{"version":3,"sources":["jsdelivr-header.js","/npm/trinsic-oidc-client-ts@0.1.7-a/src/index.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/CryptoUtils.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/Logger.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/Event.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/JwtUtils.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/PopupUtils.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/Timer.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/UrlUtils.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/errors/ErrorResponse.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/errors/ErrorTimeout.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/AccessTokenEvents.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/CheckSessionIFrame.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/InMemoryWebStorage.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/JsonService.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/MetadataService.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/WebStorageStateStore.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/OidcClientSettings.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/UserInfoService.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/TokenClient.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/ResponseValidator.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/State.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SigninState.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SigninRequest.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SigninResponse.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SignoutRequest.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SignoutResponse.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/OidcClient.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SessionMonitor.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/User.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/AbstractChildWindow.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/UserManagerSettings.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/IFrameWindow.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/IFrameNavigator.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/PopupWindow.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/PopupNavigator.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/navigators/RedirectNavigator.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/UserManagerEvents.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/SilentRenewService.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/RefreshState.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/UserManager.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/utils/TrinsicUtils.ts","/npm/trinsic-oidc-client-ts@0.1.7-a/src/Version.ts"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,svBCNA,YAAA,GAAA,SAAA,YAAA,CAAA,kBAAA,IAAA,kBAAA,mBAAA,IAAA,mBAAA,cAAA,IAAA,cAAA,aAAA,IAAA,aAAA,mBAAA,IAAA,mBAAA,IAAA,IAAA,IAAA,OAAA,IAAA,OAAA,gBAAA,IAAA,gBAAA,WAAA,IAAA,WAAA,wBAAA,IAAA,wBAAA,eAAA,IAAA,eAAA,eAAA,IAAA,eAAA,YAAA,IAAA,YAAA,gBAAA,IAAA,gBAAA,MAAA,IAAA,MAAA,KAAA,IAAA,KAAA,YAAA,IAAA,YAAA,yBAAA,IAAA,yBAAA,QAAA,IAAA,QAAA,qBAAA,IAAA,uBAAA,OAAA,QAAA,aAAA,aCAA,ICsBI,MACA,ODvBJ,YAAqB,QAAA,QAAA,sBACrB,cAAmB,QAAA,QAAA,wBACnB,kBAAmB,QAAA,QAAA,4BACnB,gBAAiB,QAAA,QAAA,0BCYX,UAAqB,CACvB,MAAO,KAAM,EACb,KAAM,KAAM,EACZ,KAAM,KAAM,EACZ,MAAO,KACX,GAUY,IAAL,CAAK,IACR,IAAA,eACA,IAAA,iBACA,IAAA,eACA,IAAA,eACA,IAAA,iBALQ,GAAL,CAAK,KAAA,KAaK,IACN,EAAS,MAAT,WACH,MAAQ,EACR,OAAS,SACb,EAEO,EAAS,SAAT,SAAkB,GACrB,KAAM,GAAY,GAAS,GAAS,GAChC,MAAM,IAAI,MAAM,qBAEpB,MAAQ,CACZ,EAEO,EAAS,UAAT,SAAmB,GACtB,OAAS,CACb,CAFgB,EA1BR,CAaK,UAAA,KAuBV,IAAM,OAAN,MAEI,WAAA,CAAoB,GAAA,KAAA,OAAgB,CAEpC,KAAA,IAAS,GACR,OAAS,GACT,OAAO,MAAM,OAAO,QAAQ,KAAK,MAAO,KAAK,YAAa,EAElE,CACO,IAAA,IAAQ,GACP,OAAS,GACT,OAAO,KAAK,OAAO,QAAQ,KAAK,MAAO,KAAK,YAAa,EAEjE,CACO,IAAA,IAAQ,GACP,OAAS,GACT,OAAO,KAAK,OAAO,QAAQ,KAAK,MAAO,KAAK,YAAa,EAEjE,CACO,KAAA,IAAS,GACR,OAAS,GACT,OAAO,MAAM,OAAO,QAAQ,KAAK,MAAO,KAAK,YAAa,EAElE,CAEO,MAAM,GAET,MADA,KAAK,MAAM,GACL,CACV,CAEO,MAAA,CAAO,GACV,MAAM,EAAuB,OAAO,OAAO,MAG3C,OAFA,EAAa,QAAU,EACvB,EAAa,MAAM,SACZ,CACX,CAEA,mBAAc,CAAa,EAAc,GACrC,MAAM,EAAe,IAAI,OAAO,GAAG,KAAQ,KAE3C,OADA,EAAa,MAAM,SACZ,CACX,CAEA,cAAe,CAAQ,EAAc,GACjC,MAAM,EAAS,IAAI,KACnB,OAAO,EAAS,GAAG,KAAU,KAAY,CAC7C,CAGA,YAAc,CAAM,KAAiB,GAC7B,OAAS,GACT,OAAO,MAAM,OAAO,QAAQ,MAAU,EAE9C,CACA,WAAc,CAAK,KAAiB,GAC5B,OAAS,GACT,OAAO,KAAK,OAAO,QAAQ,MAAU,EAE7C,CACA,WAAc,CAAK,KAAiB,GAC5B,OAAS,GACT,OAAO,KAAK,OAAO,QAAQ,MAAU,EAE7C,CACA,YAAc,CAAM,KAAiB,GAC7B,OAAS,GACT,OAAO,MAAM,OAAO,QAAQ,MAAU,EAE9C,GAGJ,IAAI,QDlIJ,IAAM,iBAAmB,uCAKZ,YAAN,MACH,kBAAe,GACX,OAAO,YAAA,QAAS,IAAI,UAAU,OAAO,GAAG,MAAM,EAClD,CAKA,qBAAc,GAIV,OAHa,iBAAiB,QAAQ,UAAU,KAC1C,EAAI,YAAY,cAAgB,KAAO,EAAI,GAAG,SAAS,MAEjD,QAAQ,KAAM,GAC9B,CAKA,2BAAc,GACV,OAAO,YAAY,iBAAmB,YAAY,iBAAmB,YAAY,gBACrF,CAKA,4BAAc,CAAsB,GAChC,IACI,MAAM,GAAA,EAAS,cAAA,SAAO,GACtB,OAAO,kBAAA,QAAO,UAAU,GAAQ,QAAQ,MAAO,KAAK,QAAQ,MAAO,KAAK,QAAQ,MAAO,GAC3F,OACO,GAEH,MADA,OAAO,MAAM,oCAAqC,GAC5C,CACV,CACJ,CAKA,wBAAc,CAAkB,EAAmB,GAC/C,MAAM,EAAY,gBAAA,QAAK,MAAM,CAAC,EAAW,GAAe,KAAK,MAC7D,OAAO,kBAAA,QAAO,UAAU,EAC5B,GEzCS,MAAN,MAKI,WAAA,CAA+B,GAAA,KAAA,QAJtC,KAAmB,QAAU,IAAI,OAAO,UAAU,KAAK,WAEvD,KAAQ,WAAyC,EAEK,CAE/C,UAAA,CAAW,GAEd,OADA,KAAK,WAAW,KAAK,GACd,IAAM,KAAK,cAAc,EACpC,CAEO,aAAA,CAAc,GACjB,MAAM,EAAM,KAAK,WAAW,YAAY,GACpC,GAAO,GACP,KAAK,WAAW,OAAO,EAAK,EAEpC,CAEO,KAAA,IAAS,GACZ,KAAK,QAAQ,MAAM,YAAa,GAChC,UAAW,KAAM,KAAK,WACb,KAAM,EAEnB,GCrCJ,kBAAuB,QAAA,QAAA,eAQV,SAAN,MAEH,aAAc,CAAO,GACjB,IACI,SAAO,kBAAA,SAAsB,EACjC,OACO,GAEH,MADA,OAAO,MAAM,kBAAmB,GAC1B,CACV,CACJ,GCES,WAAN,MAMH,aAAO,KAAY,IA1BvB,IAAA,EAgCQ,OALsB,MAAlB,EAAS,QACT,EAAS,MAAQ,OAAA,EAAA,CAAC,IAAK,IAAK,IAAK,KAAK,MAAK,GAAS,GAAS,OAAO,WAAa,SAAhE,EAA0E,KAC/F,MAAA,EAAS,OAAT,EAAS,KAAS,KAAK,IAAI,EAAG,KAAK,MAAM,OAAO,SAAW,OAAO,WAAa,EAAS,OAAS,KAC1E,MAAnB,EAAS,SACT,MAAA,EAAS,MAAT,EAAS,IAAQ,KAAK,IAAI,EAAG,KAAK,MAAM,OAAO,SAAW,OAAO,YAAc,EAAS,QAAU,MAC/F,CACX,CAEA,gBAAO,CAAU,GACb,OAAO,OAAO,QAAQ,GACjB,QAAO,EAAE,CAAE,KAAoB,MAAT,IACtB,KAAI,EAAE,EAAK,KAAW,GAAG,KAAwB,kBAAV,EAAsB,EAAkB,EAAQ,MAAQ,SAC/F,KAAK,IACd,GC/BS,MAAN,cAAoB,MAApB,WAAA,GAAA,SAAA,WACH,KAAmB,QAAU,IAAI,OAAO,UAAU,KAAK,WACvD,KAAQ,aAAsD,KAC9D,KAAQ,YAAc,EAyCtB,KAAU,UAAY,KAClB,MAAM,EAAO,KAAK,YAAc,MAAM,eACtC,KAAK,QAAQ,MAAM,qBAAsB,GAErC,KAAK,aAAe,MAAM,iBAC1B,KAAK,SACL,MAAM,QACV,CACJ,CA9CA,mBAAc,GACV,OAAO,KAAK,MAAM,KAAK,MAAQ,IACnC,CAEO,IAAA,CAAK,GACR,MAAM,EAAS,KAAK,QAAQ,OAAO,QACnC,EAAoB,KAAK,IAAI,KAAK,MAAM,GAAoB,GAC5D,MAAM,EAAa,MAAM,eAAiB,EAC1C,GAAI,KAAK,aAAe,GAAc,KAAK,aAGvC,YADA,EAAO,MAAM,uDAAwD,KAAK,YAI9E,KAAK,SAEL,EAAO,MAAM,iBAAkB,GAC/B,KAAK,YAAc,EAKnB,MAAM,EAAyB,KAAK,IAAI,EAAmB,GAC3D,KAAK,aAAe,YAAY,KAAK,UAAoC,IAAzB,EACpD,CAEA,cAAW,GACP,OAAO,KAAK,WAChB,CAEO,MAAA,GACH,KAAK,QAAQ,OAAO,UAChB,KAAK,eACL,cAAc,KAAK,cACnB,KAAK,aAAe,KAE5B,GC7CS,SAAN,MACH,iBAAc,CAAW,EAAa,EAAqC,SACvE,IAAK,EAAK,MAAM,IAAI,UAAU,eAC9B,MACM,EADY,IAAI,IAAI,EAAK,OAAO,SAAS,QACL,aAAjB,EAA8B,OAAS,UAChE,OAAO,IAAI,gBAAgB,EAAO,MAAM,GAC5C,GCAS,cAAN,cAA4B,MAmBxB,WAAA,CACH,EAKgB,GArCxB,IAAA,EAAA,EAAA,EAyCQ,GAFA,MAAM,EAAK,mBAAqB,EAAK,OAAS,IAF9B,KAAA,OAvBpB,KAAgB,KAAe,iBA2BtB,EAAK,MAEN,MADA,OAAO,MAAM,gBAAiB,mBACxB,IAAI,MAAM,mBAGpB,KAAK,MAAQ,EAAK,MAClB,KAAK,kBAAoB,OAAA,EAAA,EAAK,mBAAL,EAA0B,KACnD,KAAK,UAAY,OAAA,EAAA,EAAK,WAAL,EAAkB,KAEnC,KAAK,MAAQ,EAAK,UAClB,KAAK,cAAgB,OAAA,EAAA,EAAK,eAAL,EAAsB,IAC/C,GC5CS,aAAN,cAA2B,MAIvB,WAAA,CAAY,GACf,MAAM,GAHV,KAAgB,KAAe,cAI/B,GCAS,kBAAN,MAOI,WAAA,CAAY,GANnB,KAAmB,QAAU,IAAI,OAAO,qBAExC,KAAiB,eAAiB,IAAI,MAAM,yBAC5C,KAAiB,cAAgB,IAAI,MAAM,wBAIvC,KAAK,mCAAqC,EAAK,iCACnD,CAEO,IAAA,CAAK,GACR,MAAM,EAAS,KAAK,QAAQ,OAAO,QAEnC,GAAI,EAAU,mBAAyC,IAAzB,EAAU,WAA0B,CAC9D,MAAM,EAAW,EAAU,WAG3B,GAFA,EAAO,MAAM,4CAA6C,GAEtD,EAAW,EAAG,CAEd,IAAI,EAAW,EAAW,KAAK,mCAC3B,GAAY,IACZ,EAAW,GAGf,EAAO,MAAM,yCAA0C,EAAU,WACjE,KAAK,eAAe,KAAK,EAC7B,MAEI,EAAO,MAAM,oEACb,KAAK,eAAe,SAIxB,MAAM,EAAU,EAAW,EAC3B,EAAO,MAAM,wCAAyC,EAAS,WAC/D,KAAK,cAAc,KAAK,EAC5B,MAEI,KAAK,eAAe,SACpB,KAAK,cAAc,QAE3B,CAEO,MAAA,GACH,KAAK,QAAQ,MAAM,kDACnB,KAAK,eAAe,SACpB,KAAK,cAAc,QACvB,CAKO,sBAAA,CAAuB,GAC1B,OAAO,KAAK,eAAe,WAAW,EAC1C,CAIO,yBAAA,CAA0B,GAC7B,KAAK,eAAe,cAAc,EACtC,CAKO,qBAAA,CAAsB,GACzB,OAAO,KAAK,cAAc,WAAW,EACzC,CAIO,wBAAA,CAAyB,GAC5B,KAAK,cAAc,cAAc,EACrC,GChFS,mBAAN,MAOI,WAAA,CACK,EACA,EACR,EACQ,EACA,GAJA,KAAA,YACA,KAAA,aAEA,KAAA,qBACA,KAAA,eAXZ,KAAiB,QAAU,IAAI,OAAO,sBAGtC,KAAQ,OAAgD,KACxD,KAAQ,eAAgC,KAmCxC,KAAQ,SAAY,IACZ,EAAE,SAAW,KAAK,eAClB,EAAE,SAAW,KAAK,OAAO,gBAEV,UAAX,EAAE,MACF,KAAK,QAAQ,MAAM,8CACf,KAAK,cACL,KAAK,QAGO,YAAX,EAAE,MACP,KAAK,QAAQ,MAAM,gDACnB,KAAK,OACA,KAAK,aAGV,KAAK,QAAQ,MAAM,EAAE,KAAO,yCAEpC,EA5CA,MAAM,EAAY,IAAI,IAAI,GAC1B,KAAK,cAAgB,EAAU,OAE/B,KAAK,OAAS,OAAO,SAAS,cAAc,UAG5C,KAAK,OAAO,MAAM,WAAa,SAC/B,KAAK,OAAO,MAAM,SAAW,QAC7B,KAAK,OAAO,MAAM,KAAO,UACzB,KAAK,OAAO,MAAM,IAAM,IACxB,KAAK,OAAO,MAAQ,IACpB,KAAK,OAAO,OAAS,IACrB,KAAK,OAAO,IAAM,EAAU,IAChC,CAEO,IAAA,GACH,OAAO,IAAI,SAAe,IACtB,KAAK,OAAO,OAAS,KACjB,GAAQ,EAGZ,OAAO,SAAS,KAAK,YAAY,KAAK,QACtC,OAAO,iBAAiB,UAAW,KAAK,UAAU,EAAK,GAE/D,CAuBO,KAAA,CAAM,GACT,GAAI,KAAK,iBAAmB,EACxB,OAGJ,KAAK,QAAQ,OAAO,SAEpB,KAAK,OAEL,KAAK,eAAiB,EAEtB,MAAM,EAAO,KACJ,KAAK,OAAO,eAAkB,KAAK,gBAIxC,KAAK,OAAO,cAAc,YAAY,KAAK,WAAa,IAAM,KAAK,eAAgB,KAAK,cAAa,EAIzG,IAGA,KAAK,OAAS,YAAY,EAAgC,IAA1B,KAAK,mBACzC,CAEO,IAAA,GACH,KAAK,QAAQ,OAAO,QACpB,KAAK,eAAiB,KAElB,KAAK,SAEL,cAAc,KAAK,QACnB,KAAK,OAAS,KAEtB,GChGS,mBAAN,iBAAA,GACH,KAAiB,QAAU,IAAI,OAAO,sBACtC,KAAQ,MAAgC,CAAC,EAElC,KAAA,GACH,KAAK,QAAQ,OAAO,SACpB,KAAK,MAAQ,CAAC,CAClB,CAEO,OAAA,CAAQ,GAEX,OADA,KAAK,QAAQ,OAAO,YAAY,OACzB,KAAK,MAAM,EACtB,CAEO,OAAA,CAAQ,EAAa,GACxB,KAAK,QAAQ,OAAO,YAAY,OAChC,KAAK,MAAM,GAAO,CACtB,CAEO,UAAA,CAAW,GACd,KAAK,QAAQ,OAAO,eAAe,cAC5B,KAAK,MAAM,EACtB,CAEA,UAAW,GACP,OAAO,OAAO,oBAAoB,KAAK,OAAO,MAClD,CAEO,GAAA,CAAI,GACP,OAAO,OAAO,oBAAoB,KAAK,OAAO,EAClD,GCNS,YAAN,MAKI,WAAA,CACH,EAAmC,GAC3B,EAAiC,MAAjC,KAAA,cANZ,KAAiB,QAAU,IAAI,OAAO,eAEtC,KAAQ,cAA0B,GAM9B,KAAK,cAAc,QAAQ,EAAwB,oBAC/C,GACA,KAAK,cAAc,KAAK,kBAEhC,CAEA,sBAAgB,CAAiB,EAAoB,EAAoD,CAAC,GACtG,MAAM,iBAAE,KAAqB,GAAc,EAC3C,IAAK,EACD,aAAa,MAAM,EAAO,GAG9B,MAAM,EAAa,IAAI,gBACjB,EAAY,YAAW,IAAM,EAAW,SAA4B,IAAnB,GAEvD,IAKI,aAJuB,MAAM,EAAO,IAC7B,EACH,OAAQ,EAAW,QAG3B,OACO,GACH,GAAI,aAAe,cAA6B,eAAb,EAAI,KACnC,MAAM,IAAI,aAAa,qBAE3B,MAAM,CACV,SAEI,aAAa,EACjB,CACJ,CAEA,aAAa,CAAQ,GAAa,MAC9B,EAAA,YACA,GACa,CAAC,GACd,MAAM,EAAS,KAAK,QAAQ,OAAO,WAC7B,EAAuB,CACzB,OAAU,KAAK,cAAc,KAAK,OAOtC,IAAI,EALA,IACA,EAAO,MAAM,8CACb,EAAQ,cAAmB,UAAY,GAI3C,IACI,EAAO,MAAM,OAAQ,GACrB,QAAiB,KAAK,iBAAiB,EAAK,CAAE,OAAQ,MAAO,UAAS,eAC1E,OACO,GAEH,MADA,EAAO,MAAM,iBACP,CACV,CAEA,EAAO,MAAM,iCAAkC,EAAS,QACxD,MAAM,EAAc,EAAS,QAAQ,IAAI,gBAIzC,GAHI,IAAgB,KAAK,cAAc,MAAK,GAAQ,EAAY,WAAW,MACvE,EAAO,MAAM,IAAI,MAAM,kCAAmC,MAAA,IAAe,0BAA2B,MAEpG,EAAS,IAAM,KAAK,cAAe,MAAA,OAAA,EAAA,EAAa,WAAW,oBAC3D,aAAa,KAAK,kBAAkB,EAAS,QAEjD,IAAI,EACJ,IACI,QAAa,EAAS,MAC1B,OACO,GAEH,GADA,EAAO,MAAM,8BAA+B,GACxC,EAAS,GAAI,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,EAAS,eAAe,EAAS,UACxD,CACA,IAAK,EAAS,GAAI,CAEd,GADA,EAAO,MAAM,qBAAsB,GAC/B,EAAK,MACL,MAAM,IAAI,cAAc,GAE5B,MAAM,IAAI,MAAM,GAAG,EAAS,eAAe,EAAS,YAAY,KAAK,UAAU,KACnF,CACA,OAAO,CACX,CAEA,cAAa,CAAS,GAAa,KAC/B,EAAA,UACA,EAAA,iBACA,EAAA,gBACA,IAEA,MAAM,EAAS,KAAK,QAAQ,OAAO,YAC7B,EAAuB,CACzB,OAAU,KAAK,cAAc,KAAK,MAClC,eAAgB,qCAMpB,IAAI,OAJc,IAAd,IACA,EAAQ,cAAmB,SAAW,GAI1C,IACI,EAAO,MAAM,OAAQ,GACrB,QAAiB,KAAK,iBAAiB,EAAK,CAAE,OAAQ,OAAQ,UAAS,OAAM,mBAAkB,YAAa,GAChH,OACO,GAEH,MADA,EAAO,MAAM,iBACP,CACV,CAEA,EAAO,MAAM,iCAAkC,EAAS,QACxD,MAAM,EAAc,EAAS,QAAQ,IAAI,gBACzC,GAAI,IAAgB,KAAK,cAAc,MAAK,GAAQ,EAAY,WAAW,KACvE,MAAM,IAAI,MAAM,kCAAmC,MAAA,IAAe,0BAA2B,KAGjG,MAAM,QAAqB,EAAS,OAEpC,IAAI,EAAgC,CAAC,EACrC,GAAI,EACA,IACI,EAAO,KAAK,MAAM,EACtB,OACO,GAEH,GADA,EAAO,MAAM,8BAA+B,GACxC,EAAS,GAAI,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,EAAS,eAAe,EAAS,UACxD,CAGJ,IAAK,EAAS,GAAI,CAEd,GADA,EAAO,MAAM,qBAAsB,GAC/B,EAAK,MACL,MAAM,IAAI,cAAc,EAAM,GAElC,MAAM,IAAI,MAAM,GAAG,EAAS,eAAe,EAAS,YAAY,KAAK,UAAU,KACnF,CAEA,OAAO,CACX,GCvKS,gBAAN,MAUI,WAAA,CAA6B,GAAA,KAAA,YATpC,KAAiB,QAAU,IAAI,OAAO,mBACtC,KAAiB,aAAe,IAAI,YAAY,CAAC,6BAIjD,KAAQ,aAAoC,KAC5C,KAAQ,UAA0C,KAI9C,KAAK,aAAe,KAAK,UAAU,YAE/B,KAAK,UAAU,cACf,KAAK,QAAQ,MAAM,mCACnB,KAAK,aAAe,KAAK,UAAU,aAGnC,KAAK,UAAU,WACf,KAAK,QAAQ,MAAM,gCACnB,KAAK,UAAY,KAAK,UAAU,UAGhC,KAAK,UAAU,0BACf,KAAK,QAAQ,MAAM,+CACnB,KAAK,yBAA2B,KAAK,UAAU,wBAEvD,CAEO,gBAAA,GACH,KAAK,aAAe,IACxB,CAEA,iBAAa,GACT,MAAM,EAAS,KAAK,QAAQ,OAAO,eACnC,GAAI,KAAK,UAEL,OADA,EAAO,MAAM,uBACN,KAAK,UAGhB,IAAK,KAAK,aAEN,MADA,EAAO,MAAM,IAAI,MAAM,uDACjB,KAGV,EAAO,MAAM,wBAAyB,KAAK,cAC3C,MAAM,QAAiB,KAAK,aAAa,QAAQ,KAAK,aAAc,CAAE,YAAa,KAAK,2BAIxF,OAFA,EAAO,MAAM,0CACb,KAAK,UAAY,OAAO,OAAO,CAAC,EAAG,KAAK,UAAU,aAAc,GACzD,KAAK,SAChB,CAEO,SAAA,GACH,OAAO,KAAK,qBAAqB,SACrC,CAEO,wBAAA,GACH,OAAO,KAAK,qBAAqB,yBACrC,CAEO,mBAAA,GACH,OAAO,KAAK,qBAAqB,oBACrC,CAIO,gBAAA,CAAiB,GAAW,GAC/B,OAAO,KAAK,qBAAqB,iBAAkB,EACvD,CAEO,qBAAA,GACH,OAAO,KAAK,qBAAqB,wBAAwB,EAC7D,CAEO,qBAAA,GACH,OAAO,KAAK,qBAAqB,wBAAwB,EAC7D,CAIO,qBAAA,CAAsB,GAAW,GACpC,OAAO,KAAK,qBAAqB,sBAAuB,EAC5D,CAIO,eAAA,CAAgB,GAAW,GAC9B,OAAO,KAAK,qBAAqB,WAAY,EACjD,CAEA,0BAAgB,CAAqB,EAA0B,GAAS,GACpE,MAAM,EAAS,KAAK,QAAQ,OAAO,yBAAyB,OAEtD,QAAiB,KAAK,cAG5B,GAFA,EAAO,MAAM,iBAEU,IAAnB,EAAS,GAAqB,CAC9B,IAAiB,IAAb,EAEA,YADA,EAAO,KAAK,+CAIhB,EAAO,MAAM,IAAI,MAAM,sCAAwC,GACnE,CAEA,OAAO,EAAS,EACpB,CAEA,oBAAa,GACT,MAAM,EAAS,KAAK,QAAQ,OAAO,kBACnC,GAAI,KAAK,aAEL,OADA,EAAO,MAAM,oCACN,KAAK,aAGhB,MAAM,QAAiB,KAAK,iBAAgB,GAC5C,EAAO,MAAM,eAAgB,GAE7B,MAAM,QAAe,KAAK,aAAa,QAAQ,GAG/C,GAFA,EAAO,MAAM,cAAe,IAEvB,MAAM,QAAQ,EAAO,MAEtB,MADA,EAAO,MAAM,IAAI,MAAM,2BACjB,KAIV,OADA,KAAK,aAAe,EAAO,KACpB,KAAK,YAChB,GClIS,qBAAN,MAMI,WAAA,EAAY,OACf,EAAS,QAAA,MACT,EAAQ,cAC6C,CAAC,GAR1D,KAAiB,QAAU,IAAI,OAAO,wBASlC,KAAK,OAAS,EACd,KAAK,QAAU,CACnB,CAEA,SAAa,CAAI,EAAa,GAC1B,KAAK,QAAQ,OAAO,QAAQ,OAE5B,EAAM,KAAK,QAAU,QACf,KAAK,OAAO,QAAQ,EAAK,EACnC,CAEA,SAAa,CAAI,GACb,KAAK,QAAQ,OAAO,QAAQ,OAE5B,EAAM,KAAK,QAAU,EAErB,aADmB,KAAK,OAAO,QAAQ,EAE3C,CAEA,YAAa,CAAO,GAChB,KAAK,QAAQ,OAAO,WAAW,OAE/B,EAAM,KAAK,QAAU,EACrB,MAAM,QAAa,KAAK,OAAO,QAAQ,GAEvC,aADM,KAAK,OAAO,WAAW,GACtB,CACX,CAEA,gBAAa,GACT,KAAK,QAAQ,OAAO,cACpB,MAAM,QAAY,KAAK,OAAO,OAExB,EAAO,GACb,QAAS,EAAQ,EAAG,EAAQ,EAAK,IAAS,CACtC,MAAM,QAAY,KAAK,OAAO,IAAI,GAC9B,GAAqC,IAA9B,EAAI,QAAQ,KAAK,UACxB,EAAK,KAAK,EAAI,OAAO,KAAK,QAAQ,QAE1C,CACA,OAAO,CACX,GCpDE,oBAAsB,OACtB,aAAe,SACf,4BAA8B,qBAC9B,oBAAsB,QACtB,8BAAgC,IAChC,0BAA4B,IAmHrB,wBAAN,MA2CI,WAAA,EAAY,UAEf,EAAA,YAAW,EAAA,SAAa,EAAA,YAAU,EAAA,aAAa,EAAA,UAE/C,EAAA,cAAW,EAAA,cAAe,EAAgB,oBAAA,MAAqB,EAAQ,aAAA,aACvE,EAAA,yBAAc,EAAA,sBACd,EAAwB,4BAAA,OAExB,EAAA,QAAQ,EAAA,QAAS,EAAA,WAAS,EAAA,WAAY,EAAA,SAAY,EAAA,cAAU,EAAgB,oBAAA,qBAE5E,GAAuB,EAAA,aACvB,GAAe,EAAA,uBACf,EAAyB,8BAAA,mBACzB,EAAqB,0BAAA,kBACrB,EAAoB,KAAA,YACpB,GAAc,EAAA,WAEd,EAAA,wBACA,EAAA,kCACA,EAAA,wBACA,EAAA,iBAEA,EAAmB,CAAC,EAAA,iBACpB,EAAmB,CAAC,IAoDpB,GAjDA,KAAK,UAAY,EAEb,EACA,KAAK,YAAc,GAEnB,KAAK,YAAc,EACf,IACK,KAAK,YAAY,SAAS,OAC3B,KAAK,aAAe,KAExB,KAAK,aAAe,qCAI5B,KAAK,SAAW,EAChB,KAAK,aAAe,EACpB,KAAK,YAAc,EAEnB,KAAK,UAAY,EACjB,KAAK,cAAgB,EACrB,KAAK,cAAgB,EACrB,KAAK,MAAQ,EACb,KAAK,aAAe,EACpB,KAAK,yBAA2B,EAChC,KAAK,sBAAwB,EAE7B,KAAK,OAAS,EACd,KAAK,QAAU,EACf,KAAK,QAAU,EACf,KAAK,WAAa,EAClB,KAAK,WAAa,EAClB,KAAK,SAAW,EAChB,KAAK,cAAgB,EAErB,KAAK,uBAAyB,EAC9B,KAAK,eAAiB,EACtB,KAAK,uBAAyB,EAC9B,KAAK,mBAAqB,EAC1B,KAAK,kBAAoB,EACzB,KAAK,cAAgB,EAErB,KAAK,kCAAoC,EAErC,GAA2B,GAC3B,QAAQ,KAAK,+GAEjB,KAAK,wBAA0B,IACzB,GAAoD,eAEtD,EACA,KAAK,WAAa,MAEjB,CACD,MAAM,EAA0B,oBAAX,OAAyB,OAAO,aAAe,IAAI,mBACxE,KAAK,WAAa,IAAI,qBAAqB,CAAE,SACjD,CAEA,KAAK,iBAAmB,EACxB,KAAK,iBAAmB,CAC5B,GCpPS,gBAAN,MAII,WAAA,CAA6B,EACf,GADe,KAAA,YACf,KAAA,mBAJrB,KAAmB,QAAU,IAAI,OAAO,mBA2BxC,KAAU,kBAAoB,MAAO,IACjC,MAAM,EAAS,KAAK,QAAQ,OAAO,qBACnC,IACI,MAAM,EAAU,SAAS,OAAO,GAGhC,OAFA,EAAO,MAAM,2BAEN,CACX,OAAS,GAEL,MADA,EAAO,MAAM,8BACP,CACV,GA/BA,KAAK,aAAe,IAAI,iBAAY,EAAW,KAAK,kBACxD,CAEA,eAAa,CAAU,GACnB,MAAM,EAAS,KAAK,QAAQ,OAAO,aAC9B,GACD,KAAK,QAAQ,MAAM,IAAI,MAAM,oBAGjC,MAAM,QAAY,KAAK,iBAAiB,sBACxC,EAAO,MAAM,mBAAoB,GAEjC,MAAM,QAAe,KAAK,aAAa,QAAQ,EAAK,CAChD,QACA,YAAa,KAAK,UAAU,0BAIhC,OAFA,EAAO,MAAM,aAAc,GAEpB,CACX,GCsBS,YAAN,MAII,WAAA,CACc,EACA,GADA,KAAA,YACA,KAAA,mBALrB,KAAiB,QAAU,IAAI,OAAO,eAOlC,KAAK,aAAe,IAAI,YAAY,KAAK,UAAU,kCACvD,CAEA,kBAAa,EAAa,WACtB,EAAa,qBAAA,aACb,EAAe,KAAK,UAAU,aAAA,UAC9B,EAAY,KAAK,UAAU,UAAA,cAC3B,EAAgB,KAAK,UAAU,iBAC5B,IAEH,MAAM,EAAS,KAAK,QAAQ,OAAO,gBAC9B,GACD,EAAO,MAAM,IAAI,MAAM,4BAEtB,GACD,EAAO,MAAM,IAAI,MAAM,+BAEtB,EAAK,MACN,EAAO,MAAM,IAAI,MAAM,uBAEtB,EAAK,eACN,EAAO,MAAM,IAAI,MAAM,gCAG3B,MAAM,EAAS,IAAI,gBAAgB,CAAE,aAAY,iBACjD,UAAY,EAAK,KAAU,OAAO,QAAQ,GACzB,MAAT,GACA,EAAO,IAAI,EAAK,GAGxB,IAAI,EACJ,OAAQ,KAAK,UAAU,uBACnB,IAAK,sBACD,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,gCACjB,KAEV,EAAY,YAAY,kBAAkB,EAAW,GACrD,MACJ,IAAK,qBACD,EAAO,OAAO,YAAa,GACvB,GACA,EAAO,OAAO,gBAAiB,GAK3C,MAAM,QAAY,KAAK,iBAAiB,kBAAiB,GACzD,EAAO,MAAM,sBAEb,MAAM,QAAiB,KAAK,aAAa,SAAS,EAAK,CAAE,KAAM,EAAQ,YAAW,gBAAiB,KAAK,UAAU,0BAGlH,OAFA,EAAO,MAAM,gBAEN,CACX,CAEA,yBAAa,EAAoB,WAC7B,EAAa,WAAA,UACb,EAAY,KAAK,UAAU,UAAA,cAC3B,EAAgB,KAAK,UAAU,cAAA,MAC/B,EAAQ,KAAK,UAAU,MAAA,SACvB,EAAA,SACA,IAEA,MAAM,EAAS,KAAK,QAAQ,OAAO,uBAE9B,GACD,EAAO,MAAM,IAAI,MAAM,4BAG3B,MAAM,EAAS,IAAI,gBAAgB,CAAE,aAAY,WAAU,WAAU,UAErE,IAAI,EACJ,OAAQ,KAAK,UAAU,uBACnB,IAAK,sBACD,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,gCACjB,KAEV,EAAY,YAAY,kBAAkB,EAAW,GACrD,MACJ,IAAK,qBACD,EAAO,OAAO,YAAa,GACvB,GACA,EAAO,OAAO,gBAAiB,GAK3C,MAAM,QAAY,KAAK,iBAAiB,kBAAiB,GACzD,EAAO,MAAM,sBAEb,MAAM,QAAiB,KAAK,aAAa,SAAS,EAAK,CAAE,KAAM,EAAQ,YAAW,gBAAiB,KAAK,UAAU,0BAGlH,OAFA,EAAO,MAAM,gBAEN,CACX,CAEA,0BAAa,EAAqB,WAC9B,EAAa,gBAAA,UACb,EAAY,KAAK,UAAU,UAAA,cAC3B,EAAgB,KAAK,UAAU,cAAA,iBAC/B,KACG,IAEH,MAAM,EAAS,KAAK,QAAQ,OAAO,wBAC9B,GACD,EAAO,MAAM,IAAI,MAAM,4BAEtB,EAAK,eACN,EAAO,MAAM,IAAI,MAAM,gCAG3B,MAAM,EAAS,IAAI,gBAAgB,CAAE,eACrC,UAAY,EAAK,KAAU,OAAO,QAAQ,GACzB,MAAT,GACA,EAAO,IAAI,EAAK,GAGxB,IAAI,EACJ,OAAQ,KAAK,UAAU,uBACnB,IAAK,sBACD,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,gCACjB,KAEV,EAAY,YAAY,kBAAkB,EAAW,GACrD,MACJ,IAAK,qBACD,EAAO,OAAO,YAAa,GACvB,GACA,EAAO,OAAO,gBAAiB,GAK3C,MAAM,QAAY,KAAK,iBAAiB,kBAAiB,GACzD,EAAO,MAAM,sBAEb,MAAM,QAAiB,KAAK,aAAa,SAAS,EAAK,CAAE,KAAM,EAAQ,YAAW,mBAAkB,gBAAiB,KAAK,UAAU,0BAGpI,OAFA,EAAO,MAAM,gBAEN,CACX,CAOA,YAAa,CAAO,GA1NxB,IAAA,EA2NQ,MAAM,EAAS,KAAK,QAAQ,OAAO,UAC9B,EAAK,OACN,EAAO,MAAM,IAAI,MAAM,wBAG3B,MAAM,QAAY,KAAK,iBAAiB,uBAAsB,GAE9D,EAAO,MAAM,qCAAqC,OAAA,EAAA,EAAK,iBAAL,EAAwB,wBAE1E,MAAM,EAAS,IAAI,gBACnB,UAAY,EAAK,KAAU,OAAO,QAAQ,GACzB,MAAT,GACA,EAAO,IAAI,EAAK,GAGxB,EAAO,IAAI,YAAa,KAAK,UAAU,WACnC,KAAK,UAAU,eACf,EAAO,IAAI,gBAAiB,KAAK,UAAU,qBAGzC,KAAK,aAAa,SAAS,EAAK,CAAE,KAAM,IAC9C,EAAO,MAAM,eACjB,GCxNE,eAAiB,CACnB,MAEA,MACA,MACA,MACA,MACA,MACA,YACA,QACA,MACA,MACA,MAEA,WAMS,kBAAN,MAKI,WAAA,CACgB,EACA,GADA,KAAA,YACA,KAAA,mBANvB,KAAmB,QAAU,IAAI,OAAO,qBACxC,KAAmB,iBAAmB,IAAI,gBAAgB,KAAK,UAAW,KAAK,kBAC/E,KAAmB,aAAe,IAAI,YAAY,KAAK,UAAW,KAAK,iBAKpE,CAEH,4BAAa,CAAuB,EAA0B,GAC1D,MAAM,EAAS,KAAK,QAAQ,OAAO,0BAEnC,KAAK,oBAAoB,EAAU,GACnC,EAAO,MAAM,yBAEP,KAAK,aAAa,EAAU,GAClC,EAAO,MAAM,kBAET,EAAS,UACT,KAAK,2BAA2B,GAEpC,EAAO,MAAM,0BAEP,KAAK,eAAe,EAAU,MAAA,OAAA,EAAA,EAAO,aAAc,EAAS,UAClE,EAAO,MAAM,mBACjB,CAEA,iCAAa,CAA4B,EAA0B,GAC/D,MAAM,EAAS,KAAK,QAAQ,OAAO,+BAE/B,EAAS,UACT,KAAK,2BAA2B,GAEpC,EAAO,MAAM,0BAEP,KAAK,eAAe,EAAU,EAAc,EAAS,UAC3D,EAAO,MAAM,mBACjB,CAEA,6BAAa,CAAwB,EAA0B,GAC3D,MAAM,EAAS,KAAK,QAAQ,OAAO,2BAEnC,EAAS,UAAY,EAAM,KAE3B,MAAA,EAAS,gBAAT,EAAS,cAAkB,EAAM,eAEjC,MAAA,EAAS,QAAT,EAAS,MAAU,EAAM,OAIrB,EAAS,UAAc,EAAS,WAChC,KAAK,2BAA2B,EAAU,EAAM,UAChD,EAAO,MAAM,uBAGZ,EAAS,WAEV,EAAS,SAAW,EAAM,SAE1B,EAAS,QAAU,EAAM,SAG7B,MAAM,EAAa,EAAS,YAAc,EAAS,eAC7C,KAAK,eAAe,GAAU,EAAO,GAC3C,EAAO,MAAM,mBACjB,CAEO,uBAAA,CAAwB,EAA2B,GACtD,MAAM,EAAS,KAAK,QAAQ,OAAO,2BAWnC,GAVI,EAAM,KAAO,EAAS,OACtB,EAAO,MAAM,IAAI,MAAM,yBAM3B,EAAO,MAAM,mBACb,EAAS,UAAY,EAAM,KAEvB,EAAS,MAET,MADA,EAAO,KAAK,qBAAsB,EAAS,OACrC,IAAI,cAAc,EAEhC,CAEU,mBAAA,CAAoB,EAA0B,GACpD,MAAM,EAAS,KAAK,QAAQ,OAAO,uBA6BnC,GA5BI,EAAM,KAAO,EAAS,OACtB,EAAO,MAAM,IAAI,MAAM,yBAGtB,EAAM,WACP,EAAO,MAAM,IAAI,MAAM,0BAGtB,EAAM,WACP,EAAO,MAAM,IAAI,MAAM,0BAIvB,KAAK,UAAU,YAAc,EAAM,WACnC,EAAO,MAAM,IAAI,MAAM,oDAEvB,KAAK,UAAU,WAAa,KAAK,UAAU,YAAc,EAAM,WAC/D,EAAO,MAAM,IAAI,MAAM,oDAM3B,EAAO,MAAM,mBACb,EAAS,UAAY,EAAM,KAE3B,MAAA,EAAS,QAAT,EAAS,MAAU,EAAM,OAErB,EAAS,MAET,MADA,EAAO,KAAK,qBAAsB,EAAS,OACrC,IAAI,cAAc,GAGxB,EAAM,gBAAkB,EAAS,MACjC,EAAO,MAAM,IAAI,MAAM,+BAGtB,EAAM,eAAiB,EAAS,MACjC,EAAO,MAAM,IAAI,MAAM,+BAE/B,CAEA,oBAAgB,CAAe,EAA0B,GAAe,EAAO,GAAc,GACzF,MAAM,EAAS,KAAK,QAAQ,OAAO,kBAGnC,GAFA,EAAS,QAAU,KAAK,sBAAsB,EAAS,SAEnD,IAAiB,KAAK,UAAU,eAAiB,EAAS,aAE1D,YADA,EAAO,MAAM,yBAIjB,EAAO,MAAM,qBACb,MAAM,QAAe,KAAK,iBAAiB,UAAU,EAAS,cAC9D,EAAO,MAAM,qDAET,GAAe,EAAO,MAAQ,EAAS,QAAQ,KAC/C,EAAO,MAAM,IAAI,MAAM,sEAG3B,EAAS,QAAU,KAAK,aAAa,EAAS,QAAS,KAAK,sBAAsB,IAClF,EAAO,MAAM,8CAA+C,EAAS,QACzE,CAEU,YAAA,CAAa,EAAsB,GACzC,MAAM,EAAS,IAAK,GAEpB,UAAY,EAAO,KAAW,OAAO,QAAQ,GACzC,UAAW,KAAS,MAAM,QAAQ,GAAU,EAAS,CAAC,GAAS,CAC3D,MAAM,EAAgB,EAAO,GACxB,EAGI,MAAM,QAAQ,GACd,EAAc,SAAS,IACxB,EAAc,KAAK,GAGlB,EAAO,KAAW,IACF,iBAAV,GAAsB,KAAK,UAAU,YAC5C,EAAO,GAAS,KAAK,aAAa,EAA8B,GAGhE,EAAO,GAAS,CAAC,EAAe,IAZpC,EAAO,GAAS,CAexB,CAGJ,OAAO,CACX,CAEU,qBAAA,CAAsB,GAC5B,MAAM,EAAS,IAAK,GAEpB,GAAI,KAAK,UAAU,qBACf,UAAW,KAAQ,sBACR,EAAO,GAItB,OAAO,CACX,CAEA,kBAAgB,CAAa,EAA0B,GACnD,MAAM,EAAS,KAAK,QAAQ,OAAO,gBACnC,GAAI,EAAS,KAAM,CACf,EAAO,MAAM,mBACb,MAAM,QAAsB,KAAK,aAAa,aAAa,CACvD,UAAW,EAAM,UACjB,cAAe,EAAM,cACrB,KAAM,EAAS,KACf,aAAc,EAAM,aACpB,cAAe,EAAM,iBAClB,EAAM,mBAEb,OAAO,OAAO,EAAU,EAC5B,MACI,EAAO,MAAM,qBAErB,CAEU,0BAAA,CAA2B,EAA0B,GA9PnE,IAAA,EA+PQ,MAAM,EAAS,KAAK,QAAQ,OAAO,8BAEnC,EAAO,MAAM,yBACb,MAAM,EAAU,SAAS,OAAO,OAAA,EAAA,EAAS,UAAT,EAAqB,IAMrD,GAJK,EAAQ,KACT,EAAO,MAAM,IAAI,MAAM,wCAGvB,EAAc,CACd,MAAM,EAAU,SAAS,OAAO,GAC5B,EAAQ,MAAQ,EAAQ,KACxB,EAAO,MAAM,IAAI,MAAM,+CAEvB,EAAQ,WAAa,EAAQ,YAAc,EAAQ,WACnD,EAAO,MAAM,IAAI,MAAM,4DAEvB,EAAQ,KAAO,EAAQ,MAAQ,EAAQ,KACvC,EAAO,MAAM,IAAI,MAAM,iDAEtB,EAAQ,KAAO,EAAQ,KACxB,EAAO,MAAM,IAAI,MAAM,yDAE/B,CAEA,EAAS,QAAU,CACvB,GChRS,MAAN,MAQI,WAAA,CAAY,GAMf,KAAK,GAAK,EAAK,IAAM,YAAY,iBACjC,KAAK,KAAO,EAAK,KAEb,EAAK,SAAW,EAAK,QAAU,EAC/B,KAAK,QAAU,EAAK,QAGpB,KAAK,QAAU,MAAM,eAEzB,KAAK,aAAe,EAAK,YAC7B,CAEO,eAAA,GAEH,OADA,IAAI,OAAO,SAAS,OAAO,mBACpB,KAAK,UAAU,CAClB,GAAI,KAAK,GACT,KAAM,KAAK,KACX,QAAS,KAAK,QACd,aAAc,KAAK,cAE3B,CAEA,wBAAc,CAAkB,GAE5B,OADA,OAAO,aAAa,QAAS,qBACtB,IAAI,MAAM,KAAK,MAAM,GAChC,CAEA,4BAAoB,CAAgB,EAAqB,GACrD,MAAM,EAAS,OAAO,aAAa,QAAS,mBACtC,EAAS,MAAM,eAAiB,EAEhC,QAAa,EAAQ,aAC3B,EAAO,MAAM,WAAY,GAEzB,QAAS,EAAI,EAAG,EAAI,EAAK,OAAQ,IAAK,CAClC,MAAM,EAAM,EAAK,GACX,QAAa,EAAQ,IAAI,GAC/B,IAAI,GAAS,EAEb,GAAI,EACA,IACI,MAAM,EAAQ,MAAM,kBAAkB,GAEtC,EAAO,MAAM,qBAAsB,EAAK,EAAM,SAC1C,EAAM,SAAW,IACjB,GAAS,EAEjB,OACO,GACH,EAAO,MAAM,+BAAgC,EAAK,GAClD,GAAS,CACb,MAGA,EAAO,MAAM,8BAA+B,GAC5C,GAAS,EAGT,IACA,EAAO,MAAM,wBAAyB,GACjC,EAAQ,OAAO,GAE5B,CACJ,GC7ES,YAAN,cAA0B,MAyBtB,WAAA,CAAY,GAgBf,MAAM,IAEqB,IAAvB,EAAK,cACL,KAAK,cAAgB,YAAY,uBAE5B,EAAK,gBACV,KAAK,cAAgB,EAAK,eAG1B,KAAK,gBACL,KAAK,eAAiB,YAAY,sBAAsB,KAAK,gBAGjE,KAAK,UAAY,EAAK,UACtB,KAAK,UAAY,EAAK,UACtB,KAAK,aAAe,EAAK,aACzB,KAAK,MAAQ,EAAK,MAClB,KAAK,cAAgB,EAAK,cAC1B,KAAK,iBAAmB,EAAK,iBAE7B,KAAK,cAAgB,EAAK,cAC1B,KAAK,aAAe,EAAK,YAC7B,CAEO,eAAA,GAEH,OADA,IAAI,OAAO,eAAe,OAAO,mBAC1B,KAAK,UAAU,CAClB,GAAI,KAAK,GACT,KAAM,KAAK,KACX,QAAS,KAAK,QACd,aAAc,KAAK,aAEnB,cAAe,KAAK,cACpB,UAAW,KAAK,UAChB,UAAW,KAAK,UAChB,aAAc,KAAK,aACnB,MAAO,KAAK,MACZ,cAAe,KAAK,cACpB,iBAAmB,KAAK,iBACxB,cAAe,KAAK,cACpB,aAAc,KAAK,cAE3B,CAEA,wBAAc,CAAkB,GAC5B,OAAO,aAAa,cAAe,qBACnC,MAAM,EAAO,KAAK,MAAM,GACxB,OAAO,IAAI,YAAY,EAC3B,GCtDS,cAAN,MAMI,WAAA,EAAY,IAEf,EAAA,UACA,EAAA,UACA,EAAA,aACA,EAAA,cACA,EAAA,MACA,EAAA,WAEA,EAAA,cACA,EAAA,aACA,EAAA,cACA,EAAA,MACA,EAAA,aACA,EAAA,iBACA,EAAA,iBACA,KACG,IAEH,GAxBJ,KAAiB,QAAU,IAAI,OAAO,kBAwB7B,EAED,MADA,KAAK,QAAQ,MAAM,uBACb,IAAI,MAAM,OAEpB,IAAK,EAED,MADA,KAAK,QAAQ,MAAM,6BACb,IAAI,MAAM,aAEpB,IAAK,EAED,MADA,KAAK,QAAQ,MAAM,gCACb,IAAI,MAAM,gBAEpB,IAAK,EAED,MADA,KAAK,QAAQ,MAAM,iCACb,IAAI,MAAM,iBAEpB,IAAK,EAED,MADA,KAAK,QAAQ,MAAM,yBACb,IAAI,MAAM,SAEpB,IAAK,EAED,MADA,KAAK,QAAQ,MAAM,6BACb,IAAI,MAAM,aAGpB,KAAK,MAAQ,IAAI,YAAY,CACzB,KAAM,EACN,eACA,eAAe,EACf,YACA,YACA,eACA,gBACA,gBACA,QACA,mBACA,iBAGJ,MAAM,EAAY,IAAI,IAAI,GAC1B,EAAU,aAAa,OAAO,YAAa,GAC3C,EAAU,aAAa,OAAO,eAAgB,GAC9C,EAAU,aAAa,OAAO,gBAAiB,GAC/C,EAAU,aAAa,OAAO,QAAS,GACnC,GACA,EAAU,aAAa,OAAO,QAAS,GAG3C,EAAU,aAAa,OAAO,QAAS,KAAK,MAAM,IAC9C,KAAK,MAAM,iBACX,EAAU,aAAa,OACnB,iBACA,KAAK,MAAM,gBAEf,EAAU,aAAa,OAAO,wBAAyB,SAG3D,UAAY,EAAK,KAAU,OAAO,QAAQ,CACtC,mBACG,KACA,IAEU,MAAT,GACA,EAAU,aAAa,OAAO,EAAK,EAAM,YAIjD,KAAK,IAAM,EAAU,IACzB,GCnIE,UAAY,SAKL,eAAN,MAqCI,WAAA,CAAY,GAhBnB,KAAO,aAAe,GAEtB,KAAO,WAAa,GAYpB,KAAO,QAAuB,CAAC,EAG3B,KAAK,MAAQ,EAAO,IAAI,SACxB,KAAK,cAAgB,EAAO,IAAI,iBAEhC,KAAK,MAAQ,EAAO,IAAI,SACxB,KAAK,kBAAoB,EAAO,IAAI,qBACpC,KAAK,UAAY,EAAO,IAAI,aAE5B,KAAK,KAAO,EAAO,IAAI,OAC3B,CAEA,cAAW,GACP,QAAwB,IAApB,KAAK,WAGT,OAAO,KAAK,WAAa,MAAM,cACnC,CACA,cAAW,CAAW,GAEG,iBAAV,IAAoB,EAAQ,OAAO,SAChC,IAAV,GAAuB,GAAS,IAChC,KAAK,WAAa,KAAK,MAAM,GAAS,MAAM,eAEpD,CAEA,YAAW,GAzEf,IAAA,EA0EQ,OAAO,OAAA,EAAA,KAAK,YAAL,EAAA,EAAY,MAAM,KAAK,SAAS,eAAgB,KAAK,QAChE,GCnDS,eAAN,MAMI,WAAA,EAAY,IACf,EAAA,WACA,EAAA,cAAY,EAAA,yBAAe,EAAA,iBAA0B,EAAA,aAAkB,IAEvE,GATJ,KAAiB,QAAU,IAAI,OAAO,mBAS7B,EAED,MADA,KAAK,QAAQ,MAAM,uBACb,IAAI,MAAM,OAGpB,MAAM,EAAY,IAAI,IAAI,GACtB,GACA,EAAU,aAAa,OAAO,gBAAiB,GAG/C,IACA,EAAU,aAAa,OAAO,2BAA4B,GAEtD,IACA,KAAK,MAAQ,IAAI,MAAM,CAAE,KAAM,EAAY,iBAE3C,EAAU,aAAa,OAAO,QAAS,KAAK,MAAM,MAI1D,UAAY,EAAK,KAAU,OAAO,QAAQ,IAAK,IAC9B,MAAT,GACA,EAAU,aAAa,OAAO,EAAK,EAAM,YAIjD,KAAK,IAAM,EAAU,IACzB,GCvDS,gBAAN,MAcI,WAAA,CAAY,GACf,KAAK,MAAQ,EAAO,IAAI,SAExB,KAAK,MAAQ,EAAO,IAAI,SACxB,KAAK,kBAAoB,EAAO,IAAI,qBACpC,KAAK,UAAY,EAAO,IAAI,YAChC,GCmDS,WAAN,MAQI,WAAA,CAAY,GANnB,KAAmB,QAAU,IAAI,OAAO,cAOpC,KAAK,SAAW,IAAI,wBAAwB,GAE5C,KAAK,gBAAkB,IAAI,gBAAgB,KAAK,UAChD,KAAK,WAAa,IAAI,kBAAkB,KAAK,SAAU,KAAK,iBAC5D,KAAK,aAAe,IAAI,YAAY,KAAK,SAAU,KAAK,gBAC5D,CAEA,yBAAa,EAAoB,MAC7B,EAAA,QACA,EAAA,YACA,EAAA,aACA,EAAA,cACA,EAAA,WACA,EAAA,aACA,EAAA,MACA,EAAA,cACA,EAAgB,KAAK,SAAS,cAAA,MAC9B,EAAQ,KAAK,SAAS,MAAA,aACtB,EAAe,KAAK,SAAS,aAAA,OAC7B,EAAS,KAAK,SAAS,OAAA,QACvB,EAAU,KAAK,SAAS,QAAA,QACxB,EAAU,KAAK,SAAS,QAAA,WACxB,EAAa,KAAK,SAAS,WAAA,WAC3B,EAAa,KAAK,SAAS,WAAA,SAC3B,EAAW,KAAK,SAAS,SAAA,cACzB,EAAgB,KAAK,SAAS,cAAA,iBAC9B,EAAmB,KAAK,SAAS,iBAAA,iBACjC,EAAmB,KAAK,SAAS,mBAEjC,MAAM,EAAS,KAAK,QAAQ,OAAO,uBAEnC,GAAsB,SAAlB,EACA,MAAM,IAAI,MAAM,6DAGpB,MAAM,QAAY,KAAK,gBAAgB,2BACvC,EAAO,MAAM,kCAAmC,GAEhD,MAAM,EAAgB,IAAI,cAAc,CACpC,MACA,UAAW,KAAK,SAAS,UACzB,UAAW,KAAK,SAAS,UACzB,eACA,gBACA,QACA,WAAY,EACZ,SAAQ,UAAS,UAAS,aAAY,gBAAe,aAAY,aACjE,WAAU,UAAS,cAAa,mBAAkB,mBAAkB,eAAc,gBAClF,cAAe,KAAK,SAAS,cAC7B,eACA,gBAIE,KAAK,kBAEX,MAAM,EAAc,EAAc,MAElC,aADM,KAAK,SAAS,WAAW,IAAI,EAAY,GAAI,EAAY,mBACxD,CACX,CAEA,6BAAa,CAAwB,EAAa,GAAc,GAC5D,MAAM,EAAS,KAAK,QAAQ,OAAO,2BAE7B,EAAW,IAAI,eAAe,SAAS,WAAW,EAAK,KAAK,SAAS,gBAC3E,IAAK,EAAS,MAGV,MAFA,EAAO,MAAM,IAAI,MAAM,yBAEjB,KAGV,MAAM,QAA0B,KAAK,SAAS,WAAW,EAAc,SAAW,OAAO,EAAS,OAClG,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,uCACjB,KAIV,MAAO,CAAE,MADK,YAAY,kBAAkB,GAC5B,WACpB,CAEA,2BAAa,CAAsB,GAC/B,MAAM,EAAS,KAAK,QAAQ,OAAO,0BAE7B,MAAE,EAAA,SAAO,SAAmB,KAAK,wBAAwB,GAAK,GAGpE,OAFA,EAAO,MAAM,0DACP,KAAK,WAAW,uBAAuB,EAAU,GAChD,CACX,CAEA,6CAAa,EAAwC,SACjD,EAAA,SACA,EAAA,aACA,GAAe,IAEf,MAAM,QAA+C,KAAK,aAAa,oBAAoB,CAAE,WAAU,aACjG,EAAiC,IAAI,eAAe,IAAI,iBAG9D,OAFA,OAAO,OAAO,EAAgB,SACxB,KAAK,WAAW,4BAA4B,EAAgB,GAC3D,CACX,CAEA,qBAAa,EAAgB,MACzB,EAAA,iBACA,IAEA,MAAM,EAAS,KAAK,QAAQ,OAAO,mBAE7B,QAAe,KAAK,aAAa,qBAAqB,CACxD,cAAe,EAAM,cACrB,MAAO,EAAM,MACb,qBAEE,EAAW,IAAI,eAAe,IAAI,iBAIxC,OAHA,OAAO,OAAO,EAAU,GACxB,EAAO,MAAM,sBAAuB,SAC9B,KAAK,WAAW,wBAAwB,EAAU,GACjD,CACX,CAEA,0BAAa,EAAqB,MAC9B,EAAA,cACA,EAAA,aACA,EAAA,yBACA,EAA2B,KAAK,SAAS,yBAAA,iBACzC,EAAmB,KAAK,SAAS,kBACP,CAAC,GAC3B,MAAM,EAAS,KAAK,QAAQ,OAAO,wBAE7B,QAAY,KAAK,gBAAgB,wBACvC,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,4BACjB,KAGV,EAAO,MAAM,gCAAiC,GAE9C,MAAM,EAAU,IAAI,eAAe,CAC/B,MACA,gBACA,2BACA,WAAY,EACZ,mBACA,uBAIE,KAAK,kBAEX,MAAM,EAAe,EAAQ,MAM7B,OALI,IACA,EAAO,MAAM,8CACP,KAAK,SAAS,WAAW,IAAI,EAAa,GAAI,EAAa,oBAG9D,CACX,CAEA,8BAAa,CAAyB,EAAa,GAAc,GAC7D,MAAM,EAAS,KAAK,QAAQ,OAAO,4BAE7B,EAAW,IAAI,gBAAgB,SAAS,WAAW,EAAK,KAAK,SAAS,gBAC5E,IAAK,EAAS,MAAO,CAGjB,GAFA,EAAO,MAAM,wBAET,EAAS,MAET,MADA,EAAO,KAAK,sBAAuB,EAAS,OACtC,IAAI,cAAc,GAG5B,MAAO,CAAE,WAAO,EAAW,WAC/B,CAEA,MAAM,QAA0B,KAAK,SAAS,WAAW,EAAc,SAAW,OAAO,EAAS,OAClG,IAAK,EAED,MADA,EAAO,MAAM,IAAI,MAAM,uCACjB,KAIV,MAAO,CAAE,MADK,MAAM,kBAAkB,GACtB,WACpB,CAEA,4BAAa,CAAuB,GAChC,MAAM,EAAS,KAAK,QAAQ,OAAO,2BAE7B,MAAE,EAAA,SAAO,SAAmB,KAAK,yBAAyB,GAAK,GAQrE,OAPI,GACA,EAAO,MAAM,oDACb,KAAK,WAAW,wBAAwB,EAAU,IAElD,EAAO,MAAM,uDAGV,CACX,CAEO,eAAA,GAEH,OADA,KAAK,QAAQ,OAAO,mBACb,MAAM,gBAAgB,KAAK,SAAS,WAAY,KAAK,SAAS,uBACzE,CAEA,iBAAa,CAAY,EAAe,GAEpC,OADA,KAAK,QAAQ,OAAO,qBACP,KAAK,aAAa,OAAO,CAClC,QACA,gBAAiB,GAEzB,GC3RS,eAAN,MAOI,WAAA,CAA6B,GAAA,KAAA,eANpC,KAAiB,QAAU,IAAI,OAAO,kBA2CtC,KAAU,OAAS,MACf,IAKA,MAAM,EAAgB,EAAK,cAC3B,IAAK,EACD,OAEJ,MAAM,EAAS,KAAK,QAAQ,OAAO,UAanC,GAXI,EAAK,SACL,KAAK,KAAO,EAAK,QAAQ,IACzB,KAAK,KAAO,EAAK,QAAQ,IACzB,EAAO,MAAM,gBAAiB,EAAe,QAAS,KAAK,QAG3D,KAAK,UAAO,EACZ,KAAK,UAAO,EACZ,EAAO,MAAM,gBAAiB,EAAe,qBAG7C,KAAK,oBACL,KAAK,oBAAoB,MAAM,QAInC,IACI,MAAM,QAAY,KAAK,aAAa,gBAAgB,wBACpD,GAAI,EAAK,CACL,EAAO,MAAM,qCAEb,MAAM,EAAY,KAAK,aAAa,SAAS,UACvC,EAAoB,KAAK,aAAa,SAAS,8BAC/C,EAAc,KAAK,aAAa,SAAS,wBAEzC,EAAqB,IAAI,mBAAmB,KAAK,UAAW,EAAW,EAAK,EAAmB,SAC/F,EAAmB,OACzB,KAAK,oBAAsB,EAC3B,EAAmB,MAAM,EAC7B,MAEI,EAAO,KAAK,gDAEpB,OACO,GAEH,EAAO,MAAM,oCAAqC,aAAe,MAAQ,EAAI,QAAU,EAC3F,GAGJ,KAAU,MAAQ,KACd,MAAM,EAAS,KAAK,QAAQ,OAAO,SAQnC,GAPA,KAAK,UAAO,EACZ,KAAK,UAAO,EAER,KAAK,qBACL,KAAK,oBAAoB,OAGzB,KAAK,aAAa,SAAS,wBAAyB,CAIpD,MAAM,EAAc,aAAY,UAC5B,cAAc,GAEd,IACI,MAAM,QAAgB,KAAK,aAAa,qBACxC,GAAI,EAAS,CACT,MAAM,EAAU,CACZ,cAAe,EAAQ,cACvB,QAAS,EAAQ,KAAO,EAAQ,IAAM,CAClC,IAAK,EAAQ,IACb,IAAK,EAAQ,KACb,MAEH,KAAK,OAAO,EACrB,CACJ,OACO,GAEH,EAAO,MAAM,gCAAiC,aAAe,MAAQ,EAAI,QAAU,EACvF,IACD,IACP,GAGJ,KAAU,UAAY,UAClB,MAAM,EAAS,KAAK,QAAQ,OAAO,aACnC,IACI,MAAM,QAAgB,KAAK,aAAa,qBACxC,IAAI,GAAa,EAEb,GAAW,KAAK,oBACZ,EAAQ,MAAQ,KAAK,MACrB,GAAa,EACb,KAAK,oBAAoB,MAAM,EAAQ,eAEnC,EAAQ,MAAQ,KAAK,KACrB,EAAO,MAAM,iFAAkF,EAAQ,gBAGvG,EAAO,MAAM,4GAA6G,EAAQ,eAClI,KAAK,aAAa,OAAO,6BAI7B,EAAO,MAAM,mCAAoC,EAAQ,KAI7D,EAAO,MAAM,oCAGb,EACI,KAAK,KACL,KAAK,aAAa,OAAO,sBAGzB,KAAK,aAAa,OAAO,qBAG7B,EAAO,MAAM,mDAErB,OACO,GACC,KAAK,OACL,EAAO,MAAM,oEAAqE,GAClF,KAAK,aAAa,OAAO,sBAEjC,GAxKK,GACD,KAAK,QAAQ,MAAM,IAAI,MAAM,2BAGjC,KAAK,aAAa,OAAO,cAAc,KAAK,QAC5C,KAAK,aAAa,OAAO,gBAAgB,KAAK,OAE9C,KAAK,QAAQ,OAAO,IAEhB,KAAK,QAAQ,MAAM,EAAG,GAE9B,CAEA,WAAgB,GACZ,KAAK,QAAQ,OAAO,SACpB,MAAM,QAAa,KAAK,aAAa,UAGrC,GAAI,EACK,KAAK,OAAO,QACrB,GACS,KAAK,aAAa,SAAS,wBAAyB,CACzD,MAAM,QAAgB,KAAK,aAAa,qBACxC,GAAI,EAAS,CACT,MAAM,EAAU,CACZ,cAAe,EAAQ,cACvB,QAAS,EAAQ,KAAO,EAAQ,IAAM,CAClC,IAAK,EAAQ,IACb,IAAK,EAAQ,KACb,MAEH,KAAK,OAAO,EACrB,CACJ,CACJ,GCtCS,KAAN,MAsCI,WAAA,CAAY,GArDvB,IAAA,EAgEQ,KAAK,SAAW,EAAK,SACrB,KAAK,cAAgB,OAAA,EAAA,EAAK,eAAL,EAAsB,KAC3C,KAAK,aAAe,EAAK,aACzB,KAAK,cAAgB,EAAK,cAE1B,KAAK,WAAa,EAAK,WACvB,KAAK,MAAQ,EAAK,MAClB,KAAK,QAAU,EAAK,QACpB,KAAK,WAAa,EAAK,WACvB,KAAK,MAAQ,EAAK,SACtB,CAGA,cAAW,GACP,QAAwB,IAApB,KAAK,WAGT,OAAO,KAAK,WAAa,MAAM,cACnC,CAEA,cAAW,CAAW,QACJ,IAAV,IACA,KAAK,WAAa,KAAK,MAAM,GAAS,MAAM,eAEpD,CAGA,WAAW,GACP,MAAM,EAAa,KAAK,WACxB,QAAmB,IAAf,EAGJ,OAAO,GAAc,CACzB,CAGA,UAAW,GApGf,IAAA,EAAA,EAqGQ,OAAO,OAAA,EAAA,OAAA,EAAA,KAAK,YAAL,EAAA,EAAY,MAAM,MAAlB,EAA0B,EACrC,CAEO,eAAA,GAEH,OADA,IAAI,OAAO,QAAQ,OAAO,mBACnB,KAAK,UAAU,CAClB,SAAU,KAAK,SACf,cAAe,KAAK,cACpB,aAAc,KAAK,aACnB,cAAe,KAAK,cACpB,WAAY,KAAK,WACjB,MAAO,KAAK,MACZ,QAAS,KAAK,QACd,WAAY,KAAK,YAEzB,CAEA,wBAAc,CAAkB,GAE5B,OADA,OAAO,aAAa,OAAQ,qBACrB,IAAI,KAAK,KAAK,MAAM,GAC/B,GCnHE,cAAgB,cAcA,oBAAf,iBAAA,GAEH,KAAmB,OAAS,IAAI,MAC5B,6BAEJ,KAAmB,iBAAmB,IAAI,IAE1C,KAAU,QAA8B,KAExC,cAAa,CAAS,GAClB,MAAM,EAAS,KAAK,QAAQ,OAAO,YACnC,IAAK,KAAK,QACN,MAAM,IAAI,MAAM,8CAGpB,EAAO,MAAM,yBACb,KAAK,QAAQ,SAAS,QAAQ,EAAO,KAErC,MAAM,IAAE,EAAA,SAAK,SAAmB,IAAI,SAChC,CAAC,EAAS,KACN,MAAM,EAAY,IACd,MAAM,EAAgC,EAAE,KAExC,GAAK,EAAL,CACA,IACI,MAAM,EAAQ,SAAS,WACnB,EAAK,IACL,EAAO,eACT,IAAI,SAIN,GAHK,GACD,EAAO,KAAK,kCAGZ,EAAE,SAAW,KAAK,SAClB,IAAU,EAAO,MAIjB,MAER,OAAS,GACL,MAGJ,CACA,EAAQ,EAtBG,CAsBC,EAEhB,OAAO,iBAAiB,UAAW,GAAU,GAC7C,KAAK,iBAAiB,KAAI,IACtB,OAAO,oBAAoB,UAAW,GAAU,KAEpD,KAAK,iBAAiB,IAClB,KAAK,OAAO,YAAY,IACpB,KAAK,WACL,EAAO,EAAM,IAErB,IAUR,OAPA,EAAO,MAAM,4BACb,KAAK,WAEA,GACD,KAAK,QAGF,CAAE,MACb,CAIQ,QAAA,GACJ,KAAK,QAAQ,OAAO,YAEpB,UAAW,KAAW,KAAK,iBACvB,IAEJ,KAAK,iBAAiB,OAC1B,CAEA,oBAAiB,CACb,EACA,EACA,GAAW,EACX,EAAe,OAAO,SAAS,QAE/B,EAAO,YACH,CACI,OAAQ,cACR,MACA,YAEJ,EAER,GCvGS,2BAAkD,CAC3D,UAAU,EACV,SAAS,EACT,OAAQ,KAEC,mBAAqB,SAC5B,oDAAsD,GACtD,qCAAuC,EAChC,qCAAuC,IA8EvC,yBAAN,cAAuC,wBAiCnC,WAAA,CAAY,GACf,QAAQ,IAAI,OAAQ,GACpB,MAAM,mBACF,EAAqB,EAAK,aAAA,+BAC1B,EAAiC,EAAK,yBAAA,oBACtC,EAAsB,2BAAA,kBACtB,EAAoB,mBAAA,eACpB,EAAiB,SAAA,eACjB,EAAiB,OAAA,yBAEjB,EAA2B,EAAK,yBAAA,mBAChC,EAAqB,EAAK,mBAAA,oBAE1B,EAAsB,EAAK,aAAA,8BAC3B,EAAgC,qCAAA,aAChC,EAAe,EAAK,aAAA,qBACpB,GAAuB,EAAA,yBACvB,GAA2B,EAAA,4BAC3B,GAA8B,EAAA,eAE9B,GAAiB,EAAA,wBACjB,GAA0B,EAAA,8BAC1B,EAAgC,qCAAA,2BAChC,EAA6B,OAAA,wBAC7B,GAA0B,EAAA,iBAE1B,EAAmB,CAAC,eAAgB,iBAAe,sBACnD,GAAwB,EAAA,8BACxB,GAAgC,EAAA,6CAEhC,EAA+C,oDAAA,UAE/C,GACA,EAkCJ,GAhCA,MAAM,GAEN,KAAK,mBAAqB,EAC1B,KAAK,+BAAiC,EACtC,KAAK,oBAAsB,EAC3B,KAAK,kBAAoB,EACzB,KAAK,eAAiB,EACtB,KAAK,eAAiB,EAEtB,KAAK,yBAA2B,EAChC,KAAK,mBAAqB,EAE1B,KAAK,oBAAsB,EAC3B,KAAK,8BAAgC,EACrC,KAAK,aAAe,EACpB,KAAK,qBAAuB,EAC5B,KAAK,yBAA2B,EAChC,KAAK,4BAA8B,EAEnC,KAAK,eAAiB,EACtB,KAAK,wBAA0B,EAC/B,KAAK,8BAAgC,EACrC,KAAK,wBAA0B,EAC/B,KAAK,2BAA6B,EAElC,KAAK,iBAAmB,EACxB,KAAK,sBAAwB,EAC7B,KAAK,8BAAgC,EAErC,KAAK,6CACD,EAEA,EACA,KAAK,UAAY,MACd,CACH,MAAM,EACgB,oBAAX,OACD,OAAO,eACP,IAAI,mBACd,KAAK,UAAY,IAAI,qBAAqB,CAAE,SAChD,CACJ,GCtMJ,kBAAuB,QAAA,QAAA,eACvB,kBAAA,QAAW,OAaJ,IAAM,aAAN,cAA2B,oBAKvB,WAAA,EAAY,8BACf,EAAgC,qCAAA,OAChC,GAAS,IAET,QARJ,KAAmB,QAAU,IAAI,OAAO,gBASpC,KAAK,kBAAoB,EAEzB,KAAK,OAAS,aAAa,sBAC3B,KAAK,QAAU,KAAK,OAAO,aAC/B,CAEA,yBAAe,GACX,MAAM,EAAS,OAAO,SAAS,cAAc,UAe7C,OAZA,EAAO,MAAM,WAAa,SAC1B,EAAO,MAAM,SAAW,QACxB,EAAO,MAAM,KAAO,UACpB,EAAO,MAAM,IAAM,IACnB,EAAO,MAAQ,IACf,EAAO,OAAS,IAChB,EAAO,aACH,UACA,uFAGJ,OAAO,SAAS,KAAK,YAAY,GAC1B,CACX,CAEA,0BAAe,GACX,MAAM,EAAS,OAAO,SAAS,cAAc,UAG7C,EAAO,MAAM,SAAW,WACxB,EAAO,MAAM,KAAO,IACpB,EAAO,MAAM,IAAM,IACnB,EAAO,MAAQ,OACf,EAAO,OAAS,OAChB,EAAO,aACH,UACA,uFAGJ,IAAI,EAAe,OAAO,SAAS,eAC/B,yBAEJ,IAAK,EAAc,CACf,MAAM,EAAO,6fAab,OAAO,SAAS,KAAK,mBAAmB,YAAa,EACzD,CAMA,OALA,EAAe,OAAO,SAAS,eAC3B,yBAEJ,EAAa,YAAY,GACzB,kBAAA,QAAW,KAAK,gBACT,CACX,CAEA,cAAa,CAAS,GAClB,KAAK,QAAQ,MACT,8BACA,KAAK,mBAET,MAAM,EAAQ,YACV,IACI,KAAK,OAAO,MACR,IAAI,aAAa,yCAEA,IAAzB,KAAK,mBAIT,OAFA,KAAK,iBAAiB,KAAI,IAAM,aAAa,WAEhC,MAAM,SAAS,EAChC,CAEO,KAAA,GAnHX,IAAA,EAoHY,KAAK,SACD,KAAK,OAAO,aACZ,KAAK,OAAO,iBACR,QACC,IAxHrB,IAAA,EAyHwB,MAAM,EAAQ,EAAG,OACjB,OAAA,EAAA,EAAM,aAAN,EAAkB,YAAY,GAC9B,KAAK,OAAO,MAAM,IAAI,MAAM,2BAA0B,IAE1D,GAEJ,OAAA,EAAA,KAAK,OAAO,gBAAZ,EAA2B,SAAS,QAAQ,gBAEhD,KAAK,OAAS,MAElB,KAAK,QAAU,IACnB,CAEA,mBAAc,CAAa,EAAa,GACpC,OAAO,MAAM,cAAc,OAAO,OAAQ,GAAK,EAAO,EAC1D,GC7HS,gBAAN,MAGH,WAAA,CAAoB,GAAA,KAAA,YAFpB,KAAiB,QAAU,IAAI,OAAO,kBAEoB,CAE1D,aAAa,EAAQ,8BACjB,EAAgC,KAAK,UAChC,8BAAA,OACL,EAAS,KAAK,UAAU,eAExB,OAAO,IAAI,aAAa,CACpB,gCACA,UAER,CAEA,cAAa,CAAS,GAClB,KAAK,QAAQ,OAAO,YACpB,aAAa,aAAa,EAAK,KAAK,UAAU,yBAClD,GCtBE,4BAA8B,IAavB,YAAN,cAA0B,oBAKtB,WAAA,EAAY,kBACf,EAAoB,mBAAA,oBACpB,EAAsB,CAAC,IAEvB,QARJ,KAAmB,QAAU,IAAI,OAAO,eASpC,MAAM,EAAgB,WAAW,OAAO,IAAK,8BAA+B,IAC5E,KAAK,QAAU,OAAO,UAAK,EAAW,EAAmB,WAAW,UAAU,GAClF,CAEA,cAAa,CAAS,GAnC1B,IAAA,EAoCQ,OAAA,EAAA,KAAK,UAAL,EAAc,QAEd,MAAM,EAAsB,aAAY,KAC/B,KAAK,UAAW,KAAK,QAAQ,QAC9B,KAAK,OAAO,MAAM,IAAI,MAAM,wBAChC,GACD,6BAGH,OAFA,KAAK,iBAAiB,KAAI,IAAM,cAAc,WAEjC,MAAM,SAAS,EAChC,CAEO,KAAA,GACC,KAAK,UACA,KAAK,QAAQ,SACd,KAAK,QAAQ,QACb,KAAK,OAAO,MAAM,IAAI,MAAM,mBAGpC,KAAK,QAAU,IACnB,CAEA,mBAAc,CAAa,EAAa,GACpC,IAAK,OAAO,OACR,MAAM,IAAI,MAAM,kDAEpB,OAAO,MAAM,cAAc,OAAO,OAAQ,EAAK,EACnD,GCpDS,eAAN,MAGH,WAAA,CAAoB,GAAA,KAAA,YAFpB,KAAiB,QAAU,IAAI,OAAO,iBAEoB,CAE1D,aAAa,EAAQ,oBACjB,EAAsB,KAAK,UAAU,oBAAA,kBACrC,EAAoB,KAAK,UAAU,oBAEnC,OAAO,IAAI,YAAY,CAAE,sBAAqB,qBAClD,CAEA,cAAa,CAAS,EAAa,GAAW,GAC1C,KAAK,QAAQ,OAAO,YAEpB,YAAY,aAAa,EAAK,EAClC,GCRS,kBAAN,MAGH,WAAA,CAAoB,GAAA,KAAA,YAFpB,KAAiB,QAAU,IAAI,OAAO,oBAEoB,CAE1D,aAAa,EAAQ,eACjB,EAAiB,KAAK,UAAU,eAAA,eAChC,EAAiB,KAAK,UAAU,iBA1BxC,IAAA,EA4BQ,KAAK,QAAQ,OAAO,WACpB,IAAI,EAAe,OAAO,KAEH,QAAnB,IACA,EAAe,OAAA,EAAA,OAAO,KAAP,EAAc,OAAO,MAGxC,MAAM,EAAW,EAAa,SAAS,GAAgB,KAAK,EAAa,UACzE,IAAI,EACJ,MAAO,CACH,SAAU,MAAO,IACb,KAAK,QAAQ,OAAO,YAEpB,MAAM,EAAU,IAAI,SAAQ,CAAC,EAAS,KAClC,EAAQ,CAAA,IAGZ,OADA,EAAS,EAAO,WACF,CAAA,EAElB,MAAO,KACH,KAAK,QAAQ,OAAO,SACpB,MAAA,KAAQ,IAAI,MAAM,qBAClB,EAAa,MAAK,EAG9B,GCjBS,kBAAN,cAAgC,kBAU5B,WAAA,CAAY,GACf,MAAM,CAAE,kCAAmC,EAAS,+CAVxD,KAAmB,QAAU,IAAI,OAAO,qBAExC,KAAiB,YAAc,IAAI,MAAc,eACjD,KAAiB,cAAgB,IAAI,MAAU,iBAC/C,KAAiB,kBAAoB,IAAI,MAAe,sBACxD,KAAiB,cAAgB,IAAI,MAAU,kBAC/C,KAAiB,eAAiB,IAAI,MAAU,mBAChD,KAAiB,oBAAsB,IAAI,MAAU,uBAIrD,CAEO,IAAA,CAAK,EAAY,GAAW,GAC/B,MAAM,KAAK,GACP,GACA,KAAK,YAAY,MAAM,EAE/B,CACO,MAAA,GACH,MAAM,SACN,KAAK,cAAc,OACvB,CAKO,aAAA,CAAc,GACjB,OAAO,KAAK,YAAY,WAAW,EACvC,CAIO,gBAAA,CAAiB,GACpB,OAAO,KAAK,YAAY,cAAc,EAC1C,CAKO,eAAA,CAAgB,GACnB,OAAO,KAAK,cAAc,WAAW,EACzC,CAIO,kBAAA,CAAmB,GACtB,OAAO,KAAK,cAAc,cAAc,EAC5C,CAKO,mBAAA,CAAoB,GACvB,OAAO,KAAK,kBAAkB,WAAW,EAC7C,CAIO,sBAAA,CAAuB,GAC1B,OAAO,KAAK,kBAAkB,cAAc,EAChD,CAIO,sBAAA,CAAuB,GAC1B,KAAK,kBAAkB,MAAM,EACjC,CAMO,eAAA,CAAgB,GACnB,OAAO,KAAK,cAAc,WAAW,EACzC,CAIO,kBAAA,CAAmB,GACtB,KAAK,cAAc,cAAc,EACrC,CAIO,kBAAA,GACH,KAAK,cAAc,OACvB,CAMO,gBAAA,CAAiB,GACpB,OAAO,KAAK,eAAe,WAAW,EAC1C,CAIO,mBAAA,CAAoB,GACvB,KAAK,eAAe,cAAc,EACtC,CAIO,mBAAA,GACH,KAAK,eAAe,OACxB,CAMO,qBAAA,CAAsB,GACzB,OAAO,KAAK,oBAAoB,WAAW,EAC/C,CAIO,wBAAA,CAAyB,GAC5B,KAAK,oBAAoB,cAAc,EAC3C,CAIO,wBAAA,GACH,KAAK,oBAAoB,OAC7B,GCzJS,mBAAN,MAKI,WAAA,CAAoB,GAAA,KAAA,eAJ3B,KAAU,QAAU,IAAI,OAAO,sBAC/B,KAAQ,YAAa,EACrB,KAAiB,YAAc,IAAI,MAAM,sBAgCzC,KAAU,eAAsC,UAC5C,MAAM,EAAS,KAAK,QAAQ,OAAO,kBACnC,UACU,KAAK,aAAa,eACxB,EAAO,MAAM,kCACjB,OACO,GACH,GAAI,aAAe,aAIf,OAFA,EAAO,KAAK,kCAAmC,EAAK,oBACpD,KAAK,YAAY,KAAK,GAI1B,EAAO,MAAM,2BAA4B,GACzC,KAAK,aAAa,OAAO,uBAAuB,EACpD,EA9CmD,CAEvD,WAAa,GACT,MAAM,EAAS,KAAK,QAAQ,OAAO,SACnC,IAAK,KAAK,WAAY,CAClB,KAAK,YAAa,EAClB,KAAK,aAAa,OAAO,uBAAuB,KAAK,gBACrD,KAAK,YAAY,WAAW,KAAK,gBAGjC,UACU,KAAK,aAAa,SAE5B,OACO,GAEH,EAAO,MAAM,gBAAiB,EAClC,CACJ,CACJ,CAEO,IAAA,GACC,KAAK,aACL,KAAK,YAAY,SACjB,KAAK,YAAY,cAAc,KAAK,gBACpC,KAAK,aAAa,OAAO,0BAA0B,KAAK,gBACxD,KAAK,YAAa,EAE1B,GClCS,aAAN,MAUH,WAAA,CAAY,GASR,KAAK,cAAgB,EAAK,cAC1B,KAAK,SAAW,EAAK,SACrB,KAAK,cAAgB,EAAK,cAC1B,KAAK,MAAQ,EAAK,MAClB,KAAK,QAAU,EAAK,QAEpB,KAAK,KAAO,EAAK,KACrB,GCFJ,mBAAuB,QAAA,QAAA,eCvBV,wBAA0B,CACnC,EACA,KAAA,IAEI,MAAA,IAAU,CAAC,EACf,eAAgB,IDqGP,YAAN,MAaI,WAAA,CAAY,GAlIvB,IAAA,EAwHI,KAAmB,QAAU,IAAI,OAAO,eAWpC,MAAM,EACF,OAAA,EAAA,MAAA,IACA,OAAO,cADP,EAEC,CAAC,EACN,KAAK,SAAW,IAAI,yBAAyB,GAE7C,KAAK,QAAU,IAAI,WAAW,GAE9B,KAAK,mBAAqB,IAAI,kBAAkB,KAAK,UACrD,KAAK,gBAAkB,IAAI,eAAe,KAAK,UAC/C,KAAK,iBAAmB,IAAI,gBAAgB,KAAK,UAEjD,KAAK,QAAU,IAAI,kBAAkB,KAAK,UAC1C,KAAK,oBAAsB,IAAI,mBAAmB,MAG9C,KAAK,SAAS,sBACd,KAAK,mBAGT,KAAK,gBAAkB,KACnB,KAAK,SAAS,iBACd,KAAK,gBAAkB,IAAI,eAAe,MAElD,CAGA,UAAW,GACP,OAAO,KAAK,OAChB,CAGA,mBAAW,GACP,OAAO,KAAK,QAAQ,eACxB,CAKA,aAAa,GACT,MAAM,EAAS,KAAK,QAAQ,OAAO,WAC7B,QAAa,KAAK,YACxB,OAAI,GACA,EAAO,KAAK,eACZ,KAAK,QAAQ,KAAK,GAAM,GACjB,IAGX,EAAO,KAAK,6BACL,KACX,CAKA,gBAAa,GACT,MAAM,EAAS,KAAK,QAAQ,OAAO,oBAC7B,KAAK,UAAU,MACrB,EAAO,KAAK,6BACZ,KAAK,QAAQ,QACjB,CAKA,oBAAa,CAAe,EAA2B,CAAC,GACpD,KAAK,QAAQ,OAAO,kBACpB,MAAM,eAAE,KAAmB,GAAgB,EACrC,QAAe,KAAK,mBAAmB,QAAQ,CACjD,mBAGE,EAAmB,wBAAA,WAErB,EAAY,wBAGV,KAAK,aACP,CACI,aAAc,UACX,KACA,GAEP,EAER,CAKA,4BAAa,CACT,EAAM,OAAO,SAAS,MAEtB,MAAM,EAAS,KAAK,QAAQ,OAAO,0BAC7B,QAAa,KAAK,WAAW,GAOnC,OANI,EAAK,SAAW,EAAK,QAAQ,IAC7B,EAAO,KAAK,6BAA8B,EAAK,QAAQ,KAEvD,EAAO,KAAK,cAGT,CACX,CAOA,oCAAa,EAA+B,SACxC,EAAA,SACA,EAAA,aACA,GAAe,IAEf,MAAM,EAAS,KAAK,QAAQ,OAAO,iCAE7B,QACI,KAAK,QAAQ,wCAAwC,CACvD,WACA,WACA,iBAER,EAAO,MAAM,uBAEb,MAAM,QAAa,KAAK,WAAW,GAMnC,OALI,EAAK,SAAW,EAAK,QAAQ,IAC7B,EAAO,KAAK,6BAA8B,EAAK,QAAQ,KAEvD,EAAO,KAAK,cAET,CACX,CAKA,iBAAa,CAAY,EAAwB,CAAC,GAC9C,MAAM,EAAS,KAAK,QAAQ,OAAO,gBAC7B,oBAAE,EAAA,kBAAqB,KAAsB,GAAgB,EAE7D,QAAe,KAAK,gBAAgB,QAAQ,CAC9C,sBACA,sBAGE,EAAmB,wBAAA,QAErB,EAAY,kBAGV,QAAa,KAAK,QACpB,CACI,aAAc,OACd,aAAc,IACd,QAAS,WACN,KACA,GAEP,GAUJ,OARI,IACI,EAAK,SAAW,EAAK,QAAQ,IAC7B,EAAO,KAAK,6BAA8B,EAAK,QAAQ,KAEvD,EAAO,KAAK,eAIb,CACX,CAIA,yBAAa,CACT,EAAM,OAAO,SAAS,KACtB,GAAW,GAEX,MAAM,EAAS,KAAK,QAAQ,OAAO,6BAC7B,KAAK,gBAAgB,SAAS,EAAK,GACzC,EAAO,KAAK,UAChB,CAMA,kBAAa,CACT,EAAyB,CAAE,QAAQ,EAAO,cAAU,IA9T5D,IAAA,EAgUQ,MAAM,EAAS,KAAK,QAAQ,OAAO,iBAC7B,8BACF,EAAA,OACA,EAAA,SACA,KACG,GACH,EAEJ,IAOI,EAPA,QAAa,KAAK,YACtB,GAAI,MAAA,OAAA,EAAA,EAAM,cAAe,CACrB,EAAO,MAAM,uBACb,MAAM,EAAQ,IAAI,aAAa,GAC/B,aAAa,KAAK,iBAAiB,EACvC,CAGI,GAAQ,KAAK,SAAS,2BACtB,EAAO,MAAM,iCAAkC,EAAK,QAAQ,KAC5D,EAAY,EAAK,QAAQ,KAG7B,MAAM,QAAe,KAAK,iBAAiB,QAAQ,CAC/C,gCACA,SACA,aAGE,EAAmB,wBAAA,SAErB,EAAY,kBA0BhB,OAvBA,QAAa,KAAK,QACd,CACI,aAAc,OACd,aAAc,IACd,QAAS,QACT,cAAe,KAAK,SAAS,4BACvB,MAAA,OAAA,EAAA,EAAM,cACN,KACH,KACA,GAEP,EACA,GAEJ,mBAAA,QAAW,MAAM,gBACb,KACI,OAAA,EAAA,EAAK,cAAL,EAAA,EAAc,KACd,EAAO,KAAK,6BAA8B,EAAK,QAAQ,KAEvD,EAAO,KAAK,eAIb,CACX,CAEA,sBAAgB,CAAiB,GAC7B,MAAM,QAAiB,KAAK,QAAQ,gBAAgB,CAChD,QACA,iBAAkB,KAAK,SAAS,gCAE9B,EAAO,IAAI,KAAK,IAAK,KAAU,IAIrC,aAFM,KAAK,UAAU,GACrB,KAAK,QAAQ,KAAK,GACX,CACX,CAKA,0BAAa,CACT,EAAM,OAAO,SAAS,MAEtB,MAAM,EAAS,KAAK,QAAQ,OAAO,8BAC7B,KAAK,iBAAiB,SAAS,GACrC,EAAO,KAAK,UAChB,CAEA,oBAAa,CACT,EAAM,OAAO,SAAS,MAEtB,MAAM,MAAE,SAAgB,KAAK,QAAQ,wBAAwB,GAC7D,OAAQ,EAAM,cACV,IAAK,OACD,aAAa,KAAK,uBAAuB,GAC7C,IAAK,OACD,aAAa,KAAK,oBAAoB,GAC1C,IAAK,OACD,aAAa,KAAK,qBAAqB,GAC3C,QACI,MAAM,IAAI,MAAM,kCAE5B,CAEA,qBAAa,CACT,EAAM,OAAO,SAAS,KACtB,GAAW,GAEX,MAAM,MAAE,SAAgB,KAAK,QAAQ,yBAAyB,GAC9D,GAAK,EAIL,OAAQ,EAAM,cACV,IAAK,aACK,KAAK,wBAAwB,GACnC,MACJ,IAAK,aACK,KAAK,qBAAqB,EAAK,GACrC,MACJ,IAAK,aACK,KAAK,sBAAsB,GACjC,MACJ,QACI,MAAM,IAAI,MAAM,kCAE5B,CAKA,wBAAa,CACT,EAA+B,CAAE,QAAQ,EAAO,cAAU,IAE1D,MAAM,EAAS,KAAK,QAAQ,OAAO,uBAC7B,8BACF,EAAA,OACA,EAAA,SACA,KACG,GACH,EACE,EAAM,KAAK,SAAS,oBACrB,GACD,EAAO,MAAM,IAAI,MAAM,sCAG3B,MAAM,QAAa,KAAK,YAClB,QAAe,KAAK,iBAAiB,QAAQ,CAC/C,gCACA,SACA,aAGE,QAAoB,KAAK,aAC3B,CACI,aAAc,OACd,aAAc,EACd,OAAQ,OACR,cAAe,KAAK,SAAS,4BACvB,MAAA,OAAA,EAAA,EAAM,cACN,EACN,cAAe,KAAK,SAAS,2BAC7B,MAAO,SACP,cAAc,KACX,GAEP,GAEJ,IACI,MAAM,QAAuB,KAAK,QAAQ,sBACtC,EAAY,KAIhB,OAFA,EAAO,MAAM,uBAET,EAAe,eAAiB,EAAe,QAAQ,KACvD,EAAO,KAAK,sBAAuB,EAAe,QAAQ,KACnD,CACH,cAAe,EAAe,cAC9B,IAAK,EAAe,QAAQ,IAC5B,IAAK,EAAe,QAAQ,OAIpC,EAAO,KAAK,mCACL,KACX,OAAS,GACL,GACI,KAAK,SAAS,yBACd,aAAe,cAEf,OAAQ,EAAI,OACR,IAAK,iBACL,IAAK,mBACL,IAAK,uBACL,IAAK,6BAED,OADA,EAAO,KAAK,8BACL,CAEH,cAAe,EAAI,eAInC,MAAM,CACV,CACJ,CAEA,aAAgB,CACZ,EACA,EACA,GAEA,MAAM,QAAoB,KAAK,aAAa,EAAM,GAClD,aAAa,KAAK,WAAW,EAAY,IAAK,EAClD,CACA,kBAAgB,CACZ,EACA,GAEA,MAAM,EAAS,KAAK,QAAQ,OAAO,gBAEnC,IACI,MAAM,QAAsB,KAAK,QAAQ,oBAAoB,GAG7D,OAFA,EAAO,MAAM,4BAEA,EAAO,SAAS,CACzB,IAAK,EAAc,IACnB,MAAO,EAAc,MAAM,GAC3B,cAAe,EAAc,MAAM,cACnC,aAAc,KAAK,SAAS,oBAEpC,OAAS,GAKL,MAJA,EAAO,MACH,6DAEJ,EAAO,QACD,CACV,CACJ,CACA,gBAAgB,CAAW,EAAa,GACpC,MAAM,EAAS,KAAK,QAAQ,OAAO,cAC7B,QAAuB,KAAK,QAAQ,sBAAsB,GAChE,EAAO,MAAM,uBAGb,aADmB,KAAK,WAAW,EAAgB,EAEvD,CAEA,gBAAgB,CACZ,EACA,GAEA,MAAM,EAAS,KAAK,QAAQ,OAAO,cAC7B,EAAO,IAAI,KAAK,GAmBtB,aAJM,KAAK,UAAU,GACrB,EAAO,MAAM,eACb,KAAK,QAAQ,KAAK,GAEX,CACX,CAKA,qBAAa,CACT,EAA4B,CAAC,GAE7B,MAAM,EAAS,KAAK,QAAQ,OAAO,oBAC7B,eAAE,KAAmB,GAAgB,EACrC,QAAe,KAAK,mBAAmB,QAAQ,CACjD,yBAEE,KAAK,cACP,CACI,aAAc,OACd,yBACI,KAAK,SAAS,4BACf,GAEP,GAEJ,EAAO,KAAK,UAChB,CAKA,6BAAa,CACT,EAAM,OAAO,SAAS,MAEtB,MAAM,EAAS,KAAK,QAAQ,OAAO,2BAC7B,QAAiB,KAAK,YAAY,GAExC,OADA,EAAO,KAAK,WACL,CACX,CAKA,kBAAa,CAAa,EAAyB,CAAC,GAChD,MAAM,EAAS,KAAK,QAAQ,OAAO,iBAC7B,oBAAE,EAAA,kBAAqB,KAAsB,GAAgB,EAC7D,EAAM,KAAK,SAAS,+BAEpB,QAAe,KAAK,gBAAgB,QAAQ,CAC9C,sBACA,4BAEE,KAAK,SACP,CACI,aAAc,OACd,yBAA0B,EAM1B,MAAc,MAAP,OAAc,EAAY,CAAC,KAC/B,GAEP,GAEJ,EAAO,KAAK,UAChB,CAKA,0BAAa,CACT,EAAM,OAAO,SAAS,KACtB,GAAW,GAEX,MAAM,EAAS,KAAK,QAAQ,OAAO,8BAC7B,KAAK,gBAAgB,SAAS,EAAK,GACzC,EAAO,KAAK,UAChB,CAEA,cAAgB,CACZ,EACA,GAEA,MAAM,QAAoB,KAAK,cAAc,EAAM,GACnD,aAAa,KAAK,YAAY,EAAY,IAC9C,CACA,mBAAgB,CACZ,EAAiC,CAAC,EAClC,GAhqBR,IAAA,EAkqBQ,MAAM,EAAS,KAAK,QAAQ,OAAO,iBAEnC,IACI,MAAM,QAAa,KAAK,YACxB,EAAO,MAAM,oCAET,KAAK,SAAS,6BACR,KAAK,gBAAgB,GAG/B,MAAM,EAAW,EAAK,eAAkB,GAAQ,EAAK,SACjD,IACA,EAAO,MAAM,4CACb,EAAK,cAAgB,SAGnB,KAAK,aACX,EAAO,MAAM,0CAEb,MAAM,QAAuB,KAAK,QAAQ,qBACtC,GAIJ,OAFA,EAAO,MAAM,6BAEA,EAAO,SAAS,CACzB,IAAK,EAAe,IACpB,MAAO,OAAA,EAAA,EAAe,YAAf,EAAA,EAAsB,IAErC,OAAS,GAKL,MAJA,EAAO,MACH,6DAEJ,EAAO,QACD,CACV,CACJ,CACA,iBAAgB,CAAY,GACxB,MAAM,EAAS,KAAK,QAAQ,OAAO,eAC7B,QAAwB,KAAK,QAAQ,uBAAuB,GAGlE,OAFA,EAAO,MAAM,wBAEN,CACX,CAKA,mBAAa,CACT,EAA0B,CAAE,QAAQ,EAAO,cAAU,IAltB7D,IAAA,EAotBQ,MAAM,EAAS,KAAK,QAAQ,OAAO,kBAC7B,8BACF,EAAA,OACA,EAAA,SACA,KACG,GACH,EAEE,EAAgB,KAAK,SAAS,8BAC7B,OAAA,QAAM,KAAK,kBAAX,EAAA,EAAyB,cAC1B,EAEA,EAAM,KAAK,SAAS,+BACpB,QAAe,KAAK,iBAAiB,QAAQ,CAC/C,gCACA,SACA,mBAEE,KAAK,SACP,CACI,aAAc,OACd,yBAA0B,EAC1B,mBACG,GAEP,GAGJ,EAAO,KAAK,UAChB,CAKA,2BAAa,CACT,EAAM,OAAO,SAAS,MAEtB,MAAM,EAAS,KAAK,QAAQ,OAAO,+BAC7B,KAAK,iBAAiB,SAAS,GACrC,EAAO,KAAK,UAChB,CAEA,kBAAa,CAAa,GACtB,MAAM,QAAa,KAAK,kBAClB,KAAK,gBAAgB,EAAM,EACrC,CAEA,qBAAgB,CACZ,EACA,EAAQ,KAAK,SAAS,kBAEtB,MAAM,EAAS,KAAK,QAAQ,OAAO,mBACnC,IAAK,EAAM,OAEX,MAAM,EAAe,EAAM,QACtB,GAA+B,iBAAf,EAAK,KAG1B,GAAK,EAAa,OAAlB,CAMA,UAAW,KAAQ,QACT,KAAK,QAAQ,YACf,EAAK,GACL,GAEJ,EAAO,KAAK,GAAG,0BACF,iBAAT,IACA,EAAK,GAAQ,YAIf,KAAK,UAAU,GACrB,EAAO,MAAM,eACb,KAAK,QAAQ,KAAK,EAhBlB,MAFI,EAAO,MAAM,uCAmBrB,CAKO,gBAAA,GACH,KAAK,QAAQ,OAAO,oBACf,KAAK,oBAAoB,OAClC,CAKO,eAAA,GACH,KAAK,oBAAoB,MAC7B,CAEA,iBAAc,GACV,MAAO,QAAQ,KAAK,SAAS,aAAa,KAAK,SAAS,WAC5D,CAEA,eAAgB,GACZ,MAAM,EAAS,KAAK,QAAQ,OAAO,aAC7B,QAAsB,KAAK,SAAS,UAAU,IAChD,KAAK,eAET,OAAI,GACA,EAAO,MAAM,6BACN,KAAK,kBAAkB,KAGlC,EAAO,MAAM,yBACN,KACX,CAEA,eAAa,CAAU,GACnB,MAAM,EAAS,KAAK,QAAQ,OAAO,aACnC,GAAI,EAAM,CACN,EAAO,MAAM,gBACb,MAAM,EAAgB,EAAK,wBACrB,KAAK,SAAS,UAAU,IAC1B,KAAK,cACL,EAER,MACI,KAAK,QAAQ,MAAM,uBACb,KAAK,SAAS,UAAU,OAAO,KAAK,cAElD,CAKA,qBAAa,SACH,KAAK,QAAQ,iBACvB,G,iBEn1BS,QAAkB","file":"/npm/trinsic-oidc-client-ts@0.1.7-a/dist/umd/oidc-client-ts.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.19.2.\n * Original file: /npm/trinsic-oidc-client-ts@0.1.7-a/dist/umd/oidc-client-ts.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nexport { ErrorResponse, ErrorTimeout } from \"./errors\";\nexport type { IFrameWindowParams, PopupWindowParams, RedirectParams } from \"./navigators\";\nexport { Log, Logger } from \"./utils\";\nexport type { ILogger, PopupWindowFeatures } from \"./utils\";\nexport type { OidcAddressClaim, OidcStandardClaims, IdTokenClaims, JwtClaims } from \"./Claims\";\n\nexport { AccessTokenEvents } from \"./AccessTokenEvents\";\nexport type { AccessTokenCallback } from \"./AccessTokenEvents\";\nexport { CheckSessionIFrame } from \"./CheckSessionIFrame\";\nexport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\nexport type { AsyncStorage } from \"./AsyncStorage\";\nexport { MetadataService } from \"./MetadataService\";\nexport * from \"./OidcClient\";\nexport { OidcClientSettingsStore } from \"./OidcClientSettings\";\nexport type { OidcClientSettings, SigningKey } from \"./OidcClientSettings\";\nexport type { OidcMetadata } from \"./OidcMetadata\";\nexport { SessionMonitor } from \"./SessionMonitor\";\nexport type { SessionStatus } from \"./SessionStatus\";\nexport type { SigninRequest, SigninRequestArgs } from \"./SigninRequest\";\nexport { SigninResponse } from \"./SigninResponse\";\nexport { SigninState } from \"./SigninState\";\nexport type { SignoutRequest, SignoutRequestArgs } from \"./SignoutRequest\";\nexport { SignoutResponse } from \"./SignoutResponse\";\nexport { State } from \"./State\";\nexport type { StateStore } from \"./StateStore\";\nexport { User } from \"./User\";\nexport type { UserProfile } from \"./User\";\nexport * from \"./UserManager\";\nexport type {\n    UserManagerEvents,\n    SilentRenewErrorCallback,\n    UserLoadedCallback,\n    UserSessionChangedCallback,\n    UserSignedInCallback,\n    UserSignedOutCallback,\n    UserUnloadedCallback,\n} from \"./UserManagerEvents\";\nexport { UserManagerSettingsStore } from \"./UserManagerSettings\";\nexport type { UserManagerSettings } from \"./UserManagerSettings\";\nexport { Version } from \"./Version\";\nexport { WebStorageStateStore } from \"./WebStorageStateStore\";\n","import CryptoJS from \"crypto-js/core.js\";\nimport sha256 from \"crypto-js/sha256.js\";\nimport Base64 from \"crypto-js/enc-base64.js\";\nimport Utf8 from \"crypto-js/enc-utf8.js\";\n\nimport { Logger } from \"./Logger\";\n\nconst UUID_V4_TEMPLATE = \"10000000-1000-4000-8000-100000000000\";\n\n/**\n * @internal\n */\nexport class CryptoUtils {\n    private static _randomWord(): number {\n        return CryptoJS.lib.WordArray.random(1).words[0];\n    }\n\n    /**\n     * Generates RFC4122 version 4 guid\n     */\n    public static generateUUIDv4(): string {\n        const uuid = UUID_V4_TEMPLATE.replace(/[018]/g, c =>\n            (+c ^ CryptoUtils._randomWord() & 15 >> +c / 4).toString(16),\n        );\n        return uuid.replace(/-/g, \"\");\n    }\n\n    /**\n     * PKCE: Generate a code verifier\n     */\n    public static generateCodeVerifier(): string {\n        return CryptoUtils.generateUUIDv4() + CryptoUtils.generateUUIDv4() + CryptoUtils.generateUUIDv4();\n    }\n\n    /**\n     * PKCE: Generate a code challenge\n     */\n    public static generateCodeChallenge(code_verifier: string): string {\n        try {\n            const hashed = sha256(code_verifier);\n            return Base64.stringify(hashed).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n        }\n        catch (err) {\n            Logger.error(\"CryptoUtils.generateCodeChallenge\", err);\n            throw err;\n        }\n    }\n\n    /**\n     * Generates a base64-encoded string for a basic auth header\n     */\n    public static generateBasicAuth(client_id: string, client_secret: string): string {\n        const basicAuth = Utf8.parse([client_id, client_secret].join(\":\"));\n        return Base64.stringify(basicAuth);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * Native interface\n *\n * @public\n */\nexport interface ILogger {\n    debug(...args: unknown[]): void;\n    info(...args: unknown[]): void;\n    warn(...args: unknown[]): void;\n    error(...args: unknown[]): void;\n}\n\nconst nopLogger: ILogger = {\n    debug: () => undefined,\n    info: () => undefined,\n    warn: () => undefined,\n    error: () => undefined,\n};\n\nlet level: number;\nlet logger: ILogger;\n\n/**\n * Log levels\n *\n * @public\n */\nexport enum Log {\n    NONE,\n    ERROR,\n    WARN,\n    INFO,\n    DEBUG\n}\n\n/**\n * Log manager\n *\n * @public\n */\nexport namespace Log { // eslint-disable-line @typescript-eslint/no-namespace\n    export function reset(): void {\n        level = Log.INFO;\n        logger = nopLogger;\n    }\n\n    export function setLevel(value: Log): void {\n        if (!(Log.NONE <= value && value <= Log.DEBUG)) {\n            throw new Error(\"Invalid log level\");\n        }\n        level = value;\n    }\n\n    export function setLogger(value: ILogger): void {\n        logger = value;\n    }\n}\n\n/**\n * Internal logger instance\n *\n * @public\n */\nexport class Logger {\n    private _method?: string;\n    public constructor(private _name: string) {}\n\n    public debug(...args: unknown[]): void {\n        if (level >= Log.DEBUG) {\n            logger.debug(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public info(...args: unknown[]): void {\n        if (level >= Log.INFO) {\n            logger.info(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public warn(...args: unknown[]): void {\n        if (level >= Log.WARN) {\n            logger.warn(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public error(...args: unknown[]): void {\n        if (level >= Log.ERROR) {\n            logger.error(Logger._format(this._name, this._method), ...args);\n        }\n    }\n\n    public throw(err: Error): never {\n        this.error(err);\n        throw err;\n    }\n\n    public create(method: string): Logger {\n        const methodLogger: Logger = Object.create(this);\n        methodLogger._method = method;\n        methodLogger.debug(\"begin\");\n        return methodLogger;\n    }\n\n    public static createStatic(name: string, staticMethod: string): Logger {\n        const staticLogger = new Logger(`${name}.${staticMethod}`);\n        staticLogger.debug(\"begin\");\n        return staticLogger;\n    }\n\n    private static _format(name: string, method?: string) {\n        const prefix = `[${name}]`;\n        return method ? `${prefix} ${method}:` : prefix;\n    }\n\n    // helpers for static class methods\n    public static debug(name: string, ...args: unknown[]): void {\n        if (level >= Log.DEBUG) {\n            logger.debug(Logger._format(name), ...args);\n        }\n    }\n    public static info(name: string, ...args: unknown[]): void {\n        if (level >= Log.INFO) {\n            logger.info(Logger._format(name), ...args);\n        }\n    }\n    public static warn(name: string, ...args: unknown[]): void {\n        if (level >= Log.WARN) {\n            logger.warn(Logger._format(name), ...args);\n        }\n    }\n    public static error(name: string, ...args: unknown[]): void {\n        if (level >= Log.ERROR) {\n            logger.error(Logger._format(name), ...args);\n        }\n    }\n}\n\nLog.reset();\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./Logger\";\n\n/**\n * @internal\n */\nexport type Callback<EventType extends unknown[]> = (...ev: EventType) => (Promise<void> | void);\n\n/**\n * @internal\n */\nexport class Event<EventType extends unknown[]> {\n    protected readonly _logger = new Logger(`Event('${this._name}')`);\n\n    private _callbacks: Array<Callback<EventType>> = [];\n\n    public constructor(protected readonly _name: string) {}\n\n    public addHandler(cb: Callback<EventType>): () => void {\n        this._callbacks.push(cb);\n        return () => this.removeHandler(cb);\n    }\n\n    public removeHandler(cb: Callback<EventType>): void {\n        const idx = this._callbacks.lastIndexOf(cb);\n        if (idx >= 0) {\n            this._callbacks.splice(idx, 1);\n        }\n    }\n\n    public raise(...ev: EventType): void {\n        this._logger.debug(\"raise:\", ...ev);\n        for (const cb of this._callbacks) {\n            void cb(...ev);\n        }\n    }\n}\n","import jwt_decode from \"jwt-decode\";\n\nimport { Logger } from \"./Logger\";\nimport type { JwtClaims } from \"../Claims\";\n\n/**\n * @internal\n */\nexport class JwtUtils {\n    // IMPORTANT: doesn't validate the token\n    public static decode(token: string): JwtClaims {\n        try {\n            return jwt_decode<JwtClaims>(token);\n        }\n        catch (err) {\n            Logger.error(\"JwtUtils.decode\", err);\n            throw err;\n        }\n    }\n}\n","/**\n * @see https://developer.mozilla.org/en-US/docs/Web/API/Window/open#window_features\n *\n * @public\n */\nexport interface PopupWindowFeatures {\n    left?: number;\n    top?: number;\n    width?: number;\n    height?: number;\n    menubar?: boolean | string;\n    toolbar?: boolean | string;\n    location?: boolean | string;\n    status?: boolean | string;\n    resizable?: boolean | string;\n    scrollbars?: boolean | string;\n\n    [k: string]: boolean | string | number | undefined;\n}\n\nexport class PopupUtils {\n    /**\n     * Populates a map of window features with a placement centered in front of\n     * the current window. If no explicit width is given, a default value is\n     * binned into [800, 720, 600, 480, 360] based on the current window's width.