1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[781],{1402:(e,t,s)=>{Object.defineProperty(t,"__esModule",{value:!0}),!function(e,t){for(var s in t)Object.defineProperty(e,s,{enumerable:!0,get:t[s]})}(t,{default:function(){return m},handleClientScriptLoad:function(){return p},initScriptLoader:function(){return f}});let r=s(8140),i=s(9417),n=s(5155),a=r._(s(7650)),o=i._(s(2115)),l=s(2073),c=s(4681),d=s(4853),u=s(9001),h=new Map,g=new Set,_=e=>{let{src:t,id:s,onLoad:r=()=>{},onReady:i=null,dangerouslySetInnerHTML:n,children:o="",strategy:l="afterInteractive",onError:d,stylesheets:u}=e,_=s||t;if(_&&g.has(_))return;if(h.has(t)){g.add(_),h.get(t).then(r,d);return}let p=()=>{i&&i(),g.add(_)},f=document.createElement("script"),w=new Promise((e,t)=>{f.addEventListener("load",function(t){e(),r&&r.call(this,t),p()}),f.addEventListener("error",function(e){t(e)})}).catch(function(e){d&&d(e)});n?(f.innerHTML=n.__html||"",p()):o?(f.textContent="string"==typeof o?o:Array.isArray(o)?o.join(""):"",p()):t&&(f.src=t,h.set(t,w)),(0,c.setAttributesFromProps)(f,e),"w
1orker"===l&&f.setAttribute("type","text/partytown"),f.setAttribute("data-nscript",l),u&&(e=>{if(a.default.preinit)return e.forEach(e=>{a.default.preinit(e,{as:"style"})});{let t=document.head;e.forEach(e=>{let s=document.createElement("link");s.type="text/css",s.rel="stylesheet",s.href=e,t.appendChild(s)})}})(u),document.body.appendChild(f)};function p(e){let{strategy:t="afterInteractive"}=e;"lazyOnload"===t?window.addEventListener("load",()=>{(0,d.requestIdleCallback)(()=>_(e))}):_(e)}function f(e){e.forEach(p),[...document.querySelectorAll('[data-nscript="beforeInteractive"]'),...document.querySelectorAll('[data-nscript="beforePageRender"]')].forEach(e=>{let t=e.id||e.getAttribute("src");g.add(t)})}function w(e){let{id:t,src:s="",onLoad:r=()=>{},onReady:i=null,strategy:c="afterInteractive",onError:h,stylesheets:p,...f}=e,{updateScripts:w,scripts:m,getIsSsr:y,appDir:b,nonce:v}=(0,o.useContext)(l.HeadManagerContext);v=f.nonce||v;let S=(0,o.useRef)(!1);(0,o.useEffect)(()=>{let e=t||s;S.current||(i&&e&&g.has(e)&&i(),S.current=!0)},[i,t,s]);let k=(0,o.useRef)(!1);if((0,o.useEffect)(()=>{if(!k.current){if("afterInteractive"===c)_(e);else"lazyOnload"===c&&("complete"===document.readyState?(0,d.requestIdleCallback)(()=>_(e)):window.addEventListener("load",()=>{(0,d.requestIdleCallback)(()=>_(e))}));k.current=!0}},[e,c]),("beforeInteractive"===c||"worker"===c)&&(w?(m[c]=(m[c]||[]).concat([{id:t,src:s,onLoad:r,onReady:i,onError:h,...f,nonce:v}]),w(m)):y&&y()?g.add(t||s):y&&!y()&&_({...e,nonce:v})),b){if(p&&p.forEach(e=>{a.default.preinit(e,{as:"style"})}),"beforeInteractive"===c)if(!s)return f.dangerouslySetInnerHTML&&(f.children=f.dangerouslySetInnerHTML.__html,delete f.dangerouslySetInnerHTML),(0,n.jsx)("script",{nonce:v,dangerouslySetInnerHTML:{__html:"(self.__next_s=self.__next_s||[]).push("+(0,u.htmlEscapeJsonString)(JSON.stringify([0,{...f,id:t}]))+")"}});else return a.default.preload(s,f.integrity?{as:"script",integrity:f.integrity,nonce:v,crossOrigin:f.crossOrigin}:{as:"script",nonce:v,crossOrigin:f.crossOrigin}),(0,n.jsx)("script",{nonce:v,dangerouslySetInnerHTML:{__html:"(self.__next_s=self.__next_s||[]).push("+(0,u.htmlEscapeJsonString)(JSON.stringify([s,{...f,id:t}]))+")"}});"afterInteractive"===c&&s&&a.default.preload(s,f.integrity?{as:"script",integrity:f.integrity,nonce:v,crossOrigin:f.crossOrigin}:{as:"script",nonce:v,crossOrigin:f.crossOrigin})}return null}Object.defineProperty(w,"__nextScript",{value:!0});let m=w;("function"==typeof t.default||"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},2037:function(e,t,s){var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){let{apiKey:t,...s}=e,r={...s,key:t},{html:o}=(0,n.GoogleMapsEmbed)(r);return(0,i.jsx)(a.default,{height:r.height||null,width:r.width||null,html:o,dataNtpc:"GoogleMapsEmbed"})};let i=s(5155),n=s(3067),a=r(s(7445))},3067:(e,t,s)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.YouTubeEmbed=t.GoogleMapsEmbed=t.GoogleAnalytics=void 0;var r=s(8197);Object.defineProperty(t,"GoogleAnalytics",{enumerable:!0,get:function(){return r.GoogleAnalytics}});var i=s(5546);Object.defineProperty(t,"GoogleMapsEmbed",{enumerable:!0,get:function(){return i.GoogleMapsEmbed}});var n=s(3438);Object.defineProperty(t,"YouTubeEmbed",{enumerable:!0,get:function(){return n.YouTubeEmbed}})},3438:function(e,t,s){var r=this&&this.__rest||function(e,t){var s={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(s[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,r=Object.getOwnPropertySymbols(e);i<r.length;i++)0>t.indexOf(r[i])&&Object.prototype.propertyIsEnumerable.call(e,r[i])&&(s[r[i]]=e[r[i]]);return s},i=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.YouTubeEmbed=void 0;let n=i(s(8246)),a=s(5781);t.YouTubeEmbed=e=>{var t=r(e,[]);return(0,a.formatData)(n.default,t)}},3817:e=>{e.exports=JSON.parse('{"id":"google-analytics","description":"Install a Google Analytics tag on your website","website":"https://analytics.google.com/analytics/web/","scripts":[{"url":"https://www.googletagmanager.com/gtag/js","params":["id"],"strategy":"worker","location":"head","action":"append"},{"code":"window.dataLayer=window.dataLayer||[];window.gtag=function gtag(){window.dataLayer.push(arguments);};gtag(\'js\',new Date());gtag(\'config\',\'${args.id}\')","strategy":"worker","location":"head","action":"append"}]}')}
1,4853:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),!function(e,t){for(var s in t)Object.defineProperty(e,s,{enumerable:!0,get:t[s]})}(t,{cancelIdleCallback:function(){return r},requestIdleCallback:function(){return s}});let s="undefined"!=typeof self&&self.requestIdleCallback&&self.requestIdleCallback.bind(window)||function(e){let t=Date.now();return self.setTimeout(function(){e({didTimeout:!1,timeRemaining:function(){return Math.max(0,50-(Date.now()-t))}})},1)},r="undefined"!=typeof self&&self.cancelIdleCallback&&self.cancelIdleCallback.bind(window)||function(e){return clearTimeout(e)};("function"==typeof t.default||"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},5546:function(e,t,s){var r=this&&this.__rest||function(e,t){var s={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(s[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,r=Object.getOwnPropertySymbols(e);i<r.length;i++)0>t.indexOf(r[i])&&Object.prototype.propertyIsEnumerable.call(e,r[i])&&(s[r[i]]=e[r[i]]);return s},i=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.GoogleMapsEmbed=void 0;let n=i(s(6802)),a=s(5781);t.GoogleMapsEmbed=e=>{var t=r(e,[]);return(0,a.formatData)(n.default,t)}},5781:(e,t)=>{function s(e,t,r=!1){return t?Object.keys(e).filter(e=>r?!t.includes(e):t.includes(e)).reduce((t,s)=>(t[s]=e[s],t),{}):{}}function r(e,t,s,r){let i=r&&Object.keys(r).length>0?new URL(Object.values(r)[0],e):new URL(e);return t&&s&&t.forEach(e=>{s[e]&&i.searchParams.set(e,s[e])}),i.toString()}function i(e,t,s,i,n){var a;if(!t)return`<${e}></${e}>`;let o=(null==(a=t.src)?void 0:a.url)?Object.assign(Object.assign({},t),{src:r(t.src.url,t.src.params,i,n)}):t,l=Object.keys(Object.assign(Object.assign({},o),s)).reduce((e,t)=>{let r=null==s?void 0:s[t],i=o[t],n=null!=r?r:i,a=!0===n?t:`${t}="${n}"`;return n?e+` ${a}`:e},"");return`<${e}${l}></${e}>`}Object.defineProperty(t,"__esModule",{value:!0}),t.formatData=t.createHtml=t.formatUrl=void 0,t.formatUrl=r,t.createHtml=i,t.formatData=function(e,t){var n,a,o,l,c;let d=s(t,null==(n=e.scripts)?void 0:n.reduce((e,t)=>[...e,...Array.isArray(t.params)?t.params:[]],[])),u=s(t,null==(o=null==(a=e.html)?void 0:a.attributes.src)?void 0:o.params),h=s(t,[null==(c=null==(l=e.html)?void 0:l.attributes.src)?void 0:c.slugParam]),g=s(t,[...Object.keys(d),...Object.keys(u),...Object.keys(h)],!0);return Object.assign(Object.assign({},e),{html:e.html?i(e.html.element,e.html.attributes,g,u,h):null,scripts:e.scripts?e.scripts.map(e=>Object.assign(Object.assign({},e),{url:r(e.url,e.params,d)})):null})}},6784:function(e,t,s){var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.sendGAEvent=t.GoogleAnalytics=t.sendGTMEvent=t.GoogleTagManager=t.YouTubeEmbed=t.GoogleMapsEmbed=void 0;var i=s(2037);Object.defineProperty(t,"GoogleMapsEmbed",{enumerable:!0,get:function(){return r(i).default}});var n=s(7577);Object.defineProperty(t,"YouTubeEmbed",{enumerable:!0,get:function(){return r(n).default}});var a=s(8202);Object.defineProperty(t,"GoogleTagManager",{enumerable:!0,get:function(){return a.GoogleTagManager}}),Object.defineProperty(t,"sendGTMEvent",{enumerable:!0,get:function(){return a.sendGTMEvent}});var o=s(8332);Object.defineProperty(t,"GoogleAnalytics",{enumerable:!0,get:function(){return o.GoogleAnalytics}}),Object.defineProperty(t,"sendGAEvent",{enumerable:!0,get:function(){return o.sendGAEvent}})},6802:e=>{e.exports=JSON.parse('{"id":"google-maps-embed","description":"Embed a Google Maps embed on your webpage","website":"https://developers.google.com/maps/documentation/embed/get-started","html":{"element":"iframe","attributes":{"loading":"lazy","src":{"url":"https://www.google.com/maps/embed/v1/place","slugParam":"mode","params":["key","q","center","zoom","maptype","language","region"]},"referrerpolicy":"no-referrer-when-downgrade","frameborder":"0","style":"border:0","allowfullscreen":true,"width":null,"height":null}}}')},7445:(e,t,s)=>
