https://app.nominal.so/_next/static/chunks/1wfblm3ldtak1.js?dpl=dpl_3DMHYDZHmN3Vhn3VGuDYGNbANu71

1;!function(){try { var e="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof global?global:"undefined"!=typeof window?window:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&((e._debugIds|| (e._debugIds={}))[n]="f2f74e79-34dc-c188-deb0-a01db90bd180")}catch(e){}}();
2(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,775547,(e,t,r)=>{"use strict";Object.defineProperty(r,"__esModule",{value:!0}),r.jwtDecode=r.InvalidTokenError=void 0;class i extends Error{}r.InvalidTokenError=i,i.prototype.name="InvalidTokenError",r.jwtDecode=function(e,t){let r;if("string"!=typeof e)throw new i("Invalid token specified: must be a string");t||(t={});let s=+(!0!==t.header),n=e.split(".")[s];if("string"!=typeof n)throw new i(`Invalid token specified: missing part #${s+1}`);try{r=function(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw Error("base64 string is not of the correct length")}try{var r;

2return r=t,decodeURIComponent(atob(r).replace(/(.)/g,(e,t)=>{let r=t.charCodeAt(0).toString(16).toUpperCase();return r.length<2&&(r="0"+r),"%"+r}))}catch(e){return atob(t)}}(n)}catch(e){throw new i(`Invalid token specified: invalid base64 for part #${s+1} (${e.message})`)}try{return JSON.parse(r)}catch(e){throw new i(`Invalid token specified: invalid json for part #${s+1} (${e.message})`)}}},16404,(e,t,r)=>{"use strict";var i,s,n,o,a=Object.defineProperty,l=Object.getOwnPropertyDescriptor,c=Object.getOwnPropertyNames,d=Object.prototype.hasOwnProperty,u={},h={AccessTokenEvents:()=>R,CheckSessionIFrame:()=>x,DPoPState:()=>V,ErrorResponse:()=>E,ErrorTimeout:()=>T,InMemoryWebStorage:()=>C,IndexedDbDPoPStore:()=>eg,Log:()=>_,Logger:()=>f,MetadataService:()=>j,OidcClient:()=>G,OidcClientSettingsStore:()=>N,SessionMonitor:()=>Z,SigninResponse:()=>L,SigninState:()=>H,SignoutResponse:()=>W,State:()=>M,User:()=>X,UserManager:()=>eu,UserManagerSettingsStore:()=>er,Version:()=>eh,WebStorageStateStore:()=>A};for(var g in h)a(u,g,{get:h[g],enumerable:!0});t.exports=((e,t,r,i)=>{if(t&&"object"==typeof t||"function"==typeof t)for(let s of c(t))d.call(e,s)||s===r||a(e,s,{get:()=>t[s],enumerable:!(i=l(t,s))||i.enumerable});return e})(a({},"__esModule",{value:!0}),u);var p={debug:()=>void 0,info:()=>void 0,warn:()=>void 0,error:()=>void 0},_=((i=_||{})[i.NONE=0]="NONE",i[i.ERROR=1]="ERROR",i[i.WARN=2]="WARN",i[i.INFO=3]="INFO",i[i.DEBUG=4]="DEBUG",i);(s=_||(_={})).reset=function(){n=3,o=p},s.setLevel=function(e){if(!(0<=e&&e<=4))throw Error("Invalid log level");n=e},s.setLogger=function(e){o=e};var f=class e{constructor(e){this._name=e}debug(...t){n>=4&&o.debug(e._format(this._name,this._method),...t)}info(...t){n>=3&&o.info(e._format(this._name,this._method),...t)}warn(...t){n>=2&&o.warn(e._format(this._name,this._method),...t)}error(...t){n>=1&&o.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){let t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,r){let i=new e(`${t}.${r}`);return i.debug("begin"),i}static _format(e,t){let r=`[${e}]`;return t?`${r} ${t}:`:r}static debug(t,...r){n>=4&&o.debug(e._format(t),...r)}static info(t,...r){n>=3&&o.info(e._format(t),...r)}static warn(t,...r){n>=2&&o.warn(e._format(t),...r)}static error(t,...r){n>=1&&o.error(e._format(t),...r)}};_.reset();var w=e.r(775547),m=class{static decode(e){try{return(0,w.jwtDecode)(e)}catch(e){throw f.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,r){let i=b.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),s=b.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${s}`,o=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},r,new TextEncoder().encode(n)),a=b.encodeBase64Url(new Uint8Array(o));return`${n}.${a}`}static async generateSignedJwtWithHmac(e,t,r){let i=b.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),s=b.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${s}`,o=await window.crypto.subtle.sign("HMAC",r,new TextEncoder().encode(n)),a=b.encodeBase64Url(new Uint8Array(o));return`${n}.${a}`}},v=e=>btoa([...new Uint8Array(e)].map(e=>String.fromCharCode(e)).join("")),y=class e{static _randomWord(){let e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,t=>(t^e._randomWord()&15>>t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{let t=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",t);return v(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw f.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){return v(new TextEncoder().encode([e,t].join(":")))}static async hash(e,t){let r=new TextEncoder().encode(t);return new Uint8Array(await crypto.subtle.digest(e,r))}static async customCalculateJwkThumbprint(t){let r;switch(t.kty){case"RSA":r={e:t.e,kty:t.kty,n:t.n};break;case"EC":r={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":r={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":r={crv:t.k,kty:t.kty};break;default:throw Error("Unknown jwk type")}let i=await e.hash("SHA-256",JSON.stringify(r));return e.encodeBase64Url(i)}static async generateDPoPProof({url:t,accessToken:r,httpMethod:i,keyPair:s,nonce:n}){let o,a={jti:window.crypto.randomUUID(),htm:null!=i?i:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};r&&(o=await e.hash("SHA-256",r),a.ath=e.encodeBase64Url(o)),n&&(a.nonce=n);try{let e=await crypto.subtle.exportKey("jwk",s.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await m.generateSignedJwt(t,a,s.privateKey)}catch(e){if(e instanceof TypeError)throw Error(`Error exporting dpop public key: ${e.message}`);throw e}}static async generateDPoPJkt(t){try{let r=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(r)}catch(e){if(e instanceof TypeError)throw Error(`Could not retrieve dpop keys from storage: ${e.message}`);throw e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,r,i,s="HS256"){let n=Math.floor(Date.now()/1e3),o={iss:t,sub:t,aud:i,jti:e.generateUUIDv4(),exp:n+300,iat:n},a={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[s];if(!a)throw Error(`Unsupported algorithm: ${s}. Supported algorithms are: HS256, HS384, HS512`);let l=new TextEncoder,c=await crypto.subtle.importKey("raw",l.encode(r),{name:"HMAC",hash:a},!1,["sign"]);return await m.generateSignedJwtWithHmac({alg:s,typ:"JWT"},o,c)}};y.encodeBase64Url=e=>v(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var b=y,k=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new f(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){let t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}

2async raise(...e){for(let t of(this._logger.debug("raise:",...e),this._callbacks))await t(...e)}},S=class{static center({...e}){var t;return null==e.width&&(e.width=null!=(t=[800,720,600,480].find(e=>e<=window.outerWidth/1.618))?t:360),null!=e.left||(e.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-e.width)/2))),null!=e.height&&(null!=e.top||(e.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-e.height)/2)))),e}static serialize(e){return Object.entries(e).filter(([,e])=>null!=e).map(([e,t])=>`${e}=${"boolean"!=typeof t?t:t?"yes":"no"}`).join(",")}},I=class e extends k{constructor(){super(...arguments),this._logger=new f(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{let t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){let r=this._logger.create("init");t=Math.max(Math.floor(t),1);let i=e.getEpochTime()+t;if(this.expiration===i&&this._timerHandle)return void r.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),r.debug("using duration",t),this._expiration=i;let s=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*s)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},O=class{static readParams(e,t="query"){if(!e)throw TypeError("Invalid URL");return new URLSearchParams(new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"].slice(1))}},E=class extends Error{constructor(e,t){var r,i,s;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw f.error("ErrorResponse","No error passed"),Error("No error passed");this.error=e.error,this.error_description=null!=(r=e.error_description)?r:null,this.error_uri=null!=(i=e.error_uri)?i:null,this.state=e.userState,this.session_state=null!=(s=e.session_state)?s:null,this.url_state=e.url_state}},T=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},R=class{constructor(e){this._logger=new f("AccessTokenEvents"),this._expiringTimer=new I("Access token expiring"),this._expiredTimer=new I("Access token expired"),this._expiringNotificationTimeInSeconds=e.expiringNotificationTimeInSeconds}async load(e){let t=this._logger.create("load");if(e.access_token&&void 0!==e.expires_in){let r=e.expires_in;if(t.debug("access token present, remaining duration:",r),r>0){let e=r-this._expiringNotificationTimeInSeconds;e<=0&&(e=1),t.debug("registering expiring timer, raising in",e,"seconds"),this._expiringTimer.init(e)}else t.debug("canceling existing expiring timer because we're past expiration."),this._expiringTimer.cancel();let i=r+1;t.debug("registering expired timer, raising in",i,"seconds"),this._expiredTimer.init(i)}else this._expiringTimer.cancel(),this._expiredTimer.cancel()}async unload(){this._logger.debug("unload: canceling existing access token timers"),this._expiringTimer.cancel(),this._expiredTimer.cancel()}addAccessTokenExpiring(e){return this._expiringTimer.addHandler(e)}removeAccessTokenExpiring(e){this._expiringTimer.removeHandler(e)}addAccessTokenExpired(e){return this._expiredTimer.addHandler(e)}removeAccessTokenExpired(e){this._expiredTimer.removeHandler(e)}},x=class{constructor(e,t,r,i,s){this._callback=e,this._client_id=t,this._intervalInSeconds=i,this._stopOnError=s,this._logger=new f("CheckSessionIFrame"),this._timer=null,this._session_state=null,this._message=e=>{e.origin===this._frame_origin&&e.source===this._frame.contentWindow&&("error"===e.data?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):"changed"===e.data?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(e.data+" message from check session op iframe"))};const n=new URL(r);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(e=>{this._frame.onload=()=>{e()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(e){if(this._session_state===e)return;this._logger.create("start"),this.stop(),this._session_state=e;let t=()=>{this._frame.contentWindow&&this._session_state&&this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};t(),this._timer=setInterval(t,1e3*this._intervalInSeconds)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}},C=class{constructor(){this._logger=new f("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}}

2,U=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},P=class{constructor(e=[],t=null,r={}){this._jwtHandler=t,this._extraHeaders=r,this._logger=new f("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){let{timeoutInSeconds:r,...i}=t;if(!r)return await fetch(e,i);let s=new AbortController,n=setTimeout(()=>s.abort(),1e3*r);try{return await fetch(e,{...t,signal:s.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new T("Network timed out");throw e}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:r,timeoutInSeconds:i}={}){let s,n,o=this._logger.create("getJson"),a={Accept:this._contentTypes.join(", ")};t&&(o.debug("token passed, setting Authorization header"),a.Authorization="Bearer "+t),this._appendExtraHeaders(a);try{o.debug("url:",e),s=await this.fetchWithTimeout(e,{method:"GET",headers:a,timeoutInSeconds:i,credentials:r})}catch(e){throw o.error("Network Error"),e}o.debug("HTTP response received, status",s.status);let l=s.headers.get("Content-Type");if(l&&!this._contentTypes.find(e=>l.startsWith(e))&&o.throw(Error(`Invalid response Content-Type: ${null!=l?l:"undefined"}, from URL: ${e}`)),s.ok&&this._jwtHandler&&(null==l?void 0:l.startsWith("application/jwt")))return await this._jwtHandler(await s.text());try{n=await s.json()}catch(e){if(o.error("Error parsing JSON response",e),s.ok)throw e;throw Error(`${s.statusText} (${s.status})`)}if(!s.ok){if(o.error("Error from server:",n),n.error)throw new E(n);throw Error(`${s.statusText} (${s.status}): ${JSON.stringify(n)}`)}return n}async postForm(e,{body:t,basicAuth:r,timeoutInSeconds:i,initCredentials:s,extraHeaders:n}){let o,a=this._logger.create("postForm"),l={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...n};void 0!==r&&(l.Authorization="Basic "+r),this._appendExtraHeaders(l);try{a.debug("url:",e),o=await this.fetchWithTimeout(e,{method:"POST",headers:l,body:t,timeoutInSeconds:i,credentials:s})}catch(e){throw a.error("Network error"),e}a.debug("HTTP response received, status",o.status);let c=o.headers.get("Content-Type");if(c&&!this._contentTypes.find(e=>c.startsWith(e)))throw Error(`Invalid response Content-Type: ${null!=c?c:"undefined"}, from URL: ${e}`);let d=await o.text(),u={};if(d)try{u=JSON.parse(d)}catch(e){if(a.error("Error parsing JSON response",e),o.ok)throw e;throw Error(`${o.statusText} (${o.status})`)}if(!o.ok){if(a.error("Error from server:",u),o.headers.has("dpop-nonce"))throw new U(o.headers.get("dpop-nonce"),`${JSON.stringify(u)}`);if(u.error)throw new E(u,t);throw Error(`${o.statusText} (${o.status}): ${JSON.stringify(u)}`)}return u}_appendExtraHeaders(e){let t=this._logger.create("appendExtraHeaders"),r=Object.keys(this._extraHeaders),i=["accept","content-type"],s=["authorization"];0!==r.length&&r.forEach(r=>{if(i.includes(r.toLocaleLowerCase()))return void t.warn("Protected header could not be set",r,i);if(s.includes(r.toLocaleLowerCase())&&Object.keys(e).includes(r))return void t.warn("Header could not be overridden",r,s);let n="function"==typeof this._extraHeaders[r]?this._extraHeaders[r]():this._extraHeaders[r];n&&""!==n&&(e[r]=n)})}},j=class{constructor(e){this._settings=e,this._logger=new f("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new P(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){let e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);let t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){let r=this._logger.create(`_getMetadataProperty('${e}')`),i=await this.getMetadata();if(r.debug("resolved"),void 0===i[e]){if(!0===t)return void r.warn("Metadata does not contain optional property");r.throw(Error("Metadata does not contain property "+e))}return i[e]}async getSigningKeys(){let e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;let t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);let r=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",r),!Array.isArray(r.keys))throw e.throw(Error("Missing keys on keyset")),null;return this._signingKeys=r.keys,this._signingKeys}},A=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new f("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){return this._logger.create(`get('${e}')`),e=this._prefix+e,await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;let t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");let e=await this._store.length,t=[];for(let r=0;r<e;r++){let e=await this._store.key(r);

