https://www.jakmarketing.co.uk/static/js/1386.641d7289.chunk.js

1"use strict";(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__||[]).push([[1386],{61386:(e,t,n)=>{var r,o;let s;if(n.r(t),n.d(t,{OperationProcessingError:()=>w,UnsupportedOperationError:()=>h,authorizationCodeGrantRequest:()=>ve,calculatePKCECodeChallenge:()=>J,clientCredentialsGrantRequest:()=>xe,clockSkew:()=>i,clockTolerance:()=>a,deviceAuthorizationRequest:()=>Ze,deviceCodeGrantRequest:()=>Xe,discoveryRequest:()=>E,expectNoNonce:()=>Ee,expectNoState:()=>Be,generateKeyPair:()=>et,generateRandomCodeVerifier:()=>P,generateRandomNonce:()=>j,generateRandomState:()=>x,getValidatedIdTokenClaims:()=>he,introspectionRequest:()=>Ue,isOAuth2Error:()=>Q,issueRequestObject:()=>G,parseWwwAuthenticateChallenges:()=>ee,processAuthorizationCodeOAuth2Response:()=>Ae,processAuthorizationCodeOpenIDResponse:()=>Re,processClientCredentialsResponse:()=>je,processDeviceAuthorizationResponse:()=>Qe,processDeviceCodeResponse:()=>Ye,processDiscoveryResponse:()=>R,processIntrospectionResponse:()=>De,processPushedAuthorizationResponse:()=>te,processRefreshTokenResponse:()=>fe,processRevocationResponse:()=>Le,processUserInfoResponse:()=>ce,protectedResourceRequest:()=>ne,pushedAuthorizationRequest:()=>Z,refreshTokenGrantRequest:()=>de,revocationRequest:()=>Je,skipAuthTimeCheck:()=>Te,skipStateCheck:()=>Ge,skipSubjectCheck:()=>ie,userInfoRequest:()=>re,validateAuthResponse:()=>Ve,validateJwtAuthResponse:()=>qe}),'undefined'==typeof navigator||null===(r=navigator.userAgent)||void 0===r||null===(o=r.startsWith)||void 0===o||!o.call(r,'Mozilla/5.0 ')){s=`${'oauth4webapi'}/${'v2.3.0'}`}const i=Symbol(),a=Symbol(),c=new TextEncoder,u=new TextDecoder;function p(e){return'string'==typeof e?c.encode(e):u.decode(e)}const d=32768;function l(e){return'string'==typeof e?function(e){try{const t=atob(e.replace(/-/g,'+').replace(/_/g,'/').replace(/\s/g,'')),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch{throw new TypeError('The input to be decoded is not correctly encoded.')}}(e):function(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));const t=[];for(let n=0;n<e.byteLength;n+=d)t.push(String.fromCharCode.apply(null,e.subarray(n,n+d)));return btoa(t.join('')).replace(/=/g,'').replace(/\+/g,'-').replace(/\//g,'_')}(e)}

1class h extends Error{constructor(e){var t;super(e??'operation not supported'),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}class w extends Error{constructor(e){var t;super(e),this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}}const f=w,y=new class{constructor(e){this.cache=new Map,this._cache=new Map,this.maxSize=e}get(e){let t=this.cache.get(e);return t||((t=this._cache.get(e))?(this.update(e,t),t):void 0)}has(e){return this.cache.has(e)||this._cache.has(e)}set(e,t){return this.cache.has(e)?this.cache.set(e,t):this.update(e,t),this}delete(e){return this.cache.has(e)?this.cache.delete(e):!!this._cache.has(e)&&this._cache.delete(e)}update(e,t){this.cache.set(e,t),this.cache.size>=this.maxSize&&(this._cache=this.cache,this.cache=new Map)}}(100);function m(e){return e instanceof CryptoKey}function b(e){return m(e)&&'private'===e.type}const _=['PS256','ES256','RS256','PS384','ES384','RS384','PS512','ES512','RS512','EdDSA'];function g(e){const t=new URL(e.url);return e.headers.has('dpop-nonce')&&y.set(t.origin,e.headers.get('dpop-nonce')),e}function v(e){return null!==e&&'object'==typeof e&&!Array.isArray(e)}function S(e){if(void 0!==e&&!(e instanceof Headers))throw new TypeError('"options.headers" must be an instance of Headers');const t=new Headers(e);if(s&&!t.has('user-agent')&&t.set('user-agent',s),t.has('authorization'))throw new TypeError('"options.headers" must not include the "authorization" header name');if(t.has('dpop'))throw new TypeError('"options.headers" must not include the "dpop" header name');return t}function k(e){if('function'==typeof e&&(e=e()),!(e instanceof AbortSignal))throw new TypeError('"options.signal" must return or be an instance of AbortSignal');return e}async function E(e,t){if(!(e instanceof URL))throw new TypeError('"issuerIdentifier" must be an instance of URL');if('https:'!