PyPI - hackagent-webui - Versions diffs - 0.2.0__py3-none-any.whl - Mend

hackagent-webui 0.2.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (81) hide show

hackagent_webui/static/_next/static/chunks/abf9ae41-a2ad9357d01c2a31.js ADDED Viewed

@@ -0,0 +1 @@

+ "use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[330],{67176:(e,t,n)=>{let r,o,i,a,s,c,l,u,h,d;n.d(t,{WB:()=>sX,y2:()=>sV});var p,f,m,y,g,w,v,b,_,k,S,T,E,P,C,A,R,x,I,O,j,W,N,U,M,L,K,z,J,D,Z,H,F,G,V,X,Y,q,B,Q,$,ee,et,en,er,eo,ei,ea,es,ec,el,eu,eh,ed,ep,ef,em,ey,eg,ew,ev,eb=n(12115),e_=function(e,t){return(e_=Object.setPrototypeOf||({__proto__:[]})instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])})(e,t)},ek=function(){return(ek=Object.assign||function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e}).apply(this,arguments)};function eS(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(n[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var o=0,r=Object.getOwnPropertySymbols(e);o<r.length;o++)0>t.indexOf(r[o])&&Object.prototype.propertyIsEnumerable.call(e,r[o])&&(n[r[o]]=e[r[o]]);return n}function eT(e,t,n,r){return new(n||(n=Promise))(function(o,i){function a(e){try{c(r.next(e))}catch(e){i(e)}}function s(e){try{c(r.throw(e))}catch(e){i(e)}}function c(e){var t;e.done?o(e.value):((t=e.value)instanceof n?t:new n(function(e){e(t)})).then(a,s)}c((r=r.apply(e,t||[])).next())})}function eE(e,t){var n,r,o,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return a.next=s(0),a.throw=s(1),a.return=s(2),"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function s(s){return function(c){var l=[s,c];if(n)throw TypeError("Generator is already executing.");for(;a&&(a=0,l[0]&&(i=0)),i;)try{if(n=1,r&&(o=2&l[0]?r.return:l[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,l[1])).done)return o;switch(r=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return i.label++,{value:l[1],done:!1};case 5:i.label++,r=l[1],l=[0];continue;case 7:l=i.ops.pop(),i.trys.pop();continue;default:if(!(o=(o=i.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){i=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){i.label=l[1];break}if(6===l[0]&&i.label<o[1]){i.label=o[1],o=l;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(l);break}o[2]&&i.ops.pop(),i.trys.pop();continue}l=t.call(e,i)}catch(e){l=[6,e],r=0}finally{n=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}function eP(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(n[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols){var o=0;for(r=Object.getOwnPropertySymbols(e);o<r.length;o++)0>t.indexOf(r[o])&&Object.prototype.propertyIsEnumerable.call(e,r[o])&&(n[r[o]]=e[r[o]])}return n}function eC(e,t,n,r){if("a"===n&&!r)throw TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!r:!t.has(e))throw TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?r:"a"===n?r.call(e):r?r.value:t.get(e)}function eA(e,t,n,r,o){if("m"===r)throw TypeError("Private method is not writable");if("a"===r&&!o)throw TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!o:!t.has(e))throw TypeError("Cannot write private member to an object whose class did not declare it");return"a"===r?o.call(e,n):o?o.value=n:t.set(e,n),n}function eR(e,t){this.v=e,this.k=t}function ex(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function eI(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw TypeError("Private element is not present on this object")}function eO(e,t){if(t.has(e))throw TypeError("Cannot initialize the same private elements twice on an object")}function ej(e,t){return e.get(eI(e,t))}function eW(e,t,n){eO(e,t),t.set(e,n)}function eN(e,t,n){return e.set(eI(e,t),n),n}function eU(e,t){eO(e,t),t.add(e)}function eM(e,t,n){var r;return(t="symbol"==typeof(r=function(e,t){if("object"!=typeof e||!e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!=typeof r)return r;throw TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(t,"string"))?r:r+"")in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function eL(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function eK(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?eL(Object(n),!0).forEach(function(t){eM(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):eL(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function ez(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n={};for(var r in e)if(({}).hasOwnProperty.call(e,r)){if(-1!==t.indexOf(r))continue;n[r]=e[r]}return n}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],-1===t.indexOf(n)&&({}).propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function eJ(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i,a,s=[],c=!0,l=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;c=!1}else for(;!(c=(r=i.call(n)).done)&&(s.push(r.value),s.length!==t);c=!0);}catch(e){l=!0,o=e}finally{try{if(!c&&null!=n.return&&(a=n.return(),Object(a)!==a))return}finally{if(l)throw o}}return s}}(e,t)||function(e,t){if(e){if("string"==typeof e)return ex(e,t);var n=({}).toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?ex(e,t):void 0}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function eD(e){return function(){return new eZ(e.apply(this,arguments))}}function eZ(e){var t,n;function r(t,n){try{var i=e[t](n),a=i.value,s=a instanceof eR;Promise.resolve(s?a.v:a).then(function(n){if(s){var c="return"===t&&a.k?t:"next";if(!a.k||n.done)return r(c,n);n=e[c](n).value}o(!!i.done,n)},function(e){r("throw",e)})}catch(e){o(2,e)}}function o(e,o){2===e?t.reject(o):t.resolve({value:o,done:e}),(t=t.next)?r(t.key,t.arg):n=null}this._invoke=function(e,o){return new Promise(function(i,a){var s={key:e,arg:o,resolve:i,reject:a,next:null};n?n=n.next=s:(t=n=s,r(e,o))})},"function"!=typeof e.return&&(this.return=void 0)}"function"==typeof SuppressedError&&SuppressedError,"function"==typeof SuppressedError&&SuppressedError,eZ.prototype["function"==typeof Symbol&&Symbol.asyncIterator||"@@asyncIterator"]=function(){return this},eZ.prototype.next=function(e){return this._invoke("next",e)},eZ.prototype.throw=function(e){return this._invoke("throw",e)},eZ.prototype.return=function(e){return this._invoke("return",e)};let eH={timeoutInSeconds:60},eF="memory",eG="Multifactor authentication required",eV="online_access",eX={name:"auth0-spa-js",version:"2.27.0"},eY=()=>Date.now(),eq="default";class eB extends Error{static fromPayload(e){return new eB(e.error,e.error_description)}constructor(e,t){super(t),this.error=e,this.error_description=t,Object.setPrototypeOf(this,eB.prototype)}}class eQ extends eB{constructor(e,t){super("invalid_configuration","".concat(e," ").concat(t)),this.suggestion=t,Object.setPrototypeOf(this,eQ.prototype)}}class e$ extends eB{constructor(e,t,n){let r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:null;super(e,t),this.state=n,this.appState=r,Object.setPrototypeOf(this,e$.prototype)}}class e0 extends eB{constructor(e,t,n,r){let o=arguments.length>4&&void 0!==arguments[4]?arguments[4]:null;super(e,t),this.connection=n,this.state=r,this.appState=o,Object.setPrototypeOf(this,e0.prototype)}}class e2 extends eB{constructor(){super("timeout","Timeout"),Object.setPrototypeOf(this,e2.prototype)}}class e1 extends e2{constructor(e){super(),this.popup=e,Object.setPrototypeOf(this,e1.prototype)}}class e5 extends eB{constructor(e){super("cancelled","Popup closed"),this.popup=e,Object.setPrototypeOf(this,e5.prototype)}}class e3 extends eB{constructor(){super("popup_open","Unable to open a popup for loginWithPopup - window.open returned `null`"),Object.setPrototypeOf(this,e3.prototype)}}class e9 extends eB{constructor(e,t,n,r){super(e,t),this.mfa_token=n,this.mfa_requirements=r,Object.setPrototypeOf(this,e9.prototype)}}class e4 extends eB{constructor(e,t){super("missing_refresh_token","Missing Refresh Token (audience: '".concat(e7(e,["default"]),"', scope: '").concat(e7(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,e4.prototype)}}class e6 extends eB{constructor(e,t){super("missing_scopes","Missing requested scopes after refresh (audience: '".concat(e7(e,["default"]),"', missing scope: '").concat(e7(t),"')")),this.audience=e,this.scope=t,Object.setPrototypeOf(this,e6.prototype)}}class e8 extends eB{constructor(e){super("use_dpop_nonce","Server rejected DPoP proof: wrong nonce"),this.newDpopNonce=e,Object.setPrototypeOf(this,e8.prototype)}}function e7(e){return e&&!(arguments.length>1&&void 0!==arguments[1]?arguments[1]:[]).includes(e)?e:""}let te=()=>window.crypto,tt=()=>{let e="";for(;e.length<43;)for(let t of te().getRandomValues(new Uint8Array(43-e.length)))e.length<43&&t<198&&(e+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~."[t%66]);return e},tn=e=>btoa(e),tr=[{key:"name",type:["string"]},{key:"version",type:["string","number"]},{key:"env",type:["object"]}],to=function(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return Object.keys(e).reduce((n,r)=>{if(t&&"env"===r)return n;let o=tr.find(e=>e.key===r);return o&&o.type.includes(typeof e[r])&&(n[r]=e[r]),n},{})},ti=e=>new URLSearchParams((e=>Object.keys(e).filter(t=>void 0!==e[t]).reduce((t,n)=>Object.assign(Object.assign({},t),{[n]:e[n]}),{}))(Object.assign({client_id:e.clientId},eP(e,["clientId"])))).toString(),ta=async e=>{let t=te().subtle.digest({name:"SHA-256"},(new TextEncoder).encode(e));return await t},ts=e=>decodeURIComponent(atob(e.replace(/_/g,"/").replace(/-/g,"+")).split("").map(e=>"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)).join("")),tc=e=>{let t=new Uint8Array(e);return(e=>{let t={"+":"-","/":"_","=":""};return e.replace(/[+/=]/g,e=>t[e])})(window.btoa(String.fromCharCode(...Array.from(t))))};var tl="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:void 0!==n.g?n.g:"undefined"!=typeof self?self:{},tu={},th={};Object.defineProperty(th,"__esModule",{value:!0});var td=function(){function e(){var e=this;this.locked=new Map,this.addToLocked=function(t,n){var r=e.locked.get(t);void 0===r?void 0===n?e.locked.set(t,[]):e.locked.set(t,[n]):void 0!==n&&(r.unshift(n),e.locked.set(t,r))},this.isLocked=function(t){return e.locked.has(t)},this.lock=function(t){return new Promise(function(n,r){e.isLocked(t)?e.addToLocked(t,n):(e.addToLocked(t),n())})},this.unlock=function(t){var n=e.locked.get(t);if(void 0!==n&&0!==n.length){var r=n.pop();e.locked.set(t,n),void 0!==r&&setTimeout(r,0)}else e.locked.delete(t)}}return e.getInstance=function(){return void 0===e.instance&&(e.instance=new e),e.instance},e}();th.default=function(){return td.getInstance()};var tp=tl&&tl.__awaiter||function(e,t,n,r){return new(n||(n=Promise))(function(o,i){function a(e){try{c(r.next(e))}catch(e){i(e)}}function s(e){try{c(r.throw(e))}catch(e){i(e)}}function c(e){e.done?o(e.value):new n(function(t){t(e.value)}).then(a,s)}c((r=r.apply(e,t||[])).next())})},tf=tl&&tl.__generator||function(e,t){var n,r,o,i,a={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:s(0),throw:s(1),return:s(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function s(i){return function(s){var c=[i,s];if(n)throw TypeError("Generator is already executing.");for(;a;)try{if(n=1,r&&(o=2&c[0]?r.return:c[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,c[1])).done)return o;switch(r=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return a.label++,{value:c[1],done:!1};case 5:a.label++,r=c[1],c=[0];continue;case 7:c=a.ops.pop(),a.trys.pop();continue;default:if(!(o=(o=a.trys).length>0&&o[o.length-1])&&(6===c[0]||2===c[0])){a=0;continue}if(3===c[0]&&(!o||c[1]>o[0]&&c[1]<o[3])){a.label=c[1];break}if(6===c[0]&&a.label<o[1]){a.label=o[1],o=c;break}if(o&&a.label<o[2]){a.label=o[2],a.ops.push(c);break}o[2]&&a.ops.pop(),a.trys.pop();continue}c=t.call(e,a)}catch(e){c=[6,e],r=0}finally{n=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}}};Object.defineProperty(tu,"__esModule",{value:!0});var tm="browser-tabs-lock-key",ty={key:function(e){return tp(tl,void 0,void 0,function(){return tf(this,function(e){throw Error("Unsupported")})})},getItem:function(e){return tp(tl,void 0,void 0,function(){return tf(this,function(e){throw Error("Unsupported")})})},clear:function(){return tp(tl,void 0,void 0,function(){return tf(this,function(e){return[2,window.localStorage.clear()]})})},removeItem:function(e){return tp(tl,void 0,void 0,function(){return tf(this,function(e){throw Error("Unsupported")})})},setItem:function(e,t){return tp(tl,void 0,void 0,function(){return tf(this,function(e){throw Error("Unsupported")})})},keySync:function(e){return window.localStorage.key(e)},getItemSync:function(e){return window.localStorage.getItem(e)},clearSync:function(){return window.localStorage.clear()},removeItemSync:function(e){return window.localStorage.removeItem(e)},setItemSync:function(e,t){return window.localStorage.setItem(e,t)}};function tg(e){return new Promise(function(t){return setTimeout(t,e)})}function tw(e){for(var t="",n=0;n<e;n++)t+="0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz"[Math.floor(61*Math.random())];return t}var tv=tu.default=function(){function e(t){this.acquiredIatSet=new Set,this.storageHandler=void 0,this.id=Date.now().toString()+tw(15),this.acquireLock=this.acquireLock.bind(this),this.releaseLock=this.releaseLock.bind(this),this.releaseLock__private__=this.releaseLock__private__.bind(this),this.waitForSomethingToChange=this.waitForSomethingToChange.bind(this),this.refreshLockWhileAcquired=this.refreshLockWhileAcquired.bind(this),this.storageHandler=t,void 0===e.waiters&&(e.waiters=[])}return e.prototype.acquireLock=function(t,n){return void 0===n&&(n=5e3),tp(this,void 0,void 0,function(){var r,o,i,a,s,c,l;return tf(this,function(u){switch(u.label){case 0:r=Date.now()+tw(4),o=Date.now()+n,i=tm+"-"+t,a=void 0===this.storageHandler?ty:this.storageHandler,u.label=1;case 1:return Date.now()<o?[4,tg(30)]:[3,8];case 2:return u.sent(),null!==a.getItemSync(i)?[3,5]:(s=this.id+"-"+t+"-"+r,[4,tg(Math.floor(25*Math.random()))]);case 3:return u.sent(),a.setItemSync(i,JSON.stringify({id:this.id,iat:r,timeoutKey:s,timeAcquired:Date.now(),timeRefreshed:Date.now()})),[4,tg(30)];case 4:return u.sent(),null!==(c=a.getItemSync(i))&&(l=JSON.parse(c)).id===this.id&&l.iat===r?(this.acquiredIatSet.add(r),this.refreshLockWhileAcquired(i,r),[2,!0]):[3,7];case 5:return e.lockCorrector(void 0===this.storageHandler?ty:this.storageHandler),[4,this.waitForSomethingToChange(o)];case 6:u.sent(),u.label=7;case 7:return r=Date.now()+tw(4),[3,1];case 8:return[2,!1]}})})},e.prototype.refreshLockWhileAcquired=function(e,t){return tp(this,void 0,void 0,function(){var n=this;return tf(this,function(r){return setTimeout(function(){return tp(n,void 0,void 0,function(){var n,r,o;return tf(this,function(i){switch(i.label){case 0:return[4,th.default().lock(t)];case 1:return i.sent(),this.acquiredIatSet.has(t)?null===(r=(n=void 0===this.storageHandler?ty:this.storageHandler).getItemSync(e))?th.default().unlock(t):((o=JSON.parse(r)).timeRefreshed=Date.now(),n.setItemSync(e,JSON.stringify(o)),th.default().unlock(t),this.refreshLockWhileAcquired(e,t)):th.default().unlock(t),[2]}})})},1e3),[2]})})},e.prototype.waitForSomethingToChange=function(t){return tp(this,void 0,void 0,function(){return tf(this,function(n){switch(n.label){case 0:return[4,new Promise(function(n){var r=!1,o=Date.now(),i=!1;function a(){if(i||(window.removeEventListener("storage",a),e.removeFromWaiting(a),clearTimeout(s),i=!0),!r){r=!0;var t=50-(Date.now()-o);t>0?setTimeout(n,t):n(null)}}window.addEventListener("storage",a),e.addToWaiting(a);var s=setTimeout(a,Math.max(0,t-Date.now()))})];case 1:return n.sent(),[2]}})})},e.addToWaiting=function(t){this.removeFromWaiting(t),void 0!==e.waiters&&e.waiters.push(t)},e.removeFromWaiting=function(t){void 0!==e.waiters&&(e.waiters=e.waiters.filter(function(e){return e!==t}))},e.notifyWaiters=function(){void 0!==e.waiters&&e.waiters.slice().forEach(function(e){return e()})},e.prototype.releaseLock=function(e){return tp(this,void 0,void 0,function(){return tf(this,function(t){switch(t.label){case 0:return[4,this.releaseLock__private__(e)];case 1:return[2,t.sent()]}})})},e.prototype.releaseLock__private__=function(t){return tp(this,void 0,void 0,function(){var n,r,o,i;return tf(this,function(a){switch(a.label){case 0:return n=void 0===this.storageHandler?ty:this.storageHandler,r=tm+"-"+t,null===(o=n.getItemSync(r))?[2]:(i=JSON.parse(o)).id!==this.id?[3,2]:[4,th.default().lock(i.iat)];case 1:a.sent(),this.acquiredIatSet.delete(i.iat),n.removeItemSync(r),th.default().unlock(i.iat),e.notifyWaiters(),a.label=2;case 2:return[2]}})})},e.lockCorrector=function(t){for(var n=Date.now()-5e3,r=[],o=0;;){var i=t.keySync(o);if(null===i)break;r.push(i),o++}for(var a=!1,s=0;s<r.length;s++){var c=r[s];if(c.includes(tm)){var l=t.getItemSync(c);if(null!==l){var u=JSON.parse(l);(void 0===u.timeRefreshed&&u.timeAcquired<n||void 0!==u.timeRefreshed&&u.timeRefreshed<n)&&(t.removeItemSync(c),a=!0)}}}a&&e.notifyWaiters()},e.waiters=void 0,e}();class tb{async runWithLock(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),t);try{return await navigator.locks.request(e,{mode:"exclusive",signal:r.signal},async e=>{if(clearTimeout(o),!e)throw Error("Lock not available");return await n()})}catch(e){if(clearTimeout(o),"AbortError"===(null==e?void 0:e.name))throw new e2;throw e}}}class t_{async runWithLock(e,t,n){let r=!1;for(let n=0;n<10&&!r;n++)r=await this.lock.acquireLock(e,t);if(!r)throw new e2;this.activeLocks.add(e),1===this.activeLocks.size&&"undefined"!=typeof window&&window.addEventListener("pagehide",this.pagehideHandler);try{return await n()}finally{this.activeLocks.delete(e),await this.lock.releaseLock(e),0===this.activeLocks.size&&"undefined"!=typeof window&&window.removeEventListener("pagehide",this.pagehideHandler)}}constructor(){this.activeLocks=new Set,this.lock=new tv,this.pagehideHandler=()=>{this.activeLocks.forEach(e=>this.lock.releaseLock(e)),this.activeLocks.clear()}}}let tk=null;function tS(){var e;return tk||(tk="undefined"!=typeof navigator&&"function"==typeof(null==(e=navigator.locks)?void 0:e.request)?new tb:new t_),tk}let tT=new TextEncoder,tE=new TextDecoder;function tP(e){return"string"==typeof e?tT.encode(e):tE.decode(e)}function tC(e){if("number"!=typeof e.modulusLength||e.modulusLength<2048)throw new tx("".concat(e.name," modulusLength must be at least 2048 bits"))}async function tA(e,t,n){var o,i,a;if(!1===n.usages.includes("sign"))throw TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let s="".concat((o=tP(JSON.stringify(e)),r(o)),".").concat((i=tP(JSON.stringify(t)),r(i)));return"".concat(s,".").concat((a=await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return tC(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return tC(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new tR}(n),n,tP(s)),r(a)))}r=Uint8Array.prototype.toBase64?e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0})):e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));let t=[];for(let n=0;n<e.byteLength;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};class tR extends Error{constructor(e){var t;super(null!=e?e:"operation not supported"),this.name=this.constructor.name,null==(t=Error.captureStackTrace)||t.call(Error,this,this.constructor)}}class tx extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null==(t=Error.captureStackTrace)||t.call(Error,this,this.constructor)}}function tI(e){return e instanceof CryptoKey}function tO(e){return tI(e)&&"public"===e.type}async function tj(e,t,n,o,i,a){var s;let c=null==e?void 0:e.privateKey,l=null==e?void 0:e.publicKey;if(!tI(c)||"private"!==c.type)throw TypeError('"keypair.privateKey" must be a private CryptoKey');if(!tO(l))throw TypeError('"keypair.publicKey" must be a public CryptoKey');if(!0!==l.extractable)throw TypeError('"keypair.publicKey.extractable" must be true');if("string"!=typeof t)throw TypeError('"htu" must be a string');if("string"!=typeof n)throw TypeError('"htm" must be a string');if(void 0!==o&&"string"!=typeof o)throw TypeError('"nonce" must be a string or undefined');if(void 0!==i&&"string"!=typeof i)throw TypeError('"accessToken" must be a string or undefined');if(void 0!==a&&("object"!=typeof a||null===a||Array.isArray(a)))throw TypeError('"additional" must be an object');let u=Object.assign(Object.create(null),a,{iat:Math.floor(Date.now()/1e3),jti:crypto.randomUUID(),htm:n,nonce:o,htu:t,ath:i?(s=await crypto.subtle.digest("SHA-256",tP(i)),r(s)):void 0});return tA({alg:function(e){switch(e.algorithm.name){case"RSA-PSS":if("SHA-256"===e.algorithm.hash.name)return"PS256";throw new tR("unsupported RsaHashedKeyAlgorithm hash name");case"RSASSA-PKCS1-v1_5":if("SHA-256"===e.algorithm.hash.name)return"RS256";throw new tR("unsupported RsaHashedKeyAlgorithm hash name");case"ECDSA":if("P-256"===e.algorithm.namedCurve)return"ES256";throw new tR("unsupported EcKeyAlgorithm namedCurve");case"Ed25519":return"Ed25519";default:throw new tR("unsupported CryptoKey algorithm name")}}(c),typ:"dpop+jwt",jwk:await tW(l)},u,c)}async function tW(e){let{kty:t,e:n,n:r,x:o,y:i,crv:a}=await crypto.subtle.exportKey("jwk",e);return{kty:t,crv:a,e:n,n:r,x:o,y:i}}let tN="dpop-nonce",tU=["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:token-exchange","urn:okta:params:oauth:grant-type:webauthn","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code"],tM=(e,t)=>new Promise(function(n,r){let o=new MessageChannel;o.port1.onmessage=function(e){e.data.error?r(Error(e.data.error)):n(e.data),o.port1.close()},t.postMessage(e,[o.port2])}),tL=(e,t,n)=>{let r,o=new AbortController;return t.signal=o.signal,Promise.race([fetch(e,t),new Promise((e,t)=>{r=setTimeout(()=>{o.abort(),t(Error("Timeout when executing 'fetch'"))},n)})]).finally(()=>{clearTimeout(r)})},tK=async function(e,t,n,r,o,i){let a=arguments.length>6&&void 0!==arguments[6]?arguments[6]:1e4;return o?(async(e,t,n,r,o,i,a,s,c,l)=>tM({type:"refresh",auth:{audience:t,scope:n},timeout:o,fetchUrl:e,fetchOptions:r,useFormData:a,useMrrt:s,skipTokenStorage:c,preserveRefreshToken:l},i))(e,t,n,r,a,o,i,arguments.length>7?arguments[7]:void 0,arguments.length>8?arguments[8]:void 0,arguments.length>9?arguments[9]:void 0):(async(e,t,n)=>{let r=await tL(e,t,n);return{ok:r.ok,json:await r.json(),headers:[...r.headers].reduce((e,t)=>{let n=eJ(t,2),r=n[0],o=n[1];return e[r]=o,e},{})}})(e,r,a)};async function tz(e,t,n,r,o,i,a,s,c,l,u,h){let d;if(c){let t=await c.generateProof({url:e,method:o.method||"GET",nonce:await c.getNonce()});o.headers=Object.assign(Object.assign({},o.headers),{dpop:t})}let p,f=null;for(let c=0;c<3;c++)try{p=await tK(e,n,r,o,i,a,t,s,u,h),f=null;break}catch(e){f=e}if(f)throw f;let m=p.json,y=m.error,g=m.error_description,w=eP(m,["error","error_description"]),v=p,b=v.headers,_=v.ok;if(c&&(d=b[tN])&&await c.setNonce(d),!_){let p=g||"HTTP error. Unable to fetch ".concat(e);if("mfa_required"===y)throw new e9(y,p,w.mfa_token,w.mfa_requirements);if("missing_refresh_token"===y)throw new e4(n,r);if("use_dpop_nonce"===y){if(!c||!d||l)throw new e8(d);return tz(e,t,n,r,o,i,a,s,c,!0,u,h)}throw new eB(y||"request_error",p)}return w}async function tJ(e,t,n){var r,o=e.baseUrl,i=e.timeout,a=e.audience,s=e.scope,c=e.auth0Client,l=e.useFormData,u=e.useMrrt,h=e.dpop,d=e.preserveRefreshToken,p=eP(e,["baseUrl","timeout","audience","scope","auth0Client","useFormData","useMrrt","dpop","preserveRefreshToken"]);let f="urn:ietf:params:oauth:grant-type:token-exchange"===p.grant_type,m="urn:okta:params:oauth:grant-type:webauthn"===p.grant_type,y="refresh_token"===p.grant_type&&u,g=f||m||y,w=Object.assign(Object.assign(Object.assign({},p),g&&a&&{audience:a}),g&&s&&{scope:s}),v=m||!l,b=v?JSON.stringify(w):ti(w),_=(r=p.grant_type,tU.includes(r));return await tz("".concat(o,"/oauth/token"),i,a||eq,s,{method:"POST",body:b,headers:{"Content-Type":v?"application/json":"application/x-www-form-urlencoded","Auth0-Client":btoa(JSON.stringify(to(c||eX)))}},t,l,u,_?h:void 0,void 0,n,d)}let tD=function(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];return Array.from(new Set(t.filter(Boolean).join(" ").trim().split(/\s+/))).join(" ")},tZ=(e,t,n)=>{let r;return n&&(r=e[n]),r||(r=e[eq]),tD(r,t)},tH="@@auth0spajs@@",tF="@@user@@";class tG{toKey(){return[this.prefix,this.clientId,this.audience,this.scope,this.suffix].filter(Boolean).join("::")}static fromKey(e){let t=eJ(e.split("::"),4),n=t[0],r=t[1],o=t[2];return new tG({clientId:r,scope:t[3],audience:o},n)}static fromCacheEntry(e){let t=e.scope;return new tG({scope:t,audience:e.audience,clientId:e.client_id})}constructor(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:tH,n=arguments.length>2?arguments[2]:void 0;this.prefix=t,this.suffix=n,this.clientId=e.clientId,this.scope=e.scope,this.audience=e.audience}}class tV{set(e,t){localStorage.setItem(e,JSON.stringify(t))}get(e){let t=window.localStorage.getItem(e);if(t)try{return JSON.parse(t)}catch(e){return}}remove(e){localStorage.removeItem(e)}allKeys(){return Object.keys(window.localStorage).filter(e=>e.startsWith(tH))}}class tX{constructor(){this.enclosedCache=function(){let e={};return{set(t,n){e[t]=n},get(t){let n=e[t];if(n)return n},remove(t){delete e[t]},allKeys:()=>Object.keys(e)}}()}}class tY{async setIdToken(e,t,n){var r;let o=this.getIdTokenCacheKey(e);await this.cache.set(o,{id_token:t,decodedToken:n}),await (null==(r=this.keyManifest)?void 0:r.add(o))}async getIdToken(e){let t=await this.cache.get(this.getIdTokenCacheKey(e.clientId));if(!t&&e.scope&&e.audience){let t=await this.get(e);if(!t||!t.id_token||!t.decodedToken)return;return{id_token:t.id_token,decodedToken:t.decodedToken}}if(t)return{id_token:t.id_token,decodedToken:t.decodedToken}}async get(e){var t;let n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,r=arguments.length>2&&void 0!==arguments[2]&&arguments[2],o=arguments.length>3?arguments[3]:void 0,i=await this.cache.get(e.toKey()),a=e;if(!i){let t=await this.getCacheKeys();if(!t)return;let n=this.matchExistingCacheKey(e,t);if(n&&(i=await this.cache.get(n),a=tG.fromKey(n)),!i&&r&&"cache-only"!==o)return this.getEntryWithRefreshToken(e,t)}if(!i)return;let s=Math.floor(await this.nowProvider()/1e3);return i.expiresAt-n<s?i.body.refresh_token?this.modifiedCachedEntry(i,a):(await this.cache.remove(a.toKey()),void await (null==(t=this.keyManifest)?void 0:t.remove(a.toKey()))):i.body}async modifiedCachedEntry(e,t){let n={refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope},r={body:n,expiresAt:e.expiresAt};return await this.cache.set(t.toKey(),r),{refresh_token:n.refresh_token,audience:n.audience,scope:n.scope}}async set(e){var t;let n=new tG({clientId:e.client_id,scope:e.scope,audience:e.audience}),r=await this.wrapCacheEntry(e);await this.cache.set(n.toKey(),r),await (null==(t=this.keyManifest)?void 0:t.add(n.toKey()))}async remove(e,t,n){let r=new tG({clientId:e,scope:n,audience:t});await this.cache.remove(r.toKey())}async stripRefreshToken(e){var t;let n=await this.getCacheKeys();if(n)for(let r of n){let n=await this.cache.get(r);(null==(t=null==n?void 0:n.body)?void 0:t.refresh_token)===e&&(delete n.body.refresh_token,await this.cache.set(r,n))}}async clear(e){var t;let n=await this.getCacheKeys();n&&(await n.filter(t=>!e||t.includes(e)).reduce(async(e,t)=>{await e,await this.cache.remove(t)},Promise.resolve()),await (null==(t=this.keyManifest)?void 0:t.clear()))}async wrapCacheEntry(e){return{body:e,expiresAt:Math.floor(await this.nowProvider()/1e3)+e.expires_in}}async getCacheKeys(){var e;return this.keyManifest?null==(e=await this.keyManifest.get())?void 0:e.keys:this.cache.allKeys?this.cache.allKeys():void 0}getIdTokenCacheKey(e){return new tG({clientId:e},tH,tF).toKey()}matchExistingCacheKey(e,t){return t.filter(t=>{var n;let r=tG.fromKey(t),o=new Set(r.scope&&r.scope.split(" ")),i=(null==(n=e.scope)?void 0:n.split(" "))||[],a=r.scope&&i.reduce((e,t)=>e&&o.has(t),!0);return r.prefix===tH&&r.clientId===e.clientId&&r.audience===e.audience&&a})[0]}async getEntryWithRefreshToken(e,t){var n;for(let r of t){let t=tG.fromKey(r);if(t.prefix===tH&&t.clientId===e.clientId){let e=await this.cache.get(r);if(null==(n=null==e?void 0:e.body)?void 0:n.refresh_token)return{refresh_token:e.body.refresh_token,audience:e.body.audience,scope:e.body.scope}}}}async getRefreshTokensByAudience(e,t){var n;let r=await this.getCacheKeys();if(!r)return[];let o=new Set;for(let i of r){let r=tG.fromKey(i);if(r.prefix===tH&&r.clientId===t&&r.audience===e){let e=await this.cache.get(i);(null==(n=null==e?void 0:e.body)?void 0:n.refresh_token)&&o.add(e.body.refresh_token)}}return Array.from(o)}async updateEntry(e,t,n){let r=arguments.length>3&&void 0!