2e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},N=class{constructor({authority:e,metadataUrl:t,metadata:r,signingKeys:i,metadataSeed:s,client_id:n,client_secret:o,response_type:a="code",scope:l="openid",redirect_uri:c,post_logout_redirect_uri:d,client_authentication:u="client_secret_post",token_endpoint_auth_signing_alg:h="HS256",prompt:g,display:p,max_age:_,ui_locales:f,acr_values:w,resource:m,response_mode:v,filterProtocolClaims:y=!0,loadUserInfo:b=!1,requestTimeoutInSeconds:k,staleStateAgeInSeconds:S=900,mergeClaimsStrategy:I={array:"replace"},disablePKCE:O=!1,stateStore:E,revokeTokenAdditionalContentTypes:T,fetchRequestCredentials:R,refreshTokenAllowedScope:x,extraQueryParams:U={},extraTokenParams:P={},extraHeaders:j={},dpop:N,omitScopeWhenRequesting:D=!1}){var q;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=r,this.metadataSeed=s,this.signingKeys=i,this.client_id=n,this.client_secret=o,this.response_type=a,this.scope=l,this.redirect_uri=c,this.post_logout_redirect_uri=d,this.client_authentication=u,this.token_endpoint_auth_signing_alg=h,this.prompt=g,this.display=p,this.max_age=_,this.ui_locales=f,this.acr_values=w,this.resource=m,this.response_mode=v,this.filterProtocolClaims=null==y||y,this.loadUserInfo=!!b,this.staleStateAgeInSeconds=S,this.mergeClaimsStrategy=I,this.omitScopeWhenRequesting=D,this.disablePKCE=!!O,this.revokeTokenAdditionalContentTypes=T,this.fetchRequestCredentials=R||"same-origin",this.requestTimeoutInSeconds=k,E)this.stateStore=E;else{const e="u">typeof window?window.localStorage:new C;this.stateStore=new A({store:e})}if(this.refreshTokenAllowedScope=x,this.extraQueryParams=U,this.extraTokenParams=P,this.extraHeaders=j,this.dpop=N,this.dpop&&!(null==(q=this.dpop)?void 0:q.store))throw Error("A DPoPStore is required when dpop is enabled")}},D=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new f("UserInfoService"),this._getClaimsFromJwt=async e=>{let t=this._logger.create("_getClaimsFromJwt");try{let r=m.decode(e);return t.debug("JWT decoding successful"),r}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new P(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){let t=this._logger.create("getClaims");e||this._logger.throw(Error("No token passed"));let r=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",r);let i=await this._jsonService.getJson(r,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",i),i}},q=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new f("TokenClient"),this._jsonService=new P(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:r=this._settings.client_id,client_secret:i=this._settings.client_secret,extraHeaders:s,...n}){let o,a=this._logger.create("exchangeCode");r||a.throw(Error("A client_id is required")),t||a.throw(Error("A redirect_uri is required")),n.code||a.throw(Error("A code is required"));let l=new URLSearchParams({grant_type:e,redirect_uri:t});for(let[e,t]of Object.entries(n))null!=t&&l.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==i)throw a.throw(Error("A client_secret is required")),null;let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":o=b.generateBasicAuth(r,i);break;case"client_secret_post":l.append("client_id",r),i&&l.append("client_secret",i);break;case"client_secret_jwt":{let e=await b.generateClientAssertionJwt(r,i,c,this._settings.token_endpoint_auth_signing_alg);l.append("client_id",r),l.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),l.append("client_assertion",e)}}a.debug("got token endpoint");let d=await this._jsonService.postForm(c,{body:l,basicAuth:o,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:s});return a.debug("got response"),d}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,scope:i=this._settings.scope,...s}){let n,o=this._logger.create("exchangeCredentials");t||o.throw(Error("A client_id is required"));let a=new URLSearchParams({grant_type:e});for(let[e,t]of(this._settings.omitScopeWhenRequesting||a.set("scope",i),Object.entries(s)))null!=t&&a.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw o.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":n=b.generateBasicAuth(t,r);break;case"client_secret_post":a.append("client_id",t),r&&a.append("client_secret",r);break;case"client_secret_jwt":{let e=await b.generateClientAssertionJwt(t,r,l,this._settings.token_endpoint_auth_signing_alg);a.append("client_id",t),a.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),a.append("client_assertion",e)}}o.debug("got token endpoint");let c=await this._jsonService.postForm(l,{body:a,basicAuth:n,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return o.debug("got response"),c}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,timeoutInSeconds:i,extraHeaders:s,...n}){let o,a=this._logger.create("exchangeRefreshToken");t||a.throw(Error("A client_id is required")),n.refresh_token||a.throw(Error("A refresh_token is required"));let l=new URLSearchParams({grant_type:e});for(let[e,t]of Object.entries(n))Array.isArray(t)?t.forEach(t=>l.append(e,t)):null!=t&&l.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==r)throw a.throw(Error("A client_secret is required")),null;

2let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":o=b.generateBasicAuth(t,r);break;case"client_secret_post":l.append("client_id",t),r&&l.append("client_secret",r);break;case"client_secret_jwt":{let e=await b.generateClientAssertionJwt(t,r,c,this._settings.token_endpoint_auth_signing_alg);l.append("client_id",t),l.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),l.append("client_assertion",e)}}a.debug("got token endpoint");let d=await this._jsonService.postForm(c,{body:l,basicAuth:o,timeoutInSeconds:i,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:s});return a.debug("got response"),d}async revoke(e){var t;let r=this._logger.create("revoke");e.token||r.throw(Error("A token is required"));let i=await this._metadataService.getRevocationEndpoint(!1);r.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);let s=new URLSearchParams;for(let[t,r]of Object.entries(e))null!=r&&s.set(t,r);s.set("client_id",this._settings.client_id),this._settings.client_secret&&s.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(i,{body:s,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),r.debug("got response")}},$=class{constructor(e,t,r){this._settings=e,this._metadataService=t,this._claimsService=r,this._logger=new f("ResponseValidator"),this._userInfoService=new D(this._settings,this._metadataService),this._tokenClient=new q(this._settings,this._metadataService)}async validateSigninResponse(e,t,r){let i=this._logger.create("validateSigninResponse");this._processSigninState(e,t),i.debug("state processed"),await this._processCode(e,t,r),i.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),i.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),i.debug("claims processed")}async validateCredentialsResponse(e,t){let r=this._logger.create("validateCredentialsResponse"),i=e.isOpenId&&!!e.id_token;i&&this._validateIdTokenAttributes(e),r.debug("tokens validated"),await this._processClaims(e,t,i),r.debug("claims processed")}async validateRefreshResponse(e,t){let r=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),r.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);let i=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,i),r.debug("claims processed")}validateSignoutResponse(e,t){let r=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&r.throw(Error("State does not match")),r.debug("state validated"),e.userState=t.data,e.error)throw r.warn("Response was error",e.error),new E(e)}_processSigninState(e,t){let r=this._logger.create("_processSigninState");if(t.id!==e.state&&r.throw(Error("State does not match")),t.client_id||r.throw(Error("No client_id on state")),t.authority||r.throw(Error("No authority on state")),this._settings.authority!==t.authority&&r.throw(Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&r.throw(Error("client_id mismatch on settings vs. signin state")),r.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw r.warn("Response was error",e.error),new E(e);t.code_verifier&&!e.code&&r.throw(Error("Expected code in response"))}async _processClaims(e,t=!1,r=!0){let i=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void i.debug("not loading user info");i.debug("loading user info");let s=await this._userInfoService.getClaims(e.access_token);i.debug("user info claims received from user info endpoint"),r&&s.sub!==e.profile.sub&&i.throw(Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(s)),i.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,r){let i=this._logger.create("_processCode");if(e.code){i.debug("Validating code");let s=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:r,...t.extraTokenParams});Object.assign(e,s)}else i.debug("No code to process")}_validateIdTokenAttributes(e,t,r){var i;let s=this._logger.create("_validateIdTokenAttributes");s.debug("decoding ID Token JWT");let n=m.decode(null!=(i=e.id_token)?i:"");if(n.sub||s.throw(Error("ID Token is missing a subject claim")),r&&n.nonce!==r&&s.throw(Error("nonce in id_token does not match nonce in client storage")),t){let e=m.decode(t);n.sub!==e.sub&&s.throw(Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==e.auth_time&&s.throw(Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==e.azp&&s.throw(Error("azp in id_token does not match original azp")),!n.azp&&e.azp&&s.throw(Error("azp not in id_token, but present in original id_token"))}e.profile=n}},M=class e{constructor(e){this.id=e.id||b.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=I.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new f("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return f.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,r){let i=f.createStatic("State","clearStaleState"),s=I.getEpochTime()-r,n=await t.getAllKeys();i.debug("got keys",n);for(let r=0;r<n.length;r++){let o=n[r],a=await t.get(o),l=!1;if(a)try{let t=await e.fromStorageString(a);i.debug("got item from key:",o,t.created),t.created<=s&&(l=!0)}catch(e){i.error("Error parsing state for key:",o,e),l=!0}else i.debug("no item in storage for key:",o),l=!0;l&&(i.debug("removed item for key:",o),t.remove(o))}}},H=class e extends M{constructor(e){super(e),this.code_verifier=e.code_verifier,this.co

2de_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){let r=!0===t.code_verifier?b.generateCodeVerifier():t.code_verifier||void 0,i=r?await b.generateCodeChallenge(r):void 0;return new e({...t,code_verifier:r,code_challenge:i})}toStorageString(){return new f("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){f.createStatic("SigninState","fromStorageString");let r=JSON.parse(t);return e.create(r)}},J=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:r,client_id:i,redirect_uri:s,response_type:n,scope:o,state_data:a,response_mode:l,request_type:c,client_secret:d,nonce:u,url_state:h,resource:g,skipUserInfo:p,extraQueryParams:_,extraTokenParams:f,disablePKCE:w,dpopJkt:m,omitScopeWhenRequesting:v,...y}){if(!t)throw this._logger.error("create: No url passed"),Error("url");if(!i)throw this._logger.error("create: No client_id passed"),Error("client_id");if(!s)throw this._logger.error("create: No redirect_uri passed"),Error("redirect_uri");if(!n)throw this._logger.error("create: No response_type passed"),Error("response_type");if(!o)throw this._logger.error("create: No scope passed"),Error("scope");if(!r)throw this._logger.error("create: No authority passed"),Error("authority");let b=await H.create({data:a,request_type:c,url_state:h,code_verifier:!w,client_id:i,authority:r,redirect_uri:s,response_mode:l,client_secret:d,scope:o,extraTokenParams:f,skipUserInfo:p,nonce:u}),k=new URL(t);k.searchParams.append("client_id",i),k.searchParams.append("redirect_uri",s),k.searchParams.append("response_type",n),v||k.searchParams.append("scope",o),u&&k.searchParams.append("nonce",u),m&&k.searchParams.append("dpop_jkt",m);let S=b.id;for(let[e,t]of(h&&(S=`${S};${h}`),k.searchParams.append("state",S),b.code_challenge&&(k.searchParams.append("code_challenge",b.code_challenge),k.searchParams.append("code_challenge_method","S256")),g&&(Array.isArray(g)?g:[g]).forEach(e=>k.searchParams.append("resource",e)),Object.entries({response_mode:l,...y,..._})))null!=t&&k.searchParams.append(e,t.toString());return new e({url:k.href,state:b})}};J._logger=new f("SigninRequest");var L=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-I.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+I.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},K=class{constructor({url:e,state_data:t,id_token_hint:r,post_logout_redirect_uri:i,extraQueryParams:s,request_type:n,client_id:o,url_state:a}){if(this._logger=new f("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),Error("url");const l=new URL(e);if(r&&l.searchParams.append("id_token_hint",r),o&&l.searchParams.append("client_id",o),i&&(l.searchParams.append("post_logout_redirect_uri",i),t||a)){this.state=new M({data:t,request_type:n,url_state:a});let e=this.state.id;a&&(e=`${e};${a}`),l.searchParams.append("state",e)}for(const[e,t]of Object.entries({...s}))null!=t&&l.searchParams.append(e,t.toString());this.url=l.href}},W=class{constructor(e){if(this.state=e.get("state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},F=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],B=["sub","iss","aud","exp","iat"],z=class{constructor(e){this._settings=e,this._logger=new f("ClaimsService")}filterProtocolClaims(e){let t={...e};if(this._settings.filterProtocolClaims){for(let e of Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:F)B.includes(e)||delete t[e]}return t}mergeClaims(e,t){let r={...e};for(let[e,i]of Object.entries(t))if(r[e]!==i)if(Array.isArray(r[e])||Array.isArray(i))if("replace"==this._settings.mergeClaimsStrategy.array)r[e]=i;else{let t=Array.isArray(r[e])?r[e]:[r[e]];for(let e of Array.isArray(i)?i:[i])t.includes(e)||t.push(e);r[e]=t}else"object"==typeof r[e]&&"object"==typeof i?r[e]=this.mergeClaims(r[e],i):r[e]=i;return r}},V=class{constructor(e,t){this.keys=e,this.nonce=t}},G=class{constructor(e,t){this._logger=new f("OidcClient"),this.settings=e instanceof N?e:new N(e),this.metadataService=null!=t?t:new j(this.settings),this._claimsService=new z(this.settings),this._val

2idator=new $(this.settings,this.metadataService,this._claimsService),this._tokenClient=new q(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:r,request_type:i,id_token_hint:s,login_hint:n,skipUserInfo:o,nonce:a,url_state:l,response_type:c=this.settings.response_type,scope:d=this.settings.scope,redirect_uri:u=this.settings.redirect_uri,prompt:h=this.settings.prompt,display:g=this.settings.display,max_age:p=this.settings.max_age,ui_locales:_=this.settings.ui_locales,acr_values:f=this.settings.acr_values,resource:w=this.settings.resource,response_mode:m=this.settings.response_mode,extraQueryParams:v=this.settings.extraQueryParams,extraTokenParams:y=this.settings.extraTokenParams,dpopJkt:b,omitScopeWhenRequesting:k=this.settings.omitScopeWhenRequesting}){let S=this._logger.create("createSigninRequest");if("code"!==c)throw Error("Only the Authorization Code flow (with PKCE) is supported");let I=await this.metadataService.getAuthorizationEndpoint();S.debug("Received authorization endpoint",I);let O=await J.create({url:I,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:u,response_type:c,scope:d,state_data:e,url_state:l,prompt:h,display:g,max_age:p,ui_locales:_,id_token_hint:s,login_hint:n,acr_values:f,dpopJkt:b,resource:w,request:t,request_uri:r,extraQueryParams:v,extraTokenParams:y,request_type:i,response_mode:m,client_secret:this.settings.client_secret,skipUserInfo:o,nonce:a,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:k});await this.clearStaleState();let E=O.state;return await this.settings.stateStore.set(E.id,E.toStorageString()),O}async readSigninResponseState(e,t=!1){let r=this._logger.create("readSigninResponseState"),i=new L(O.readParams(e,this.settings.response_mode));if(!i.state)throw r.throw(Error("No state in response")),null;let s=await this.settings.stateStore[t?"remove":"get"](i.state);if(!s)throw r.throw(Error("No matching state found in storage")),null;return{state:await H.fromStorageString(s),response:i}}async processSigninResponse(e,t,r=!0){let i=this._logger.create("processSigninResponse"),{state:s,response:n}=await this.readSigninResponseState(e,r);if(i.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}try{await this._validator.validateSigninResponse(n,s,t)}catch(e){if(e instanceof U&&this.settings.dpop){let r=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=r,await this._validator.validateSigninResponse(n,s,t)}else throw e}return n}async getDpopProof(e,t){let r;return(await e.getAllKeys()).includes(this.settings.client_id)?(r=await e.get(this.settings.client_id)).nonce!==t&&t&&(r.nonce=t,await e.set(this.settings.client_id,r)):(r=new V(await b.generateDPoPKeys(),t),await e.set(this.settings.client_id,r)),await b.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:r.keys,nonce:r.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:r=!1,extraTokenParams:i={}}){let s=await this._tokenClient.exchangeCredentials({username:e,password:t,...i}),n=new L(new URLSearchParams);return Object.assign(n,s),await this._validator.validateCredentialsResponse(n,r),n}async useRefreshToken({state:e,redirect_uri:t,resource:r,timeoutInSeconds:i,extraHeaders:s,extraTokenParams:n}){var o;let a,l,c=this._logger.create("useRefreshToken");if(void 0===this.settings.refreshTokenAllowedScope)a=e.scope;else{let t=this.settings.refreshTokenAllowedScope.split(" ");a=((null==(o=e.scope)?void 0:o.split(" "))||[]).filter(e=>t.includes(e)).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);s={...s,DPoP:e}}try{l=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:a,redirect_uri:t,resource:r,timeoutInSeconds:i,extraHeaders:s,...n})}catch(o){if(o instanceof U&&this.settings.dpop)s.DPoP=await this.getDpopProof(this.settings.dpop.store,o.nonce),l=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:a,redirect_uri:t,resource:r,timeoutInSeconds:i,extraHeaders:s,...n});else throw o}let d=new L(new URLSearchParams);return Object.assign(d,l),c.debug("validating response",d),await this._val

