn,this).call(this,e,{method:"GET",headers:{Authorization:"Bearer ".concat(t),"Content-Type":"application/json"}});if(!n.ok){let o;try{o=await n.json()}catch{throw new Ms("Failed to list authenticators")}throw new Ms(o.error_description||"Failed to list authenticators",o)}return(await n.json()).map(Qf)}async enrollAuthenticator(r){const e="".concat(v(an,this),"/mfa/associate"),t=r.mfaToken,n=Uc(r,zf),o={authenticator_types:n.authenticatorTypes};"oobChannels"in n&&(o.oob_channels=n.oobChannels),"phoneNumber"in n&&n.phoneNumber&&(o.phone_number=n.phoneNumber),"email"in n&&n.email&&(o.email=n.email);const i=await v(cn,this).call(this,e,{method:"POST",headers:{Authorization:"Bearer ".concat(t),"Content-Type":"application/json"},body:JSON.stringify(o)});if(!i.ok){let s;try{s=await i.json()}catch{throw new Us("Failed to enroll authenticator")}throw new Us(s.error_description||"Failed to enroll authenticator",s)}return(function(s){if(s.authenticator_type==="otp")return{authenticatorType:"otp",secret:s.secret,barcodeUri:s.barcode_uri,recoveryCodes:s.recovery_codes,id:s.id};if(s.authenticator_type==="oob")return{authenticatorType:"oob",oobChannel:s.oob_channel,oobCode:s.oob_code,bindingMethod:s.binding_method,id:s.id,barcodeUri:s.barcode_uri,recoveryCodes:s.recovery_codes};throw new Error("Unexpected authenticator type: ".concat(s.authenticator_type))})(await i.json())}async deleteAuthenticator(r){const e=r.authenticatorId,t=r.mfaToken,n="".concat(v(an,this),"/mfa/authenticators/").concat(encodeURIComponent(e)),o=await v(cn,this).call(this,n,{method:"DELETE",headers:{Authorization:"Bearer ".concat(t),"Content-Type":"application/json"}});if(!o.ok){let i;try{i=await o.json()}catch{throw new gh("Failed to delete authenticator")}throw new gh(i.error_description||"Failed to delete authenticator",i)}}async challengeAuthenticator(r){const e="".concat(v(an,this),"/mfa/challenge"),t=r.mfaToken,n=Uc(r,Wf),o={mfa_token:t,client_id:v(vo,this),challenge_type:n.challengeType};v(mr,this)&&(o.client_secret=v(mr,this)),n.authenticatorId&&(o.authenticator_id=n.authenticatorId);const i=await v(cn,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!i.ok){let s;try{s=await i.json()}catch{throw new Ds("Failed to challenge authenticator")}throw new Ds(s.error_description||"Failed to challenge authenticator",s)}return(function(s){const a={challengeType:s.challenge_type};return s.oob_code!==void 0&&(a.oobCode=s.oob_code),s.binding_method!==void 0&&(a.bindingMethod=s.binding_method),a})(await i.json())}async verify(r){if(!v(yr,this))throw new Error("MFA verify requires a configuration provider (getConfiguration was not set)");const e=await v(yr,this).call(this),t={mfa_token:r.mfaToken};r.audience&&(t.audience=r.audience),r.factorType==="otp"?t.otp=r.otp:r.factorType==="oob"?(t.oob_code=r.oobCode,r.bindingCode&&(t.binding_code=r.bindingCode)):r.factorType==="recovery-code"&&(t.recovery_code=r.recoveryCode);try{const s=await gn(e,qf[r.factorType],t),a=ut.fromTokenEndpointResponse(s);return s.recovery_code&&(a.recoveryCode=s.recovery_code),a}catch(s){var n,o,i;if(s instanceof mh)throw s;const a=s;throw new mh(a.error_description||a.message||"Failed to verify MFA challenge",{error:(n=a.error)!==null&&n!==void 0?n:"mfa_verify_error",error_description:(o=(i=a.error_description)!==null&&i!==void 0?i:a.message)!==null&&o!