==arguments[3]&&arguments[3],o=await this.getCacheKeys();if(o)for(let i of o){if(tG.fromKey(i).clientId!==n)continue;let o=await this.cache.get(i);if(!(null==o?void 0:o.body))continue;let a=o.body.refresh_token;a&&(r||a===e)&&(o.body.refresh_token=t,await this.cache.set(i,o))}}constructor(e,t,n){this.cache=e,this.keyManifest=t,this.nowProvider=n||eY}}class tq{create(e){this.storage.save(this.storageKey,e,{daysUntilExpire:1,cookieDomain:this.cookieDomain})}get(){return this.storage.get(this.storageKey)}remove(){this.storage.remove(this.storageKey,{cookieDomain:this.cookieDomain})}constructor(e,t,n){this.storage=e,this.clientId=t,this.cookieDomain=n,this.storageKey="".concat("a0.spajs.txs",".").concat(this.clientId)}}let tB=["iss","aud","exp","nbf","iat","jti","azp","nonce","auth_time","at_hash","c_hash","acr","amr","sub_jwk","cnf","sip_from_tag","sip_date","sip_callid","sip_cseq_num","sip_via_branch","orig","dest","mky","events","toe","txn","rph","sid","vot","vtm"];var tQ=tl&&tl.__assign||function(){return(tQ=Object.assign||function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e}).apply(this,arguments)};function t$(e,t){if(!t)return"";var n="; "+e;return!0===t?n:n+"="+t}function t0(e,t,n){var r;document.cookie=(r=tQ({path:"/"},n),encodeURIComponent(e).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/$/g,"%28").replace(/$/g,"%29")+"="+encodeURIComponent(t).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent)+function(e){if("number"==typeof e.expires){var t=new Date;t.setMilliseconds(t.getMilliseconds()+864e5*e.expires),e.expires=t}return t$("Expires",e.expires?e.expires.toUTCString():"")+t$("Domain",e.domain)+t$("Path",e.path)+t$("Secure",e.secure)+t$("SameSite",e.sameSite)}(r))}var t2=function(e,t){t0(e,"",tQ(tQ({},t),{expires:-1}))};let t1={get(e){let t=function(e){for(var t={},n=e?e.split("; "):[],r=/(%[\dA-F]{2})+/gi,o=0;o<n.length;o++){var i=n[o].split("="),a=i.slice(1).join("=");'"'===a.charAt(0)&&(a=a.slice(1,-1));try{t[i[0].replace(r,decodeURIComponent)]=a.replace(r,decodeURIComponent)}catch(e){}}return t}(document.cookie)[e];if(void 0!==t)return JSON.parse(t)},save(e,t,n){let r={};"https:"===window.location.protocol&&(r={secure:!0,sameSite:"none"}),(null==n?void 0:n.daysUntilExpire)&&(r.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(r.domain=n.cookieDomain),t0(e,JSON.stringify(t),r)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),t2(e,n)}},t5="_legacy_",t3={get:e=>t1.get(e)||t1.get("".concat(t5).concat(e)),save(e,t,n){let r={};"https:"===window.location.protocol&&(r={secure:!0}),(null==n?void 0:n.daysUntilExpire)&&(r.expires=n.daysUntilExpire),(null==n?void 0:n.cookieDomain)&&(r.domain=n.cookieDomain),t0("".concat(t5).concat(e),JSON.stringify(t),r),t1.save(e,t,n)},remove(e,t){let n={};(null==t?void 0:t.cookieDomain)&&(n.domain=t.cookieDomain),t2(e,n),t1.remove(e,t),t1.remove("".concat(t5).concat(e),t)}},t9={get(e){if("undefined"==typeof sessionStorage)return;let t=sessionStorage.getItem(e);return null!=t?JSON.parse(t):void 0},save(e,t){sessionStorage.setItem(e,JSON.stringify(t))},remove(e){sessionStorage.removeItem(e)}};!function(e){e.Code="code",e.ConnectCode="connect_code"}(t4||(t4={}));var t4,t6,t8=function(e){var t,n,r;return new Worker(t6=t6||(n=(t=function(e,t){var n=atob(e);if(t){for(var r=new Uint8Array(n.length),o=0,i=n.length;o<i;++o)r[o]=n.charCodeAt(o);return String.fromCharCode.apply(null,new Uint16Array(r.buffer))}return n}("Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJdO2lmKG51bGwhPXIpe3ZhciBvLG4scyxhLGk9W10sYz0hMCxsPSExO3RyeXtpZihzPShyPXIuY2FsbChlKSkubmV4dCwwPT09dCl7aWYoT2JqZWN0KHIpIT09cilyZXR1cm47Yz0hMX1lbHNlIGZvcig7IShjPShvPXMuY2FsbChyKSkuZG9uZSkmJihpLnB1c2goby52YWx1ZSksaS5sZW5ndGghPT10KTtjPSEwKTt9Y2F0Y2goZSl7bD0hMCxuPWV9ZmluYWxseXt0cnl7aWYoIWMmJm51bGwhPXIucmV0dXJuJiYoYT1yLnJldHVybigpLE9iamVjdChhKSE9PWEpKXJldHVybn1maW5hbGx5e2lmKGwpdGhyb3cgbn19cmV0dXJuIGl9fSh0LHIpfHxmdW5jdGlvbih0LHIpe2lmKHQpe2lmKCJzdHJpbmciPT10eXBlb2YgdClyZXR1cm4gZSh0LHIpO3ZhciBvPXt9LnRvU3RyaW5nLmNhbGwodCkuc2xpY2UoOCwtMSk7cmV0dXJuIk9iamVjdCI9PT1vJiZ0LmNvbnN0cnVjdG9yJiYobz10LmNvbnN0cnVjdG9yLm5hbWUpLCJNYXAiPT09b3x8IlNldCI9PT1vP0FycmF5LmZyb20odCk6IkFyZ3VtZW50cyI9PT1vfHwvXig/OlVpfEkpbnQoPzo4fDE2fDMyKSg/OkNsYW1wZWQpP0FycmF5JC8udGVzdChvKT9lKHQscik6dm9pZCAwfX0odCxyKXx8ZnVuY3Rpb24oKXt0aHJvdyBuZXcgVHlwZUVycm9yKCJJbnZhbGlkIGF0dGVtcHQgdG8gZGVzdHJ1Y3R1cmUgbm9uLWl0ZXJhYmxlIGluc3RhbmNlLlxuSW4gb3JkZXIgdG8gYmUgaXRlcmFibGUsIG5vbi1hcnJheSBvYmplY3RzIG11c3QgaGF2ZSBhIFtTeW1ib2wuaXRlcmF0b3JdKCkgbWV0aG9kLiIpfSgpfWNsYXNzIHIgZXh0ZW5kcyBFcnJvcntjb25zdHJ1Y3RvcihlLHQpe3N1cGVyKHQpLHRoaXMuZXJyb3I9ZSx0aGlzLmVycm9yX2Rlc2NyaXB0aW9uPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsci5wcm90b3R5cGUpfXN0YXRpYyBmcm9tUGF5bG9hZChlKXtsZXQgdD1lLmVycm9yLG89ZS5lcnJvcl9kZXNjcmlwdGlvbjtyZXR1cm4gbmV3IHIodCxvKX19Y2xhc3MgbyBleHRlbmRzIHJ7Y29uc3RydWN0b3IoZSx0KXtzdXBlcigibWlzc2luZ19yZWZyZXNoX3Rva2VuIiwiTWlzc2luZyBSZWZyZXNoIFRva2VuIChhdWRpZW5jZTogJyIuY29uY2F0KG4oZSxbImRlZmF1bHQiXSksIicsIHNjb3BlOiAnIikuY29uY2F0KG4odCksIicpIikpLHRoaXMuYXVkaWVuY2U9ZSx0aGlzLnNjb3BlPXQsT2JqZWN0LnNldFByb3RvdHlwZU9mKHRoaXMsby5wcm90b3R5cGUpfX1mdW5jdGlvbiBuKGUpe3JldHVybiBlJiYhKGFyZ3VtZW50cy5sZW5ndGg+MSYmdm9pZCAwIT09YXJndW1lbnRzWzFdP2FyZ3VtZW50c1sxXTpbXSkuaW5jbHVkZXMoZSk/ZToiIn0iZnVuY3Rpb24iPT10eXBlb2YgU3VwcHJlc3NlZEVycm9yJiZTdXBwcmVzc2VkRXJyb3I7Y29uc3Qgcz1lPT57dmFyIHQ9ZS5jbGllbnRJZCxyPWZ1bmN0aW9uKGUsdCl7dmFyIHI9e307Zm9yKHZhciBvIGluIGUpT2JqZWN0LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eS5jYWxsKGUsbykmJnQuaW5kZXhPZihvKTwwJiYocltvXT1lW29dKTtpZihudWxsIT1lJiYiZnVuY3Rpb24iPT10eXBlb2YgT2JqZWN0LmdldE93blByb3BlcnR5U3ltYm9scyl7dmFyIG49MDtmb3Iobz1PYmplY3QuZ2V0T3duUHJvcGVydHlTeW1ib2xzKGUpO248by5sZW5ndGg7bisrKXQuaW5kZXhPZihvW25dKTwwJiZPYmplY3QucHJvdG90eXBlLnByb3BlcnR5SXNFbnVtZXJhYmxlLmNhbGwoZSxvW25dKSYmKHJbb1tuXV09ZVtvW25dXSl9cmV0dXJuIHJ9KGUsWyJjbGllbnRJZCJdKTtyZXR1cm4gbmV3IFVSTFNlYXJjaFBhcmFtcygoZT0+T2JqZWN0LmtleXMoZSkuZmlsdGVyKHQ9PnZvaWQgMCE9PWVbdF0pLnJlZHVjZSgodCxyKT0+T2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHQpLHtbcl06ZVtyXX0pLHt9KSkoT2JqZWN0LmFzc2lnbih7Y2xpZW50X2lkOnR9LHIpKSkudG9TdHJpbmcoKX07bGV0IGE9e30saT1udWxsO2NvbnN0IGM9KGUsdCk9PiIiLmNvbmNhdChlLCJ8IikuY29uY2F0KHQpLGw9KGUsdCk9PnQuc3RhcnRzV2l0aCgiIi5jb25jYXQoZSwifCIpKSx1PShlLHQpPT5hW2MoZSx0KV0sZj1lPT57T2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChyPT57bGV0IG89dChyLDIpLG49b1swXTtvWzFdPT09ZSYmZGVsZXRlIGFbbl19KX0saD1lPT57Y29uc3QgdD1uZXcgVVJMU2VhcmNoUGFyYW1zKGUpLHI9e307cmV0dXJuIHQuZm9yRWFjaCgoZSx0KT0+e3JbdF09ZX0pLHJ9LGQ9YXN5bmMgZT0+e2xldCByLG4saT1lLmRhdGEsZj1pLnRpbWVvdXQsZD1pLmF1dGgscD1pLmZldGNoVXJsLHk9aS5mZXRjaE9wdGlvbnMsZz1pLnVzZUZvcm1EYXRhLGI9aS51c2VNcnJ0LE89aS5za2lwVG9rZW5TdG9yYWdlLGs9aS5wcmVzZXJ2ZVJlZnJlc2hUb2tlbixtPXQoZS5wb3J0cywxKVswXSxqPXt9O2NvbnN0IHY9ZHx8e30sXz12LmF1ZGllbmNlLHc9di5zY29wZTt0cnl7Y29uc3QgZT1nP2goeS5ib2R5KTpKU09OLnBhcnNlKHkuYm9keSk7aWYoZS5yZWZyZXNoX3Rva2VufHwicmVmcmVzaF90b2tlbiIhPT1lLmdyYW50X3R5cGUpZS5tZmFfdG9rZW4mJihuPXUoXyx3KSwhbiYmYiYmKG49YS5sYXRlc3RfcmVmcmVzaF90b2tlbikpO2Vsc2V7aWYobj11KF8sdyksIW4mJmIpe2NvbnN0IGU9YS5sYXRlc3RfcmVmcmVzaF90b2tlbix0PSgoZSx0KT0+ISFPYmplY3Qua2V5cyhhKS5maW5kKHI9PntpZigibGF0ZXN0X3JlZnJlc2hfdG9rZW4iIT09cil7Y29uc3Qgbz1sKHQsciksbj1yLnNwbGl0KCJ8IilbMV0uc3BsaXQoIiAiKSxzPWUuc3BsaXQoIiAiKS5ldmVyeShlPT5uLmluY2x1ZGVzKGUpKTtyZXR1cm4gbyYmc319KSkodyxfKTtlJiYhdCYmKG49ZSl9aWYoIW4pdGhyb3cgbmV3IG8oXyx3KTt5LmJvZHk9Zz9zKE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxlKSx7cmVmcmVzaF90b2tlbjpufSkpfWxldCBpLGQ7ImZ1bmN0aW9uIj09dHlwZW9mIEFib3J0Q29udHJvbGxlciYmKGk9bmV3IEFib3J0Q29udHJvbGxlcix5LnNpZ25hbD1pLnNpZ25hbCk7dHJ5e2Q9YXdhaXQgUHJvbWlzZS5yYWNlKFsoUD1mLG5ldyBQcm9taXNlKGU9PnNldFRpbWVvdXQoZSxQKSkpLGZldGNoKHAsT2JqZWN0LmFzc2lnbih7fSx5KSldKX1jYXRjaChlKXtyZXR1cm4gdm9pZCBtLnBvc3RNZXNzYWdlKHtlcnJvcjplLm1lc3NhZ2V9KX1pZighZClyZXR1cm4gaSYmaS5hYm9ydCgpLHZvaWQgbS5wb3N0TWVzc2FnZSh7ZXJyb3I6IlRpbWVvdXQgd2hlbiBleGVjdXRpbmcgJ2ZldGNoJyJ9KTtpZihVPWQuaGVhZGVycyxqPVsuLi5VXS5yZWR1Y2UoKGUscik9PntsZXQgbz10KHIsMiksbj1vWzBdLHM9b1sxXTtyZXR1cm4gZVtuXT1zLGV9LHt9KSxyPWF3YWl0IGQuanNvbigpLE8pcmV0dXJuIGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4sdm9pZCBtLnBvc3RNZXNzYWdlKHtvazpkLm9rLGpzb246cixoZWFkZXJzOmp9KTtyLnJlZnJlc2hfdG9rZW4/KGImJihhLmxhdGVzdF9yZWZyZXNoX3Rva2VuPXIucmVmcmVzaF90b2tlbixTPW4sTT1yLnJlZnJlc2hfdG9rZW4sT2JqZWN0LmVudHJpZXMoYSkuZm9yRWFjaChlPT57bGV0IHI9dChlLDIpLG89clswXTtyWzFdPT09UyYmKGFbb109TSl9KSksKChlLHQscik9PnthW2ModCxyKV09ZX0pKHIucmVmcmVzaF90b2tlbixfLHcpLGRlbGV0ZSByLnJlZnJlc2hfdG9rZW4pOmt8fCgoZSx0KT0+e2RlbGV0ZSBhW2MoZSx0KV19KShfLHcpLG0ucG9zdE1lc3NhZ2Uoe29rOmQub2ssanNvbjpyLGhlYWRlcnM6an0pfWNhdGNoKGUpe20ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOmUuZXJyb3IsZXJyb3JfZGVzY3JpcHRpb246ZS5tZXNzYWdlfSxoZWFkZXJzOmp9KX12YXIgUyxNLFUsUH0scD1hc3luYyBlPT57bGV0IHI9ZS5kYXRhLG89ci50aW1lb3V0LG49ci5hdXRoLGk9ci5mZXRjaFVybCxjPXIuZmV0Y2hPcHRpb25zLHU9ci51c2VGb3JtRGF0YSxkPXQoZS5wb3J0cywxKVswXTtjb25zdCBwPShufHx7fSkuYXVkaWVuY2U7dHJ5e2NvbnN0IGU9KGU9Pntjb25zdCByPW5ldyBTZXQ7cmV0dXJuIE9iamVjdC5lbnRyaWVzKGEpLmZvckVhY2gobz0+e2xldCBuPXQobywyKSxzPW5bMF0sYT1uWzFdO2woZSxzKSYmci5hZGQoYSl9KSxBcnJheS5mcm9tKHIpfSkocCk7aWYoMD09PWUubGVuZ3RoKXJldHVybiB2b2lkIGQucG9zdE1lc3NhZ2Uoe29rOiEwfSk7Y29uc3Qgcj11P2goYy5ib2R5KTpKU09OLnBhcnNlKGMuYm9keSk7Zm9yKGNvbnN0IHQgb2YgZSl7Y29uc3QgZT11P3MoT2JqZWN0LmFzc2lnbihPYmplY3QuYXNzaWduKHt9LHIpLHt0b2tlbjp0fSkpOkpTT04uc3RyaW5naWZ5KE9iamVjdC5hc3NpZ24oT2JqZWN0LmFzc2lnbih7fSxyKSx7dG9rZW46dH0pKTtsZXQgbixhLGwsaDsiZnVuY3Rpb24iPT10eXBlb2YgQWJvcnRDb250cm9sbGVyJiYobj1uZXcgQWJvcnRDb250cm9sbGVyLGE9bi5zaWduYWwpO3RyeXtoPWF3YWl0IFByb21pc2UucmFjZShbbmV3IFByb21pc2UoZT0+e2w9c2V0VGltZW91dChlLG8pfSksZmV0Y2goaSxPYmplY3QuYXNzaWduKE9iamVjdC5hc3NpZ24oe30sYykse2JvZHk6ZSxzaWduYWw6YX0pKV0pLmZpbmFsbHkoKCk9PmNsZWFyVGltZW91dChsKSl9Y2F0Y2goZSl7cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZS5tZXNzYWdlfSl9aWYoIWgpcmV0dXJuIG4mJm4uYWJvcnQoKSx2b2lkIGQucG9zdE1lc3NhZ2Uoe2Vycm9yOiJUaW1lb3V0IHdoZW4gZXhlY3V0aW5nICdmZXRjaCcifSk7aWYoIWgub2spe2xldCBlO3RyeXtjb25zdCB0PUpTT04ucGFyc2UoYXdhaXQgaC50ZXh0KCkpO2U9dC5lcnJvcl9kZXNjcmlwdGlvbn1jYXRjaChlKXt9cmV0dXJuIHZvaWQgZC5wb3N0TWVzc2FnZSh7ZXJyb3I6ZXx8IkhUVFAgZXJyb3IgIi5jb25jYXQoaC5zdGF0dXMpfSl9Zih0KX1kLnBvc3RNZXNzYWdlKHtvazohMH0pfWNhdGNoKGUpe2QucG9zdE1lc3NhZ2Uoe2Vycm9yOmUubWVzc2FnZXx8IlVua25vd24gZXJyb3IgZHVyaW5nIHRva2VuIHJldm9jYXRpb24ifSl9fSx5PShlLHQpPT57aWYoIWkpcmV0dXJuITE7dHJ5e2NvbnN0IHI9bmV3IFVSTChpKS5vcmlnaW4sbz1uZXcgVVJMKGUuZmV0Y2hVcmwpO3JldHVybiBvLm9yaWdpbj09PXImJm8ucGF0aG5hbWU9PT10fWNhdGNoKGUpe3JldHVybiExfX07YWRkRXZlbnRMaXN0ZW5lcigibWVzc2FnZSIsZT0+e2NvbnN0IHI9ZS5kYXRhLG89dChlLnBvcnRzLDEpWzBdO2lmKCEoInR5cGUiaW4gcil8fCJpbml0IiE9PXIudHlwZSlyZXR1cm4idHlwZSJpbiByJiYiY2xlYXIiPT09ci50eXBlPyhhPXt9LHZvaWQobnVsbD09b3x8by5wb3N0TWVzc2FnZSh7b2s6ITB9KSkpOiJ0eXBlImluIHImJiJyZXZva2UiPT09ci50eXBlP3kociwiL29hdXRoL3Jldm9rZSIpP3ZvaWQgcChlKTp2b2lkKG51bGw9PW98fG8ucG9zdE1lc3NhZ2Uoe29rOiExLGpzb246e2Vycm9yOiJpbnZhbGlkX2ZldGNoX3VybCIsZXJyb3JfZGVzY3JpcHRpb246IlVuYXV0aG9yaXplZCBmZXRjaCBVUkwifSxoZWFkZXJzOnt9fSkpOnZvaWQoImZldGNoVXJsImluIHImJnkociwiL29hdXRoL3Rva2VuIik/ZChlKTpudWxsPT1vfHxvLnBvc3RNZXNzYWdlKHtvazohMSxqc29uOntlcnJvcjoiaW52YWxpZF9mZXRjaF91cmwiLGVycm9yX2Rlc2NyaXB0aW9uOiJVbmF1dGhvcml6ZWQgZmV0Y2ggVVJMIn0saGVhZGVyczp7fX0pKTtpZihudWxsPT09aSl0cnl7bmV3IFVSTChyLmFsbG93ZWRCYXNlVXJsKSxpPXIuYWxsb3dlZEJhc2VVcmx9Y2F0Y2goZSl7cmV0dXJufX0pfSgpOwoK",!1)).indexOf("\n",10)+1,r=new Blob([t.substring(n)+""],{type:"application/javascript"}),URL.createObjectURL(r)),e)};class t7{async add(e){var t;let n=new Set((null==(t=await this.cache.get(this.manifestKey))?void 0:t.keys)||[]);n.add(e),await this.cache.set(this.manifestKey,{keys:[...n]})}async remove(e){let t=await this.cache.get(this.manifestKey);if(t){let n=new Set(t.keys);return n.delete(e),n.size>0?await this.cache.set(this.manifestKey,{keys:[...n]}):await this.cache.remove(this.manifestKey)}}get(){return this.cache.get(this.manifestKey)}clear(){return this.cache.remove(this.manifestKey)}createManifestKeyFrom(e){return"".concat(tH,"::").concat(e)}constructor(e,t){this.cache=e,this.clientId=t,this.manifestKey=this.createManifestKeyFrom(this.clientId)}}let ne="auth0.is.authenticated",nt={memory:()=>(new tX).enclosedCache,localstorage:()=>new tV},nn=e=>nt[e],nr=e=>{let t=e.openUrl,n=e.onRedirect;return Object.assign(Object.assign({},eP(e,["openUrl","onRedirect"])),{openUrl:!1===t||t?t:n})},no={NONCE:"nonce",KEYPAIR:"keypair"};class ni{getVersion(){return 1}createDbHandle(){let e=window.indexedDB.open("auth0-spa-js",this.getVersion());return new Promise((t,n)=>{e.onupgradeneeded=()=>Object.values(no).forEach(t=>e.result.createObjectStore(t)),e.onerror=()=>n(e.error),e.onsuccess=()=>t(e.result)})}async getDbHandle(){return this.dbHandle||(this.dbHandle=await this.createDbHandle()),this.dbHandle}async executeDbRequest(e,t,n){let r=n((await this.getDbHandle()).transaction(e,t).objectStore(e));return new Promise((e,t)=>{r.onsuccess=()=>e(r.result),r.onerror=()=>t(r.error)})}buildKey(e){return"".concat(this.clientId,"::").concat(e?"_".concat(e):"auth0")}setNonce(e,t){return this.save(no.NONCE,this.buildKey(t),e)}setKeyPair(e){return this.save(no.KEYPAIR,this.buildKey(),e)}async save(e,t,n){await this.executeDbRequest(e,"readwrite",e=>e.put(n,t))}findNonce(e){return this.find(no.NONCE,this.buildKey(e))}findKeyPair(){return this.find(no.KEYPAIR,this.buildKey())}find(e,t){return this.executeDbRequest(e,"readonly",e=>e.get(t))}async deleteBy(e,t){let n=await this.executeDbRequest(e,"readonly",e=>e.getAllKeys());await Promise.all((null==n?void 0:n.filter(t).map(t=>this.executeDbRequest(e,"readwrite",e=>e.delete(t))))||[])}deleteByClientId(e,t){return this.deleteBy(e,e=>"string"==typeof e&&e.startsWith("".concat(t,"::")))}clearNonces(){return this.deleteByClientId(no.NONCE,this.clientId)}clearKeyPairs(){return this.deleteByClientId(no.KEYPAIR,this.clientId)}constructor(e){this.clientId=e}}class na{getNonce(e){return this.storage.findNonce(e)}setNonce(e,t){return this.storage.setNonce(e,t)}async getOrGenerateKeyPair(){let e=await this.storage.findKeyPair();return e||(e=await async function(e,t){var n;let r;if("string"!=typeof e||0===e.length)throw TypeError('"alg" must be a non-empty string');switch(e){case"PS256":r={name:"RSA-PSS",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":r={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"};break;case"Ed25519":r={name:"Ed25519"};break;default:throw new tR}return crypto.subtle.generateKey(r,null!=(n=null==t?void 0:t.extractable)&&n,["sign","verify"])}("ES256",{extractable:!1}),await this.storage.setKeyPair(e)),e}async generateProof(e){var t;let n,r,o,i,a;return n=(t=Object.assign({keyPair:await this.getOrGenerateKeyPair()},e)).keyPair,r=t.url,o=t.method,i=t.nonce,a=t.accessToken,tj(n,function(e){let t=new URL(e);return t.search="",t.hash="",t.href}(r),o,i,a)}async calculateThumbprint(){return async function(e){var t;let n;if(!tO(e))throw TypeError('"publicKey" must be a public CryptoKey');if(!0!==e.extractable)throw TypeError('"publicKey.extractable" must be true');let o=await tW(e);switch(o.kty){case"EC":n={crv:o.crv,kty:o.kty,x:o.x,y:o.y};break;case"OKP":n={crv:o.crv,kty:o.kty,x:o.x};break;case"RSA":n={e:o.e,kty:o.kty,n:o.n};break;default:throw new tR("unsupported JWK kty")}return t=await crypto.subtle.digest({name:"SHA-256"},tP(JSON.stringify(n))),r(t)}((await this.getOrGenerateKeyPair()).publicKey)}async clear(){await Promise.all([this.storage.clearNonces(),this.storage.clearKeyPairs()])}constructor(e){this.storage=new ni(e)}}!function(e){e.Bearer="Bearer",e.DPoP="DPoP"}(p||(p={}));class ns{isAbsoluteUrl(e){return/^(https?:)?\/\//i.test(e)}buildUrl(e,t){if(t){if(this.isAbsoluteUrl(t))return t;if(e)return"".concat(e.replace(/\/?\/$/,""),"/").concat(t.replace(/^\/+/,""))}throw TypeError("`url` must be absolute or `baseUrl` non-empty.")}getAccessToken(e){return this.config.getAccessToken?this.config.getAccessToken(e):this.hooks.getAccessToken(e)}extractUrl(e){return"string"==typeof e?e:e instanceof URL?e.href:e.url}buildBaseRequest(e,t){if(!this.config.baseUrl)return new Request(e,t);let n=this.buildUrl(this.config.baseUrl,this.extractUrl(e)),r=e instanceof Request?new Request(n,e):n;return new Request(r,t)}setAuthorizationHeader(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:p.Bearer;e.headers.set("authorization","".concat(n," ").concat(t))}async setDpopProofHeader(e,t){if(!this.config.dpopNonceId)return;let n=await this.hooks.getDpopNonce(),r=await this.hooks.generateDpopProof({accessToken:t,method:e.method,nonce:n,url:e.url});e.headers.set("dpop",r)}async prepareRequest(e,t){let n,r,o=await this.getAccessToken(t);if(void 0===o)throw new eB("missing_access_token","No access token available");"string"==typeof o?(n=this.config.dpopNonceId?p.DPoP:p.Bearer,r=o):(n=o.token_type,r=o.access_token),this.setAuthorizationHeader(e,r,n),n===p.DPoP&&await this.setDpopProofHeader(e,r)}getHeader(e,t){return Array.isArray(e)?new Headers(e).get(t)||"":"function"==typeof e.get?e.get(t)||"":e[t]||""}hasUseDpopNonceError(e){if(401!==e.status)return!1;let t=this.getHeader(e.headers,"www-authenticate");return t.includes("invalid_dpop_nonce")||t.includes("use_dpop_nonce")}async handleResponse(e,t){let n=this.getHeader(e.headers,tN);if(n&&await this.hooks.setDpopNonce(n),!this.hasUseDpopNonceError(e))return e;if(!n||!t.onUseDpopNonceError)throw new e8(n);return t.onUseDpopNonceError()}async internalFetchWithAuth(e,t,n,r){let o=this.buildBaseRequest(e,t);await this.prepareRequest(o,r);let i=await this.config.fetch(o);return this.handleResponse(i,n)}fetchWithAuth(e,t,n){let r={onUseDpopNonceError:()=>this.internalFetchWithAuth(e,t,Object.assign(Object.assign({},r),{onUseDpopNonceError:void 0}),n)};return this.internalFetchWithAuth(e,t,r,n)}constructor(e,t){this.hooks=t,this.config=Object.assign(Object.assign({},e),{fetch:e.fetch||("undefined"==typeof window?fetch:window.fetch.bind(window))})}}class nc{async connectAccount(e){let t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/connect"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async completeAccount(e){let t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/connected-accounts/complete"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:connected_accounts"]});return this._handleResponse(t)}async getFactors(){let e=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/factors"),{method:"GET"},{scope:["read:me:factors"]});return(await this._handleResponse(e)).factors}async getAuthenticationMethods(e){let t=e?"?".concat(new URLSearchParams({type:e})):"",n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods").concat(t),{method:"GET"},{scope:["read:me:authentication_methods"]});return(await this._handleResponse(n)).authentication_methods}async getAuthenticationMethod(e){let t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"GET"},{scope:["read:me:authentication_methods"]});return this._handleResponse(t)}async deleteAuthenticationMethod(e){let t=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"DELETE"},{scope:["delete:me:authentication_methods"]});t.ok||await this._handleResponse(t)}async updateAuthenticationMethod(e,t){let n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods/").concat(encodeURIComponent(e)),{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)},{scope:["update:me:authentication_methods"]});return this._handleResponse(n)}async enrollmentChallenge(e){var t;let n=await this.myAccountFetcher.fetchWithAuth("".concat(this.apiBase,"v1/authentication-methods"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)},{scope:["create:me:authentication_methods"]}),r=await this._handleResponse(n),o=null!=(t=n.headers.get("location"))?t:"",i=decodeURIComponent(o.split("/").pop()||"");return Object.assign(Object.assign({},r),{id:i,location:o})}async enrollmentVerify(e){let t=e.location;e.type;let n=eP(e,["location","type"]),r=await this.myAccountFetcher.fetchWithAuth("".concat(t,"/verify"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(n)},{scope:["create:me:authentication_methods"]});return this._handleResponse(r)}async _handleResponse(e){let t;try{t=await e.text(),t=JSON.parse(t)}catch(n){throw new nl({type:"invalid_json",status:e.status,title:"Invalid JSON response",detail:t||String(n)})}if(e.ok)return t;throw new nl(t)}constructor(e,t){this.myAccountFetcher=e,this.apiBase=t}}class nl extends Error{constructor(e){let t=e.type,n=e.status,r=e.title,o=e.detail,i=e.validation_errors;super(o),this.name="MyAccountApiError",this.type=t,this.status=n,this.title=r,this.detail=o,this.validation_errors=i,Object.setPrototypeOf(this,nl.prototype)}}let nu={otp:{authenticatorTypes:["otp"]},sms:{authenticatorTypes:["oob"],oobChannels:["sms"]},email:{authenticatorTypes:["oob"],oobChannels:["email"]},push:{authenticatorTypes:["oob"],oobChannels:["auth0"]},voice:{authenticatorTypes:["oob"],oobChannels:["voice"]}};function nh(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch(e){return!1}}"undefined"!=typeof navigator&&null!=(f=navigator.userAgent)&&null!=(m=f.startsWith)&&m.call(f,"Mozilla/5.0 ")||(o="".concat("oauth4webapi","/").concat("v3.8.6"));let nd="ERR_INVALID_ARG_VALUE",np="ERR_INVALID_ARG_TYPE";function nf(e,t,n){let r=TypeError(e,{cause:n});return Object.assign(r,{code:t}),r}let nm=Symbol(),ny=Symbol(),ng=Symbol(),nw=Symbol(),nv=Symbol(),nb=Symbol(),n_=new TextEncoder,nk=new TextDecoder;function nS(e){return"string"==typeof e?n_.encode(e):nk.decode(e)}function nT(e){return"string"==typeof e?a(e):i(e)}i=Uint8Array.prototype.toBase64?e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0})):e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));let t=[];for(let n=0;n<e.byteLength;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")},a=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw nf("The input to be decoded is not correctly encoded.",nd,e)}}:e=>{try{let t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw nf("The input to be decoded is not correctly encoded.",nd,e)}};class nE extends Error{constructor(e,t){var n;super(e,t),eM(this,"code",void 0),this.name=this.constructor.name,this.code=rg,null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}class nP extends Error{constructor(e,t){var n;super(e,t),eM(this,"code",void 0),this.name=this.constructor.name,null!=t&&t.code&&(this.code=null==t?void 0:t.code),null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}function nC(e,t,n){return new nP(e,{code:t,cause:n})}function nA(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}function nR(e){nh(e,Headers)&&(e=Object.fromEntries(e.entries()));let t=new Headers(null!=e?e:{});if(o&&!t.has("user-agent")&&t.set("user-agent",o),t.has("authorization"))throw nf('"options.headers" must not include the "authorization" header name',nd);return t}function nx(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw nf('"options.signal" must return or be an instance of AbortSignal',np);return t}}function nI(e){return e.includes("//")?e.replace("//","/"):e}async function nO(e,t){return async function(e,t,n,r){if(!(e instanceof URL))throw nf('"'.concat(t,'" must be an instance of URL'),np);nH(e,!0!==(null==r?void 0:r[nm]));let o=n(new URL(e.href)),i=nR(null==r?void 0:r.headers);return i.set("accept","application/json"),((null==r?void 0:r[nw])||fetch)(o.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:nx(o,null==r?void 0:r.signal)})}(e,"issuerIdentifier",e=>{switch(null==t?void 0:t.algorithm){case void 0:case"oidc":e.pathname=nI("".concat(e.pathname,"/").concat(".well-known/openid-configuration"));break;case"oauth2":!function(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];"/"===e.pathname?e.pathname=t:e.pathname=nI("".concat(t,"/").concat(n?e.pathname:e.pathname.replace(/(\/)$/,"")))}(e,".well-known/oauth-authorization-server");break;default:throw nf('"options.algorithm" must be "oidc" (default), or "oauth2"',nd)}return e},t)}function nj(e,t,n,r,o){try{if("number"!=typeof e||!Number.isFinite(e))throw nf("".concat(n," must be a number"),np,o);if(e>0)return;if(t){if(0!==e)throw nf("".concat(n," must be a non-negative number"),nd,o);return}throw nf("".concat(n," must be a positive number"),nd,o)}catch(e){if(r)throw nC(e.message,r,o);throw e}}function nW(e,t,n,r){try{if("string"!=typeof e)throw nf("".concat(t," must be a string"),np,r);if(0===e.length)throw nf("".concat(t," must not be empty"),nd,r)}catch(e){if(n)throw nC(e.message,n,r);throw e}}function nN(e){var t="application/json";if(n9(e)!==t)throw function(e){let t='"response" content-type must be ';for(var n=arguments.length,r=Array(n>1?n-1:0),o=1;o<n;o++)r[o-1]=arguments[o];if(r.length>2){let e=r.pop();t+="".concat(r.join(", "),", or ").concat(e)}else 2===r.length?t+="".concat(r[0]," or ").concat(r[1]):t+=r[0];return nC(t,rk,e)}(e,t)}function nU(){return nT(crypto.getRandomValues(new Uint8Array(32)))}function nM(e){let t=null==e?void 0:e[ny];return"number"==typeof t&&Number.isFinite(t)?t:0}function nL(e){let t=null==e?void 0:e[ng];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function nK(){return Math.floor(Date.now()/1e3)}function nz(e){if("object"!=typeof e||null===e)throw nf('"as" must be an object',np);nW(e.issuer,'"as.issuer"')}function nJ(e){if("object"!=typeof e||null===e)throw nf('"client" must be an object',np);nW(e.client_id,'"client.client_id"')}function nD(e){return nW(e,'"clientSecret"'),(t,n,r,o)=>{r.set("client_id",n.client_id),r.set("client_secret",e)}}let nZ=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch(e){return null}};function nH(e,t){if(t&&"https:"!==e.protocol)throw nC("only requests to HTTPS are allowed",rT,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw nC("only HTTP and HTTPS requests are allowed",rE,e)}function nF(e,t,n,r){let o;if("string"!=typeof e||!(o=nZ(e)))throw nC("authorization server metadata does not contain a valid ".concat(n?'"as.mtls_endpoint_aliases.'.concat(t,'"'):'"as.'.concat(t,'"')),void 0===e?rR:rx,{attribute:n?"mtls_endpoint_aliases.".concat(t):t});return nH(o,r),o}function nG(e,t,n,r){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?nF(e.mtls_endpoint_aliases[t],t,n,r):nF(e[t],t,n,r)}class nV extends Error{constructor(e,t){var n;super(e,t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"error",void 0),eM(this,"status",void 0),eM(this,"error_description",void 0),eM(this,"response",void 0),this.name=this.constructor.name,this.code=ry,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}class nX extends Error{constructor(e,t){var n,r;super(e,t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"error",void 0),eM(this,"error_description",void 0),this.name=this.constructor.name,this.code=rw,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=null!=(n=t.cause.get("error_description"))?n:void 0,null==(r=Error.captureStackTrace)||r.call(Error,this,this.constructor)}}class nY extends Error{constructor(e,t){var n;super(e,t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"response",void 0),eM(this,"status",void 0),this.name=this.constructor.name,this.code=rm,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}let nq="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",nB=RegExp("^[,\\s]*("+nq+")"),nQ=RegExp("^[,\\s]*("+nq+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"[,\\s]*(.*)'),n$=RegExp("^[,\\s]*"+("("+nq+")\\s*=\\s*(")+nq+")[,\\s]*(.*)"),n0=RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function n2(e,t,n){if(e.status!==t){var r;let t;if(rr(e),t=await async function(e){if(e.status>399&&e.status<500){rO(e),nN(e);try{let t=await e.clone().json();if(nA(t)&&"string"==typeof t.error&&t.error.length)return t}catch(e){}}}(e))throw await (null==(r=e.body)?void 0:r.cancel()),new nV("server responded with an error in the response body",{cause:t,response:e});throw nC('"response" is not a conform '.concat(n," response (unexpected HTTP status code)"),rS,e)}}function n1(e){if(!rc.has(e))throw nf('"options.DPoP" is not a valid DPoPHandle',nd)}async function n5(e,t,n,r){nz(e),nJ(t);let o=nG(e,"userinfo_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==r?void 0:r[nm])),i=nR(null==r?void 0:r.headers);return t.userinfo_signed_response_alg?i.set("accept","application/jwt"):(i.set("accept","application/json"),i.append("accept","application/jwt")),async function(e,t,n,r,o,i){var a;if(nW(e,'"accessToken"'),!