2idator.validateRefreshResponse(d,{...e,scope:a}),d}async createSignoutRequest({state:e,id_token_hint:t,client_id:r,request_type:i,url_state:s,post_logout_redirect_uri:n=this.settings.post_logout_redirect_uri,extraQueryParams:o=this.settings.extraQueryParams}={}){let a=this._logger.create("createSignoutRequest"),l=await this.metadataService.getEndSessionEndpoint();if(!l)throw a.throw(Error("No end session endpoint")),null;a.debug("Received end session endpoint",l),r||!n||t||(r=this.settings.client_id);let c=new K({url:l,id_token_hint:t,client_id:r,post_logout_redirect_uri:n,state_data:e,extraQueryParams:o,request_type:i,url_state:s});await this.clearStaleState();let d=c.state;return d&&(a.debug("Signout request has state to persist"),await this.settings.stateStore.set(d.id,d.toStorageString())),c}async readSignoutResponseState(e,t=!1){let r=this._logger.create("readSignoutResponseState"),i=new W(O.readParams(e,this.settings.response_mode));if(!i.state){if(r.debug("No state in response"),i.error)throw r.warn("Response was error:",i.error),new E(i);return{state:void 0,response:i}}let s=await this.settings.stateStore[t?"remove":"get"](i.state);if(!s)throw r.throw(Error("No matching state found in storage")),null;return{state:await M.fromStorageString(s),response:i}}async processSignoutResponse(e){let t=this._logger.create("processSignoutResponse"),{state:r,response:i}=await this.readSignoutResponseState(e,!0);return r?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(i,r)):t.debug("No state from storage; skipping response validation"),i}clearStaleState(){return this._logger.create("clearStaleState"),M.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}},Z=class{constructor(e){this._userManager=e,this._logger=new f("SessionMonitor"),this._start=async e=>{let t=e.session_state;if(!t)return;let r=this._logger.create("_start");if(e.profile?(this._sub=e.profile.sub,r.debug("session_state",t,", sub",this._sub)):(this._sub=void 0,r.debug("session_state",t,", anonymous user")),this._checkSessionIFrame)return void this._checkSessionIFrame.start(t);try{let e=await this._userManager.metadataService.getCheckSessionIframe();if(e){r.debug("initializing check session iframe");let i=this._userManager.settings.client_id,s=this._userManager.settings.checkSessionIntervalInSeconds,n=this._userManager.settings.stopCheckSessionOnError,o=new x(this._callback,i,e,s,n);await o.load(),this._checkSessionIFrame=o,o.start(t)}else r.warn("no check session iframe found in the metadata")}catch(e){r.error("Error from getCheckSessionIframe:",e instanceof Error?e.message:e)}},this._stop=()=>{let e=this._logger.create("_stop");if(this._sub=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){let t=setInterval(async()=>{clearInterval(t);try{let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}catch(t){e.error("error from querySessionStatus",t instanceof Error?t.message:t)}},1e3)}},this._callback=async()=>{let e=this._logger.create("_callback");try{let t=await this._userManager.querySessionStatus(),r=!0;t&&this._checkSessionIFrame?t.sub===this._sub?(r=!1,this._checkSessionIFrame.start(t.session_state),e.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",t.session_state),await this._userManager.events._raiseUserSessionChanged()):e.debug("different subject signed into OP",t.sub):e.debug("subject no longer signed into OP"),r?this._sub?await this._userManager.events._raiseUserSignedOut():await this._userManager.events._raiseUserSignedIn():e.debug("no change in session detected, no event to raise")}catch(t){this._sub&&(e.debug("Error calling queryCurrentSigninSession; raising signed out event",t),await this._userManager.events._raiseUserSignedOut())}},e||this._logger.throw(Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(e=>{this._logger.error(e)})}async _init(){this._logger.create("_init");let e=await this._userManager.getUser();if(e)this._start(e);else if(this._userManager.settings.monitorAnonymousSession){let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}}},X=class e{constructor(e){var t;this.id_token=e.id_token,this.session_state=null!=(t=e.session_state)?t:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState,this.url_state=e.url_state}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-I.getEpochTime()}set expires_in(e){void 0!==e&&(this.expires_at=Math.floor(e)+I.getEpochTime())}get expired(){let e=this.expires_in;if(void 0!==e)return e<=0}get scopes(){var e,t;return null!=(t=null==(e=this.scope)?void 0:e.split(" "))?t:[]}toStorageString(){return new f("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(t){return f.createStatic("User","fromStorageString"),new e(JSON.parse(t))}},Q="oidc-client",Y=class{constructor(){this._abort=new k("Window navigation aborted"),this._disposeHandlers=new Set,this._window=null}async navigate(e){let t=this._logger.create("navigate");if(!this._window)throw Error("Attempted to navigate on a disposed window");t.debug("setting URL in window"),this._window.location.replace(e.url);let{url:r,keepOpen:i}=await new Promise((r,i)=>{let s=s=>{var n;let o=s.data,a=null!=(n=e.scriptOrigin)?n:window.location.origin;if(s.origin===a&&(null==o?void 0:o.source)===Q){try{let r=O.readParams(o.url,e.response_mode).get("state");if(r||t.warn("no state found in response url"),s.source!==this._window&&r!==e.state)return}catch{this._dispose(),i(Error("Invalid response from window"))}r(o)}};window.addEventListener("message",s,!1),this._disposeHandlers.add(()=>window.removeEventListener("message",s,!1));let n=new BroadcastChannel(`oidc-client-popup-${e.state}`);n.addEventListener("message",s,!1),this._disposeHandlers.add(()=>n.close()),this._disposeHandlers.add(this._abort.addHandler(e=>{this._dispose(),i(e)}))});return t.debug("got response from window"),this._dispose(),i||this.close(),{url:r}}_dispose(){for(let e of(this._logger.create("_dispose"),this._disposeHandlers))e();this._disposeHandlers.clear()}static _notifyParent(e,t,r=!1,i=window.location.origin){let s={source:Q,url:t,keepOpen:r},n=new f("_notifyParent");

2if(e)n.debug("With parent. Using parent.postMessage."),e.postMessage(s,i);else{n.debug("No parent. Using BroadcastChannel.");let e=new URL(t).searchParams.get("state");if(!e)throw Error("No parent and no state in URL. Can't complete notification.");let r=new BroadcastChannel(`oidc-client-popup-${e}`);r.postMessage(s),r.close()}}},ee={location:!1,toolbar:!1,height:640,closePopupWindowAfterInSeconds:-1},et="_blank",er=class extends N{constructor(e){const{popup_redirect_uri:t=e.redirect_uri,popup_post_logout_redirect_uri:r=e.post_logout_redirect_uri,popupWindowFeatures:i=ee,popupWindowTarget:s=et,redirectMethod:n="assign",redirectTarget:o="self",iframeNotifyParentOrigin:a=e.iframeNotifyParentOrigin,iframeScriptOrigin:l=e.iframeScriptOrigin,requestTimeoutInSeconds:c,silent_redirect_uri:d=e.redirect_uri,silentRequestTimeoutInSeconds:u,automaticSilentRenew:h=!0,validateSubOnSilentRenew:g=!0,includeIdTokenInSilentRenew:p=!1,monitorSession:_=!1,monitorAnonymousSession:f=!1,checkSessionIntervalInSeconds:w=2,query_status_response_type:m="code",stopCheckSessionOnError:v=!0,revokeTokenTypes:y=["access_token","refresh_token"],revokeTokensOnSignout:b=!1,includeIdTokenInSilentSignout:k=!1,accessTokenExpiringNotificationTimeInSeconds:S=60,maxSilentRenewTimeoutRetries:I,userStore:O}=e;if(super(e),this.popup_redirect_uri=t,this.popup_post_logout_redirect_uri=r,this.popupWindowFeatures=i,this.popupWindowTarget=s,this.redirectMethod=n,this.redirectTarget=o,this.iframeNotifyParentOrigin=a,this.iframeScriptOrigin=l,this.silent_redirect_uri=d,this.silentRequestTimeoutInSeconds=u||c||10,this.automaticSilentRenew=h,this.validateSubOnSilentRenew=g,this.includeIdTokenInSilentRenew=p,this.monitorSession=_,this.monitorAnonymousSession=f,this.checkSessionIntervalInSeconds=w,this.stopCheckSessionOnError=v,this.query_status_response_type=m,this.revokeTokenTypes=y,this.revokeTokensOnSignout=b,this.includeIdTokenInSilentSignout=k,this.accessTokenExpiringNotificationTimeInSeconds=S,this.maxSilentRenewTimeoutRetries=I,O)this.userStore=O;else{const e="u">typeof window?window.sessionStorage:new C;this.userStore=new A({store:e})}}},ei=class e extends Y{constructor({silentRequestTimeoutInSeconds:t=10}){super(),this._logger=new f("IFrameWindow"),this._timeoutInSeconds=t,this._frame=e.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){let e=window.document.createElement("iframe");return e.style.visibility="hidden",e.style.position="fixed",e.style.left="-1000px",e.style.top="0",e.width="0",e.height="0",window.document.body.appendChild(e),e}async navigate(e){this._logger.debug("navigate: Using timeout of:",this._timeoutInSeconds);let t=setTimeout(()=>void this._abort.raise(new T("IFrame timed out without a response")),1e3*this._timeoutInSeconds);return this._disposeHandlers.add(()=>clearTimeout(t)),await super.navigate(e)}close(){var e;this._frame&&(this._frame.parentNode&&(this._frame.addEventListener("load",e=>{var t;let r=e.target;null==(t=r.parentNode)||t.removeChild(r),this._abort.raise(Error("IFrame removed from DOM"))},!0),null==(e=this._frame.contentWindow)||e.location.replace("about:blank")),this._frame=null),this._window=null}static notifyParent(e,t){return super._notifyParent(window.parent,e,!1,t)}},es=class{constructor(e){this._settings=e,this._logger=new f("IFrameNavigator")}async prepare({silentRequestTimeoutInSeconds:e=this._settings.silentRequestTimeoutInSeconds}){return new ei({silentRequestTimeoutInSeconds:e})}async callback(e){this._logger.create("callback"),ei.notifyParent(e,this._settings.iframeNotifyParentOrigin)}},en=class extends Y{constructor({popupWindowTarget:e=et,popupWindowFeatures:t={},popupSignal:r,popupAbortOnClose:i}){super(),this._logger=new f("PopupWindow");const s=S.center({...ee,...t});this._window=window.open(void 0,e,S.serialize(s)),this.abortOnClose=!!i,r&&r.addEventListener("abort",()=>{var e;this._abort.raise(Error(null!=(e=r.reason)?e:"Popup aborted"))}),t.closePopupWindowAfterInSeconds&&t.closePopupWindowAfterInSeconds>0&&setTimeout(()=>{!this._window||"boolean"!=typeof this._window.closed||this._window.closed?this._abort.raise(Error("Popup blocked by user")):this.close()},1e3*t.closePopupWindowAfterInSeconds)}async navigate(e){var t;

2null==(t=this._window)||t.focus();let r=setInterval(()=>{(!this._window||this._window.closed)&&(this._logger.debug("Popup closed by user or isolated by redirect"),i(),this._disposeHandlers.delete(i),this.abortOnClose&&this._abort.raise(Error("Popup closed by user")))},500),i=()=>clearInterval(r);return this._disposeHandlers.add(i),await super.navigate(e)}close(){this._window&&!this._window.closed&&(this._window.close(),this._abort.raise(Error("Popup closed"))),this._window=null}static notifyOpener(e,t){super._notifyParent(window.opener,e,t),t||window.opener||window.close()}},eo=class{constructor(e){this._settings=e,this._logger=new f("PopupNavigator")}async prepare({popupWindowFeatures:e=this._settings.popupWindowFeatures,popupWindowTarget:t=this._settings.popupWindowTarget,popupSignal:r,popupAbortOnClose:i}){return new en({popupWindowFeatures:e,popupWindowTarget:t,popupSignal:r,popupAbortOnClose:i})}async callback(e,{keepOpen:t=!1}){this._logger.create("callback"),en.notifyOpener(e,t)}},ea=class{constructor(e){this._settings=e,this._logger=new f("RedirectNavigator")}async prepare({redirectMethod:e=this._settings.redirectMethod,redirectTarget:t=this._settings.redirectTarget}){var r;let i;this._logger.create("prepare");let s=window.self;"top"===t&&(s=null!=(r=window.top)?r:window.self);let n=s.location[e].bind(s.location);return{navigate:async e=>{this._logger.create("navigate");let t=new Promise((t,r)=>{i=r,window.addEventListener("pageshow",()=>t(window.location.href)),n(e.url)});return await t},close:()=>{this._logger.create("close"),null==i||i(Error("Redirect aborted")),s.stop()}}}async callback(){}},el=class extends R{constructor(e){super({expiringNotificationTimeInSeconds:e.accessTokenExpiringNotificationTimeInSeconds}),this._logger=new f("UserManagerEvents"),this._userLoaded=new k("User loaded"),this._userUnloaded=new k("User unloaded"),this._silentRenewError=ne

2w k("Silent renew error"),this._userSignedIn=new k("User signed in"),this._userSignedOut=new k("User signed out"),this._userSessionChanged=new k("User session changed")}async load(e,t=!0){await super.load(e),t&&await this._userLoaded.raise(e)}async unload(){await super.unload(),await this._userUnloaded.raise()}addUserLoaded(e){return this._userLoaded.addHandler(e)}removeUserLoaded(e){return this._userLoaded.removeHandler(e)}addUserUnloaded(e){return this._userUnloaded.addHandler(e)}removeUserUnloaded(e){return this._userUnloaded.removeHandler(e)}addSilentRenewError(e){return this._silentRenewError.addHandler(e)}removeSilentRenewError(e){return this._silentRenewError.removeHandler(e)}async _raiseSilentRenewError(e){await this._silentRenewError.raise(e)}addUserSignedIn(e){return this._userSignedIn.addHandler(e)}removeUserSignedIn(e){this._userSignedIn.removeHandler(e)}async _raiseUserSignedIn(){await this._userSignedIn.raise()}addUserSignedOut(e){return this._userSignedOut.addHandler(e)}removeUserSignedOut(e){this._userSignedOut.removeHandler(e)}async _raiseUserSignedOut(){await this._userSignedOut.raise()}addUserSessionChanged(e){return this._userSessionChanged.addHandler(e)}removeUserSessionChanged(e){this._userSessionChanged.removeHandler(e)}async _raiseUserSessionChanged(){await this._userSessionChanged.raise()}},ec=class{constructor(e){this._userManager=e,this._logger=new f("SilentRenewService"),this._isStarted=!1,this._retryTimer=new I("Retry Silent Renew"),this._timeoutRetryCount=0,this._tokenExpiring=async()=>{let e=this._logger.create("_tokenExpiring");try{await this._userManager.signinSilent(),this._timeoutRetryCount=0,e.debug("silent token renewal successful")}catch(t){if(t instanceof T){this._timeoutRetryCount++;let r=this._userManager.settings.maxSilentRenewTimeoutRetries;if(void 0!==r&&this._timeoutRetryCount>r){e.error(`Timeout retry limit reached (${this._timeoutRetryCount} > ${r}), raising silentRenewError:`,t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t);return}e.warn(`ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,t),this._retryTimer.init(5);return}e.error("Error from signinSilent:",t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t)}}}async start(){let e=this._logger.create("start");if(!this._isStarted){this._isStarted=!0,this._userManager.events.addAccessTokenExpiring(this._tokenExpiring),this._retryTimer.addHandler(this._tokenExpiring);try{await this._userManager.getUser()}catch(t){e.error("getUser error",t)}}}stop(){this._isStarted&&(this._retryTimer.cancel(),this._retryTimer.removeHandler(this._tokenExpiring),this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring),this._isStarted=!1)}},ed=class{constructor(e){this.refresh_token=e.refresh_token,this.id_token=e.id_token,this.session_state=e.session_state,this.scope=e.scope,this.profile=e.profile,this.data=e.state}}