\n     */\n    static center({ ...features }: PopupWindowFeatures): PopupWindowFeatures {\n        if (features.width == null)\n            features.width = [800, 720, 600, 480].find(width => width <= window.outerWidth / 1.618) ?? 360;\n        features.left ??= Math.max(0, Math.round(window.screenX + (window.outerWidth - features.width) / 2));\n        if (features.height != null)\n            features.top ??= Math.max(0, Math.round(window.screenY + (window.outerHeight - features.height) / 2));\n        return features;\n    }\n\n    static serialize(features: PopupWindowFeatures): string {\n        return Object.entries(features)\n            .filter(([, value]) => value != null)\n            .map(([key, value]) => `${key}=${typeof value !== \"boolean\" ? value as string : value ? \"yes\" : \"no\"}`)\n            .join(\",\");\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Event } from \"./Event\";\nimport { Logger } from \"./Logger\";\n\n/**\n * @internal\n */\nexport class Timer extends Event<[void]> {\n    protected readonly _logger = new Logger(`Timer('${this._name}')`);\n    private _timerHandle: ReturnType<typeof setInterval> | null = null;\n    private _expiration = 0;\n\n    // get the time\n    public static getEpochTime(): number {\n        return Math.floor(Date.now() / 1000);\n    }\n\n    public init(durationInSeconds: number): void {\n        const logger = this._logger.create(\"init\");\n        durationInSeconds = Math.max(Math.floor(durationInSeconds), 1);\n        const expiration = Timer.getEpochTime() + durationInSeconds;\n        if (this.expiration === expiration && this._timerHandle) {\n            // no need to reinitialize to same expiration, so bail out\n            logger.debug(\"skipping since already initialized for expiration at\", this.expiration);\n            return;\n        }\n\n        this.cancel();\n\n        logger.debug(\"using duration\", durationInSeconds);\n        this._expiration = expiration;\n\n        // we're using a fairly short timer and then checking the expiration in the\n        // callback to handle scenarios where the browser device sleeps, and then\n        // the timers end up getting delayed.\n        const timerDurationInSeconds = Math.min(durationInSeconds, 5);\n        this._timerHandle = setInterval(this._callback, timerDurationInSeconds * 1000);\n    }\n\n    public get expiration(): number {\n        return this._expiration;\n    }\n\n    public cancel(): void {\n        this._logger.create(\"cancel\");\n        if (this._timerHandle) {\n            clearInterval(this._timerHandle);\n            this._timerHandle = null;\n        }\n    }\n\n    protected _callback = (): void => {\n        const diff = this._expiration - Timer.getEpochTime();\n        this._logger.debug(\"timer completes in\", diff);\n\n        if (this._expiration <= Timer.getEpochTime()) {\n            this.cancel();\n            super.raise();\n        }\n    };\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * @internal\n */\nexport class UrlUtils {\n    public static readParams(url: string, responseMode: \"query\" | \"fragment\" = \"query\"): URLSearchParams {\n        if (!url) throw new TypeError(\"Invalid URL\");\n        const parsedUrl = new URL(url, window.location.origin);\n        const params = parsedUrl[responseMode === \"fragment\" ? \"hash\" : \"search\"];\n        return new URLSearchParams(params.slice(1));\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\n\n/**\n * Error class thrown in case of an authentication error.\n *\n * See https://openid.net/specs/openid-connect-core-1_0.html#AuthError\n *\n * @public\n */\nexport class ErrorResponse extends Error {\n    /** Marker to detect class: \"ErrorResponse\" */\n    public readonly name: string = \"ErrorResponse\";\n\n    /** An error code string that can be used to classify the types of errors that occur and to respond to errors. */\n    public readonly error: string | null;\n    /** additional information that can help a developer identify the cause of the error.*/\n    public readonly error_description: string | null;\n    /**\n     * URI identifying a human-readable web page with information about the error, used to provide the client\n       developer with additional information about the error.\n    */\n    public readonly error_uri: string | null;\n\n    /** custom state data set during the initial signin request */\n    public state?: unknown;\n\n    public readonly session_state: string | null;\n\n    public constructor(\n        args: {\n            error?: string | null; error_description?: string | null; error_uri?: string | null;\n            userState?: unknown; session_state?: string | null;\n        },\n        /** The x-www-form-urlencoded request body sent to the authority server */\n        public readonly form?: URLSearchParams,\n    ) {\n        super(args.error_description || args.error || \"\");\n\n        if (!args.error) {\n            Logger.error(\"ErrorResponse\", \"No error passed\");\n            throw new Error(\"No error passed\");\n        }\n\n        this.error = args.error;\n        this.error_description = args.error_description ?? null;\n        this.error_uri = args.error_uri ?? null;\n\n        this.state = args.userState;\n        this.session_state = args.session_state ?? null;\n    }\n}\n","// Copyright (C) 2021 AuthTS Contributors\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * Error class thrown in case of network timeouts (e.g IFrame time out).\n *\n * @public\n */\nexport class ErrorTimeout extends Error {\n    /** Marker to detect class: \"ErrorTimeout\" */\n    public readonly name: string = \"ErrorTimeout\";\n\n    public constructor(message?: string) {\n        super(message);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport type AccessTokenCallback = (...ev: unknown[]) => (Promise<void> | void);\n\n/**\n * @public\n */\nexport class AccessTokenEvents {\n    protected readonly _logger = new Logger(\"AccessTokenEvents\");\n\n    private readonly _expiringTimer = new Timer(\"Access token expiring\");\n    private readonly _expiredTimer = new Timer(\"Access token expired\");\n    private readonly _expiringNotificationTimeInSeconds: number;\n\n    public constructor(args: { expiringNotificationTimeInSeconds: number }) {\n        this._expiringNotificationTimeInSeconds = args.expiringNotificationTimeInSeconds;\n    }\n\n    public load(container: User): void {\n        const logger = this._logger.create(\"load\");\n        // only register events if there's an access token and it has an expiration\n        if (container.access_token && container.expires_in !== undefined) {\n            const duration = container.expires_in;\n            logger.debug(\"access token present, remaining duration:\", duration);\n\n            if (duration > 0) {\n                // only register expiring if we still have time\n                let expiring = duration - this._expiringNotificationTimeInSeconds;\n                if (expiring <= 0) {\n                    expiring = 1;\n                }\n\n                logger.debug(\"registering expiring timer, raising in\", expiring, \"seconds\");\n                this._expiringTimer.init(expiring);\n            }\n            else {\n                logger.debug(\"canceling existing expiring timer because we're past expiration.\");\n                this._expiringTimer.cancel();\n            }\n\n            // if it's negative, it will still fire\n            const expired = duration + 1;\n            logger.debug(\"registering expired timer, raising in\", expired, \"seconds\");\n            this._expiredTimer.init(expired);\n        }\n        else {\n            this._expiringTimer.cancel();\n            this._expiredTimer.cancel();\n        }\n    }\n\n    public unload(): void {\n        this._logger.debug(\"unload: canceling existing access token timers\");\n        this._expiringTimer.cancel();\n        this._expiredTimer.cancel();\n    }\n\n    /**\n     * Add callback: Raised prior to the access token expiring.\n     */\n    public addAccessTokenExpiring(cb: AccessTokenCallback): () => void {\n        return this._expiringTimer.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised prior to the access token expiring.\n     */\n    public removeAccessTokenExpiring(cb: AccessTokenCallback): void {\n        this._expiringTimer.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised after the access token has expired.\n     */\n    public addAccessTokenExpired(cb: AccessTokenCallback): () => void {\n        return this._expiredTimer.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised after the access token has expired.\n     */\n    public removeAccessTokenExpired(cb: AccessTokenCallback): void {\n        this._expiredTimer.removeHandler(cb);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\n\n/**\n * @internal\n */\nexport class CheckSessionIFrame {\n    private readonly _logger = new Logger(\"CheckSessionIFrame\");\n    private _frame_origin: string;\n    private _frame: HTMLIFrameElement;\n    private _timer: ReturnType<typeof setInterval> | null = null;\n    private _session_state: string | null = null;\n\n    public constructor(\n        private _callback: () => Promise<void>,\n        private _client_id: string,\n        url: string,\n        private _intervalInSeconds: number,\n        private _stopOnError: boolean,\n    ) {\n        const parsedUrl = new URL(url);\n        this._frame_origin = parsedUrl.origin;\n\n        this._frame = window.document.createElement(\"iframe\");\n\n        // shotgun approach\n        this._frame.style.visibility = \"hidden\";\n        this._frame.style.position = \"fixed\";\n        this._frame.style.left = \"-1000px\";\n        this._frame.style.top = \"0\";\n        this._frame.width = \"0\";\n        this._frame.height = \"0\";\n        this._frame.src = parsedUrl.href;\n    }\n\n    public load(): Promise<void> {\n        return new Promise<void>((resolve) => {\n            this._frame.onload = () => {\n                resolve();\n            };\n\n            window.document.body.appendChild(this._frame);\n            window.addEventListener(\"message\", this._message, false);\n        });\n    }\n\n    private _message = (e: MessageEvent<string>): void => {\n        if (e.origin === this._frame_origin &&\n            e.source === this._frame.contentWindow\n        ) {\n            if (e.data === \"error\") {\n                this._logger.error(\"error message from check session op iframe\");\n                if (this._stopOnError) {\n                    this.stop();\n                }\n            }\n            else if (e.data === \"changed\") {\n                this._logger.debug(\"changed message from check session op iframe\");\n                this.stop();\n                void this._callback();\n            }\n            else {\n                this._logger.debug(e.data + \" message from check session op iframe\");\n            }\n        }\n    };\n\n    public start(session_state: string): void {\n        if (this._session_state === session_state) {\n            return;\n        }\n\n        this._logger.create(\"start\");\n\n        this.stop();\n\n        this._session_state = session_state;\n\n        const send = () => {\n            if (!this._frame.contentWindow || !this._session_state) {\n                return;\n            }\n\n            this._frame.contentWindow.postMessage(this._client_id + \" \" + this._session_state, this._frame_origin);\n        };\n\n        // trigger now\n        send();\n\n        // and setup timer\n        this._timer = setInterval(send, this._intervalInSeconds * 1000);\n    }\n\n    public stop(): void {\n        this._logger.create(\"stop\");\n        this._session_state = null;\n\n        if (this._timer) {\n\n            clearInterval(this._timer);\n            this._timer = null;\n        }\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\n\n/**\n * @public\n */\nexport class InMemoryWebStorage implements Storage {\n    private readonly _logger = new Logger(\"InMemoryWebStorage\");\n    private _data: Record<string, string> = {};\n\n    public clear(): void {\n        this._logger.create(\"clear\");\n        this._data = {};\n    }\n\n    public getItem(key: string): string {\n        this._logger.create(`getItem('${key}')`);\n        return this._data[key];\n    }\n\n    public setItem(key: string, value: string): void {\n        this._logger.create(`setItem('${key}')`);\n        this._data[key] = value;\n    }\n\n    public removeItem(key: string): void {\n        this._logger.create(`removeItem('${key}')`);\n        delete this._data[key];\n    }\n\n    public get length(): number {\n        return Object.getOwnPropertyNames(this._data).length;\n    }\n\n    public key(index: number): string {\n        return Object.getOwnPropertyNames(this._data)[index];\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { ErrorResponse, ErrorTimeout } from \"./errors\";\nimport { Logger } from \"./utils\";\n\n/**\n * @internal\n */\nexport type JwtHandler = (text: string) => Promise<Record<string, unknown>>;\n\n/**\n * @internal\n */\nexport interface GetJsonOpts {\n    token?: string;\n    credentials?: RequestCredentials;\n}\n\n/**\n * @internal\n */\nexport interface PostFormOpts {\n    body: URLSearchParams;\n    basicAuth?: string;\n    timeoutInSeconds?: number;\n    initCredentials?: \"same-origin\" | \"include\" | \"omit\";\n}\n\n/**\n * @internal\n */\nexport class JsonService {\n    private readonly _logger = new Logger(\"JsonService\");\n\n    private _contentTypes: string[] = [];\n\n    public constructor(\n        additionalContentTypes: string[] = [],\n        private _jwtHandler: JwtHandler | null = null,\n    ) {\n        this._contentTypes.push(...additionalContentTypes, \"application/json\");\n        if (_jwtHandler) {\n            this._contentTypes.push(\"application/jwt\");\n        }\n    }\n\n    protected async fetchWithTimeout(input: RequestInfo, init: RequestInit & { timeoutInSeconds?: number } = {}) {\n        const { timeoutInSeconds, ...initFetch } = init;\n        if (!timeoutInSeconds) {\n            return await fetch(input, initFetch);\n        }\n\n        const controller = new AbortController();\n        const timeoutId = setTimeout(() => controller.abort(), timeoutInSeconds * 1000);\n\n        try {\n            const response = await fetch(input, {\n                ...init,\n                signal: controller.signal,\n            });\n            return response;\n        }\n        catch (err) {\n            if (err instanceof DOMException && err.name === \"AbortError\") {\n                throw new ErrorTimeout(\"Network timed out\");\n            }\n            throw err;\n        }\n        finally {\n            clearTimeout(timeoutId);\n        }\n    }\n\n    public async getJson(url: string, {\n        token,\n        credentials,\n    }: GetJsonOpts = {}): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"getJson\");\n        const headers: HeadersInit = {\n            \"Accept\": this._contentTypes.join(\", \"),\n        };\n        if (token) {\n            logger.debug(\"token passed, setting Authorization header\");\n            headers[\"Authorization\"] = \"Bearer \" + token;\n        }\n\n        let response: Response;\n        try {\n            logger.debug(\"url:\", url);\n            response = await this.fetchWithTimeout(url, { method: \"GET\", headers, credentials });\n        }\n        catch (err) {\n            logger.error(\"Network Error\");\n            throw err;\n        }\n\n        logger.debug(\"HTTP response received, status\", response.status);\n        const contentType = response.headers.get(\"Content-Type\");\n        if (contentType && !this._contentTypes.find(item => contentType.startsWith(item))) {\n            logger.throw(new Error(`Invalid response Content-Type: ${(contentType ?? \"undefined\")}, from URL: ${url}`));\n        }\n        if (response.ok && this._jwtHandler && contentType?.startsWith(\"application/jwt\")) {\n            return await this._jwtHandler(await response.text());\n        }\n        let json: Record<string, unknown>;\n        try {\n            json = await response.json();\n        }\n        catch (err) {\n            logger.error(\"Error parsing JSON response\", err);\n            if (response.ok) throw err;\n            throw new Error(`${response.statusText} (${response.status})`);\n        }\n        if (!response.ok) {\n            logger.error(\"Error from server:\", json);\n            if (json.error) {\n                throw new ErrorResponse(json);\n            }\n            throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n        }\n        return json;\n    }\n\n    public async postForm(url: string, {\n        body,\n        basicAuth,\n        timeoutInSeconds,\n        initCredentials,\n    }: PostFormOpts): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"postForm\");\n        const headers: HeadersInit = {\n            \"Accept\": this._contentTypes.join(\", \"),\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n        };\n        if (basicAuth !