(n instanceof URL))throw nf('"url" must be an instance of URL',np);nH(n,!0!==(null==i?void 0:i[nm])),r=nR(r),null!=i&&i.DPoP&&(n1(i.DPoP),await i.DPoP.addProof(n,r,"GET",e)),r.set("authorization","".concat(r.has("dpop")?"DPoP":"Bearer"," ").concat(e));let s=await ((null==i?void 0:i[nw])||fetch)(n.href,{duplex:nh(null,ReadableStream)?"half":void 0,body:null,headers:Object.fromEntries(r.entries()),method:"GET",redirect:"manual",signal:nx(n,null==i?void 0:i.signal)});return null==i||null==(a=i.DPoP)||a.cacheNonce(s,n),s}(n,"GET",o,i,null,eK(eK({},r),{},{[ny]:nM(t)}))}let n3=Symbol();function n9(e){var t;return null==(t=e.headers.get("content-type"))?void 0:t.split(";")[0]}async function n4(e,t,n,r,o){let i;if(nz(e),nJ(t),!nh(r,Response))throw nf('"response" must be an instance of Response',np);if(rr(r),200!==r.status)throw nC('"response" is not a conform UserInfo Endpoint response (unexpected HTTP status code)',rS,r);if(rO(r),"application/jwt"===n9(r)){let n=await rW(await r.text(),rU.bind(void 0,t.userinfo_signed_response_alg,e.userinfo_signing_alg_values_supported,void 0),nM(t),nL(t),null==o?void 0:o[nb]).then(ro.bind(void 0,t.client_id)).then(ra.bind(void 0,e)),a=n.claims,s=n.jwt;re.set(r,s),i=a}else{if(t.userinfo_signed_response_alg)throw nC("JWT UserInfo Response expected",rv,r);i=await rz(r)}if(nW(i.sub,'"response" body "sub" property',r_,{body:i}),n===n3);else if(nW(n,'"expectedSubject"'),i.sub!==n)throw nC('unexpected "response" body "sub" property value',rA,{expected:n,body:i,attribute:"sub"});return i}async function n6(e,t,n,r,o,i,a){return await n(e,t,o,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),((null==a?void 0:a[nw])||fetch)(r.href,{body:o,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:nx(r,null==a?void 0:a.signal)})}async function n8(e,t,n,r,o,i){var a;let s=nG(e,"token_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==i?void 0:i[nm]));o.set("grant_type",r);let c=nR(null==i?void 0:i.headers);c.set("accept","application/json"),void 0!==(null==i?void 0:i.DPoP)&&(n1(i.DPoP),await i.DPoP.addProof(s,c,"POST"));let l=await n6(e,t,n,s,o,c,i);return null==i||null==(a=i.DPoP)||a.cacheNonce(l,s),l}let n7=new WeakMap,re=new WeakMap;function rt(e){if(!e.id_token)return;let t=n7.get(e);if(!t)throw nf('"ref" was already garbage collected or did not resolve from the proper sources',nd);return t}async function rn(e,t,n,r,o,i){if(nz(e),nJ(t),!nh(n,Response))throw nf('"response" must be an instance of Response',np);await n2(n,200,"Token Endpoint"),rO(n);let a=await rz(n);if(nW(a.access_token,'"response" body "access_token" property',r_,{body:a}),nW(a.token_type,'"response" body "token_type" property',r_,{body:a}),a.token_type=a.token_type.toLowerCase(),void 0!==a.expires_in){let e="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;nj(e,!0,'"response" body "expires_in" property',r_,{body:a}),a.expires_in=e}if(void 0!==a.refresh_token&&nW(a.refresh_token,'"response" body "refresh_token" property',r_,{body:a}),void 0!==a.scope&&"string"!=typeof a.scope)throw nC('"response" body "scope" property must be a string',r_,{body:a});if(void 0!==a.id_token){nW(a.id_token,'"response" body "id_token" property',r_,{body:a});let i=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&i.push("auth_time"),void 0!==t.default_max_age&&(nj(t.default_max_age,!0,'"client.default_max_age"'),i.push("auth_time")),null!=r&&r.length&&i.push(...r);let s=await rW(a.id_token,rU.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),nM(t),nL(t),o).then(rh.bind(void 0,i)).then(rs.bind(void 0,e)).then(ri.bind(void 0,t.client_id)),c=s.claims,l=s.jwt;if(Array.isArray(c.aud)&&1!==c.aud.length){if(void 0===c.azp)throw nC('ID Token "aud" (audience) claim includes additional untrusted audiences',rC,{claims:c,claim:"aud"});if(c.azp!==t.client_id)throw nC('unexpected ID Token "azp" (authorized party) claim value',rC,{expected:t.client_id,claims:c,claim:"azp"})}void 0!==c.auth_time&&nj(c.auth_time,!0,'ID Token "auth_time" (authentication time)',r_,{claims:c}),re.set(n,l),n7.set(a,c)}if(void 0!==(null==i?void 0:i[a.token_type]))i[a.token_type](n,a);else if("dpop"!==a.token_type&&"bearer"!==a.token_type)throw new nE("unsupported `token_type` value",{cause:{body:a}});return a}function rr(e){let t;if(t=function(e){if(!nh(e,Response))throw nf('"response" must be an instance of Response',np);let t=e.headers.get("www-authenticate");if(null===t)return;let n=[],r=t;for(;r;){let e,t=r.match(nB),c=null==(o=t)?void 0:o[1].toLowerCase();if(!c)return;let l=r.substring(t[0].length);if(l&&!l.match(/^[\s,]/))return;let u=l.match(/^\s+(.*)$/),h=!!u;r=u?u[1]:void 0;let d={};if(h)for(;r;){let n,c;if(t=r.match(nQ)){var o,i=eJ(t,4);if(n=i[1],c=i[2],r=i[3],c.includes("\\"))try{c=JSON.parse('"'.concat(c,'"'))}catch(e){}d[n.toLowerCase()]=c}else{if(!(t=r.match(n$))){if(t=r.match(n0)){if(Object.keys(d).length)break;var a=eJ(t,3);e=a[1],r=a[2];break}return}var s=eJ(t,4);n=s[1],c=s[2],r=s[3],d[n.toLowerCase()]=c}}else r=l||void 0;let p={scheme:c,parameters:d};e&&(p.token68=e),n.push(p)}return n.length?n:void 0}(e))throw new nY("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}function ro(e,t){return void 0!==t.claims.aud?ri(e,t):t}function ri(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw nC('unexpected JWT "aud" (audience) claim value',rC,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw nC('unexpected JWT "aud" (audience) claim value',rC,{expected:e,claims:t.claims,claim:"aud"});return t}function ra(e,t){return void 0!==t.claims.iss?rs(e,t):t}function rs(e,t){var n,r;let o=null!=(n=null==(r=e[rD])?void 0:r.call(e,t))?n:e.issuer;if(t.claims.iss!==o)throw nC('unexpected JWT "iss" (issuer) claim value',rC,{expected:o,claims:t.claims,claim:"iss"});return t}let rc=new WeakSet,rl=Symbol(),ru={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function rh(e,t){for(let n of e)if(void 0===t.claims[n])throw nC('JWT "'.concat(n,'" (').concat(ru[n],") claim missing"),r_,{claims:t.claims});return t}let rd=Symbol(),rp=Symbol();async function rf(e,t,n,r){return"string"==typeof(null==r?void 0:r.expectedNonce)||"number"==typeof(null==r?void 0:r.maxAge)||null!=r&&r.requireIdToken?async function(e,t,n,r,o,i,a){let s=[];switch(r){case void 0:r=rd;break;case rd:break;default:nW(r,'"expectedNonce" argument'),s.push("nonce")}switch(null!=o||(o=t.default_max_age),o){case void 0:o=rp;break;case rp:break;default:nj(o,!0,'"maxAge" argument'),s.push("auth_time")}let c=await rn(e,t,n,s,i,a);nW(c.id_token,'"response" body "id_token" property',r_,{body:c});let l=rt(c);if(o!==rp){let e=nK()+nM(t),n=nL(t);if(l.auth_time+o<e-n)throw nC("too much time has elapsed since the last End-User authentication",rP,{claims:l,now:e,tolerance:n,claim:"auth_time"})}if(r===rd){if(void 0!==l.nonce)throw nC('unexpected ID Token "nonce" claim value',rC,{expected:void 0,claims:l,claim:"nonce"})}else if(l.nonce!==r)throw nC('unexpected ID Token "nonce" claim value',rC,{expected:r,claims:l,claim:"nonce"});return c}(e,t,n,r.expectedNonce,r.maxAge,r[nb],r.recognizedTokenTypes):async function(e,t,n,r,o){let i=await rn(e,t,n,void 0,r,o),a=rt(i);if(a){if(void 0!==t.default_max_age){nj(t.default_max_age,!0,'"client.default_max_age"');let e=nK()+nM(t),n=nL(t);if(a.auth_time+t.default_max_age<e-n)throw nC("too much time has elapsed since the last End-User authentication",rP,{claims:a,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==a.nonce)throw nC('unexpected ID Token "nonce" claim value',rC,{expected:void 0,claims:a,claim:"nonce"})}return i}(e,t,n,null==r?void 0:r[nb],null==r?void 0:r.recognizedTokenTypes)}let rm="OAUTH_WWW_AUTHENTICATE_CHALLENGE",ry="OAUTH_RESPONSE_BODY_ERROR",rg="OAUTH_UNSUPPORTED_OPERATION",rw="OAUTH_AUTHORIZATION_RESPONSE_ERROR",rv="OAUTH_JWT_USERINFO_EXPECTED",rb="OAUTH_PARSE_ERROR",r_="OAUTH_INVALID_RESPONSE",rk="OAUTH_RESPONSE_IS_NOT_JSON",rS="OAUTH_RESPONSE_IS_NOT_CONFORM",rT="OAUTH_HTTP_REQUEST_FORBIDDEN",rE="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",rP="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",rC="OAUTH_JWT_CLAIM_COMPARISON_FAILED",rA="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",rR="OAUTH_MISSING_SERVER_METADATA",rx="OAUTH_INVALID_SERVER_METADATA";async function rI(e){if(!nh(e,Response))throw nf('"response" must be an instance of Response',np);await n2(e,200,"Revocation Endpoint")}function rO(e){if(e.bodyUsed)throw nf('"response" body has been used already',nd)}function rj(e){let t=e.algorithm;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new nE("unsupported ".concat(t.name," modulusLength"),{cause:e})}async function rW(e,t,n,r,o){let i,a,s=e.split("."),c=s[0],l=s[1],u=s.length;if(5===u){if(void 0===o)throw new nE("JWE decryption is not configured",{cause:e});var h=(e=await o(e)).split(".");c=h[0],l=h[1],u=h.length}if(3!==u)throw nC("Invalid JWT",r_,e);try{i=JSON.parse(nS(nT(c)))}catch(e){throw nC("failed to parse JWT Header body as base64url encoded JSON",rb,e)}if(!nA(i))throw nC("JWT Header must be a top level object",r_,e);if(t(i),void 0!==i.crit)throw new nE('no JWT "crit" header parameter extensions are supported',{cause:{header:i}});try{a=JSON.parse(nS(nT(l)))}catch(e){throw nC("failed to parse JWT Payload body as base64url encoded JSON",rb,e)}if(!nA(a))throw nC("JWT Payload must be a top level object",r_,e);let d=nK()+n;if(void 0!==a.exp){if("number"!=typeof a.exp)throw nC('unexpected JWT "exp" (expiration time) claim type',r_,{claims:a});if(a.exp<=d-r)throw nC('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',rP,{claims:a,now:d,tolerance:r,claim:"exp"})}if(void 0!==a.iat&&"number"!=typeof a.iat)throw nC('unexpected JWT "iat" (issued at) claim type',r_,{claims:a});if(void 0!==a.iss&&"string"!=typeof a.iss)throw nC('unexpected JWT "iss" (issuer) claim type',r_,{claims:a});if(void 0!==a.nbf){if("number"!=typeof a.nbf)throw nC('unexpected JWT "nbf" (not before) claim type',r_,{claims:a});if(a.nbf>d+r)throw nC('unexpected JWT "nbf" (not before) claim value',rP,{claims:a,now:d,tolerance:r,claim:"nbf"})}if(void 0!==a.aud&&"string"!=typeof a.aud&&!Array.isArray(a.aud))throw nC('unexpected JWT "aud" (audience) claim type',r_,{claims:a});return{header:i,claims:a,jwt:e}}async function rN(e){if("POST"!==e.method)throw nf("form_post responses are expected to use the POST method",nd,{cause:e});if("application/x-www-form-urlencoded"!==n9(e))throw nf("form_post responses are expected to use the application/x-www-form-urlencoded content-type",nd,{cause:e});return async function(e){if(e.bodyUsed)throw nf("form_post Request instances must contain a readable body",nd,{cause:e});return e.text()}(e)}function rU(e,t,n,r){if(void 0===e)if(Array.isArray(t)){if(!t.includes(r.alg))throw nC('unexpected JWT "alg" header parameter',r_,{header:r,expected:t,reason:"authorization server metadata"})}else{if(void 0===n)throw nC('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n});if("string"==typeof n?r.alg!==n:"function"==typeof n?!n(r.alg):!n.includes(r.alg))throw nC('unexpected JWT "alg" header parameter',r_,{header:r,expected:n,reason:"default value"})}else if("string"==typeof e?r.alg!==e:!e.includes(r.alg))throw nC('unexpected JWT "alg" header parameter',r_,{header:r,expected:e,reason:"client configuration"})}function rM(e,t){let n=e.getAll(t),r=n[0];if(n.length>1)throw nC('"'.concat(t,'" parameter must be provided only once'),r_);return r}let rL=Symbol(),rK=Symbol();async function rz(e){let t,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:nN;try{t=await e.json()}catch(t){throw n(e),nC('failed to parse "response" body as JSON',rb,t)}if(!nA(t))throw nC('"response" body must be a top level object',r_,{body:t});return t}let rJ=Symbol(),rD=Symbol(),rZ=new TextEncoder,rH=new TextDecoder,rF=new TextDecoder("utf-8",{fatal:!0});function rG(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];let r=new Uint8Array(t.reduce((e,t)=>e+t.length,0)),o=0;for(let e of t)r.set(e,o),o+=e.length;return r}function rV(e){let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r>127)throw TypeError("non-ASCII string encountered in encode()");t[n]=r}return t}let rX=function(e){return TypeError("CryptoKey does not support this operation, its ".concat(arguments.length>1&&void 0!==arguments[1]?arguments[1]:"algorithm.name"," must be ").concat(e))},rY=function(e,t){for(var n=arguments.length,r=Array(n>2?n-2:0),o=2;o<n;o++)r[o-2]=arguments[o];return function(e,t){for(var n,r=arguments.length,o=Array(r>2?r-2:0),i=2;i<r;i++)o[i-2]=arguments[i];if(o.length>2){let t=o.pop();e+="one of type ".concat(o.join(", "),", or ").concat(t,".")}else 2===o.length?e+="one of type ".concat(o[0]," or ").concat(o[1],"."):e+="of type ".concat(o[0],".");return null==t?e+=" Received ".concat(t):"function"==typeof t&&t.name?e+=" Received function ".concat(t.name):"object"==typeof t&&null!=t&&null!=(n=t.constructor)&&n.name&&(e+=" Received an instance of ".concat(t.constructor.name)),e}("Key for the ".concat(e," algorithm must be "),t,...r)};class rq extends Error{constructor(e,t){var n;super(e,t),eM(this,"code","ERR_JOSE_GENERIC"),this.name=this.constructor.name,null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}eM(rq,"code","ERR_JOSE_GENERIC");class rB extends rq{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:r,payload:t}}),eM(this,"code","ERR_JWT_CLAIM_VALIDATION_FAILED"),eM(this,"claim",void 0),eM(this,"reason",void 0),eM(this,"payload",void 0),this.claim=n,this.reason=r,this.payload=t}}eM(rB,"code","ERR_JWT_CLAIM_VALIDATION_FAILED");class rQ extends rq{constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"unspecified",r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:"unspecified";super(e,{cause:{claim:n,reason:r,payload:t}}),eM(this,"code","ERR_JWT_EXPIRED"),eM(this,"claim",void 0),eM(this,"reason",void 0),eM(this,"payload",void 0),this.claim=n,this.reason=r,this.payload=t}}eM(rQ,"code","ERR_JWT_EXPIRED");class r$ extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JOSE_ALG_NOT_ALLOWED")}}eM(r$,"code","ERR_JOSE_ALG_NOT_ALLOWED");class r0 extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JOSE_NOT_SUPPORTED")}}eM(r0,"code","ERR_JOSE_NOT_SUPPORTED"),eM(class extends rq{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"decryption operation failed",arguments.length>1?arguments[1]:void 0),eM(this,"code","ERR_JWE_DECRYPTION_FAILED")}},"code","ERR_JWE_DECRYPTION_FAILED"),eM(class extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JWE_INVALID")}},"code","ERR_JWE_INVALID");class r2 extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JWS_INVALID")}}eM(r2,"code","ERR_JWS_INVALID");class r1 extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JWT_INVALID")}}eM(r1,"code","ERR_JWT_INVALID"),eM(class extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JWK_INVALID")}},"code","ERR_JWK_INVALID");class r5 extends rq{constructor(){super(...arguments),eM(this,"code","ERR_JWKS_INVALID")}}eM(r5,"code","ERR_JWKS_INVALID");class r3 extends rq{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"no applicable key found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),eM(this,"code","ERR_JWKS_NO_MATCHING_KEY")}}eM(r3,"code","ERR_JWKS_NO_MATCHING_KEY");class r9 extends rq{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"multiple matching keys found in the JSON Web Key Set",arguments.length>1?arguments[1]:void 0),eM(this,Symbol.asyncIterator,eD(function*(){})),eM(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS")}}eM(r9,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");class r4 extends rq{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"request timed out",arguments.length>1?arguments[1]:void 0),eM(this,"code","ERR_JWKS_TIMEOUT")}}eM(r4,"code","ERR_JWKS_TIMEOUT");class r6 extends rq{constructor(){super(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"signature verification failed",arguments.length>1?arguments[1]:void 0),eM(this,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED")}}eM(r6,"code","ERR_JWS_SIGNATURE_VERIFICATION_FAILED");let r8=e=>{if("CryptoKey"===(null==e?void 0:e[Symbol.toStringTag]))return!0;try{return e instanceof CryptoKey}catch(e){return!1}};function r7(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}let oe="The input to be decoded is not correctly encoded.";function ot(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64("string"==typeof e?e:rH.decode(e),{alphabet:"base64url"})}catch(e){throw TypeError(oe,{cause:e})}let t=e;if(t instanceof Uint8Array&&(t=rH.decode(t)),t.includes("+")||t.includes("/"))throw TypeError(oe);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return r7(t)}catch(e){throw TypeError(oe)}}function on(e){let t=e;return"string"==typeof t&&(t=rZ.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:!0}):(function(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=[];for(let n=0;n<e.length;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join(""))})(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function or(e){if("object"!=typeof e||null===e||"[object Object]"!==Object.prototype.toString.call(e))return!1;let t=Object.getPrototypeOf(e);return null===t||null===Object.getPrototypeOf(t)}function oo(e){return or(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(or)}function oi(e,t,n){try{return ot(e)}catch(e){throw new n("Failed to base64url decode the ".concat(t))}}async function oa(e,t){var n,r,o,i;if("RSA"===t.kty&&"oth"in t&&void 0!==t.oth)throw new r0('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new r0('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let a=null!=(n=null==(r=e.resolve)?void 0:r.call(e,{kty:t.kty,crv:t.crv}))?n:e.subtle,s=!(!t.d&&!t.priv),c=eK({},t);return"AKP"!==c.kty&&delete c.alg,delete c.use,crypto.subtle.importKey("jwk",c,a,null!=(o=t.ext)?o:!s,null!=(i=t.key_ops)?i:e.usages[+!!s])}function os(e){return eK({__proto__:null},e)}let oc=e=>e[Symbol.toStringTag],ol={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function ou(e,t,n){s||(s=new WeakMap);let r=s.get(e);return n&&(r?r[t]=n:s.set(e,{[t]:n})),null!=n?n:null==r?void 0:r[t]}let oh=async(e,t,n)=>{var r;return null!=(r=ou(e,n.alg))?r:ou(e,n.alg,await oa(n,eK(eK({},t),{},{alg:n.alg})))};async function od(e,t,n){let r=function(e,t,n){let r=e.alg,o=e.secret,i="decrypt"===n||"sign"===n;if(o&&t instanceof Uint8Array)return[0,t];if(or(t)){let a=function(e){let t=os(e);if(void 0!==t.ext&&"boolean"!=typeof t.ext)throw TypeError('"ext" (Extractable) Parameter must be a boolean');if(void 0!==t.key_ops){let e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>"string"!=typeof e)||new Set(n).size!==n.length)throw TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}(t);if("string"!=typeof a.kty)throw TypeError(o?rY(r,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):rY(r,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(o?"oct"===a.kty&&"string"==typeof a.k:"oct"!==a.kty&&(i?"AKP"===a.kty&&"string"==typeof a.priv||"string"==typeof a.d:void 0===a.d&&void 0===a.priv)))throw TypeError(o?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':"JSON Web Key for this operation must be a ".concat(i?"private":"public"," JWK"));return((e,t,n)=>{let r=e.alg;if(void 0!==t.use){let e="sign"===n||"verify"===n?"sig":"enc";if(t.use!==e)throw TypeError('Invalid key for this operation, its "use" must be "'.concat(e,'" when present'))}if(void 0!==t.alg&&t.alg!==r)throw TypeError('Invalid key for this operation, its "alg" must be "'.concat(r,'" when present'));if(Array.isArray(t.key_ops)){var o;let r="encrypt"===n||"decrypt"===n?null==(o=e.ops)?void 0:o[+("encrypt"!==n)]:n;if(r&&!t.key_ops.includes(r))throw TypeError('Invalid key for this operation, its "key_ops" must include "'.concat(r,'" when present'))}})(e,a,n),[3,t,a]}if(!(r8(t)||"KeyObject"===(null==t?void 0:t[Symbol.toStringTag])))throw TypeError(o?rY(r,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):rY(r,t,"CryptoKey","KeyObject","JSON Web Key"));if(o){if("secret"!==t.type)throw TypeError("".concat(oc(t),' instances for symmetric algorithms must be of type "secret"'))}else{if("secret"===t.type)throw TypeError("".concat(oc(t),' instances for asymmetric algorithms must not be of type "secret"'));let e=i?"private":"public";if(("public"===t.type||"private"===t.type)&&t.type!==e){let r="sign"===n?"signing":"verify"===n?"verifying":"".concat(n.slice(0,-1),"tion");throw TypeError("".concat(oc(t)," instances for asymmetric algorithm ").concat(r,' must be of type "').concat(e,'"'))}}return r8(t)?[1,t]:[2,t]}(e,t,n);switch(r[0]){case 0:case 1:return r[1];case 3:{let t=r[1],n=r[2];if("oct"===n.kty)return ot(n.k);if(!Object.isFrozen(t)){let e=t.key_ops;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}return oh(t,n,e)}case 2:{let t=r[1];return"secret"===t.type?t.export():"toCryptoKey"in t&&"function"==typeof t.toCryptoKey?((e,t)=>{var n,r,o;let i=ou(e,t.alg);if(i)return i;let a="public"===e.type,s=t.usages[+!a],c=e.asymmetricKeyType,l=ol[null==(n=e.asymmetricKeyDetails)?void 0:n.namedCurve],u=null!=(r=null==(o=t.resolve)?void 0:o.call(t,{crv:l,asymmetricKeyType:c}))?r:t.subtle;return ou(e,t.alg,e.toCryptoKey(u,a,s))})(t,e):oh(t,t.export({format:"jwk"}),e)}}}function op(e){let t={__proto__:null};for(let n in e)t[n]=eK(eK({},e[n]),{},{alg:n});return t}let of=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],om=[[],["deriveBits"]],oy=[[],[]];function og(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:"SHA-".concat(e)},usages:of,ops:["wrapKey","unwrapKey"]}}function ow(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:e=>{let t=e.kty,n=e.crv,r=e.asymmetricKeyType;if("X25519"===n||"x25519"===r)return{name:"X25519"};if("OKP"===t)throw new r0('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:n}},usages:om,ops:[void 0,"deriveBits"]}}function ov(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:oy,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function ob(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:oy,ops:["deriveBits","deriveBits"]}}let o_=op({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:oy,ops:["encrypt","decrypt"]},"RSA-OAEP":og(1),"RSA-OAEP-256":og(256),"RSA-OAEP-384":og(384),"RSA-OAEP-512":og(512),"ECDH-ES":ow(),"ECDH-ES+A128KW":ow(),"ECDH-ES+A192KW":ow(),"ECDH-ES+A256KW":ow(),A128KW:ov(128),A192KW:ov(192),A256KW:ov(256),A128GCMKW:ov(128,!0),A192GCMKW:ov(192,!0),A256GCMKW:ov(256,!0),"PBES2-HS256+A128KW":ob(),"PBES2-HS384+A192KW":ob(),"PBES2-HS512+A256KW":ob()}),ok=["encrypt","decrypt"];function oS(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:oy,ops:ok,cekBits:e,ivBits:t?128:96,cbc:t}}op({A128GCM:oS(128),A192GCM:oS(192),A256GCM:oS(256),"A128CBC-HS256":oS(256,!0),"A192CBC-HS384":oS(384,!0),"A256CBC-HS512":oS(512,!0)});let oT={__proto__:null,b64:!0};function oE(e,t,n,r,o){if(void 0!==o.crit&&void 0===(null==r?void 0:r.crit))throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!r||void 0===r.crit)return[];if(!Array.isArray(r.crit)||0===r.crit.length||r.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i=void 0===n?t:eK(eK({__proto__:null},n),t);for(let t of r.crit){if(!(t in i))throw new r0('Extension Header Parameter "'.concat(t,'" is not recognized'));if(!Object.hasOwn(o,t)||void 0===o[t])throw new e('Extension Header Parameter "'.concat(t,'" is missing'));if(i[t]&&(!Object.hasOwn(r,t)||void 0===r[t]))throw new e('Extension Header Parameter "'.concat(t,'" MUST be integrity protected'))}return r.crit}function oP(e,t){if(t.includes("b64")){let t=e.b64;if("boolean"!=typeof t)throw new r2('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return t}return!0}"undefined"!=typeof navigator&&null!=(y=navigator.userAgent)&&null!=(g=y.startsWith)&&g.call(y,"Mozilla/5.0 ")||(c={"user-agent":"".concat("openid-client","/").concat("v6.8.4")});let oC=e=>l.get(e);function oA(e){return void 0!==e?nD(e):(u||(u=new WeakMap),(e,t,n,r)=>{let o;return(o=u.get(t))||(!function(e,t){if("string"!=typeof e)throw oI("".concat(t," must be a string"),ox);if(0===e.length)throw oI("".concat(t," must not be empty"),oR)}(t.client_secret,'"metadata.client_secret"'),o=nD(t.client_secret),u.set(t,o)),o(e,t,n,r)})}let oR="ERR_INVALID_ARG_VALUE",ox="ERR_INVALID_ARG_TYPE";function oI(e,t,n){let r=TypeError(e,{cause:n});return Object.assign(r,{code:t}),r}class oO extends Error{constructor(e,t){var n;super(e,t),eM(this,"code",void 0),this.name=this.constructor.name,this.code=null==t?void 0:t.code,null==(n=Error.captureStackTrace)||n.call(Error,this,this.constructor)}}function oj(e,t,n){return new oO(e,{cause:t,code:n})}function oW(e){if(e instanceof TypeError||e instanceof oO||e instanceof nV||e instanceof nX||e instanceof nY)throw e;if(e instanceof nP)switch(e.code){case rT:throw oj("only requests to HTTPS are allowed",e,e.code);case rE:throw oj("only requests to HTTP or HTTPS are allowed",e,e.code);case rS:throw oj("unexpected HTTP response status code",e.cause,e.code);case rk:throw oj("unexpected response content-type",e.cause,e.code);case rb:throw oj("parsing error occured",e,e.code);case r_:throw oj("invalid response encountered",e,e.code);case rC:throw oj("unexpected JWT claim value encountered",e,e.code);case rA:throw oj("unexpected JSON attribute value encountered",e,e.code);case rP:throw oj("JWT timestamp claim value failed validation",e,e.code);default:throw oj(e.message,e,e.code)}if(e instanceof nE)throw oj("unsupported operation",e,e.code);if(e instanceof DOMException)switch(e.name){case"OperationError":throw oj("runtime operation error",e,rg);case"NotSupportedError":throw oj("runtime unsupported operation",e,rg);case"TimeoutError":throw oj("operation timed out",e,"OAUTH_TIMEOUT");case"AbortError":throw oj("operation aborted",e,"OAUTH_ABORT")}throw new oO("something went wrong",{cause:e})}async function oN(e,t,n,r,o){let i=new oM(await async function(e,t){var n,r,o;if(!(e instanceof URL))throw oI('"server" must be an instance of URL',ox);let i=!e.href.includes("/.well-known/"),a=null!=(n=null==t?void 0:t.timeout)?n:30,s=AbortSignal.timeout(1e3*a),l=await (i?nO(e,{algorithm:null==t?void 0:t.algorithm,[nw]:null==t?void 0:t[nw],[nm]:null==t||null==(r=t.execute)?void 0:r.includes(oZ),signal:s,headers:new Headers(c)}):((null==t?void 0:t[nw])||fetch)((nH(e,null==t||null==(o=t.execute)||!o.includes(oZ)),e.href),{headers:Object.fromEntries(new Headers(eK({accept:"application/json"},c)).entries()),body:void 0,method:"GET",redirect:"manual",signal:s})).then(e=>(async function(e,t){if(!(e instanceof URL)&&e!==rJ)throw nf('"expectedIssuerIdentifier" must be an instance of URL',np);if(!nh(t,Response))throw nf('"response" must be an instance of Response',np);if(200!==t.status)throw nC('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',rS,t);rO(t);let n=await rz(t);if(nW(n.issuer,'"response" body "issuer" property',r_,{body:n}),e!==rJ&&new URL(n.issuer).href!==e.href)throw nC('"response" body "issuer" property does not match the expected value',rA,{expected:e.href,body:n,attribute:"issuer"});return n})(rJ,e)).catch(oW);return i&&new URL(l.issuer).href!==e.href&&("https://login.microsoftonline.com"!==e.origin||null!=t&&t.algorithm&&"oidc"!==t.algorithm||(l[oU]=!0,0))&&(!e.hostname.endsWith(".b2clogin.com")||null!=t&&t.algorithm&&"oidc"!==t.algorithm)&&(()=>{throw new oO("discovered metadata issuer does not match the expected issuer",{code:rA,cause:{expected:e.href,body:l,attribute:"issuer"}})})(),l}(e,o),t,n,r),a=oC(i);if(null!=o&&o[nw]&&(a.fetch=o[nw]),null!=o&&o.timeout&&(a.timeout=o.timeout),null!=o&&o.execute)for(let e of o.execute)e(i);return i}new TextDecoder;let oU=Symbol();class oM{serverMetadata(){let e=structuredClone(oC(this).as);return Object.defineProperties(e,{supportsPKCE:{__proto__:null,value(){var t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"S256";return!0===(null==(t=e.code_challenge_methods_supported)?void 0:t.includes(n))}}}),e}clientMetadata(){return structuredClone(oC(this).c)}get timeout(){return oC(this).timeout}set timeout(e){oC(this).timeout=e}get[nw](){return oC(this).fetch}set[nw](e){oC(this).fetch=e}constructor(e,t,n,r){var o,i,a,s,c;let u;if("string"!