==void 0?o:"Failed to verify MFA challenge"})}}}),wa=class extends Error{constructor(r,e,t){super(e),I(this,"cause",void 0),I(this,"code",void 0),this.code=r,this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message}}},tg=class extends wa{constructor(r,e){super("passkey_register_error",r,e),this.name="PasskeyRegisterError"}},ng=class extends wa{constructor(r,e){super("passkey_challenge_error",r,e),this.name="PasskeyChallengeError"}},rg=class extends wa{constructor(r,e){super("passkey_get_token_error",r,e),this.name="PasskeyGetTokenError",this.cause=e&&{error:e.error,error_description:e.error_description,message:e.message,mfa_token:e.mfa_token,mfa_requirements:e.mfa_requirements}}},wd="urn:okta:params:oauth:grant-type:webauthn",og=(wr=new WeakMap,vr=new WeakMap,br=new WeakMap,bo=new WeakMap,Co=new WeakSet,class{constructor(r){var e;Rl(this,Co),j(this,wr,void 0),j(this,vr,void 0),j(this,br,void 0),j(this,bo,void 0),U(wr,this,"https://".concat(r.domain)),U(vr,this,r.clientId),U(br,this,(e=r.customFetch)!==null&&e!==void 0?e:function(){return fetch(...arguments)}),U(bo,this,r.grantRequest)}async register(r){const e="".concat(v(wr,this),"/passkey/register"),t=E(E(E(E(E(E(E(E({},r.email&&{email:r.email}),r.name&&{name:r.name}),r.phoneNumber&&{phone_number:r.phoneNumber}),r.username&&{username:r.username}),r.givenName&&{given_name:r.givenName}),r.familyName&&{family_name:r.familyName}),r.nickname&&{nickname:r.nickname}),r.picture&&{picture:r.picture}),n={client_id:v(vr,this),user_profile:t};r.realm&&(n.realm=r.realm),r.organization&&(n.organization=r.organization),r.userMetadata&&(n.user_metadata=r.userMetadata);const o=await v(br,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(n)});if(!o.ok){const a=await J(Co,this,yh).call(this,o);throw new tg(a.error_description||"Failed to request signup challenge",a)}return{authSession:(s=await o.json()).auth_session,authnParamsPublicKey:E({},s.authn_params_public_key)};var s}async challenge(r){const e="".concat(v(wr,this),"/passkey/challenge"),t={client_id:v(vr,this)};r!=null&&r.realm&&(t.realm=r.realm),r!=null&&r.organization&&(t.organization=r.organization);const n=await v(br,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});if(!n.ok){const s=await J(Co,this,yh).call(this,n);throw new ng(s.error_description||"Failed to request login challenge",s)}return{authSession:(i=await n.json()).auth_session,authnParamsPublicKey:E({},i.authn_params_public_key)};var i}async getTokenByPasskey(r){const e=new URLSearchParams({auth_session:r.authSession,authn_response:JSON.stringify(r.credential)});r.realm&&e.append("realm",r.realm),r.scope&&e.append("scope",r.scope),r.audience&&e.append("audience",r.audience),r.organization&&e.append("organization",r.organization);try{return await v(bo,this).call(this,wd,e)}catch(t){const n=pn(t);throw new rg(n.error_description||"Failed to exchange passkey credential for tokens.",n)}}});async function yh(r){try{return await r.json()}catch{return{error:"unknown_error",error_description:"HTTP ".concat(r.status," ").concat(r.statusText)}}}var ig=(Fe=new WeakMap,To=new WeakMap,ko=new WeakMap,class{constructor(r,e){j(this,Fe,new Map),j(this,To,void 0),j(this,ko,void 0),U(ko,this,Math.max(1,Math.floor(r))),U(To,this,Math.max(0,Math.floor(e)))}get(r){const e=v(Fe,this).get(r);if(e){if(!