== undefined) {\n            headers[\"Authorization\"] = \"Basic \" + basicAuth;\n        }\n\n        let response: Response;\n        try {\n            logger.debug(\"url:\", url);\n            response = await this.fetchWithTimeout(url, { method: \"POST\", headers, body, timeoutInSeconds, credentials: initCredentials });\n        }\n        catch (err) {\n            logger.error(\"Network error\");\n            throw err;\n        }\n\n        logger.debug(\"HTTP response received, status\", response.status);\n        const contentType = response.headers.get(\"Content-Type\");\n        if (contentType && !this._contentTypes.find(item => contentType.startsWith(item))) {\n            throw new Error(`Invalid response Content-Type: ${(contentType ?? \"undefined\")}, from URL: ${url}`);\n        }\n\n        const responseText = await response.text();\n\n        let json: Record<string, unknown> = {};\n        if (responseText) {\n            try {\n                json = JSON.parse(responseText);\n            }\n            catch (err) {\n                logger.error(\"Error parsing JSON response\", err);\n                if (response.ok) throw err;\n                throw new Error(`${response.statusText} (${response.status})`);\n            }\n        }\n\n        if (!response.ok) {\n            logger.error(\"Error from server:\", json);\n            if (json.error) {\n                throw new ErrorResponse(json, body);\n            }\n            throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n        }\n\n        return json;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { OidcClientSettingsStore, SigningKey } from \"./OidcClientSettings\";\nimport type { OidcMetadata } from \"./OidcMetadata\";\n\n/**\n * @public\n */\nexport class MetadataService {\n    private readonly _logger = new Logger(\"MetadataService\");\n    private readonly _jsonService = new JsonService([\"application/jwk-set+json\"]);\n\n    // cache\n    private _metadataUrl: string;\n    private _signingKeys: SigningKey[] | null = null;\n    private _metadata: Partial<OidcMetadata> | null = null;\n    private _fetchRequestCredentials: RequestCredentials | undefined;\n\n    public constructor(private readonly _settings: OidcClientSettingsStore) {\n        this._metadataUrl = this._settings.metadataUrl;\n\n        if (this._settings.signingKeys) {\n            this._logger.debug(\"using signingKeys from settings\");\n            this._signingKeys = this._settings.signingKeys;\n        }\n\n        if (this._settings.metadata) {\n            this._logger.debug(\"using metadata from settings\");\n            this._metadata = this._settings.metadata;\n        }\n\n        if (this._settings.fetchRequestCredentials) {\n            this._logger.debug(\"using fetchRequestCredentials from settings\");\n            this._fetchRequestCredentials = this._settings.fetchRequestCredentials;\n        }\n    }\n\n    public resetSigningKeys(): void {\n        this._signingKeys = null;\n    }\n\n    public async getMetadata(): Promise<Partial<OidcMetadata>> {\n        const logger = this._logger.create(\"getMetadata\");\n        if (this._metadata) {\n            logger.debug(\"using cached values\");\n            return this._metadata;\n        }\n\n        if (!this._metadataUrl) {\n            logger.throw(new Error(\"No authority or metadataUrl configured on settings\"));\n            throw null;\n        }\n\n        logger.debug(\"getting metadata from\", this._metadataUrl);\n        const metadata = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials });\n\n        logger.debug(\"merging remote JSON with seed metadata\");\n        this._metadata = Object.assign({}, this._settings.metadataSeed, metadata);\n        return this._metadata;\n    }\n\n    public getIssuer(): Promise<string> {\n        return this._getMetadataProperty(\"issuer\") as Promise<string>;\n    }\n\n    public getAuthorizationEndpoint(): Promise<string> {\n        return this._getMetadataProperty(\"authorization_endpoint\") as Promise<string>;\n    }\n\n    public getUserInfoEndpoint(): Promise<string> {\n        return this._getMetadataProperty(\"userinfo_endpoint\") as Promise<string>;\n    }\n\n    public getTokenEndpoint(optional: false): Promise<string>;\n    public getTokenEndpoint(optional?: true): Promise<string | undefined>;\n    public getTokenEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"token_endpoint\", optional) as Promise<string | undefined>;\n    }\n\n    public getCheckSessionIframe(): Promise<string | undefined> {\n        return this._getMetadataProperty(\"check_session_iframe\", true) as Promise<string | undefined>;\n    }\n\n    public getEndSessionEndpoint(): Promise<string | undefined> {\n        return this._getMetadataProperty(\"end_session_endpoint\", true) as Promise<string | undefined>;\n    }\n\n    public getRevocationEndpoint(optional: false): Promise<string>;\n    public getRevocationEndpoint(optional?: true): Promise<string | undefined>;\n    public getRevocationEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"revocation_endpoint\", optional) as Promise<string | undefined>;\n    }\n\n    public getKeysEndpoint(optional: false): Promise<string>;\n    public getKeysEndpoint(optional?: true): Promise<string | undefined>;\n    public getKeysEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"jwks_uri\", optional) as Promise<string | undefined>;\n    }\n\n    protected async _getMetadataProperty(name: keyof OidcMetadata, optional=false): Promise<string | boolean | string[] | undefined> {\n        const logger = this._logger.create(`_getMetadataProperty('${name}')`);\n\n        const metadata = await this.getMetadata();\n        logger.debug(\"resolved\");\n\n        if (metadata[name] === undefined) {\n            if (optional === true) {\n                logger.warn(\"Metadata does not contain optional property\");\n                return undefined;\n            }\n\n            logger.throw(new Error(\"Metadata does not contain property \" + name));\n        }\n\n        return metadata[name];\n    }\n\n    public async getSigningKeys(): Promise<SigningKey[] | null> {\n        const logger = this._logger.create(\"getSigningKeys\");\n        if (this._signingKeys) {\n            logger.debug(\"returning signingKeys from cache\");\n            return this._signingKeys;\n        }\n\n        const jwks_uri = await this.getKeysEndpoint(false);\n        logger.debug(\"got jwks_uri\", jwks_uri);\n\n        const keySet = await this._jsonService.getJson(jwks_uri);\n        logger.debug(\"got key set\", keySet);\n\n        if (!Array.isArray(keySet.keys)) {\n            logger.throw(new Error(\"Missing keys on keyset\"));\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        this._signingKeys = keySet.keys;\n        return this._signingKeys;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport type { StateStore } from \"./StateStore\";\nimport type { AsyncStorage } from \"./AsyncStorage\";\n\n/**\n * @public\n */\nexport class WebStorageStateStore implements StateStore {\n    private readonly _logger = new Logger(\"WebStorageStateStore\");\n\n    private readonly _store: AsyncStorage | Storage;\n    private readonly _prefix: string;\n\n    public constructor({\n        prefix = \"oidc.\",\n        store = localStorage,\n    }: { prefix?: string; store?: AsyncStorage | Storage } = {}) {\n        this._store = store;\n        this._prefix = prefix;\n    }\n\n    public async set(key: string, value: string): Promise<void> {\n        this._logger.create(`set('${key}')`);\n\n        key = this._prefix + key;\n        await this._store.setItem(key, value);\n    }\n\n    public async get(key: string): Promise<string | null> {\n        this._logger.create(`get('${key}')`);\n\n        key = this._prefix + key;\n        const item = await this._store.getItem(key);\n        return item;\n    }\n\n    public async remove(key: string): Promise<string | null> {\n        this._logger.create(`remove('${key}')`);\n\n        key = this._prefix + key;\n        const item = await this._store.getItem(key);\n        await this._store.removeItem(key);\n        return item;\n    }\n\n    public async getAllKeys(): Promise<string[]> {\n        this._logger.create(\"getAllKeys\");\n        const len = await this._store.length;\n\n        const keys = [];\n        for (let index = 0; index < len; index++) {\n            const key = await this._store.key(index);\n            if (key && key.indexOf(this._prefix) === 0) {\n                keys.push(key.substr(this._prefix.length));\n            }\n        }\n        return keys;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { WebStorageStateStore } from \"./WebStorageStateStore\";\nimport type { OidcMetadata } from \"./OidcMetadata\";\nimport type { StateStore } from \"./StateStore\";\nimport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\n\nconst DefaultResponseType = \"code\";\nconst DefaultScope = \"openid\";\nconst DefaultClientAuthentication = \"client_secret_post\";\nconst DefaultResponseMode = \"query\";\nconst DefaultStaleStateAgeInSeconds = 60 * 15;\nconst DefaultClockSkewInSeconds = 60 * 5;\n\n/**\n * @public\n */\nexport type SigningKey = Record<string, string | string[]>;\n\n/**\n * The settings used to configure the {@link OidcClient}.\n *\n * @public\n */\nexport interface OidcClientSettings {\n    /** The URL of the OIDC/OAuth2 provider */\n    authority: string;\n    metadataUrl?: string;\n    /** Provide metadata when authority server does not allow CORS on the metadata endpoint */\n    metadata?: Partial<OidcMetadata>;\n    /** Can be used to seed or add additional values to the results of the discovery request */\n    metadataSeed?: Partial<OidcMetadata>;\n    /** Provide signingKeys when authority server does not allow CORS on the jwks uri */\n    signingKeys?: SigningKey[];\n\n    /** Your client application's identifier as registered with the OIDC/OAuth2 */\n    client_id: string;\n    client_secret?: string;\n    /** The type of response desired from the OIDC/OAuth2 provider (default: \"code\") */\n    response_type?: string;\n    /** The scope being requested from the OIDC/OAuth2 provider (default: \"openid\") */\n    scope?: string;\n    /** The redirect URI of your client application to receive a response from the OIDC/OAuth2 provider */\n    redirect_uri: string;\n    /** The OIDC/OAuth2 post-logout redirect URI */\n    post_logout_redirect_uri?: string;\n\n    /**\n     * Client authentication method that is used to authenticate when using the token endpoint (default: \"client_secret_post\")\n     * - \"client_secret_basic\": using the HTTP Basic authentication scheme\n     * - \"client_secret_post\": including the client credentials in the request body\n     *\n     * See https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication\n     */\n    client_authentication?: \"client_secret_basic\" | \"client_secret_post\";\n\n    /** optional protocol param */\n    prompt?: string;\n    /** optional protocol param */\n    display?: string;\n    /** optional protocol param */\n    max_age?: number;\n    /** optional protocol param */\n    ui_locales?: string;\n    /** optional protocol param */\n    acr_values?: string;\n    /** optional protocol param */\n    resource?: string;\n\n    /** optional protocol param (default: \"query\") */\n    response_mode?: \"query\" | \"fragment\";\n\n    /** Should OIDC protocol claims be removed from profile (default: true) */\n    filterProtocolClaims?: boolean;\n    /** Flag to control if additional identity data is loaded from the user info endpoint in order to populate the user's profile (default: false) */\n    loadUserInfo?: boolean;\n    /** Number (in seconds) indicating the age of state entries in storage for authorize requests that are considered abandoned and thus can be cleaned up (default: 900) */\n    staleStateAgeInSeconds?: number;\n\n    /** @deprecated Unused */\n    clockSkewInSeconds?: number;\n    /** @deprecated Unused */\n    userInfoJwtIssuer?: \"ANY\" | \"OP\" | string;\n\n    /**\n     * Indicates if objects returned from the user info endpoint as claims (e.g. `address`) are merged into the claims from the id token as a single object.\n     * Otherwise, they are added to an array as distinct objects for the claim type. (default: false)\n     */\n    mergeClaims?: boolean;\n\n    /**\n     * Storage object used to persist interaction state (default: window.localStorage, InMemoryWebStorage iff no window).\n     * E.g. `stateStore: new WebStorageStateStore({ store: window.localStorage })`\n     */\n    stateStore?: StateStore;\n\n    /**\n     * An object containing additional query string parameters to be including in the authorization request.\n     * E.g, when using Azure AD to obtain an access token an additional resource parameter is required. extraQueryParams: `{resource:\"some_identifier\"}`\n     */\n    extraQueryParams?: Record<string, string | number | boolean>;\n\n    extraTokenParams?: Record<string, unknown>;\n\n    /**\n     * @deprecated since version 2.1.0. Use fetchRequestCredentials instead.\n     */\n    refreshTokenCredentials?: \"same-origin\" | \"include\" | \"omit\";\n\n    /**\n     * Will check the content type header of the response of the revocation endpoint to match these passed values (default: [])\n     */\n    revokeTokenAdditionalContentTypes?: string[];\n\n    /**\n     * Sets the credentials for fetch requests. (default: \"same-origin\")\n     * Use this if you need to send cookies to the OIDC/OAuth2 provider or if you are using a proxy that requires cookies\n     */\n    fetchRequestCredentials?: RequestCredentials;\n}\n\n/**\n * The settings with defaults applied of the {@link OidcClient}.\n * @see {@link OidcClientSettings}\n *\n * @public\n */\nexport class OidcClientSettingsStore {\n    // metadata\n    public readonly authority: string;\n    public readonly metadataUrl: string;\n    public readonly metadata: Partial<OidcMetadata> | undefined;\n    public readonly metadataSeed: Partial<OidcMetadata> | undefined;\n    public readonly signingKeys: SigningKey[] | undefined;\n\n    // client config\n    public readonly client_id: string;\n    public readonly client_secret: string | undefined;\n    public readonly response_type: string;\n    public readonly scope: string;\n    public readonly redirect_uri: string;\n    public readonly post_logout_redirect_uri: string | undefined;\n    public readonly client_authentication: \"client_secret_basic\" | \"client_secret_post\";\n\n    // optional protocol params\n    public readonly prompt: string | undefined;\n    public readonly display: string | undefined;\n    public readonly max_age: number | undefined;\n    public readonly ui_locales: string | undefined;\n    public readonly acr_values: string | undefined;\n    public readonly resource: string | undefined;\n    public readonly response_mode: \"query\" | \"fragment\";\n\n    // behavior flags\n    public readonly filterProtocolClaims: boolean;\n    public readonly loadUserInfo: boolean;\n    public readonly staleStateAgeInSeconds: number;\n    public readonly clockSkewInSeconds: number;\n    public readonly userInfoJwtIssuer: \"ANY\" | \"OP\" | string;\n    public readonly mergeClaims: boolean;\n\n    public readonly stateStore: StateStore;\n\n    // extra\n    public readonly extraQueryParams: Record<string, string | number | boolean>;\n    public readonly extraTokenParams: Record<string, unknown>;\n\n    public readonly revokeTokenAdditionalContentTypes?: string[];\n    public readonly fetchRequestCredentials: RequestCredentials;\n\n    public constructor({\n        // metadata related\n        authority, metadataUrl, metadata, signingKeys, metadataSeed,\n        // client related\n        client_id, client_secret, response_type = DefaultResponseType, scope = DefaultScope,\n        redirect_uri, post_logout_redirect_uri,\n        client_authentication = DefaultClientAuthentication,\n        // optional protocol\n        prompt, display, max_age, ui_locales, acr_values, resource, response_mode = DefaultResponseMode,\n        // behavior flags\n        filterProtocolClaims = true,\n        loadUserInfo = false,\n        staleStateAgeInSeconds = DefaultStaleStateAgeInSeconds,\n        clockSkewInSeconds = DefaultClockSkewInSeconds,\n        userInfoJwtIssuer = \"OP\",\n        mergeClaims = false,\n        // other behavior\n        stateStore,\n        refreshTokenCredentials,\n        revokeTokenAdditionalContentTypes,\n        fetchRequestCredentials,\n        // extra query params\n        extraQueryParams = {},\n        extraTokenParams = {},\n    }: OidcClientSettings) {\n\n        this.authority = authority;\n\n        if (metadataUrl) {\n            this.metadataUrl = metadataUrl;\n        } else {\n            this.metadataUrl = authority;\n            if (authority) {\n                if (!this.metadataUrl.endsWith(\"/\")) {\n                    this.metadataUrl += \"/\";\n                }\n                this.metadataUrl += \".well-known/openid-configuration\";\n            }\n        }\n\n        this.metadata = metadata;\n        this.metadataSeed = metadataSeed;\n        this.signingKeys = signingKeys;\n\n        this.client_id = client_id;\n        this.client_secret = client_secret;\n        this.response_type = response_type;\n        this.scope = scope;\n        this.redirect_uri = redirect_uri;\n        this.post_logout_redirect_uri = post_logout_redirect_uri;\n        this.client_authentication = client_authentication;\n\n        this.prompt = prompt;\n        this.display = display;\n        this.max_age = max_age;\n        this.ui_locales = ui_locales;\n        this.acr_values = acr_values;\n        this.resource = resource;\n        this.response_mode = response_mode;\n\n        this.filterProtocolClaims = !!filterProtocolClaims;\n        this.loadUserInfo = !!loadUserInfo;\n        this.staleStateAgeInSeconds = staleStateAgeInSeconds;\n        this.clockSkewInSeconds = clockSkewInSeconds;\n        this.userInfoJwtIssuer = userInfoJwtIssuer;\n        this.mergeClaims = !!mergeClaims;\n\n        this.revokeTokenAdditionalContentTypes = revokeTokenAdditionalContentTypes;\n\n        if (fetchRequestCredentials && refreshTokenCredentials) {\n            console.warn(\"Both fetchRequestCredentials and refreshTokenCredentials is set. Only fetchRequestCredentials will be used.\");\n        }\n        this.fetchRequestCredentials = fetchRequestCredentials ? fetchRequestCredentials\n            : refreshTokenCredentials ? refreshTokenCredentials : \"same-origin\";\n\n        if (stateStore) {\n            this.stateStore = stateStore;\n        }\n        else {\n            const store = typeof window !