=typeof t||!t.length)throw oI('"clientId" must be a non-empty string',ox);if("string"==typeof n&&(n={client_secret:n}),void 0!==(null==(o=n)?void 0:o.client_id)&&t!==n.client_id)throw oI('"clientId" and "metadata.client_id" must be the same',oR);let h=eK(eK({},structuredClone(n)),{},{client_id:t});h[ny]=null!=(i=null==(a=n)?void 0:a[ny])?i:0,h[ng]=null!=(s=null==(c=n)?void 0:c[ng])?s:30,u=r||("string"==typeof h.client_secret&&h.client_secret.length?oA(h.client_secret):(e,t,n,r)=>{n.set("client_id",t.client_id)});let d=Object.freeze(h),p=structuredClone(e);oU in e&&(p[rD]=t=>{let n=t.claims.tid;return e.issuer.replace("{tenantid}",n)});let f=Object.freeze(p);l||(l=new WeakMap),l.set(this,{__proto__:null,as:f,c:d,auth:u,tlsOnly:!0,jwksCache:{}})}}function oL(e){Object.defineProperties(e,function(e){let t;if(void 0!==e.expires_in){let n=new Date;n.setSeconds(n.getSeconds()+e.expires_in),t=n.getTime()}return{expiresIn:{__proto__:null,value(){if(t){let e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){try{return rt(this)}catch(e){return}}}}}(e))}async function oK(e,t,n){var r;let o,i=arguments.length>3&&void 0!==arguments[3]&&arguments[3],a=null==(r=e.headers.get("retry-after"))?void 0:r.trim();if(void 0!==a){if(/^\d+$/.test(a))o=parseInt(a,10);else{let e=new Date(a);if(Number.isFinite(e.getTime())){let t=new Date,n=e.getTime()-t.getTime();n>0&&(o=Math.ceil(n/1e3))}}if(i&&!Number.isFinite(o))throw new nP("invalid Retry-After header value",{cause:e});o>t&&await oz(o-t,n)}}function oz(e,t){return new Promise((n,r)=>{let o=e=>{try{t.throwIfAborted()}catch(e){return void r(e)}if(e<=0)return void n();let i=Math.min(e,5);setTimeout(()=>o(e-i),1e3*i)};o(e)})}async function oJ(e,t){oY(e);let n=oC(e),r=n.as,o=n.c,i=n.auth,a=n.fetch,s=n.tlsOnly,l=n.timeout;return(async function(e,t,n,r,o){nz(e),nJ(t);let i=nG(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==o?void 0:o[nm])),a=new URLSearchParams(r);a.set("client_id",t.client_id);let s=nR(null==o?void 0:o.headers);return s.set("accept","application/json"),n6(e,t,n,i,a,s,o)})(r,o,i,t,{[nw]:a,[nm]:!s,headers:new Headers(c),signal:oq(l)}).then(e=>(async function(e,t,n){if(nz(e),nJ(t),!nh(n,Response))throw nf('"response" must be an instance of Response',np);await n2(n,200,"Backchannel Authentication Endpoint"),rO(n);let r=await rz(n);nW(r.auth_req_id,'"response" body "auth_req_id" property',r_,{body:r});let o="number"!=typeof r.expires_in?parseFloat(r.expires_in):r.expires_in;return nj(o,!0,'"response" body "expires_in" property',r_,{body:r}),r.expires_in=o,void 0!==r.interval&&nj(r.interval,!1,'"response" body "interval" property',r_,{body:r}),r})(r,o,e)).catch(oW)}async function oD(e,t,n,r){var o,i,a;let s;oY(e),n=new URLSearchParams(n);let l=null!=(o=t.interval)?o:5,u=null!=(i=null==r?void 0:r.signal)?i:AbortSignal.timeout(1e3*t.expires_in);try{await oz(l,u)}catch(e){oW(e)}let h=oC(e),d=h.as,p=h.c,f=h.auth,m=h.fetch,y=h.tlsOnly,g=h.nonRepudiation,w=h.timeout,v=h.decrypt,b=(o,i)=>oD(e,eK(eK({},t),{},{interval:o}),n,eK(eK({},r),{},{signal:u,flag:i})),_=function(e,t){let n=oq(t);if(!n)return{signal:e,cleanup(){}};let r=new AbortController,o=e=>{let t=e.target;r.abort(t.reason)};return e.aborted?r.abort(e.reason):n.aborted?r.abort(n.reason):(e.addEventListener("abort",o,{once:!0}),n.addEventListener("abort",o,{once:!0})),{signal:r.signal,cleanup(){e.removeEventListener("abort",o),n.removeEventListener("abort",o)}}}(u,w),k=await (async function(e,t,n,r,o){nz(e),nJ(t),nW(r,'"authReqId"');let i=new URLSearchParams(null==o?void 0:o.additionalParameters);return i.set("auth_req_id",r),n8(e,t,n,"urn:openid:params:grant-type:ciba",i,o)})(d,p,f,t.auth_req_id,{[nw]:m,[nm]:!y,additionalParameters:n,DPoP:null==r?void 0:r.DPoP,headers:new Headers(c),signal:_.signal}).catch(oW).finally(_.cleanup);if(503===k.status&&k.headers.has("retry-after"))return await oK(k,l,u,!0),await (null==(a=k.body)?void 0:a.cancel()),b(l);let S=async function(e,t,n,r){return rn(e,t,n,void 0,null==r?void 0:r[nb],null==r?void 0:r.recognizedTokenTypes)}(d,p,k,{[nb]:v});try{s=await S}catch(e){if(oQ(e,r))return b(l,o$);if(e instanceof nV)switch(e.error){case"slow_down":l+=5;case"authorization_pending":return await oK(e.response,l,u),b(l)}oW(e)}return s.id_token&&await (null==g?void 0:g(k)),oL(s),s}function oZ(e){oC(e).tlsOnly=!1}async function oH(e,t,n,r,o){let i,a,s;if(oY(e),!((null==o?void 0:o.flag)===o$||t instanceof URL||function(e,t){try{return Object.getPrototypeOf(e)[Symbol.toStringTag]===t}catch(e){return!1}}(t,"Request")))throw oI('"currentUrl" must be an instance of URL, or Request',ox);let l=oC(e),u=l.as,h=l.c,d=l.auth,p=l.fetch,f=l.tlsOnly,m=l.jarm,y=l.hybrid,g=l.nonRepudiation,w=l.timeout,v=l.decrypt,b=l.implicit;if((null==o?void 0:o.flag)===o$)i=o.authResponse,a=o.redirectUri;else{if(!(t instanceof URL)){let e=t;switch(t=new URL(t.url),e.method){case"GET":break;case"POST":let n=new URLSearchParams(await rN(e));if(y)t.hash=n.toString();else for(let e of n.entries()){var _,k=eJ(e,2);let n=k[0],r=k[1];t.searchParams.append(n,r)}break;default:throw oI("unexpected Request HTTP method",oR)}}switch((_=new URL(_=t)).search="",_.hash="",a=_.href,!0){case!!m:i=await m(t,null==n?void 0:n.expectedState);break;case!!y:i=await y(t,null==n?void 0:n.expectedNonce,null==n?void 0:n.expectedState,null==n?void 0:n.maxAge);break;case!!b:throw TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");default:try{i=function(e,t,n,r){var o;if(nz(e),nJ(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw nf('"parameters" must be an instance of URLSearchParams, or URL',np);if(rM(n,"response"))throw nC('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',r_,{parameters:n});let i=rM(n,"iss"),a=rM(n,"state");if(!i&&e.authorization_response_iss_parameter_supported)throw nC('response parameter "iss" (issuer) missing',r_,{parameters:n});if(i&&i!==e.issuer)throw nC('unexpected "iss" (issuer) response parameter value',r_,{expected:e.issuer,parameters:n});switch(r){case void 0:case rK:if(void 0!==a)throw nC('unexpected "state" response parameter encountered',r_,{expected:void 0,parameters:n});break;case rL:break;default:if(nW(r,'"expectedState" argument'),a!==r)throw nC(void 0===a?'response parameter "state" missing':'unexpected "state" response parameter value',r_,{expected:r,parameters:n})}if(rM(n,"error"))throw new nX("authorization response from the server is an error",{cause:n});let s=rM(n,"id_token"),c=rM(n,"token");if(void 0!==s||void 0!==c)throw new nE("implicit and hybrid flows are not supported");return o=new URLSearchParams(n),rc.add(o),o}(u,h,t.searchParams,null==n?void 0:n.expectedState)}catch(e){oW(e)}}}let S=await (async function(e,t,n,r,o,i,a){if(nz(e),nJ(t),!rc.has(r))throw nf('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',nd);nW(o,'"redirectUri"');let s=rM(r,"code");if(!s)throw nC('no authorization code in "callbackParameters"',r_);let c=new URLSearchParams(null==a?void 0:a.additionalParameters);return c.set("redirect_uri",o),c.set("code",s),i!==rl&&(nW(i,'"codeVerifier"'),c.set("code_verifier",i)),n8(e,t,n,"authorization_code",c,a)})(u,h,d,i,a,(null==n?void 0:n.pkceCodeVerifier)||rl,{additionalParameters:r,[nw]:p,[nm]:!f,DPoP:null==o?void 0:o.DPoP,headers:new Headers(c),signal:oq(w)}).catch(oW);"string"!=typeof(null==n?void 0:n.expectedNonce)&&"number"!=typeof(null==n?void 0:n.maxAge)||(n.idTokenExpected=!0);let T=rf(u,h,S,{expectedNonce:null==n?void 0:n.expectedNonce,maxAge:null==n?void 0:n.maxAge,requireIdToken:null==n?void 0:n.idTokenExpected,[nb]:v});try{s=await T}catch(t){if(oQ(t,o))return oH(e,void 0,n,r,eK(eK({},o),{},{flag:o$,authResponse:i,redirectUri:a}));oW(t)}return s.id_token&&await (null==g?void 0:g(S)),oL(s),s}async function oF(e,t,n,r){let o;oY(e),n=new URLSearchParams(n);let i=oC(e),a=i.as,s=i.c,l=i.auth,u=i.fetch,h=i.tlsOnly,d=i.nonRepudiation,p=i.timeout,f=i.decrypt,m=await (async function(e,t,n,r,o){nz(e),nJ(t),nW(r,'"refreshToken"');let i=new URLSearchParams(null==o?void 0:o.additionalParameters);return i.set("refresh_token",r),n8(e,t,n,"refresh_token",i,o)})(a,s,l,t,{[nw]:u,[nm]:!h,additionalParameters:n,DPoP:null==r?void 0:r.DPoP,headers:new Headers(c),signal:oq(p)}).catch(oW),y=async function(e,t,n,r){return rn(e,t,n,void 0,null==r?void 0:r[nb],null==r?void 0:r.recognizedTokenTypes)}(a,s,m,{[nb]:f});try{o=await y}catch(o){if(oQ(o,r))return oF(e,t,n,eK(eK({},r),{},{flag:o$}));oW(o)}return o.id_token&&await (null==d?void 0:d(m)),oL(o),o}async function oG(e,t,n){let r;oY(e),t=new URLSearchParams(t);let o=oC(e),i=o.as,a=o.c,s=o.auth,l=o.fetch,u=o.tlsOnly,h=o.timeout,d=await (async function(e,t,n,r,o){return nz(e),nJ(t),n8(e,t,n,"client_credentials",new URLSearchParams(r),o)})(i,a,s,t,{[nw]:l,[nm]:!u,DPoP:null==n?void 0:n.DPoP,headers:new Headers(c),signal:oq(h)}).catch(oW),p=async function(e,t,n,r){return rn(e,t,n,void 0,void 0,void 0)}(i,a,d);try{r=await p}catch(r){if(oQ(r,n))return oG(e,t,eK(eK({},n),{},{flag:o$}));oW(r)}return oL(r),r}function oV(e,t){oY(e);let n=oC(e),r=n.as,o=n.c,i=n.tlsOnly,a=n.hybrid,s=n.jarm,c=n.implicit,l=nG(r,"authorization_endpoint",!1,i);if((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",o.client_id),!t.has("request_uri")&&!t.has("request")){if(t.has("response_type")||t.set("response_type",a?"code id_token":c?"id_token":"code"),c&&!t.has("nonce"))throw oI("response_type=id_token clients must provide a nonce parameter in their authorization request parameters",oR);s&&t.set("response_mode","jwt")}for(let e of t.entries()){var u=eJ(e,2);let t=u[0],n=u[1];l.searchParams.append(t,n)}return l}async function oX(e,t,n){let r;oY(e);let o=oV(e,t),i=oC(e),a=i.as,s=i.c,l=i.auth,u=i.fetch,h=i.tlsOnly,d=i.timeout,p=await (async function(e,t,n,r,o){var i;nz(e),nJ(t);let a=nG(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==o?void 0:o[nm])),s=new URLSearchParams(r);s.set("client_id",t.client_id);let c=nR(null==o?void 0:o.headers);c.set("accept","application/json"),void 0!==(null==o?void 0:o.DPoP)&&(n1(o.DPoP),await o.DPoP.addProof(a,c,"POST"));let l=await n6(e,t,n,a,s,c,o);return null==o||null==(i=o.DPoP)||i.cacheNonce(l,a),l})(a,s,l,o.searchParams,{[nw]:u,[nm]:!h,DPoP:null==n?void 0:n.DPoP,headers:new Headers(c),signal:oq(d)}).catch(oW),f=async function(e,t,n){if(nz(e),nJ(t),!nh(n,Response))throw nf('"response" must be an instance of Response',np);await n2(n,201,"Pushed Authorization Request Endpoint"),rO(n);let r=await rz(n);nW(r.request_uri,'"response" body "request_uri" property',r_,{body:r});let o="number"!=typeof r.expires_in?parseFloat(r.expires_in):r.expires_in;return nj(o,!0,'"response" body "expires_in" property',r_,{body:r}),r.expires_in=o,r}(a,s,p);try{r=await f}catch(r){if(oQ(r,n))return oX(e,t,eK(eK({},n),{},{flag:o$}));oW(r)}return oV(e,{request_uri:r.request_uri})}function oY(e){if(!(e instanceof oM))throw oI('"config" must be an instance of Configuration',ox);if(Object.getPrototypeOf(e)!==oM.prototype)throw oI("subclassing Configuration is not allowed",oR)}function oq(e){return e?AbortSignal.timeout(1e3*e):void 0}async function oB(e,t,n,r){oY(e);let o=oC(e),i=o.as,a=o.c,s=o.fetch,l=o.tlsOnly,u=o.nonRepudiation,h=o.timeout,d=o.decrypt,p=await n5(i,a,t,{[nw]:s,[nm]:!l,DPoP:null==r?void 0:r.DPoP,headers:new Headers(c),signal:oq(h)}).catch(oW),f,m=n4(i,a,n,p,{[nb]:d});try{f=await m}catch(o){if(oQ(o,r))return oB(e,t,n,eK(eK({},r),{},{flag:o$}));oW(o)}return"application/jwt"===n9(p)&&await (null==u?void 0:u(p)),f}function oQ(e,t){return!(null==t||!t.DPoP||t.flag===o$)&&function(e){if(e instanceof nY){let t=e.cause,n=t[0];return 1===t.length&&"dpop"===n.scheme&&"use_dpop_nonce"===n.parameters.error}return e instanceof nV&&"use_dpop_nonce"===e.error}(e)}Object.freeze(oM.prototype);let o$=Symbol();async function o0(e,t,n,r){let o,i;oY(e);let a=oC(e),s=a.as,l=a.c,u=a.auth,h=a.fetch,d=a.tlsOnly,p=a.timeout,f=a.decrypt,m=a.nonRepudiation,y=await (async function(e,t,n,r,o,i){return nz(e),nJ(t),nW(r,'"grantType"'),n8(e,t,n,r,new URLSearchParams(o),i)})(s,l,u,t,new URLSearchParams(n),{[nw]:h,[nm]:!d,DPoP:null==r?void 0:r.DPoP,headers:new Headers(c),signal:oq(p)}).catch(oW);"urn:ietf:params:oauth:grant-type:token-exchange"===t&&(o={n_a:()=>{}});let g=async function(e,t,n,r){return rn(e,t,n,void 0,null==r?void 0:r[nb],null==r?void 0:r.recognizedTokenTypes)}(s,l,y,{[nb]:f,recognizedTokenTypes:o});try{i=await g}catch(o){if(oQ(o,r))return o0(e,t,n,eK(eK({},r),{},{flag:o$}));oW(o)}return i.id_token&&await (null==m?void 0:m(y)),oL(i),i}async function o2(e,t,n){oY(e);let r=oC(e),o=r.as,i=r.c,a=r.auth,s=r.fetch,l=r.tlsOnly,u=r.timeout;return(async function(e,t,n,r,o){nz(e),nJ(t),nW(r,'"token"');let i=nG(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,!0!==(null==o?void 0:o[nm])),a=new URLSearchParams(null==o?void 0:o.additionalParameters);a.set("token",r);let s=nR(null==o?void 0:o.headers);return s.delete("accept"),n6(e,t,n,i,a,s,o)})(o,i,a,t,{[nw]:s,[nm]:!l,additionalParameters:new URLSearchParams(n),headers:new Headers(c),signal:oq(u)}).then(rI).catch(oW)}async function o1(e,t,n){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,e.subtle,!1,[n]):(function(e,t,n){var r;let o=e.algorithm;if(o.name!==t.name)throw rX(t.name);if(t.hash&&(null==(r=o.hash)?void 0:r.name)!==t.hash)throw rX(t.hash,"algorithm.hash");if(t.namedCurve&&o.namedCurve!==t.namedCurve)throw rX(t.namedCurve,"algorithm.namedCurve");if(void 0!==t.length&&o.length!==t.length)throw rX(t.length,"algorithm.length");if(n&&!e.usages.includes(n))throw TypeError("CryptoKey does not support this operation, its usages must include ".concat(n,"."))}(t,e.subtle,n),e.minRsaBits&&function(e,t){let n=t.algorithm.modulusLength;if("number"!=typeof n||n<2048)throw TypeError("".concat(e," requires key modulusLength to be 2048 bits or larger"))}(e.alg,t),t)}let o5=[["verify"],["sign"]];function o3(e){let t={name:"HMAC",hash:"SHA-".concat(e)};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:o5}}function o9(e,t){let n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:"SHA-".concat(e)};return{kty:["RSA"],subtle:n,signing:t?eK(eK({},n),{},{saltLength:t}):n,usages:o5,minRsaBits:2048}}function o4(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:"SHA-".concat(t)},usages:o5}}function o6(){let e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:o5}}function o8(e){let t={name:"ML-DSA-".concat(e)};return{kty:["AKP"],subtle:t,signing:t,usages:o5}}let o7=op({HS256:o3(256),HS384:o3(384),HS512:o3(512),RS256:o9(256),RS384:o9(384),RS512:o9(512),PS256:o9(256,32),PS384:o9(384,48),PS512:o9(512,64),ES256:o4("P-256",256),ES384:o4("P-384",384),ES512:o4("P-521",512),EdDSA:o6(),Ed25519:o6(),"ML-DSA-44":o8(44),"ML-DSA-65":o8(65),"ML-DSA-87":o8(87)});function ie(e){let t="string"==typeof e?o7[e]:void 0;if(!t)throw new r0("alg ".concat(e," is not supported either by JOSE or your javascript runtime"));return t}async function it(e,t,n,r,o,i,a){var s;let c=!1;"function"==typeof n&&(n=await n(o,e),c=!0);let l="string"==typeof a,u=ie(i),h=rG(void 0!==r?rV(r):new Uint8Array,rV("."),l?null!=(s=t[2])?s:t[2]=function(e,t,n){try{return rV(e)}catch(e){throw new n("The ".concat(t," is not a valid base64url string"))}}(a,"payload",r2):a),d=oi(e.signature,"signature",r2),p=await od(u,n,"verify");if(!await async function(e,t,n,r){let o=await o1(e,t,"verify");try{return await crypto.subtle.verify(e.signing,o,n,r)}catch(e){return!1}}(u,p,d,h))throw new r6;return[l?oi(a,"payload",r2):a,o,l,p,c]}async function ir(e,t,n){if(e instanceof Uint8Array&&(e=rH.decode(e)),"string"!=typeof e)throw new r2("Compact JWS must be a string or Uint8Array");let r=e.split("."),o=r[0],i=r[1],a=r[2];if(3!==r.length)throw new r2("Invalid Compact JWS");let s=function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:void 0===e?{}:function(e,t,n){let r;try{r=JSON.parse(rF.decode(ot(e)))}catch(e){throw new t(n)}if(!or(r))throw new t(n);return r}(e,r2,"JWS Protected Header is invalid");return t}(o),c=eJ(function(e,t,n){let r=oP(e,oE(r2,oT,n[1],e,t)),o=t.alg;if("string"!=typeof o||!o)throw new r2('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(n[0]&&!n[0].has(o))throw new r$('"alg" (Algorithm) Header Parameter value not allowed');return[r,o]}(s,s,t),2),l=c[0],u=c[1],h=l?i:function(e){try{return rV(e)}catch(e){throw new r2("JWS Compact Serialization payload must use only ASCII characters")}}(i);return it({payload:i,protected:o,signature:a},t,n,o,s,u,h)}let io=e=>Math.floor(e.getTime()/1e3),ii={s:1,m:60,h:3600,d:86400,w:604800,y:0x1e187e0},ia=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,is="check_failed";function ic(){throw TypeError("Invalid time period format")}function il(e){"string"!=typeof e&&ic();let t=ia.exec(e);(!t||t[4]&&t[1])&&ic();let n=Math.round(parseFloat(t[2])*ii[t[3][0].toLowerCase()]);return Number.isFinite(n)||ic(),"-"===t[1]||"ago"===t[4]?-n:n}function iu(e,t){if(!Number.isFinite(t))throw TypeError("Invalid ".concat(e," input"));return t}function ih(e,t){if("string"!=typeof t)throw TypeError('"'.concat(e,'" claim must be a string'))}function id(e,t){return"number"==typeof e?iu(t,e):e instanceof Date?iu(t,io(e)):io(new Date)+il(e)}let ip=e=>{let t=e.toLowerCase();return e.includes("/")?t:"application/".concat(t)};function im(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],r=e[t];if(void 0!==r||n){if("number"!=typeof r)throw new rB('"'.concat(t,'" claim must be a number'),e,t,"invalid");return r}}function iy(e,t){throw new rB('unexpected "'.concat(t,'" claim value'),e,t,is)}function ig(e){return h.get(e)}async function iw(e,t,n){let r=await ir(e,[n&&function(e,t){if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw TypeError('"'.concat(e,'" option must be an array of strings'));if(t)return new Set(t)}("algorithms",n.algorithms),null==n?void 0:n.crit],t);if(!r[2])throw new r1("JWTs MUST NOT use unencoded payload");let o={payload:function(e,t){var n,r;let o,i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};try{o=JSON.parse(rF.decode(t))}catch(e){}if(!or(o))throw new r1("JWT Claims Set must be a top-level JSON object");let a=i.typ;if(void 0!==a&&("string"!=typeof e.typ||ip(e.typ)!==ip(a)))throw new rB('unexpected "typ" JWT header value',o,"typ",is);let s=i.requiredClaims,c=i.issuer,l=i.subject,u=i.audience,h=i.maxTokenAge,d=[...void 0===s?[]:s];for(let e of(void 0!==h&&d.push("iat"),void 0!==u&&d.push("aud"),void 0!==l&&d.push("sub"),void 0!==c&&d.push("iss"),new Set(d.reverse())))if(!Object.hasOwn(o,e))throw new rB('missing required "'.concat(e,'" claim'),o,e,"missing");void 0===c||(Array.isArray(c)?c:[c]).includes(o.iss)||iy(o,"iss"),void 0!==l&&o.sub!==l&&iy(o,"sub"),void 0===u||(n=o.aud,r="string"==typeof u?[u]:u,"string"==typeof n?r.includes(n):Array.isArray(n)&&r.some(e=>n.includes(e)))||iy(o,"aud");let p=i.clockTolerance,f=0;if("string"==typeof p)f=il(p);else if(void 0!==p){if("number"!=typeof p)throw TypeError("Invalid clockTolerance option type");f=p}iu("clockTolerance option",f);let m=i.currentDate,y=iu("currentDate option",io(void 0===m?new Date:m)),g=im(o,"iat",void 0!==h),w=im(o,"nbf");if(void 0!==w&&w>y+f)throw new rB('"nbf" claim timestamp check failed',o,"nbf",is);let v=im(o,"exp");if(void 0!==v&&v<=y-f)throw new rQ('"exp" claim timestamp check failed',o,"exp",is);if(void 0!==h){let e=y-g;if(e-f>iu("maxTokenAge option","number"==typeof h?h:il(h)))throw new rQ('"iat" claim timestamp check failed (too far in the past)',o,"iat",is);if(e<-f)throw new rB('"iat" claim timestamp check failed (it should be in the past)',o,"iat",is)}return o}(r[1],r[0],n),protectedHeader:r[1]};return"function"==typeof t?eK(eK({},o),{},{key:r[3]}):o}async function iv(e,t,n,r){let o=rG(rV(e),rV("."),t),i=await od(n,r,"sign");return on(await async function(e,t,n){let r=await o1(e,t,"sign");return new Uint8Array(await crypto.subtle.sign(e.signing,r,n))}(n,i,o))}async function ib(e,t,n,r,o){let i=eJ(function(e){if(void 0===e)return[void 0,""];let t=function(e,t){let n,r;try{n=JSON.stringify(t),r=JSON.parse(n)}catch(t){throw new e("JOSE Header is not valid JSON",{cause:t})}if(!or(r))throw new e("JOSE Header is not a JSON object");return[r,n]}(r2,e);return[t[0],on(t[1])]}(t),2),a=i[0],s=i[1];if(!a)throw new r2("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");(function(e,t){let n=(null!=t?t:{}).crit;if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')})(r2,a),oP(a,oE(r2,oT,n,a,a))||o();let c=function(e){let t=e.alg;if("string"!=typeof t||!t)throw new r2('JWS "alg" (Algorithm) Header Parameter missing or invalid');return ie(t)}(a),l=on(e),u=await iv(s,rV(l),c,r);return"".concat(s,".").concat(l,".").concat(u)}let i_=class{setIssuer(e){return ih("iss",e),ig(this).iss=e,this}setSubject(e){return ih("sub",e),ig(this).sub=e,this}setAudience(e){return function(e){if("string"!=typeof e&&(!Array.isArray(e)||Array.from(e).some(e=>"string"!=typeof e)))throw TypeError('"aud" claim must be a string or an array of strings')}(e),ig(this).aud=e,this}setJti(e){return ih("jti",e),ig(this).jti=e,this}setNotBefore(e){return ig(this).nbf=id(e,"setNotBefore"),this}setExpirationTime(e){return ig(this).exp=id(e,"setExpirationTime"),this}setIssuedAt(e){return ig(this).iat=void 0===e?io(new Date):"string"==typeof e?iu("setIssuedAt",io(new Date)+il(e)):id(e,"setIssuedAt"),this}constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!or(e))throw TypeError("JWT Claims Set MUST be an object");(h||(h=new WeakMap)).set(this,structuredClone(e))}};var ik=new WeakMap;class iS extends i_{setProtectedHeader(e){return function(e,t){if(void 0!==e)throw TypeError("".concat(t," can only be called once"))}(ej(ik,this),"setProtectedHeader"),eN(ik,this,e),this}async sign(e,t){return ib(function(e){let t=ig(e);for(let e of["iat","nbf","exp"]){let n=t[e];if("number"==typeof n&&!Number.isFinite(n))throw TypeError('"'.concat(e,'" claim must be a finite number'))}return rZ.encode(JSON.stringify(t))}(this),ej(ik,this),null==t?void 0:t.crit,e,()=>{throw new r1("JWTs MUST NOT use unencoded payload")})}constructor(){super(...arguments),eW(this,ik,void 0)}}let iT='"alg" (Algorithm)';function iE(){throw new r0("Invalid or unsupported ".concat(arguments.length>0&&void 0!==arguments[0]?arguments[0]:'JWK "alg" (Algorithm) Parameter'," value"))}let iP=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},iC=e=>{let t=e.data[e.pos++];if(void 0===t)throw Error("Unexpected end of ASN.1 input");return t},iA=e=>{let t=iC(e);if(128&t){let n=127&t,r=0;for(let t=0;t<n;t++)r=r<<8|iC(e);return r}return t},iR=(e,t,n)=>{if(iC(e)!==t)throw Error(n)},ix=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error("Unexpected end of ASN.1 input");let n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},iI=async(e,t,n,r)=>{let o,i=function(e){if(void 0!==e&&"boolean"!=typeof e)throw TypeError('"extractable" option must be a boolean');return e}(null==r?void 0:r.extractable),a=function(e,t){var n,r;return null!=(n="string"==typeof e?null!=(r=o7[e])?r:o_[e]:void 0)?n:iE(t)}(n,iT);a.secret&&iE(iT);let s="spki"===e;if(a.resolve)try{let n={data:t,pos:0};!function(e,t){if(iR(e,48,"Invalid ".concat("spki"===t?"SPKI":"PKCS#8"," structure")),iA(e),"pkcs8"===t){iR(e,2,"Expected version field");let t=iA(e);e.pos+=t}iR(e,48,"Expected algorithm identifier"),iA(e)}(n,e),o=a.resolve({crv:(e=>{let t=(e=>{iR(e,6,"Expected algorithm OID");let t=iA(e);return ix(e,t)})(e);if(iP(t,[43,101,110]))return"X25519";if(!iP(t,[42,134,72,206,61,2,1]))throw Error("Unsupported key algorithm");iR(e,6,"Expected curve OID");let n=iA(e),r=ix(e,n);if(iP(r,[42,134,72,206,61,3,1,7]))return"P-256";if(iP(r,[43,129,4,0,34]))return"P-384";if(iP(r,[43,129,4,0,35]))return"P-521";throw Error("Unsupported named curve")})(n)})}catch(e){throw new r0("Invalid or unsupported key format")}else o=a.subtle;return crypto.subtle.importKey(e,t,o,null!=i?i:s,a.usages[+!s])};async function iO(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),o=n.alg;if(void 0===r[o]){let e=await oa(n,eK(eK({},t),{},{alg:o,ext:!0}));if("public"!==e.type)throw new r5("JSON Web Key Set members must be public keys");r[o]=e}return r[o]}function ij(e){let t;try{t=structuredClone(e)}catch(e){}if(!oo(t))throw new r5("JSON Web Key Set malformed");let n=new WeakMap;return Object.defineProperty(async(e,r)=>{let o=eK(eK({},e),null==r?void 0:r.header),i=o.alg,a=o.kid,s="string"==typeof i?o7[i]:void 0;if(!s||s.secret)throw new r0('Unsupported "alg" value for a JSON Web Key Set');let c=t.keys.filter(e=>(function(e,t,n,r){let o=os(e),i=o.kty,a=o.key_ops,s=o.ext,c=o.kid,l=o.alg,u=o.use,h=o.crv,d=Array.isArray(a)?[...a]:a;return(void 0===s||"boolean"==typeof s)&&(void 0===d||Array.isArray(d)&&d.every((e,t)=>"string"==typeof e&&d.indexOf(e)===t)&&d.includes("verify"))&&t.kty.includes(i)&&(void 0===r||"string"==typeof r&&r===c)&&(void 0===l?"AKP"!==i:n===l)&&(void 0===u||"sig"===u)&&(!t.crv||h===t.crv)})(e,s,i,a)),l=c[0],u=c.length;if(!u)throw new r3;if(1!==u){let e=new r9;throw e[Symbol.asyncIterator]=eD(function*(){for(let t of c)try{var e;yield yield(e=iO(n,t,s),new eR(e,0))}catch(e){}}),e}return iO(n,l,s)},"jwks",{value:()=>structuredClone(t)})}"undefined"!=typeof navigator&&null!=(w=navigator.userAgent)&&null!=(v=w.startsWith)&&v.call(w,"Mozilla/5.0 ")||(d="".concat("jose","/").concat("v6.2.10"));let iW=Symbol(),iN=Symbol();function iU(e,t){return Number.isFinite(e)&&Date.now()<e+t}function iM(e,t,n){if(Number.isNaN(e))throw TypeError('"'.concat(n,'" option must not be NaN'));return"number"==typeof e?e:t}async function iL(e,t,n){let r;if("string"!=typeof e||0!==e.indexOf("-----BEGIN PRIVATE KEY-----"))throw TypeError('"pkcs8" must be PKCS#8 formatted string');return iI("pkcs8",(r=/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,r7(e.replace(r,""))),t,n)}let iK=["mfaToken"],iz=["mfaToken"];function iJ(e){return"object"!=typeof e||null===e?{}:{statusCode:"number"==typeof e.statusCode?e.statusCode:void 0,headers:e.headers instanceof Headers?e.headers:void 0,body:"string"==typeof e.body?e.body:void 0}}function iD(e){var t,n;let r;if("object"!=typeof e||null===e)return{error:"unknown_error",error_description:String(e)};if(e.response instanceof Response)try{(r=new Headers(e.response.headers)).delete("set-cookie")}catch(e){r=void 0}let o={error:null!=(t=e.error)?t:"",error_description:null!=(n=e.error_description)?n:"",message:e.message,statusCode:"number"==typeof e.status?e.status:void 0,headers:r};if("mfa_required"===e.error&&e.cause){o.mfa_token="string"==typeof e.cause.mfa_token?e.cause.mfa_token:void 0;let t=e.cause.mfa_requirements;"object"==typeof t&&null!