1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,26012,27834,94612,e=>{"use strict";let t,n,a,r,s;function i(e,t){if(null==e)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch{return!1}}e.s(["DEFAULT_DPOP_CLOCK_SKEW",0,0,"DEFAULT_DPOP_CLOCK_TOLERANCE",0,30,"DEFAULT_MFA_CONTEXT_TTL_SECONDS",0,300,"DEFAULT_POPUP_HEIGHT",0,600,"DEFAULT_POPUP_TIMEOUT",0,6e4,"DEFAULT_POPUP_WIDTH",0,400,"DEFAULT_RETRY_DELAY",0,100,"DEFAULT_RETRY_JITTER",0,!0,"DEFAULT_SCOPES",0,"openid profile email offline_access","DEFAULT_STT_SCOPES",0,"openid profile email","MAX_RECOMMENDED_DPOP_CLOCK_TOLERANCE",0,300,"POLL_INTERVAL",0,500],26012),("u"<typeof navigator||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(t="oauth4webapi/v3.8.7");let o="ERR_INVALID_ARG_VALUE",c="ERR_INVALID_ARG_TYPE";function u(e,t,n){let a=TypeError(e,{cause:n});return Object.assign(a,{code:t}),a}let p=Symbol(),l=Symbol(),d=Symbol(),h=Symbol(),f=Symbol(),m=Symbol(),y=Symbol(),_=new TextEncoder,w=new TextDecoder;function b(e){return"string"==typeof e?_.encode(e):w.decode(e)}function g(e){return"string"==typeof e?a(e):n(e)}n=Uint8Array.prototype.toBase64?e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:"base64url",omitPadding:!0})):e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));let t=[];for(let n=0;n<e.byteLength;n+=32768)t.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(t.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")},a=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:"base64url"})}catch(e){throw u("The input to be decoded is not correctly encoded.",o,e)}}:e=>{try{let t=atob(e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw u("The input to be decoded is not correctly encoded.",o,e)}};class S extends Error{code;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=e0,Error.captureStackTrace?.(this,this.constructor)}}class R extends Error{code;constructor(e,t){super(e,t),this.name=this.constructor.name,t?.code&&(this.code=t?.code),Error.captureStackTrace?.(this,this.constructor)}}function v(e,t,n){return new R(e,{code:t,cause:n})}async function A(e){let t;switch(e.kty){case"EC":t={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":t={crv:e.crv,kty:e.kty,x:e.x};break;case"AKP":t={alg:e.alg,kty:e.kty,pub:e.pub};break;case"RSA":t={e:e.e,kty:e.kty,n:e.n};break;default:throw new S("unsupported JWK key type",{cause:e})}return g(await crypto.subtle.digest("SHA-256",b(JSON.stringify(t))))}function P(e,t){if(!(e instanceof CryptoKey))throw u(`${t} must be a CryptoKey`,c)}function T(e,t){if(P(e,t),"private"!==e.type)throw u(`${t} must be a private CryptoKey`,o)}function k(e){return!(null===e||"object"!=typeof e||Array.isArray(e))}function E(e){i(e,Headers)&&(e=Object.fromEntries(e.entries()));let n=new Headers(e??{});if(t&&!n.has("user-agent")&&n.set("user-agent",t),n.has("authorization"))throw u('"options.headers" must not include the "authorization" header name',o);return n}function x(e,t){if(void 0!==t){if("function"==typeof t&&(t=t(e.href)),!(t instanceof AbortSignal))throw u('"options.signal" must return or be an instance of AbortSignal',c);return t}}function O(e){return e.includes("//")?e.replace("//","/"):e}async function D(e,t,n,a){if(!(e instanceof URL))throw u(`"${t}" must be an instance of URL`,c);et(e,a?.[p]!==!0);let r=n(new URL(e.href)),s=E(a?.headers);return s.set("accept","application/json"),(a?.[h]||fetch)(r.href,{body:void 0,headers:Object.fromEntries(s.entries()),method:"GET",redirect:"manual",signal:x(r,a?.signal)})}async function U(e,t){return D(e,"issuerIdentifier",e=>{switch(t?.algorithm){case void 0:case"oidc":e.pathname=O(`${e.pathname}/.well-known/openid-configuration`);break;case"oauth2":!function(e,t,n=!1){"/"===e.pathname?e.pathname=t:e.pathname=O(`${t}/${n?e.pathname:e.pathname.replace(/(\/)$/,"")}`)}(e,".well-known/oauth-authorization-server");break;default:throw u('"options.algorithm" must be "oidc" (default), or "oauth2"',o)}return e},t)}function L(e,t,n,a,r){try{if("number"!=typeof e||!Number.isFinite(e))throw u(`${n} must be a number`,c,r);if(e>0)return;if(t){if(0!==e)throw u(`${n} must be a non-negative number`,o,r);return}throw u(`${n} must be a positive number`,o,r)}catch(e){if(a)throw v(e.message,a,r);throw e}}function C(e,t,n,a){try{if("string"!=typeof e)throw u(`${t} must be a string`,c,a);if(0===e.length)throw u(`${t} must not be empty`,o,a)}catch(e){if(n)throw v(e.message,n,a);throw e}}async function j(e,t){if(!(e instanceof URL)&&e!==tG)throw u('"expectedIssuerIdentifier" must be an instance of URL',c);if(!i(t,Response))throw u('"response" must be an instance of Response',c);if(200!==t.status)throw v('"response" is not a conform Authorization Server Metadata response
1(unexpected HTTP status code)',e8,t);td(t);let n=await tB(t);if(C(n.issuer,'"response" body "issuer" property',e6,{body:n}),e!==tG&&new URL(n.issuer).href!==e.href)throw v('"response" body "issuer" property does not match the expected value',tt,{expected:e.href,body:n,attribute:"issuer"});return n}function N(e){var t=e,n="application/json";if(eT(t)!==n)throw I(t,n)}function I(e,...t){let n='"response" content-type must be ';if(t.length>2){let e=t.pop();n+=`${t.join(", ")}, or ${e}`}else 2===t.length?n+=`${t[0]} or ${t[1]}`:n+=t[0];return v(n,e4,e)}function J(){return g(crypto.getRandomValues(new Uint8Array(32)))}async function H(e){return C(e,"codeVerifier"),g(await crypto.subtle.digest("SHA-256",b(e)))}function W(e){return e instanceof CryptoKey?{key:e}:e?.key instanceof CryptoKey?(void 0!