2,eu=class{constructor(e,t,r,i){this._logger=new f("UserManager"),this.settings=new er(e),this._client=new G(e),this._redirectNavigator=null!=t?t:new ea(this.settings),this._popupNavigator=null!=r?r:new eo(this.settings),this._iframeNavigator=null!=i?i:new es(this.settings),this._events=new el(this.settings),this._silentRenewService=new ec(this),this.settings.automaticSilentRenew&&this.startSilentRenew(),this._sessionMonitor=null,this.settings.monitorSession&&(this._sessionMonitor=new Z(this))}get events(){return this._events}get metadataService(){return this._client.metadataService}async getUser(e=!1){let t=this._logger.create("getUser"),r=await this._loadUser();return r?(t.info("user loaded"),await this._events.load(r,e),r):(t.info("user not found in storage"),null)}async removeUser(){let e=this._logger.create("removeUser");await this.storeUser(null),e.info("user removed from storage"),await this._events.unload()}async signinRedirect(e={}){var t;let r;this._logger.create("signinRedirect");let{redirectMethod:i,...s}=e;(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(r=await this.generateDPoPJkt(this.settings.dpop));let n=await this._redirectNavigator.prepare({redirectMethod:i});await this._signinStart({request_type:"si:r",dpopJkt:r,...s},n)}async signinRedirectCallback(e=window.location.href){let t=this._logger.create("signinRedirectCallback"),r=await this._signinEnd(e);return r.profile&&r.profile.sub?t.info("success, signed in subject",r.profile.sub):t.info("no subject"),r}async signinResourceOwnerCredentials({username:e,password:t,skipUserInfo:r=!1}){let i=this._logger.create("signinResourceOwnerCredential"),s=await this._client.processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:r,extraTokenParams:this.settings.extraTokenParams});i.debug("got signin response");let n=await this._buildUser(s);return n.profile&&n.profile.sub?i.info("success, signed in subject",n.profile.sub):i.info("no subject"),n}async signinPopup(e={}){var t;let r,i=this._logger.create("signinPopup");(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(r=await this.generateDPoPJkt(this.settings.dpop));let{popupWindowFeatures:s,popupWindowTarget:n,popupSignal:o,popupAbortOnClose:a,...l}=e,c=this.settings.popup_redirect_uri;c||i.throw(Error("No popup_redirect_uri configured"));let d=await this._popupNavigator.prepare({popupWindowFeatures:s,popupWindowTarget:n,popupSignal:o,popupAbortOnClose:a}),u=await this._signin({request_type:"si:p",redirect_uri:c,display:"popup",dpopJkt:r,...l},d);return u&&(u.profile&&u.profile.sub?i.info("success, signed in subject",u.profile.sub):i.info("no subject")),u}async signinPopupCallback(e=window.location.href,t=!1){let r=this._logger.create("signinPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),r.info("success")}async signinSilent(e={}){var t,r;let i,s,n=this._logger.create("signinSilent"),{silentRequestTimeoutInSeconds:o,...a}=e,l=await this._loadUser();if(!e.forceIframeAuth&&(null==l?void 0:l.refresh_token)){n.debug("using refresh token");let e=new ed(l);return await this._useRefreshToken({state:e,redirect_uri:a.redirect_uri,resource:a.resource,extraTokenParams:a.extraTokenParams,timeoutInSeconds:o})}(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(i=await this.generateDPoPJkt(this.settings.dpop));let c=this.settings.silent_redirect_uri;c||n.throw(Error("No silent_redirect_uri configured")),l&&this.settings.validateSubOnSilentRenew&&(n.debug("subject prior to silent renew:",l.profile.sub),s=l.profile.sub);let d=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:o});return(l=await this._signin({request_type:"si:s",redirect_uri:c,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==l?void 0:l.id_token:void 0,dpopJkt:i,...a},d,s))&&((null==(r=l.profile)?void 0:r.sub)?n.info("success, signed in subject",l.profile.sub):n.info("no subject")),l}async _useRefreshToken(e){let t=await this._client.useRefreshToken({timeoutInSeconds:this.settings.silentRequestTimeoutInSeconds,...e}),r=new X({...e.state,...t});return await this.storeUser(r),await this._events.load(r),r}async signinSilentCallback(e=window.location.href){let t=this._logger.create("signinSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async signinCallback(e=window.location.href){let{state:t}=await this._client.readSigninResponseState(e);switch(t.request_type){case"si:r":return await this.signinRedirectCallback(e);case"si:p":await this.signinPopupCallback(e);break;case"si:s":await this.signinSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async signoutCallback(e=window.location.href,t=!1){let{state:r}=await this._client.readSignoutResponseState(e);if(r)switch(r.request_type){case"so:r":return await this.signoutRedirectCallback(e);case"so:p":await this.signoutPopupCallback(e,t);break;case"so:s":await this.signoutSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async querySessionStatus(e={}){let t=this._logger.create("querySessionStatus"),{silentRequestTimeoutInSeconds:r,...i}=e,s=this.settings.silent_redirect_uri;s||t.throw(Error("No silent_redirect_uri configured"));let n=await this._loadUser(),o=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:r}),a=await this._signinStart({request_type:"si:s",redirect_uri:s,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==n?void 0:n.id_token:void 0,response_type:this.settings.query_status_response_type,scope:"openid",skipUserInfo:!0,...i},o);try{let e=await this._client.processSigninResponse(a.url,{});if(t.debug("got signin response"),e.session_state&&e.profile.sub)return t.info("success for subject",e.profile.sub),{session_state:e.session_state,sub:e.profile.sub};return t.info("success, user not authenticated"),null}catch(e){if(this.settings.monitorAnonymousSession&&e instanceof E)switch(e.error){case"login_required":case"consent_required":case"interaction_required":case"account_selection_required":return t.info("success for anonymous user"),{session_state:e.session_state}}throw e}}async _signin(e,t,r){let i=await this._signinStart(e,t);return await this._signinEnd(i.url,r)}async _signinStart(e,t){let r=this._logger.create("_signinStart");try{let i=await this._client.createSigninRequest(e);return r.debug("got signin request"),await t.navigate({url:i.url,state:i.state.id,response_mode:i.state.response_mode,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw r.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signinEnd(e,t){let r=this._logger.create("_signinEnd"),i=await this._client.processSigninResponse(e,{});return r.debug("got signin response"),await this._buildUser(i,t)}async _buildUser(e,t){let r=this._logger.create("_buildUser"),i=new X(e);if(t){if(t!==i.profile.sub)throw r.debug("current user does not match user returned from signin. sub from signin:",i.profile.sub),new E({...e,error:"login_required"});r.debug("current user matches user returned from signin")}return await this.storeUser(i),r.debug("user stored"),await this._events.load(i),i}async signoutRedirect(e={}){let t=this._logger.create("signoutRedirect"),{redirectMethod:r,...i}=e,s=await this._redirectNavigator.prepare({redirectMethod:r});await this._signoutStart({request_type:"so:r",post_logout_redirect_uri:this.settings.post_logout_redirect_uri,...i},s),t.info("success")}async signoutRedirectCallback(e=window.location.href){let t=this._logger.create("signoutRedirectCallback"),r=await this._signoutEnd(e);return t.info("success"),r}async signoutPopup(e={}){let t=this._logger.create("signoutPopup"),{popupWindowFeatures:r,popupWindowTarget:i,popupSignal:s,...n}=e,o=this.settings.popup_post_logout_redirect_uri,a=await this._popupNavigator.prepare({popupWindowFeatures:r,popupWindowTarget:i,popupSignal:s});await this._signout({request_type:"so:p",post_logout_redirect_uri:o,state:null==o?void 0:{},...n},a),t.info("success")}async signoutPopupCallback(e=window.location.href,t=!1){let r=this._logger.create("signoutPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),r.info("success")}async _signout(e,t){let r=await this._signoutStart(e,t);return await this._signoutEnd(r.url)}async _signoutStart(e={},t){var r;let i=this._logger.create("_signoutStart");try{let s=await this._loadUser();i.debug("loaded current user from storage"),this.settings.revokeTokensOnSignout&&await this._revokeInternal(s);let n=e.id_token_hint||s&&s.id_token;n&&(i.debug("setting id_token_hint in signout request"),e.id_token_hint=n),await this.removeUser(),i.debug("user removed, creating signout request");

2let o=await this._client.createSignoutRequest(e);return i.debug("got signout request"),await t.navigate({url:o.url,state:null==(r=o.state)?void 0:r.id,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw i.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signoutEnd(e){let t=this._logger.create("_signoutEnd"),r=await this._client.processSignoutResponse(e);return t.debug("got signout response"),r}async signoutSilent(e={}){var t;let r=this._logger.create("signoutSilent"),{silentRequestTimeoutInSeconds:i,...s}=e,n=this.settings.includeIdTokenInSilentSignout?null==(t=await this._loadUser())?void 0:t.id_token:void 0,o=this.settings.popup_post_logout_redirect_uri,a=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:i});await this._signout({request_type:"so:s",post_logout_redirect_uri:o,id_token_hint:n,...s},a),r.info("success")}async signoutSilentCallback(e=window.location.href){let t=this._logger.create("signoutSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async revokeTokens(e){let t=await this._loadUser();await this._revokeInternal(t,e)}async _revokeInternal(e,t=this.settings.revokeTokenTypes){let r=this._logger.create("_revokeInternal");if(!e)return;let i=t.filter(t=>"string"==typeof e[t]);if(!i.length)return void r.debug("no need to revoke due to no token(s)");for(let t of i)await this._client.revokeToken(e[t],t),r.info(`${t} revoked successfully`),"access_token"!==t&&(e[t]=null);await this.storeUser(e),r.debug("user stored"),await this._events.load(e)}startSilentRenew(){this._logger.create("startSilentRenew"),this._silentRenewService.start()}stopSilentRenew(){this._silentRenewService.stop()}get _userStoreKey(){return`user:${this.settings.authority}:${this.settings.client_id}`}async _loadUser(){let e=this._logger.create("_loadUser"),t=await this.settings.userStore.get(this._userStoreKey);return t?(e.debug("user storageString loaded"),X.fromStorageString(t)):(e.debug("no user storageString"),null)}async storeUser(e){let t=this._logger.create("storeUser");if(e){t.debug("storing user");let r=e.toStorageString();await this.settings.userStore.set(this._userStoreKey,r)}else this._logger.debug("removing user"),await this.settings.userStore.remove(this._userStoreKey),this.settings.dpop&&await this.settings.dpop.store.remove(this.settings.client_id)}async clearStaleState(){await this._client.clearStaleState()}

2async dpopProof(e,t,r,i){var s,n;let o=await (null==(n=null==(s=this.settings.dpop)?void 0:s.store)?void 0:n.get(this.settings.client_id));if(o)return await b.generateDPoPProof({url:e,accessToken:null==t?void 0:t.access_token,httpMethod:r,keyPair:o.keys,nonce:i})}async generateDPoPJkt(e){let t=await e.store.get(this.settings.client_id);return t||(t=new V(await b.generateDPoPKeys()),await e.store.set(this.settings.client_id,t)),await b.generateDPoPJkt(t.keys)}},eh="3.5.0",eg=class{constructor(){this._dbName="oidc",this._storeName="dpop"}async set(e,t){let r=await this.createStore(this._dbName,this._storeName);await r("readwrite",r=>(r.put(t,e),this.promisifyRequest(r.transaction)))}async get(e){let t=await this.createStore(this._dbName,this._storeName);return await t("readonly",t=>this.promisifyRequest(t.get(e)))}async remove(e){let t=await this.get(e),r=await this.createStore(this._dbName,this._storeName);return await r("readwrite",t=>this.promisifyRequest(t.delete(e))),t}async getAllKeys(){let e=await this.createStore(this._dbName,this._storeName);return await e("readonly",e=>this.promisifyRequest(e.getAllKeys()))}promisifyRequest(e){return new Promise((t,r)=>{e.oncomplete=e.onsuccess=()=>t(e.result),e.onabort=e.onerror=()=>r(e.error)})}async createStore(e,t){let r=indexedDB.open(e);r.onupgradeneeded=()=>r.result.createObjectStore(t);let i=await this.promisifyRequest(r);return async(e,r)=>{let s=i.transaction(t,e).objectStore(t);return await r(s)}}}},698637,292930,734804,e=>{"use strict";let t,r,i,s,n;var o=e.i(824627);class a extends Error{}function l(e,t){let r;if("string"!=typeof e)throw new a("Invalid token specified: must be a string");t||(t={});let i=+(!0!==t.header),s=e.split(".")[i];if("string"!=typeof s)throw new a(`Invalid token specified: missing part #${i+1}`);try{r=function(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw Error("base64 string is not of the correct length")}try{var r;