1{Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){let{html:t,height:s=null,width:n=null,children:a,dataNtpc:o=""}=e;return(0,i.useEffect)(()=>{o&&performance.mark("mark_feature_usage",{detail:{feature:"next-third-parties-".concat(o)}})},[o]),(0,r.jsxs)(r.Fragment,{children:[a,t?(0,r.jsx)("div",{style:{height:null!=s?"".concat(s,"px"):"auto",width:null!=n?"".concat(n,"px"):"auto"},"data-ntpc":o,dangerouslySetInnerHTML:{__html:t}}):null]})};let r=s(5155),i=s(2115)},7577:function(e,t,s){var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){let{html:t,scripts:s,stylesheets:r}=(0,a.YouTubeEmbed)(e);return(0,i.jsx)(o.default,{height:e.height||null,width:e.width||null,html:t,dataNtpc:"YouTubeEmbed",children:null==s?void 0:s.map(e=>(0,i.jsx)(n.default,{src:e.url,strategy:l[e.strategy],stylesheets:r},e.url))})};let i=s(5155),n=r(s(8321)),a=s(3067),o=r(s(7445)),l={server:"beforeInteractive",client:"afterInteractive",idle:"lazyOnload",worker:"worker"}},8197:function(e,t,s){var r=this&&this.__rest||function(e,t){var s={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&0>t.indexOf(r)&&(s[r]=e[r]);if(null!=e&&"function"==typeof Object.getOwnPropertySymbols)for(var i=0,r=Object.getOwnPropertySymbols(e);i<r.length;i++)0>t.indexOf(r[i])&&Object.prototype.propertyIsEnumerable.call(e,r[i])&&(s[r[i]]=e[r[i]]);return s},i=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.GoogleAnalytics=void 0;let n=i(s(3817)),a=s(5781);t.GoogleAnalytics=e=>{var t=r(e,[]);return(0,a.formatData)(n.default,t)}},8202:(e,t,s)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.sendGTMEvent=void 0,t.GoogleTagManager=function(e){let{gtmId:t,gtmScriptUrl:s="https://www.googletagmanager.com/gtm.js",dataLayerName:o="dataLayer",auth:l,preview:c,dataLayer:d,nonce:u}=e;a=o;let h="dataLayer"!==o?"&l=".concat(o):"";return(0,i.useEffect)(()=>{performance.mark("mark_feature_usage",{detail:{feature:"next-third-parties-gtm"}})},[]),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.default,{id:"_next-gtm-init",dangerouslySetInnerHTML:{__html:"\n (function(w,l){\n w[l]=w[l]||[];\n w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});\n ".concat(d?"w[l].push(".concat(JSON.stringify(d),")"):"","\n })(window,'").concat(o,"');")},nonce:u}),(0,r.jsx)(n.default,{id:"_next-gtm","data-ntpc":"GTM",src:"".concat(s,"?id=").concat(t).concat(h).concat(l?">m_auth=".concat(l):"").concat(c?">m_preview=".concat(c,">m_cookies_win=x"):""),nonce:u})]})};let r=s(5155),i=s(2115),n=function(e){return e&&e.__esModule?e:{default:e}}(s(8321)),a="dataLayer";t.sendGTMEvent=(e,t)=>{let s=t||a;window[s]=window[s]||[],window[s].push(e)}},8212:(e,t,s)=>{s.d(t,{$5:()=>es,O:()=>x});class r extends Error{}r.prototype.name="InvalidTokenError";var i,n,a={debug:()=>void 0,info:()=>void 0,warn:()=>void 0,error:()=>void 0},o=(e=>(e[e.NONE=0]="NONE",e[e.ERROR=1]="ERROR",e[e.WARN=2]="WARN",e[e.INFO=3]="INFO",e[e.DEBUG=4]="DEBUG",e))(o||{});(e=>{e.reset=function(){i=3,n=a},e.setLevel=function(e){if(!(0<=e&&e<=4))throw Error("Invalid log level");i=e},e.setLogger=function(e){n=e}})(o||(o={}));var l=class e{constructor(e){this._name=e}debug(...t){i>=4&&n.debug(e._format(this._name,this._method),...t)}info(...t){i>=3&&n.info(e._format(this._name,this._method),...t)}warn(...t){i>=2&&n.warn(e._format(this._name,this._method),...t)}error(...t){i>=1&&n.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){let t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,s){let r=new e(`${t}.${s}`);return r.debug("begin"),r}static _format(e,t){let s=`[${e}]`;return t?`${s} ${t}:`:s}static debug(t,...s){i>=4&&n.debug(e._format(t),...s)}static info(t,...s){i>=3&&n.info(e._format(t),...s)}static warn(t,...s){i>=2&&n.warn(e._format(t),...s)}static error(t,...s){i>=1&&n.error(e._format(t),...s)}};o.reset();var c=class{static decode(e){try{return function(e,t){let s;if("string"!=typeof e)throw new r("Invalid token specified: must be a string");t||(t={});let i=+(!0!==t.header),n=e.split(".")[i];if("string"!=typeof n)throw new r(`Invalid token specified: missing part #${i+1}`);try{s=function(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw Error("base64 string is not of the correct length")}try{var s;
1return s=t,decodeURIComponent(atob(s).replace(/(.)/g,(e,t)=>{let s=t.charCodeAt(0).toString(16).toUpperCase();return s.length<2&&(s="0"+s),"%"+s}))}catch(e){return atob(t)}}(n)}catch(e){throw new r(`Invalid token specified: invalid base64 for part #${i+1} (${e.message})`)}try{return JSON.parse(s)}catch(e){throw new r(`Invalid token specified: invalid json for part #${i+1} (${e.message})`)}}(e)}catch(e){throw l.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,s){let r=h.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),i=h.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${r}.${i}`,a=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},s,new TextEncoder().encode(n)),o=h.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}static async generateSignedJwtWithHmac(e,t,s){let r=h.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),i=h.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${r}.${i}`,a=await window.crypto.subtle.sign("HMAC",s,new TextEncoder().encode(n)),o=h.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}},d=e=>btoa([...new Uint8Array(e)].map(e=>String.fromCharCode(e)).join("")),u=class e{static _randomWord(){let e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,t=>(t^e._randomWord()&15>>t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{let t=new TextEncoder().encode(e),s=await crypto.subtle.digest("SHA-256",t);return d(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw l.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){return d(new TextEncoder().encode([e,t].join(":")))}static async hash(e,t){let s=new TextEncoder().encode(t);return new Uint8Array(await crypto.subtle.digest(e,s))}static async customCalculateJwkThumbprint(t){let s;switch(t.kty){case"RSA":s={e:t.e,kty:t.kty,n:t.n};break;case"EC":s={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":s={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":s={crv:t.k,kty:t.kty};break;default:throw Error("Unknown jwk type")}let r=await e.hash("SHA-256",JSON.stringify(s));return e.encodeBase64Url(r)}static async generateDPoPProof({url:t,accessToken:s,httpMethod:r,keyPair:i,nonce:n}){let a,o={jti:window.crypto.randomUUID(),htm:null!=r?r:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};s&&(a=await e.hash("SHA-256",s),o.ath=e.encodeBase64Url(a)),n&&(o.nonce=n);try{let e=await crypto.subtle.exportKey("jwk",i.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await c.generateSignedJwt(t,o,i.privateKey)}catch(e){if(e instanceof TypeError)throw Error(`Error exporting dpop public key: ${e.message}`);throw e}}static async generateDPoPJkt(t){try{let s=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(s)}catch(e){if(e instanceof TypeError)throw Error(`Could not retrieve dpop keys from storage: ${e.message}`);throw e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,s,r,i="HS256"){let n=Math.floor(Date.now()/1e3),a={iss:t,sub:t,aud:r,jti:e.generateUUIDv4(),exp:n+300,iat:n},o={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[i];if(!o)throw Error(`Unsupported algorithm: ${i}. Supported algorithms are: HS256, HS384, HS512`);let l=new TextEncoder,d=await crypto.subtle.importKey("raw",l.encode(s),{name:"HMAC",hash:o},!1,["sign"]);return await c.generateSignedJwtWithHmac({alg:i,typ:"JWT"},a,d)}};u.encodeBase64Url=e=>d(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var h=u,g=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new l(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){let t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}