==e.kid&&C(e.kid,'"kid"'),{key:e.key,kid:e.kid}):{}}function K(e){switch(e.algorithm.name){case"RSA-PSS":switch(e.algorithm.hash.name){case"SHA-256":return"PS256";case"SHA-384":return"PS384";case"SHA-512":return"PS512";default:throw new S("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":switch(e.algorithm.hash.name){case"SHA-256":return"RS256";case"SHA-384":return"RS384";case"SHA-512":return"RS512";default:throw new S("unsupported RsaHashedKeyAlgorithm hash name",{cause:e})}case"ECDSA":switch(e.algorithm.namedCurve){case"P-256":return"ES256";case"P-384":return"ES384";case"P-521":return"ES512";default:throw new S("unsupported EcKeyAlgorithm namedCurve",{cause:e})}case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e.algorithm.name;case"EdDSA":return"Ed25519";default:throw new S("unsupported CryptoKey algorithm name",{cause:e})}}function z(e){let t=e?.[l];return"number"==typeof t&&Number.isFinite(t)?t:0}function $(e){let t=e?.[d];return"number"==typeof t&&Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function M(){return Math.floor(Date.now()/1e3)}function q(e){if("object"!=typeof e||null===e)throw u('"as" must be an object',c);C(e.issuer,'"as.issuer"')}function F(e){if("object"!=typeof e||null===e)throw u('"client" must be an object',c);C(e.client_id,'"client.client_id"')}function B(e){return encodeURIComponent(e).replace(/(?:[-_.!~*'()]|%20)/g,e=>{switch(e){case"-":case"_":case".":case"!":case"~":case"*":case"'":case"(":case")":return`%${e.charCodeAt(0).toString(16).toUpperCase()}`;case"%20":return"+";default:throw Error()}})}function G(e,t){let n=M()+z(t);return{jti:J(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}function V(){return(e,t,n,a)=>{n.set("client_id",t.client_id)}}async function Y(e,t,n){if(!n.usages.includes("sign"))throw u('CryptoKey instances used for signing assertions must include "sign" in their "usages"',o);let a=`${g(b(JSON.stringify(e)))}.${g(b(JSON.stringify(t)))}`,r=g(await crypto.subtle.sign(tw(n),n,b(a)));return`${a}.${r}`}async function Q(e,t,n,a,r){let s;q(e),F(t),n=new URLSearchParams(n);let{key:i,kid:c}=W(a);T(i,'"privateKey.key"'),n.set("client_id",t.client_id);let p=M()+z(t),l={...Object.fromEntries(n.entries()),jti:J(),aud:e.issuer,exp:p+60,iat:p,nbf:p,iss:t.client_id};n.has("resource")&&(s=n.getAll("resource"))&&s.length>1&&(l.resource=s);{let e=n.get("max_age");null!==e&&(l.max_age=parseInt(e,10),L(l.max_age,!0,'"max_age" parameter'))}{let e=n.get("claims");if(null!==e){try{l.claims=JSON.parse(e)}catch(e){throw v('failed to parse the "claims" parameter as JSON',e1,e)}if(!k(l.claims))throw u('"claims" parameter must be a JSON with a top level object',o)}}{let e=n.get("authorization_details");if(null!==e){try{l.authorization_details=JSON.parse(e)}catch(e){throw v('failed to parse the "authorization_details" parameter as JSON',e1,e)}if(!Array.isArray(l.authorization_details))throw u('"authorization_details" parameter must be a JSON with a top level array',o)}}let d={alg:K(i),typ:"oauth-authz-req+jwt",kid:c};return r?.[f]?.(d,l),Y(d,l,i)}async function X(e,t){let{kty:n,e:a,n:s,x:i,y:o,crv:c,pub:u}=await crypto.subtle.exportKey("jwk",e),p={kty:n,e:a,n:s,x:i,y:o,crv:c,pub:u};return"AKP"===n&&(p.alg=t),r.set(e,p),p}async function Z(e,t){return(r||=new WeakMap).get(e)||X(e,t)}let ee=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch{return null}};function et(e,t){if(t&&"https:"!==e.protocol)throw v("only requests to HTTPS are allowed",e3,e);if("https:"!==e.protocol&&"http:"!==e.protocol)throw v("only HTTP and HTTPS requests are allowed",e9,e)}function en(e,t,n,a){let r;if("string"!=typeof e||!(r=ee(e)))throw v(`authorization server metadata does not contain a valid ${n?`"as.mtls_endpoint_aliases.${t}"`:`"as.${t}"`}`,void 0===e?ta:tr,{attribute:n?`mtls_endpoint_aliases.${t}`:t});return et(r,a),r}function ea(e,t,n,a){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?en(e.mtls_endpoint_aliases[t],t,n,a):en(e[t],t,n,a)}async function er(e,t,n,a,r){q(e),F(t);let s=ea(e,"pushed_authorization_request_endpoint",t.use_mtls_endpoint_aliases,r?.[p]!==!0),i=new URLSearchParams(a);i.set("client_id",t.client_id);let o=E(r?.headers);o.set("accept","application/json"),r?.DPoP!==void 0&&(ew(r.DPoP),await r.DPoP.addProof(s,o,"POST"));let c=await eE(e,t,n,s,i,o,r);return r?.DPoP?.cacheNonce(c,s),c}class es{#e;#t;#n;#a;#r;#s;#i;constructor(e,t,n){if(T(t?.privateKey,'"DPoP.privateKey"'),!function(e,t){if(P(e,t),"public"!==e.type)throw u(`${t} must be a public CryptoKey`,o)}(t?.publicKey,'"DPoP.publicKey"'),!t.publicKey.extractable)throw u('"DPoP.publicKey.extractable" must be true',o);this.#r=n?.[f],this.#a=z(e),this.#t=t.privateKey,this.#n=t.publicKey,ez.add(this)}#o(e){this.#s||=new Map;let t=this.#s.get(e);return t&&(this.#s.delete(e),this.#s.set(e,t)),t}#c(e,t){this.#s||=new Map,this.#s.delete(e),100===this.#s.size&&this.#s.delete(this.#s.keys().next().value),this.#s.set(e,t)}async calculateThumbprint(){if(!this.#i){let e=await crypto.subtle.exportKey("jwk",this.#n);this.#i||=await A(e)}return this.#i}async addProof(e,t,n,a){let r=K(this.#t);this.#e||={alg:r,typ:"dpop+jwt",jwk:await Z(this.#n,r)};let s=this.#o(e.origin),i={iat:M()+this.#a,jti:J(),htm:n,nonce:s,htu:`${e.origin}${e.pathname}`,ath:a?g(await crypto.subtle.digest("SHA-256",b(a))):void 0};this.#r?.(this.#e,i),t.set("dpop",await Y(this.#e,i,this.#t))}cacheNonce(e,t){try{let n=e.headers.get("dpop-nonce");n&&this.#c(t.origin,n)}catch{}}}function ei(e){if(e instanceof eu){let{0:t,length:n}=e.cause;return 1===n&&"dpop"===t.scheme&&"use_dpop_nonce"===t.parameters.error}return e instanceof eo&&"use_dpop_nonce"===e.error}