2return r=t,decodeURIComponent(atob(r).replace(/(.)/g,(e,t)=>{let r=t.charCodeAt(0).toString(16).toUpperCase();return r.length<2&&(r="0"+r),"%"+r}))}catch(e){return atob(t)}}(s)}catch(e){throw new a(`Invalid token specified: invalid base64 for part #${i+1} (${e.message})`)}try{return JSON.parse(r)}catch(e){throw new a(`Invalid token specified: invalid json for part #${i+1} (${e.message})`)}}a.prototype.name="InvalidTokenError";var c="/v1/auth/accesskey/exchange",d="/v1/auth/otp/verify",u="/v1/auth/otp/signin",h="/v1/auth/otp/signup",g={email:"/v1/auth/otp/update/email",phone:"/v1/auth/otp/update/phone"},p="/v1/auth/otp/signup-in",_="/v1/auth/magiclink/verify",f="/v1/auth/magiclink/signin",w="/v1/auth/magiclink/signup",m={email:"/v1/auth/magiclink/update/email",phone:"/v1/auth/magiclink/update/phone"},v="/v1/auth/magiclink/signup-in",y="/v1/auth/enchantedlink/verify",b="/v1/auth/enchantedlink/signin",k="/v1/auth/enchantedlink/signup",S="/v1/auth/enchantedlink/pending-session",I={email:"/v1/auth/enchantedlink/update/email"},O="/v1/auth/enchantedlink/signup-in",E="/v1/auth/oauth/authorize",T="/v1/auth/oauth/exchange",R="v1/auth/oauth/native/start",x="v1/auth/oauth/native/finish",C={getOneTapClientId:"/v1/auth/onetap/clientid/{provider}",exchangeOneTapIDToken:"/v1/auth/onetap/idtoken/exchange",verifyOneTapIDToken:"/v1/auth/onetap/idtoken/verify"},U="/v1/outbound/oauth/connect",P="/v1/auth/saml/authorize",j="/v1/auth/saml/exchange",A="/v1/auth/totp/verify",N="/v1/auth/totp/signup",D="/v1/auth/totp/update",q="/v1/auth/notp/whatsapp/signin",$="/v1/auth/notp/whatsapp/signup",M="/v1/auth/notp/whatsapp/signup-in",H="/v1/auth/notp/pending-session",J={start:"/v1/auth/webauthn/signup/start",finish:"/v1/auth/webauthn/signup/finish"},L={start:"/v1/auth/webauthn/signin/start",finish:"/v1/auth/webauthn/signin/finish"},K={start:"/v1/auth/webauthn/signup-in/start"},W={start:"v1/auth/webauthn/update/start",finish:"/v1/auth/webauthn/update/finish"},F="/v1/auth/password/signup",B="/v1/auth/password/signin",z="/v1/auth/password/reset",V="/v1/auth/password/update",G="/v1/auth/password/replace",Z="/v1/auth/password/policy",X="/v1/flow/start",Q="/v1/flow/next";let Y="<region>",ee=`https://api.${Y}descope.com`,et=()=>{let e={};return{headers(t){return e.Headers=JSON.stringify("function"==typeof t.entries?Object.fromEntries(t.entries()):t),this},body(t){return e.Body=t,this},url(t){return e.Url=t.toString(),this},method(t){return e.Method=t,this},title(t){return e.Title=t,this},status(t){return e.Status=t,this},retries(t){return e.Retries=t,this},build:()=>Object.keys(e).flatMap(t=>e[t]?[`${"Title"!==t?`${t}: `:""}${e[t]}`]:[]).join("\n")}},er=[503,520,521,522,524,530],ei=[100,5e3,5e3],es=e=>new Promise(t=>setTimeout(t,e)),en=e=>async function(...t){let r=await e(...t),i=0;for(;er.includes(r.status)&&i<ei.length;)await es(ei[i]),r=await e(...t),i++;i>0&&(r.retries=i);let s=await r.text();return r.text=()=>Promise.resolve(s),r.json=()=>Promise.resolve(JSON.parse(s)),r.clone=()=>r,r};(tI=tR||(tR={})).get="GET",tI.delete="DELETE",tI.post="POST",tI.put="PUT",tI.patch="PATCH";let eo=({path:e,baseUrl:t,queryParams:r,projectId:i})=>{let s=i.slice(1,-27);t=t.replace(Y,s?s+".":"");let n=e?`${t.replace(/\/$/,"")}/${null==e?void 0:e.replace(/^\//,"")}`:t;if(r){let e=Object.keys(r);e.forEach((t,i)=>{n=`${n}${0===i?"?":""}${t}=${encodeURIComponent(r[t])}${i===e.length-1?"":"&"}`})}return n},ea={"Content-Type":"application/json"};var el=(s=({baseUrl:e,projectId:r,baseConfig:i,refreshCookieName:s,logger:n,hooks:o,cookiePolicy:a,fetch:l})=>{let c,d=e||ee,u=((c=l||fetch)||null==n||n.warn("Fetch is not defined, you will not be able to send http requests, if you are running in a test, make sure fetch is defined globally"),n?async function(...e){if(!c)throw Error("Cannot send http request, fetch is not defined, if you are running in a test, make sure fetch is defined globally");n.log(et().title("Request").url(e[0]).method(e[1].method).headers(e[1].headers).body(e[1].body).build());let t=await en(c)(...e);return n[t.ok?"log":"error"](await (async e=>{let t=await e.text();return et().title("Response").url(e.url.toString()).status(`${e.status} ${e.statusText}`).headers(e.headers).body(t).retries(e.retries).build()})(t)),t}:en(c)),h=async e=>{var n;let l,{path:c,body:h,headers:g,queryParams:p,method:_,token:f}=(null==o?void 0:o.beforeRequest)?o.beforeRequest(e):e,w=void 0===h?void 0:JSON.stringify(h),m={headers:((...e)=>new Headers(e.reduce((e,t)=>

2((Array.isArray(t)?t:t instanceof Headers?Array.from(t.entries()):t?Object.entries(t):[]).forEach(([t,r])=>{e[t]="function"==typeof r?r():r}),e),{})))(((e,t="")=>{let r=e;return t&&(r=r+":"+t),{Authorization:`Bearer ${r}`}})(r,f),(l={"x-descope-sdk-session-id":(()=>{if(t)return t;let e=new Date,r=`${e.getUTCFullYear().toString()}-${(e.getUTCMonth()+1).toString().padStart(2,"0")}-${e.getUTCDate().toString().padStart(2,"0")}-${e.getUTCHours().toString().padStart(2,"0")}:${e.getUTCMinutes().toString().padStart(2,"0")}:${e.getUTCSeconds().toString().padStart(2,"0")}:${e.getUTCMilliseconds().toString()}`,i=Math.floor(1e3+9e3*Math.random());return t=`${r}-${i}`})(),"x-descope-sdk-name":"core-js","x-descope-sdk-version":"2.67.0","x-descope-project-id":r},s&&(l["x-descope-refresh-cookie-name"]=s),l),(null==i?void 0:i.baseHeaders)||{},(e=>{try{e=JSON.parse(e)}catch(e){return!1}return"object"==typeof e&&null!==e})(w)?ea:{},g),method:_,body:w};null!==a&&(m.credentials=a||"include");let v=await u(eo({path:c,baseUrl:d,queryParams:p,projectId:r}),m);

2if((null==o?void 0:o.afterRequest)&&await o.afterRequest(e,null==v?void 0:v.clone()),null==o?void 0:o.transformResponse){let e=await v.json(),t=Object.fromEntries((function(e){if(!e)return[];let t=[],r=0;function i(){for(;r<e.length&&/\s/.test(e.charAt(r));)r+=1;return r<e.length}for(;r<e.length;){let s=r,n,o,a=!1;for(;i();)if(","===e.charAt(r)){for(n=r,r+=1,i(),o=r;r<e.length&&function(){let t=e.charAt(r);return"="!==t&&";"!==t&&","!==t}();)r+=1;if(r<e.length&&"="===e.charAt(r)){a=!0,r=o,t.push(e.substring(s,n));break}r=n+1}else r+=1;(!a||r>=e.length)&&t.push(e.substring(s,e.length))}return t})((null==(n=v.headers)?void 0:n.get("set-cookie"))||"").map(e=>{let t=e.split(";")[0],r=t.indexOf("=");return r<1?null:[t.substring(0,r).trim(),t.substring(r+1).trim()]}).filter(Boolean)),r=Object.assign(Object.assign({},v),{json:()=>Promise.resolve(e),cookies:t});return r.clone=()=>r,o.transformResponse(r)}return v};return{get:(e,{headers:t,queryParams:r,token:i}={})=>h({path:e,headers:t,queryParams:r,body:void 0,method:tR.get,token:i}),post:(e,t,{headers:r,queryParams:i,token:s}={})=>h({path:e,headers:r,queryParams:i,body:t,method:tR.post,token:s}),patch:(e,t,{headers:r,queryParams:i,token:s}={})=>h({path:e,headers:r,queryParams:i,body:t,method:tR.patch,token:s}),put:(e,t,{headers:r,queryParams:i,token:s}={})=>h({path:e,headers:r,queryParams:i,body:t,method:tR.put,token:s}),delete:(e,{headers:t,queryParams:r,token:i}={})=>h({path:e,headers:t,queryParams:r,body:void 0,method:tR.delete,token:i}),hooks:o,buildUrl:(e,t)=>eo({projectId:r,baseUrl:d,path:e,queryParams:t})}},e=>{var t;return s(Object.assign(Object.assign({},e),{hooks:{beforeRequest:t=>{var r;let i=[].concat((null==(r=e.hooks)?void 0:r.beforeRequest)||[]);return null==i?void 0:i.reduce((e,t)=>t(e),t)},afterRequest:async(t,r)=>{var i;let s=[].concat((null==(i=e.hooks)?void 0:i.afterRequest)||[]);0!=s.length&&(await Promise.allSettled(null==s?void 0:s.map(e=>e(t,null==r?void 0:r.clone())))).forEach(t=>{var r;return"rejected"===t.status&&(null==(r=e.logger)?void 0:r.error(t.reason))})},transformResponse:null==(t=e.hooks)?void 0:t.transformResponse}}))});function ec(e,t,r){var i;let s=ed(e);if(t){if(!(null==s?void 0:s.tenants)&&(null==s?void 0:s.dct)===t)return(null==s?void 0:s[r])||[];s=null==(i=null==s?void 0:s.tenants)?void 0:i[t]}let n=null==s?void 0:s[r];return Array.isArray(n)?n:[]}function ed(e){if("string"!=typeof e||!e)throw Error("Invalid token provided");return l(e)}function eu(e){let{exp:t}=ed(e);return(new Date).getTime()/1e3>t}function eh(e){let t=ed(e),r=Object.keys(null==t?void 0:t.tenants);return Array.isArray(r)?r:[]}function eg(e,t){return ec(e,t,"permissions")}function ep(e,t){return ec(e,t,"roles")}let e_=(...e)=>e.join("/").replace(/\/{2,}/g,"/");async function ef(e,t){var r;let i=await e,s={code:i.status,ok:i.ok,response:i},n=await i.clone().json();return i.ok?s.data=t?t(n):n:(s.error=n,429===i.status&&Object.assign(s.error,{retryAfter:Number.parseInt(null==(r=i.headers)?void 0:r.get("retry-after"))||0})),s}function ew(e){var t;return(null==(t=ed(e))?void 0:t.dct)||""}let em=(e,t)=>(r=t)=>t=>!e(t)&&r.replace("{val}",t),ev=(e,t)=>(r=t)=>t=>{let i=e.filter(e=>e(t));return!(i.length<e.length)&&(r?r.replace("{val}",t):i.join(" OR "))},ey=(...e)=>({validate:t=>(e.forEach(e=>{let r=e(t);if(r)throw Error(r)}),!0)}),eb=e=>t=>e.test(t),ek=eb(/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/),eS=eb(/^\+[1-9]{1}[0-9]{3,14}$/),eI=em(ek,'"{val}" is not a valid email'),eO=em(eS,'"{val}" is not a valid phone number'),eE=em(e=>e.length>=1,"Minimum length is 1"),eT=em(e=>"string"==typeof e,"Input is not a string"),eR=em(e=>Array.isArray(e),"Input is not an array"),ex=em(e=>"boolean"==typeof e,"Input is not a boolean"),eC=em(e=>void 0===e,"Input is defined"),eU=ev([eT(),eC()],"Input is not a string or undefined"),eP=ev([eR(),ex()],"Input is not an array or boolean"),ej=(...e)=>t=>(...r)=>(e.forEach((e,t)=>ey(...e).validate(r[t])),t(...r)),eA=e=>[eT(`"${e}" must be a string`)],eN=e=>[eU(`"${e}" must be string or undefined`)],eD=e=>[eT(`"${e}" must be a string`),eE(`"${e}" must not be empty`)],eq=e=>[eT(`"${e}" must be a string`),eI()],e$=e=>[eT(`"${e}" must be a string`),eO()],eM=ej(eD("accessKey")),eH=(e,t,r)=>(t.forEach(t=>{let i=t.split("."),s=i.shift(),n=e;for(;i.length>0;){if(n=n[s],!s||!n)throw Error(`Invalid path "${t}", "${s}" is missing or has no value`);s=i.shift()}if("function"!=typeof n[s])throw Error(`"${t}" is not a function`);let o=n[s];n[s]=r(o)}),e),eJ=({pollingIntervalMs:e=1e3,timeoutMs:t=6e5}={})=>({pollingIntervalMs:Math.max(e||1e3,1e3),timeoutMs:Math.min(t||6e5,6e5)});(tO=tx||(tx={})).sms="sms",tO.voice="voice",tO.whatsapp="whatsapp",tO.im="im",(tC||(tC={})).email="email";let eL=Object.assign(Object.assign({},tx),tC);(tE=tU||(tU={})).waiting="waiting",tE.running="running",tE.completed="completed",tE.failed="failed";

2let eK=eD("loginId"),eW=ej(eD("token")),eF=ej(eK),eB=ej(eD("pendingRef")),ez=ej(eK,eq("email")),eV=ej(eD("flowId")),eG=ej(eD("executionId"),eD("stepId"),eD("interactionId")),eZ=eD("loginId"),eX=ej(eD("token")),eQ=ej(eZ),eY=ej(eZ,e$("phone")),e0=ej(eZ,eq("email")),e1=Object.keys(eL).filter(e=>e!==tx.voice&&e!==tx.im);(tT=tP||(tP={})).facebook="facebook",tT.github="github",tT.google="google",tT.microsoft="microsoft",tT.gitlab="gitlab",tT.apple="apple",tT.discord="discord",tT.linkedin="linkedin",tT.slack="slack";let e2=ej(eD("code")),e3=ej(eD("appId")),e6=eD("loginId"),e4=ej(e6,eD("code")),e5=ej(e6),e8=ej(e6,e$("phone")),e7=ej(e6,eq("email")),e9=ej(eD("tenant")),te=ej(eD("code")),tt=e=>({start:e9((t,r,i,s,n,o,a,l)=>ef(e.post(P,i||{},Object.assign({queryParams:Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({tenant:t},r&&{redirectURL:r}),n&&{ssoId:n}),o&&{forceAuthn:"true"}),a&&{loginHint:a}),l&&{initiatedEmail:t})},s&&{token:s})))),exchange:te(t=>ef(e.post(j,{code:t})))}),tr=eD("loginId"),ti=ej(tr,eD("code")),ts=ej(tr),tn=ej(tr),to=eD("loginId"),ta=eD("newPassword"),tl=ej(to,eD("password")),tc=ej(to),td=ej(to,ta),tu=ej(to,eD("oldPassword"),ta),th=eA("loginId"),tg=eD("loginId"),tp=eD("origin"),t_=ej(tg,tp,eD("name")),tf=ej(tg,tp),tw=ej(th,tp),tm=ej(tg,tp,eN("token")),tv=ej(eD("transactionId"),eD("response")),ty=ej(eA("loginId")),tb=ej(eD("pendingRef")),tk=ej(eD("token")),tS=ej(eN("token"));var tI,tO,tE,tT,tR,tx,tC,tU,tP,tj=Object.assign(ej([em((n=eD("projectId"),e=>ey(...n).validate(((e,t,r)=>{let i=(Array.isArray(t)?t.join("."):String(t)).replace(/\[\\?("|')?(\w|d)+\\?("|')?\]/g,(e,t,r)=>"."+r).split("."),s=i.length,n=0,o=e===Object(e)?e:void 0;for(;null!=o&&n<s;)o=o[i[n++]];return n&&n===s&&void 0!==o?o:r})(e,"projectId"))))()])(e=>{var t;let r,{projectId:i,logger:s,baseUrl:n,cookiePolicy:a,baseHeaders:l={},refreshCookieName:P,fetch:j}=e;return{accessKey:(r=t=el({baseUrl:n,projectId:i,logger:s,hooks:{get beforeRequest(){var Y;return null==(Y=e.hooks)?void 0:Y.beforeRequest}