1async raise(...e){for(let t of(this._logger.debug("raise:",...e),this._callbacks))await t(...e)}},_=class{static center({...e}){var t;return null==e.width&&(e.width=null!=(t=[800,720,600,480].find(e=>e<=window.outerWidth/1.618))?t:360),null!=e.left||(e.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-e.width)/2))),null!=e.height&&(null!=e.top||(e.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-e.height)/2)))),e}static serialize(e){return Object.entries(e).filter(([,e])=>null!=e).map(([e,t])=>`${e}=${"boolean"!=typeof t?t:t?"yes":"no"}`).join(",")}},p=class e extends g{constructor(){super(...arguments),this._logger=new l(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{let t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){let s=this._logger.create("init");t=Math.max(Math.floor(t),1);let r=e.getEpochTime()+t;if(this.expiration===r&&this._timerHandle)return void s.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),s.debug("using duration",t),this._expiration=r;let i=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*i)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},f=class{static readParams(e,t="query"){if(!e)throw TypeError("Invalid URL");return new URLSearchParams(new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"].slice(1))}},w=class extends Error{constructor(e,t){var s,r,i;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw l.error("ErrorResponse","No error passed"),Error("No error passed");this.error=e.error,this.error_description=null!=(s=e.error_description)?s:null,this.error_uri=null!=(r=e.error_uri)?r:null,this.state=e.userState,this.session_state=null!=(i=e.session_state)?i:null,this.url_state=e.url_state}},m=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},y=class{constructor(e){this._logger=new l("AccessTokenEvents"),this._expiringTimer=new p("Access token expiring"),this._expiredTimer=new p("Access token expired"),this._expiringNotificationTimeInSeconds=e.expiringNotificationTimeInSeconds}async load(e){let t=this._logger.create("load");if(e.access_token&&void 0!==e.expires_in){let s=e.expires_in;if(t.debug("access token present, remaining duration:",s),s>0){let e=s-this._expiringNotificationTimeInSeconds;e<=0&&(e=1),t.debug("registering expiring timer, raising in",e,"seconds"),this._expiringTimer.init(e)}else t.debug("canceling existing expiring timer because we're past expiration."),this._expiringTimer.cancel();let r=s+1;t.debug("registering expired timer, raising in",r,"seconds"),this._expiredTimer.init(r)}else this._expiringTimer.cancel(),this._expiredTimer.cancel()}async unload(){this._logger.debug("unload: canceling existing access token timers"),this._expiringTimer.cancel(),this._expiredTimer.cancel()}addAccessTokenExpiring(e){return this._expiringTimer.addHandler(e)}removeAccessTokenExpiring(e){this._expiringTimer.removeHandler(e)}addAccessTokenExpired(e){return this._expiredTimer.addHandler(e)}removeAccessTokenExpired(e){this._expiredTimer.removeHandler(e)}},b=class{constructor(e,t,s,r,i){this._callback=e,this._client_id=t,this._intervalInSeconds=r,this._stopOnError=i,this._logger=new l("CheckSessionIFrame"),this._timer=null,this._session_state=null,this._message=e=>{e.origin===this._frame_origin&&e.source===this._frame.contentWindow&&("error"===e.data?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):"changed"===e.data?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(e.data+" message from check session op iframe"))};let n=new URL(s);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(e=>{this._frame.onload=()=>{e()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(e){if(this._session_state===e)return;this._logger.create("start"),this.stop(),this._session_state=e;let t=()=>{this._frame.contentWindow&&this._session_state&&this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};t(),this._timer=setInterval(t,1e3*this._intervalInSeconds)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}},v=class{constructor(){this._logger=new l("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}}
1,S=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},k=class{constructor(e=[],t=null,s={}){this._jwtHandler=t,this._extraHeaders=s,this._logger=new l("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){let{timeoutInSeconds:s,...r}=t;if(!s)return await fetch(e,r);let i=new AbortController,n=setTimeout(()=>i.abort(),1e3*s);try{return await fetch(e,{...t,signal:i.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new m("Network timed out");throw e}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:s,timeoutInSeconds:r}={}){let i,n,a=this._logger.create("getJson"),o={Accept:this._contentTypes.join(", ")};t&&(a.debug("token passed, setting Authorization header"),o.Authorization="Bearer "+t),this._appendExtraHeaders(o);try{a.debug("url:",e),i=await this.fetchWithTimeout(e,{method:"GET",headers:o,timeoutInSeconds:r,credentials:s})}catch(e){throw a.error("Network Error"),e}a.debug("HTTP response received, status",i.status);let l=i.headers.get("Content-Type");if(l&&!this._contentTypes.find(e=>l.startsWith(e))&&a.throw(Error(`Invalid response Content-Type: ${null!=l?l:"undefined"}, from URL: ${e}`)),i.ok&&this._jwtHandler&&(null==l?void 0:l.startsWith("application/jwt")))return await this._jwtHandler(await i.text());try{n=await i.json()}catch(e){if(a.error("Error parsing JSON response",e),i.ok)throw e;throw Error(`${i.statusText} (${i.status})`)}if(!i.ok){if(a.error("Error from server:",n),n.error)throw new w(n);throw Error(`${i.statusText} (${i.status}): ${JSON.stringify(n)}`)}return n}async postForm(e,{body:t,basicAuth:s,timeoutInSeconds:r,initCredentials:i,extraHeaders:n}){let a,o=this._logger.create("postForm"),l={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...n};void 0!==s&&(l.Authorization="Basic "+s),this._appendExtraHeaders(l);try{o.debug("url:",e),a=await this.fetchWithTimeout(e,{method:"POST",headers:l,body:t,timeoutInSeconds:r,credentials:i})}catch(e){throw o.error("Network error"),e}o.debug("HTTP response received, status",a.status);let c=a.headers.get("Content-Type");if(c&&!this._contentTypes.find(e=>c.startsWith(e)))throw Error(`Invalid response Content-Type: ${null!=c?c:"undefined"}, from URL: ${e}`);let d=await a.text(),u={};if(d)try{u=JSON.parse(d)}catch(e){if(o.error("Error parsing JSON response",e),a.ok)throw e;throw Error(`${a.statusText} (${a.status})`)}if(!a.ok){if(o.error("Error from server:",u),a.headers.has("dpop-nonce"))throw new S(a.headers.get("dpop-nonce"),`${JSON.stringify(u)}`);if(u.error)throw new w(u,t);throw Error(`${a.statusText} (${a.status}): ${JSON.stringify(u)}`)}return u}_appendExtraHeaders(e){let t=this._logger.create("appendExtraHeaders"),s=Object.keys(this._extraHeaders),r=["accept","content-type"],i=["authorization"];0!==s.length&&s.forEach(s=>{if(r.includes(s.toLocaleLowerCase()))return void t.warn("Protected header could not be set",s,r);if(i.includes(s.toLocaleLowerCase())&&Object.keys(e).includes(s))return void t.warn("Header could not be overridden",s,i);let n="function"==typeof this._extraHeaders[s]?this._extraHeaders[s]():this._extraHeaders[s];n&&""!==n&&(e[s]=n)})}},E=class{constructor(e){this._settings=e,this._logger=new l("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new k(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){let e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);let t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){let s=this._logger.create(`_getMetadataProperty('${e}')`),r=await this.getMetadata();if(s.debug("resolved"),void 0===r[e]){if(!0===t)return void s.warn("Metadata does not contain optional property");s.throw(Error("Metadata does not contain property "+e))}return r[e]}async getSigningKeys(){let e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;let t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);let s=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",s),!Array.isArray(s.keys))throw e.throw(Error("Missing keys on keyset")),null;return this._signingKeys=s.keys,this._signingKeys}},x=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new l("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){return this._logger.create(`get('${e}')`),e=this._prefix+e,await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;let t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");let e=await this._store.length,t=[];for(let s=0;s<e;s++){let e=await this._store.key(s);
1e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},T=class{constructor({authority:e,metadataUrl:t,metadata:s,signingKeys:r,metadataSeed:i,client_id:n,client_secret:a,response_type:o="code",scope:l="openid",redirect_uri:c,post_logout_redirect_uri:d,client_authentication:u="client_secret_post",token_endpoint_auth_signing_alg:h="HS256",prompt:g,display:_,max_age:p,ui_locales:f,acr_values:w,resource:m,response_mode:y,filterProtocolClaims:b=!0,loadUserInfo:S=!1,requestTimeoutInSeconds:k,staleStateAgeInSeconds:E=900,mergeClaimsStrategy:T={array:"replace"},disablePKCE:P=!1,stateStore:O,revokeTokenAdditionalContentTypes:I,fetchRequestCredentials:C,refreshTokenAllowedScope:R,extraQueryParams:j={},extraTokenParams:U={},extraHeaders:A={},dpop:M,omitScopeWhenRequesting:N=!1}){var H;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=s,this.metadataSeed=i,this.signingKeys=r,this.client_id=n,this.client_secret=a,this.response_type=o,this.scope=l,this.redirect_uri=c,this.post_logout_redirect_uri=d,this.client_authentication=u,this.token_endpoint_auth_signing_alg=h,this.prompt=g,this.display=_,this.max_age=p,this.ui_locales=f,this.acr_values=w,this.resource=m,this.response_mode=y,this.filterProtocolClaims=null==b||b,this.loadUserInfo=!!S,this.staleStateAgeInSeconds=E,this.mergeClaimsStrategy=T,this.omitScopeWhenRequesting=N,this.disablePKCE=!!P,this.revokeTokenAdditionalContentTypes=I,this.fetchRequestCredentials=C||"same-origin",this.requestTimeoutInSeconds=k,O)this.stateStore=O;else{let e="undefined"!