(Date.now()>=e.expiresAt))return v(Fe,this).delete(r),v(Fe,this).set(r,e),e.value;v(Fe,this).delete(r)}}set(r,e){for(v(Fe,this).has(r)&&v(Fe,this).delete(r),v(Fe,this).set(r,{value:e,expiresAt:Date.now()+v(To,this)});v(Fe,this).size>v(ko,this);){const t=v(Fe,this).keys().next().value;if(t===void 0)break;v(Fe,this).delete(t)}}}),wh=new Map;function vh(r){return{ttlMs:1e3*(typeof(r==null?void 0:r.ttl)=="number"?r.ttl:600),maxEntries:typeof(r==null?void 0:r.maxEntries)=="number"&&r.maxEntries>0?r.maxEntries:100}}var bh=class{static createDiscoveryCache(r){const e=(t=r.maxEntries,n=r.ttlMs,"".concat(t,":").concat(n));var t,n;let o=(i=e,wh.get(i));var i;return o||(o=new ig(r.maxEntries,r.ttlMs),wh.set(e,o)),o}static createJwksCache(){return{}}},Ls="openid profile email offline_access",sg=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function vd(r){if(r==null)throw new Qe("subject_token is required");if(typeof r!="string")throw new Qe("subject_token must be a string");if(r.trim().length===0)throw new Qe("subject_token cannot be blank or whitespace");if(r!==r.trim())throw new Qe("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(r))throw new Qe("subject_token must not include the 'Bearer ' prefix")}function bd(r,e){if(e)for(const n of Object.entries(e)){var t=Ke(n,2);const o=t[0],i=t[1];if(!sg.has(o))if(Array.isArray(i)){if(i.length>20)throw new Qe("Parameter '".concat(o,"' exceeds maximum array size of ").concat(20));i.forEach(s=>{r.append(o,s)})}else r.append(o,i)}}var Cd="urn:ietf:params:oauth:token-type:access_token",ag=(Be=new WeakMap,lt=new WeakMap,Ln=new WeakMap,F=new WeakMap,Ve=new WeakMap,Cr=new WeakMap,Dr=new WeakMap,zn=new WeakMap,_o=new WeakMap,X=new WeakSet,class{constructor(r){var e,t,n,o;if(Rl(this,X),j(this,Be,void 0),j(this,lt,void 0),j(this,Ln,void 0),j(this,F,void 0),j(this,Ve,void 0),j(this,Cr,void 0),j(this,Dr,void 0),j(this,zn,void 0),j(this,_o,void 0),I(this,"mfa",void 0),I(this,"passkey",void 0),U(F,this,r),r.useMtls&&!r.customFetch)throw new fh("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");U(Ve,this,(function(s,a){if(a.enabled===!1)return s;const c={name:a.name,version:a.version},l=btoa(JSON.stringify(c));return async(h,d)=>{const p=h instanceof Request?new Headers(h.headers):new Headers;return d!=null&&d.headers&&new Headers(d.headers).forEach((u,f)=>{p.set(f,u)}),p.set("Auth0-Client",l),s(h,E(E({},d),{},{headers:p}))}})((e=r.customFetch)!==null&&e!==void 0?e:function(){return fetch(...arguments)},((t=r.telemetry)==null?void 0:t.enabled)===!1?t:{enabled:!0,name:(n=t==null?void 0:t.name)!==null&&n!==void 0?n:"@auth0/auth0-auth-js",version:(o=t==null?void 0:t.version)!==null&&o!==void 0?o:"1.9.1"}));const i=vh(r.discoveryCache);U(Dr,this,bh.createDiscoveryCache(i)),U(zn,this,new Map),U(_o,this,bh.createJwksCache()),this.mfa=new eg({domain:v(F,this).domain,clientId:v(F,this).clientId,clientSecret:v(F,this).clientSecret,customFetch:v(Ve,this),getConfiguration:async()=>(await J(X,this,we).call(this)).configuration}),this.passkey=new og({domain:v(F,this).domain,clientId:v(F,this).clientId,customFetch:v(Ve,this),grantRequest:async(s,a)=>{const c=(await J(X,this,we).call(this)).serverMetadata,l=await J(X,this,Hs).call(this,c);l[et]=(function(d,p){return(u,f)=>{const g=f==null?void 0:f.body;if(p!==wd||!(g instanceof URLSearchParams))return d(u,f);const y={};for(const C of g){var m=Ke(C,2);const k=m[0],_=m[1];y[k]=k==="authn_response"?JSON.parse(_):_}const b=new Headers(f==null?void 0:f.headers);return b.set("Content-Type","application/json"),d(u,E(E({},f),{},{headers:b,body:JSON.stringify(y)}))}})(v(Ve,this),s);const h=await gn(l,s,a);return ut.fromTokenEndpointResponse(h)}})}async getServerMetadata(){return(await J(X,this,we).call(this)).serverMetadata}async buildAuthorizationUrl(r){const e=(await J(X,this,we).call(this)).serverMetadata;if(r!