==e.protocol&&'http:'!==e.protocol)throw new TypeError('"issuer.protocol" must be "https:" or "http:"');const n=new URL(e.href);switch(null==t?void 0:t.algorithm){case void 0:case'oidc':n.pathname=`${n.pathname}/.well-known/openid-configuration`.replace('//','/');break;case'oauth2':'/'===n.pathname?n.pathname=".well-known/oauth-authorization-server":n.pathname=`.well-known/oauth-authorization-server/${n.pathname}`.replace('//','/');break;default:throw new TypeError('"options.algorithm" must be "oidc" (default), or "oauth2"')}const r=S(null==t?void 0:t.headers);return r.set('accept','application/json'),fetch(n.href,{headers:r,method:'GET',redirect:'manual',signal:null!=t&&t.signal?k(t.signal):null}).then(g)}function T(e){return'string'==typeof e&&0!==e.length}async function R(e,t){if(!(e instanceof URL))throw new TypeError('"expectedIssuer" must be an instance of URL');if(!(t instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==t.status)throw new f('"response" is not a conform Authorization Server Metadata response');let n;Ce(t);try{n=await t.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(n))throw new f('"response" body must be a top level object');if(!T(n.issuer))throw new f('"response" body "issuer" property must be a non-empty string');if(new URL(n.issuer).href!==e.href)throw new f('"response" body "issuer" does not match "expectedIssuer"');return n}function A(){return l(crypto.getRandomValues(new Uint8Array(32)))}function P(){return A()}function x(){return A()}function j(){return A()}async function J(e){if(!T(e))throw new TypeError('"codeVerifier" must be a non-empty string');return l(await crypto.subtle.digest({name:'SHA-256'},p(e)))}function L(e){if(e instanceof CryptoKey)return{key:e};if(!((null==e?void 0:e.key)instanceof CryptoKey))return{};if(void 0!==e.kid&&!T(e.kid))throw new TypeError('"kid" must be a non-empty string');return{key:e.key,kid:e.kid}}function C(e){return encodeURIComponent(e).replace(/%20/g,'+')}function U(e){switch(e.algorithm.name){case'RSA-PSS':return function(e){switch(e.algorithm.hash.name){case'SHA-256':return'PS256';case'SHA-384':return'PS384';case'SHA-512':return'PS512';default:throw new h('unsupported RsaHashedKeyAlgorithm hash name')}}(e);case'RSASSA-PKCS1-v1_5':return function(e){switch(e.algorithm.hash.name){case'SHA-256':return'RS256';case'SHA-384':return'RS384';case'SHA-512':return'RS512';default:throw new h('unsupported RsaHashedKeyAlgorithm hash name')}}(e);case'ECDSA':return function(e){switch(e.algorithm.namedCurve){case'P-256':return'ES256';case'P-384':return'ES384';case'P-521':return'ES512';default:throw new h('unsupported EcKeyAlgorithm namedCurve')}}(e);case'Ed25519':case'Ed448':return'EdDSA';default:throw new h('unsupported CryptoKey algorithm name')}}function D(e){return Number.isFinite(e[i])?e[i]:0}function O(e){const t=e[a];return Number.isFinite(t)&&-1!==Math.sign(t)?t:30}function W(){return Math.floor(Date.now()/1e3)}async function z(e,t,n,r){return M({alg:U(n),kid:r},function(e,t){const n=W()+D(t);return{jti:A(),aud:[e.issuer,e.token_endpoint],exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}(e,t),n)}function K(e){if('object'!=typeof e||null===e)throw new TypeError('"as" must be an object');if(!T(e.issuer))throw new TypeError('"as.issuer" property must be a non-empty string');return!0}function $(e){if('object'!=typeof e||null===e)throw new TypeError('"client" must be an object');if(!T(e.client_id))throw new TypeError('"client.client_id" property must be a non-empty string');return!0}function N(e){if(!T(e))throw new TypeError('"client.client_secret" property must be a non-empty string');return e}function H(e,t){if(void 0!==t)throw new TypeError(`"options.clientPrivateKey" property must not be provided when ${e} client authentication method is used.`)}function q(e,t){if(void 0!==t)throw new TypeError(`"client.client_secret" property must not be provided when ${e} client authentication method is used.