1class eo extends Error{cause;code;error;status;error_description;response;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=eZ,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),Error.captureStackTrace?.(this,this.constructor)}}class ec extends Error{cause;code;error;error_description;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=e2,this.cause=t.cause,this.error=t.cause.get("error"),this.error_description=t.cause.get("error_description")??void 0,Error.captureStackTrace?.(this,this.constructor)}}class eu extends Error{cause;code;response;status;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=eX,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),Error.captureStackTrace?.(this,this.constructor)}}let ep="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",el=RegExp("^[,\\s]*("+ep+")"),ed=RegExp("^[,\\s]*("+ep+')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"[,\\s]*(.*)'),eh=RegExp("^[,\\s]*"+("("+ep+")\\s*=\\s*(")+ep+")[,\\s]*(.*)"),ef=RegExp("^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)");async function em(e,t,n){if(q(e),F(t),!i(n,Response))throw u('"response" must be an instance of Response',c);await e_(n,201,"Pushed Authorization Request Endpoint"),td(n);let a=await tB(n);C(a.request_uri,'"response" body "request_uri" property',e6,{body:a});let r="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;return L(r,!0,'"response" body "expires_in" property',e6,{body:a}),a.expires_in=r,a}async function ey(e){if(e.status>399&&e.status<500){td(e),N(e);try{let t=await e.clone().json();if(k(t)&&"string"==typeof t.error&&t.error.length)return t}catch{}}}async function e_(e,t,n){if(e.status!==t){let t;if(eN(e),t=await ey(e))throw await e.body?.cancel(),new eo("server responded with an error in the response body",{cause:t,response:e});throw v(`"response" is not a conform ${n} response (unexpected HTTP status code)`,e8,e)}}function ew(e){if(!ez.has(e))throw u('"options.DPoP" is not a valid DPoPHandle',o)}async function eb(e,t,n,a,r,s){if(C(e,'"accessToken"'),!(n instanceof URL))throw u('"url" must be an instance of URL',c);et(n,s?.[p]!==!0),a=E(a),s?.DPoP&&(ew(s.DPoP),await s.DPoP.addProof(n,a,t.toUpperCase(),e)),a.set("authorization",`${a.has("dpop")?"DPoP":"Bearer"} ${e}`);let o=await (s?.[h]||fetch)(n.href,{duplex:i(r,ReadableStream)?"half":void 0,body:r,headers:Object.fromEntries(a.entries()),method:t,redirect:"manual",signal:x(n,s?.signal)});return s?.DPoP?.cacheNonce(o,n),o}async function eg(e,t,n,a,r,s){let i=await eb(e,t,n,a,r,s);return eN(i),i}async function eS(e,t,n,a){q(e),F(t);let r=ea(e,"userinfo_endpoint",t.use_mtls_endpoint_aliases,a?.[p]!==!0),s=E(a?.headers);return t.userinfo_signed_response_alg?s.set("accept","application/jwt"):(s.set("accept","application/json"),s.append("accept","application/jwt")),eb(n,"GET",r,s,null,{...a,[l]:z(t)})}function eR(e,t,n,a){(s||=new WeakMap).set(e,{jwks:t,uat:n,get age(){return M()-this.uat}}),a&&Object.assign(a,{jwks:structuredClone(t),uat:n})}function ev(e,t){s?.delete(e),delete t?.jwks,delete t?.uat}async function eA(e,t,n){var a;let r,i,o,{alg:c,kid:u}=n;if(function(e){if(!function(e){switch(e){case"PS256":case"ES256":case"RS256":case"PS384":case"ES384":case"RS384":case"PS512":case"ES512":case"RS512":case"Ed25519":case"E
1dDSA":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return!0;default:return!1}}(e.alg))throw new S('unsupported JWS "alg" identifier',{cause:{alg:e.alg}})}(n),!s?.has(e)&&!("object"!=typeof(a=t?.[y])||null===a||!("uat"in a)||"number"!=typeof a.uat||M()-a.uat>=300)&&"jwks"in a&&k(a.jwks)&&Array.isArray(a.jwks.keys)&&Array.prototype.every.call(a.jwks.keys,k)&&eR(e,t?.[y].jwks,t?.[y].uat),s?.has(e)){if({jwks:r,age:i}=s.get(e),i>=300)return ev(e,t?.[y]),eA(e,t,n)}else r=await tm(e,t).then(ty),i=0,eR(e,r,M(),t?.[y]);switch(c.slice(0,2)){case"RS":case"PS":o="RSA";break;case"ES":o="EC";break;case"Ed":o="OKP";break;case"ML":o="AKP";break;default:throw new S("unsupported JWS algorithm",{cause:{alg:c}})}let p=r.keys.filter(e=>{if(e.kty!==o||void 0!==u&&u!==e.kid||void 0!==e.alg&&c!==e.alg||void 0!==e.use&&"sig"!==e.use||e.key_ops?.includes("verify")===!1)return!1;switch(!0){case"ES256"===c&&"P-256"!==e.crv:case"ES384"===c&&"P-384"!==e.crv:case"ES512"===c&&"P-521"!==e.crv:case"Ed25519"===c&&"Ed25519"!==e.crv:case"EdDSA"===c&&"Ed25519"!==e.crv:return!1}return!0}),{0:l,length:d}=p;if(!d){if(i>=60)return ev(e,t?.[y]),eA(e,t,n);throw v("error when selecting a JWT verification key, no applicable keys found",tn,{header:n,candidates:p,jwks_uri:new URL(e.jwks_uri)})}if(1!==d)throw v('error when selecting a JWT verification key, multiple applicable keys found, a "kid" JWT Header Parameter is required',tn,{header:n,candidates:p,jwks_uri:new URL(e.jwks_uri)});return tj(c,l)}let eP=Symbol();function eT(e){return e.headers.get("content-type")?.split(";")[0]}async function ek(e,t,n,a,r){let s;if(q(e),F(t),!i(a,Response))throw u('"response" must be an instance of Response',c);if(eN(a),200!==a.status)throw v('"response" is not a conform UserInfo Endpoint response (unexpected HTTP status code)',e8,a);if(td(a),"application/jwt"===eT(a)){let{claims:n,jwt:i}=await tg(await a.text(),tx.bind(void 0,t.userinfo_signed_response_alg,e.userinfo_signing_alg_values_supported,void 0),z(t),$(t),r?.[m]).then(eJ.bind(void 0,t.client_id)).then(eW.bind(void 0,e));eU.set(a,i),s=n}else{if(t.userinfo_signed_response_alg)throw v("JWT UserInfo Response expected",e5,a);s=await tB(a)}if(C(s.sub,'"response" body "sub" property',e6,{body:s}),n===eP);else if(C(n,'"expectedSubject"'),s.sub!==n)throw v('unexpected "response" body "sub" property value',tt,{expected:n,body:s,attribute:"sub"});return s}async function eE(e,t,n,a,r,s,i){return await n(e,t,r,s),s.