=null&&r.pushedAuthorizationRequests&&!e.pushed_authorization_request_endpoint)throw new fh("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await J(X,this,ns).call(this,r)}catch(t){throw new Zf(t)}}async buildLinkUserUrl(r){try{const e=await J(X,this,ns).call(this,{authorizationParams:E(E({},r.authorizationParams),{},{requested_connection:r.connection,requested_connection_scope:r.connectionScope,scope:"openid link_account offline_access",id_token_hint:r.idToken})});return{linkUserUrl:e.authorizationUrl,codeVerifier:e.codeVerifier}}catch(e){throw new $f(e)}}async buildUnlinkUserUrl(r){try{const e=await J(X,this,ns).call(this,{authorizationParams:E(E({},r.authorizationParams),{},{requested_connection:r.connection,scope:"openid unlink_account",id_token_hint:r.idToken})});return{unlinkUserUrl:e.authorizationUrl,codeVerifier:e.codeVerifier}}catch(e){throw new Xf(e)}}async backchannelAuthentication(r){const e=await J(X,this,we).call(this),t=e.configuration,n=e.serverMetadata,o=xs(E(E({},v(F,this).authorizationParams),r==null?void 0:r.authorizationParams)),i=new URLSearchParams(E(E({scope:Ls},o),{},{client_id:v(F,this).clientId,binding_message:r.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:r.loginHint.sub})}));r.requestedExpiry&&i.append("requested_expiry",r.requestedExpiry.toString()),r.authorizationDetails&&i.append("authorization_details",JSON.stringify(r.authorizationDetails));try{const s=await ch(t,i),a=await dd(t,s);return ut.fromTokenEndpointResponse(a)}catch(s){throw new ts(s)}}async initiateBackchannelAuthentication(r){const e=await J(X,this,we).call(this),t=e.configuration,n=e.serverMetadata,o=xs(E(E({},v(F,this).authorizationParams),r==null?void 0:r.authorizationParams)),i=new URLSearchParams(E(E({scope:Ls},o),{},{client_id:v(F,this).clientId,binding_message:r.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:n.issuer,sub:r.loginHint.sub})}));r.requestedExpiry&&i.append("requested_expiry",r.requestedExpiry.toString()),r.authorizationDetails&&i.append("authorization_details",JSON.stringify(r.authorizationDetails));try{const s=await ch(t,i);return{authReqId:s.auth_req_id,expiresIn:s.expires_in,interval:s.interval}}catch(s){throw new ts(s)}}async backchannelAuthenticationGrant(r){let e=r.authReqId;const t=(await J(X,this,we).call(this)).configuration,n=new URLSearchParams({auth_req_id:e});try{const o=await gn(t,"urn:openid:params:grant-type:ciba",n);return ut.fromTokenEndpointResponse(o)}catch(o){throw new ts(o)}}async getTokenForConnection(r){var e;if(r.refreshToken&&r.accessToken)throw new es("Either a refresh or access token should be specified, but not both.");const t=(e=r.accessToken)!==null&&e!==void 0?e:r.refreshToken;if(!t)throw new es("Either a refresh or access token must be specified.");try{return await this.exchangeToken({connection:r.connection,subjectToken:t,subjectTokenType:r.accessToken?Cd:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:r.loginHint})}catch(n){throw n instanceof Qe?new es(n.message,n.cause):n}}async exchangeToken(r){return"connection"in r?J(X,this,hg).call(this,r):J(X,this,lg).call(this,r)}async getTokenByCode(r,e){const t=(await J(X,this,we).call(this)).configuration;try{const n=await ud(t,r,{pkceCodeVerifier:e.codeVerifier});return ut.fromTokenEndpointResponse(n)}catch(n){throw new Jf("There was an error while trying to request a token.",pn(n))}}async getTokenByRefreshToken(r){const e=(await J(X,this,we).call(this)).configuration,t=new URLSearchParams;r.audience&&t.append("audience",r.audience),r.scope&&t.append("scope",r.scope);try{const n=await pd(e,r.refreshToken,t);return