=typeof window?window.localStorage:new v;this.stateStore=new x({store:e})}if(this.refreshTokenAllowedScope=R,this.extraQueryParams=j,this.extraTokenParams=U,this.extraHeaders=A,this.dpop=M,this.dpop&&!(null==(H=this.dpop)?void 0:H.store))throw Error("A DPoPStore is required when dpop is enabled")}},P=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new l("UserInfoService"),this._getClaimsFromJwt=async e=>{let t=this._logger.create("_getClaimsFromJwt");try{let s=c.decode(e);return t.debug("JWT decoding successful"),s}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new k(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){let t=this._logger.create("getClaims");e||this._logger.throw(Error("No token passed"));let s=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",s);let r=await this._jsonService.getJson(s,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",r),r}},O=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new l("TokenClient"),this._jsonService=new k(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:s=this._settings.client_id,client_secret:r=this._settings.client_secret,extraHeaders:i,...n}){let a,o=this._logger.create("exchangeCode");s||o.throw(Error("A client_id is required")),t||o.throw(Error("A redirect_uri is required")),n.code||o.throw(Error("A code is required"));let l=new URLSearchParams({grant_type:e,redirect_uri:t});for(let[e,t]of Object.entries(n))null!=t&&l.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw o.throw(Error("A client_secret is required")),null;let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=h.generateBasicAuth(s,r);break;case"client_secret_post":l.append("client_id",s),r&&l.append("client_secret",r);break;case"client_secret_jwt":{let e=await h.generateClientAssertionJwt(s,r,c,this._settings.token_endpoint_auth_signing_alg);l.append("client_id",s),l.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),l.append("client_assertion",e)}}o.debug("got token endpoint");let d=await this._jsonService.postForm(c,{body:l,basicAuth:a,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:i});return o.debug("got response"),d}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,scope:r=this._settings.scope,...i}){let n,a=this._logger.create("exchangeCredentials");t||a.throw(Error("A client_id is required"));let o=new URLSearchParams({grant_type:e});for(let[e,t]of(this._settings.omitScopeWhenRequesting||o.set("scope",r),Object.entries(i)))null!=t&&o.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw a.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":n=h.generateBasicAuth(t,s);break;case"client_secret_post":o.append("client_id",t),s&&o.append("client_secret",s);break;case"client_secret_jwt":{let e=await h.generateClientAssertionJwt(t,s,l,this._settings.token_endpoint_auth_signing_alg);o.append("client_id",t),o.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),o.append("client_assertion",e)}}a.debug("got token endpoint");let c=await this._jsonService.postForm(l,{body:o,basicAuth:n,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return a.debug("got response"),c}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,timeoutInSeconds:r,extraHeaders:i,...n}){let a,o=this._logger.create("exchangeRefreshToken");t||o.throw(Error("A client_id is required")),n.refresh_token||o.throw(Error("A refresh_token is required"));let l=new URLSearchParams({grant_type:e});for(let[e,t]of Object.entries(n))Array.isArray(t)?t.forEach(t=>l.append(e,t)):null!=t&&l.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw o.throw(Error("A client_secret is required")),null;
1let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=h.generateBasicAuth(t,s);break;case"client_secret_post":l.append("client_id",t),s&&l.append("client_secret",s);break;case"client_secret_jwt":{let e=await h.generateClientAssertionJwt(t,s,c,this._settings.token_endpoint_auth_signing_alg);l.append("client_id",t),l.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),l.append("client_assertion",e)}}o.debug("got token endpoint");let d=await this._jsonService.postForm(c,{body:l,basicAuth:a,timeoutInSeconds:r,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:i});return o.debug("got response"),d}async revoke(e){var t;let s=this._logger.create("revoke");e.token||s.throw(Error("A token is required"));let r=await this._metadataService.getRevocationEndpoint(!1);s.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);let i=new URLSearchParams;for(let[t,s]of Object.entries(e))null!=s&&i.set(t,s);i.set("client_id",this._settings.client_id),this._settings.client_secret&&i.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(r,{body:i,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),s.debug("got response")}},I=class{constructor(e,t,s){this._settings=e,this._metadataService=t,this._claimsService=s,this._logger=new l("ResponseValidator"),this._userInfoService=new P(this._settings,this._metadataService),this._tokenClient=new O(this._settings,this._metadataService)}async validateSigninResponse(e,t,s){let r=this._logger.create("validateSigninResponse");this._processSigninState(e,t),r.debug("state processed"),await this._processCode(e,t,s),r.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),r.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),r.debug("claims processed")}async validateCredentialsResponse(e,t){let s=this._logger.create("validateCredentialsResponse"),r=e.isOpenId&&!!e.id_token;r&&this._validateIdTokenAttributes(e),s.debug("tokens validated"),await this._processClaims(e,t,r),s.debug("claims processed")}async validateRefreshResponse(e,t){let s=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),s.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);let r=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,r),s.debug("claims processed")}validateSignoutResponse(e,t){let s=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&s.throw(Error("State does not match")),s.debug("state validated"),e.userState=t.data,e.error)throw s.warn("Response was error",e.error),new w(e)}_processSigninState(e,t){let s=this._logger.create("_processSigninState");if(t.id!==e.state&&s.throw(Error("State does not match")),t.client_id||s.throw(Error("No client_id on state")),t.authority||s.throw(Error("No authority on state")),this._settings.authority!==t.authority&&s.throw(Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&s.throw(Error("client_id mismatch on settings vs. signin state")),s.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw s.warn("Response was error",e.error),new w(e);t.code_verifier&&!e.code&&s.throw(Error("Expected code in response"))}async _processClaims(e,t=!1,s=!0){let r=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void r.debug("not loading user info");r.debug("loading user info");let i=await this._userInfoService.getClaims(e.access_token);r.debug("user info claims received from user info endpoint"),s&&i.sub!==e.profile.sub&&r.throw(Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(i)),r.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,s){let r=this._logger.create("_processCode");if(e.code){r.debug("Validating code");let i=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:s,...t.extraTokenParams});Object.assign(e,i)}else r.debug("No code to process")}_validateIdTokenAttributes(e,t,s){var r;let i=this._logger.create("_validateIdTokenAttributes");i.debug("decoding ID Token JWT");let n=c.decode(null!=(r=e.id_token)?r:"");
1if(n.sub||i.throw(Error("ID Token is missing a subject claim")),s&&n.nonce!==s&&i.throw(Error("nonce in id_token does not match nonce in client storage")),t){let e=c.decode(t);n.sub!==e.sub&&i.throw(Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==e.auth_time&&i.throw(Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==e.azp&&i.throw(Error("azp in id_token does not match original azp")),!n.azp&&e.azp&&i.throw(Error("azp not in id_token, but present in original id_token"))}e.profile=n}},C=class e{constructor(e){this.id=e.id||h.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=p.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new l("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return l.