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),(i?.[h]||fetch)(a.href,{body:r,headers:Object.fromEntries(s.entries()),method:"POST",redirect:"manual",signal:x(a,i?.signal)})}async function ex(e,t,n,a,r,s){let i=ea(e,"token_endpoint",t.use_mtls_endpoint_aliases,s?.[p]!==!0);r.set("grant_type",a);let o=E(s?.headers);o.set("accept","application/json"),s?.DPoP!==void 0&&(ew(s.DPoP),await s.DPoP.addProof(i,o,"POST"));let c=await eE(e,t,n,i,r,o,s);return s?.DPoP?.cacheNonce(c,i),c}async function eO(e,t,n,a,r){q(e),F(t),C(a,'"refreshToken"');let s=new URLSearchParams(r?.additionalParameters);return s.set("refresh_token",a),ex(e,t,n,"refresh_token",s,r)}let eD=new WeakMap,eU=new WeakMap;function eL(e){if(!e.id_token)return;let t=eD.get(e);if(!t)throw u('"ref" was already garbage collected or did not resolve from the proper sources',o);return t}async function eC(e,t,n){let a;if(q(e),!eU.has(t))throw u('"ref" does not contain a processed JWT Response to verify the signature of',o);let{0:r,1:s,2:i}=eU.get(t).split("."),c=JSON.parse(b(g(r)));if(c.alg.startsWith("HS"))throw new S("unsupported JWS algorithm",{cause:{alg:c.alg}});a=await eA(e,n,c),await tb(r,s,a,g(i))}async function ej(e,t,n,a,r,s){if(q(e),F(t),!i(n,Response))throw u('"response" must be an instance of Response',c);await e_(n,200,"Token Endpoint"),td(n);let o=await tB(n);if(C(o.access_token,'"response" body "access_token" property',e6,{body:o}),C(o.token_type,'"response" body "token_type" property',e6,{body:o}),o.token_type=o.token_type.toLowerCase(),void 0!==o.expires_in){let e="number"!=typeof o.expires_in?parseFloat(o.expires_in):o.expires_in;L(e,!0,'"response" body "expires_in" property',e6,{body:o}),o.expires_in=e}if(void 0!==o.refresh_token&&C(o.refresh_token,'"response" body "refresh_token" property',e6,{body:o}),void 0!==o.scope&&"string"!=typeof o.scope)throw v('"response" body "scope" property must be a string',e6,{body:o});if(void 0!==o.id_token){C(o.id_token,'"response" body "id_token" property',e6,{body:o});let s=["aud","exp","iat","iss","sub"];!0===t.require_auth_time&&s.push("auth_time"),void 0!==t.default_max_age&&(L(t.default_max_age,!0,'"client.default_max_age"'),s.push("auth_time")),a?.length&&s.push(...a);let{claims:i,jwt:c}=await tg(o.id_token,tx.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),z(t),$(t),r).then(eF.bind(void 0,s)).then(eK.bind(void 0,e)).then(eH.bind(void 0,t.client_id));if(Array.isArray(i.aud)&&1!==i.aud.length){if(void 0===i.azp)throw v('ID Token "aud" (audience) claim includes additional untrusted audiences',te,{claims:i,claim:"aud"});if(i.azp!==t.client_id)throw v('unexpected ID Token "azp" (authorized party) claim value',te,{expected:t.client_id,claims:i,claim:"azp"})}void 0!==i.auth_time&&L(i.auth_time,!0,'ID Token "auth_time" (authentication time)',e6,{claims:i}),eU.set(n,c),eD.set(o,i)}if(s?.[o.token_type]!==void 0)s[o.token_type](n,o);else if("dpop"!==o.token_type&&"bearer"!==o.token_type)throw new S("unsupported `token_type` value",{cause:{body:o}});return o}function eN(e){let t;if(t=function(e){if(!i(e,Response))throw u('"response" must be an instance of Response',c);let t=e.headers.get("www-authenticate");if(null===t)return;let n=[],a=t;for(;a;){let e,t=a.match(el),r=t?.["1"].toLowerCase();if(!r)return;let s=a.substring(t[0].length);if(s&&!s.match(/^[\s,]/))return;let i=s.match(/^\s+(.*)$/),o=!!i;a=i?i[1]:void 0;let c={};if(o)for(;a;){let n,r;if(t=a.match(ed)){if([,n,r,a]=t,r.includes("\\"))try{r=JSON.parse(`"${r}"`)}catch{}c[n.toLowerCase()]=r;continue}if(t=a.match(eh)){[,n,r,a]=t,c[n.toLowerCase()]=r;continue}if(t=a.match(ef)){if(Object.keys(c).length)break;[,e,a]=t;break}return}else a=s||void 0;let u={scheme:r,parameters:c};e&&(u.token68=e),n.push(u)}if(n.length)return n}(e))throw new eu("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:t,response:e})}async function eI(e,t,n,a){return ej(e,t,n,void 0,a?.[m],a?.recognizedTokenTypes)}function eJ(e,t){return void 0!==t.claims.aud?eH(e,t):t}function eH(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw v('unexpected JWT "aud" (audience) claim value',te,{expected:e,claims:t.claims,claim:"aud"})}else if(t.claims.aud!==e)throw v('unexpected JWT "aud" (audience) claim value',te,{expected:e,claims:t.claims,claim:"aud"});return t}function eW(e,t){return void 0!==t.claims.iss?eK(e,t):t}function eK(e,t){let n=e[tV]?.(t)??e.issuer;if(t.claims.iss!==n)throw v('unexpected JWT "iss" (issuer) claim value',te,{expected:n,claims:t.claims,claim:"iss"});return t}let ez=new WeakSet,e$=Symbol();async function eM(e,t,n,a,r,s,i){if(q(e),F(t),!ez.has(a))throw u('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',o);C(r,'"redirectUri"');let c=tO(a,"code");if(!c)throw v('no authorization code in "callbackParameters"',e6);let p=new URLSearchParams(i?.additionalParameters);