ut.fromTokenEndpointResponse(n)}catch(n){throw new Gf("The access token has expired and there was an error while trying to refresh it.",pn(n))}}async getTokenByPassword(r){const e=(await J(X,this,we).call(this)).configuration,t=new URLSearchParams({username:r.username,password:r.password});r.audience&&t.append("audience",r.audience),r.scope&&t.append("scope",r.scope),r.realm&&t.append("realm",r.realm);let n=e;if(r.auth0ForwardedFor){const o=await J(X,this,va).call(this);n=new Qn(e.serverMetadata(),v(F,this).clientId,v(F,this).clientSecret,o),n[et]=(i,s)=>v(Ve,this).call(this,i,E(E({},s),{},{headers:E(E({},s.headers),{},{"auth0-forwarded-for":r.auth0ForwardedFor})}))}try{const o=await gn(n,"password",t);return ut.fromTokenEndpointResponse(o)}catch(o){throw new Vf("There was an error while trying to request a token.",pn(o))}}async getTokenByClientCredentials(r){const e=(await J(X,this,we).call(this)).configuration;try{const t=new URLSearchParams({audience:r.audience});r.organization&&t.append("organization",r.organization);const n=await fd(e,t);return ut.fromTokenEndpointResponse(n)}catch(t){throw new Bf("There was an error while trying to request a token.",pn(t))}}async buildLogoutUrl(r){const e=await J(X,this,we).call(this),t=e.configuration;if(!e.serverMetadata.end_session_endpoint){const n=new URL("https://".concat(v(F,this).domain,"/v2/logout"));return n.searchParams.set("returnTo",r.returnTo),n.searchParams.set("client_id",v(F,this).clientId),n}return(function(n,o){xt(n);const i=fe(n),s=i.as,a=i.c,c=Xr(s,"end_session_endpoint",!1,i.tlsOnly);(o=new URLSearchParams(o)).has("client_id")||o.set("client_id",a.client_id);for(const h of o.entries()){var l=Ke(h,2);const d=l[0],p=l[1];c.searchParams.append(d,p)}return c})(t,{post_logout_redirect_uri:r.returnTo})}async verifyLogoutToken(r){const e=(await J(X,this,we).call(this)).serverMetadata,t=vh(v(F,this).discoveryCache),n=e.jwks_uri;v(Cr,this)||U(Cr,this,(function(i,s){const a=new jf(i,s),c=async(l,h)=>a.getKey(l,h);return Object.defineProperties(c,{coolingDown:{get:()=>a.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>a.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>a.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>a.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>a.jwks(),enumerable:!0,configurable:!1,writable:!1}}),c})(new URL(n),{cacheMaxAge:t.ttlMs,[md]:v(Ve,this),[xo]:v(_o,this)}));const o=(await Hf(r.logoutToken,v(Cr,this),{issuer:e.issuer,audience:v(F,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in o)&&!("sub"in o))throw new Ht('either "sid" or "sub" (or both) claims must be present');if("sid"in o&&typeof o.sid!="string")throw new Ht('"sid" claim must be a string');if("sub"in o&&typeof o.sub!="string")throw new Ht('"sub" claim must be a string');if("nonce"in o)throw new Ht('"nonce" claim is prohibited');if(!("events"in o))throw new Ht('"events" claim is missing');if(typeof o.events!="object"||o.events===null)throw new Ht('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in o.events))throw new Ht('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if(typeof o.events["http://schemas.openid.net/event/backchannel-logout"]!