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,s){let r=l.createStatic("State","clearStaleState"),i=p.getEpochTime()-s,n=await t.getAllKeys();r.debug("got keys",n);for(let s=0;s<n.length;s++){let a=n[s],o=await t.get(a),l=!1;if(o)try{let t=await e.fromStorageString(o);r.debug("got item from key:",a,t.created),t.created<=i&&(l=!0)}catch(e){r.error("Error parsing state for key:",a,e),l=!0}else r.debug("no item in storage for key:",a),l=!0;l&&(r.debug("removed item for key:",a),t.remove(a))}}},R=class e extends C{constructor(e){super(e),this.code_verifier=e.code_verifier,this.code_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){let s=!0===t.code_verifier?h.generateCodeVerifier():t.code_verifier||void 0,r=s?await h.generateCodeChallenge(s):void 0;return new e({...t,code_verifier:s,code_challenge:r})}toStorageString(){return new l("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){l.createStatic("SigninState","fromStorageString");let s=JSON.parse(t);return e.create(s)}},j=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:s,client_id:r,redirect_uri:i,response_type:n,scope:a,state_data:o,response_mode:l,request_type:c,client_secret:d,nonce:u,url_state:h,resource:g,skipUserInfo:_,extraQueryParams:p,extraTokenParams:f,disablePKCE:w,dpopJkt:m,omitScopeWhenRequesting:y,...b}){if(!t)throw this._logger.error("create: No url passed"),Error("url");if(!r)throw this._logger.error("create: No client_id passed"),Error("client_id");if(!i)throw this._logger.error("create: No redirect_uri passed"),Error("redirect_uri");if(!n)throw this._logger.error("create: No response_type passed"),Error("response_type");if(!a)throw this._logger.error("create: No scope passed"),Error("scope");if(!s)throw this._logger.error("create: No authority passed"),Error("authority");let v=await R.create({data:o,request_type:c,url_state:h,code_verifier:!w,client_id:r,authority:s,redirect_uri:i,response_mode:l,client_secret:d,scope:a,extraTokenParams:f,skipUserInfo:_,nonce:u}),S=new URL(t);S.searchParams.append("client_id",r),S.searchParams.append("redirect_uri",i),S.searchParams.append("response_type",n),y||S.searchParams.append("scope",a),u&&S.searchParams.append("nonce",u),m&&S.searchParams.append("dpop_jkt",m);let k=v.id;for(let[e,t]of(h&&(k=`${k};${h}`),S.searchParams.append("state",k),v.code_challenge&&(S.searchParams.append("code_challenge",v.code_challenge),S.searchParams.append("code_challenge_method","S256")),g&&(Array.isArray(g)?g:[g]).forEac
1h(e=>S.searchParams.append("resource",e)),Object.entries({response_mode:l,...b,...p})))null!=t&&S.searchParams.append(e,t.toString());return new e({url:S.href,state:v})}};j._logger=new l("SigninRequest");var U=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){let e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},A=class{constructor({url:e,state_data:t,id_token_hint:s,post_logout_redirect_uri:r,extraQueryParams:i,request_type:n,client_id:a,url_state:o}){if(this._logger=new l("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),Error("url");let c=new URL(e);if(s&&c.searchParams.append("id_token_hint",s),a&&c.searchParams.append("client_id",a),r&&(c.searchParams.append("post_logout_redirect_uri",r),t||o)){this.state=new C({data:t,request_type:n,url_state:o});let e=this.state.id;o&&(e=`${e};${o}`),c.searchParams.append("state",e)}for(let[e,t]of Object.entries({...i}))null!=t&&c.searchParams.append(e,t.toString());this.url=c.href}},M=class{constructor(e){if(this.state=e.get("state"),this.state){let e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},N=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],H=["sub","iss","aud","exp","iat"],q=class{constructor(e){this._settings=e,this._logger=new l("ClaimsService")}filterProtocolClaims(e){let t={...e};if(this._settings.filterProtocolClaims){for(let e of Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:N)H.includes(e)||delete t[e]}return t}mergeClaims(e,t){let s={...e};for(let[e,r]of Object.entries(t))if(s[e]!==r)if(Array.isArray(s[e])||Array.isArray(r))if("replace"==this._settings.mergeClaimsStrategy.array)s[e]=r;else{let t=Array.isArray(s[e])?s[e]:[s[e]];for(let e of Array.isArray(r)?r:[r])t.includes(e)||t.push(e);s[e]=t}else"object"==typeof s[e]&&"object"==typeof r?s[e]=this.mergeClaims(s[e],r):s[e]=r;return s}},$=class{constructor(e,t){this.keys=e,this.nonce=t}},L=class{constructor(e,t){this._logger=new l("OidcClient"),this.settings=e instanceof T?e:new T(e),this.metadataService=null!=t?t:new E(this.settings),this._claimsService=new q(this.settings),this._validator=new I(this.settings,this.metadataService,this._claimsService),this._tokenClient=new O(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:s,request_type:r,id_token_hint:i,login_hint:n,skipUserInfo:a,nonce:o,url_state:l,response_type:c=this.settings.response_type,scope:d=this.settings.scope,redirect_uri:u=this.settings.redirect_uri,prompt:h=this.settings.prompt,display:g=this.settings.display,max_age:_=this.settings.max_age,ui_locales:p=this.settings.ui_locales,acr_values:f=this.settings.acr_values,resource:w=this.settings.resource,response_mode:m=this.settings.response_mode,extraQueryParams:y=this.settings.extraQueryParams,extraTokenParams:b=this.settings.extraTokenParams,dpopJkt:v,omitScopeWhenRequesting:S=this.settings.omitScopeWhenRequesting}){let k=this._logger.create("createSigninRequest");if("code"!==c)throw Error("Only the Authorization Code flow (with PKCE) is supported");let E=await this.metadataService.getAuthorizationEndpoint();k.debug("Received authorization endpoint",E);let x=await j.create({url:E,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:u,response_type:c,scope:d,state_data:e,url_state:l,prompt:h,display:g,max_age:_,ui_locales:p,id_token_hint:i,login_hint:n,acr_values:f,dpopJkt:v,resource:w,request:t,request_uri:s,extraQueryParams:y,extraTokenParams:b,request_type:r,response_mode:m,client_secret:this.settings.client_secret,skipUserInfo:a,nonce:o,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:S});await this.clearStaleState();let T=x.state;return await this.settings.stateStore.set(T.id,T.toStorageString()),x}async readSigninResponseState(e,t=!1){let s=this._logger.create("readSigninResponseState"),r=new U(f.readParams(e,this.settings.response_mode));if(!r.state)throw s.throw(Error("No state in response")),null;let i=await this.settings.stateStore[t?"remove":"get"](r.state);if(!i)throw s.throw(Error("No matching state found in storage")),null;return{state:await R.fromStorageString(i),response:r}}async processSigninResponse(e,t,s=!0){let r=this._logger.create("processSigninResponse"),{state:i,response:n}=await this.readSigninResponseState(e,s);if(r.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}
1try{await this._validator.validateSigninResponse(n,i,t)}catch(e){if(e instanceof S&&this.settings.dpop){let s=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=s,await this._validator.validateSigninResponse(n,i,t)}else throw e}return n}async getDpopProof(e,t){let s;return(await e.getAllKeys()).includes(this.settings.client_id)?(s=await e.get(this.settings.client_id)).nonce!==t&&t&&(s.nonce=t,await e.set(this.settings.client_id,s)):(s=new $(await h.generateDPoPKeys(),t),await e.set(this.settings.client_id,s)),await h.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:s.keys,nonce:s.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s=!1,extraTokenParams:r={}}){let i=await this._tokenClient.exchangeCredentials({username:e,password:t,...r}),n=new U(new URLSearchParams);return Object.assign(n,i),await this._validator.validateCredentialsResponse(n,s),n}async useRefreshToken({state:e,redirect_uri:t,resource:s,timeoutInSeconds:r,extraHeaders:i,extraTokenParams:n}){var a;let o,l,c=this._logger.create("useRefreshToken");if(void 0===this.settings.refreshTokenAllowedScope)o=e.scope;else{let t=this.settings.refreshTokenAllowedScope.split(" ");o=((null==(a=e.scope)?void 0:a.split(" "))||[]).filter(e=>t.includes(e)).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);i={...i,DPoP:e}}try{l=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:r,extraHeaders:i,...n})}catch(a){if(a instanceof S&&this.settings.dpop)i.DPoP=await this.getDpopProof(this.settings.dpop.store,a.nonce),l=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:r,extraHeaders:i,...n});else throw a}let d=new U(new URLSearchParams);return Object.assign(d,l),c.debug("validating response",d),await this._validator.validateRefreshResponse(d,{...e,scope:o}),d}async createSignoutRequest({state:e,id_token_hint:t,client_id:s,request_type:r,url_state:i,post_logout_redirect_uri:n=this.settings.post_logout_redirect_uri,extraQueryParams:a=this.settings.extraQueryParams}={}){let o=this._logger.create("createSignoutRequest"),l=await this.metadataService.getEndSessionEndpoint();if(!l)throw o.throw(Error("No end session endpoint")),null;o.debug("Received end session endpoint",l),s||!n||t||(s=this.settings.client_id);let c=new A({url:l,id_token_hint:t,client_id:s,post_logout_redirect_uri:n,state_data:e,extraQueryParams:a,request_type:r,url_state:i});await this.clearStaleState();let d=c.state;return d&&(o.debug("Signout request has state to persist"),await this.settings.stateStore.set(d.id,d.toStorageString())),c}async readSignoutResponseState(e,t=!1){let s=this._logger.create("readSignoutResponseState"),r=new M(f.readParams(e,this.settings.response_mode));if(!r.state){if(s.debug("No state in response"),r.error)throw s.warn("Response was error:",r.error),new w(r);return{state:void 0,response:r}}let i=await this.settings.stateStore[t?"remove":"get"](r.state);if(!i)throw s.throw(Error("No matching state found in storage")),null;return{state:await C.fromStorageString(i),response:r}}async processSignoutResponse(e){let t=this._logger.create("processSignoutResponse"),{state:s,response:r}=await this.readSignoutResponseState(e,!0);return s?