1return p.set("redirect_uri",r),p.set("code",c),s!==e$&&(C(s,'"codeVerifier"'),p.set("code_verifier",s)),ex(e,t,n,"authorization_code",p,i)}let eq={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function eF(e,t){for(let n of e)if(void 0===t.claims[n])throw v(`JWT "${n}" (${eq[n]}) claim missing`,e6,{claims:t.claims});return t}let eB=Symbol(),eG=Symbol();async function eV(e,t,n,a){return"string"==typeof a?.expectedNonce||"number"==typeof a?.maxAge||a?.requireIdToken?eY(e,t,n,a.expectedNonce,a.maxAge,a[m],a.recognizedTokenTypes):eQ(e,t,n,a?.[m],a?.recognizedTokenTypes)}async function eY(e,t,n,a,r,s,i){let o=[];switch(a){case void 0:a=eB;break;case eB:break;default:C(a,'"expectedNonce" argument'),o.push("nonce")}switch(r??=t.default_max_age){case void 0:r=eG;break;case eG:break;default:L(r,!0,'"maxAge" argument'),o.push("auth_time")}let c=await ej(e,t,n,o,s,i);C(c.id_token,'"response" body "id_token" property',e6,{body:c});let u=eL(c);if(r!==eG){let e=M()+z(t),n=$(t);if(u.auth_time+r<e-n)throw v("too much time has elapsed since the last End-User authentication",e7,{claims:u,now:e,tolerance:n,claim:"auth_time"})}if(a===eB){if(void 0!==u.nonce)throw v('unexpected ID Token "nonce" claim value',te,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==a)throw v('unexpected ID Token "nonce" claim value',te,{expected:a,claims:u,claim:"nonce"});return c}async function eQ(e,t,n,a,r){let s=await ej(e,t,n,void 0,a,r),i=eL(s);if(i){if(void 0!==t.default_max_age){L(t.default_max_age,!0,'"client.default_max_age"');let e=M()+z(t),n=$(t);if(i.auth_time+t.default_max_age<e-n)throw v("too much time has elapsed since the last End-User authentication",e7,{claims:i,now:e,tolerance:n,claim:"auth_time"})}if(void 0!==i.nonce)throw v('unexpected ID Token "nonce" claim value',te,{expected:void 0,claims:i,claim:"nonce"})}return s}let eX="OAUTH_WWW_AUTHENTICATE_CHALLENGE",eZ="OAUTH_RESPONSE_BODY_ERROR",e0="OAUTH_UNSUPPORTED_OPERATION",e2="OAUTH_AUTHORIZATION_RESPONSE_ERROR",e5="OAUTH_JWT_USERINFO_EXPECTED",e1="OAUTH_PARSE_ERROR",e6="OAUTH_INVALID_RESPONSE",e4="OAUTH_RESPONSE_IS_NOT_JSON",e8="OAUTH_RESPONSE_IS_NOT_CONFORM",e3="OAUTH_HTTP_REQUEST_FORBIDDEN",e9="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",e7="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",te="OAUTH_JWT_CLAIM_COMPARISON_FAILED",tt="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED",tn="OAUTH_KEY_SELECTION_FAILED",ta="OAUTH_MISSING_SERVER_METADATA",tr="OAUTH_INVALID_SERVER_METADATA";function ts(e,t){if("string"!=typeof t.header.typ||t.header.typ.toLowerCase().replace(/^application\//,"")!==e)throw v('unexpected JWT "typ" header parameter value',e6,{header:t.header});return t}async function ti(e,t,n,a,r){return q(e),F(t),ex(e,t,n,"client_credentials",new URLSearchParams(a),r)}async function to(e,t,n,a,r,s){return q(e),F(t),C(a,'"grantType"'),ex(e,t,n,a,new URLSearchParams(r),s)}async function tc(e,t,n,a){return ej(e,t,n,void 0,a?.[m],a?.recognizedTokenTypes)}async function tu(e,t,n,a){return ej(e,t,n,void 0,a?.[m],a?.recognizedTokenTypes)}async function tp(e,t,n,a,r){q(e),F(t),C(a,'"token"');let s=ea(e,"revocation_endpoint",t.use_mtls_endpoint_aliases,r?.[p]!==!0),i=new URLSearchParams(r?.additionalParameters);i.set("token",a);let o=E(r?.headers);return o.delete("accept"),eE(e,t,n,s,i,o,r)}async function tl(e){if(!i(e,Response))throw u('"response" must be an instance of Response',c);await e_(e,200,"Revocation Endpoint")}function td(e){if(e.bodyUsed)throw u('"response" body has been used already',o)}async function th(e,t,n,a,r){q(e),F(t),C(a,'"token"');let s=ea(e,"introspection_endpoint",t.use_mtls_endpoint_aliases,r?.[p]!==!0),i=new URLSearchParams(r?.additionalParameters);i.set("token",a);let o=E(r?.headers);return r?.requestJwtResponse??t.introspection_signed_response_alg?o.set("accept","application/token-introspection+jwt"):o.set("accept","application/json"),eE(e,t,n,s,i,o,r)}async function tf(e,t,n,a){let r;if(q(e),F(t),!i(n,Response))throw u('"response" must be an instance of Response',c);if(await e_(n,200,"Introspection Endpoint"),"application/token-introspection+jwt"===eT(n)){td(n);let{claims:s,jwt:i}=await tg(await n.text(),tx.bind(void 0,t.introspection_signed_response_alg,e.introspection_signing_alg_values_supported,"RS256"),z(t),$(t),a?.[m]).then(ts.bind(void 0,"token-introspection+jwt")).then(eF.bind(void 0,["aud","iat","iss"])).then(eK.bind(void 0,e)).then(eH.bind(void 0,t.client_id));if(eU.set(n,i),!k(s.token_introspection))throw v('JWT "token_introspection" claim must be a JSON object',e6,{claims:s});r=s.token_introspection}else td(n),r=await tB(n);if("boolean"!=typeof r.active)throw v('"response" body "active" property must be a boolean',e6,{body:r});return r}async function tm(e,t){q(e);let n=ea(e,"jwks_uri",!1,t?.[p]!==!0),a=E(t?.headers);return a.set("accept","application/json"),a.append("accept","application/jwk-set+json"),(t?.[h]||fetch)(n.href,{body:void 0,headers:Object.fromEntries(a.entries()),method:"GET",redirect:"manual",signal:x(n,t?.signal)}
1)}async function ty(e){if(!i(e,Response))throw u('"response" must be an instance of Response',c);if(200!==e.status)throw v('"response" is not a conform JSON Web Key Set response (unexpected HTTP status code)',e8,e);td(e);let t=await tB(e,e=>(function(e,...t){if(!t.includes(eT(e)))throw I(e,...t)})(e,"application/json","application/jwk-set+json"));if(!Array.isArray(t.keys))throw v('"response" body "keys" property must be an array',e6,{body:t});if(!Array.prototype.every.call(t.keys,k))throw v('"response" body "keys" property members must be JWK formatted objects',e6,{body:t});return t}function t_(e){let{algorithm:t}=e;if("number"!=typeof t.modulusLength||t.modulusLength<2048)throw new S(`unsupported ${t.name} modulusLength`,{cause:e})}function tw(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:function(e){let{algorithm:t}=e;switch(t.namedCurve){case"P-256":return"SHA-256";case"P-384":return"SHA-384";case"P-521":return"SHA-512";default:throw new S("unsupported ECDSA namedCurve",{cause:e})}}(e)};case"RSA-PSS":switch(t_(e),e.algorithm.hash.name){case"SHA-256":case"SHA-384":case"SHA-512":return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new S("unsupported RSA-PSS hash name",{cause:e})}case"RSASSA-PKCS1-v1_5":return t_(e),e.algorithm.name;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":case"Ed25519":return e.algorithm.name}throw new S("unsupported CryptoKey algorithm name",{cause:e})}async function tb(e,t,n,a){let r=b(`${e}.