2,get afterRequest(){var ee;return null==(ee=e.hooks)?void 0:ee.afterRequest},get transformResponse(){var et;return null==(et=e.hooks)?void 0:et.transformResponse}},cookiePolicy:a,baseConfig:{baseHeaders:l},refreshCookieName:P,fetch:j}),{exchange:eM((e,t)=>ef(r.post(c,{loginOptions:t},{token:e})))}),otp:{verify:Object.keys(eL).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:e4((e,i)=>ef(t.post(e_(d,r),{code:i,loginId:e})))}),{}),signIn:Object.keys(eL).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:e5((e,i={},s)=>{var{providerId:n}=i,a=(0,o.__rest)(i,["providerId"]);return ef(t.post(e_(u,r),{loginId:e,loginOptions:a,providerId:n},{token:s}))})}),{}),signUp:Object.keys(eL).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:e5((e,i,s={})=>{var{providerId:n}=s,a=(0,o.__rest)(s,["providerId"]);return ef(t.post(e_(h,r),{loginId:e,user:i,loginOptions:a,providerId:n}))})}),{}),signUpOrIn:Object.keys(eL).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:e5((e,i={})=>{var{providerId:s}=i,n=(0,o.__rest)(i,["providerId"]);return ef(t.post(e_(p,r),{loginId:e,loginOptions:n,providerId:s}))})}),{}),update:{email:e7((e,r,i,s)=>ef(t.post(g.email,Object.assign({loginId:e,email:r},s),{token:i}))),phone:Object.keys(tx).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:e8((e,i,s,n)=>ef(t.post(e_(g.phone,r),Object.assign({loginId:e,phone:i},n),{token:s})))}),{})}},magicLink:{verify:eX(e=>ef(t.post(_,{token:e}))),signIn:e1.reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:eQ((e,i,s={},n)=>{var{providerId:a}=s,l=(0,o.__rest)(s,["providerId"]);return ef(t.post(e_(f,r),{loginId:e,URI:i,loginOptions:l,providerId:a},{token:n}))})}),{}),signUp:e1.reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:eQ((e,i,s,n={})=>{var{providerId:a}=n,l=(0,o.__rest)(n,["providerId"]);return ef(t.post(e_(w,r),{loginId:e,URI:i,user:s,loginOptions:l,providerId:a}))})}),{}),signUpOrIn:e1.reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:eQ((e,i,s={})=>{var{providerId:n}=s,a=(0,o.__rest)(s,["providerId"]);return ef(t.post(e_(v,r),{loginId:e,URI:i,loginOptions:a,providerId:n}))})}),{}),update:{email:e0((e,r,i,s,n)=>ef(t.post(m.email,Object.assign({loginId:e,email:r,URI:i},n),{token:s}))),phone:Object.keys(tx).filter(e=>e!==tx.voice).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:eY((e,i,s,n,o)=>ef(t.post(e_(m.phone,r),Object.assign({loginId:e,phone:i,URI:s},o),{token:n})))}),{})}},enchantedLink:{verify:eW(e=>ef(t.post(y,{token:e}))),signIn:eF((e,r,i={},s)=>{var{providerId:n}=i,a=(0,o.__rest)(i,["providerId"]);return ef(t.post(e_(b,eL.email),{loginId:e,URI:r,loginOptions:a,providerId:n},{token:s}))}),signUpOrIn:eF((e,r,i={})=>{var{providerId:s}=i,n=(0,o.__rest)(i,["providerId"]);return ef(t.post(e_(O,eL.email),{loginId:e,URI:r,loginOptions:n,providerId:s}))}),signUp:eF((e,r,i,s={})=>{var{providerId:n}=s,a=(0,o.__rest)(s,["providerId"]);return ef(t.post(e_(k,eL.email),{loginId:e,URI:r,user:i,loginOptions:a,providerId:n}))}),waitForSession:eB((e,r)=>new Promise(i=>{let s,{pollingIntervalMs:n,timeoutMs:o}=eJ(r),a=setInterval(async()=>{let r=await t.post(S,{pendingRef:e});r.ok&&(clearInterval(a),s&&clearTimeout(s),i(ef(Promise.resolve(r))))},n);s=setTimeout(()=>{i({error:{errorDescription:`Session polling timeout exceeded: ${o}ms`,errorCode:"0"},ok:!1}),clearInterval(a)},o)})),update:{email:ez((e,r,i,s,n)=>ef(t.post(I.email,Object.assign({loginId:e,email:r,URI:i},n),{token:s})))}},oauth:{start:Object.assign((e,r,i,s,n)=>ef(t.post(E,i||{},{queryParams:Object.assign(Object.assign({provider:e},r&&{redirectURL:r}),n&&{loginHint:n}),token:s})),Object.keys(tP).reduce((e,r)=>Object.assign(Object.assign({},e),{[r]:(e,i,s,n)=>ef(t.post(E,i||{},{queryParams:Object.assign(Object.assign({provider:r},e&&{redirectURL:e}),n&&{loginHint:n}),token:s}))}),{})),exchange:e2(e=>ef(t.post(T,{code:e}))),startNative:(e,r,i)=>ef(t.post(R,{provider:e,loginOptions:r,implicit:i})),finishNative:(e,r,i,s,n)=>ef(t.post(x,{provider:e,stateId:r,user:i,code:s,idToken:n})),getOneTapClientId:e=>ef(t.get(C.getOneTapClientId.replace("{provider}",e))),verifyOneTapIDToken:(e,r,i,s)=>ef(t.post(C.verifyOneTapIDToken,{provider:e,idToken:r,nonce:i,loginOptions:s}

2)),exchangeOneTapIDToken:(e,r,i,s)=>ef(t.post(C.exchangeOneTapIDToken,{provider:e,idToken:r,nonce:i,loginOptions:s}))},outbound:{connect:e3((e,r,i)=>{let s=null==r?void 0:r.tenantId,n=null==r?void 0:r.tenantLevel;return null==r||delete r.tenantId,null==r||delete r.tenantLevel,ef(t.post(U,{appId:e,tenantId:s,tenantLevel:n,options:r},{token:i}))})},sso:tt(t),saml:tt(t),totp:{signUp:ts((e,r)=>ef(t.post(N,{loginId:e,user:r}))),verify:ti((e,r,i,s)=>ef(t.post(A,{loginId:e,code:r,loginOptions:i},{token:s}))),update:tn((e,r)=>ef(t.post(D,{loginId:e},{token:r})))},notp:{signUpOrIn:ty((e,r={})=>{var{providerId:i}=r,s=(0,o.__rest)(r,["providerId"]);return ef(t.post(M,{loginId:e,loginOptions:s,providerId:i}))}),signUp:ty((e,r,i={})=>{var{providerId:s}=i,n=(0,o.__rest)(i,["providerId"]);return ef(t.post($,{loginId:e,user:r,providerId:s,loginOptions:n}))}),signIn:ty((e,r={},i)=>{var{providerId:s}=r,n=(0,o.__rest)(r,["providerId"]);return ef(t.post(q,{loginId:e,loginOptions:n,providerId:s},{token:i}))}),waitForSession:tb((e,r)=>new Promise(i=>{let s,{pollingIntervalMs:n,timeoutMs:o}=eJ(r),a=setInterval(async()=>{let r=await t.post(H,{pendingRef:e});r.ok&&(clearInterval(a),s&&clearTimeout(s),i(ef(Promise.resolve(r))))},n);s=setTimeout(()=>{i({error:{errorDescription:`Session polling timeout exceeded: ${o}ms`,errorCode:"0"},ok:!1}),clearInterval(a)},o)}))},webauthn:{signUp:{start:t_((e,r,i,s,n)=>ef(t.post(J.start,{user:{loginId:e,name:i},origin:r,loginOptions:n,passkeyOptions:s}))),finish:tv((e,r)=>ef(t.post(J.finish,{transactionId:e,response:r})))},signIn:{start:tw((e,r,i,s,n)=>ef(t.post(L.start,{loginId:e,origin:r,loginOptions:i,passkeyOptions:n},{token:s}))),finish:tv((e,r)=>ef(t.post(L.finish,{transactionId:e,response:r})))},signUpOrIn:{start:tf((e,r,i,s)=>ef(t.post(K.start,{loginId:e,origin:r,loginOptions:s,passkeyOptions:i})))},update:{start:tm((e,r,i,s,n)=>ef(t.post(W.start,{loginId:e,origin:r,passkeyOptions:s,mfa:n},{token:i}))),finish:tv((e,r)=>ef(t.post(W.finish,{transactionId:e,response:r})))}},password:{signUp:tl((e,r,i,s={})=>{var{providerId:n}=s,a=(0,o.__rest)(s,["providerId"]);return ef(t.post(F,{loginId:e,password:r,user:i,loginOptions:a,providerId:n}))}),signIn:tl((e,r,i={})=>{var{providerId:s}=i,n=(0,o.__rest)(i,["providerId"]);return ef(t.post(B,{loginId:e,password:r,loginOptions:n,providerId:s}))}),sendReset:tc((e,r,i)=>ef(t.post(z,{loginId:e,redirectUrl:r,templateOptions:i}))),update:td((e,r,i)=>ef(t.post(V,{loginId:e,newPassword:r},{token:i}))),replace:tu((e,r,i)=>ef(t.post(G,{loginId:e,oldPassword:r,newPassword:i}))),policy:()=>ef(t.get(Z))},flow:{start:eV((e,r,i,s,n,o,a,l=!1)=>ef(t.post(X,{flowId:e,options:r,conditionInteractionId:i,interactionId:s,componentsVersion:n,flowVersions:o,input:a,isCustomScreen:l}))),next:eG((e,r,i,s,n,o,a=!1)=>ef(t.post(Q,{executionId:e,stepId:r,interactionId:i,version:s,componentsVersion:n,input:o,isCustomScreen:a})))},refresh:tS((e,r,i,s)=>{let n={};return i&&(n.externalToken=i),ef(t.post(s?"/v1/auth/try-refresh":"/v1/auth/refresh",n,{token:e,queryParams:r}))}),selectTenant:ej([eT("tenantId")],[eU('"token" must be string or undefined')])((e,r)=>ef(t.post("/v1/auth/tenant/select",{tenant:e},{token:r}))),logout:tS(e=>ef(t.post("/v1/auth/logout",{},{token:e}))),logoutAll:tS(e=>ef(t.post("/v1/auth/logoutall",{},{token:e}))),me:tS(e=>ef(t.get("/v1/auth/me",{token:e}))),myTenants:ej([eP('"tenants" must a string array or a boolean')],[eU('"token" must be string or undefined')])((e,r)=>{let i={};return"boolean"==typeof e?i.dct=e:i.ids=e,ef(t.post("/v1/auth/me/tenants",i,{token:r}))}),history:tS(e=>ef(t.get("/v1/auth/me/history",{token:e}))),isJwtExpired:tk(eu),getTenants:tk(eh),getJwtPermissions:tk(eg),getJwtRoles:tk(ep),getCurrentTenant:tk(ew),httpClient:t}}),{DeliveryMethods:eL});function tA(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var i in r)"__proto__"!==i&&(e[i]=r[i])}return e}e.s(["default",0,tj,"wrapWith",0,eH],292930);var tN=function e(t,r){function i(e,i,s){if("u">typeof document){"number"==typeof(s=tA({},r,s)).expires&&(s.expires=new Date(Date.now()+864e5*s.expires)),s.expires&&(s.expires=s.expires.toUTCString()),e=encodeURIComponent(e).replace(/%(2[346B]|5E|60|7C)/g,decode

2URIComponent).replace(/[()]/g,escape);var n="";for(var o in s)s[o]&&(n+="; "+o,!0!==s[o]&&(n+="="+s[o].split(";")[0]));return document.cookie=e+"="+t.write(i,e)+n}}return Object.create({set:i,get:function(e){if("u">typeof document&&(!arguments.length||e)){for(var r=document.cookie?document.cookie.split("; "):[],i={},s=0;s<r.length;s++){var n=r[s].split("="),o=n.slice(1).join("=");try{var a=decodeURIComponent(n[0]);if(a in i||(i[a]=t.read(o,a)),e===a)break}catch(e){}}return e?i[e]:i}},remove:function(e,t){i(e,"",tA({},t,{expires:-1}))},withAttributes:function(t){return e(this.converter,tA({},this.attributes,t))},withConverter:function(t){return e(tA({},this.converter,t),this.attributes)}},{attributes:{value:Object.freeze(r)},converter:{value:Object.freeze(t)}})}({read:function(e){return'"'===e[0]&&(e=e.slice(1,-1)),e.replace(/(%[\dA-F]{2})+/gi,decodeURIComponent)},write:function(e){return encodeURIComponent(e).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g,decodeURIComponent)}},{path:"/"});e.s(["default",0,tN],734804);var tD={default:"endpoint"},tq="Blocked by CSP",t$="The endpoint parameter is not a valid URL",tM="Failed to load the JS script of the agent",tH="9319",tJ="https://fpnpmcdn.net/v<version>/<apiKey>/loader_v<loaderVersion>.js";function tL(e){var t,r,i,s,n,o,a;return(t=function(){return new Promise(function(t,r){if(function(e){if(URL.prototype)try{return new URL(e,location.href),!1}catch(e){if(e instanceof Error&&"TypeError"===e.name)return!0;throw e}}(e))throw Error(t$);var i=document.createElement("script"),s=function(){var e;return null==(e=i.parentNode)?void 0:e.removeChild(i)},n=document.head||document.getElementsByTagName("head")[0];i.onload=function(){s(),t()},i.onerror=function(){s(),r(Error(tM))},i.async=!0,i.src=e,n.appendChild(i)})},r=function(){throw Error(tq)},s=document,n="securitypolicyviolation",o=function(t){var r=new URL(e,location.href),s=t.blockedURI;s!==r.href&&s!==r.protocol.slice(0,-1)&&s!==r.origin||(i=t,a())},s.addEventListener(n,o),a=function(){return s.removeEventListener(n,o)},Promise.resolve().then(t).then(function(e){return a(),e},function(e){return new Promise(function(e){var t=new MessageChannel;t.port1.onmessage=function(){return e()},t.port2.postMessage(null)}).then(function(){if(a(),i)return r(i);throw e})})).then(tK)}function tK(){var e,t,r=window,i="__fpjs_p_l_b",s=r[i];if((null==(t=null==(e=Object.getOwnPropertyDescriptor)?void 0:e.call(Object,r,i))?void 0:t.configurable)?delete r[i]:t&&!t.writable||(r[i]=void 0),"function"!=typeof(null==s?void 0:s.load))throw Error(tH);return s}let tW="3.2.0",tF="u">typeof window,tB=`https://descopecdn.com/npm/oidc-client-ts@${tW}/dist/browser/oidc-client-ts.min.js`,tz=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${tW}/dist/browser/oidc-client-ts.min.js`,tV=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"],tG=e=>{try{return l(e).exp}catch(e){return null}},tZ=e=>{let{access_token:t,id_token:r,refresh_token:i,refresh_expire_in:s}=e,n=(0,o.__rest)(e,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:e.sessionJwt||t,idToken:r,refreshJwt:e.refreshJwt||i,sessionExpiration:e.sessionExpiration||(e=>{let{expires_in:t,expires_at:r,access_token:i}=e;return r||(t?Math.floor(Date.now()/1e3)+t:i?tG(i):void 0)})(e),cookieExpiration:e.cookieExpiration||(e=>{let{refresh_expire_in:t,refresh_token:r}=e;return t?Math.floor(Date.now()/1e3)+t:tG(r)})(e)},n)},tX=(e,t)=>{var r;return["beforeRequest","afterRequest"].reduce((r,i)=>{var s;return r[i]=[].concat((null==(s=e.hooks)?void 0:s[i])||[]).concat((null==t?void 0:t[i])||[]),r},null!=(r=e.hooks)?r:e.hooks={}),e},tQ=async e=>{if(!(null==e?void 0:e.ok))return{};let t=await (null==e?void 0:e.clone().json());return tZ((null==t?void 0:t.authInfo)||t||{})},tY=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;let r=(null==e?void 0:e.path)||"";return tV.includes(r)},t0=void 0!==r||tF&&void 0!==window.localStorage,t1=(e,t)=>{var i,s;return null==(s=null==(i=r||tF&&window.localStorage)?void 0:i.setItem)?void 0:s.call(i,e,t)},t2=e=>{var t,i;return null==(i=null==(t=r||tF&&window.localStorage)?void 0:t.getItem)?void 0:i.call(t,e)},t3=e=>{var t,i;return null==(i=null==(t=r||tF&&window.localStorage)?void 0:t.removeItem)?void 0:i.call(t,e)},t6=e=>{var t,i,s,n,o;return null!=(o=null!=(i=null==(t=null==r?void 0:r.key)?void 0:t.call(r,e))?i:tF&&(null==(n=null==(s=window.localStorage)?void 0:s.key)?void 0:n.call(s,e)))?o:null},t4=e=>{var t,r;return tF&&(null==(r=null==(t=window.localStorage)?void 0:t.getItem)?void 0:r.call(t,e))||null},t5=e=>{var t,r;try{tF&&(null==(r=null==(t=window.localStorage)?void 0:t.removeItem)||r.call(t,e))}catch(e){}},t8=(...e)=>{console.debug(...e)},t7=(...e)=>{console.warn(...e)},t9="DSRCN";function re(e,t,r){if(t){let{cookieDomain:i,cookiePath:s,cookieSameSite:n,cookieExpiration:o,cookieSecure:a}