==t&&(o.mfa_requirements=t)}return o}var iZ=class extends Error{constructor(e,t){super(t),eM(this,"code",void 0),this.name="NotSupportedError",this.code=e}},iH=class extends Error{constructor(e,t,n){super(t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"statusCode",void 0),eM(this,"headers",void 0),eM(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements};let r=iJ(n);this.statusCode=r.statusCode,this.headers=r.headers,this.body=r.body}},iF=class extends iH{constructor(e,t){super("token_by_code_error",e,t),this.name="TokenByCodeError"}},iG=class extends iH{constructor(e,t){super("token_by_client_credentials_error",e,t),this.name="TokenByClientCredentialsError"}},iV=class extends iH{constructor(e,t){super("token_by_refresh_token_error",e,t),this.name="TokenByRefreshTokenError"}},iX=class extends iH{constructor(e,t){super("token_by_password_error",e,t),this.name="TokenByPasswordError"}},iY=class extends iH{constructor(e,t){super("token_for_connection_error",e,t),this.name="TokenForConnectionErrorCode"}},iq=class extends iH{constructor(e,t){super("token_exchange_error",e,t),this.name="TokenExchangeError"}},iB=class extends iH{constructor(e,t){super("token_revocation_error",e,t),this.name="TokenRevocationError"}},iQ=class extends iH{constructor(e,t){super("user_info_error",e,t),this.name="UserInfoError"}},i$=class extends Error{constructor(e){super(e),eM(this,"code","verify_logout_token_error"),this.name="VerifyLogoutTokenError"}},i0=class extends iH{constructor(e){super("backchannel_authentication_error","There was an error when trying to use Client-Initiated Backchannel Authentication.",e),eM(this,"code","backchannel_authentication_error"),this.name="BackchannelAuthenticationError"}},i2=class extends iH{constructor(e){super("build_authorization_url_error","There was an error when trying to build the authorization URL.",e),this.name="BuildAuthorizationUrlError"}},i1=class extends iH{constructor(e){super("build_link_user_url_error","There was an error when trying to build the Link User URL.",e),this.name="BuildLinkUserUrlError"}},i5=class extends iH{constructor(e){super("build_unlink_user_url_error","There was an error when trying to build the Unlink User URL.",e),this.name="BuildUnlinkUserUrlError"}},i3=class extends Error{constructor(){super("The client secret or client assertion signing key must be provided."),eM(this,"code","missing_client_auth_error"),this.name="MissingClientAuthError"}},i9=class extends Error{constructor(e){super(e),eM(this,"code","organization_validation_error"),this.name="OrganizationValidationError"}},i4=class extends Error{constructor(e){super(e||"fullResponse: true requested but no HTTP Response was captured. This is a bug in CapturingFetch."),eM(this,"code","missing_captured_response_error"),this.name="MissingCapturedResponseError"}};function i6(e){try{let t=new Headers(e);return t.delete("set-cookie"),t}catch(e){return new Headers}}function i8(e,t,n){var r;let o="object"==typeof t&&null!==t?t:void 0,i=null!=(r=null==o?void 0:o.response)?r:n,a="number"==typeof(null==o?void 0:o.status)?o.status:null==i?void 0:i.status;"number"==typeof a&&(e.statusCode=a),null!=i&&i.headers&&(e.headers=i6(i.headers))}function i7(e){return Object.entries(e).filter(e=>void 0!==eJ(e,2)[1]).reduce((e,t)=>eK(eK({},e),{},{[t[0]]:t[1]}),{})}function ae(e){if(!e.trim())throw new i9("organization must not be blank")}function at(e,t){if(!e)return;let n=t.trim();if(n.startsWith("org_")){let t=e.org_id;if("string"!=typeof t)throw new i9("Organization Id (org_id) claim must be a string present in the ID token");if(t!==n)throw new i9('Organization Id (org_id) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}else{let t=e.org_name;if("string"!=typeof t)throw new i9("Organization Name (org_name) claim must be a string present in the ID token");if(t.toLowerCase()!==n.toLowerCase())throw new i9('Organization Name (org_name) claim value mismatch in the ID token; expected "'.concat(n,'", found "').concat(t,'"'))}}var an=class extends Error{constructor(e,t,n){super(t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"statusCode",void 0),eM(this,"headers",void 0),eM(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};let r=iJ(n);this.statusCode=r.statusCode,this.headers=r.headers,this.body=r.body}},ar=class extends an{constructor(e,t){super("mfa_list_authenticators_error",e,t),this.name="MfaListAuthenticatorsError"}},ao=class extends an{constructor(e,t){super("mfa_enrollment_error",e,t),this.name="MfaEnrollmentError"}},ai=class extends an{constructor(e,t){super("mfa_delete_authenticator_error",e,t),this.name="MfaDeleteAuthenticatorError"}},aa=class extends an{constructor(e,t){super("mfa_challenge_error",e,t),this.name="MfaChallengeError"}},as=class extends an{constructor(e,t){super("mfa_verify_error",e,t),this.name="MfaVerifyError"}};function ac(e){return{id:e.id,authenticatorType:e.authenticator_type,active:e.active,name:e.name,oobChannels:e.oob_channels,type:e.type}}var al=class e{static fromTokenEndpointResponse(t){let n=t.id_token?t.claims():void 0,r=new e(t.access_token,Math.floor(Date.now()/1e3)+Number(t.expires_in),t.id_token,t.refresh_token,t.scope,n,t.authorization_details);return r.tokenType=t.token_type,r.issuedTokenType=t.issued_token_type,r}constructor(e,t,n,r,o,i,a){eM(this,"accessToken",void 0),eM(this,"idToken",void 0),eM(this,"refreshToken",void 0),eM(this,"expiresAt",void 0),eM(this,"scope",void 0),eM(this,"claims",void 0),eM(this,"authorizationDetails",void 0),eM(this,"tokenType",void 0),eM(this,"issuedTokenType",void 0),eM(this,"recoveryCode",void 0),eM(this,"act",void 0),this.accessToken=e,this.idToken=n,this.refreshToken=r,this.expiresAt=t,this.scope=o,this.claims=i,this.authorizationDetails=a}};function au(e,t){if(!1===t.enabled)return e;let n=btoa(JSON.stringify({name:t.name,version:t.version}));return async(t,r)=>{let o=t instanceof Request?new Headers(t.headers):new Headers;return null!=r&&r.headers&&new Headers(r.headers).forEach((e,t)=>{o.set(t,e)}),o.set("Auth0-Client",n),e(t,eK(eK({},r),{},{headers:o}))}}function ah(e){var t,n;return!1===(null==e?void 0:e.enabled)?e:{enabled:!0,name:null!=(t=null==e?void 0:e.name)?t:"@auth0/auth0-auth-js",version:null!=(n=null==e?void 0:e.version)?n:"1.15.0"}}function ad(e){let t,n=async(n,r)=>{let o=await e(n,r);return t=o.clone(),o};return n.getCapturedResponse=()=>t,n}function ap(e,t,n){if(!t)return e;let r=t.signal,o=t.headers,i=t.customFetch,a=i?au(i,n):e;return r||o?async(e,t)=>{let n=o?new Headers(e instanceof Request?e.headers:void 0):void 0;if(n&&null!=t&&t.headers&&new Headers(t.headers).forEach((e,t)=>n.set(t,e)),o)for(let e of Object.entries(o)){var i,s=eJ(e,2);let t=s[0],r=s[1],o=t.toLowerCase();"authorization"!==o&&"auth0-client"!==o&&n.set(t,r)}let c=function(e,t){if(!e)return{signal:null!=t?t:void 0};if(!t)return{signal:e};if("undefined"!=typeof AbortSignal&&"function"==typeof AbortSignal.any)return{signal:AbortSignal.any([e,t])};let n=new AbortController,r=[e,t],o=r.find(e=>e.aborted);if(o)return n.abort(o.reason),{signal:n.signal};let i=[],a=()=>{r.forEach((e,t)=>{let n=i[t];n&&e.removeEventListener("abort",n)})};return r.forEach((e,t)=>{let r=()=>{a(),n.abort(e.reason)};i[t]=r,e.addEventListener("abort",r,{once:!0})}),{signal:n.signal,cleanup:a}}(r,null==t?void 0:t.signal);try{return await a(e,eK(eK(eK({},t),n&&{headers:n}),{},{signal:c.signal}))}finally{null==(i=c.cleanup)||i.call(c)}}:a}var af={otp:"http://auth0.com/oauth/grant-type/mfa-otp",oob:"http://auth0.com/oauth/grant-type/mfa-oob","recovery-code":"http://auth0.com/oauth/grant-type/mfa-recovery-code"},am=(b=new WeakMap,_=new WeakMap,k=new WeakMap,S=new WeakMap,T=new WeakMap,E=new WeakMap,P=new WeakMap,C=new WeakSet,class{async listAuthenticators(e,t){let n="".concat(ej(b,this),"/mfa/authenticators"),r=e.mfaToken,o=await eI(C,this,ay).call(this,t)(n,{method:"GET",headers:{Authorization:"Bearer ".concat(r),"Content-Type":"application/json"}});if(!o.ok){let e,t=await o.clone().text(),n=o.status,r=i6(o.headers);try{e=JSON.parse(t)}catch(e){throw new ar("Failed to list authenticators",{error:"unknown_error",error_description:"Failed to list authenticators",statusCode:n,headers:r,body:t})}throw new ar(e.error_description||"Failed to list authenticators",eK(eK({},e),{},{statusCode:n,headers:r,body:t}))}return(await o.json()).map(ac)}async enrollAuthenticator(e,t){let n="".concat(ej(b,this),"/mfa/associate"),r=e.mfaToken,o=ez(e,iK),i={authenticator_types:o.authenticatorTypes};"oobChannels"in o&&(i.oob_channels=o.oobChannels),"phoneNumber"in o&&o.phoneNumber&&(i.phone_number=o.phoneNumber),"email"in o&&o.email&&(i.email=o.email);let a=await eI(C,this,ay).call(this,t)(n,{method:"POST",headers:{Authorization:"Bearer ".concat(r),"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let e,t=await a.clone().text(),n=a.status,r=i6(a.headers);try{e=JSON.parse(t)}catch(e){throw new ao("Failed to enroll authenticator",{error:"unknown_error",error_description:"Failed to enroll authenticator",statusCode:n,headers:r,body:t})}throw new ao(e.error_description||"Failed to enroll authenticator",eK(eK({},e),{},{statusCode:n,headers:r,body:t}))}var s=await a.json();if("otp"===s.authenticator_type)return{authenticatorType:"otp",secret:s.secret,barcodeUri:s.barcode_uri,recoveryCodes:s.recovery_codes,id:s.id};if("oob"===s.authenticator_type)return{authenticatorType:"oob",oobChannel:s.oob_channel,oobCode:s.oob_code,bindingMethod:s.binding_method,id:s.id,barcodeUri:s.barcode_uri,recoveryCodes:s.recovery_codes};throw Error("Unexpected authenticator type: ".concat(s.authenticator_type))}async deleteAuthenticator(e,t){let n=e.authenticatorId,r=e.mfaToken,o="".concat(ej(b,this),"/mfa/authenticators/").concat(encodeURIComponent(n)),i=await eI(C,this,ay).call(this,t)(o,{method:"DELETE",headers:{Authorization:"Bearer ".concat(r),"Content-Type":"application/json"}});if(!i.ok){let e,t=await i.clone().text(),n=i.status,r=i6(i.headers);try{e=JSON.parse(t)}catch(e){throw new ai("Failed to delete authenticator",{error:"unknown_error",error_description:"Failed to delete authenticator",statusCode:n,headers:r,body:t})}throw new ai(e.error_description||"Failed to delete authenticator",eK(eK({},e),{},{statusCode:n,headers:r,body:t}))}}async challengeAuthenticator(e,t){let n="".concat(ej(b,this),"/mfa/challenge"),r=e.mfaToken,o=ez(e,iz),i={mfa_token:r,client_id:ej(_,this),challenge_type:o.challengeType};ej(k,this)&&(i.client_secret=ej(k,this)),o.authenticatorId&&(i.authenticator_id=o.authenticatorId);let a=await eI(C,this,ay).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let e,t=await a.clone().text(),n=a.status,r=i6(a.headers);try{e=JSON.parse(t)}catch(e){throw new aa("Failed to challenge authenticator",{error:"unknown_error",error_description:"Failed to challenge authenticator",statusCode:n,headers:r,body:t})}throw new aa(e.error_description||"Failed to challenge authenticator",eK(eK({},e),{},{statusCode:n,headers:r,body:t}))}var s=await a.json();let c={challengeType:s.challenge_type};return void 0!==s.oob_code&&(c.oobCode=s.oob_code),void 0!==s.binding_method&&(c.bindingMethod=s.binding_method),c}async verify(e,t){var n,r,o,i,a,s,c;if(!ej(E,this))throw Error("MFA verify requires a configuration provider (getConfiguration was not set)");let l={mfa_token:e.mfaToken};if(e.audience&&(l.audience=e.audience),"otp"===e.factorType?l.otp=e.otp:"oob"===e.factorType?(l.oob_code=e.oobCode,e.bindingCode&&(l.binding_code=e.bindingCode)):"recovery-code"===e.factorType&&(l.recovery_code=e.recoveryCode),e.fullResponse){if(!ej(P,this))throw Error("MFA verify fullResponse requires a capture-config factory (createCaptureConfiguration was not set)");let a=ad(null!=(n=(await ej(E,this).call(this,t))[nw])?n:fetch),s=await ej(P,this).call(this,a);try{let t=await o0(s,af[e.factorType],l),n=al.fromTokenEndpointResponse(t);t.recovery_code&&(n.recoveryCode=t.recovery_code);let r=a.getCapturedResponse();if(!r)throw new i4;return{data:n,response:r}}catch(t){if(t instanceof i4||t instanceof as)throw t;let e=new as(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!=(r=t.error)?r:"mfa_verify_error",error_description:null!=(o=null!=(i=t.error_description)?i:t.message)?o:"Failed to verify MFA challenge"});throw i8(e,t,a.getCapturedResponse()),e}}let u=await ej(E,this).call(this,t);try{let t=await o0(u,af[e.factorType],l),n=al.fromTokenEndpointResponse(t);return t.recovery_code&&(n.recoveryCode=t.recovery_code),n}catch(t){if(t instanceof as)throw t;let e=new as(t.error_description||t.message||"Failed to verify MFA challenge",{error:null!=(a=t.error)?a:"mfa_verify_error",error_description:null!=(s=null!=(c=t.error_description)?c:t.message)?s:"Failed to verify MFA challenge"});throw i8(e,t),e}}constructor(e){var t,n;eU(this,C),eW(this,b,void 0),eW(this,_,void 0),eW(this,k,void 0),eW(this,S,void 0),eW(this,T,void 0),eW(this,E,void 0),eW(this,P,void 0),eN(b,this,"https://".concat(e.domain)),eN(_,this,e.clientId),eN(k,this,e.clientSecret),eN(S,this,null!=(t=e.customFetch)?t:function(){return fetch(...arguments)}),eN(T,this,null!=(n=e.telemetryConfig)?n:ah()),eN(E,this,e.getConfiguration),eN(P,this,e.createCaptureConfiguration)}});function ay(e){return ap(ej(S,this),e,ej(T,this))}var ag=class extends Error{constructor(e,t,n){super(t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"statusCode",void 0),eM(this,"headers",void 0),eM(this,"body",void 0),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};let r=iJ(n);this.statusCode=r.statusCode,this.headers=r.headers,this.body=r.body}},aw=class extends ag{constructor(e,t){super("passkey_register_error",e,t),this.name="PasskeyRegisterError"}},av=class extends ag{constructor(e,t){super("passkey_challenge_error",e,t),this.name="PasskeyChallengeError"}},ab=class extends ag{constructor(e,t){super("passkey_get_token_error",e,t),this.name="PasskeyGetTokenError",this.cause=t&&{error:t.error,error_description:t.error_description,message:t.message,mfa_token:t.mfa_token,mfa_requirements:t.mfa_requirements}}};function a_(e){return e.useMtls?{}:e.clientSecret?{client_secret:e.clientSecret}:{}}var ak="urn:okta:params:oauth:grant-type:webauthn",aS=(A=new WeakMap,R=new WeakMap,x=new WeakMap,I=new WeakMap,O=new WeakMap,j=new WeakMap,W=new WeakSet,class{async register(e,t){let n="".concat(ej(A,this),"/passkey/register"),r=eK(eK(eK(eK(eK(eK(eK(eK({},e.email&&{email:e.email}),e.name&&{name:e.name}),e.phoneNumber&&{phone_number:e.phoneNumber}),e.username&&{username:e.username}),e.givenName&&{given_name:e.givenName}),e.familyName&&{family_name:e.familyName}),e.nickname&&{nickname:e.nickname}),e.picture&&{picture:e.picture}),o=eK(eK({client_id:ej(R,this)},a_(ej(x,this))),{},{user_profile:r});e.realm&&(o.realm=e.realm),e.organization&&(o.organization=e.organization),e.userMetadata&&(o.user_metadata=e.userMetadata);let i=await eI(W,this,aT).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!i.ok){let e=await eI(W,this,aE).call(this,i),t=new aw(e.error_description||"Failed to request signup challenge",e);throw t.statusCode=i.status,t.headers=i6(i.headers),t}let a=await i.json();return{authSession:a.auth_session,authnParamsPublicKey:eK({},a.authn_params_public_key)}}async challenge(e,t){let n="".concat(ej(A,this),"/passkey/challenge"),r=eK({client_id:ej(R,this)},a_(ej(x,this)));null!=e&&e.realm&&(r.realm=e.realm),null!=e&&e.organization&&(r.organization=e.organization);let o=await eI(W,this,aT).call(this,t)(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(r)});if(!o.ok){let e=await eI(W,this,aE).call(this,o),t=new av(e.error_description||"Failed to request login challenge",e);throw t.statusCode=o.status,t.headers=i6(o.headers),t}let i=await o.json();return{authSession:i.auth_session,authnParamsPublicKey:eK({},i.authn_params_public_key)}}async getTokenByPasskey(e,t){let n;void 0!==e.organization&&ae(e.organization);let r=new URLSearchParams({auth_session:e.authSession,authn_response:JSON.stringify(e.credential)});e.realm&&r.append("realm",e.realm),e.scope&&r.append("scope",e.scope),e.audience&&r.append("audience",e.audience),e.organization&&r.append("organization",e.organization);try{n=await ej(j,this).call(this,ak,r,t,e.fullResponse)}catch(n){if(n instanceof i4)throw n;let e=iD(n),t=new ab(e.error_description||"Failed to exchange passkey credential for tokens.",e);throw i8(t,n),t}if(e.fullResponse){let t=n;return e.organization&&at(t.data.claims,e.organization),t}let o=n;return e.organization&&at(o.claims,e.organization),o}constructor(e){var t,n;eU(this,W),eW(this,A,void 0),eW(this,R,void 0),eW(this,x,void 0),eW(this,I,void 0),eW(this,O,void 0),eW(this,j,void 0),eN(A,this,"https://".concat(e.domain)),eN(R,this,e.clientId),eN(x,this,{clientSecret:e.clientSecret,useMtls:e.useMtls}),eN(I,this,null!=(t=e.customFetch)?t:function(){return fetch(...arguments)}),eN(O,this,null!=(n=e.telemetryConfig)?n:ah()),eN(j,this,e.grantRequest)}});function aT(e){return ap(ej(I,this),e,ej(O,this))}async function aE(e){let t=await e.clone().text();try{return eK(eK({},JSON.parse(t)),{},{statusCode:e.status,headers:e.headers,body:t})}catch(n){return{error:"unknown_error",error_description:"HTTP ".concat(e.status," ").concat(e.statusText),statusCode:e.status,headers:e.headers,body:t}}}var aP=class extends Error{constructor(e,t,n){super(t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"statusCode",void 0),eM(this,"headers",void 0),eM(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&(n.error||n.error_description)?{error:n.error,error_description:n.error_description,message:n.message,mfa_token:n.mfa_token,mfa_requirements:n.mfa_requirements}:void 0;let r=iJ(n);this.statusCode=r.statusCode,this.headers=r.headers,this.body=r.body}},aC=class extends aP{constructor(e,t){super("passwordless_start_error",e,t),this.name="PasswordlessStartError"}},aA=class extends aP{constructor(e,t){super("passwordless_verify_error",e,t),this.name="PasswordlessVerifyError"}},aR=class extends aP{constructor(e,t){super("passwordless_db_get_token_error",e,t),this.name="PasswordlessDbGetTokenError"}},ax=class extends aP{constructor(e,t,n,r,o){super("passwordless_challenge_error",e,n),eM(this,"statusCode",void 0),eM(this,"validationErrors",void 0),this.name="PasswordlessChallengeError",this.statusCode=t,this.validationErrors=r,this.headers=null!=o?o:this.headers}};function aI(e){return/^\+[1-9]\d{1,14}$/.test(e)}async function aO(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var r;let o=null!=(r=e.clientAssertionSigningAlg)?r:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await iL(e.clientAssertionSigningKey,o);return{client_assertion:await new iS({}).setProtectedHeader({alg:o}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}if(e.clientSecret)return{client_secret:e.clientSecret};throw new i3}var aj=(N=new WeakMap,U=new WeakMap,M=new WeakMap,L=new WeakMap,K=new WeakMap,z=new WeakMap,J=new WeakMap,D=new WeakSet,class{async sendEmail(e,t){let n=await eI(D,this,aN).call(this,function(e){var t;let n=null!=(t=e.send)?t:"code",r={email:e.email,connection:"email",send:n};return"link"===n&&e.authParams&&(r.authParams=e.authParams),r}(e),"Failed to send passwordless email",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async sendSms(e,t){if(!aI(e.phoneNumber))throw new aC("Phone number must be in E.164 format (e.g. +14155550100).");let n=await eI(D,this,aN).call(this,{phone_number:e.phoneNumber,connection:"sms"},"Failed to send passwordless SMS",e.language,t);if(e.fullResponse)return{data:void 0,response:n}}async challengeWithEmail(e,t){var n;let r={email:e.email,connection:e.connection,allow_signup:null!=(n=e.allowSignup)&&n};return eI(D,this,aU).call(this,r,"Failed to request email OTP challenge",t)}async challengeWithPhoneNumber(e,t){if(!aI(e.phoneNumber))throw new ax("Phone number must be in E.164 format (e.g. +14155550100).",0,void 0,void 0);let n=function(e){var t;let n={phone_number:e.phoneNumber,connection:e.connection,allow_signup:null!=(t=e.allowSignup)&&t};return e.deliveryMethod&&(n.delivery_method=e.deliveryMethod),n}(e);return eI(D,this,aU).call(this,n,"Failed to request phone OTP challenge",t)}async getTokenByPasswordlessDbConnection(e,t){let n=new URLSearchParams({auth_session:e.authSession,otp:e.otp});if(e.scope&&n.append("scope",e.scope),e.audience&&n.append("audience",e.audience),!ej(J,this))throw new aR("Missing grant request delegate.",iD(Error("missing grantRequest")));try{return await ej(J,this).call(this,"http://auth0.com/oauth/grant-type/passwordless/otp",n,t,e.fullResponse)}catch(t){if(t instanceof i4)throw t;let e=new aR("There was an error while trying to request a token.",iD(t));throw e.statusCode=t._statusCode,e.headers=t._headers,e}}constructor(e){var t,n;eU(this,D),eW(this,N,void 0),eW(this,U,void 0),eW(this,M,void 0),eW(this,L,void 0),eW(this,K,void 0),eW(this,z,void 0),eW(this,J,void 0),eN(U,this,e.domain),eN(N,this,"https://".concat(e.domain)),eN(M,this,e.clientId),eN(L,this,null!=(t=e.customFetch)?t:function(){return fetch(...arguments)}),eN(K,this,null!=(n=e.telemetryConfig)?n:ah()),eN(z,this,{clientSecret:e.clientSecret,clientAssertionSigningKey:e.clientAssertionSigningKey,clientAssertionSigningAlg:e.clientAssertionSigningAlg,useMtls:e.useMtls}),eN(J,this,e.grantRequest)}});function aW(e){return ap(ej(L,this),e,ej(K,this))}async function aN(e,t,n,r){var o;let i,a,s=await aO(ej(z,this),ej(M,this),ej(U,this)),c=eK(eK({client_id:ej(M,this)},e),s);try{i=await eI(D,this,aW).call(this,r)("".concat(ej(N,this),"/passwordless/start"),{method:"POST",headers:eK({"Content-Type":"application/json"},n?{"x-request-language":n}:{}),body:JSON.stringify(c)})}catch(e){throw new aC("".concat(t,": a network error occurred."))}if(i.ok)return i;let l=await i.clone().text();if(204!==i.status)try{a=JSON.parse(l)}catch(e){a=void 0}let u=new aC((null==(o=a)?void 0:o.error_description)||t,a);throw u.statusCode=i.status,u.headers=i6(i.headers),u.body=l,u}async function aU(e,t,n){var r,o;let i,a,s=await aO(ej(z,this),ej(M,this),ej(U,this)),c=eK(eK({client_id:ej(M,this)},e),s);try{i=await eI(D,this,aW).call(this,n)("".concat(ej(N,this),"/otp/challenge"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(c)})}catch(e){throw new ax("challenge error: a network error occurred.",0,void 0,void 0)}if(i.ok){let e;try{e=await i.json()}catch(e){throw new ax("".concat(t,": could not parse the response body."),i.status,void 0,void 0,i6(i.headers))}return{authSession:e.auth_session}}let l=await i.clone().text();try{a=JSON.parse(l)}catch(e){a=void 0}let u=a?eK(eK({},a),{},{statusCode:i.status,headers:i.headers,body:l}):{error:"",error_description:"",statusCode:i.status,headers:i.headers,body:l};throw new ax((null==(r=a)?void 0:r.error_description)||t,i.status,u,null==(o=a)?void 0:o.validation_errors,i6(i.headers))}var aM=class extends Error{constructor(e,t,n){super(t),eM(this,"cause",void 0),eM(this,"code",void 0),eM(this,"statusCode",void 0),eM(this,"headers",void 0),eM(this,"body",void 0),Object.setPrototypeOf(this,new.target.prototype),this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message};let r=iJ(n);this.statusCode=r.statusCode,this.headers=r.headers,this.body=r.body}},aL=class extends aM{constructor(e,t){super("signup_error",e,t),this.name="SignUpError"}},aK=class extends aM{constructor(e,t){super("change_password_error",e,t),this.name="ChangePasswordError"}};function az(e,t,n){for(let r of t)if(null===e[r]||void 0===e[r]||""===e[r])throw new n('Required parameter "'.concat(String(r),'" was null, undefined, or empty.'))}function aJ(e){var t,n;return{id:null!=(t=null!=(n=e._id)?n:e.user_id)?t:e.id,email:"string"==typeof e.email?e.email:"",emailVerified:!!e.email_verified,username:e.username,givenName:e.given_name,familyName:e.family_name,name:e.name,nickname:e.nickname,picture:e.picture,userMetadata:e.user_metadata}}var aD=(Z=new WeakMap,H=new WeakMap,F=new WeakMap,G=new WeakMap,V=new WeakSet,class{async signUp(e,t){var n;az(e,["email","password","connection"],aL);let r=eK({client_id:null!=(n=e.clientId)?n:ej(H,this)},function(e){let t={email:e.email,password:e.password,connection:e.connection};return void 0!==e.username&&(t.username=e.username),void 0!==e.givenName&&(t.given_name=e.givenName),void 0!==e.familyName&&(t.family_name=e.familyName),void 0!==e.name&&(t.name=e.name),void 0!==e.nickname&&(t.nickname=e.nickname),void 0!==e.picture&&(t.picture=e.picture),void 0!==e.userMetadata&&(t.user_metadata=e.userMetadata),t}(e)),o=await eI(V,this,aZ).call(this,"/dbconnections/signup",r,aL,"Failed to sign up",t);if(e.fullResponse){let e=o.clone();return{data:aJ(await o.json()),response:e}}return aJ(await o.json())}async changePassword(e,t){var n;if(az(e,["connection"],aK),!e.email&&!e.username)throw new aK('Either "email" or "username" is required.');let r=eK({client_id:null!=(n=e.clientId)?n:ej(H,this)},function(e){let t={connection:e.connection};return void 0!==e.email&&(t.email=e.email),void 0!==e.username&&(t.username=e.username),void 0!==e.organization&&(t.organization=e.organization),t}(e)),o=await eI(V,this,aZ).call(this,"/dbconnections/change_password",r,aK,"Failed to request a password change",t);if(e.fullResponse){let e=o.clone();return{data:await o.text(),response:e}}return o.text()}constructor(e){var t,n;eU(this,V),eW(this,Z,void 0),eW(this,H,void 0),eW(this,F,void 0),eW(this,G,void 0),eN(Z,this,"https://".concat(e.domain)),eN(H,this,e.clientId),eN(F,this,null!=(t=e.customFetch)?t:function(){return fetch(...arguments)}),eN(G,this,null!=(n=e.telemetryConfig)?n:ah())}});async function aZ(e,t,n,r,o){let i,a=ap(ej(F,this),o,ej(G,this));try{i=await a("".concat(ej(Z,this)).concat(e),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}catch(e){throw new n("".concat(r,": a network error occurred."))}if(i.ok)return i;let s=await i.clone().text(),c=await async function(e){let t;try{t=await e.json()}catch(e){return}return"string"==typeof t.error?t:"string"==typeof t.code?{error:t.code,error_description:"string"==typeof t.description?t.description:""}:void 0}(i.clone()),l=new n((null==c?void 0:c.error_description)||r,null!=c?c:{error:"unknown_error",error_description:r});throw l.statusCode=i.status,l.headers=i6(i.headers),l.body=s,l}var aH=class extends Error{constructor(e,t,n){super(t),eM(this,"code",void 0),eM(this,"cause",void 0),this.name="AnonymousSessionError",this.code=e,this.cause=n&&{error:n.error,error_description:n.error_description,message:n.message}}},aF=new Set(["session_expired","invalid_session_token"]);async function aG(e){let t="Request failed with status ".concat(e.status),n={};try{n=await e.json()}catch(e){}return{error:"string"==typeof n.error?n.error:"server_error",error_description:"string"==typeof n.error_description?n.error_description:t}}var aV=(X=new WeakMap,Y=new WeakMap,q=new WeakMap,B=new WeakMap,Q=new WeakMap,$=new WeakMap,ee=new WeakMap,et=new WeakMap,en=new WeakSet,class{async createSession(e){let t={client_id:ej(q,this)};null!=e&&e.audience&&(t.audience=e.audience),null!=e&&e.scope&&(t.scope=e.scope),null!=e&&e.metadata&&(t.metadata=e.metadata);let n=await eI(en,this,aY).call(this,t);if(!n.sessionToken)throw new aH("server_error","session_token missing from create session response");return{sessionToken:n.sessionToken,accessToken:n.accessToken,expiresAt:n.expiresAt,sessionTokenExpiresAt:n.sessionTokenExpiresAt,scope:n.scope}}async getAccessToken(e){if(null==e||!e.sessionToken)return this.createSession({audience:null==e?void 0:e.audience,scope:null==e?void 0:e.scope});try{return await eI(en,this,aX).call(this,e.sessionToken,e)}catch(t){if(t instanceof aH&&aF.has(t.code))return eK(eK({},await this.createSession({audience:null==e?void 0:e.audience,scope:null==e?void 0:e.scope})),{},{sessionReplaced:!0});throw t}}async logout(){let e="".concat(ej(Y,this),"/anonymous/logout"),t={client_id:ej(q,this)},n=await ej(et,this).call(this,e,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(t)});if(!n.ok){let e=await aG(n);throw new aH(e.error,e.error_description||"Failed to end anonymous session",e)}}constructor(e){var t;eU(this,en),eW(this,X,void 0),eW(this,Y,void 0),eW(this,q,void 0),eW(this,B,void 0),eW(this,Q,void 0),eW(this,$,void 0),eW(this,ee,void 0),eW(this,et,void 0),eN(X,this,e.domain),eN(Y,this,"https://".concat(e.domain)),eN(q,this,e.clientId),eN(B,this,e.clientSecret),eN(Q,this,e.clientAssertionSigningKey),eN($,this,e.clientAssertionSigningAlg),eN(ee,this,e.useMtls),eN(et,this,null!=(t=e.customFetch)?t:function(){return fetch(...arguments)})}});async function aX(e,t){let n={client_id:ej(q,this),session_token:e};null!=t&&t.audience&&(n.audience=t.audience),null!=t&&t.scope&&(n.scope=t.scope);let r=await eI(en,this,aY).call(this,n);return{sessionToken:e,accessToken:r.accessToken,expiresAt:r.expiresAt,sessionTokenExpiresAt:r.sessionTokenExpiresAt,scope:r.scope,sessionReplaced:!1}}async function aY(e){let t,n="".concat(ej(Y,this),"/anonymous/token");Object.assign(e,await async function(e,t,n){if(e.useMtls)return{};if(e.clientAssertionSigningKey){var r;let o=null!=(r=e.clientAssertionSigningAlg)?r:"RS256",i=e.clientAssertionSigningKey instanceof CryptoKey?e.clientAssertionSigningKey:await iL(e.clientAssertionSigningKey,o);return{client_assertion:await new iS({}).setProtectedHeader({alg:o}).setIssuer(t).setSubject(t).setAudience("https://".concat(n,"/")).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("".concat(120,"s")).sign(i),client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}return e.clientSecret?