${t}`),s=tw(n);if(!await crypto.subtle.verify(s,n,a,r))throw v("JWT signature verification failed",e6,{key:n,data:r,signature:a,algorithm:s})}async function tg(e,t,n,a,r){let s,i,{0:o,1:c,length:u}=e.split(".");if(5===u)if(void 0!==r)e=await r(e),{0:o,1:c,length:u}=e.split(".");else throw new S("JWE decryption is not configured",{cause:e});if(3!==u)throw v("Invalid JWT",e6,e);try{s=JSON.parse(b(g(o)))}catch(e){throw v("failed to parse JWT Header body as base64url encoded JSON",e1,e)}if(!k(s))throw v("JWT Header must be a top level object",e6,e);if(t(s),void 0!==s.crit)throw new S('no JWT "crit" header parameter extensions are supported',{cause:{header:s}});try{i=JSON.parse(b(g(c)))}catch(e){throw v("failed to parse JWT Payload body as base64url encoded JSON",e1,e)}if(!k(i))throw v("JWT Payload must be a top level object",e6,e);let p=M()+n;if(void 0!==i.exp){if("number"!=typeof i.exp)throw v('unexpected JWT "exp" (expiration time) claim type',e6,{claims:i});if(i.exp<=p-a)throw v('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',e7,{claims:i,now:p,tolerance:a,claim:"exp"})}if(void 0!==i.iat&&"number"!=typeof i.iat)throw v('unexpected JWT "iat" (issued at) claim type',e6,{claims:i});if(void 0!==i.iss&&"string"!=typeof i.iss)throw v('unexpected JWT "iss" (issuer) claim type',e6,{claims:i});if(void 0!==i.nbf){if("number"!=typeof i.nbf)throw v('unexpected JWT "nbf" (not before) claim type',e6,{claims:i});if(i.nbf>p+a)throw v('unexpected JWT "nbf" (not before) claim value',e7,{claims:i,now:p,tolerance:a,claim:"nbf"})}if(void 0!==i.aud&&"string"!=typeof i.aud&&!Array.isArray(i.aud))throw v('unexpected JWT "aud" (audience) claim type',e6,{claims:i});return{header:s,claims:i,jwt:e}}async function tS(e,t,n,a,r){if(q(e),F(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw u('"parameters" must be an instance of URLSearchParams, or URL',c);let s=tO(n,"response");if(!s)throw v('"parameters" does not contain a JARM response',e6);let{claims:i,header:o,jwt:p}=await tg(s,tx.bind(void 0,t.authorization_signed_response_alg,e.authorization_signing_alg_values_supported,"RS256"),z(t),$(t),r?.[m]).then(eF.bind(void 0,["aud","exp","iss"])).then(eK.bind(void 0,e)).then(eH.bind(void 0,t.client_id)),{0:l,1:d,2:h}=p.split("."),f=g(h),y=await eA(e,r,o);await tb(l,d,y,f);let _=new URLSearchParams;for(let[e,t]of Object.entries(i))"string"==typeof t&&"aud"!==e&&_.set(e,t);return tL(e,t,_,a)}async function tR(e,t,n){let a;switch(t.alg){case"RS256":case"PS256":case"ES256":a="SHA-256";break;case"RS384":case"PS384":case"ES384":a="SHA-384";break;
1case"RS512":case"PS512":case"ES512":case"Ed25519":case"EdDSA":a="SHA-512";break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":a={name:"cSHAKE256",length:512,outputLength:512};break;default:throw new S(`unsupported JWS algorithm for ${n} calculation`,{cause:{alg:t.alg}})}let r=await crypto.subtle.digest(a,b(e));return g(r.slice(0,r.byteLength/2))}async function tv(e,t,n,a){return t===await tR(e,n,a)}async function tA(e,t,n,a,r,s,i){return tE(e,t,n,a,r,s,i,!0)}async function tP(e,t,n,a,r,s,i){return tE(e,t,n,a,r,s,i,!1)}async function tT(e){if(e.bodyUsed)throw u("form_post Request instances must contain a readable body",o,{cause:e});return e.text()}async function tk(e){if("POST"!==e.method)throw u("form_post responses are expected to use the POST method",o,{cause:e});if("application/x-www-form-urlencoded"!==eT(e))throw u("form_post responses are expected to use the application/x-www-form-urlencoded content-type",o,{cause:e});return tT(e)}async function tE(e,t,n,a,r,s,p,l){if(q(e),F(t),n instanceof URL){if(!n.hash.length)throw u('"parameters" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters',o);n=new URLSearchParams(n.hash.slice(1))}else if(i(n,Request))n=new URLSearchParams(await tk(n));else if(n instanceof URLSearchParams)n=new URLSearchParams(n);else throw u('"parameters" must be an instance of URLSearchParams, URL, or Response',c);let d=tO(n,"id_token");switch(n.delete("id_token"),r){case void 0:case tU:break;default:C(r,'"expectedState" argument')}let h=tL({...e,authorization_response_iss_parameter_supported:!1},t,n,r);if(!d)throw v('"parameters" does not contain an ID Token',e6);let f=tO(n,"code");if(!f)throw v('"parameters" does not contain an Authorization Code',e6);let y=["aud","exp","iat","iss","sub","nonce","c_hash"],_=n.get("state");l&&("string"==typeof r||null!==_)&&y.push("s_hash"),void 0!==s?L(s,!0,'"maxAge" argument'):void 0!==t.default_max_age&&L(t.default_max_age,!0,'"client.default_max_age"'),s??=t.default_max_age??eG,(t.require_auth_time||s!==eG)&&y.push("auth_time");let{claims:w,header:b,jwt:S}=await tg(d,tx.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,"RS256"),z(t),$(t),p?.[m]).then(eF.bind(void 0,y)).then(eK.bind(void 0,e)).then(eH.bind(void 0,t.client_id)),R=z(t),A=M()+R;if(w.iat<A-3600)throw v('unexpected JWT "iat" (issued at) claim value, it is too far in the past',e7,{now:A,claims:w,claim:"iat"});if(C(w.c_hash,'ID Token "c_hash" (code hash) claim value',e6,{claims:w}
1),void 0!==w.auth_time&&L(w.auth_time,!0,'ID Token "auth_time" (authentication time)',e6,{claims:w}),s!==eG){let e=M()+z(t),n=$(t);if(w.auth_time+s<e-n)throw v("too much time has elapsed since the last End-User authentication",e7,{claims:w,now:e,tolerance:n,claim:"auth_time"})}if(C(a,'"expectedNonce" argument'),w.nonce!==a)throw v('unexpected ID Token "nonce" claim value',te,{expected:a,claims:w,claim:"nonce"});if(Array.isArray(w.aud)&&1!==w.aud.length){if(void 0===w.azp)throw v('ID Token "aud" (audience) claim includes additional untrusted audiences',te,{claims:w,claim:"aud"});if(w.azp!==t.client_id)throw v('unexpected ID Token "azp" (authorized party) claim value',te,{expected:t.client_id,claims:w,claim:"azp"})}let{0:P,1:T,2:k}=S.split("."),E=g(k),x=await eA(e,p,b);if(await tb(P,T,x,E),await tv(f,w.c_hash,b,"c_hash")!==!0)throw v('invalid ID Token "c_hash" (code hash) claim value',te,{code:f,alg:b.alg,claim:"c_hash",claims:w});if((l&&null!==_||void 0!==w.s_hash)&&(C(w.s_hash,'ID Token "s_hash" (state hash) claim value',e6,{claims:w}