2=r,l=new Date(1e3*o),c=rt(i);tN.set(e,t,{path:s,domain:c?i:void 0,expires:l,sameSite:n,secure:a})}}function rt(e){let t=window.location.hostname.split("."),r=null==e?void 0:e.split(".");return t.slice(-(null==r?void 0:r.length)).join(".")===e}let rr=e=>(null==e?void 0:e.cookieName)||"DS",ri=e=>(null==e?void 0:e.cookieName)||"DSR";function rs(e="",t){return tN.get(ri(t))||t2(`${e}DSR`)||""}function rn(e="",t){return tN.get(rr(t))||t2(`${e}DS`)||""}function ro(e=""){return t2(`${e}DSI`)||""}function ra(e="",t,r,i){t3(`${e}DSR`),t3(`${e}DS`),t3(`${e}DSI`),t3(`${e}${t9}`);let s=rr(t);tN.remove(s,null==i?void 0:i.session);let n=ri(r);tN.remove(n,null==i?void 0:i.refresh)}let rl=tF&&(null==localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",rc=(e=!1)=>{let t=t2("fp");if(!t)return null;let r=JSON.parse(t);return(new Date).getTime()>r.expiry&&!e?null:r.value},rd=async(e,t=rl)=>{try{var r,i,s,n,a,l,c,d,u,h,g,p,_,f,w,m;let v;if(rc())return;let y=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),b=new URL(t);b.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";let k=new URL(t);k.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";let S=k.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",I=((r={apiKey:e,endpoint:[b.toString(),tD],scriptUrlPattern:[S,tJ]}).scriptUrlPattern,u=r.token,h=r.apiKey,g=void 0===h?u:h,p=(0,o.__rest)(r,["scriptUrlPattern","token","apiKey"]),_=null!==(i="scriptUrlPattern",d=Object.prototype.hasOwnProperty.call(r,i)?r[i]:void 0)&&void 0!==d?d:tJ,w=(a=[],l=function(){a.push({time:new Date,state:document.visibilityState})},s=document,n="visibilitychange",s.addEventListener(n,l,void 0),c=function(){return s.removeEventListener(n,l,void 0)},l(),f=[a,c])[0],m=f[1],Promise.resolve().then(function(){if(!g||"string"!=typeof g)throw Error("API key required");return function(e,t){var r,i,s,n,a,l,c=[],d=(r=(0,o.__spreadArray)([],e,!0),i={current:function(){return r[0]},postpone:function(){var e=r.shift();void 0!==e&&r.push(e)},exclude:function(){r.shift()}},a=0,s=function(){return Math.random()*Math.min(3e3,100*Math.pow(2,a++))},n=new Set,[i.current(),function(e,t){var r,o=t instanceof Error?t.message:"";if(o===tq||o===t$)i.exclude(),r=0;else if(o===tH)i.exclude();else if(o===tM){var a=Date.now()-e.getTime()<50,l=i.current();l&&a&&!n.has(l)&&(n.add(l),r=0),i.postpone()}else i.postpone();var c=i.current();return void 0===c?void 0:[c,null!=r?r:e.getTime()+s()-Date.now()]}]),u=d[0],h=d[1];if(void 0===u)return Promise.reject(TypeError("The list of script URL patterns is empty"));var g=function(e){var r=new Date,i=function(t){return c.push({url:e,startedAt:r,finishedAt:new Date,error:t})},s=t(e);return s.then(function(){return i()},i),s.catch(function(e){if(null!=l||(l=e),c.length>=5)throw l;var t=h(r,e);if(!t)throw l;var i=t[0],s=t[1];return new Promise(function(e){return setTimeout(e,s)}).then(function(){return g(i)})})};return g(u).then(function(e){return[e,c]})}((Array.isArray(_)?_:[_]).map(function(e){var t,r;return t=String(e),r=encodeURIComponent,t.replace(/<[^<>]+>/g,function(e){return"<version>"===e?"3":"<apiKey>"===e?r(g):"<loaderVersion>"===e?r("3.11.6"):e})}),tL)}).catch(function(e){throw m(),e instanceof Error&&e.message===tH?Error(tM):e}).then(function(e){var t=e[0],r=e[1];return m(),t.load((0,o.__assign)((0,o.__assign)({},p),{ldi:{attempts:r,visibilityStates:w}}))})),O=await I,{requestId:E}=await O.get({linkedId:y});v={value:{vsid:y,vrid:E},expiry:(new Date).getTime()+864e5},t1("fp",JSON.stringify(v))}catch(e){console.warn("Could not load fingerprint",e)}},ru=e=>{let t=rc(!0);return t&&e.body&&(e.body.fpData=t),e},rh="descopeFlowNonce",rg="X-Descope-Flow-Nonce",rp="/v1/flow/start",r_="/v1/flow/next",rf=(e,t=rh)=>`${t}${e}`,rw=e=>{var t;return(null==(t=/.*\|#\|(.*)/.exec(e))?void 0:t[1])||null},rm=e=>{var t;return e.path===r_&&(null==(t=e.body)?void 0:t.executionId)?rw(e.body.executionId):null},rv="dls_last_user_login_id",ry="dls_last_user_display_name",rb=()=>t2(rv),rk=()=>t2(ry),rS=e=>async(...t)=>{t[1]=t[1]||{};let[,r={}]=t,i=rb(),s=rk();return i&&(null!=r.lastAuth||(r.lastAuth={}),r.lastAuth.loginId=i,r.lastAuth.name=s),await e(...t)},rI="DSLI",rO=e=>async(...t)=>{let r=await e(...t);return t5(rI),r};function rE(){let e=[];return{pub:t=>

2{e.forEach(e=>e(t))},sub:t=>{let r=e.push(t)-1;return()=>e.splice(r,1)}}}async function rT(e){var t;let r,i=((r=JSON.parse(e)).publicKey.challenge=rA(r.publicKey.challenge),r.publicKey.user.id=rA(r.publicKey.user.id),null==(t=r.publicKey.excludeCredentials)||t.forEach(e=>{e.id=rA(e.id)}),r);try{let e=await navigator.credentials.create(i);return JSON.stringify({id:e.id,rawId:rN(e.rawId),type:e.type,response:{attestationObject:rN(e.response.attestationObject),clientDataJSON:rN(e.response.clientDataJSON)}})}catch(e){throw await rC(e,i,!0)}}async function rR(e){let t=rP(e);try{return rj(await navigator.credentials.get(t))}catch(e){throw await rC(e,t,!1)}}async function rx(e,t){let r=rP(e);r.signal=t.signal,r.mediation="conditional";try{return rj(await navigator.credentials.get(r))}catch(e){throw await rC(e,r,!1)}}async function rC(e,t,r){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,r){var i,s;let n=null==e?void 0:e.name;if("AbortError"===n&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===n&&r)return"authenticator_already_registered";if("NotSupportedError"===n)return"no_supported_algorithm";if("ConstraintError"===n)return"authenticator_constraints_unsupported";if("SecurityError"===n){let e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await rU())return"webauthn_unsupported";let o="platform"===(null==(s=null==(i=null==t?void 0:t.publicKey)?void 0:i.authenticatorSelection)?void 0:s.authenticatorAttachment);return r&&o&&!await rU(!0)?"platform_authenticator_unsupported":"NotAllowedError"===n?"not_allowed":"unknown"}(e,t,r)}catch(e){}return e}async function rU(e=!1){var t,r;if(!tF)return Promise.resolve(!1);if(tF&&window.descopeBridge){let e=null==(r=null==(t=window.descopeBridge)?void 0:t.hostInfo)?void 0:r.webauthn;if("boolean"==typeof e)return e}let i=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return i&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():i}function rP(e){var t;let r=JSON.parse(e);return r.publicKey.challenge=rA(r.publicKey.challenge),null==(t=r.publicKey.allowCredentials)||t.forEach(e=>{e.id=rA(e.id)}),r}function rj(e){return JSON.stringify({id:e.id,rawId:rN(e.rawId),type:e.type,response:{authenticatorData:rN(e.response.authenticatorData),clientDataJSON:rN(e.response.clientDataJSON),signature:rN(e.response.signature),userHandle:e.response.userHandle?rN(e.response.userHandle):void 0}})}function rA(e){let t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),e=>e.charCodeAt(0)).buffer}function rN(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var rD,rq=(rD=e=>({async signUp(t,r,i){let s=await e.webauthn.signUp.start(t,window.location.origin,r,i);if(!s.ok)return s;let n=await rT(s.data.options);

2return await e.webauthn.signUp.finish(s.data.transactionId,n)},async signIn(t,r){let i=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,r);if(!i.ok)return i;let s=await rR(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,s)},async signUpOrIn(t,r){var i;let s=await e.webauthn.signUpOrIn.start(t,window.location.origin,r);if(!s.ok)return s;if(null==(i=s.data)?void 0:i.create){let t=await rT(s.data.options);return await e.webauthn.signUp.finish(s.data.transactionId,t)}{let t=await rR(s.data.options);return await e.webauthn.signIn.finish(s.data.transactionId,t)}},async update(t,r,i){let s=await e.webauthn.update.start(t,window.location.origin,r,i);if(!s.ok)return s;let n=await rT(s.data.options);return await e.webauthn.update.finish(s.data.transactionId,n)},helpers:{create:rT,get:rR,isSupported:rU,conditional:rx}}),(...e)=>{let t=rD(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});let r$="/fedcm/config";async function rM(e,t){var r;try{await rH(e,t)}catch(e){null==(r=null==t?void 0:t.onFailed)||r.call(t,e)}}async function rH(e,t){var r,i;let s=await async function(e,t="google",r,i,s){let n=(()=>{if(window.crypto&&window.crypto.getRandomValues){let e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,e=>e.toString(16).padStart(2,"0")).join("")}return Math.random().toString(36).substring(2)})(),o=await async function(){return new Promise((e,t)=>{if(window.google)return void e(window.google.accounts.id);let r=document.getElementById("google-gsi-client-script");r||(r=document.createElement("script"),document.head.appendChild(r),r.async=!0,r.defer=!0,r.id="google-gsi-client-script",r.src="https://accounts.google.com/gsi/client"),r.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},r.onerror=function(){t("Failed to load Google GSI client script - failed to load")}})}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw Error("Failed to get OneTap client ID for provider "+t);let l=a.data.clientId;return new Promise(e=>{var a,c;let d=r=>{e({provider:t,nonce:n,credential:null==r?void 0:r.credential})};o.initialize(Object.assign(Object.assign({}

2,r),{itp_support:null==(a=null==r?void 0:r.itp_support)||a,use_fedcm_for_prompt:null==(c=null==r?void 0:r.use_fedcm_for_prompt)||c,client_id:l,callback:d,nonce:n})),o.prompt(e=>{var t,r;if(s&&(null==e?void 0:e.isDismissedMoment())){let r=null==(t=e.getDismissedReason)?void 0:t.call(e);return null==s||s(r),void d()}if(i&&(null==e?void 0:e.isSkippedMoment())){let t=null==(r=e.getSkippedReason)?void 0:r.call(e);return null==i||i(t),void d()}})})}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!s.credential)return null;if(null==t?void 0:t.onCodeReceived){let i=await e.oauth.verifyOneTapIDToken(s.provider,s.credential,s.nonce,null==t?void 0:t.loginOptions);if(!i.ok||!i.data)throw Error("Failed to verify OneTap client ID for provider "+s.provider);null==(r=null==t?void 0:t.onCodeReceived)||r.call(t,i.data.code)}else{let r=await e.oauth.exchangeOneTapIDToken(s.provider,s.credential,s.nonce,null==t?void 0:t.loginOptions);if(!r.ok||!r.data)throw Error("Failed to exchange OneTap client ID for provider "+s.provider);null==(i=null==t?void 0:t.onAuthenticated)||i.call(t,r.data)}}let rJ=(e,t)=>new Promise((r,i)=>{if(!e.length)return i(Error("No URLs provided to loadScriptWithFallback"));let s=t();if(s)return r(s);let n=e.shift(),o=document.createElement("script");o.src=n,o.id=(e=>{let t=0;for(let r=0;r<e.length;r++)t=(t<<5)-t+e.charCodeAt(r)|0;return Math.abs(t).toString(16)})(n),o.onload=()=>{let e=t();if(e)return r(e);throw Error("Could not get entry after loading script from URL")},o.addEventListener("error",()=>{rJ(e,t),o.setAttribute("data-error","true")}),document.body.appendChild(o)}),rL=async(t,r,s)=>{let n,o,a,l;i||(i=(async()=>{try{return e.r(16404)}catch(e){return rJ([tB,tz],()=>window.oidc)}})());let{OidcClient:c,WebStorageStateStore:d}=await i;if(!c)throw Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");let u=(null==s?void 0:s.redirectUri)||window.location.href;if(null==s?void 0:s.issuer){if(!s.clientId)throw Error("clientId is required when providing a custom issuer/authority");n=s.issuer,o=s.clientId,a=`${o}_user`,l="openid"}else(null==s?void 0:s.applicationId)?(n=t.httpClient.buildUrl(r),n=`${n}/${s.applicationId}`):n=t.httpClient.buildUrl(r),o=r,a=`${o}_user`,l="openid email roles descope.custom_claims offline_access";let h={authority:n,client_id:o,redirect_uri:u,response_type:"code",scope:(null==s?void 0:s.scope)||l,stateStore:new d({store:window.localStorage,prefix:o}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==s?void 0:s.redirectUri)&&(h.redirect_uri=s.redirectUri),{client:new c(h),stateUserKey:a}},rK=(function(...e){return t=>e.reduce((e,t)=>t(e),t)})(e=>t=>(r=t.customStorage,e(t)),e=>t=>{var{fpKey:r,fpLoad:i}=t,s=(0,o.__rest)(t,["fpKey","fpLoad"]);return tF?(r&&i&&rd(r).catch(()=>null),e(tX(s,{beforeRequest:ru}))):e(s)},e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.3"},t.baseHeaders)})),e=>t=>{let r=rE(),i=rE(),s=rE(),n=rE();return Object.assign(eH(e(tX(t,{afterRequest:async(e,t)=>{if(tY(e,t))t8("Session invalidated, notifying subscribers with empty values"),i.pub(null),s.pub(null),r.pub(null),n.pub(null);else{let e=await (async e=>{let t=await tQ(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&s.pub(e);let{sessionJwt:o,sessionExpiration:a,claims:l}=await tQ(t);o&&i.pub(o),l&&n.pub(l),(a||o)&&r.pub(a||42)}}})),["logout","logoutAll","oidc.logout"],e=>async(...t)=>{let o=await e(...t);return i.pub(null),s.pub(null),r.pub(null),n.pub(null),o}),{onSessionTokenChange:i.sub,onUserChange:s.sub,onClaimsChange:n.sub,onIsAuthenticatedChange:e=>r.sub(t=>{e(!!t)})})},e=>t=>{var i;let{enableFlowNonce:s=!0,nonceStoragePrefix:n=rh}=t,a=(0,o.__rest)(t,["enableFlowNonce","nonceStoragePrefix"]);if(!s)return e(a);((e=rh)=>{var t,i,s;try{if(!t0)return;for(let n=0;n<(t=void 0,i=void 0,s=void 0,null!=(s=null!=(t=null==r?void 0:r.length)?t:tF&&(null==(i=window.localStorage)?void 0:i.length))?s:0);n++){let t=t6(n);if(t&&t.startsWith(e)){let e=t2(t);if(e)try{JSON.parse(e).expiry<Date.now()&&t3(t)}catch(e){t3(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}})(n);let l=e(tX(a,{afterRequest:async(e,t)=>{if(e.path!==rp&&e.path!==r_)return;let{nonce:r,executionId:i}=await (async(e,t)=>{try{let r=t.headers.get(rg),i=await t.clone().json().then(e=>