== \"undefined\" ? window.localStorage : new InMemoryWebStorage();\n            this.stateStore = new WebStorageStateStore({ store });\n        }\n\n        this.extraQueryParams = extraQueryParams;\n        this.extraTokenParams = extraTokenParams;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, JwtUtils } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { MetadataService } from \"./MetadataService\";\nimport type { JwtClaims } from \"./Claims\";\nimport type { OidcClientSettingsStore } from \"./OidcClientSettings\";\n\n/**\n * @internal\n */\nexport class UserInfoService {\n    protected readonly _logger = new Logger(\"UserInfoService\");\n    private readonly _jsonService: JsonService;\n\n    public constructor(private readonly _settings: OidcClientSettingsStore,\n        private readonly _metadataService: MetadataService,\n    ) {\n        this._jsonService = new JsonService(undefined, this._getClaimsFromJwt);\n    }\n\n    public async getClaims(token: string): Promise<JwtClaims> {\n        const logger = this._logger.create(\"getClaims\");\n        if (!token) {\n            this._logger.throw(new Error(\"No token passed\"));\n        }\n\n        const url = await this._metadataService.getUserInfoEndpoint();\n        logger.debug(\"got userinfo url\", url);\n\n        const claims = await this._jsonService.getJson(url, {\n            token,\n            credentials: this._settings.fetchRequestCredentials,\n        });\n        logger.debug(\"got claims\", claims);\n\n        return claims;\n    }\n\n    protected _getClaimsFromJwt = async (responseText: string): Promise<JwtClaims> => {\n        const logger = this._logger.create(\"_getClaimsFromJwt\");\n        try {\n            const payload = JwtUtils.decode(responseText);\n            logger.debug(\"JWT decoding successful\");\n\n            return payload;\n        } catch (err) {\n            logger.error(\"Error parsing JWT response\");\n            throw err;\n        }\n    };\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { CryptoUtils, Logger } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { MetadataService } from \"./MetadataService\";\nimport type { OidcClientSettingsStore } from \"./OidcClientSettings\";\n\n/**\n * @internal\n */\nexport interface ExchangeCodeArgs {\n    client_id?: string;\n    client_secret?: string;\n    redirect_uri?: string;\n\n    grant_type?: string;\n    code: string;\n    code_verifier?: string;\n}\n\n/**\n * @internal\n */\nexport interface ExchangeCredentialsArgs {\n    client_id?: string;\n    client_secret?: string;\n\n    grant_type?: string;\n    scope?: string;\n\n    username: string;\n    password: string;\n}\n\n/**\n * @internal\n */\nexport interface ExchangeRefreshTokenArgs {\n    client_id?: string;\n    client_secret?: string;\n\n    grant_type?: string;\n    refresh_token: string;\n    scope?: string;\n\n    timeoutInSeconds?: number;\n}\n\n/**\n * @internal\n */\nexport interface RevokeArgs {\n    token: string;\n    token_type_hint?: \"access_token\" | \"refresh_token\";\n}\n\n/**\n * @internal\n */\nexport class TokenClient {\n    private readonly _logger = new Logger(\"TokenClient\");\n    private readonly _jsonService;\n\n    public constructor(\n        private readonly _settings: OidcClientSettingsStore,\n        private readonly _metadataService: MetadataService,\n    ) {\n        this._jsonService = new JsonService(this._settings.revokeTokenAdditionalContentTypes);\n    }\n\n    public async exchangeCode({\n        grant_type = \"authorization_code\",\n        redirect_uri = this._settings.redirect_uri,\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        ...args\n    }: ExchangeCodeArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeCode\");\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n        if (!redirect_uri) {\n            logger.throw(new Error(\"A redirect_uri is required\"));\n        }\n        if (!args.code) {\n            logger.throw(new Error(\"A code is required\"));\n        }\n        if (!args.code_verifier) {\n            logger.throw(new Error(\"A code_verifier is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type, redirect_uri });\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n        let basicAuth: string | undefined;\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                if (!client_secret) {\n                    logger.throw(new Error(\"A client_secret is required\"));\n                    throw null; // https://github.com/microsoft/TypeScript/issues/46972\n                }\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n        }\n\n        const url = await this._metadataService.getTokenEndpoint(false);\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, { body: params, basicAuth, initCredentials: this._settings.fetchRequestCredentials });\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    public async exchangeCredentials({\n        grant_type = \"password\",\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        scope = this._settings.scope,\n        username,\n        password,\n    }: ExchangeCredentialsArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeCredentials\");\n\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type, username, password, scope });\n\n        let basicAuth: string | undefined;\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                if (!client_secret) {\n                    logger.throw(new Error(\"A client_secret is required\"));\n                    throw null; // https://github.com/microsoft/TypeScript/issues/46972\n                }\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n        }\n\n        const url = await this._metadataService.getTokenEndpoint(false);\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, { body: params, basicAuth, initCredentials: this._settings.fetchRequestCredentials });\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    public async exchangeRefreshToken({\n        grant_type = \"refresh_token\",\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        timeoutInSeconds,\n        ...args\n    }: ExchangeRefreshTokenArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeRefreshToken\");\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n        if (!args.refresh_token) {\n            logger.throw(new Error(\"A refresh_token is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type });\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n        let basicAuth: string | undefined;\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                if (!client_secret) {\n                    logger.throw(new Error(\"A client_secret is required\"));\n                    throw null; // https://github.com/microsoft/TypeScript/issues/46972\n                }\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n        }\n\n        const url = await this._metadataService.getTokenEndpoint(false);\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    /**\n     * Revoke an access or refresh token.\n     *\n     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1\n     */\n    public async revoke(args: RevokeArgs): Promise<void> {\n        const logger = this._logger.create(\"revoke\");\n        if (!args.token) {\n            logger.throw(new Error(\"A token is required\"));\n        }\n\n        const url = await this._metadataService.getRevocationEndpoint(false);\n\n        logger.debug(`got revocation endpoint, revoking ${args.token_type_hint ?? \"default token type\"}`);\n\n        const params = new URLSearchParams();\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n        params.set(\"client_id\", this._settings.client_id);\n        if (this._settings.client_secret) {\n            params.set(\"client_secret\", this._settings.client_secret);\n        }\n\n        await this._jsonService.postForm(url, { body: params });\n        logger.debug(\"got response\");\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, JwtUtils } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport type { MetadataService } from \"./MetadataService\";\nimport { UserInfoService } from \"./UserInfoService\";\nimport { TokenClient } from \"./TokenClient\";\nimport type { OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport type { SigninState } from \"./SigninState\";\nimport type { SigninResponse } from \"./SigninResponse\";\nimport type { State } from \"./State\";\nimport type { SignoutResponse } from \"./SignoutResponse\";\nimport type { UserProfile } from \"./User\";\nimport type { RefreshState } from \"./RefreshState\";\nimport type { JwtClaims, IdTokenClaims } from \"./Claims\";\n\n/**\n * Derived from the following sets of claims:\n * - {@link https://datatracker.ietf.org/doc/html/rfc7519.html#section-4.1}\n * - {@link https://openid.net/specs/openid-connect-core-1_0.html#IDToken}\n * - {@link https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken}\n *\n * @internal\n */\nconst ProtocolClaims = [\n    \"iss\",\n    // \"sub\" should never be excluded, we need access to it internally\n    \"aud\",\n    \"exp\",\n    \"nbf\",\n    \"iat\",\n    \"jti\",\n    \"auth_time\",\n    \"nonce\",\n    \"acr\",\n    \"amr\",\n    \"azp\",\n    // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken\n    \"at_hash\",\n] as const;\n\n/**\n * @internal\n */\nexport class ResponseValidator {\n    protected readonly _logger = new Logger(\"ResponseValidator\");\n    protected readonly _userInfoService = new UserInfoService(this._settings, this._metadataService);\n    protected readonly _tokenClient = new TokenClient(this._settings, this._metadataService);\n\n    public constructor(\n        protected readonly _settings: OidcClientSettingsStore,\n        protected readonly _metadataService: MetadataService,\n    ) {}\n\n    public async validateSigninResponse(response: SigninResponse, state: SigninState): Promise<void> {\n        const logger = this._logger.create(\"validateSigninResponse\");\n\n        this._processSigninState(response, state);\n        logger.debug(\"state processed\");\n\n        await this._processCode(response, state);\n        logger.debug(\"code processed\");\n\n        if (response.isOpenId) {\n            this._validateIdTokenAttributes(response);\n        }\n        logger.debug(\"tokens validated\");\n\n        await this._processClaims(response, state?.skipUserInfo, response.isOpenId);\n        logger.debug(\"claims processed\");\n    }\n\n    public async validateCredentialsResponse(response: SigninResponse, skipUserInfo: boolean): Promise<void> {\n        const logger = this._logger.create(\"validateCredentialsResponse\");\n\n        if (response.isOpenId) {\n            this._validateIdTokenAttributes(response);\n        }\n        logger.debug(\"tokens validated\");\n\n        await this._processClaims(response, skipUserInfo, response.isOpenId);\n        logger.debug(\"claims processed\");\n    }\n\n    public async validateRefreshResponse(response: SigninResponse, state: RefreshState): Promise<void> {\n        const logger = this._logger.create(\"validateRefreshResponse\");\n\n        response.userState = state.data;\n        // if there's no session_state on the response, copy over session_state from original request\n        response.session_state ??= state.session_state;\n        // if there's no scope on the response, then assume all scopes granted (per-spec) and copy over scopes from original request\n        response.scope ??= state.scope;\n\n        // OpenID Connect Core 1.0 says that id_token is optional in refresh response:\n        // https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse\n        if (response.isOpenId && !!response.id_token) {\n            this._validateIdTokenAttributes(response, state.id_token);\n            logger.debug(\"ID Token validated\");\n        }\n\n        if (!response.id_token) {\n            // if there's no id_token on the response, copy over id_token from original request\n            response.id_token = state.id_token;\n            // and decoded part too\n            response.profile = state.profile;\n        }\n\n        const hasIdToken = response.isOpenId && !!response.id_token;\n        await this._processClaims(response, false, hasIdToken);\n        logger.debug(\"claims processed\");\n    }\n\n    public validateSignoutResponse(response: SignoutResponse, state: State): void {\n        const logger = this._logger.create(\"validateSignoutResponse\");\n        if (state.id !== response.state) {\n            logger.throw(new Error(\"State does not match\"));\n        }\n\n        // now that we know the state matches, take the stored data\n        // and set it into the response so callers can get their state\n        // this is important for both success & error outcomes\n        logger.debug(\"state validated\");\n        response.userState = state.data;\n\n        if (response.error) {\n            logger.warn(\"Response was error\", response.error);\n            throw new ErrorResponse(response);\n        }\n    }\n\n    protected _processSigninState(response: SigninResponse, state: SigninState): void {\n        const logger = this._logger.create(\"_processSigninState\");\n        if (state.id !== response.state) {\n            logger.throw(new Error(\"State does not match\"));\n        }\n\n        if (!state.client_id) {\n            logger.throw(new Error(\"No client_id on state\"));\n        }\n\n        if (!state.authority) {\n            logger.throw(new Error(\"No authority on state\"));\n        }\n\n        // ensure we're using the correct authority\n        if (this._settings.authority !== state.authority) {\n            logger.throw(new Error(\"authority mismatch on settings vs. signin state\"));\n        }\n        if (this._settings.client_id && this._settings.client_id !== state.client_id) {\n            logger.throw(new Error(\"client_id mismatch on settings vs. signin state\"));\n        }\n\n        // now that we know the state matches, take the stored data\n        // and set it into the response so callers can get their state\n        // this is important for both success & error outcomes\n        logger.debug(\"state validated\");\n        response.userState = state.data;\n        // if there's no scope on the response, then assume all scopes granted (per-spec) and copy over scopes from original request\n        response.scope ??= state.scope;\n\n        if (response.error) {\n            logger.warn(\"Response was error\", response.error);\n            throw new ErrorResponse(response);\n        }\n\n        if (state.code_verifier && !response.code) {\n            logger.throw(new Error(\"Expected code in response\"));\n        }\n\n        if (!state.code_verifier && response.code) {\n            logger.throw(new Error(\"Unexpected code in response\"));\n        }\n    }\n\n    protected async _processClaims(response: SigninResponse, skipUserInfo = false, validateSub = true): Promise<void> {\n        const logger = this._logger.create(\"_processClaims\");\n        response.profile = this._filterProtocolClaims(response.profile);\n\n        if (skipUserInfo || !this._settings.loadUserInfo || !response.access_token) {\n            logger.debug(\"not loading user info\");\n            return;\n        }\n\n        logger.debug(\"loading user info\");\n        const claims = await this._userInfoService.getClaims(response.access_token);\n        logger.debug(\"user info claims received from user info endpoint\");\n\n        if (validateSub && claims.sub !== response.profile.sub) {\n            logger.throw(new Error(\"subject from UserInfo response does not match subject in ID Token\"));\n        }\n\n        response.profile = this._mergeClaims(response.profile, this._filterProtocolClaims(claims as IdTokenClaims));\n        logger.debug(\"user info claims received, updated profile:\", response.profile);\n    }\n\n    protected _mergeClaims(claims1: UserProfile, claims2: JwtClaims): UserProfile {\n        const result = { ...claims1 };\n\n        for (const [claim, values] of Object.entries(claims2)) {\n            for (const value of Array.isArray(values) ? values : [values]) {\n                const previousValue = result[claim];\n                if (!previousValue) {\n                    result[claim] = value;\n                }\n                else if (Array.isArray(previousValue)) {\n                    if (!previousValue.includes(value)) {\n                        previousValue.push(value);\n                    }\n                }\n                else if (result[claim] !== value) {\n                    if (typeof value === \"object\" && this._settings.mergeClaims) {\n                        result[claim] = this._mergeClaims(previousValue as UserProfile, value);\n                    }\n                    else {\n                        result[claim] = [previousValue, value];\n                    }\n                }\n            }\n        }\n\n        return result;\n    }\n\n    protected _filterProtocolClaims(claims: UserProfile): UserProfile {\n        const result = { ...claims };\n\n        if (this._settings.filterProtocolClaims) {\n            for (const type of ProtocolClaims) {\n                delete result[type];\n            }\n        }\n\n        return result;\n    }\n\n    protected async _processCode(response: SigninResponse, state: SigninState): Promise<void> {\n        const logger = this._logger.create(\"_processCode\");\n        if (response.code) {\n            logger.debug(\"Validating code\");\n            const tokenResponse = await this._tokenClient.exchangeCode({\n                client_id: state.client_id,\n                client_secret: state.client_secret,\n                code: response.code,\n                redirect_uri: state.redirect_uri,\n                code_verifier: state.code_verifier,\n                ...state.extraTokenParams,\n            });\n            Object.assign(response, tokenResponse);\n        } else {\n            logger.debug(\"No code to process\");\n        }\n    }\n\n    protected _validateIdTokenAttributes(response: SigninResponse, currentToken?: string): void {\n        const logger = this._logger.create(\"_validateIdTokenAttributes\");\n\n        logger.debug(\"decoding ID Token JWT\");\n        const profile = JwtUtils.decode(response.id_token ?? \"\");\n\n        if (!profile.sub) {\n            logger.throw(new Error(\"ID Token is missing a subject claim\"));\n        }\n\n        if (currentToken) {\n            const current = JwtUtils.decode(currentToken);\n            if (current.sub !