1),C(_,'"state" response parameter',e6,{parameters:n}),await tv(_,w.s_hash,b,"s_hash")!==!0))throw v('invalid ID Token "s_hash" (state hash) claim value',te,{state:_,alg:b.alg,claim:"s_hash",claims:w});return h}function tx(e,t,n,a){if(void 0!==e){if("string"==typeof e?a.alg!==e:!e.includes(a.alg))throw v('unexpected JWT "alg" header parameter',e6,{header:a,expected:e,reason:"client configuration"});return}if(Array.isArray(t)){if(!t.includes(a.alg))throw v('unexpected JWT "alg" header parameter',e6,{header:a,expected:t,reason:"authorization server metadata"});return}if(void 0!==n){if("string"==typeof n?a.alg!==n:"function"==typeof n?!n(a.alg):!n.includes(a.alg))throw v('unexpected JWT "alg" header parameter',e6,{header:a,expected:n,reason:"default value"});return}throw v('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:e,issuer:t,fallback:n})}function tO(e,t){let{0:n,length:a}=e.getAll(t);if(a>1)throw v(`"${t}" parameter must be provided only once`,e6);return n}let tD=Symbol(),tU=Symbol();function tL(e,t,n,a){var r;if(q(e),F(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw u('"parameters" must be an instance of URLSearchParams, or URL',c);if(tO(n,"response"))throw v('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',e6,{parameters:n});let s=tO(n,"iss"),i=tO(n,"state");if(!s&&e.authorization_response_iss_parameter_supported)throw v('response parameter "iss" (issuer) missing',e6,{parameters:n});if(s&&s!==e.issuer)throw v('unexpected "iss" (issuer) response parameter value',e6,{expected:e.issuer,parameters:n});switch(a){case void 0:case tU:if(void 0!==i)throw v('unexpected "state" response parameter encountered',e6,{expected:void 0,parameters:n});break;case tD:break;default:if(C(a,'"expectedState" argument'),i!==a)throw v(void 0===i?'response parameter "state" missing':'unexpected "state" response parameter value',e6,{expected:a,parameters:n})}if(tO(n,"error"))throw new ec("authorization response from the server is an error",{cause:n});let o=tO(n,"id_token"),p=tO(n,"token");if(void 0!==o||void 0!==p)throw new S("implicit and hybrid flows are not supported");return r=new URLSearchParams(n),ez.add(r),r}function tC(e){switch(e){case"PS256":case"PS384":case"PS512":return{name:"RSA-PSS",hash:`SHA-${e.slice(-3)}`};case"RS256":case"RS384":case"RS512":return{name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.slice(-3)}`};case"ES256":case"ES384":return{name:"ECDSA",namedCurve:`P-${e.slice(-3)}`};case"ES512":return{name:"ECDSA",namedCurve:"P-521"};case"EdDSA":return"Ed25519";case"Ed25519":case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return e;default:throw new S("unsupported JWS algorithm",{cause:{alg:e}})}}async function tj(e,t){let{ext:n,key_ops:a,use:r,...s}=t;return crypto.subtle.importKey("jwk",s,tC(e),!0,["verify"])}async function tN(e,t,n,a,r){q(e),F(t);let s=ea(e,"device_authorization_endpoint",t.use_mtls_endpoint_aliases,r?.[p]!==!0),i=new URLSearchParams(a);i.set("client_id",t.client_id);let o=E(r?.headers);return o.set("accept","application/json"),eE(e,t,n,s,i,o,r)}async function tI(e,t,n){if(q(e),F(t),!i(n,Response))throw u('"response" must be an instance of Response',c);await e_(n,200,"Device Authorization Endpoint"),td(n);let a=await tB(n);C(a.device_code,'"response" body "device_code" property',e6,{body:a}),C(a.user_code,'"response" body "user_code" property',e6,{body:a}),C(a.verification_uri,'"response" body "verification_uri" property',e6,{body:a});let r="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;return L(r,!0,'"response" body "expires_in" property',e6,{body:a}),a.expires_in=r,void 0!==a.verification_uri_complete&&C(a.verification_uri_complete,'"response" body "verification_uri_complete" property',e6,{body:a}),void 0!==a.interval&&L(a.interval,!1,'"response" body "interval" property',e6,{body:a}),a}async function tJ(e,t,n,a,r){q(e),F(t),C(a,'"deviceCode"');let s=new URLSearchParams(r?.additionalParameters);return s.set("device_code",a),ex(e,t,n,"urn:ietf:params:oauth:grant-type:device_code",s,r)}async function tH(e,t,n,a){return ej(e,t,n,void 0,a?.[m],a?.recognizedTokenTypes)}async function tW(e,t){C(e,'"alg"');let n=tC(e);return(e.startsWith("PS")||e.startsWith("RS"))&&Object.assign(n,{modulusLength:t?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])}),crypto.subtle.generateKey(n,t?.extractable??!1,["sign","verify"])}async function tK(e,t,n,a,r){q(e),F(t);let s=ea(e,"backchannel_authentication_endpoint",t.use_mtls_endpoint_aliases,r?.[p]!==!0),i=new URLSearchParams(a);i.set("client_id",t.client_id);let o=E(r?.headers);return o.set("accept","application/json"),eE(e,t,n,s,i,o,r)}async function tz(e,t,n){if(q(e),F(t),!i(n,Response))throw u('"response" must be an instance of Response',c);