2(null==e?void 0:e.executionId)||null).catch(()=>null);return i||(i=rm(e)),{nonce:r,executionId:rw(i)}}catch(e){return{nonce:null,executionId:null}}})(e,t);r&&i&&((e,t,r,i=rh)=>{try{let s=rf(e,i),n={value:t,expiry:Date.now()+1e3*(r?172800:10800),isStart:r};t1(s,JSON.stringify(n))}catch(e){console.error("Error setting flow nonce:",e)}})(i,r,e.path===rp,n)},beforeRequest:e=>{if(e.path===r_){let t=rm(e);if(t){let r=((e,t=rh)=>{try{let r=rf(e,t),i=t2(r);if(!i)return null;let s=JSON.parse(i);return s.expiry<Date.now()?(((e,t=rh)=>{try{let r=rf(e,t);t3(r)}catch(e){console.error("Error removing flow nonce:",e)}})(e,t),null):s.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,n);r&&(e.headers=e.headers||{},e.headers[rg]=r)}}return e}}));if(null==(i=l.flow)?void 0:i.next){let e=Promise.resolve(),t=l.flow.next.bind(l.flow);l.flow.next=async(...r)=>{let i,s=e;e=new Promise(e=>{i=e}),await s;try{return await t(...r)}finally{i()}}}return l},e=>t=>eH(e(tX(t,{afterRequest:async(e,t)=>{if(tY(e,t))return void t5(rI);let r=await tQ(t);(null==r?void 0:r.sessionExpiration)&&((e,t)=>{var r,i;try{tF&&(null==(i=null==(r=window.localStorage)?void 0:r.setItem)||i.call(r,e,t))}catch(e){}})(rI,String(r.sessionExpiration))}})),["logout","logoutAll","oidc.logout"],rO),e=>t=>{let r,i;var{autoRefresh:s}=t,n=(0,o.__rest)(t,["autoRefresh"]);let a=!!s,c="object"==typeof s&&(null==s?void 0:s.customActivityTracking);if(!a||tF&&window.descopeBridge)return Object.assign(e(n),{markUserActive:()=>{t7("markUserActive() called but has no effect")}});let{clearAllTimers:d,setTimer:u}=(r=[],{clearAllTimers:()=>{for(;r.length;)clearTimeout(r.pop())},setTimer:(e,t)=>{r.push(setTimeout(e,t))}}),h,g,p=null,_=!1,f=!1;c&&(t8("Activity-based refresh enabled"),i=!0,p={hadActivity:()=>i,reset:()=>{i=!1},markActive:()=>{i=!0}}),tF&&document.addEventListener("visibilitychange",()=>{"visible"===document.visibilityState&&h&&new Date>h&&(t8("Expiration time passed, refreshing session"),w.refresh(rs()||g))});let w=e(tX(n,{afterRequest:async(e,t)=>{let{sessionJwt:r,refreshJwt:i,sessionExpiration:s,nextRefreshSeconds:n}=await tQ(t);if(tY(e,t))t8("Session invalidated, canceling all timers"),d();else if(r||s){var o,a;let e;if(!(h=((e,t)=>{if(t)return new Date(1e3*t);t8("Could not extract expiration time from session token, trying to decode the token");try{let t=l(e);if(t.exp)return new Date(1e3*t.exp)}catch(e){return null}})(r,s)))return void t8("Could not extract expiration time from session token");g=i,_=n>0;let t=(o=h,(a=n)>0?(e=1e3*a,t8(`Using provided nextRefreshSeconds: ${a}s`)):e=(o?o.getTime()-(new Date).getTime():0)-2e4,e>0x7fffffff&&(t8(`Timeout is too large (${e}ms), setting it to 2147483647ms`),e=0x7fffffff),e);if(d(),t<=2e4)return void t8("Session is too close to expiration, not setting refresh timer");let c=new Date(Date.now()+t).toLocaleTimeString("en-US",{hour12:!1});t8(`Setting refresh timer for ${c}. (${t}ms)`),p&&(p.reset(),f=!1),u(()=>{if(tF&&"hidden"===document.visibilityState)t8("Skipping refresh due to timer - document is hidden");else{if(p&&_&&!p.hadActivity())return t8("Skipping refresh due to timer - user is idle"),void(f=!0);t8("Refreshing session due to timer"),w.refresh(rs()||i)}},t)}}}));return Object.assign(eH(w,["logout","logoutAll","oidc.logout"],e=>async(...t)=>{let r=await e(...t);return t8("Clearing all timers"),d(),r}),{markUserActive:p?()=>{t8("markUserActive() called"),_||t8("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),p.markActive(),f&&(t8("User became active after skipped refresh, triggering refresh"),f=!1,d(),w.refresh(rs()||g))}:()=>{t7("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})},e=>t=>{var{storeLastAuthenticatedUser:r=!0,keepLastAuthenticatedUserAfterLogout:i=!1}=t,s=(0,o.__rest)(t,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!r)return Object.assign(e(s),{getLastUserLoginId:rb,getLastUserDisplayName:rk});let n=eH(e(tX(s,{afterRequest:async(e,t)=>{var r;let{userInfo:i,lastAuth:s}=await (async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};

2let t=await (null==e?void 0:e.clone().json()),r=tZ((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==r?void 0:r.user)||((null==r?void 0:r.hasOwnProperty("userId"))?r:void 0),lastAuth:t.lastAuth}})(t),n=null==(r=null==i?void 0:i.loginIds)?void 0:r[0],o=null==i?void 0:i.name;n?(t1(rv,n),t1(ry,o)):(null==s?void 0:s.loginId)&&t1(rv,s.loginId)}})),["flow.start"],rS);return Object.assign(n=eH(n,["logout","logoutAll"],e=>async(...t)=>{let r=await e(...t);return i||(t3(rv),t3(ry)),r}),{getLastUserLoginId:rb,getLastUserDisplayName:rk})},e=>t=>{let r,i;var{persistTokens:s,sessionTokenViaCookie:n,refreshTokenViaCookie:a,storagePrefix:l,refreshCookieName:c}=t,d=(0,o.__rest)(t,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);return s&&tF?Object.assign(eH(e(tX(Object.assign({refreshCookieName:c},d),{beforeRequest:e=>{let t=Object.assign(e,{token:e.token||rs(l,a)});if(!c){let e=function(e=""){return t2(`${e}${t9}`)}(l);e&&(t.headers=Object.assign(Object.assign({},t.headers||{}),{"x-descope-refresh-cookie-name":e}))}let r=function(e=""){return t2(`${e}DTD`)||""}(l);return r&&(t.headers=Object.assign(Object.assign({},t.headers||{}),{"x-descope-trusted-device-token":r})),t},afterRequest:async(e,t)=>{if(tY(e,t))t8("Session invalidated, clearing persisted tokens"),ra(l,n,a,r);else{let e=await tQ(t);e.cookieName?t1(`${l||""}${t9}`,e.cookieName):e.refreshJwt&&t3(`${l||""}${t9}`);let i=((e={},t=!1,r="",i=!1)=>{var s,n,o,a;let l,{sessionJwt:c,refreshJwt:d,trustedDeviceJwt:u}=e;if(d)if(i){t3(`${r}DSR`);let t=i.sameSite||"Strict",o=null==(s=i.secure)||s,a=null!=(n=i.domain)?n:e.cookieDomain,c=ri(i);o&&"https:"!==window.location.protocol&&t7("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");let u=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:o,cookieDomain:a});re(c,d,u);let h=rt(a);l=Object.assign(Object.assign({},l),{refresh:{path:u.cookiePath,domain:h?a:void 0}})}else{let e=ri(i);tN.remove(e),t1(`${r}DSR`,d)}if(c)if(t){let r=t.sameSite||"Strict",i=null==(o=t.secure)||o,s=null!=(a=t.domain)?a:e.cookieDomain,n=rr(t);i&&"https:"!==window.location.protocol&&t7("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");let d=Object.assign(Object.assign({},e),{cookieSameSite:r,cookieSecure:i,cookieDomain:s});re(n,c,d);let u=rt(s);l=Object.assign(Object.assign({},l),{session:{path:d.cookiePath,domain:u?s:void 0}})}else t1(`${r}DS`,c);return e.idToken&&t1(`${r}DSI`,e.idToken),u&&t1(`${r}DTD`,u),l})(e,n,l,a);i&&(r=i)}}})),["logout","logoutAll","oidc.logout"],(i=()=>r,e=>async(...t)=>{let r=await e(...t);return ra(l,n,a,null==i?void 0:i()),r})),{getRefreshToken:()=>rs(l,a),getSessionToken:()=>rn(l,n),getIdToken:()=>ro(l)}):e(Object.assign({refreshCookieName:c},d))})(e=>{var t,r,i;let s,n,o=tj(e),a=(r=e.projectId,i=e.oidcConfig,s=async()=>{let e,t;return e&&t||({client:e,stateUserKey:t}=await rL(o,r,i)),{client:e,stateUserKey:t}},{loginWithRedirect:async(e={},t=!1)=>{var r;let{client:i}=await s(),n=await i.createSigninRequest(e),{url:a}=n;return t||(await (null==(r=o.httpClient.hooks)?void 0:r.afterRequest

2({},new Response(JSON.stringify(n)))),window.location.href=a),{ok:!0,data:n}},finishLogin:n=async(e="")=>{var t;let r,{client:i,stateUserKey:n}=await s(),a=await i.processSigninResponse(e||window.location.href);return await (null==(t=o.httpClient.hooks)?void 0:t.afterRequest({},new Response(JSON.stringify(a)))),t1(n,JSON.stringify({id_token:a.id_token,session_state:a.session_state,profile:a.profile})),(r=new URL(window.location.href)).searchParams.delete("code"),r.searchParams.delete("state"),window.history.replaceState({},document.title,r.toString()),a},finishLoginIfNeed:async(e="")=>{if(window.location.search.includes("code")&&window.location.search.includes("state"))return await n(e)},refreshToken:async e=>{var t;let r,{client:i,stateUserKey:n}=await s(),a=(r=t2(n))?JSON.parse(r):null;if(!a)throw Error("User not found in storage to refresh token");let l=e;if(!l){let e={};o.httpClient.hooks.beforeRequest(e),l=e.token}let c=await i.useRefreshToken({state:{refresh_token:l,session_state:a.session_state,profile:a.profile}});return await (null==(t=o.httpClient.hooks)?void 0:t.afterRequest

2({},new Response(JSON.stringify(c)))),c},logout:async(e,t=!1)=>{let{client:r,stateUserKey:i}=await s();e||(e={}),e.id_token_hint=e.id_token_hint||ro(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;let n=await r.createSignoutRequest(e),{url:o}=n;return t3(i),t||window.location.replace(o),n}});return Object.assign(Object.assign({},o),{refresh:async(t,r)=>{var i;if(tF&&window.descopeBridge)return t8(`Refresh called in native flow: ${Error().stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await a.refreshToken(t),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(r&&tF&&void 0!==window.localStorage&&!t4(rI)&&!t2(rv)&&!t4("DSLI_DISABLED"))return Promise.resolve({ok:!0});let s=rn(),n=rs(),l="";if(e.getExternalToken)try{l=await (null==(i=e.getExternalToken)?void 0:i.call(e))}catch(e){t8("Error getting external token while refreshing",e)}return o.refresh(t,{dcs:s?"t":"f",dcr:n?"t":"f"},l,r)},logout:async t=>{if(e.oidcConfig)try{return await a.logout({id_token_hint:t}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return o.logout(t)},flow:Object.assign(Object.assign({},o.flow),{start:async(...e)=>{let t=await rU(),r=Object.assign(Object.assign({location:window.location.href},e[1]),{deviceInfo:{webAuthnSupport:t},startOptionsVersion:1});return e[1]=r,o.flow.start(...e)}}),webauthn:rq(o),fedcm:(t=e.projectId,{onetap:{requestExchangeCode(e){rM(o,e)},requestAuthentication(e){rM(o,e)}},async oneTap(e,t,r,i,s){await rH(o,{provider:e,oneTapConfig:t,loginOptions:r,onSkipped:i,onDismissed:s})},async launch(e){var r;let i={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(t+r$),clientId:t}]}},s=await (null==(r=navigator.credentials)?void 0:r.get(i));return o.refresh(s.token)},isSupported:()=>tF&&"IdentityCredential"in window,async isLoggedIn(e){var r;let i=o.httpClient.buildUrl(t+r$);try{let s=await (null==(r=navigator.credentials)?void 0:r.get({identity:{context:e||"signin",providers:[{configURL:i,clientId:t}]}}));return!!s&&!!s.token}catch(e){return!1}}}),oidc:a})});e.s(["clearFingerprintData",0,()=>{t3("fp")},"createSdk",0,rK,"default",0,rK,"ensureFingerprintIds",0,rd,"getSessionToken",0,rn],698637)}]);
3
4//# debugId=f2f74e79-34dc-c188-deb0-a01db90bd180