`)}async function I(e,t,n,r,o){switch(n.delete('client_secret'),n.delete('client_assertion_type'),n.delete('client_assertion'),t.token_endpoint_auth_method){case void 0:case'client_secret_basic':H('client_secret_basic',o),r.set('authorization',function(e,t){const n=C(e),r=C(t);return`Basic ${btoa(`${n}:${r}`)}`}(t.client_id,N(t.client_secret)));break;case'client_secret_post':H('client_secret_post',o),n.set('client_id',t.client_id),n.set('client_secret',N(t.client_secret));break;case'private_key_jwt':{if(q('private_key_jwt',t.client_secret),void 0===o)throw new TypeError('"options.clientPrivateKey" must be provided when "client.token_endpoint_auth_method" is "private_key_jwt"');const{key:r,kid:s}=L(o);if(!b(r))throw new TypeError('"options.clientPrivateKey.key" must be a private CryptoKey');n.set('client_id',t.client_id),n.set('client_assertion_type','urn:ietf:params:oauth:client-assertion-type:jwt-bearer'),n.set('client_assertion',await z(e,t,r,s));break}case'none':q('none',t.client_secret),H('none',o),n.set('client_id',t.client_id);break;default:throw new h('unsupported client token_endpoint_auth_method')}}async function M(e,t,n){if(!n.usages.includes('sign'))throw new TypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"');const r=`${l(p(JSON.stringify(e)))}.${l(p(JSON.stringify(t)))}`;return`${r}.${l(await crypto.subtle.sign($e(n),n,p(r)))}`}async function G(e,t,n,r){K(e),$(t),n=new URLSearchParams(n);const{key:o,kid:s}=L(r);

1if(!b(o))throw new TypeError('"privateKey.key" must be a private CryptoKey');n.set('client_id',t.client_id);const i=W()+D(t),a={...Object.fromEntries(n.entries()),jti:A(),aud:e.issuer,exp:i+60,iat:i,nbf:i,iss:t.client_id};let c;if(n.has('resource')&&(c=n.getAll('resource'))&&c.length>1&&(a.resource=c),n.has('claims')){const e=n.get('claims');if('[object Object]'===e)throw new f('"claims" parameter must be passed as a UTF-8 encoded JSON');try{a.claims=JSON.parse(e)}catch{throw new f('failed to parse the "claims" parameter as JSON')}if(!v(a.claims))throw new f('"claims" parameter must be a top level object')}return M({alg:U(o),typ:'oauth-authz-req+jwt',kid:s},a,o)}async function B(e,t,n,r,o,s){const{privateKey:i,publicKey:a,nonce:c=y.get(n.origin)}=t;if(!b(i))throw new TypeError('"DPoP.privateKey" must be a private CryptoKey');if(!m(u=a)||'public'!==u.type)throw new TypeError('"DPoP.publicKey" must be a public CryptoKey');var u;if(void 0!==c&&!T(c))throw new TypeError('"DPoP.nonce" must be a non-empty string or undefined');if(!a.extractable)throw new TypeError('"DPoP.publicKey.extractable" must be true');const d=W()+o,h=await M({alg:U(i),typ:'dpop+jwt',jwk:await F(a)},{iat:d,jti:A(),htm:r,nonce:c,htu:`${n.origin}${n.pathname}`,ath:s?l(await crypto.subtle.digest({name:'SHA-256'},p(s))):void 0},i);e.set('dpop',h)}let V;async function F(e){if(V||(V=new WeakMap),V.has(e))return V.get(e);const{kty:t,e:n,n:r,x:o,y:s,crv:i}=await crypto.subtle.exportKey('jwk',e),a={kty:t,e:n,n:r,x:o,y:s,crv:i};return V.set(e,a),a}async function Z(e,t,n,r){if(K(e),$(t),'string'!=typeof e.pushed_authorization_request_endpoint)throw new TypeError('"as.pushed_authorization_request_endpoint" must be a string');const o=new URL(e.pushed_authorization_request_endpoint),s=new URLSearchParams(n);s.set('client_id',t.client_id);const i=S(null==r?void 0:r.headers);return i.set('accept','application/json'),void 0!==(null==r?void 0:r.DPoP)&&await B(i,r.DPoP,o,'POST',D(t)),ue(e,t,'POST',o,s,i,r)}function Q(e){const t=e;return'object'==typeof t&&!Array.isArray(t)&&null!==t&&void 0!==t.error}const X=/((?:,|, )?[0-9a-zA-Z!#$%&'*+-.^_`|~]+=)/,Y=/(?:^|, ?)([0-9a-zA-Z!#$%&'*+\-.^_`|~]+)(?=$|[ ,])/g;function ee(e){if(!(e instanceof Response))throw new TypeError('"response" must be an instance of Response');if(!e.headers.has('www-authenticate'))return;const t=e.headers.get('www-authenticate'),n=[];for(const{1:e,index:r}of t.matchAll(Y))n.push([e,r]);if(!n.length)return;return n.map(((e,n,r)=>{let[o,s]=e;const i=r[n+1];let a;return a=i?t.slice(s,i[1]):t.slice(s),function(e,t){const n=t.split(X).slice(1);if(!n.length)return{scheme:e.toLowerCase(),parameters:{}};n[n.length-1]=n[n.length-1].replace(/,$/,'');const r={};for(let e=1;e<n.length;e+=2){const t=e;if('"'===n[t][0])for(;'"'!==n[t].slice(-1)&&++e<n.length;)n[t]+=n[e];r[n[t-1].replace(/^(?:, ?)