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(r,s)):t.debug("No state from storage; skipping response validation"),r}clearStaleState(){return this._logger.create("clearStaleState"),C.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}},D=class{constructor(e){this._userManager=e,this._logger=new l("SessionMonitor"),this._start=async e=>{let t=e.session_state;if(!t)return;let s=this._logger.create("_start");if(e.profile?(this._sub=e.profile.sub,s.debug("session_state",t,", sub",this._sub)):(this._sub=void 0,s.debug("session_state",t,", anonymous user")),this._checkSessionIFrame)return void this._checkSessionIFrame.start(t);try{let e=await this._userManager.metadataService.getCheckSessionIframe();if(e){s.debug("initializing check session iframe");let r=this._userManager.settings.client_id,i=this._userManager.settings.checkSessionIntervalInSeconds,n=this._userManager.settings.stopCheckSessionOnError,a=new b(this._callback,r,e,i,n);await a.load(),this._checkSessionIFrame=a,a.start(t)}else s.warn("no check session iframe found in the metadata")}catch(e){s.error("Error from getCheckSessionIframe:",e instanceof Error?e.message:e)}},this._stop=()=>{let e=this._logger.create("_stop");if(this._sub=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){let t=setInterval(async()=>{clearInterval(t);try{let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}catch(t){e.error("error from querySessionStatus",t instanceof Error?t.message:t)}},1e3)}},this._callback=async()=>{let e=this._logger.create("_callback");try{let t=await this._userManager.querySessionStatus(),s=!0;t&&this._checkSessionIFrame?t.sub===this._sub?(s=!1,this._checkSessionIFrame.start(t.session_state),e.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",t.session_state),await this._userManager.events._raiseUserSessionChanged()):e.debug("different subject signed into OP",t.sub):e.debug("subject no longer signed into OP"),s?this._sub?await this._userManager.events._raiseUserSignedOut():await this._userManager.events._raiseUserSignedIn():e.debug("no change in session detected, no event to raise")}catch(t){this._sub&&(e.debug("Error calling queryCurrentSigninSession; raising signed out event",t),await this._userManager.events._raiseUserSignedOut())}},e||this._logger.throw(Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(e=>{this._logger.error(e)})}async _init(){this._logger.create("_init");let e=await this._userManager.getUser();if(e)this._start(e);else if(this._userManager.settings.monitorAnonymousSession){let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}}},J=class e{constructor(e){var t;this.id_token=e.id_token,this.session_state=null!=(t=e.session_state)?t:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState,this.url_state=e.url_state}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){void 0!==e&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get expired(){let e=this.expires_in;if(void 0!==e)return e<=0}get scopes(){var e,t;return null!=(t=null==(e=this.scope)?void 0:e.split(" "))?t:[]}toStorageString(){return new l("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(t){return l.createStatic("User","fromStorageString"),new e(JSON.parse(t))}},G="oidc-client",W=class{constructor(){this._abort=new g("Window navigation aborted"),this._disposeHandlers=new Set,this._window=null}async navigate(e){let t=this._logger.create("navigate");if(!this._window)throw Error("Attempted to navigate on a disposed window");t.debug("setting URL in window"),this._window.location.replace(e.url);let{url:s,keepOpen:r}=await new Promise((s,r)=>{let i=i=>{var n;let a=i.data,o=null!=(n=e.scriptOrigin)?n:window.location.origin;if(i.origin===o&&(null==a?void 0:a.source)===G){try{let s=f.readParams(a.url,e.response_mode).get("state");if(s||t.warn("no state found in response url"),i.source!==this._window&&s!==e.state)return}catch{this._dispose(),r(Error("Invalid response from window"))}s(a)}};window.addEventListener("message",i,!1),this._disposeHandlers.add(()=>window.removeEventListener("message",i,!1));let n=new BroadcastChannel(`oidc-client-popup-${e.state}`);n.addEventListener("message",i,!1),this._disposeHandlers.add(()=>n.close()),this._disposeHandlers.add(this._abort.addHandler(e=>{this._dispose(),r(e)}))});return t.debug("got response from window"),this._dispose(),r||this.close(),{url:s}}_dispose(){for(let e of(this._logger.create("_dispose"),this._disposeHandlers))e();this._disposeHandlers.clear()}static _notifyParent(e,t,s=!1,r=window.location.origin){let i={source:G,url:t,keepOpen:s},n=new l("_notifyParent");
1if(e)n.debug("With parent. Using parent.postMessage."),e.postMessage(i,r);else{n.debug("No parent. Using BroadcastChannel.");let e=new URL(t).searchParams.get("state");if(!e)throw Error("No parent and no state in URL. Can't complete notification.");let s=new BroadcastChannel(`oidc-client-popup-${e}`);s.postMessage(i),s.close()}}},K={location:!1,toolbar:!1,height:640,closePopupWindowAfterInSeconds:-1},z="_blank",F=class extends T{constructor(e){let{popup_redirect_uri:t=e.redirect_uri,popup_post_logout_redirect_uri:s=e.post_logout_redirect_uri,popupWindowFeatures:r=K,popupWindowTarget:i=z,redirectMethod:n="assign",redirectTarget:a="self",iframeNotifyParentOrigin:o=e.iframeNotifyParentOrigin,iframeScriptOrigin:l=e.iframeScriptOrigin,requestTimeoutInSeconds:c,silent_redirect_uri:d=e.redirect_uri,silentRequestTimeoutInSeconds:u,automaticSilentRenew:h=!0,validateSubOnSilentRenew:g=!0,includeIdTokenInSilentRenew:_=!1,monitorSession:p=!1,monitorAnonymousSession:f=!1,checkSessionIntervalInSeconds:w=2,query_status_response_type:m="code",stopCheckSessionOnError:y=!0,revokeTokenTypes:b=["access_token","refresh_token"],revokeTokensOnSignout:S=!1,includeIdTokenInSilentSignout:k=!1,accessTokenExpiringNotificationTimeInSeconds:E=60,maxSilentRenewTimeoutRetries:T,userStore:P}=e;if(super(e),this.popup_redirect_uri=t,this.popup_post_logout_redirect_uri=s,this.popupWindowFeatures=r,this.popupWindowTarget=i,this.redirectMethod=n,this.redirectTarget=a,this.iframeNotifyParentOrigin=o,this.iframeScriptOrigin=l,this.silent_redirect_uri=d,this.silentRequestTimeoutInSeconds=u||c||10,this.automaticSilentRenew=h,this.validateSubOnSilentRenew=g,this.includeIdTokenInSilentRenew=_,this.monitorSession=p,this.monitorAnonymousSession=f,this.checkSessionIntervalInSeconds=w,this.stopCheckSessionOnError=y,this.query_status_response_type=m,this.revokeTokenTypes=b,this.revokeTokensOnSignout=S,this.includeIdTokenInSilentSignout=k,this.accessTokenExpiringNotificationTimeInSeconds=E,this.maxSilentRenewTimeoutRetries=T,P)this.userStore=P;else{let e="undefined"!=typeof window?window.sessionStorage:new v;this.userStore=new x({store:e})}}},B=class e extends W{constructor({silentRequestTimeoutInSeconds:t=10}){super(),this._logger=new l("IFrameWindow"),this._timeoutInSeconds=t,this._frame=e.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){let e=window.document.createElement("iframe");return e.style.visibility="hidden",e.style.position="fixed",e.style.left="-1000px",e.style.top="0",e.width="0",e.height="0",window.document.body.appendChild(e),e}async navigate(e){this._logger.debug("navigate: Using timeout of:",this._timeoutInSeconds);let t=setTimeout(()=>void this._abort.raise(new m("IFrame timed out without a response")),1e3*this._timeoutInSeconds);return this._disposeHandlers.add(()=>clearTimeout(t)),await super.navigate(e)}close(){var e;this._frame&&(this._frame.parentNode&&(this._frame.addEventListener("load",e=>{var t;let s=e.target;null==(t=s.parentNode)||t.removeChild(s),this._abort.raise(Error("IFrame removed from DOM"))},!0),null==(e=this._frame.contentWindow)||e.location.replace("about:blank")),this._frame=null),this._window=null}static notifyParent(e,t){return super._notifyParent(window.parent,e,!1,t)}},Y=class{constructor(e){this._settings=e,this._logger=new l("IFrameNavigator")}async prepare({silentRequestTimeoutInSeconds:e=this._settings.silentRequestTimeoutInSeconds}){return new B({silentRequestTimeoutInSeconds:e})}async callback(e){this._logger.create("callback"),B.notifyParent(e,this._settings.iframeNotifyParentOrigin)}},V=class extends W{constructor({popupWindowTarget:e=z,popupWindowFeatures:t={},popupSignal:s,popupAbortOnClose:r}){super(),this._logger=new l("PopupWindow");let i=_.center({...K,...t});this._window=window.open(void 0,e,_.serialize(i)),this.abortOnClose=!!r,s&&s.addEventListener("abort",()=>{var e;this._abort.raise(Error(null!=(e=s.reason)?e:"Popup aborted"))}),t.closePopupWindowAfterInSeconds&&t.closePopupWindowAfterInSeconds>0&&setTimeout(()=>{if(!this._window||"boolean"!=typeof this._window.closed||this._window.closed)return void this._abort.raise(Error("Popup blocked by user"));this.close()},1e3*t.closePopupWindowAfterInSeconds)}async navigate(e){var t;