{client_secret:e.clientSecret}:{}}({clientSecret:ej(B,this),clientAssertionSigningKey:ej(Q,this),clientAssertionSigningAlg:ej($,this),useMtls:ej(ee,this)},ej(q,this),ej(X,this)));let r=await ej(et,this).call(this,n,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",redirect:"error",body:JSON.stringify(e)});if(!r.ok){let e=await aG(r);throw new aH(e.error,e.error_description||"Anonymous token request failed",e)}try{t=await r.json()}catch(e){throw new aH("server_error","Invalid response from anonymous token endpoint")}var o=t;let i=Math.floor(Date.now()/1e3);if("string"!=typeof o.access_token||!o.access_token)throw new aH("server_error","access_token missing or invalid in anonymous token response");let a=o.expires_in;if("number"!=typeof a||!Number.isFinite(a))throw new aH("server_error","expires_in missing or invalid in anonymous token response");return{accessToken:o.access_token,expiresAt:i+a,scope:o.scope,sessionToken:o.session_token,sessionTokenExpiresAt:"number"==typeof o.session_expires_in&&Number.isFinite(o.session_expires_in)?i+o.session_expires_in:void 0}}var aq=(er=new WeakMap,eo=new WeakMap,ei=new WeakMap,class{get(e){let t=ej(er,this).get(e);if(t){if(!(Date.now()>=t.expiresAt))return ej(er,this).delete(e),ej(er,this).set(e,t),t.value;ej(er,this).delete(e)}}set(e,t,n){ej(er,this).has(e)&&ej(er,this).delete(e);let r=null!=n&&Number.isFinite(n)&&n>0?n:ej(eo,this);for(ej(er,this).set(e,{value:t,expiresAt:Date.now()+r});ej(er,this).size>ej(ei,this);){let e=ej(er,this).keys().next().value;if(void 0===e)break;ej(er,this).delete(e)}}constructor(e,t){eW(this,er,new Map),eW(this,eo,void 0),eW(this,ei,void 0),eN(ei,this,Math.max(1,Math.floor(e))),eN(eo,this,Math.max(0,Math.floor(t)))}}),aB=new Map;function aQ(e){return{ttlMs:1e3*("number"==typeof(null==e?void 0:e.ttl)?e.ttl:600),maxEntries:"number"==typeof(null==e?void 0:e.maxEntries)&&e.maxEntries>0?e.maxEntries:100}}var a$=class{static createDiscoveryCache(e){var t,n;let r=(t=e.maxEntries,n=e.ttlMs,"".concat(t,":").concat(n)),o=aB.get(r);return o||(o=new aq(e.maxEntries,e.ttlMs),aB.set(r,o)),o}static createJwksCache(){return{}}},a0="openid profile email offline_access",a2=Object.freeze(new Set(["grant_type","client_id","client_secret","client_assertion","client_assertion_type","subject_token","subject_token_type","requested_token_type","actor_token","actor_token_type","audience","aud","resource","resources","resource_indicator","scope","connection","login_hint","organization","assertion"]));function a1(e){if(null==e)throw new iq("subject_token is required");if("string"!=typeof e)throw new iq("subject_token must be a string");if(0===e.trim().length)throw new iq("subject_token cannot be blank or whitespace");if(e!==e.trim())throw new iq("subject_token must not include leading or trailing whitespace");if(/^bearer\s+/i.test(e))throw new iq("subject_token must not include the 'Bearer ' prefix")}function a5(e,t){if(t)for(let r of Object.entries(t)){var n=eJ(r,2);let t=n[0],o=n[1];if(!a2.has(t))if(Array.isArray(o)){if(o.length>20)throw new iq("Parameter '".concat(t,"' exceeds maximum array size of ").concat(20));o.forEach(n=>{e.append(t,n)})}else e.append(t,o)}}var a3="urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",a9="urn:ietf:params:oauth:grant-type:token-exchange",a4="urn:ietf:params:oauth:token-type:access_token";function a6(e,t){return(n,r)=>{let o=null==r?void 0:r.body;if(t!==ak||!(o instanceof URLSearchParams))return e(n,r);let i={};for(let e of o){var a=eJ(e,2);let t=a[0],n=a[1];i[t]="authn_response"===t?JSON.parse(n):n}let s=new Headers(null==r?void 0:r.headers);return s.set("Content-Type","application/json"),e(n,eK(eK({},r),{},{headers:s,body:JSON.stringify(i)}))}}var a8=(ea=new WeakMap,es=new WeakMap,ec=new WeakMap,el=new WeakMap,eu=new WeakMap,eh=new WeakMap,ed=new WeakMap,ep=new WeakMap,ef=new WeakMap,em=new WeakMap,ey=new WeakMap,eg=new WeakSet,class{async getServerMetadata(){return(await eI(eg,this,sr).call(this)).serverMetadata}async buildAuthorizationUrl(e){let t=(await eI(eg,this,sr).call(this)).serverMetadata;if(null!=e&&e.pushedAuthorizationRequests&&!t.pushed_authorization_request_endpoint)throw new iZ("par_not_supported_error","The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");try{return await eI(eg,this,su).call(this,e)}catch(e){throw new i2(e)}}async buildLinkUserUrl(e){try{let t=await eI(eg,this,su).call(this,{authorizationParams:eK(eK({},e.authorizationParams),{},{requested_connection:e.connection,requested_connection_scope:e.connectionScope,scope:"openid link_account offline_access",id_token_hint:e.idToken})});return{linkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new i1(e)}}async buildUnlinkUserUrl(e){try{let t=await eI(eg,this,su).call(this,{authorizationParams:eK(eK({},e.authorizationParams),{},{requested_connection:e.connection,scope:"openid unlink_account",id_token_hint:e.idToken})});return{unlinkUserUrl:t.authorizationUrl,codeVerifier:t.codeVerifier}}catch(e){throw new i5(e)}}async backchannelAuthentication(e,t){var n,r;let o=await eI(eg,this,sn).call(this,t),i=o.configuration,a=o.serverMetadata,s=i7(eK(eK({},ej(eu,this).authorizationParams),null==e?void 0:e.authorizationParams)),c=new URLSearchParams(eK(eK({scope:a0},s),{},{client_id:ej(eu,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:a.issuer,sub:e.loginHint.sub})}));if(e.requestedExpiry&&c.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&c.append("authorization_details",JSON.stringify(e.authorizationDetails)),e.fullResponse){let e=ad(null!=(r=i[nw])?r:ej(eh,this)),t=await eI(eg,this,se).call(this,i.serverMetadata(),e);try{let n=await oJ(i,c),r=await oD(t,n),o=e.getCapturedResponse();if(!o)throw new i4;return{data:al.fromTokenEndpointResponse(r),response:o}}catch(n){if(n instanceof i4)throw n;let t=new i0(n);throw i8(t,n,e.getCapturedResponse()),t}}let l=ad(null!=(n=i[nw])?n:ej(eh,this)),u=await eI(eg,this,se).call(this,i.serverMetadata(),l);try{let e=await oJ(i,c),t=await oD(u,e);return al.fromTokenEndpointResponse(t)}catch(t){let e=new i0(t);throw i8(e,t,l.getCapturedResponse()),e}}async initiateBackchannelAuthentication(e,t){var n;let r=await eI(eg,this,sn).call(this,t),o=r.configuration,i=r.serverMetadata,a=i7(eK(eK({},ej(eu,this).authorizationParams),null==e?void 0:e.authorizationParams)),s=new URLSearchParams(eK(eK({scope:a0},a),{},{client_id:ej(eu,this).clientId,binding_message:e.bindingMessage,login_hint:JSON.stringify({format:"iss_sub",iss:i.issuer,sub:e.loginHint.sub})}));e.requestedExpiry&&s.append("requested_expiry",e.requestedExpiry.toString()),e.authorizationDetails&&s.append("authorization_details",JSON.stringify(e.authorizationDetails));let c=ad(null!=(n=o[nw])?n:ej(eh,this)),l=await eI(eg,this,se).call(this,o.serverMetadata(),c);try{let e=await oJ(l,s);return{authReqId:e.auth_req_id,expiresIn:e.expires_in,interval:e.interval}}catch(n){let e=new i0(n),t=c.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async backchannelAuthenticationGrant(e,t){var n;let r=e.authReqId,o=(await eI(eg,this,sn).call(this,t)).configuration,i=new URLSearchParams({auth_req_id:r}),a=ad(null!=(n=o[nw])?n:ej(eh,this)),s=await eI(eg,this,se).call(this,o.serverMetadata(),a);try{let e=await o0(s,"urn:openid:params:grant-type:ciba",i);return al.fromTokenEndpointResponse(e)}catch(n){let e=new i0(n),t=a.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async getTokenForConnection(e,t){var n;if(e.refreshToken&&e.accessToken)throw new iY("Either a refresh or access token should be specified, but not both.");let r=null!=(n=e.accessToken)?n:e.refreshToken;if(!r)throw new iY("Either a refresh or access token must be specified.");try{return await this.exchangeToken(eK({connection:e.connection,subjectToken:r,subjectTokenType:e.accessToken?a4:"urn:ietf:params:oauth:token-type:refresh_token",loginHint:e.loginHint},e.fullResponse?{fullResponse:!0}:{}),t)}catch(e){if(e instanceof iq){let t=new iY(e.message,e.cause);throw t.statusCode=e.statusCode,t.headers=e.headers,t}throw e}}async exchangeToken(e,t){return e.fullResponse?"connection"in e?eI(eg,this,si).call(this,e,t,!0):eI(eg,this,ss).call(this,e,t,!0):"connection"in e?eI(eg,this,si).call(this,e,t):eI(eg,this,ss).call(this,e,t)}async getTokenByCode(e,t,n){var r,o;let i,a=(await eI(eg,this,sn).call(this,n)).configuration;if(void 0!==t.organization&&ae(t.organization),t.fullResponse){let n,r,i=ad(null!=(o=a[nw])?o:ej(eh,this)),s=await eI(eg,this,se).call(this,a.serverMetadata(),i);try{let o=await oH(s,e,{pkceCodeVerifier:t.codeVerifier});if(n=al.fromTokenEndpointResponse(o),!(r=i.getCapturedResponse()))throw new i4}catch(n){if(n instanceof i4)throw n;let e=new iF("There was an error while trying to request a token.",iD(n)),t=i.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}return t.organization&&at(n.claims,t.organization),{data:n,response:r}}let s=ad(null!=(r=a[nw])?r:ej(eh,this)),c=await eI(eg,this,se).call(this,a.serverMetadata(),s);try{let n=await oH(c,e,{pkceCodeVerifier:t.codeVerifier});i=al.fromTokenEndpointResponse(n)}catch(n){let e=new iF("There was an error while trying to request a token.",iD(n)),t=s.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}return t.organization&&at(i.claims,t.organization),i}async getTokenByMagicLinkCode(e,t,n){var r,o;let i=(await eI(eg,this,sn).call(this,n)).configuration;if(null!=t&&t.fullResponse){let n=ad(null!=(o=i[nw])?o:ej(eh,this)),r=await eI(eg,this,se).call(this,i.serverMetadata(),n);try{let o=await oH(r,e,{expectedState:null==t?void 0:t.expectedState}),i=al.fromTokenEndpointResponse(o),a=n.getCapturedResponse();if(!a)throw new i4;return{data:i,response:a}}catch(r){if(r instanceof i4)throw r;let e=new iF(r instanceof Error&&r.message?r.message:"There was an error while trying to request a token.",r),t=n.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}let a=ad(null!=(r=i[nw])?r:ej(eh,this)),s=await eI(eg,this,se).call(this,i.serverMetadata(),a);try{let n=await oH(s,e,{expectedState:null==t?void 0:t.expectedState});return al.fromTokenEndpointResponse(n)}catch(n){let e=new iF(n instanceof Error&&n.message?n.message:"There was an error while trying to request a token.",n),t=a.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async getTokenByRefreshToken(e,t){var n,r;let o=(await eI(eg,this,sn).call(this,t)).configuration,i=new URLSearchParams;if(e.audience&&i.append("audience",e.audience),e.scope&&i.append("scope",e.scope),e.fullResponse){let t=ad(null!=(r=o[nw])?r:ej(eh,this)),n=await eI(eg,this,se).call(this,o.serverMetadata(),t);try{let r=await oF(n,e.refreshToken,i),o=al.fromTokenEndpointResponse(r),a=t.getCapturedResponse();if(!a)throw new i4;return{data:o,response:a}}catch(r){if(r instanceof i4)throw r;let e=new iV("The access token has expired and there was an error while trying to refresh it.",iD(r)),n=t.getCapturedResponse();throw e.statusCode=null==n?void 0:n.status,e.headers=n?i6(n.headers):void 0,e}}let a=ad(null!=(n=o[nw])?n:ej(eh,this)),s=await eI(eg,this,se).call(this,o.serverMetadata(),a);try{let t=await oF(s,e.refreshToken,i);return al.fromTokenEndpointResponse(t)}catch(n){let e=new iV("The access token has expired and there was an error while trying to refresh it.",iD(n)),t=a.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async revokeToken(e,t){var n;let r=(await eI(eg,this,sn).call(this,t)).configuration,o={};e.tokenTypeHint&&(o.token_type_hint=e.tokenTypeHint);let i=ad(null!=(n=r[nw])?n:ej(eh,this)),a=await eI(eg,this,se).call(this,r.serverMetadata(),i);try{await o2(a,e.token,o)}catch(n){let e=new iB("An error occurred while trying to revoke the token.",iD(n)),t=i.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async getUserInfo(e,t){let n=(await eI(eg,this,sn).call(this,t,!0)).configuration;try{var r;return await oB(n,e.accessToken,null!=(r=e.expectedSubject)?r:n3)}catch(e){throw new iQ("There was an error while trying to retrieve the user info.",iD(e))}}async getTokenByPassword(e,t){var n,r;let o=(await eI(eg,this,sn).call(this,t)).configuration,i=new URLSearchParams({username:e.username,password:e.password});e.audience&&i.append("audience",e.audience),e.scope&&i.append("scope",e.scope),e.realm&&i.append("realm",e.realm);let a=o;if(e.auth0ForwardedFor){let t=await eI(eg,this,sl).call(this);a=new oM(o.serverMetadata(),ej(eu,this).clientId,{client_secret:ej(eu,this).clientSecret,use_mtls_endpoint_aliases:ej(eu,this).useMtls},t);let n=o[nw];a[nw]=(t,r)=>n(t,eK(eK({},r),{},{headers:eK(eK({},r.headers),{},{"auth0-forwarded-for":e.auth0ForwardedFor})}))}if(e.fullResponse){let e=ad(null!=(r=a[nw])?r:ej(eh,this)),t=await eI(eg,this,se).call(this,a.serverMetadata(),e);try{let n=await o0(t,"password",i),r=al.fromTokenEndpointResponse(n),o=e.getCapturedResponse();if(!o)throw new i4;return{data:r,response:o}}catch(r){if(r instanceof i4)throw r;let t=new iX("There was an error while trying to request a token.",iD(r)),n=e.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?i6(n.headers):void 0,t}}let s=ad(null!=(n=a[nw])?n:ej(eh,this)),c=await eI(eg,this,se).call(this,a.serverMetadata(),s);try{let e=await o0(c,"password",i);return al.fromTokenEndpointResponse(e)}catch(n){let e=new iX("There was an error while trying to request a token.",iD(n)),t=s.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async getTokenByPasswordlessEmail(e,t){let n=new URLSearchParams({username:e.email,otp:e.code,realm:"email"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),eI(eg,this,sc).call(this,n,t,e.fullResponse)}async getTokenByPasswordlessSms(e,t){if(!aI(e.phoneNumber))throw new aA("Phone number must be in E.164 format (e.g. +14155550100).");let n=new URLSearchParams({username:e.phoneNumber,otp:e.code,realm:"sms"});return e.audience&&n.append("audience",e.audience),e.scope&&n.append("scope",e.scope),eI(eg,this,sc).call(this,n,t,e.fullResponse)}async getTokenByClientCredentials(e,t){var n,r;let o=(await eI(eg,this,sn).call(this,t)).configuration;if(e.fullResponse){let t=ad(null!=(r=o[nw])?r:ej(eh,this)),n=await eI(eg,this,se).call(this,o.serverMetadata(),t),i=new URLSearchParams({audience:e.audience});e.organization&&i.append("organization",e.organization);try{let e=await oG(n,i),r=al.fromTokenEndpointResponse(e),o=t.getCapturedResponse();if(!o)throw new i4;return{data:r,response:o}}catch(r){if(r instanceof i4)throw r;let e=new iG("There was an error while trying to request a token.",iD(r)),n=t.getCapturedResponse();throw e.statusCode=null==n?void 0:n.status,e.headers=n?i6(n.headers):void 0,e}}let i=ad(null!=(n=o[nw])?n:ej(eh,this)),a=await eI(eg,this,se).call(this,o.serverMetadata(),i);try{let t=new URLSearchParams({audience:e.audience});e.organization&&t.append("organization",e.organization);let n=await oG(a,t);return al.fromTokenEndpointResponse(n)}catch(n){let e=new iG("There was an error while trying to request a token.",iD(n)),t=i.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async buildLogoutUrl(e){let t=await eI(eg,this,sr).call(this),n=t.configuration;if(!t.serverMetadata.end_session_endpoint){let t=new URL("https://".concat(ej(eu,this).domain,"/v2/logout"));return t.searchParams.set("returnTo",e.returnTo),t.searchParams.set("client_id",ej(eu,this).clientId),e.federated&&t.searchParams.set("federated",""),t}let r={post_logout_redirect_uri:e.returnTo};return e.federated&&(r.federated=""),function(e,t){oY(e);let n=oC(e),r=n.as,o=n.c,i=nG(r,"end_session_endpoint",!1,n.tlsOnly);for(let e of((t=new URLSearchParams(t)).has("client_id")||t.set("client_id",o.client_id),t.entries())){var a=eJ(e,2);let t=a[0],n=a[1];i.searchParams.append(t,n)}return i}(n,r)}async verifyLogoutToken(e){let t=(await eI(eg,this,sr).call(this)).serverMetadata,n=aQ(ej(eu,this).discoveryCache),r=t.jwks_uri;ej(ep,this)||eN(ep,this,function(e,t){if(!(e instanceof URL))throw TypeError("url must be an instance of URL");let n=new URL(e.href).href,r=null!=t?t:{},o=r.timeoutDuration;if("number"==typeof o&&(!Number.isInteger(o)||o<0))throw TypeError('"timeoutDuration" option must be a non-negative integer');let i="number"==typeof o?o:5e3,a=iM(r.cooldownDuration,3e4,"cooldownDuration"),s=iM(r.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(r.headers);d&&!c.has("User-Agent")&&c.set("User-Agent",d),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");let l=r[iW],u=r[iN],h,p,f,m=0,y=0;if(u&&"object"==typeof u){let e=u.uat,t=u.jwks;iU(e,s)&&oo(t)&&(h=e,f=ij(t))}let g=async()=>{if(p&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(p=void 0),!p){let e=++m,t=p=(async function(e,t,n){let r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:fetch,o=await r(e,{method:"GET",signal:n,redirect:"manual",headers:t}).catch(e=>{if("TimeoutError"===e.name)throw new r4;throw e});if(200!==o.status)throw new rq("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch(e){throw new rq("Failed to parse the JSON Web Key Set HTTP response as JSON")}})(n,c,AbortSignal.timeout(i),l).then(t=>{let n=ij(t);if(e<=y)return;f=n;let r=Date.now();u&&(u.uat=r,u.jwks=t),h=r,y=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{f&&iU(h,s)||await g();try{return await f(e,t)}catch(n){if(n instanceof r3&&!iU(h,a))return await g(),f(e,t);throw n}},{coolingDown:{get:()=>iU(h,a),enumerable:!0},fresh:{get:()=>iU(h,s),enumerable:!0},reload:{value:g,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>{var e;return null==(e=f)?void 0:e.jwks()},enumerable:!0}})}(new URL(r),{cacheMaxAge:n.ttlMs,[iW]:ej(eh,this),[iN]:ej(ey,this)}));let o=(await iw(e.logoutToken,ej(ep,this),{issuer:t.issuer,audience:ej(eu,this).clientId,algorithms:["RS256"],requiredClaims:["iat"]})).payload;if(!("sid"in o)&&!("sub"in o))throw new i$('either "sid" or "sub" (or both) claims must be present');if("sid"in o&&"string"!=typeof o.sid)throw new i$('"sid" claim must be a string');if("sub"in o&&"string"!=typeof o.sub)throw new i$('"sub" claim must be a string');if("nonce"in o)throw new i$('"nonce" claim is prohibited');if(!("events"in o))throw new i$('"events" claim is missing');if("object"!=typeof o.events||null===o.events)throw new i$('"events" claim must be an object');if(!("http://schemas.openid.net/event/backchannel-logout"in o.events))throw new i$('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim');if("object"!=typeof o.events["http://schemas.openid.net/event/backchannel-logout"])throw new i$('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object');return{sid:o.sid,sub:o.sub}}constructor(e){var t;if(eU(this,eg),eW(this,ea,void 0),eW(this,es,void 0),eW(this,ec,void 0),eW(this,el,void 0),eW(this,eu,void 0),eW(this,eh,void 0),eW(this,ed,void 0),eW(this,ep,void 0),eW(this,ef,void 0),eW(this,em,void 0),eW(this,ey,void 0),eM(this,"mfa",void 0),eM(this,"passkey",void 0),eM(this,"passwordless",void 0),eM(this,"database",void 0),eM(this,"anonymous",void 0),eN(eu,this,e),e.useMtls&&!e.customFetch)throw new iZ("mtls_without_custom_fetch_not_supported","Using mTLS without a custom fetch implementation is not supported");eN(ed,this,ah(e.telemetry)),eN(eh,this,au(null!=(t=e.customFetch)?t:function(){return fetch(...arguments)},ej(ed,this)));let n=aQ(e.discoveryCache);eN(ef,this,a$.createDiscoveryCache(n)),eN(em,this,new Map),eN(ey,this,a$.createJwksCache()),this.mfa=new am({domain:ej(eu,this).domain,clientId:ej(eu,this).clientId,clientSecret:ej(eu,this).clientSecret,customFetch:ej(eh,this),telemetryConfig:ej(ed,this),getConfiguration:async e=>(await eI(eg,this,sn).call(this,e)).configuration,createCaptureConfiguration:async e=>{let t=(await eI(eg,this,sr).call(this)).serverMetadata;return eI(eg,this,se).call(this,t,e)}}),this.passkey=new aS({domain:ej(eu,this).domain,clientId:ej(eu,this).clientId,clientSecret:ej(eu,this).clientSecret,useMtls:ej(eu,this).useMtls,customFetch:ej(eh,this),telemetryConfig:ej(ed,this),grantRequest:async(e,t,n,r)=>{let o=(await eI(eg,this,sr).call(this)).serverMetadata,i=eI(eg,this,st).call(this,n);if(r){let n=ad(i),r=await eI(eg,this,se).call(this,o,n);r[nw]=a6(n,e);let a=await o0(r,e,t),s=al.fromTokenEndpointResponse(a),c=n.getCapturedResponse();if(!c)throw new i4;return{data:s,response:c}}let a=await eI(eg,this,se).call(this,o);a[nw]=a6(i,e);let s=await o0(a,e,t);return al.fromTokenEndpointResponse(s)}}),this.passwordless=new aj({domain:ej(eu,this).domain,clientId:ej(eu,this).clientId,customFetch:ej(eh,this),telemetryConfig:ej(ed,this),clientSecret:ej(eu,this).clientSecret,clientAssertionSigningKey:ej(eu,this).clientAssertionSigningKey,clientAssertionSigningAlg:ej(eu,this).clientAssertionSigningAlg,useMtls:ej(eu,this).useMtls,grantRequest:async(e,t,n,r)=>{let o=(await eI(eg,this,sn).call(this,n)).configuration;if(r){var i;let n=ad(null!=(i=o[nw])?i:ej(eh,this)),r=await eI(eg,this,se).call(this,o.serverMetadata(),n),a=await o0(r,e,t),s=al.fromTokenEndpointResponse(a),c=n.getCapturedResponse();if(!c)throw new i4;return{data:s,response:c}}try{let n=await o0(o,e,t);return al.fromTokenEndpointResponse(n)}catch(t){let e={};throw i8(e,t),t._statusCode=e.statusCode,t._headers=e.headers,t}}}),this.database=new aD({domain:ej(eu,this).domain,clientId:ej(eu,this).clientId,customFetch:ej(eh,this),telemetryConfig:ej(ed,this)}),this.anonymous=new aV({domain:ej(eu,this).domain,clientId:ej(eu,this).clientId,clientSecret:ej(eu,this).clientSecret,clientAssertionSigningKey:ej(eu,this).clientAssertionSigningKey,clientAssertionSigningAlg:ej(eu,this).clientAssertionSigningAlg,useMtls:ej(eu,this).useMtls,customFetch:ej(eh,this)})}});function a7(){let e=ej(eu,this).domain.toLowerCase();return"".concat(e,"|mtls:").concat(ej(eu,this).useMtls?"1":"0")}async function se(e,t){let n=arguments.length>2&&void 0!==arguments[2]&&arguments[2],r=await eI(eg,this,sl).call(this,n),o=new oM(e,ej(eu,this).clientId,{client_secret:ej(eu,this).clientSecret,use_mtls_endpoint_aliases:ej(eu,this).useMtls},r);return o[nw]=null!=t?t:ej(eh,this),o}function st(e){return ap(ej(eh,this),e,ej(ed,this))}async function sn(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=await eI(eg,this,sr).call(this,t),r=n.configuration,o=n.serverMetadata;if(!e)return{configuration:r,serverMetadata:o};let i=eI(eg,this,st).call(this,e);return{configuration:await eI(eg,this,se).call(this,o,i,t),serverMetadata:o}}async function sr(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0],t=ej(e?es:ea,this);if(t&&ej(ec,this))return{configuration:t,serverMetadata:ej(ec,this)};let n=eI(eg,this,a7).call(this);e||await eI(eg,this,sl).call(this,!1);let r=ej(ef,this).get(n);if(r)return eI(eg,this,so).call(this,r.serverMetadata,e);let o=ej(em,this).get(n);if(o){let t=await o;return eI(eg,this,so).call(this,t.serverMetadata,e)}let i=(async()=>{let e=(await oN(new URL("https://".concat(ej(eu,this).domain)),ej(eu,this).clientId,{use_mtls_endpoint_aliases:ej(eu,this).useMtls},(e,t,n,r)=>{n.set("client_id",t.client_id)},{[nw]:ej(eh,this)})).serverMetadata();return ej(ef,this).set(n,{serverMetadata:e}),{serverMetadata:e}})();i.catch(()=>{}),ej(em,this).set(n,i);try{let t=(await i).serverMetadata;return eI(eg,this,so).call(this,t,e)}finally{ej(em,this).delete(n)}}async function so(e,t){let n=await eI(eg,this,se).call(this,e,void 0,t);return eN(ec,this,e),eN(t?es:ea,this,n),{configuration:n,serverMetadata:e}}async function si(e,t,n){var r,o,i,a;let s=(await eI(eg,this,sn).call(this,t)).configuration;if("audience"in e||"resource"in e)throw new iq("audience and resource parameters are not supported for Token Vault exchanges");a1(e.subjectToken);let c=new URLSearchParams({connection:e.connection,subject_token:e.subjectToken,subject_token_type:null!=(r=e.subjectTokenType)?r:a4,requested_token_type:null!=(o=e.requestedTokenType)?o:"http://auth0.com/oauth/token-type/federated-connection-access-token"});if(e.loginHint&&c.append("login_hint",e.loginHint),e.scope&&c.append("scope",e.scope),a5(c,e.extra),n){let t=ad(null!=(a=s[nw])?a:ej(eh,this)),n=await eI(eg,this,se).call(this,s.serverMetadata(),t);try{let e=await o0(n,a3,c),r=al.fromTokenEndpointResponse(e),o=t.getCapturedResponse();if(!o)throw new i4;return{data:r,response:o}}catch(o){if(o instanceof i4)throw o;let n=new iq("Failed to exchange token for connection '".concat(e.connection,"'."),iD(o)),r=t.getCapturedResponse();throw n.statusCode=null==r?void 0:r.status,n.headers=r?i6(r.headers):void 0,n}}let l=ad(null!=(i=s[nw])?i:ej(eh,this)),u=await eI(eg,this,se).call(this,s.serverMetadata(),l);try{let e=await o0(u,a3,c);return al.fromTokenEndpointResponse(e)}catch(r){let t=new iq("Failed to exchange token for connection '".concat(e.connection,"'."),iD(r)),n=l.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?i6(n.headers):void 0,t}}function sa(e,t,n){var r;if(n.organization&&at(e.claims,n.organization),n.actorToken)if(null!=(r=e.claims)&&r.act)e.act=e.claims.act;else try{e.act=function(e){let t,n;if("string"!=typeof e)throw new r1("JWTs must use Compact JWS serialization, JWT must be a string");let r=e.split("."),o=r[1],i=r.length;if(5===i)throw new r1("Only JWTs using Compact JWS serialization can be decoded");if(3!==i)throw new r1("Invalid JWT");if(!o)throw new r1("JWTs must contain a payload");try{t=ot(o)}catch(e){throw new r1("Failed to base64url decode the payload")}try{n=JSON.parse(rF.decode(t))}catch(e){throw new r1("Failed to parse the decoded payload as JSON")}if(!or(n))throw new r1("Invalid JWT Claims Set");return n}(t.access_token).act}catch(e){}return e}async function ss(e,t,n){var r,o;let i,a,s=(await eI(eg,this,sn).call(this,t)).configuration;if(a1(e.subjectToken),void 0!==e.organization&&ae(e.organization),void 0!==e.actorToken&&void 0===e.actorTokenType)throw new iq("actorTokenType is required when actorToken is provided");let c=new URLSearchParams({subject_token_type:e.subjectTokenType,subject_token:e.subjectToken});if(e.audience&&c.append("audience",e.audience),e.scope&&c.append("scope",e.scope),e.requestedTokenType&&c.append("requested_token_type",e.requestedTokenType),e.organization&&c.append("organization",e.organization),e.actorToken&&c.append("actor_token",e.actorToken),e.actorTokenType&&c.append("actor_token_type",e.actorTokenType),a5(c,e.extra),n){let t,n,r,i=ad(null!=(o=s[nw])?o:ej(eh,this)),a=await eI(eg,this,se).call(this,s.serverMetadata(),i);try{if(n=await o0(a,a9,c),t=al.fromTokenEndpointResponse(n),!(r=i.getCapturedResponse()))throw new i4}catch(r){if(r instanceof i4)throw r;let t=new iq("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),iD(r)),n=i.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?i6(n.headers):void 0,t}return eI(eg,this,sa).call(this,t,n,e),{data:t,response:r}}let l=ad(null!=(r=s[nw])?r:ej(eh,this)),u=await eI(eg,this,se).call(this,s.serverMetadata(),l);try{a=await o0(u,a9,c),i=al.fromTokenEndpointResponse(a)}catch(r){let t=new iq("Failed to exchange token of type '".concat(e.subjectTokenType,"'").concat(e.audience?" for audience '".concat(e.audience,"'"):"","."),iD(r)),n=l.getCapturedResponse();throw t.statusCode=null==n?void 0:n.status,t.headers=n?i6(n.headers):void 0,t}return eI(eg,this,sa).call(this,i,a,e),i}async function sc(e,t,n){var r,o;let i=(await eI(eg,this,sn).call(this,t)).configuration;if(n){let t=ad(null!=(o=i[nw])?o:ej(eh,this)),n=await eI(eg,this,se).call(this,i.serverMetadata(),t);try{let r=await o0(n,"http://auth0.com/oauth/grant-type/passwordless/otp",e),o=al.fromTokenEndpointResponse(r),i=t.getCapturedResponse();if(!i)throw new i4;return{data:o,response:i}}catch(r){if(r instanceof i4)throw r;let e=new aA("There was an error while trying to request a token.",iD(r)),n=t.getCapturedResponse();throw e.statusCode=null==n?void 0:n.status,e.headers=n?i6(n.headers):void 0,e}}let a=ad(null!=(r=i[nw])?r:ej(eh,this)),s=await eI(eg,this,se).call(this,i.serverMetadata(),a);try{let t=await o0(s,"http://auth0.com/oauth/grant-type/passwordless/otp",e);return al.fromTokenEndpointResponse(t)}catch(n){let e=new aA("There was an error while trying to request a token.",iD(n)),t=a.getCapturedResponse();throw e.statusCode=null==t?void 0:t.status,e.headers=t?i6(t.headers):void 0,e}}async function sl(){let e=arguments.length>0&&void 0!==arguments[0]&&arguments[0],t=!!ej(eu,this).clientSecret||!!ej(eu,this).clientAssertionSigningKey||!!ej(eu,this).useMtls;return e&&!t?