="object")throw new Ht('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:o.sid,sub:o.sub}}});function cg(){const r=v(F,this).domain.toLowerCase();return"".concat(r,"|mtls:").concat(v(F,this).useMtls?"1":"0")}async function Hs(r){const e=await J(X,this,va).call(this),t=new Qn(r,v(F,this).clientId,v(F,this).clientSecret,e);return t[et]=v(Ve,this),t}async function we(){if(v(Be,this)&&v(lt,this))return{configuration:v(Be,this),serverMetadata:v(lt,this)};const r=J(X,this,cg).call(this),e=v(Dr,this).get(r);if(e)return U(lt,this,e.serverMetadata),U(Be,this,await J(X,this,Hs).call(this,e.serverMetadata)),{configuration:v(Be,this),serverMetadata:v(lt,this)};const t=v(zn,this).get(r);if(t){const i=await t;return U(lt,this,i.serverMetadata),U(Be,this,await J(X,this,Hs).call(this,i.serverMetadata)),{configuration:v(Be,this),serverMetadata:v(lt,this)}}const n=(async()=>{const i=await J(X,this,va).call(this),s=await xf(new URL("https://".concat(v(F,this).domain)),v(F,this).clientId,{use_mtls_endpoint_aliases:v(F,this).useMtls},i,{[et]:v(Ve,this)}),a=s.serverMetadata();return v(Dr,this).set(r,{serverMetadata:a}),{configuration:s,serverMetadata:a}})(),o=n.then(i=>({serverMetadata:i.serverMetadata}));o.catch(()=>{}),v(zn,this).set(r,o);try{const i=await n,s=i.configuration,a=i.serverMetadata;U(Be,this,s),U(lt,this,a),v(Be,this)[et]=v(Ve,this)}finally{v(zn,this).delete(r)}return{configuration:v(Be,this),serverMetadata:v(lt,this)}}async function hg(r){var e,t;const n=(await J(X,this,we).call(this)).configuration;if("audience"in r||"resource"in r)throw new Qe("audience and resource parameters are not supported for Token Vault exchanges");vd(r.subjectToken);const o=new URLSearchParams({connection:r.connection,subject_token:r.subjectToken,subject_token_type:(e=r.subjectTokenType)!==null&&e!==void 0?e:Cd,requested_token_type:(t=r.requestedTokenType)!==null&&t!==void 0?t:"http://auth0.com/oauth/token-type/federated-connection-access-token"});r.loginHint&&o.append("login_hint",r.loginHint),r.scope&&o.append("scope",r.scope),bd(o,r.extra);try{const i=await gn(n,"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",o);return ut.fromTokenEndpointResponse(i)}catch(i){throw new Qe("Failed to exchange token for connection '".concat(r.connection,"'."),pn(i))}}async function lg(r){const e=(await J(X,this,we).call(this)).configuration;if(vd(r.subjectToken),r.actorToken!==void 0&&r.actorTokenType===void 0)throw new Qe("actorTokenType is required when actorToken is provided");const t=new URLSearchParams({subject_token_type:r.subjectTokenType,subject_token:r.subjectToken});r.audience&&t.append("audience",r.audience),r.scope&&t.append("scope",r.scope),r.requestedTokenType&&t.append("requested_token_type",r.requestedTokenType),r.organization&&t.append("organization",r.organization),r.actorToken&&t.append("actor_token",r.actorToken),r.actorTokenType&&t.append("actor_token_type",r.actorTokenType),bd(t,r.extra);try{const o=await gn(e,"urn:ietf:params:oauth:grant-type:token-exchange",t),i=ut.fromTokenEndpointResponse(o);var n;if(r.actorToken)if((n=i.claims)!==null&&n!==void 0&&n.act)i.act=i.claims.act;else try{i.act=(function(s){if(typeof s!="string")throw new dt("JWTs must use Compact JWS serialization, JWT must be a string");const a=s.split("."),c=a[1],l=a.length;if(l===5)throw new dt("Only JWTs using Compact JWS serialization can be decoded");if(l!==3)throw new dt("Invalid JWT");if(!c)throw new dt("JWTs must contain a payload");let h,d;try{h=qr(c)}catch{throw new dt("Failed to base64url decode the payload")}try{d=JSON.parse(Yn.decode(h))}catch{throw new dt("Failed to parse the decoded payload as JSON")}if(!Pt(d))throw new dt("Invalid JWT Claims Set");return d})(o.access_token).act}catch{}return i}catch(o){throw new Qe("Failed to exchange token of type '".concat(r.subjectTokenType,"'").concat(r.audience?" for audience '".concat(r.audience,"'"):"","."),pn(o))}}async function va(){return v(Ln,this)||U(Ln,this,(async()=>{if(!v(F,this).clientSecret&&!v(F,this).clientAssertionSigningKey&&!v(F,this).useMtls)throw new Yf;if(v(F,this).useMtls)return(e,t,n,o)=>{n.set("client_id",t.client_id)};let r=v(F,this).clientAssertionSigningKey;return!r||r instanceof CryptoKey||(r=await(async function(e,t,n){if(typeof e!