1null==(t=this._window)||t.focus();let s=setInterval(()=>{(!this._window||this._window.closed)&&(this._logger.debug("Popup closed by user or isolated by redirect"),r(),this._disposeHandlers.delete(r),this.abortOnClose&&this._abort.raise(Error("Popup closed by user")))},500),r=()=>clearInterval(s);return this._disposeHandlers.add(r),await super.navigate(e)}close(){this._window&&!this._window.closed&&(this._window.close(),this._abort.raise(Error("Popup closed"))),this._window=null}static notifyOpener(e,t){super._notifyParent(window.opener,e,t),t||window.opener||window.close()}},Q=class{constructor(e){this._settings=e,this._logger=new l("PopupNavigator")}async prepare({popupWindowFeatures:e=this._settings.popupWindowFeatures,popupWindowTarget:t=this._settings.popupWindowTarget,popupSignal:s,popupAbortOnClose:r}){return new V({popupWindowFeatures:e,popupWindowTarget:t,popupSignal:s,popupAbortOnClose:r})}async callback(e,{keepOpen:t=!1}){this._logger.create("callback"),V.notifyOpener(e,t)}},X=class{constructor(e){this._settings=e,this._logger=new l("RedirectNavigator")}async prepare({redirectMethod:e=this._settings.redirectMethod,redirectTarget:t=this._settings.redirectTarget}){var s;let r;this._logger.create("prepare");let i=window.self;"top"===t&&(i=null!=(s=window.top)?s:window.self);let n=i.location[e].bind(i.location);return{navigate:async e=>{this._logger.create("navigate");let t=new Promise((t,s)=>{r=s,window.addEventListener("pageshow",()=>t(window.location.href)),n(e.url)});return await t},close:()=>{this._logger.create("close"),null==r||r(Error("Redirect aborted")),i.stop()}}}async callback(){}},Z=class extends y{constructor(e){super({expiringNotificationTimeInSeconds:e.accessTokenExpiringNotificationTimeInSeconds}),this._logger=new l("UserManagerEvents"),this._userLoaded=new g("User loaded"),this._userUnloaded=new g("User unloaded"),this._silentRenewError=ne
1w g("Silent renew error"),this._userSignedIn=new g("User signed in"),this._userSignedOut=new g("User signed out"),this._userSessionChanged=new g("User session changed")}async load(e,t=!0){await super.load(e),t&&await this._userLoaded.raise(e)}async unload(){await super.unload(),await this._userUnloaded.raise()}addUserLoaded(e){return this._userLoaded.addHandler(e)}removeUserLoaded(e){return this._userLoaded.removeHandler(e)}addUserUnloaded(e){return this._userUnloaded.addHandler(e)}removeUserUnloaded(e){return this._userUnloaded.removeHandler(e)}addSilentRenewError(e){return this._silentRenewError.addHandler(e)}removeSilentRenewError(e){return this._silentRenewError.removeHandler(e)}async _raiseSilentRenewError(e){await this._silentRenewError.raise(e)}addUserSignedIn(e){return this._userSignedIn.addHandler(e)}removeUserSignedIn(e){this._userSignedIn.removeHandler(e)}async _raiseUserSignedIn(){await this._userSignedIn.raise()}addUserSignedOut(e){return this._userSignedOut.addHandler(e)}removeUserSignedOut(e){this._userSignedOut.removeHandler(e)}async _raiseUserSignedOut(){await this._userSignedOut.raise()}addUserSessionChanged(e){return this._userSessionChanged.addHandler(e)}removeUserSessionChanged(e){this._userSessionChanged.removeHandler(e)}async _raiseUserSessionChanged(){await this._userSessionChanged.raise()}},ee=class{constructor(e){this._userManager=e,this._logger=new l("SilentRenewService"),this._isStarted=!1,this._retryTimer=new p("Retry Silent Renew"),this._timeoutRetryCount=0,this._tokenExpiring=async()=>{let e=this._logger.create("_tokenExpiring");try{await this._userManager.signinSilent(),this._timeoutRetryCount=0,e.debug("silent token renewal successful")}catch(t){if(t instanceof m){this._timeoutRetryCount++;let s=this._userManager.settings.maxSilentRenewTimeoutRetries;if(void 0!==s&&this._timeoutRetryCount>s){e.error(`Timeout retry limit reached (${this._timeoutRetryCount} > ${s}), raising silentRenewError:`,t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t);return}e.warn(`ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,t),this._retryTimer.init(5);return}e.error("Error from signinSilent:",t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t)}}}async start(){let e=this._logger.create("start");if(!this._isStarted){this._isStarted=!0,this._userManager.events.addAccessTokenExpiring(this._tokenExpiring),this._retryTimer.addHandler(this._tokenExpiring);try{await this._userManager.getUser()}catch(t){e.error("getUser error",t)}}}stop(){this._isStarted&&(this._retryTimer.cancel(),this._retryTimer.removeHandler(this._tokenExpiring),this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring),this._isStarted=!1)}},et=class{constructor(e){this.refresh_token=e.refresh_token,this.id_token=e.id_token,this.session_state=e.session_state,this.scope=e.scope,this.profile=e.profile,this.data=e.state}},es=class{constructor(e,t,s,r){this._logger=new l("UserManager"),this.settings=new F(e),this._client=new L(e),this._redirectNavigator=null!=t?t:new X(this.settings),this._popupNavigator=null!=s?s:new Q(this.settings),this._iframeNavigator=null!=r?r:new Y(this.settings),this._events=new Z(this.settings),this._silentRenewService=new ee(this),this.settings.automaticSilentRenew&&this.startSilentRenew(),this._sessionMonitor=null,this.settings.monitorSession&&(this._sessionMonitor=new D(this))}get events(){return this._events}get metadataService(){return this._client.metadataService}async getUser(e=!1){let t=this._logger.create("getUser"),s=await this._loadUser();return s?(t.info("user loaded"),await this._events.load(s,e),s):(t.info("user not found in storage"),null)}async removeUser(){let e=this._logger.create("removeUser");await this.storeUser(null),e.info("user removed from storage"),await this._events.unload()}async signinRedirect(e={}){var t;let s;this._logger.create("signinRedirect");let{redirectMethod:r,...i}=e;(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let n=await this._redirectNavigator.prepare({redirectMethod:r});await this._signinStart({request_type:"si:r",dpopJkt:s,...i},n)}async signinRedirectCallback(e=window.location.href){let t=this._logger.create("signinRedirectCallback"),s=await this._signinEnd(e);return s.profile&&s.profile.sub?t.info("success, signed in subject",s.profile.sub):t.info("no subject"),s}async signinResourceOwnerCredentials({username:e,password:t,skipUserInfo:s=!1}){let r=this._logger.create("signinResourceOwnerCredential"),i=await this._client.processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s,extraTokenParams:this.settings.extraTokenParams});r.debug("got signin response");let n=await this._buildUser(i);return n.profile&&n.profile.sub?r.info("success, signed in subject",n.profile.sub):r.info("no subject"),n}async signinPopup(e={}){var t;let s,r=this._logger.create("signinPopup");(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let{popupWindowFeatures:i,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o,...l}=e,c=this.settings.popup_redirect_uri;c||r.throw(Error("No popup_redirect_uri configured"));let d=await this._popupNavigator.prepare({popupWindowFeatures:i,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o}),u=await this._signin({request_type:"si:p",redirect_uri:c,display:"popup",dpopJkt:s,...l},d);return u&&(u.profile&&u.profile.sub?r.info("success, signed in subject",u.profile.sub):r.info("no subject")),u}async signinPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signinPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async signinSilent(e={}){var t,s;let r,i,n=this._logger.create("signinSilent"),{silentRequestTimeoutInSeconds:a,...o}=e,l=await this._loadUser();if(!e.forceIframeAuth&&(null==l?void 0:l.refresh_token)){n.debug("using refresh token");let e=new et(l);return await this._useRefreshToken({state:e,redirect_uri:o.redirect_uri,resource:o.resource,extraTokenParams:o.extraTokenParams,timeoutInSeconds:a})}(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(r=await this.generateDPoPJkt(this.settings.dpop));let c=this.settings.silent_redirect_uri;c||n.throw(Error("No silent_redirect_uri configured")),l&&this.settings.val