== profile.sub) {\n                logger.throw(new Error(\"sub in id_token does not match current sub\"));\n            }\n            if (current.auth_time && current.auth_time !== profile.auth_time) {\n                logger.throw(new Error(\"auth_time in id_token does not match original auth_time\"));\n            }\n            if (current.azp && current.azp !== profile.azp) {\n                logger.throw(new Error(\"azp in id_token does not match original azp\"));\n            }\n            if (!current.azp && profile.azp) {\n                logger.throw(new Error(\"azp not in id_token, but present in original id_token\"));\n            }\n        }\n\n        response.profile = profile as UserProfile;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, CryptoUtils, Timer } from \"./utils\";\nimport type { StateStore } from \"./StateStore\";\n\n/**\n * @public\n */\nexport class State {\n    public readonly id: string;\n    public readonly created: number;\n    public readonly request_type: string | undefined;\n\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    public readonly data: unknown | undefined;\n\n    public constructor(args: {\n        id?: string;\n        data?: unknown;\n        created?: number;\n        request_type?: string;\n    }) {\n        this.id = args.id || CryptoUtils.generateUUIDv4();\n        this.data = args.data;\n\n        if (args.created && args.created > 0) {\n            this.created = args.created;\n        }\n        else {\n            this.created = Timer.getEpochTime();\n        }\n        this.request_type = args.request_type;\n    }\n\n    public toStorageString(): string {\n        new Logger(\"State\").create(\"toStorageString\");\n        return JSON.stringify({\n            id: this.id,\n            data: this.data,\n            created: this.created,\n            request_type: this.request_type,\n        });\n    }\n\n    public static fromStorageString(storageString: string): State {\n        Logger.createStatic(\"State\", \"fromStorageString\");\n        return new State(JSON.parse(storageString));\n    }\n\n    public static async clearStaleState(storage: StateStore, age: number): Promise<void> {\n        const logger = Logger.createStatic(\"State\", \"clearStaleState\");\n        const cutoff = Timer.getEpochTime() - age;\n\n        const keys = await storage.getAllKeys();\n        logger.debug(\"got keys\", keys);\n\n        for (let i = 0; i < keys.length; i++) {\n            const key = keys[i];\n            const item = await storage.get(key);\n            let remove = false;\n\n            if (item) {\n                try {\n                    const state = State.fromStorageString(item);\n\n                    logger.debug(\"got item from key:\", key, state.created);\n                    if (state.created <= cutoff) {\n                        remove = true;\n                    }\n                }\n                catch (err) {\n                    logger.error(\"Error parsing state for key:\", key, err);\n                    remove = true;\n                }\n            }\n            else {\n                logger.debug(\"no item in storage for key:\", key);\n                remove = true;\n            }\n\n            if (remove) {\n                logger.debug(\"removed item for key:\", key);\n                void storage.remove(key);\n            }\n        }\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, CryptoUtils } from \"./utils\";\nimport { State } from \"./State\";\n\n/**\n * @public\n */\nexport class SigninState extends State {\n    // isCode\n    /** The same code_verifier that was used to obtain the authorization_code via PKCE. */\n    public readonly code_verifier: string | undefined;\n    /** Used to secure authorization code grants via Proof Key for Code Exchange (PKCE). */\n    public readonly code_challenge: string | undefined;\n\n    // to ensure state still matches settings\n    /** @see {@link OidcClientSettings.authority} */\n    public readonly authority: string;\n    /** @see {@link OidcClientSettings.client_id} */\n    public readonly client_id: string;\n    /** @see {@link OidcClientSettings.redirect_uri} */\n    public readonly redirect_uri: string;\n    /** @see {@link OidcClientSettings.scope} */\n    public readonly scope: string;\n    /** @see {@link OidcClientSettings.client_secret} */\n    public readonly client_secret: string | undefined;\n    /** @see {@link OidcClientSettings.extraTokenParams} */\n    public readonly extraTokenParams: Record<string, unknown> | undefined;\n    /** @see {@link OidcClientSettings.response_mode} */\n    public readonly response_mode: \"query\" | \"fragment\" | undefined;\n\n    public readonly skipUserInfo: boolean | undefined;\n\n    public constructor(args: {\n        id?: string;\n        data?: unknown;\n        created?: number;\n        request_type?: string;\n\n        code_verifier?: string | boolean;\n        authority: string;\n        client_id: string;\n        redirect_uri: string;\n        scope: string;\n        client_secret?: string;\n        extraTokenParams?: Record<string, unknown>;\n        response_mode?: \"query\" | \"fragment\";\n        skipUserInfo?: boolean;\n    }) {\n        super(args);\n\n        if (args.code_verifier === true) {\n            this.code_verifier = CryptoUtils.generateCodeVerifier();\n        }\n        else if (args.code_verifier) {\n            this.code_verifier = args.code_verifier;\n        }\n\n        if (this.code_verifier) {\n            this.code_challenge = CryptoUtils.generateCodeChallenge(this.code_verifier);\n        }\n\n        this.authority = args.authority;\n        this.client_id = args.client_id;\n        this.redirect_uri = args.redirect_uri;\n        this.scope = args.scope;\n        this.client_secret = args.client_secret;\n        this.extraTokenParams = args.extraTokenParams;\n\n        this.response_mode = args.response_mode;\n        this.skipUserInfo = args.skipUserInfo;\n    }\n\n    public toStorageString(): string {\n        new Logger(\"SigninState\").create(\"toStorageString\");\n        return JSON.stringify({\n            id: this.id,\n            data: this.data,\n            created: this.created,\n            request_type: this.request_type,\n\n            code_verifier: this.code_verifier,\n            authority: this.authority,\n            client_id: this.client_id,\n            redirect_uri: this.redirect_uri,\n            scope: this.scope,\n            client_secret: this.client_secret,\n            extraTokenParams : this.extraTokenParams,\n            response_mode: this.response_mode,\n            skipUserInfo: this.skipUserInfo,\n        });\n    }\n\n    public static fromStorageString(storageString: string): SigninState {\n        Logger.createStatic(\"SigninState\", \"fromStorageString\");\n        const data = JSON.parse(storageString);\n        return new SigninState(data);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { SigninState } from \"./SigninState\";\n\n/**\n * @public\n */\nexport interface SigninRequestArgs {\n    // mandatory\n    url: string;\n    authority: string;\n    client_id: string;\n    redirect_uri: string;\n    response_type: string;\n    scope: string;\n\n    // optional\n    prompt?: string;\n    display?: string;\n    max_age?: number;\n    ui_locales?: string;\n    id_token_hint?: string;\n    login_hint?: string;\n    acr_values?: string;\n    resource?: string;\n    response_mode?: \"query\" | \"fragment\";\n    request?: string;\n    request_uri?: string;\n    extraQueryParams?: Record<string, string | number | boolean>;\n    request_type?: string;\n    client_secret?: string;\n    extraTokenParams?: Record<string, unknown>;\n    skipUserInfo?: boolean;\n    nonce?: string;\n\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state_data?: unknown;\n}\n\n/**\n * @public\n */\nexport class SigninRequest {\n    private readonly _logger = new Logger(\"SigninRequest\");\n\n    public readonly url: string;\n    public readonly state: SigninState;\n\n    public constructor({\n        // mandatory\n        url,\n        authority,\n        client_id,\n        redirect_uri,\n        response_type,\n        scope,\n        // optional\n        state_data,\n        response_mode,\n        request_type,\n        client_secret,\n        nonce,\n        skipUserInfo,\n        extraQueryParams,\n        extraTokenParams,\n        ...optionalParams\n    }: SigninRequestArgs) {\n        if (!url) {\n            this._logger.error(\"ctor: No url passed\");\n            throw new Error(\"url\");\n        }\n        if (!client_id) {\n            this._logger.error(\"ctor: No client_id passed\");\n            throw new Error(\"client_id\");\n        }\n        if (!redirect_uri) {\n            this._logger.error(\"ctor: No redirect_uri passed\");\n            throw new Error(\"redirect_uri\");\n        }\n        if (!response_type) {\n            this._logger.error(\"ctor: No response_type passed\");\n            throw new Error(\"response_type\");\n        }\n        if (!scope) {\n            this._logger.error(\"ctor: No scope passed\");\n            throw new Error(\"scope\");\n        }\n        if (!authority) {\n            this._logger.error(\"ctor: No authority passed\");\n            throw new Error(\"authority\");\n        }\n\n        this.state = new SigninState({\n            data: state_data,\n            request_type,\n            code_verifier: true,\n            client_id,\n            authority,\n            redirect_uri,\n            response_mode,\n            client_secret,\n            scope,\n            extraTokenParams,\n            skipUserInfo,\n        });\n\n        const parsedUrl = new URL(url);\n        parsedUrl.searchParams.append(\"client_id\", client_id);\n        parsedUrl.searchParams.append(\"redirect_uri\", redirect_uri);\n        parsedUrl.searchParams.append(\"response_type\", response_type);\n        parsedUrl.searchParams.append(\"scope\", scope);\n        if (nonce) {\n            parsedUrl.searchParams.append(\"nonce\", nonce);\n        }\n\n        parsedUrl.searchParams.append(\"state\", this.state.id);\n        if (this.state.code_challenge) {\n            parsedUrl.searchParams.append(\n                \"code_challenge\",\n                this.state.code_challenge,\n            );\n            parsedUrl.searchParams.append(\"code_challenge_method\", \"S256\");\n        }\n\n        for (const [key, value] of Object.entries({\n            response_mode,\n            ...optionalParams,\n            ...extraQueryParams,\n        })) {\n            if (value != null) {\n                parsedUrl.searchParams.append(key, value.toString());\n            }\n        }\n\n        this.url = parsedUrl.href;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Timer } from \"./utils\";\nimport type { UserProfile } from \"./User\";\n\nconst OidcScope = \"openid\";\n\n/**\n * @public\n */\nexport class SigninResponse {\n    // props present in the initial callback response regardless of success\n    public readonly state: string | null;\n    /** @see {@link User.session_state} */\n    public session_state: string | null;\n\n    // error props\n    /** @see {@link ErrorResponse.error} */\n    public readonly error: string | null;\n    /** @see {@link ErrorResponse.error_description} */\n    public readonly error_description: string | null;\n    /** @see {@link ErrorResponse.error_uri} */\n    public readonly error_uri: string | null;\n\n    // success props\n    public readonly code: string | null;\n\n    // props set after validation\n    /** @see {@link User.id_token} */\n    public id_token?: string;\n    /** @see {@link User.access_token} */\n    public access_token = \"\";\n    /** @see {@link User.token_type} */\n    public token_type = \"\";\n    /** @see {@link User.refresh_token} */\n    public refresh_token?: string;\n    /** @see {@link User.scope} */\n    public scope?: string;\n    /** @see {@link User.expires_at} */\n    public expires_at?: number;\n\n    /** custom state data set during the initial signin request */\n    public userState: unknown;\n\n    /** @see {@link User.profile} */\n    public profile: UserProfile = {} as UserProfile;\n\n    public constructor(params: URLSearchParams) {\n        this.state = params.get(\"state\");\n        this.session_state = params.get(\"session_state\");\n\n        this.error = params.get(\"error\");\n        this.error_description = params.get(\"error_description\");\n        this.error_uri = params.get(\"error_uri\");\n\n        this.code = params.get(\"code\");\n    }\n\n    public get expires_in(): number | undefined {\n        if (this.expires_at === undefined) {\n            return undefined;\n        }\n        return this.expires_at - Timer.getEpochTime();\n    }\n    public set expires_in(value: number | undefined) {\n        // spec expects a number, but normalize here just in case\n        if (typeof value === \"string\") value = Number(value);\n        if (value !== undefined && value >= 0) {\n            this.expires_at = Math.floor(value) + Timer.getEpochTime();\n        }\n    }\n\n    public get isOpenId(): boolean {\n        return this.scope?.split(\" \").includes(OidcScope) || !!this.id_token;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { State } from \"./State\";\n\n/**\n * @public\n */\nexport interface SignoutRequestArgs {\n    // mandatory\n    url: string;\n\n    // optional\n    state_data?: unknown;\n    id_token_hint?: string;\n    post_logout_redirect_uri?: string;\n    extraQueryParams?: Record<string, string | number | boolean>;\n    request_type?: string;\n}\n\n/**\n * @public\n */\nexport class SignoutRequest {\n    private readonly _logger = new Logger(\"SignoutRequest\");\n\n    public readonly url: string;\n    public readonly state?: State;\n\n    public constructor({\n        url,\n        state_data, id_token_hint, post_logout_redirect_uri, extraQueryParams, request_type,\n    }: SignoutRequestArgs) {\n        if (!url) {\n            this._logger.error(\"ctor: No url passed\");\n            throw new Error(\"url\");\n        }\n\n        const parsedUrl = new URL(url);\n        if (id_token_hint) {\n            parsedUrl.searchParams.append(\"id_token_hint\", id_token_hint);\n        }\n\n        if (post_logout_redirect_uri) {\n            parsedUrl.searchParams.append(\"post_logout_redirect_uri\", post_logout_redirect_uri);\n\n            if (state_data) {\n                this.state = new State({ data: state_data, request_type });\n\n                parsedUrl.searchParams.append(\"state\", this.state.id);\n            }\n        }\n\n        for (const [key, value] of Object.entries({ ...extraQueryParams })) {\n            if (value != null) {\n                parsedUrl.searchParams.append(key, value.toString());\n            }\n        }\n\n        this.url = parsedUrl.href;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * @public\n */\nexport class SignoutResponse {\n    public readonly state: string | null;\n\n    // error props\n    /** @see {@link ErrorResponse.error} */\n    public error: string | null;\n    /** @see {@link ErrorResponse.error_description} */\n    public error_description: string | null;\n    /** @see {@link ErrorResponse.error_uri} */\n    public error_uri: string | null;\n\n    /** custom state data set during the initial signin request */\n    public userState: unknown;\n\n    public constructor(params: URLSearchParams) {\n        this.state = params.get(\"state\");\n\n        this.error = params.get(\"error\");\n        this.error_description = params.get(\"error_description\");\n        this.error_uri = params.get(\"error_uri\");\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, UrlUtils } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport { OidcClientSettings, OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport { ResponseValidator } from \"./ResponseValidator\";\nimport { MetadataService } from \"./MetadataService\";\nimport type { RefreshState } from \"./RefreshState\";\nimport { SigninRequest } from \"./SigninRequest\";\nimport { SigninResponse } from \"./SigninResponse\";\nimport { SignoutRequest, SignoutRequestArgs } from \"./SignoutRequest\";\nimport { SignoutResponse } from \"./SignoutResponse\";\nimport { SigninState } from \"./SigninState\";\nimport { State } from \"./State\";\nimport { TokenClient } from \"./TokenClient\";\n\n/**\n * @public\n */\nexport interface CreateSigninRequestArgs {\n    redirect_uri?: string;\n    response_type?: string;\n    scope?: string;\n    nonce?: string;\n\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state?: unknown;\n\n    prompt?: string;\n    display?: string;\n    max_age?: number;\n    ui_locales?: string;\n    id_token_hint?: string;\n    login_hint?: string;\n    acr_values?: string;\n    resource?: string;\n    response_mode?: \"query\" | \"fragment\";\n    request?: string;\n    request_uri?: string;\n    extraQueryParams?: Record<string, string | number | boolean>;\n    request_type?: string;\n    client_secret?: string;\n    extraTokenParams?: Record<string, unknown>;\n    skipUserInfo?: boolean;\n}\n\n/**\n * @public\n */\nexport interface UseRefreshTokenArgs {\n    state: RefreshState;\n    timeoutInSeconds?: number;\n}\n\n/**\n * @public\n */\nexport type CreateSignoutRequestArgs = Omit<SignoutRequestArgs, \"url\" | \"state_data\"> & { state?: unknown };\n\n/**\n * @public\n */\nexport type ProcessResourceOwnerPasswordCredentialsArgs = {\n    username: string;\n    password: string;\n    skipUserInfo?: boolean;\n};\n\n/**\n * Provides the raw OIDC/OAuth2 protocol support for the authorization endpoint and the end session endpoint in the\n * authorization server. It provides a bare-bones protocol implementation and is used by the UserManager class.\n * Only use this class if you simply want protocol support without the additional management features of the\n * UserManager class.