|=$/g,'').toLowerCase()]=(o=n[t]).length>=2&&'"'===o[0]&&'"'===o[o.length-1]?o.slice(1,-1):o}var o;return{scheme:e.toLowerCase(),parameters:r}}(o,a)}))}async function te(e,t,n){if(K(e),$(t),!(n instanceof Response))throw new TypeError('"response" must be an instance of Response');if(201!==n.status){let e;if(e=await We(n))return e;throw new f('"response" is not a conform Pushed Authorization Request Endpoint response')}let r;Ce(n);try{r=await n.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(r))throw new f('"response" body must be a top level object');if(!T(r.request_uri))throw new f('"response" body "request_uri" property must be a non-empty string');if('number'!=typeof r.expires_in||r.expires_in<=0)throw new f('"response" body "expires_in" property must be a positive number');return r}async function ne(e,t,n,r,o,s){if(!T(e))throw new TypeError('"accessToken" must be a non-empty string');if(!(n instanceof URL))throw new TypeError('"url" must be an instance of URL');return r=S(r),void 0===(null==s?void 0:s.DPoP)?r.set('authorization',`Bearer ${e}`):(await B(r,s.DPoP,n,'GET',D({[i]:null==s?void 0:s.clockSkew}),e),r.set('authorization',`DPoP ${e}`)),fetch(n.href,{body:o,headers:r,method:t,redirect:'manual',signal:null!=s&&s.signal?k(s.signal):null}).then(g)}async function re(e,t,n,r){if(K(e),$(t),'string'!=typeof e.userinfo_endpoint)throw new TypeError('"as.userinfo_endpoint" must be a string');const o=new URL(e.userinfo_endpoint),s=S(null==r?void 0:r.headers);return t.userinfo_signed_response_alg?s.set('accept','application/jwt'):(s.set('accept','application/json'),s.append('accept','application/jwt')),ne(n,'GET',o,s,null,{...r,clockSkew:D(t)})}let oe;async function se(e,t,n){const{alg:r,kid:o}=n;let s,i,a;

1if(function(e){if(!_.includes(e))throw new h('unsupported JWS "alg" identifier')}(r),oe||(oe=new WeakMap),oe.has(e)){if(({jwks:s,age:i}=oe.get(e)),i>=300)return oe.delete(e),se(e,t,n)}else s=await async function(e,t){if(K(e),'string'!=typeof e.jwks_uri)throw new TypeError('"as.jwks_uri" must be a string');const n=new URL(e.jwks_uri),r=S(null==t?void 0:t.headers);return r.set('accept','application/json'),r.append('accept','application/jwk-set+json'),fetch(n.href,{headers:r,method:'GET',redirect:'manual',signal:null!=t&&t.signal?k(t.signal):null}).then(g)}(e,t).then(Oe),i=0,oe.set(e,{jwks:s,iat:W(),get age(){return W()-this.iat}});switch(r.slice(0,2)){case'RS':case'PS':a='RSA';break;case'ES':a='EC';break;case'Ed':a='OKP';break;default:throw new h}const c=s.keys.filter((e=>{var t;if(e.kty!==a)return!1;if(void 0!==o&&o!==e.kid)return!1;if(void 0!==e.alg&&r!==e.alg)return!1;if(void 0!==e.use&&'sig'!==e.use)return!1;if(!1===(null===(t=e.key_ops)||void 0===t?void 0:t.includes('verify')))return!1;switch(!0){case'ES256'===r&&'P-256'!==e.crv:case'ES384'===r&&'P-384'!==e.crv:case'ES512'===r&&'P-521'!==e.crv:case'EdDSA'===r&&!('Ed25519'===e.crv||'Ed448'===e.crv):return!1}return!0})),{0:u,length:p}=c;if(!p){if(i>=60)return oe.delete(e),se(e,t,n);throw new f('error when selecting a JWT verification key, no applicable keys found')}if(1!==p)throw new f('error when selecting a JWT verification key, multiple applicable keys found, a "kid" JWT Header Parameter is required');const d=await async function(e,t){const{ext:n,key_ops:r,use:o,...s}=t;return crypto.subtle.importKey('jwk',s,Fe(e,t.crv),!0,['verify'])}(r,u);if('public'!==d.type)throw new f('jwks_uri must only contain public keys');return d}const ie=Symbol();function ae(e){var t;return null===(t=e.headers.get('content-type'))||void 0===t?void 0:t.split(';')[0]}async function ce(e,t,n,r){if(K(e),$(t),!(r instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==r.status)throw new f('"response" is not a conform UserInfo Endpoint response');let o;if('application/jwt'===ae(r)){Ce(r);const{claims:n}=await He(await r.text(),Ie.bind(void 0,t.userinfo_signed_response_alg,e.userinfo_signing_alg_values_supported),Ne,D(t),O(t)).then(ye.bind(void 0,t.client_id)).then(be.bind(void 0,e.issuer));o=n}else{if(t.userinfo_signed_response_alg)throw new f('JWT UserInfo Response expected');Ce(r);try{o=await r.json()}catch{throw new f('failed to parse "response" body as JSON')}}if(!v(o))throw new f('"response" body must be a top level object');if(!T(o.sub))throw new f('"response" body "sub" property must be a non-empty string');if(n===ie);else{if(!T(n))throw new f('"expectedSubject" must be a non-empty string');if(o.sub!