(e,t,n,r)=>{n.set("client_id",t.client_id)}:(ej(el,this)||eN(el,this,(async()=>{if(!ej(eu,this).clientSecret&&!ej(eu,this).clientAssertionSigningKey&&!ej(eu,this).useMtls)throw new i3;if(ej(eu,this).useMtls)return(e,t,n,r)=>{n.set("client_id",t.client_id)};let e=ej(eu,this).clientAssertionSigningKey;return!e||e instanceof CryptoKey||(e=await iL(e,ej(eu,this).clientAssertionSigningAlg||"RS256")),e?function(e,t){var n=void 0;let r=e instanceof CryptoKey?{key:e}:(null==e?void 0:e.key)instanceof CryptoKey?(void 0!==e.kid&&nW(e.kid,'"kid"'),{key:e.key,kid:e.kid}):{},o=r.key,i=r.kid;return function(e,t){if(function(e,t){if(!(e instanceof CryptoKey))throw nf("".concat(t," must be a CryptoKey"),np)}(e,t),"private"!==e.type)throw nf("".concat(t," must be a private CryptoKey"),nd)}(o,'"clientPrivateKey.key"'),async(e,t,r,a)=>{var s;let c={alg:function(e){switch(e.algorithm.name){case"RSA-PSS":switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new nE("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new nE("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}case"ECDSA":switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new nE("unsupported EcKeyAlgorithm namedCurve",{cause:e})}case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new nE("unsupported CryptoKey algorithm name",{cause:e})}}(o),kid:i},l=function(e,t){let n=nK()+nM(t);return{jti:nU(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,t);null==n||null==(s=n[nv])||s.call(n,c,l),r.set("client_id",t.client_id),r.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),r.set("client_assertion",await async function(e,t,n){if(!n.usages.includes("sign"))throw nf('CryptoKey instances used for signing assertions must include "sign" in their "usages"',nd);let r="".concat(nT(nS(JSON.stringify(e))),".").concat(nT(nS(JSON.stringify(t)))),o=nT(await crypto.subtle.sign(function(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:function(e){switch(e.algorithm.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new nE("unsupported ECDSA namedCurve",{cause:e})}}(e)};case"RSA-PSS":switch(rj(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new nE("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return rj(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new nE("unsupported CryptoKey algorithm name",{cause:e})}(n),n,nS(r)));return"".concat(r,".").concat(o)}(c,l,o))}}(e):oA(ej(eu,this).clientSecret)})().catch(e=>{throw eN(el,this,void 0),e})),ej(el,this))}async function su(e){let t=(await eI(eg,this,sr).call(this)).configuration,n=nU(),r=await async function(e){return nW(e,"codeVerifier"),nT(await crypto.subtle.digest("SHA-256",nS(e)))}(n),o=i7(eK(eK({},ej(eu,this).authorizationParams),null==e?void 0:e.authorizationParams)),i=new URLSearchParams(eK(eK({scope:a0},o),{},{client_id:ej(eu,this).clientId,code_challenge:r,code_challenge_method:"S256"}));return{authorizationUrl:null!=e&&e.pushedAuthorizationRequests?await oX(t,i):await oV(t,i),codeVerifier:n}}new aq(1e3,6e4);class sh extends eB{static fromPayload(e){return new sh(e.error,e.error_description)}constructor(e,t){super(e,t),Object.setPrototypeOf(this,sh.prototype)}}class sd extends sh{constructor(e,t){super(e,t),Object.setPrototypeOf(this,sd.prototype)}}class sp extends sh{constructor(e,t){super(e,t),Object.setPrototypeOf(this,sp.prototype)}}class sf extends sh{constructor(e,t){super(e,t),Object.setPrototypeOf(this,sf.prototype)}}class sm extends sh{constructor(e,t){super(e,t),Object.setPrototypeOf(this,sm.prototype)}}class sy extends sh{constructor(e,t){super(e,t),Object.setPrototypeOf(this,sy.prototype)}}class sg{set(e,t){this.cleanup(),this.contexts.set(e,Object.assign(Object.assign({},t),{createdAt:Date.now()}))}get(e){let t=this.contexts.get(e);if(t){if(!(Date.now()-t.createdAt>this.ttlMs))return t;this.contexts.delete(e)}}remove(e){this.contexts.delete(e)}cleanup(){let e=Date.now();for(let n of this.contexts){var t=eJ(n,2);let r=t[0];e-t[1].createdAt>this.ttlMs&&this.contexts.delete(r)}}get size(){return this.contexts.size}constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:6e5;this.contexts=new Map,this.ttlMs=e}}class sw{setMFAAuthDetails(e,t,n,r){this.contextManager.set(e,{scope:t,audience:n,mfaRequirements:r})}async getAuthenticators(e){var t,n,r;let o=this.contextManager.get(e);if(!o)throw new sd("invalid_request","MFA context not found for this MFA token");let i=null==(n=null==(t=o.mfaRequirements)?void 0:t.challenge)?void 0:n.map(e=>e.type);try{let t=await this.authJsMfaClient.listAuthenticators({mfaToken:e});return i&&0!==i.length?t.filter(e=>!!e.type&&i.includes(e.type)):t}catch(e){if(e instanceof ar)throw new sd(null==(r=e.cause)?void 0:r.error,e.message);throw e}}async enroll(e){var t;let n=function(e){let t=nu[e.factorType];return Object.assign(Object.assign(Object.assign({mfaToken:e.mfaToken,authenticatorTypes:t.authenticatorTypes},t.oobChannels&&{oobChannels:t.oobChannels}),"phoneNumber"in e&&{phoneNumber:e.phoneNumber}),"email"in e&&{email:e.email})}(e);try{return await this.authJsMfaClient.enrollAuthenticator(n)}catch(e){if(e instanceof ao)throw new sp(null==(t=e.cause)?void 0:t.error,e.message);throw e}}async challenge(e){var t;try{let t={challengeType:e.challengeType,mfaToken:e.mfaToken};return e.authenticatorId&&(t.authenticatorId=e.authenticatorId),await this.authJsMfaClient.challengeAuthenticator(t)}catch(e){if(e instanceof aa)throw new sf(null==(t=e.cause)?void 0:t.error,e.message);throw e}}async getEnrollmentFactors(e){let t=this.contextManager.get(e);if(!t||!t.mfaRequirements)throw new sy("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");return t.mfaRequirements.enroll&&0!==t.mfaRequirements.enroll.length?t.mfaRequirements.enroll:[]}async verify(e){let t=this.contextManager.get(e.mfaToken);if(!t)throw new sm("mfa_context_not_found","MFA context not found for this MFA token. Please retry the original request to get a new MFA token.");let n="otp"in e&&e.otp?"http://auth0.com/oauth/grant-type/mfa-otp":"oobCode"in e&&e.oobCode?"http://auth0.com/oauth/grant-type/mfa-oob":"recoveryCode"in e&&e.recoveryCode?"http://auth0.com/oauth/grant-type/mfa-recovery-code":void 0;if(!n)throw new sm("invalid_request","Unable to determine grant type. Provide one of: otp, oobCode, or recoveryCode.");let r=t.scope,o=t.audience;try{let t=await this.auth0Client._requestTokenForMfa({grant_type:n,mfaToken:e.mfaToken,scope:r,audience:o,otp:e.otp,oob_code:e.oobCode,binding_code:e.bindingCode,recovery_code:e.recoveryCode});return this.contextManager.remove(e.mfaToken),t}catch(e){if(e instanceof sm)throw new sm(e.error,e.error_description);throw e}}constructor(e,t){this.authJsMfaClient=e,this.auth0Client=t,this.contextManager=new sg}}class sv extends Error{constructor(e,t,n){super(t),this.name="PasskeyError",this.code=e,this.cause=n,Object.setPrototypeOf(this,sv.prototype)}}class sb{async signup(e){if(!window.PublicKeyCredential)throw new sv("passkey_not_supported","WebAuthn is not supported in this browser.");let t=e.scope,n=e.audience,r=eP(e,["scope","audience"]),o=await eC(this,ew,"f").register(r),i=sS(o.authnParamsPublicKey),a=await navigator.credentials.create({publicKey:i});if(!a)throw new sv("passkey_cancelled","Passkey creation was cancelled or no credential was returned.");let s=sE(a);return eC(this,ev,"f")._requestTokenForPasskey({authSession:o.authSession,credential:s,realm:r.realm,organization:r.organization,scope:t,audience:n})}async login(e){if(!window.PublicKeyCredential)throw new sv("passkey_not_supported","WebAuthn is not supported in this browser.");let t=e||{},n=t.scope,r=t.audience,o=eP(t,["scope","audience"]),i=await eC(this,ew,"f").challenge(Object.keys(o).length>0?o:void 0),a=sT(i.authnParamsPublicKey),s=await navigator.credentials.get({publicKey:a});if(!s)throw new sv("passkey_cancelled","Passkey authentication was cancelled or no credential was returned.");let c=sP(s);return eC(this,ev,"f")._requestTokenForPasskey({authSession:i.authSession,credential:c,realm:o.realm,organization:o.organization,scope:n,audience:r})}async getSignupChallenge(e){if(!window.PublicKeyCredential)throw new sv("passkey_not_supported","WebAuthn is not supported in this browser.");let t=await eC(this,ew,"f").register(e);return{authSession:t.authSession,publicKey:sS(t.authnParamsPublicKey)}}async getLoginChallenge(e){if(!window.PublicKeyCredential)throw new sv("passkey_not_supported","WebAuthn is not supported in this browser.");let t=await eC(this,ew,"f").challenge(e);return{authSession:t.authSession,publicKey:sT(t.authnParamsPublicKey)}}async getTokenWithPasskey(e){let t;if(!window.PublicKeyCredential)throw new sv("passkey_not_supported","WebAuthn is not supported in this browser.");let n=e.authSession,r=e.credential,o=e.realm,i=e.organization,a=e.scope,s=e.audience,c=r.response;if(c instanceof AuthenticatorAttestationResponse)t=sE(r);else{if(!(c instanceof AuthenticatorAssertionResponse))throw new sv("passkey_invalid_credential","The provided credential is not a valid attestation or assertion response.");t=sP(r)}return eC(this,ev,"f")._requestTokenForPasskey({authSession:n,credential:t,realm:o,organization:i,scope:a,audience:s})}constructor(e,t){ew.set(this,void 0),ev.set(this,void 0),eA(this,ew,e,"f"),eA(this,ev,t,"f")}}function s_(e){return btoa(Array.from(new Uint8Array(e),e=>String.fromCharCode(e)).join("")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function sk(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=atob(t+"=".repeat((4-t.length%4)%4)),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r.buffer}function sS(e){return Object.assign(Object.assign({},e),{challenge:sk(e.challenge),user:Object.assign(Object.assign({},e.user),{id:sk(e.user.id)}),pubKeyCredParams:e.pubKeyCredParams,authenticatorSelection:e.authenticatorSelection})}function sT(e){return Object.assign(Object.assign({},e),{challenge:sk(e.challenge)})}function sE(e){var t;let n=e.response;return{id:e.id,rawId:s_(e.rawId),type:e.type,authenticatorAttachment:null!=(t=e.authenticatorAttachment)?t:void 0,response:{clientDataJSON:s_(n.clientDataJSON),attestationObject:s_(n.attestationObject)},clientExtensionResults:e.getClientExtensionResults()}}function sP(e){var t;let n=e.response;return{id:e.id,rawId:s_(e.rawId),type:e.type,authenticatorAttachment:null!=(t=e.authenticatorAttachment)?t:void 0,response:{clientDataJSON:s_(n.clientDataJSON),authenticatorData:s_(n.authenticatorData),signature:s_(n.signature),userHandle:n.userHandle?s_(n.userHandle):void 0},clientExtensionResults:e.getClientExtensionResults()}}function sC(e){return{get(){try{let t=window.localStorage.getItem(e);return t?JSON.parse(t):null}catch(e){return null}},set(t){try{window.localStorage.setItem(e,JSON.stringify(t))}catch(e){}},remove(){try{window.localStorage.removeItem(e)}catch(e){}}}}function sA(){let e=null;return{get:()=>e,set:t=>{e=t},remove:()=>{e=null}}}ew=new WeakMap,ev=new WeakMap;class sR{getStore(e,t){let n="".concat(this.baseKey,"::").concat(JSON.stringify([null!=e?e:"",null!=t?t:""]));return this.slots.has(n)||this.slots.set(n,this.useLocalStorage?sC(n):sA()),this.slots.get(n)}getSessionToken(){return this.sessionStore.get()}setSessionToken(e){this.sessionStore.set(e)}removeAll(){if(this.sessionStore.remove(),this.slots.forEach(e=>e.remove()),this.slots.clear(),this.useLocalStorage)try{let e=this.baseKey+"::",t=[];for(let n=0;n<window.localStorage.length;n++){let r=window.localStorage.key(n);(null==r?void 0:r.startsWith(e))&&t.push(r)}t.forEach(e=>window.localStorage.removeItem(e))}catch(e){}}constructor(e,t){this.slots=new Map,this.baseKey="".concat("@@auth0spajs@@","::").concat(e,"::anonymous"),this.useLocalStorage="localStorage"===t&&"undefined"!=typeof window&&!!window.localStorage,this.sessionKey="".concat(this.baseKey,"::").concat("session"),this.sessionStore=this.useLocalStorage?sC(this.sessionKey):sA()}}class sx{async createSession(e){let t=await this.authJsClient.createSession(e);return this.cache.setSessionToken(Object.assign({sessionToken:t.sessionToken},void 0!==t.sessionTokenExpiresAt&&{sessionTokenExpiresAt:t.sessionTokenExpiresAt})),this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:t.accessToken,expiresAt:t.expiresAt},void 0!==t.scope&&{scope:t.scope})),t}async getTokenSilently(e){let t=this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope),n=t.get();return n&&n.expiresAt-60>Date.now()/1e3?n:this.lockManager.runWithLock("anonymous::".concat(this.clientId),5e3,async()=>{var n;let r=t.get();if(r&&r.expiresAt-60>Date.now()/1e3)return r;let o=null==(n=this.cache.getSessionToken())?void 0:n.sessionToken,i=await this.authJsClient.getAccessToken(Object.assign(Object.assign({},e),{sessionToken:o}));return this.cache.getStore(null==e?void 0:e.audience,null==e?void 0:e.scope).set(Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})),!i.sessionReplaced&&this.cache.getSessionToken()||this.cache.setSessionToken(Object.assign({sessionToken:i.sessionToken},void 0!==i.sessionTokenExpiresAt&&{sessionTokenExpiresAt:i.sessionTokenExpiresAt})),Object.assign({accessToken:i.accessToken,expiresAt:i.expiresAt},void 0!==i.scope&&{scope:i.scope})})}async logout(){await this.authJsClient.logout(),this.cache.removeAll()}hasSession(){var e;return!!(null==(e=this.cache.getSessionToken())?void 0:e.sessionToken)}getClaims(){return null}constructor(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"localStorage",r=arguments.length>3?arguments[3]:void 0;this.authJsClient=e,this.clientId=t,this.cache=new sR(t,n),this.lockManager=null!=r?r:tS()}}class sI{resolveOnlineAccess(e){if("online"!==e.refreshTokenMode)return!1;if(!0!==e.useRefreshTokens)throw new eQ('`refreshTokenMode: "online"` requires the refresh-token grant.',"Set `useRefreshTokens: true`.");if(!0!==e.useDpop)throw new eQ('`refreshTokenMode: "online"` requires DPoP, which is missing or disabled.',"Set `useDpop: true` (DPoP is mandatory for online access).");return!0}warnEnterpriseConnectConfig(e){var t,n;if(!0!==e.enterpriseConnect)return;let r=null==(t=e.authorizationParams)?void 0:t.scope;(!0===e.useRefreshTokens||"string"==typeof r&&r.includes("offline_access"))&&console.warn("Enterprise Connect issues no refresh token; `useRefreshTokens` and `offline_access` in `scope` have no effect."),(null==(n=e.authorizationParams)?void 0:n.organization)&&console.warn("Enterprise Connect resolves the organization from the email domain (Home Realm Discovery); a static `organization` breaks multi-customer setups.")}getConfiguration(){return Object.freeze({domain:this.options.domain,clientId:this.options.clientId})}_url(e){let t=encodeURIComponent(btoa(JSON.stringify(to(this.options.auth0Client||eX,!0))));return"".concat(this.domainUrl).concat(e,"&auth0Client=").concat(t)}_authorizeUrl(e){return this._url("/authorize?".concat(ti(e)))}async _verifyIdToken(e,t,n){var r;let o=await this.nowProvider();return(e=>{if(!e.id_token)throw Error("ID token is required but missing");let t=(e=>{let t=e.split("."),n=eJ(t,3),r=n[0],o=n[1],i=n[2];if(3!==t.length||!r||!o||!i)throw Error("ID token could not be decoded");let a=JSON.parse(ts(o)),s={__raw:e},c={};return Object.keys(a).forEach(e=>{s[e]=a[e],tB.includes(e)||(c[e]=a[e])}),{encoded:{header:r,payload:o,signature:i},header:JSON.parse(ts(r)),claims:s,user:c}})(e.id_token);if(!t.claims.iss)throw Error("Issuer (iss) claim must be a string present in the ID token");if(t.claims.iss!==e.iss)throw Error('Issuer (iss) claim mismatch in the ID token; expected "'.concat(e.iss,'", found "').concat(t.claims.iss,'"'));if(!t.user.sub)throw Error("Subject (sub) claim must be a string present in the ID token");if("RS256"!==t.header.alg)throw Error('Signature algorithm of "'.concat(t.header.alg,'" is not supported. Expected the ID token to be signed with "RS256".'));if(!t.claims.aud||"string"!=typeof t.claims.aud&&!Array.isArray(t.claims.aud))throw Error("Audience (aud) claim must be a string or array of strings present in the ID token");if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e.aud))throw Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but was not one of "').concat(t.claims.aud.join(", "),'"'));if(t.claims.aud.length>1){if(!t.claims.azp)throw Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");if(t.claims.azp!==e.aud)throw Error('Authorized Party (azp) claim mismatch in the ID token; expected "'.concat(e.aud,'", found "').concat(t.claims.azp,'"'))}}else if(t.claims.aud!==e.aud)throw Error('Audience (aud) claim mismatch in the ID token; expected "'.concat(e.aud,'" but found "').concat(t.claims.aud,'"'));if(e.nonce){if(!t.claims.nonce)throw Error("Nonce (nonce) claim must be a string present in the ID token");if(t.claims.nonce!==e.nonce)throw Error('Nonce (nonce) claim mismatch in the ID token; expected "'.concat(e.nonce,'", found "').concat(t.claims.nonce,'"'))}if(e.max_age&&"number"!=typeof t.claims.auth_time)throw Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");if(null==t.claims.exp||"number"!=typeof t.claims.exp)throw Error("Expiration Time (exp) claim must be a number present in the ID token");if("number"!=typeof t.claims.iat)throw Error("Issued At (iat) claim must be a number present in the ID token");let n=e.leeway||60,r=new Date(e.now||Date.now()),o=new Date(0);if(o.setUTCSeconds(t.claims.exp+n),r>o)throw Error("Expiration Time (exp) claim error in the ID token; current time (".concat(r,") is after expiration time (").concat(o,")"));if(null!=t.claims.nbf&&"number"==typeof t.claims.nbf){let e=new Date(0);if(e.setUTCSeconds(t.claims.nbf-n),r<e)throw Error("Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (".concat(r,") is before ").concat(e))}if(null!=t.claims.auth_time&&"number"==typeof t.claims.auth_time){let o=new Date(0);if(o.setUTCSeconds(parseInt(t.claims.auth_time)+e.max_age+n),r>o)throw Error("Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (".concat(r,") is after last auth at ").concat(o))}if(e.organization){let n=e.organization.trim();if(n.startsWith("org_")){if(!t.claims.org_id)throw Error("Organization ID (org_id) claim must be a string present in the ID token");if(n!==t.claims.org_id)throw Error('Organization ID (org_id) claim mismatch in the ID token; expected "'.concat(n,'", found "').concat(t.claims.org_id,'"'))}else{let e=n.toLowerCase();if(!t.claims.org_name)throw Error("Organization Name (org_name) claim must be a string present in the ID token");if(e!==t.claims.org_name)throw Error('Organization Name (org_name) claim mismatch in the ID token; expected "'.concat(e,'", found "').concat(t.claims.org_name,'"'))}}return t})({iss:this.tokenIssuer,aud:this.options.clientId,id_token:e,nonce:t,organization:n,leeway:this.options.leeway,max_age:"string"!=typeof(r=this.options.authorizationParams.max_age)?r:parseInt(r,10)||void 0,now:o})}_processOrgHint(e){e?this.cookieStorage.save(this.orgHintCookieName,e,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}):this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain})}_extractSessionTransferToken(e){return new URLSearchParams(window.location.search).get(e)||void 0}_clearSessionTransferTokenFromUrl(e){try{let t=new URL(window.location.href);t.searchParams.has(e)&&(t.searchParams.delete(e),window.history.replaceState({},"",t.toString()))}catch(e){}}_applySessionTransferToken(e){let t=this.options.sessionTransferTokenQueryParamName;if(!t||e.session_transfer_token)return e;let n=this._extractSessionTransferToken(t);return n?(this._clearSessionTransferTokenFromUrl(t),Object.assign(Object.assign({},e),{session_transfer_token:n})):e}async _prepareAuthorizeUrl(e,t,n){var r;let o,i,a,s,c=tn(tt()),l=tn(tt()),u=tt(),h=tc(await ta(u)),d=await (null==(r=this.dpop)?void 0:r.calculateThumbprint()),p=(o=this.options,i=this.scope,a=e.redirect_uri||this.options.authorizationParams.redirect_uri||n,s=null==t?void 0:t.response_mode,Object.assign(Object.assign(Object.assign({client_id:o.clientId},o.authorizationParams),e),{scope:tZ(i,e.scope,e.audience),response_type:"code",response_mode:s||"query",state:c,nonce:l,redirect_uri:a||o.authorizationParams.redirect_uri,code_challenge:h,code_challenge_method:"S256",dpop_jkt:d})),f=this._authorizeUrl(p);return{nonce:l,code_verifier:u,scope:p.scope,audience:p.audience||eq,redirect_uri:p.redirect_uri,state:c,url:f}}async loginWithPopup(e,t){var n;let r,o;if(e=e||{},!(t=t||{}).popup&&(t.popup=(e=>{let t=window.screenX+(window.innerWidth-400)/2,n=window.screenY+(window.innerHeight-600)/2;return window.open(e,"auth0:authorize:popup","left=".concat(t,",top=").concat(n,",width=").concat(400,",height=").concat(600,",resizable,scrollbars=yes,status=1"))})(""),!t.popup))throw new e3;let i=this._applySessionTransferToken(e.authorizationParams||{}),a=await this._prepareAuthorizeUrl(i,{response_mode:"web_message"},window.location.origin);t.popup.location.href=a.url;let s=await (r=Object.assign(Object.assign({},t),{timeoutInSeconds:t.timeoutInSeconds||this.options.authorizeTimeoutInSeconds||60}),o=new URL(a.url).origin,new Promise((e,t)=>{let n,i=setInterval(()=>{r.popup&&r.popup.closed&&(clearInterval(i),clearTimeout(a),window.removeEventListener("message",n,!1),t(new e5(r.popup)))},1e3),a=setTimeout(()=>{clearInterval(i),t(new e1(r.popup)),window.removeEventListener("message",n,!1)},1e3*(r.timeoutInSeconds||60));n=function(s){if(s.origin===o&&s.data&&"authorization_response"===s.data.type){if(clearTimeout(a),clearInterval(i),window.removeEventListener("message",n,!1),!1!==r.closePopup&&r.popup.close(),s.data.response.error)return t(eB.fromPayload(s.data.response));e(s.data.response)}},window.addEventListener("message",n)}));if(a.state!==s.state)throw new eB("state_mismatch","Invalid state");let c=(null==(n=e.authorizationParams)?void 0:n.organization)||this.options.authorizationParams.organization;await this._requestToken({audience:a.audience,scope:a.scope,code_verifier:a.code_verifier,grant_type:"authorization_code",code:s.code,redirect_uri:a.redirect_uri},{nonceIn:a.nonce,organization:c})}async getUser(){var e;if(await this._isSessionCeilingReached())return;let t=await this._getIdTokenFromCache();return null==(e=null==t?void 0:t.decodedToken)?void 0:e.user}async getIdTokenClaims(){var e;if(await this._isSessionCeilingReached())return;let t=await this._getIdTokenFromCache();return null==(e=null==t?void 0:t.decodedToken)?void 0:e.claims}async loginWithRedirect(){var e;let t=nr(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}),n=t.openUrl,r=t.fragment,o=t.appState,i=eP(t,["openUrl","fragment","appState"]),a=(null==(e=i.authorizationParams)?void 0:e.organization)||this.options.authorizationParams.organization,s=this._applySessionTransferToken(i.authorizationParams||{}),c=await this._prepareAuthorizeUrl(s),l=c.url,u=eP(c,["url"]);this.transactionManager.create(Object.assign(Object.assign(Object.assign({},u),{appState:o,response_type:t4.Code}),a&&{organization:a}));let h=r?"".concat(l,"#").concat(r):l;n?await n(h):window.location.assign(h)}async handleRedirectCallback(){let e=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:window.location.href).split("?").slice(1);if(0===e.length)throw Error("There are no query params available for parsing.");let t=this.transactionManager.get();if(!t)throw new eB("missing_transaction","Invalid state");this.transactionManager.remove();let n=(e=>{e.indexOf("#")>-1&&(e=e.substring(0,e.indexOf("#")));let t=new URLSearchParams(e);return{state:t.get("state"),code:t.get("code")||void 0,connect_code:t.get("connect_code")||void 0,error:t.get("error")||void 0,error_description:t.get("error_description")||void 0}})(e.join(""));return t.response_type===t4.ConnectCode?this._handleConnectAccountRedirectCallback(n,t):this._handleLoginRedirectCallback(n,t)}async _handleLoginRedirectCallback(e,t){let n=e.code,r=e.state,o=e.error,i=e.error_description;if(o)throw new e$(o,i||o,r,t.appState);if(!t.code_verifier||t.state&&t.state!==r)throw new eB("state_mismatch","Invalid state");let a=t.organization,s=t.nonce,c=t.redirect_uri;return await this._requestToken(Object.assign({audience:t.audience,scope:t.scope,code_verifier:t.code_verifier,grant_type:"authorization_code",code:n},c?{redirect_uri:c}:{}),{nonceIn:s,organization:a}),{appState:t.appState,response_type:t4.Code}}async _handleConnectAccountRedirectCallback(e,t){let n=e.connect_code,r=e.state,o=e.error,i=e.error_description;if(o)throw new e0(o,i||o,t.connection,r,t.appState);if(!n)throw new eB("missing_connect_code","Missing connect code");if(!(t.code_verifier&&t.state&&t.auth_session&&t.redirect_uri&&t.state===r))throw new eB("state_mismatch","Invalid state");return Object.assign(Object.assign({},await this.myAccount.completeAccount({auth_session:t.auth_session,connect_code:n,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier})),{appState:t.appState,response_type:t4.ConnectCode})}async _maybeCreateAnonymousSession(){if(this.options.createAnonymousSessionOnFailedSilentAuth&&!this.anonymous.hasSession())try{await this.anonymous.getTokenSilently()}catch(e){console.debug("[auth0-spa-js] Anonymous session creation failed",e)}}async checkSession(e){if(!this.cookieStorage.get(this.isAuthenticatedCookieName)){if(!this.cookieStorage.get(ne))return void await this._maybeCreateAnonymousSession();this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(ne)}try{await this.getTokenSilently(e)}catch(e){e instanceof eB&&"login_required"===e.error&&e.error_description!==eG&&await this._maybeCreateAnonymousSession()}}async getTokenSilently(){var e,t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},r=Object.assign(Object.assign({cacheMode:"on"},n),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),n.authorizationParams),{scope:tZ(this.scope,null==(e=n.authorizationParams)?void 0:e.scope,(null==(t=n.authorizationParams)?void 0:t.audience)||this.options.authorizationParams.audience)})}),o=await this._getTokenSilently(r);return n.detailedResponse?o:null==o?void 0:o.access_token}async _getTokenSilently(e){var t,n;let r=e.cacheMode,o=eP(e,["cacheMode"]);if(await this._isSessionCeilingReached())return;if("off"!==r){let e=await this._getEntryFromCache({scope:o.authorizationParams.scope,audience:o.authorizationParams.audience||eq,clientId:this.options.clientId,cacheMode:r});if(e)return e}if("cache-only"===r)return;let i=(t=this.options.clientId,n=o.authorizationParams.audience||"default","".concat("auth0.lock.getTokenSilently",".").concat(t,".").concat(n));try{return await this.lockManager.runWithLock(i,5e3,async()=>{if("off"!==r){let e=await this._getEntryFromCache({scope:o.authorizationParams.scope,audience:o.authorizationParams.audience||eq,clientId:this.options.clientId});if(e)return e}let e=this.options.useRefreshTokens?await this._getTokenUsingRefreshToken(o):await this._getTokenFromIFrame(o),t=e.id_token,n=e.token_type,i=e.access_token,a=e.oauthTokenScope,s=e.expires_in;return Object.assign(Object.assign({id_token:t,token_type:n,access_token:i},a?{scope:a}:null),{expires_in:s})})}catch(e){if(this._isInteractiveError(e)&&"popup"===this.options.interactiveErrorHandler)return await this._handleInteractiveErrorWithPopup(o);throw e}}_isInteractiveError(e){return e instanceof e9||e instanceof eB&&this._isIframeMfaError(e)}_isIframeMfaError(e){return"login_required"===e.error&&e.error_description===eG}async _handleInteractiveErrorWithPopup(e){try{await this.loginWithPopup({authorizationParams:e.authorizationParams});let t=await this._getEntryFromCache({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||eq,clientId:this.options.clientId});if(!t)throw new eB("interactive_handler_cache_miss","Token not found in cache after interactive authentication");return t}catch(e){throw e}}async getTokenWithPopup(){var e,t;let n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},r=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},o=Object.assign(Object.assign({},n),{authorizationParams:Object.assign(Object.assign(Object.assign({},this.options.authorizationParams),n.authorizationParams),{scope:tZ(this.scope,null==(e=n.authorizationParams)?void 0:e.scope,(null==(t=n.authorizationParams)?void 0:t.audience)||this.options.authorizationParams.audience)})});return r=Object.assign(Object.assign({},eH),r),await this.loginWithPopup(o,r),(await this.cacheManager.get(new tG({scope:o.authorizationParams.scope,audience:o.authorizationParams.audience||eq,clientId:this.options.clientId}),void 0,this.options.useMrrt)).access_token}async isAuthenticated(){return!!await this.getUser()}_buildLogoutUrl(e){null!