="string"||e.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Rf(e,t,n)})(r,v(F,this).clientAssertionSigningAlg||"RS256")),r?(function(e,t){return Yp(e)})(r):cd(v(F,this).clientSecret)})().catch(r=>{throw U(Ln,this,void 0),r})),v(Ln,this)}async function ns(r){const e=(await J(X,this,we).call(this)).configuration,t=Nf(),n=await Of(t),o=xs(E(E({},v(F,this).authorizationParams),r==null?void 0:r.authorizationParams)),i=new URLSearchParams(E(E({scope:Ls},o),{},{client_id:v(F,this).clientId,code_challenge:n,code_challenge_method:"S256"}));return{authorizationUrl:r!=null&&r.pushedAuthorizationRequests?await gd(e,i):await Os(e,i),codeVerifier:t}}class Qt extends ne{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Qt.prototype)}static fromPayload(e){let t=e.error,n=e.error_description;return new Qt(t,n)}}class Vo extends Qt{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Vo.prototype)}}class ba extends Qt{constructor(e,t){super(e,t),Object.setPrototypeOf(this,ba.prototype)}}class Ca extends Qt{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Ca.prototype)}}class Hn extends Qt{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Hn.prototype)}}class Ta extends Qt{constructor(e,t){super(e,t),Object.setPrototypeOf(this,Ta.prototype)}}class dg{constructor(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){const t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){const e=Date.now();for(const n of this.contexts){var t=Ke(n,2);const o=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(o)}}get size(){return this.contexts.size}}class ug{constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new dg}setMFAAuthDetails(e,t,n,o){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:o})}async getAuthenticators(e){var t,n,o;const i=this.contextManager.get(e);if(!i)throw new Vo("invalid_request","MFA context not found for this MFA token");const s=(n=(t=i.mfaRequirements)===null||t===void 0?void 0:t.challenge)===null||n===void 0?void 0:n.map(a=>a.type);try{const a=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return s&&s.length!==0?a.filter(c=>!!c.type&&s.includes(c.type)):a}catch(a){throw a instanceof Ms?new Vo((o=a.cause)===null||o===void 0?void 0:o.error,a.message):a}}async enroll(e){var t;const n=(function(o){const i=zp[o.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:o.mfaToken,authenticatorTypes:i.authenticatorTypes},i.oobChannels&&{oobChannels:i.oobChannels}),"phoneNumber"in o&&{phoneNumber:o.phoneNumber}),"email"in o&&{email:o.email})})(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(o){throw o instanceof Us?new ba((t=o.cause)===null||t===void 0?void 0:t.error,o.message):o}}async challenge(e){var t;try{const n={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(n.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(n)}catch(n){throw n instanceof Ds?new Ca((t=n.cause)===null||t===void 0?void 0:t.error,n.message):n}}async getEnrollmentFactors(e){const t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new Ta("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&t.mfaRequirements.enroll.length!