==n)throw new f('unexpected "response" body "sub" value')}return o}async function ue(e,t,n,r,o,s,i){return await I(e,t,o,s,null==i?void 0:i.clientPrivateKey),s.set('content-type','application/x-www-form-urlencoded;charset=UTF-8'),fetch(r.href,{body:o,headers:s,method:n,redirect:'manual',signal:null!=i&&i.signal?k(i.signal):null}).then(g)}async function pe(e,t,n,r,o){if('string'!=typeof e.token_endpoint)throw new TypeError('"as.token_endpoint" must be a string');const s=new URL(e.token_endpoint);r.set('grant_type',n);const i=S(null==o?void 0:o.headers);return i.set('accept','application/json'),void 0!==(null==o?void 0:o.DPoP)&&await B(i,o.DPoP,s,'POST',D(t)),ue(e,t,'POST',s,r,i,o)}async function de(e,t,n,r){if(K(e),$(t),!T(n))throw new TypeError('"refreshToken" must be a non-empty string');const o=new URLSearchParams(null==r?void 0:r.additionalParameters);return o.set('refresh_token',n),pe(e,t,'refresh_token',o,r)}const le=new WeakMap;function he(e){if(!e.id_token)return;const t=le.get(e);if(!t)throw new TypeError('"ref" was already garbage collected or did not resolve from the proper sources');return t}async function we(e,t,n){let r,o=arguments.length>3&&void 0!==arguments[3]&&arguments[3],s=arguments.length>4&&void 0!==arguments[4]&&arguments[4];if(K(e),$(t),!(n instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==n.status){let e;if(e=await We(n))return e;throw new f('"response" is not a conform Token Endpoint response')}Ce(n);try{r=await n.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(r))throw new f('"response" body must be a top level object');if(!T(r.access_token))throw new f('"response" body "access_token" property must be a non-empty string');

1if(!T(r.token_type))throw new f('"response" body "token_type" property must be a non-empty string');if(r.token_type=r.token_type.toLowerCase(),'dpop'!==r.token_type&&'bearer'!==r.token_type)throw new h('unsupported `token_type` value');if(void 0!==r.expires_in&&('number'!=typeof r.expires_in||r.expires_in<=0))throw new f('"response" body "expires_in" property must be a positive number');if(!s&&void 0!==r.refresh_token&&!T(r.refresh_token))throw new f('"response" body "refresh_token" property must be a non-empty string');if(void 0!==r.scope&&'string'!=typeof r.scope)throw new f('"response" body "scope" property must be a string');if(!o){if(void 0!==r.id_token&&!T(r.id_token))throw new f('"response" body "id_token" property must be a non-empty string');if(r.id_token){const{claims:n}=await He(r.id_token,Ie.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported),Ne,D(t),O(t)).then(ke.bind(void 0,['aud','exp','iat','iss','sub'])).then(_e.bind(void 0,e.issuer)).then(me.bind(void 0,t.client_id));if(Array.isArray(n.aud)&&1!==n.aud.length&&n.azp!==t.client_id)throw new f('unexpected ID Token "azp" (authorized party) claim value');if(t.require_auth_time&&'number'!=typeof n.auth_time)throw new f('unexpected ID Token "auth_time" (authentication time) claim value');le.set(r,n)}}return r}async function fe(e,t,n){return we(e,t,n)}function ye(e,t){return void 0!==t.claims.aud?me(e,t):t}function me(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw new f('unexpected JWT "aud" (audience) claim value')}else if(t.claims.aud!==e)throw new f('unexpected JWT "aud" (audience) claim value');return t}function be(e,t){return void 0!==t.claims.iss?_e(e,t):t}function _e(e,t){if(t.claims.iss!