1await e_(n,200,"Backchannel Authentication Endpoint"),td(n);let a=await tB(n);C(a.auth_req_id,'"response" body "auth_req_id" property',e6,{body:a});let r="number"!=typeof a.expires_in?parseFloat(a.expires_in):a.expires_in;return L(r,!0,'"response" body "expires_in" property',e6,{body:a}),a.expires_in=r,void 0!==a.interval&&L(a.interval,!1,'"response" body "interval" property',e6,{body:a}),a}async function t$(e,t,n,a,r){q(e),F(t),C(a,'"authReqId"');let s=new URLSearchParams(r?.additionalParameters);return s.set("auth_req_id",a),ex(e,t,n,"urn:openid:params:grant-type:ciba",s,r)}async function tM(e,t,n,a){return ej(e,t,n,void 0,a?.[m],a?.recognizedTokenTypes)}async function tq(e,t,n){q(e);let a=ea(e,"registration_endpoint",t.use_mtls_endpoint_aliases,n?.[p]!==!0),r=E(n?.headers);r.set("accept","application/json"),r.set("content-type","application/json");let s="POST";n?.DPoP&&(ew(n.DPoP),await n.DPoP.addProof(a,r,s,n.initialAccessToken)),n?.initialAccessToken&&r.set("authorization",`${r.has("dpop")?"DPoP":"Bearer"} ${n.initialAccessToken}`);let i=await (n?.[h]||fetch)(a.href,{body:JSON.stringify(t),headers:Object.fromEntries(r.entries()),method:s,redirect:"manual",signal:x(a,n?.signal)});return n?.DPoP?.cacheNonce(i,a),i}async function tF(e){if(!i(e,Response))throw u('"response" must be an instance of Response',c);await e_(e,201,"Dynamic Client Registration Endpoint"),td(e);let t=await tB(e);return C(t.client_id,'"response" body "client_id" property',e6,{body:t}),void 0!==t.client_secret&&C(t.client_secret,'"response" body "client_secret" property',e6,{body:t}),t.client_secret&&L(t.client_secret_expires_at,!0,'"response" body "client_secret_expires_at" property',e6,{body:t}),t}async function tB(e,t=N){let n;try{n=await e.json()}catch(n){throw t(e),v('failed to parse "response" body as JSON',e1,n)}if(!k(n))throw v('"response" body must be a top level object',e6,{body:n});return n}let tG=Symbol(),tV=Symbol();e.s(["AuthorizationResponseError",0,ec,"ClientSecretBasic",0,function(e){return C(e,'"clientSecret"'),(t,n,a,r)=>{let s=B(n.client_id),i=B(e),o=btoa(`${s}:${i}`);r.set("authorization",`Basic ${o}`)}},"ClientSecretJwt",0,function(e,t){let n;C(e,'"clientSecret"');let a=t?.[f];return async(t,r,s,i)=>{n||=await crypto.subtle.importKey("raw",b(e),{hash:"SHA-256",name:"HMAC"},!1,["sign"]);let o={alg:"HS256"},c=G(t,r);a?.(o,c);let u=`${g(b(JSON.stringify(o)))}.${g(b(JSON.stringify(c)))}`,p=await crypto.subtle.sign(n.algorithm,n,b(u));s.set("client_id",r.client_id),s.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),s.set("client_assertion",`${u}.${g(new Uint8Array(p))}`)}},"ClientSecretPost",0,function(e){return C(e,'"clientSecret"'),(t,n,a,r)=>{a.set("client_id",n.client_id),a.set("client_secret",e)}},"DPoP",0,function(e,t,n){return new es(e,t,n)},"HTTP_REQUEST_FORBIDDEN",0,e3,"INVALID_RESPONSE",0,e6,"JSON_ATTRIBUTE_COMPARISON",0,tt,"JWT_CLAIM_COMPARISON",0,te,"JWT_TIMESTAMP_CHECK",0,e7,"None",0,V,"OperationProcessingError",0,R,"PARSE_ERROR",0,e1,"PrivateKeyJwt",0,function(e,t){let{key:n,kid:a}=W(e);return T(n,'"clientPrivateKey.key"'),async(e,r,s,i)=>{let o={alg:K(n),kid:a},c=G(e,r);t?.[f]?.(o,c),s.set("client_id",r.client_id),s.set("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),s.set("client_assertion",await Y(o,c,n))}},"REQUEST_PROTOCOL_FORBIDDEN",0,e9,"RESPONSE_IS_NOT_CONFORM",0,e8,"RESPONSE_IS_NOT_JSON",0,e4,"ResponseBodyError",0,eo,"TlsClientAuth",0,function(){return V()},"UNSUPPORTED_OPERATION",0,e0,"UnsupportedOperationError",0,S,"WWWAuthenticateChallengeError",0,eu,"_expectedIssuer",0,tV,"_nodiscoverycheck",0,tG,"allowInsecureRequests",0,p,"authorizationCodeGrantRequest",0,eM,"backchannelAuthenticationGrantRequest",0,t$,"backchannelAuthenticationRequest",0,tK,"calculatePKCECodeChallenge",0,H,"checkProtocol",0,et,"clientCredentialsGrantRequest",0,ti,"clockSkew",0,l,"clockTolerance",0,d,"customFetch",0,h,"deviceAuthorizationRequest",0,tN,"deviceCodeGrantRequest",0,tJ,"discoveryRequest",0,U,"dynamicClientRegistrationRequest",0,tq,"formPostResponse",0,tk,"generateKeyPair",0,tW,"generateRandomCodeVerifier",0,function(){return J()},"generateRandomNonce",0,function(){return J()},"generateRandomState",0,function(){return J()},"genericTokenEndpointRequest",0,to,"getContentType",0,eT,"getValidatedIdTokenClaims",0,eL,"introspectionRequest",0,th,"isDPoPNonceError",0,ei,"issueRequestObject",0,Q,"jweDecrypt",0,m,"jwksCache",0,y,"modifyAssertion",0,f,"nopkce",0,e$,"processAuthorizationCodeResponse",0,eV,"processBackchannelAuthenticationGrantResponse",0,tM,"processBackchannelAuthenticationResponse",0,tz,"processClientCredentialsResponse",0,tu,"processDeviceAuthorizationResponse",0,tI,"processDeviceCodeResponse",0,tH,"processDiscoveryResponse",0,j,"processDynamicClientRegistrationResponse",0,tF,"processGenericTokenEndpointResponse",0,tc,"processIntrospectionResponse",0,tf,"processPushedAuthorizationResponse",0,em,"processRefreshTokenResponse",0,eI,"processRevocationResponse",0,tl,"processUserInfoResponse",0,ek,"protectedResourceRequest",0,eg,"pushedAuthorizationRequest",0,er,"refreshTokenGrantRequest",0,eO,"resolveEndpoint",0,ea,"revocationRequest",0,tp,"skipStateCheck",0,tD,"skipSubjectCheck",0,eP,"userInfoRequest",0,eS,"validateApplicationLevelSignature",0,eC,"validateAuthResponse",0,tL,"validateCodeIdTokenResponse",0,tP,"validateDetachedSignatureResponse",0,tA,"validateJwtAuthResponse",0,tS],27834);let tY=async e=>{let t=e?.delay??100,n=e?.jitter??!0,a=t;n&&(a=t*(.5+.5*Math.random())),await new Promise(e=>setTimeout(e,a))};async function tQ(e,t){if(!t?.isDPoPEnabled)return await e();try{let n=await e();if(n instanceof Response&&400===n.status)try{let a=await n.clone().json();if("use_dpop_nonce"===a.error)return await tY(t),await e()}catch{}return n}catch(n){if(ei(n))return await tY(t),await e();throw n}}e.s(["isEdgeRuntime",0,function(){return"string"==typeof globalThis.EdgeRuntime},"withDPoPNonceRetry",0,tQ],94612)}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.