1idateSubOnSilentRenew&&(n.debug("subject prior to silent renew:",l.profile.sub),i=l.profile.sub);let d=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:a});return(l=await this._signin({request_type:"si:s",redirect_uri:c,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==l?void 0:l.id_token:void 0,dpopJkt:r,...o},d,i))&&((null==(s=l.profile)?void 0:s.sub)?n.info("success, signed in subject",l.profile.sub):n.info("no subject")),l}async _useRefreshToken(e){let t=await this._client.useRefreshToken({timeoutInSeconds:this.settings.silentRequestTimeoutInSeconds,...e}),s=new J({...e.state,...t});return await this.storeUser(s),await this._events.load(s),s}async signinSilentCallback(e=window.location.href){let t=this._logger.create("signinSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async signinCallback(e=window.location.href){let{state:t}=await this._client.readSigninResponseState(e);switch(t.request_type){case"si:r":return await this.signinRedirectCallback(e);case"si:p":await this.signinPopupCallback(e);break;case"si:s":await this.signinSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async signoutCallback(e=window.location.href,t=!1){let{state:s}=await this._client.readSignoutResponseState(e);if(s)switch(s.request_type){case"so:r":return await this.signoutRedirectCallback(e);case"so:p":await this.signoutPopupCallback(e,t);break;case"so:s":await this.signoutSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async querySessionStatus(e={}){let t=this._logger.create("querySessionStatus"),{silentRequestTimeoutInSeconds:s,...r}=e,i=this.settings.silent_redirect_uri;i||t.throw(Error("No silent_redirect_uri configured"));let n=await this._loadUser(),a=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:s}),o=await this._signinStart({request_type:"si:s",redirect_uri:i,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==n?void 0:n.id_token:void 0,response_type:this.settings.query_status_response_type,scope:"openid",skipUserInfo:!0,...r},a);try{let e=await this._client.processSigninResponse(o.url,{});if(t.debug("got signin response"),e.session_state&&e.profile.sub)return t.info("success for subject",e.profile.sub),{session_state:e.session_state,sub:e.profile.sub};return t.info("success, user not authenticated"),null}catch(e){if(this.settings.monitorAnonymousSession&&e instanceof w)switch(e.error){case"login_required":case"consent_required":case"interaction_required":case"account_selection_required":return t.info("success for anonymous user"),{session_state:e.session_state}}throw e}}async _signin(e,t,s){let r=await this._signinStart(e,t);return await this._signinEnd(r.url,s)}async _signinStart(e,t){let s=this._logger.create("_signinStart");try{let r=await this._client.createSigninRequest(e);return s.debug("got signin request"),await t.navigate({url:r.url,state:r.state.id,response_mode:r.state.response_mode,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw s.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signinEnd(e,t){let s=this._logger.create("_signinEnd"),r=await this._client.processSigninResponse(e,{});return s.debug("got signin response"),await this._buildUser(r,t)}async _buildUser(e,t){let s=this._logger.create("_buildUser"),r=new J(e);if(t){if(t!==r.profile.sub)throw s.debug("current user does not match user returned from signin. sub from signin:",r.profile.sub),new w({...e,error:"login_required"});s.debug("current user matches user returned from signin")}return await this.storeUser(r),s.debug("user stored"),await this._events.load(r),r}async signoutRedirect(e={}){let t=this._logger.create("signoutRedirect"),{redirectMethod:s,...r}=e,i=await this._redirectNavigator.prepare({redirectMethod:s});await this._signoutStart({request_type:"so:r",post_logout_redirect_uri:this.settings.post_logout_redirect_uri,...r},i),t.info("success")}async signoutRedirectCallback(e=window.location.href){let t=this._logger.create("signoutRedirectCallback"),s=await this._signoutEnd(e);return t.info("success"),s}async signoutPopup(e={}){let t=this._logger.create("signoutPopup"),{popupWindowFeatures:s,popupWindowTarget:r,popupSignal:i,...n}=e,a=this.settings.popup_post_logout_redirect_uri,o=await this._popupNavigator.prepare({popupWindowFeatures:s,popupWindowTarget:r,popupSignal:i});await this._signout({request_type:"so:p",post_logout_redirect_uri:a,state:null==a?void 0:{},...n},o),t.info("success")}async signoutPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signoutPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async _signout(e,t){let s=await this._signoutStart(e,t);return await this._signoutEnd(s.url)}async _signoutStart(e={},t){var s;let r=this._logger.create("_signoutStart");try{let i=await this._loadUser();r.debug("loaded current user from storage"),this.settings.revokeTokensOnSignout&&await this._revokeInternal(i);let n=e.id_token_hint||i&&i.id_token;n&&(r.debug("setting id_token_hint in signout request"),e.id_token_hint=n),await this.removeUser(),r.debug("user removed, creating signout request");
1let a=await this._client.createSignoutRequest(e);return r.debug("got signout request"),await t.navigate({url:a.url,state:null==(s=a.state)?void 0:s.id,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw r.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signoutEnd(e){let t=this._logger.create("_signoutEnd"),s=await this._client.processSignoutResponse(e);return t.debug("got signout response"),s}async signoutSilent(e={}){var t;let s=this._logger.create("signoutSilent"),{silentRequestTimeoutInSeconds:r,...i}=e,n=this.settings.includeIdTokenInSilentSignout?null==(t=await this._loadUser())?void 0:t.id_token:void 0,a=this.settings.popup_post_logout_redirect_uri,o=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:r});await this._signout({request_type:"so:s",post_logout_redirect_uri:a,id_token_hint:n,...i},o),s.info("success")}async signoutSilentCallback(e=window.location.href){let t=this._logger.create("signoutSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async revokeTokens(e){let t=await this._loadUser();await this._revokeInternal(t,e)}async _revokeInternal(e,t=this.settings.revokeTokenTypes){let s=this._logger.create("_revokeInternal");if(!e)return;let r=t.filter(t=>"string"==typeof e[t]);if(!r.length)return void s.debug("no need to revoke due to no token(s)");for(let t of r)await this._client.revokeToken(e[t],t),s.info(`${t} revoked successfully`),"access_token"!==t&&(e[t]=null);await this.storeUser(e),s.debug("user stored"),await this._events.load(e)}startSilentRenew(){this._logger.create("startSilentRenew"),this._silentRenewService.start()}stopSilentRenew(){this._silentRenewService.stop()}get _userStoreKey(){return`user:${this.settings.authority}:${this.settings.client_id}`}async _loadUser(){let e=this._logger.create("_loadUser"),t=await this.settings.userStore.get(this._userStoreKey);return t?(e.debug("user storageString loaded"),J.fromStorageString(t)):(e.debug("no user storageString"),null)}async storeUser(e){let t=this._logger.create("storeUser");if(e){t.debug("storing user");let s=e.toStorageString();await this.settings.userStore.set(this._userStoreKey,s)}else this._logger.debug("removing user"),await this.settings.userStore.remove(this._userStoreKey),this.settings.dpop&&await this.settings.dpop.store.remove(this.settings.client_id)}async clearStaleState(){await this._client.clearStaleState()}async dpopProof(e,t,s,r){var i,n;let a=await (null==(n=null==(i=this.settings.dpop)?void 0:i.store)?void 0:n.get(this.settings.client_id));if(a)return await h.generateDPoPProof({url:e,accessToken:null==t?void 0:t.access_token,httpMethod:s,keyPair:a.keys,nonce:r})}async generateDPoPJkt(e){let t=await e.store.get(this.settings.client_id);return t||(t=new $(await h.generateDPoPKeys()),await e.store.set(this.settings.client_id,t)),await h.generateDPoPJkt(t.keys)}}},8246:e=>{e.exports=JSON.parse('{"id":"youtube-embed","description":"Embed a YouTube embed on your webpage.","website":"https://github.com/paulirish/lite-youtube-embed","html":{"element":"lite-youtube","attributes":{"videoid":null,"playlabel":null}},"stylesheets":["https://cdn.jsdelivr.net/gh/paulirish/lite-youtube-embed@master/src/lite-yt-embed.css"],"scripts":[{"url":"https://cdn.jsdelivr.net/gh/paulirish/lite-youtube-embed@master/src/lite-yt-embed.js","strategy":"idle","location":"head","action":"append"}]}')},8321:(e,t,s)=>{s.r(t),s.d(t,{default:()=>i.a});var r=s(1402),i=s.n(r),n={};for(let e in r)"default"!==e&&(n[e]=()=>r[e]);s.d(t,n)},8332:(e,t,s)=>{let r;Object.defineProperty(t,"__esModule",{value:!0}),t.GoogleAnalytics=function(e){let{gaId:t,debugMode:s,dataLayerName:o="dataLayer",nonce:l}=e;return void 0===r&&(r=o),(0,n.useEffect)(()=>{performance.mark("mark_feature_usage",{detail:{feature:"next-third-parties-ga"}})},[]),(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(a.default,{id:"_next-ga-init",dangerouslySetInnerHTML:{__html:"\n window['".concat(o,"'] = window['").concat(o,"'] || [];\n function gtag(){window['").concat(o,"'].push(arguments);}\n gtag('js', new Date());\n\n gtag('config', '").concat(t,"' ").concat(s?",{ 'debug_mode': true }":"",");")},nonce:l}),(0,i.jsx)(a.default,{id:"_next-ga",src:"https://www.googletagmanager.com/gtag/js?i
1d=".concat(t),nonce:l})]})},t.sendGAEvent=function(){for(var e=arguments.length,t=Array(e),s=0;s<e;s++)t[s]=arguments[s];if(void 0===r)return void console.warn("@next/third-parties: GA has not been initialized");window[r]?window[r].push(arguments):console.warn("@next/third-parties: GA dataLayer ".concat(r," does not exist"))};let i=s(5155),n=s(2115),a=function(e){return e&&e.__esModule?e:{default:e}}(s(8321))},9001:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),!function(e,t){for(var s in t)Object.defineProperty(e,s,{enumerable:!0,get:t[s]})}(t,{ESCAPE_REGEX:function(){return r},htmlEscapeAttributeString:function(){return o},htmlEscapeJsonString:function(){return a}});let s={"&":"\\u0026",">":"\\u003e","<":"\\u003c","\u2028":"\\u2028","\u2029":"\\u2029"},r=/[&><\u2028\u2029]/g,i={"&":"&",'"':""","'":"'","<":"<",">":">"},n=/[&"'<>]/g;function a(e){return e.replace(r,e=>s[e])}function o(e){return e.replace(n,e=>i[e])}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.