==e)throw new f('unexpected JWT "iss" (issuer) claim value');return t}const ge=new WeakSet;async function ve(e,t,n,r,o,s){if(K(e),$(t),!ge.has(n))throw new TypeError('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()');if(!T(r))throw new TypeError('"redirectUri" must be a non-empty string');if(!T(o))throw new TypeError('"codeVerifier" must be a non-empty string');const i=Me(n,'code');if(!i)throw new f('no authorization code in "callbackParameters"');const a=new URLSearchParams(null==s?void 0:s.additionalParameters);return a.set('redirect_uri',r),a.set('code_verifier',o),a.set('code',i),pe(e,t,'authorization_code',a,s)}const Se={aud:'audience',exp:'expiration time',iat:'issued at',iss:'issuer',sub:'subject'};function ke(e,t){for(const n of e)if(void 0===t.claims[n])throw new f(`JWT "${n}" (${Se[n]}) claim missing`);return t}const Ee=Symbol(),Te=Symbol();async function Re(e,t,n,r,o){const s=await we(e,t,n);if(Q(s))return s;if(!T(s.id_token))throw new f('"response" body "id_token" property must be a non-empty string');o??(o=t.default_max_age??Te);const i=he(s);if((t.require_auth_time||o!==Te)&&void 0===i.auth_time)throw new f('ID Token "auth_time" (authentication time) claim missing');if(o!==Te){if('number'!=typeof o||o<0)throw new TypeError('"options.max_age" must be a non-negative number');const e=W()+D(t),n=O(t);if(i.auth_time+o<e-n)throw new f('too much time has elapsed since the last End-User authentication')}switch(r){case void 0:case Ee:if(void 0!==i.nonce)throw new f('unexpected ID Token "nonce" claim value');break;default:if(!T(r))throw new TypeError('"expectedNonce" must be a non-empty string');if(void 0===i.nonce)throw new f('ID Token "nonce" claim missing');if(i.nonce!==r)throw new f('unexpected ID Token "nonce" claim value')}return s}async function Ae(e,t,n){const r=await we(e,t,n,!0);if(Q(r))return r;if(void 0!==r.id_token){if('string'==typeof r.id_token&&r.id_token.length)throw new f('Unexpected ID Token returned, use processAuthorizationCodeOpenIDResponse() for OpenID Connect callback processing');delete r.id_token}return r}function Pe(e,t){if('string'!=typeof t.header.typ||t.header.typ.toLowerCase().replace(/^application\//,'')!==e)throw new f('unexpected JWT "typ" header parameter value');return t}async function xe(e,t,n,r){return K(e),$(t),pe(e,t,'client_credentials',new URLSearchParams(n),r)}async function je(e,t,n){const r=await we(e,t,n,!0,!0);return Q(r),r}async function Je(e,t,n,r){if(K(e),$(t),!T(n))throw new TypeError('"token" must be a non-empty string');

1if('string'!=typeof e.revocation_endpoint)throw new TypeError('"as.revocation_endpoint" must be a string');const o=new URL(e.revocation_endpoint),s=new URLSearchParams(null==r?void 0:r.additionalParameters);s.set('token',n);const i=S(null==r?void 0:r.headers);return i.delete('accept'),ue(e,t,'POST',o,s,i,r)}async function Le(e){if(!(e instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==e.status){let t;if(t=await We(e))return t;throw new f('"response" is not a conform Revocation Endpoint response')}}function Ce(e){if(e.bodyUsed)throw new TypeError('"response" body has been used already')}async function Ue(e,t,n,r){if(K(e),$(t),!T(n))throw new TypeError('"token" must be a non-empty string');if('string'!=typeof e.introspection_endpoint)throw new TypeError('"as.introspection_endpoint" must be a string');const o=new URL(e.introspection_endpoint),s=new URLSearchParams(null==r?void 0:r.additionalParameters);s.set('token',n);const i=S(null==r?void 0:r.headers);return(null==r?void 0:r.requestJwtResponse)??t.introspection_signed_response_alg?i.set('accept','application/token-introspection+jwt'):i.set('accept','application/json'),ue(e,t,'POST',o,s,i,r)}async function De(e,t,n){if(K(e),$(t),!(n instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==n.status){let e;if(e=await We(n))return e;throw new f('"response" is not a conform Introspection Endpoint response')}let r;if('application/token-introspection+jwt'===ae(n)){Ce(n);const{claims:o}=await He(await n.text(),Ie.bind(void 0,t.introspection_signed_response_alg,e.introspection_signing_alg_values_supported),Ne,D(t),O(t)).then(Pe.bind(void 0,'token-introspection+jwt')).then(ke.bind(void 0,['aud','iat','iss'])).then(_e.bind(void 0,e.issuer)).then(me.bind(void 0,t.client_id));if(r=o.token_introspection,!v(r))throw new f('JWT "token_introspection" claim must be a JSON object')}else{Ce(n);try{r=await n.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(r))throw new f('"response" body must be a top level object')}if('boolean'!=typeof r.active)throw new f('"response" body "active" property must be a boolean');return r}async function Oe(e){if(!