==0?t.mfaRequirements.enroll:[]}async verify(e){const t=this.contextManager.get(e.mfaToken);if(!t)throw new Hn("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");const n=(function(s){return"otp"in s&&s.otp?Wp:"oobCode"in s&&s.oobCode?Jp:"recoveryCode"in s&&s.recoveryCode?Bp:void 0})(e);if(!n)throw new Hn("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");const o=t.scope,i=t.audience;try{const s=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:o,audience:i,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),s}catch(s){throw s instanceof Hn?new Hn(s.error,s.error_description):s}}}class Kn extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,Kn.prototype)}}var Ar,Rr;class pg{constructor(e,t){Ar.set(this,void 0),Rr.set(this,void 0),Nc(this,Ar,e),Nc(this,Rr,t)}async signup(e){if(!window.PublicKeyCredential)throw new Kn("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e.scope,n=e.audience,o=Ne(e,["scope","audience"]),i=await ho(this,Ar,"f").register(o),s=(a=i.authnParamsPublicKey,Object.assign(Object.assign({},a),{challenge:rs(a.challenge),user:Object.assign(Object.assign({},a.user),{id:rs(a.user.id)}),pubKeyCredParams:a.pubKeyCredParams,authenticatorSelection:a.authenticatorSelection}));var a;const c=await navigator.credentials.create({publicKey:s});if(!c)throw new Kn("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");const l=(function(h){var d;const p=h.response;return{id:h.id,rawId:Kt(h.rawId),type:h.type,authenticatorAttachment:(d=h.authenticatorAttachment)!==null&&d!==void 0?d:void 0,response:{clientDataJSON:Kt(p.clientDataJSON),attestationObject:Kt(p.attestationObject)},clientExtensionResults:h.getClientExtensionResults()}})(c);return ho(this,Rr,"f")._requestTokenForPasskey({authSession:i.authSession,credential:l,realm:o.realm,organization:o.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new Kn("passkey_not_supported","WebAuthn is not supported in this browser.");const t=e||{},n=t.scope,o=t.audience,i=Ne(t,["scope","audience"]),s=await ho(this,Ar,"f").challenge(Object.keys(i).length>0?i:void 0),a=(c=s.authnParamsPublicKey,Object.assign(Object.assign({},c),{challenge:rs(c.challenge)}));var c;const l=await navigator.credentials.get({publicKey:a});if(!l)throw new Kn("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");const h=(function(d){var p;const u=d.response;return{id:d.id,rawId:Kt(d.rawId),type:d.type,authenticatorAttachment:(p=d.authenticatorAttachment)!==null&&p!==void 0?p:void 0,response:{clientDataJSON:Kt(u.clientDataJSON),authenticatorData:Kt(u.authenticatorData),signature:Kt(u.signature),userHandle:u.userHandle?Kt(u.userHandle):void 0},clientExtensionResults:d.getClientExtensionResults()}})(l);return ho(this,Rr,"f")._requestTokenForPasskey({authSession:s.authSession,credential:h,realm:i.realm,organization:i.organization,scope:n,audience:o})}}function Kt(r){const e=new Uint8Array(r),t=Array.from(e,n=>String.fromCharCode(n)).join("");return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function rs(r){const e=r.replace(/-/g,"+").replace(/_/g,"/"),t=e+"=".repeat((4-e.length%4)%4),n=atob(t),o=new Uint8Array(n.length);for(let i=0;i<n.length;i++)o[i]=n.charCodeAt(i);return o.buffer}Ar=new WeakMap,Rr=new WeakMap;class fg{constructor(e){let t,n;if(this.userCache=new Hl().enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0},this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),typeof window<"u"&&(()=>{if(!Ko())throw new Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(Ko().subtle===void 0)throw new Error(`
       auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.