==e.clientId?e.clientId=e.clientId||this.options.clientId:delete e.clientId;let t=e.logoutParams||{},n=t.federated,r=eP(t,["federated"]);return this._url("/v2/logout?".concat(ti(Object.assign({clientId:e.clientId},r))))+(n?"&federated":"")}async revokeRefreshToken(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};if(!this.options.useRefreshTokens)return;let t=e.audience||this.options.authorizationParams.audience||eq,n=await this.cacheManager.getRefreshTokensByAudience(t,this.options.clientId);await async function(e,t){let n=e.baseUrl,r=e.timeout,o=e.auth0Client,i=e.useFormData,a=e.refreshTokens,s=e.audience,c=e.client_id,l=e.onRefreshTokenRevoked,u=r||1e4,h="refresh_token",d="".concat(n,"/oauth/revoke"),p={"Content-Type":i?"application/x-www-form-urlencoded":"application/json","Auth0-Client":btoa(JSON.stringify(to(o||eX)))};if(t){let e={client_id:c,token_type_hint:h},n=i?ti(e):JSON.stringify(e);try{return await tM({type:"revoke",timeout:u,fetchUrl:d,fetchOptions:{method:"POST",body:n,headers:p},useFormData:i,auth:{audience:null!=s?s:eq}},t)}catch(e){throw new eB("revoke_error",e.message)}}for(let e of a){let t={client_id:c,token_type_hint:h,token:e},n=i?ti(t):JSON.stringify(t),r=await tL(d,{method:"POST",body:n,headers:p},u);if(!r.ok){let e,t;try{var f=JSON.parse(await r.text());e=f.error,t=f.error_description}catch(e){}throw new eB(e||"revoke_error",t||"HTTP error ".concat(r.status))}await (null==l?void 0:l(e))}}({baseUrl:this.domainUrl,timeout:this.httpTimeoutMs,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,client_id:this.options.clientId,refreshTokens:n,audience:t,onRefreshTokenRevoked:e=>this.cacheManager.stripRefreshToken(e)},this.worker),this.onlineAccess&&await this._clearLocalSession()}async logout(){var e;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};this.options.enterpriseConnect&&!0!==(null==(e=t.logoutParams)?void 0:e.federated)&&console.warn("Enterprise Connect logout without `federated: true` leaves the enterprise IdP session alive; the next login may silently reuse the previous user.");let n=nr(t),r=n.openUrl,o=eP(n,["openUrl"]);await this._clearLocalSession(t.clientId);let i=this._buildLogoutUrl(o);r?await r(i):!1!==r&&window.location.assign(i)}async _getTokenFromIFrame(e){var t;let n=(t=this.options.clientId,"".concat("auth0.lock.getTokenFromIFrame",".").concat(t));try{return await this.lockManager.runWithLock(n,5e3,async()=>{let t,n=Object.assign(Object.assign({},e.authorizationParams),{prompt:"none"}),r=this.cookieStorage.get(this.orgHintCookieName);r&&!n.organization&&(n.organization=r);let o=await this._prepareAuthorizeUrl(n,{response_mode:"web_message"},window.location.origin),i=o.url,a=o.state,s=o.nonce,c=o.code_verifier,l=o.redirect_uri,u=o.scope,h=o.audience;if(window.crossOriginIsolated)throw new eB("login_required","The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");let d=e.timeoutInSeconds||this.options.authorizeTimeoutInSeconds;try{t=new URL(this.domainUrl).origin}catch(e){t=this.domainUrl}let p=await function(e,t){let n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:60;return new Promise((r,o)=>{let i,a=window.document.createElement("iframe");a.setAttribute("width","0"),a.setAttribute("height","0"),a.style.display="none";let s=()=>{window.document.body.contains(a)&&(window.document.body.removeChild(a),window.removeEventListener("message",i,!1))},c=setTimeout(()=>{o(new e2),s()},1e3*n);i=function(e){if(e.origin!=t||!e.data||"authorization_response"!==e.data.type)return;let n=e.source;n&&n.close(),e.data.response.error?o(eB.fromPayload(e.data.response)):r(e.data.response),clearTimeout(c),window.removeEventListener("message",i,!1),setTimeout(s,2e3)},window.addEventListener("message",i,!1),window.document.body.appendChild(a),a.setAttribute("src",e)})}(i,t,d);if(a!==p.state)throw new eB("state_mismatch","Invalid state");let f=await this._requestToken(Object.assign(Object.assign({},e.authorizationParams),{code_verifier:c,code:p.code,grant_type:"authorization_code",redirect_uri:l,timeout:e.authorizationParams.timeout||this.httpTimeoutMs}),{nonceIn:s,organization:n.organization});return Object.assign(Object.assign({},f),{scope:u,oauthTokenScope:f.scope,audience:h})})}catch(e){throw"login_required"===e.error&&(e instanceof eB&&this._isIframeMfaError(e)&&"popup"===this.options.interactiveErrorHandler||this.logout({openUrl:!1})),e}}async _getTokenUsingRefreshToken(e){var t,n,r,o;let i=await this.cacheManager.get(new tG({scope:e.authorizationParams.scope,audience:e.authorizationParams.audience||eq,clientId:this.options.clientId}),void 0,this.options.useMrrt);if(!(i&&i.refresh_token||this.worker)){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw new e4(e.authorizationParams.audience||eq,e.authorizationParams.scope)}let a=e.authorizationParams.redirect_uri||this.options.authorizationParams.redirect_uri||window.location.origin,s="number"==typeof e.timeoutInSeconds?1e3*e.timeoutInSeconds:null,c=((e,t,n,r)=>{var o;if(e&&n&&r){if(t.audience!==n)return t.scope;let e=r.split(" "),i=(null==(o=t.scope)?void 0:o.split(" "))||[],a=i.every(t=>e.includes(t));return e.length>=i.length&&a?r:t.scope}return t.scope})(this.options.useMrrt,e.authorizationParams,null==i?void 0:i.audience,null==i?void 0:i.scope);try{let l=await this._requestToken(Object.assign(Object.assign(Object.assign({},e.authorizationParams),{grant_type:"refresh_token",refresh_token:i&&i.refresh_token,redirect_uri:a}),s&&{timeout:s}),{scopesToRequest:c});if(await this._propagateRotatedRefreshToken(null==i?void 0:i.refresh_token,l.refresh_token),this.options.useMrrt&&(t=null==i?void 0:i.audience,n=null==i?void 0:i.scope,r=e.authorizationParams.audience,o=e.authorizationParams.scope,t!==r||!((e,t)=>{let n=(null==t?void 0:t.split(" "))||[];return((null==e?void 0:e.split(" "))||[]).every(e=>n.includes(e))})(o,n))){let t=((e,t,n)=>{let r=(null==e?void 0:e.split(" "))||[],o=n?r.filter(e=>e!==eV):r,i=(null==t?void 0:t.split(" "))||[];return o.filter(e=>-1==i.indexOf(e)).join(",")})(c,l.scope,this.onlineAccess);if(t){if(this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e);throw await this.cacheManager.remove(this.options.clientId,e.authorizationParams.audience,e.authorizationParams.scope),new e6(e.authorizationParams.audience||"default",t)}}return Object.assign(Object.assign({},l),{scope:e.authorizationParams.scope,oauthTokenScope:l.scope,audience:e.authorizationParams.audience||eq})}catch(t){if(t.message){if(t.message.includes("user is blocked"))throw await this.logout({openUrl:!1}),t;if((t.message.includes("Missing Refresh Token")||t.message.includes("invalid refresh token"))&&this.options.useRefreshTokensFallback)return await this._getTokenFromIFrame(e)}throw t}}async _propagateRotatedRefreshToken(e,t){!this.onlineAccess&&t&&e&&await this.cacheManager.updateEntry(e,t,this.options.clientId,this.options.useMrrt)}async _saveEntryInCache(e){let t=e.decodedToken.claims,n=t.session_expiry,r=t.iat;if(void 0!==n){if("number"!=typeof n)throw new eB("invalid_token","Invalid session_expiry: value must be a number.");if(n>=1e10)throw new eB("invalid_token","Invalid session_expiry: value appears to be in milliseconds; expected a Unix timestamp in seconds.");if(void 0===r||n<=r)throw new eB("invalid_token","Invalid session_expiry: session ceiling is before or at the token issue time.")}let o=e.id_token,i=e.decodedToken,a=eP(e,["id_token","decodedToken"]);this.userCache.set(tF,{id_token:o,decodedToken:i}),await this.cacheManager.setIdToken(this.options.clientId,e.id_token,e.decodedToken),await this.cacheManager.set(a)}async _clearLocalSession(){var e;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:this.options.clientId;null===t?await this.cacheManager.clear():await this.cacheManager.clear(t),this.cookieStorage.remove(this.orgHintCookieName,{cookieDomain:this.options.cookieDomain}),this.cookieStorage.remove(this.isAuthenticatedCookieName,{cookieDomain:this.options.cookieDomain}),this.userCache.remove(tF);try{await (null==(e=this.dpop)?void 0:e.clear())}catch(e){}if(this.worker)try{await tM({type:"clear"},this.worker)}catch(e){}}async _isSessionCeilingReached(){var e,t;let n=this.userCache.get(tF),r=null!=n?n:await this.cacheManager.getIdToken(new tG({clientId:this.options.clientId})),o=null==(t=null==(e=null==r?void 0:r.decodedToken)?void 0:e.claims)?void 0:t.session_expiry;return void 0!==o&&Math.floor(await this.nowProvider()/1e3)>=o-30&&(await this._clearLocalSession(),!0)}async _getIdTokenFromCache(){let e=this.options.authorizationParams.audience||eq,t=this.scope[e],n=await this.cacheManager.getIdToken(new tG({clientId:this.options.clientId,audience:e,scope:t})),r=this.userCache.get(tF);return n&&n.id_token===(null==r?void 0:r.id_token)?r:(this.userCache.set(tF,n),n)}async _getEntryFromCache(e){let t=e.scope,n=e.audience,r=e.clientId,o=e.cacheMode,i=await this.cacheManager.get(new tG({scope:t,audience:n,clientId:r}),60,this.options.useMrrt,o);if(i&&i.access_token){let e=i.token_type,t=i.access_token,n=i.oauthTokenScope,r=i.expires_in,o=await this._getIdTokenFromCache();return o&&Object.assign(Object.assign({id_token:o.id_token,token_type:e||"Bearer",access_token:t},n?{scope:n}:null),{expires_in:r})}}_storeMfaContext(e,t,n){e instanceof e9&&this.mfa.setMFAAuthDetails(e.mfa_token,t,n,e.mfa_requirements)}async _requestToken(e,t){var n,r,o,i,a,s;let c=t||{},l=c.nonceIn,u=c.organization,h=c.scopesToRequest;try{let t=await tJ(Object.assign(Object.assign({baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,useMrrt:this.options.useMrrt,dpop:this.dpop,preserveRefreshToken:this.onlineAccess},e),{scope:h||e.scope}),this.worker),c=await this._verifyIdToken(t.id_token,l,u);if("authorization_code"===e.grant_type){let e=await this._getIdTokenFromCache();(null==(r=null==(n=null==e?void 0:e.decodedToken)?void 0:n.claims)?void 0:r.sub)&&e.decodedToken.claims.sub!==c.claims.sub&&(await this.cacheManager.clear(this.options.clientId),this.userCache.remove(tF))}if("authorization_code"!==e.grant_type){let e=await this._getIdTokenFromCache(),t=null==(i=null==(o=null==e?void 0:e.decodedToken)?void 0:o.claims)?void 0:i.session_expiry;void 0!==t&&(c=Object.assign(Object.assign({},c),{claims:Object.assign(Object.assign({},c.claims),{session_expiry:t})}))}return!t.refresh_token&&this.onlineAccess&&(t.refresh_token=null!=(a=e.refresh_token)?a:null==(s=await this.cacheManager.get(new tG({scope:h||e.scope,audience:e.audience||eq,clientId:this.options.clientId}),void 0,this.options.useMrrt))?void 0:s.refresh_token),await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({},t),{decodedToken:c,scope:e.scope,audience:e.audience||eq}),t.scope?{oauthTokenScope:t.scope}:null),{client_id:this.options.clientId})),this.cookieStorage.save(this.isAuthenticatedCookieName,!0,{daysUntilExpire:this.sessionCheckExpiryDays,cookieDomain:this.options.cookieDomain}),this._processOrgHint(u||c.claims.org_id),Object.assign(Object.assign({},t),{decodedToken:c})}catch(t){throw"authorization_code"!==e.grant_type&&this._storeMfaContext(t,h||e.scope,e.audience),t}}_buildTokenExchangeParams(e){return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({},e),{grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",subject_token:e.subject_token,subject_token_type:e.subject_token_type}),e.actor_token&&{actor_token:e.actor_token}),e.actor_token_type&&{actor_token_type:e.actor_token_type}),{scope:tZ(this.scope,e.scope,e.audience||this.options.authorizationParams.audience),audience:e.audience||this.options.authorizationParams.audience,organization:e.organization||this.options.authorizationParams.organization})}async loginWithCustomTokenExchange(e){return this._requestToken(this._buildTokenExchangeParams(e))}async customTokenExchange(e){let t=this._buildTokenExchangeParams(e);try{let n=await tJ(Object.assign(Object.assign({},t),{baseUrl:this.domainUrl,client_id:this.options.clientId,auth0Client:this.options.auth0Client,useFormData:this.options.useFormData,timeout:this.httpTimeoutMs,dpop:this.dpop}),this.worker,!0);return n.id_token&&await this._verifyIdToken(n.id_token,void 0,e.organization),n}catch(e){throw this._storeMfaContext(e,t.scope,t.audience),e}}async exchangeToken(e){return this.loginWithCustomTokenExchange(e)}_assertDpop(e){if(!e)throw Error("`useDpop` option must be enabled before using DPoP.")}getDpopNonce(e){return this._assertDpop(this.dpop),this.dpop.getNonce(e)}setDpopNonce(e,t){return this._assertDpop(this.dpop),this.dpop.setNonce(e,t)}generateDpopProof(e){return this._assertDpop(this.dpop),this.dpop.generateProof(e)}createFetcher(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return new ns(e,{isDpopEnabled:()=>!!this.options.useDpop,getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null==(t=null==e?void 0:e.scope)?void 0:t.join(" "),audience:null==e?void 0:e.audience},detailedResponse:!0})},getDpopNonce:()=>this.getDpopNonce(e.dpopNonceId),setDpopNonce:t=>this.setDpopNonce(t,e.dpopNonceId),generateDpopProof:e=>this.generateDpopProof(e)})}async connectAccountWithRedirect(e){let t=e.openUrl,n=e.appState,r=e.connection,o=e.scopes,i=e.authorization_params,a=e.redirectUri,s=void 0===a?this.options.authorizationParams.redirect_uri||window.location.origin:a;if(!r)throw Error("connection is required");let c=tn(tt()),l=tt(),u=tc(await ta(l)),h=await this.myAccount.connectAccount({connection:r,scopes:o,redirect_uri:s,state:c,code_challenge:u,code_challenge_method:"S256",authorization_params:i}),d=h.connect_uri,p=h.connect_params,f=h.auth_session;this.transactionManager.create({state:c,code_verifier:l,auth_session:f,redirect_uri:s,appState:n,connection:r,response_type:t4.ConnectCode});let m=new URL(d);m.searchParams.set("ticket",p.ticket),t?await t(m.toString()):window.location.assign(m)}async _requestTokenForPasskey(e){let t=e.audience||this.options.authorizationParams.audience,n=e.organization||this.options.authorizationParams.organization;return this._requestToken(Object.assign(Object.assign(Object.assign({grant_type:"urn:okta:params:oauth:grant-type:webauthn",auth_session:e.authSession,authn_response:e.credential},e.realm&&{realm:e.realm}),n&&{organization:n}),{scope:tZ(this.scope,e.scope,t),audience:t}))}async _requestTokenForMfa(e,t){let n=e.mfaToken,r=eP(e,["mfaToken"]),o=await this.cacheManager.get(new tG({scope:r.scope,audience:r.audience||eq,clientId:this.options.clientId}),void 0,this.options.useMrrt),i=await this._requestToken(Object.assign(Object.assign({},r),{mfa_token:n}),t);return await this._propagateRotatedRefreshToken(null==o?void 0:o.refresh_token,i.refresh_token),i}constructor(e){var t,n;let r,o,i;if(this.userCache=(new tX).enclosedCache,this.defaultOptions={authorizationParams:{scope:"openid profile email"},useRefreshTokensFallback:!1,useFormData:!0,refreshTokenMode:"offline",anonymousSessionsCacheMode:"localStorage"},this.onlineAccess=this.resolveOnlineAccess(e),this.warnEnterpriseConnectConfig(e),this.options=Object.assign(Object.assign(Object.assign({},this.defaultOptions),e),{authorizationParams:Object.assign(Object.assign({},this.defaultOptions.authorizationParams),e.authorizationParams)}),"undefined"!=typeof window&&(()=>{if(!te())throw Error("For security reasons, `window.crypto` is required to run `auth0-spa-js`.");if(void 0===te().subtle)throw Error("\n auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.\n ")})(),this.lockManager=tS(),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)o=e.cache;else{if(!nn(r=e.cacheLocation||eF))throw Error('Invalid cache location "'.concat(r,'"'));o=nn(r)()}this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:1e4,this.cookieStorage=!1===e.legacySameSiteCookie?t1:t3,this.orgHintCookieName=(t=this.options.clientId,"auth0.".concat(t,".organization_hint")),this.isAuthenticatedCookieName=(i=this.options.clientId,"auth0.".concat(i,".is.authenticated")),this.sessionCheckExpiryDays=e.sessionCheckExpiryDays||1;let a=e.useCookiesForTransactions?this.cookieStorage:t9,s="";this.onlineAccess?s=eV:this.options.useRefreshTokens&&(s="offline_access"),this.scope=function(e,t){for(var n=arguments.length,r=Array(n>2?n-2:0),o=2;o<n;o++)r[o-2]=arguments[o];if("object"!=typeof e)return{[eq]:tD(t,e,...r)};let i={[eq]:tD(t,...r)};return Object.keys(e).forEach(n=>{let o=e[n];i[n]=tD(t,o,...r)}),i}(this.options.authorizationParams.scope,"openid",s),this.transactionManager=new tq(a,this.options.clientId,this.options.cookieDomain),this.nowProvider=this.options.nowProvider||eY,this.cacheManager=new tY(o,o.allKeys?void 0:new t7(o,this.options.clientId),this.nowProvider),this.dpop=this.options.useDpop?new na(this.options.clientId):void 0,this.domainUrl=(n=this.options.domain,/^https?:\/\//.test(n)?n:"https://".concat(n)),this.tokenIssuer=((e,t)=>e?e.startsWith("https://")?e:"https://".concat(e,"/"):"".concat(t,"/"))(this.options.issuer,this.domainUrl);let c="".concat(this.domainUrl,"/me/"),l=this.createFetcher(Object.assign(Object.assign({},this.options.useDpop&&{dpopNonceId:"__auth0_my_account_api__"}),{getAccessToken:e=>{var t;return this.getTokenSilently({authorizationParams:{scope:null==(t=null==e?void 0:e.scope)?void 0:t.join(" "),audience:c},detailedResponse:!0})}}));this.myAccount=new nc(l,c),this.authJsClient=new a8({domain:this.options.domain,clientId:this.options.clientId}),this.mfa=new sw(this.authJsClient.mfa,this),this.anonymous=new sx(this.authJsClient.anonymous,this.options.clientId,this.options.anonymousSessionsCacheMode,this.lockManager),this.passkey=new sb(this.authJsClient.passkey,this),"undefined"!=typeof window&&window.Worker&&this.options.useRefreshTokens&&r===eF&&(this.options.workerUrl?this.worker=new Worker(this.options.workerUrl):this.worker=new t8,this.worker.postMessage({type:"init",allowedBaseUrl:this.domainUrl}))}}var sO={isAuthenticated:!1,isLoading:!0,error:void 0,user:void 0},sj=function(){throw Error("You forgot to wrap your component in <Auth0Provider>.")},sW=ek(ek({},sO),{buildAuthorizeUrl:sj,buildLogoutUrl:sj,getAccessTokenSilently:sj,getAccessTokenWithPopup:sj,getIdTokenClaims:sj,loginWithCustomTokenExchange:sj,customTokenExchange:sj,exchangeToken:sj,loginWithRedirect:sj,loginWithPopup:sj,connectAccountWithRedirect:sj,logout:sj,revokeRefreshToken:sj,handleRedirectCallback:sj,getDpopNonce:sj,setDpopNonce:sj,generateDpopProof:sj,createFetcher:sj,getConfiguration:sj,mfa:{getAuthenticators:sj,enroll:sj,challenge:sj,verify:sj,getEnrollmentFactors:sj},passkey:{signup:sj,login:sj},myAccount:{getFactors:sj,getAuthenticationMethods:sj,getAuthenticationMethod:sj,updateAuthenticationMethod:sj,deleteAuthenticationMethod:sj,enrollmentChallenge:sj,enrollmentVerify:sj},anonymous:{createSession:sj,getTokenSilently:sj,logout:sj,hasSession:sj,getClaims:sj}}),sN=(0,eb.createContext)(sW),sU=function(e){if("function"!=typeof e&&null!==e)throw TypeError("Class extends value "+String(e)+" is not a constructor or null");function t(){this.constructor=n}function n(t,r){var o=e.call(this,null!=r?r:t)||this;return o.error=t,o.error_description=r,Object.setPrototypeOf(o,n.prototype),o}return e_(n,e),n.prototype=null===e?Object.create(e):(t.prototype=e.prototype,new t),n}(Error),sM=/[?&](?:connect_)?code=[^&]+/,sL=/[?&]state=[^&]+/,sK=/[?&]error=[^&]+/,sz=function(e){return function(t){return t instanceof Error?t:null!==t&&"object"==typeof t&&"error"in t&&"string"==typeof t.error?"error_description"in t&&"string"==typeof t.error_description?new sU(t.error,t.error_description):new sU(t.error):Error(e)}},sJ=sz("Login failed"),sD=sz("Get access token failed"),sZ=function(e){var t,n;(null==e?void 0:e.redirectUri)&&(console.warn("Using `redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `redirectUri` will be no longer supported in a future version"),e.authorizationParams=null!=(t=e.authorizationParams)?t:{},e.authorizationParams.redirect_uri=e.redirectUri,delete e.redirectUri),(null==(n=null==e?void 0:e.authorizationParams)?void 0:n.redirectUri)&&(console.warn("Using `authorizationParams.redirectUri` has been deprecated, please use `authorizationParams.redirect_uri` instead as `authorizationParams.redirectUri` will be removed in a future version"),e.authorizationParams.redirect_uri=e.authorizationParams.redirectUri,delete e.authorizationParams.redirectUri)},sH=function(e,t){switch(t.type){case"LOGIN_POPUP_STARTED":return ek(ek({},e),{isLoading:!0});case"LOGIN_POPUP_COMPLETE":case"INITIALISED":return ek(ek({},e),{isAuthenticated:!!t.user,user:t.user,isLoading:!1,error:void 0});case"HANDLE_REDIRECT_COMPLETE":case"GET_ACCESS_TOKEN_COMPLETE":case"SYNC_USER":if(e.user===t.user)return e;return ek(ek({},e),{isAuthenticated:!!t.user,user:t.user});case"LOGOUT":return ek(ek({},e),{isAuthenticated:!1,user:void 0});case"ERROR":return ek(ek({},e),{isLoading:!1,error:t.error})}},sF=function(e){var t;window.history.replaceState({},document.title,null!=(t=e.returnTo)?t:window.location.pathname)},sG=function(){var e,t,n=new Promise(function(n,r){e=n,t=r});return n.catch(function(){}),{promise:n,resolve:e,reject:t}},sV=function(e){var t=e.children,n=e.skipRedirectCallback,r=e.onRedirectCallback,o=void 0===r?sF:r,i=e.context,a=void 0===i?sN:i,s=e.client,c=eS(e,["children","skipRedirectCallback","onRedirectCallback","context","client"]);s&&(c.domain||c.clientId)&&console.warn("Auth0Provider: the `client` prop takes precedence over `domain`/`clientId` and other configuration options. Remove `domain`, `clientId`, and any other Auth0Client configuration props when using the `client` prop.");var l=(0,eb.useState)(function(){return null!=s?s:new sI((sZ(c),ek(ek({},c),{auth0Client:{name:"auth0-react",version:"2.27.0"}})))})[0],u=(0,eb.useReducer)(sH,sO),h=u[0],d=u[1],p=(0,eb.useState)(sG),f=p[0],m=p[1],y=(0,eb.useState)(!1),g=y[0],w=y[1],v=(0,eb.useRef)(!1),b=(0,eb.useRef)(!1),_=(0,eb.useCallback)(function(e){return d({type:"ERROR",error:e}),e},[]),k=(0,eb.useCallback)(function(e,t){return eT(void 0,void 0,void 0,function(){var r,i,a,s,c,u,h;return eE(this,function(p){switch(p.label){case 0:var f;if(p.trys.push([0,7,,8]),r=void 0,!(t&&(void 0===f&&(f=window.location.search),(sM.test(f)||sK.test(f))&&sL.test(f))&&!n))return[3,3];return[4,l.handleRedirectCallback()];case 1:return s=void 0===(a=(i=p.sent()).appState)?{}:a,c=i.response_type,u=eS(i,["appState","response_type"]),[4,l.getUser()];case 2:return r=p.sent(),s.response_type=c,c===t4.ConnectCode&&(s.connectedAccount=u),o(s,r),[3,6];case 3:return[4,l.checkSession()];case 4:return p.sent(),[4,l.getUser()];case 5:r=p.sent(),p.label=6;case 6:return d({type:"INITIALISED",user:r}),e.resolve(),[3,8];case 7:return _(h=sJ(p.sent())),w(!0),e.reject(h),[3,8];case 8:return[2]}})})},[l,o,n,_]);(0,eb.useEffect)(function(){b.current||(b.current=!0,k(f,!0))},[k,f]),(0,eb.useEffect)(function(){if(g&&!v.current&&h.isAuthenticated){v.current=!0;var e=sG();m(e),k(e,!1)}},[g,h.isAuthenticated,k]);var S=(0,eb.useCallback)(function(e){return sZ(e),l.loginWithRedirect(e)},[l]),T=(0,eb.useCallback)(function(e,t){return eT(void 0,void 0,void 0,function(){return eE(this,function(n){switch(n.label){case 0:d({type:"LOGIN_POPUP_STARTED"}),n.label=1;case 1:return n.trys.push([1,3,,4]),[4,l.loginWithPopup(e,t)];case 2:return n.sent(),[3,4];case 3:return _(sJ(n.sent())),[2];case 4:return[4,l.getUser()];case 5:return d({type:"LOGIN_POPUP_COMPLETE",user:n.sent()}),[2]}})})},[l,_]),E=(0,eb.useCallback)(function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return eT(void 0,function(e,t,n){if(n||2==arguments.length)for(var r,o=0,i=t.length;o<i;o++)!r&&o in t||(r||(r=Array.prototype.slice.call(t,0,o)),r[o]=t[o]);return e.concat(r||Array.prototype.slice.call(t))}([],e,!0),void 0,function(e){return void 0===e&&(e={}),eE(this,function(t){switch(t.label){case 0:return[4,l.logout(e)];case 1:return t.sent(),(e.openUrl||!1===e.openUrl)&&d({type:"LOGOUT"}),[2]}})})},[l]),P=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n;return eE(this,function(r){switch(r.label){case 0:return r.trys.push([0,,2,4]),[4,l.revokeRefreshToken(e)];case 1:return r.sent(),[3,4];case 2:return t=d,n={type:"SYNC_USER"},[4,l.getUser()];case 3:return t.apply(void 0,[(n.user=r.sent(),n)]),[7];case 4:return[2]}})})},[l]),C=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n,r;return eE(this,function(o){switch(o.label){case 0:return o.trys.push([0,2,3,5]),[4,l.getTokenSilently(e)];case 1:return t=o.sent(),[3,5];case 2:throw sD(o.sent());case 3:return n=d,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,l.getUser()];case 4:return n.apply(void 0,[(r.user=o.sent(),r)]),[7];case 5:return[2,t]}})})},[l]),A=(0,eb.useCallback)(function(e,t){return eT(void 0,void 0,void 0,function(){var n,r,o;return eE(this,function(i){switch(i.label){case 0:return i.trys.push([0,2,3,5]),[4,l.getTokenWithPopup(e,t)];case 1:return n=i.sent(),[3,5];case 2:throw sD(i.sent());case 3:return r=d,o={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,l.getUser()];case 4:return r.apply(void 0,[(o.user=i.sent(),o)]),[7];case 5:return[2,n]}})})},[l]),R=(0,eb.useCallback)(function(e){return l.connectAccountWithRedirect(e)},[l]),x=(0,eb.useCallback)(function(){return l.getIdTokenClaims()},[l]),I=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n,r;return eE(this,function(o){switch(o.label){case 0:return o.trys.push([0,2,3,5]),[4,l.loginWithCustomTokenExchange(e)];case 1:return t=o.sent(),[3,5];case 2:throw sD(o.sent());case 3:return n=d,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,l.getUser()];case 4:return n.apply(void 0,[(r.user=o.sent(),r)]),[7];case 5:return[2,t]}})})},[l]),O=(0,eb.useCallback)(function(e){return l.customTokenExchange(e)},[l]),j=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){return eE(this,function(t){return[2,I(e)]})})},[I]),W=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n;return eE(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,3,5]),[4,l.handleRedirectCallback(e)];case 1:return[2,r.sent()];case 2:throw sD(r.sent());case 3:return t=d,n={type:"HANDLE_REDIRECT_COMPLETE"},[4,l.getUser()];case 4:return t.apply(void 0,[(n.user=r.sent(),n)]),[7];case 5:return[2]}})})},[l]),N=(0,eb.useCallback)(function(e){return l.getDpopNonce(e)},[l]),U=(0,eb.useCallback)(function(e,t){return l.setDpopNonce(e,t)},[l]),M=(0,eb.useCallback)(function(e){return l.generateDpopProof(e)},[l]),L=(0,eb.useCallback)(function(e){return l.createFetcher(e)},[l]),K=(0,eb.useCallback)(function(){return l.getConfiguration()},[l]),z=(0,eb.useMemo)(function(){return l.mfa},[l]),J=(0,eb.useMemo)(function(){return l.myAccount},[l]),D=(0,eb.useMemo)(function(){return l.anonymous},[l]),Z=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n,r;return eE(this,function(o){switch(o.label){case 0:return o.trys.push([0,2,3,5]),[4,l.passkey.signup(e)];case 1:return t=o.sent(),[3,5];case 2:throw sD(o.sent());case 3:return n=d,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,l.getUser()];case 4:return n.apply(void 0,[(r.user=o.sent(),r)]),[7];case 5:return[2,t]}})})},[l]),H=(0,eb.useCallback)(function(e){return eT(void 0,void 0,void 0,function(){var t,n,r;return eE(this,function(o){switch(o.label){case 0:return o.trys.push([0,2,3,5]),[4,l.passkey.login(e)];case 1:return t=o.sent(),[3,5];case 2:throw sD(o.sent());case 3:return n=d,r={type:"GET_ACCESS_TOKEN_COMPLETE"},[4,l.getUser()];case 4:return n.apply(void 0,[(r.user=o.sent(),r)]),[7];case 5:return[2,t]}})})},[l]),F=(0,eb.useMemo)(function(){return{signup:Z,login:H}},[Z,H]),G=(0,eb.useMemo)(function(){return ek(ek({},h),{getAccessTokenSilently:C,getAccessTokenWithPopup:A,getIdTokenClaims:x,loginWithCustomTokenExchange:I,customTokenExchange:O,exchangeToken:j,loginWithRedirect:S,loginWithPopup:T,connectAccountWithRedirect:R,logout:E,revokeRefreshToken:P,handleRedirectCallback:W,getDpopNonce:N,setDpopNonce:U,generateDpopProof:M,createFetcher:L,getConfiguration:K,mfa:z,passkey:F,myAccount:J,anonymous:D,_initPromise:f.promise})},[h,C,A,x,I,O,j,S,T,R,E,P,W,N,U,M,L,K,z,F,J,D,f]);return eb.createElement(a.Provider,{value:G},t)},sX=function(e){return void 0===e&&(e=sN),(0,eb.useContext)(e)}}}]);