(e instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==e.status)throw new f('"response" is not a conform JSON Web Key Set response');let t;Ce(e);try{t=await e.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(t))throw new f('"response" body must be a top level object');if(!Array.isArray(t.keys))throw new f('"response" body "keys" property must be an array');if(!Array.prototype.every.call(t.keys,v))throw new f('"response" body "keys" property members must be JWK formatted objects');return t}async function We(e){if(e.status>399&&e.status<500){Ce(e);try{const t=await e.json();if(v(t)&&'string'==typeof t.error&&t.error.length)return void 0!==t.error_description&&'string'!=typeof t.error_description&&delete t.error_description,void 0!==t.error_uri&&'string'!=typeof t.error_uri&&delete t.error_uri,void 0!==t.algs&&'string'!=typeof t.algs&&delete t.algs,void 0!==t.scope&&'string'!=typeof t.scope&&delete t.scope,t}catch{}}}function ze(e){if('number'!=typeof e.modulusLength||e.modulusLength<2048)throw new f(`${e.name} modulusLength must be at least 2048 bits`)}function Ke(e){switch(e){case'P-256':return'SHA-256';case'P-384':return'SHA-384';case'P-521':return'SHA-512';default:throw new h}}function $e(e){switch(e.algorithm.name){case'ECDSA':return{name:e.algorithm.name,hash:{name:Ke(e.algorithm.namedCurve)}};case'RSA-PSS':switch(ze(e.algorithm),e.algorithm.hash.name){case'SHA-256':case'SHA-384':case'SHA-512':return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new h}case'RSASSA-PKCS1-v1_5':return ze(e.algorithm),{name:e.algorithm.name};case'Ed448':case'Ed25519':return{name:e.algorithm.name}}throw new h}const Ne=Symbol();async function He(e,t,n,r,o){const{0:s,1:i,2:a,length:c}=e.split('.');if(5===c)throw new h('JWE structure JWTs are not supported');if(3!==c)throw new f('Invalid JWT');let u;

1try{u=JSON.parse(p(l(s)))}catch{throw new f('failed to parse JWT Header body as base64url encoded JSON')}if(!v(u))throw new f('JWT Header must be a top level object');if(t(u),void 0!==u.crit)throw new f('unexpected JWT "crit" header parameter');const d=l(a);if(n!==Ne){const e=await n(u),t=`${s}.${i}`;if(!await crypto.subtle.verify($e(e),e,d,p(t)))throw new f('JWT signature verification failed')}let w;try{w=JSON.parse(p(l(i)))}catch{throw new f('failed to parse JWT Payload body as base64url encoded JSON')}if(!v(w))throw new f('JWT Payload must be a top level object');const y=W()+r;if(void 0!==w.exp){if('number'!=typeof w.exp)throw new f('unexpected JWT "exp" (expiration time) claim type');if(w.exp<=y-o)throw new f('unexpected JWT "exp" (expiration time) claim value, timestamp is <= now()')}if(void 0!==w.iat&&'number'!=typeof w.iat)throw new f('unexpected JWT "iat" (issued at) claim type');if(void 0!==w.iss&&'string'!=typeof w.iss)throw new f('unexpected JWT "iss" (issuer) claim type');if(void 0!==w.nbf){if('number'!=typeof w.nbf)throw new f('unexpected JWT "nbf" (not before) claim type');if(w.nbf>y+o)throw new f('unexpected JWT "nbf" (not before) claim value, timestamp is > now()')}if(void 0!==w.aud&&'string'!=typeof w.aud&&!Array.isArray(w.aud))throw new f('unexpected JWT "aud" (audience) claim type');return{header:u,claims:w,signature:d}}async function qe(e,t,n,r,o){if(K(e),$(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw new TypeError('"parameters" must be an instance of URLSearchParams, or URL');const s=Me(n,'response');if(!s)throw new f('"parameters" does not contain a JARM response');if('string'!=typeof e.jwks_uri)throw new TypeError('"as.jwks_uri" must be a string');const{claims:i}=await He(s,Ie.bind(void 0,t.authorization_signed_response_alg,e.authorization_signing_alg_values_supported),se.bind(void 0,e,o),D(t),O(t)).then(ke.bind(void 0,['aud','exp','iss'])).then(_e.bind(void 0,e.issuer)).then(me.bind(void 0,t.client_id)),a=new URLSearchParams;for(const[e,t]of Object.entries(i))'string'==typeof t&&'aud'!==e&&a.set(e,t);return Ve(e,t,a,r)}function Ie(e,t,n){if(void 0===e){if(Array.isArray(t)){if(!t.includes(n.alg))throw new f('unexpected JWT "alg" header parameter')}else if('RS256'!==n.alg)throw new f('unexpected JWT "alg" header parameter')}else if(n.alg!==e)throw new f('unexpected JWT "alg" header parameter')}function Me(e,t){const{0:n,length:r}=e.getAll(t);if(r>1)throw new f(`"${t}" parameter must be provided only once`);return n}const Ge=Symbol(),Be=Symbol();function Ve(e,t,n,r){if(K(e),$(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw new TypeError('"parameters" must be an instance of URLSearchParams, or URL');if(Me(n,'response'))throw new f('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()');const o=Me(n,'iss'),s=Me(n,'state');if(!o&&e.authorization_response_iss_parameter_supported)throw new f('response parameter "iss" (issuer) missing');if(o&&o!==e.issuer)throw new f('unexpected "iss" (issuer) response parameter value');switch(r){case void 0:case Be:if(void 0!==s)throw new f('unexpected "state" response parameter encountered');break;case Ge:break;default:if(!T(r))throw new f('"expectedState" must be a non-empty string');if(void 0===s)throw new f('response parameter "state" missing');if(s!==r)throw new f('unexpected "state" response parameter value')}const i=Me(n,'error');if(i)return{error:i,error_description:Me(n,'error_description'),error_uri:Me(n,'error_uri')};const a=Me(n,'id_token'),c=Me(n,'token');if(void 0!==a||void 0!==c)throw new h('implicit and hybrid flows are not supported');return u=new URLSearchParams(n),ge.add(u),u;var u}function Fe(e,t){switch(e){case'PS256':case'PS384':case'PS512':return{name:'RSA-PSS',hash:{name:`SHA-${e.slice(-3)}`}};case'RS256':case'RS384':case'RS512':return{name:'RSASSA-PKCS1-v1_5',hash:{name:`SHA-${e.slice(-3)}`}};case'ES256':case'ES384':return{name:'ECDSA',namedCurve:`P-${e.slice(-3)}`};case'ES512':return{name:'ECDSA',namedCurve:'P-521'};case'EdDSA':switch(t){case'Ed25519':return{name:'Ed25519'};case'Ed448':return{name:'Ed448'};default:throw new h}default:throw new h}}async function Ze(e,t,n,r){if(K(e),$(t),'string'!=typeof e.device_authorization_endpoint)throw new TypeError('"as.device_authorization_endpoint" must be a string');const o=new URL(e.device_authorization_endpoint),s=new URLSearchParams(n);s.set('client_id',t.client_id);const i=S(null==r?void 0:r.headers);return i.set('accept','application/json'),ue(e,t,'POST',o,s,i,r)}async function Qe(e,t,n){if(K(e),$(t),!(n instanceof Response))throw new TypeError('"response" must be an instance of Response');if(200!==n.status){let e;if(e=await We(n))return e;throw new f('"response" is not a conform Device Authorization Endpoint response')}let r;Ce(n);try{r=await n.json()}catch{throw new f('failed to parse "response" body as JSON')}if(!v(r))throw new f('"response" body must be a top level object');if(!T(r.device_code))throw new f('"response" body "device_code" property must be a non-empty string');

1if(!T(r.user_code))throw new f('"response" body "user_code" property must be a non-empty string');if(!T(r.verification_uri))throw new f('"response" body "verification_uri" property must be a non-empty string');if('number'!=typeof r.expires_in||r.expires_in<=0)throw new f('"response" body "expires_in" property must be a positive number');if(void 0!==r.verification_uri_complete&&!T(r.verification_uri_complete))throw new f('"response" body "verification_uri_complete" property must be a non-empty string');if(void 0!==r.interval&&('number'!=typeof r.interval||r.interval<=0))throw new f('"response" body "interval" property must be a positive number');return r}async function Xe(e,t,n,r){if(K(e),$(t),!T(n))throw new TypeError('"deviceCode" must be a non-empty string');const o=new URLSearchParams(null==r?void 0:r.additionalParameters);return o.set('device_code',n),pe(e,t,'urn:ietf:params:oauth:grant-type:device_code',o,r)}async function Ye(e,t,n){return we(e,t,n)}async function et(e,t){if(!T(e))throw new TypeError('"alg" must be a non-empty string');const n=Fe(e,'EdDSA'===e?(null==t?void 0:t.crv)??'Ed25519':void 0);return(e.startsWith('PS')||e.startsWith('RS'))&&Object.assign(n,{modulusLength:(null==t?void 0:t.modulusLength)??2048,publicExponent:new Uint8Array([1,0,1])}),crypto.subtle.generateKey(n,(null==t?void 0:t.extractable)??!1,['sign','verify'])}}}]);
2//# sourceMappingURL=1386.641d7289.chunk.js.map