\n *\n * @public\n */\nexport class OidcClient {\n    public readonly settings: OidcClientSettingsStore;\n    protected readonly _logger = new Logger(\"OidcClient\");\n\n    public readonly metadataService: MetadataService;\n    protected readonly _validator: ResponseValidator;\n    protected readonly _tokenClient: TokenClient;\n\n    public constructor(settings: OidcClientSettings) {\n        this.settings = new OidcClientSettingsStore(settings);\n\n        this.metadataService = new MetadataService(this.settings);\n        this._validator = new ResponseValidator(this.settings, this.metadataService);\n        this._tokenClient = new TokenClient(this.settings, this.metadataService);\n    }\n\n    public async createSigninRequest({\n        state,\n        request,\n        request_uri,\n        request_type,\n        id_token_hint,\n        login_hint,\n        skipUserInfo,\n        nonce,\n        response_type = this.settings.response_type,\n        scope = this.settings.scope,\n        redirect_uri = this.settings.redirect_uri,\n        prompt = this.settings.prompt,\n        display = this.settings.display,\n        max_age = this.settings.max_age,\n        ui_locales = this.settings.ui_locales,\n        acr_values = this.settings.acr_values,\n        resource = this.settings.resource,\n        response_mode = this.settings.response_mode,\n        extraQueryParams = this.settings.extraQueryParams,\n        extraTokenParams = this.settings.extraTokenParams,\n    }: CreateSigninRequestArgs): Promise<SigninRequest> {\n        const logger = this._logger.create(\"createSigninRequest\");\n\n        if (response_type !== \"code\") {\n            throw new Error(\"Only the Authorization Code flow (with PKCE) is supported\");\n        }\n\n        const url = await this.metadataService.getAuthorizationEndpoint();\n        logger.debug(\"Received authorization endpoint\", url);\n\n        const signinRequest = new SigninRequest({\n            url,\n            authority: this.settings.authority,\n            client_id: this.settings.client_id,\n            redirect_uri,\n            response_type,\n            scope,\n            state_data: state,\n            prompt, display, max_age, ui_locales, id_token_hint, login_hint, acr_values,\n            resource, request, request_uri, extraQueryParams, extraTokenParams, request_type, response_mode,\n            client_secret: this.settings.client_secret,\n            skipUserInfo,\n            nonce,\n        });\n\n        // house cleaning\n        await this.clearStaleState();\n\n        const signinState = signinRequest.state;\n        await this.settings.stateStore.set(signinState.id, signinState.toStorageString());\n        return signinRequest;\n    }\n\n    public async readSigninResponseState(url: string, removeState = false): Promise<{ state: SigninState; response: SigninResponse }> {\n        const logger = this._logger.create(\"readSigninResponseState\");\n\n        const response = new SigninResponse(UrlUtils.readParams(url, this.settings.response_mode));\n        if (!response.state) {\n            logger.throw(new Error(\"No state in response\"));\n            // need to throw within this function's body for type narrowing to work\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n        if (!storedStateString) {\n            logger.throw(new Error(\"No matching state found in storage\"));\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const state = SigninState.fromStorageString(storedStateString);\n        return { state, response };\n    }\n\n    public async processSigninResponse(url: string): Promise<SigninResponse> {\n        const logger = this._logger.create(\"processSigninResponse\");\n\n        const { state, response } = await this.readSigninResponseState(url, true);\n        logger.debug(\"received state from storage; validating response\");\n        await this._validator.validateSigninResponse(response, state);\n        return response;\n    }\n\n    public async processResourceOwnerPasswordCredentials({\n        username,\n        password,\n        skipUserInfo = false,\n    }: ProcessResourceOwnerPasswordCredentialsArgs): Promise<SigninResponse> {\n        const tokenResponse: Record<string, unknown> = await this._tokenClient.exchangeCredentials({ username, password });\n        const signinResponse: SigninResponse = new SigninResponse(new URLSearchParams());\n        Object.assign(signinResponse, tokenResponse);\n        await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);\n        return signinResponse;\n    }\n\n    public async useRefreshToken({\n        state,\n        timeoutInSeconds,\n    }: UseRefreshTokenArgs): Promise<SigninResponse> {\n        const logger = this._logger.create(\"useRefreshToken\");\n\n        const result = await this._tokenClient.exchangeRefreshToken({\n            refresh_token: state.refresh_token,\n            scope: state.scope,\n            timeoutInSeconds,\n        });\n        const response = new SigninResponse(new URLSearchParams());\n        Object.assign(response, result);\n        logger.debug(\"validating response\", response);\n        await this._validator.validateRefreshResponse(response, state);\n        return response;\n    }\n\n    public async createSignoutRequest({\n        state,\n        id_token_hint,\n        request_type,\n        post_logout_redirect_uri = this.settings.post_logout_redirect_uri,\n        extraQueryParams = this.settings.extraQueryParams,\n    }: CreateSignoutRequestArgs = {}): Promise<SignoutRequest> {\n        const logger = this._logger.create(\"createSignoutRequest\");\n\n        const url = await this.metadataService.getEndSessionEndpoint();\n        if (!url) {\n            logger.throw(new Error(\"No end session endpoint\"));\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        logger.debug(\"Received end session endpoint\", url);\n\n        const request = new SignoutRequest({\n            url,\n            id_token_hint,\n            post_logout_redirect_uri,\n            state_data: state,\n            extraQueryParams,\n            request_type,\n        });\n\n        // house cleaning\n        await this.clearStaleState();\n\n        const signoutState = request.state;\n        if (signoutState) {\n            logger.debug(\"Signout request has state to persist\");\n            await this.settings.stateStore.set(signoutState.id, signoutState.toStorageString());\n        }\n\n        return request;\n    }\n\n    public async readSignoutResponseState(url: string, removeState = false): Promise<{ state: State | undefined; response: SignoutResponse }> {\n        const logger = this._logger.create(\"readSignoutResponseState\");\n\n        const response = new SignoutResponse(UrlUtils.readParams(url, this.settings.response_mode));\n        if (!response.state) {\n            logger.debug(\"No state in response\");\n\n            if (response.error) {\n                logger.warn(\"Response was error:\", response.error);\n                throw new ErrorResponse(response);\n            }\n\n            return { state: undefined, response };\n        }\n\n        const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n        if (!storedStateString) {\n            logger.throw(new Error(\"No matching state found in storage\"));\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const state = State.fromStorageString(storedStateString);\n        return { state, response };\n    }\n\n    public async processSignoutResponse(url: string): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"processSignoutResponse\");\n\n        const { state, response } = await this.readSignoutResponseState(url, true);\n        if (state) {\n            logger.debug(\"Received state from storage; validating response\");\n            this._validator.validateSignoutResponse(response, state);\n        } else {\n            logger.debug(\"No state from storage; skipping response validation\");\n        }\n\n        return response;\n    }\n\n    public clearStaleState(): Promise<void> {\n        this._logger.create(\"clearStaleState\");\n        return State.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);\n    }\n\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        this._logger.create(\"revokeToken\");\n        return await this._tokenClient.revoke({\n            token,\n            token_type_hint: type,\n        });\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { CheckSessionIFrame } from \"./CheckSessionIFrame\";\nimport type { UserManager } from \"./UserManager\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport class SessionMonitor {\n    private readonly _logger = new Logger(\"SessionMonitor\");\n\n    private _sub: string | undefined;\n    private _sid: string | undefined;\n    private _checkSessionIFrame?: CheckSessionIFrame;\n\n    public constructor(private readonly _userManager: UserManager) {\n        if (!_userManager) {\n            this._logger.throw(new Error(\"No user manager passed\"));\n        }\n\n        this._userManager.events.addUserLoaded(this._start);\n        this._userManager.events.addUserUnloaded(this._stop);\n\n        this._init().catch((err: unknown) => {\n            // catch to suppress errors since we're in a ctor\n            this._logger.error(err);\n        });\n    }\n\n    protected async _init(): Promise<void> {\n        this._logger.create(\"_init\");\n        const user = await this._userManager.getUser();\n        // doing this manually here since calling getUser\n        // doesn't trigger load event.\n        if (user) {\n            void this._start(user);\n        }\n        else if (this._userManager.settings.monitorAnonymousSession) {\n            const session = await this._userManager.querySessionStatus();\n            if (session) {\n                const tmpUser = {\n                    session_state: session.session_state,\n                    profile: session.sub && session.sid ? {\n                        sub: session.sub,\n                        sid: session.sid,\n                    } : null,\n                };\n                void this._start(tmpUser);\n            }\n        }\n    }\n\n    protected _start = async (\n        user: User | {\n            session_state: string;\n            profile: { sub: string; sid: string } | null;\n        },\n    ): Promise<void> => {\n        const session_state = user.session_state;\n        if (!session_state) {\n            return;\n        }\n        const logger = this._logger.create(\"_start\");\n\n        if (user.profile) {\n            this._sub = user.profile.sub;\n            this._sid = user.profile.sid;\n            logger.debug(\"session_state\", session_state, \", sub\", this._sub);\n        }\n        else {\n            this._sub = undefined;\n            this._sid = undefined;\n            logger.debug(\"session_state\", session_state, \", anonymous user\");\n        }\n\n        if (this._checkSessionIFrame) {\n            this._checkSessionIFrame.start(session_state);\n            return;\n        }\n\n        try {\n            const url = await this._userManager.metadataService.getCheckSessionIframe();\n            if (url) {\n                logger.debug(\"initializing check session iframe\");\n\n                const client_id = this._userManager.settings.client_id;\n                const intervalInSeconds = this._userManager.settings.checkSessionIntervalInSeconds;\n                const stopOnError = this._userManager.settings.stopCheckSessionOnError;\n\n                const checkSessionIFrame = new CheckSessionIFrame(this._callback, client_id, url, intervalInSeconds, stopOnError);\n                await checkSessionIFrame.load();\n                this._checkSessionIFrame = checkSessionIFrame;\n                checkSessionIFrame.start(session_state);\n            }\n            else {\n                logger.warn(\"no check session iframe found in the metadata\");\n            }\n        }\n        catch (err) {\n            // catch to suppress errors since we're in non-promise callback\n            logger.error(\"Error from getCheckSessionIframe:\", err instanceof Error ? err.message : err);\n        }\n    };\n\n    protected _stop = (): void => {\n        const logger = this._logger.create(\"_stop\");\n        this._sub = undefined;\n        this._sid = undefined;\n\n        if (this._checkSessionIFrame) {\n            this._checkSessionIFrame.stop();\n        }\n\n        if (this._userManager.settings.monitorAnonymousSession) {\n            // using a timer to delay re-initialization to avoid race conditions during signout\n            // TODO rewrite to use promise correctly\n            // eslint-disable-next-line @typescript-eslint/no-misused-promises\n            const timerHandle = setInterval(async () => {\n                clearInterval(timerHandle);\n\n                try {\n                    const session = await this._userManager.querySessionStatus();\n                    if (session) {\n                        const tmpUser = {\n                            session_state: session.session_state,\n                            profile: session.sub && session.sid ? {\n                                sub: session.sub,\n                                sid: session.sid,\n                            } : null,\n                        };\n                        void this._start(tmpUser);\n                    }\n                }\n                catch (err) {\n                    // catch to suppress errors since we're in a callback\n                    logger.error(\"error from querySessionStatus\", err instanceof Error ? err.message : err);\n                }\n            }, 1000);\n        }\n    };\n\n    protected _callback = async (): Promise<void> => {\n        const logger = this._logger.create(\"_callback\");\n        try {\n            const session = await this._userManager.querySessionStatus();\n            let raiseEvent = true;\n\n            if (session && this._checkSessionIFrame) {\n                if (session.sub === this._sub) {\n                    raiseEvent = false;\n                    this._checkSessionIFrame.start(session.session_state);\n\n                    if (session.sid === this._sid) {\n                        logger.debug(\"same sub still logged in at OP, restarting check session iframe; session_state\", session.session_state);\n                    }\n                    else {\n                        logger.debug(\"same sub still logged in at OP, session state has changed, restarting check session iframe; session_state\", session.session_state);\n                        this._userManager.events._raiseUserSessionChanged();\n                    }\n                }\n                else {\n                    logger.debug(\"different subject signed into OP\", session.sub);\n                }\n            }\n            else {\n                logger.debug(\"subject no longer signed into OP\");\n            }\n\n            if (raiseEvent) {\n                if (this._sub) {\n                    this._userManager.events._raiseUserSignedOut();\n                }\n                else {\n                    this._userManager.events._raiseUserSignedIn();\n                }\n            } else {\n                logger.debug(\"no change in session detected, no event to raise\");\n            }\n        }\n        catch (err) {\n            if (this._sub) {\n                logger.debug(\"Error calling queryCurrentSigninSession; raising signed out event\", err);\n                this._userManager.events._raiseUserSignedOut();\n            }\n        }\n    };\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport type { IdTokenClaims } from \"./Claims\";\n\n/**\n * Holds claims represented by a combination of the `id_token` and the user info endpoint.\n * @public\n */\nexport type UserProfile = IdTokenClaims;\n\n/**\n * @public\n */\nexport class User {\n    /**\n     * A JSON Web Token (JWT). Only provided if `openid` scope was requested.\n     * The application can access the data decoded by using the `profile` property.\n     */\n    public id_token?: string;\n\n    /** The session state value returned from the OIDC provider. */\n    public session_state: string | null;\n\n    /**\n     * The requested access token returned from the OIDC provider. The application can use this token to\n     * authenticate itself to the secured resource.\n     */\n    public access_token: string;\n\n    /**\n     * An OAuth 2.0 refresh token. The app can use this token to acquire additional access tokens after the\n     * current access token expires. Refresh tokens are long-lived and can be used to maintain access to resources\n     * for extended periods of time.\n     */\n    public refresh_token?: string;\n\n    /** Typically \"Bearer\" */\n    public token_type: string;\n\n    /** The scopes that the requested access token is valid for. */\n    public scope?: string;\n\n    /** The claims represented by a combination of the `id_token` and the user info endpoint. */\n    public profile: UserProfile;\n\n    /** The expires at returned from the OIDC provider. */\n    public expires_at?: number;\n\n    /** custom state data set during the initial signin request */\n    public readonly state: unknown;\n\n    public constructor(args: {\n        id_token?: string;\n        session_state?: string | null;\n        access_token: string;\n        refresh_token?: string;\n        token_type: string;\n        scope?: string;\n        profile: UserProfile;\n        expires_at?: number;\n        userState?: unknown;\n    }) {\n        this.id_token = args.id_token;\n        this.session_state = args.session_state ?? null;\n        this.access_token = args.access_token;\n        this.refresh_token = args.refresh_token;\n\n        this.token_type = args.token_type;\n        this.scope = args.scope;\n        this.profile = args.profile;\n        this.expires_at = args.expires_at;\n        this.state = args.userState;\n    }\n\n    /** Computed number of seconds the access token has remaining. */\n    public get expires_in(): number | undefined {\n        if (this.expires_at === undefined) {\n            return undefined;\n        }\n        return this.expires_at - Timer.getEpochTime();\n    }\n\n    public set expires_in(value: number | undefined) {\n        if (value !== undefined) {\n            this.expires_at = Math.floor(value) + Timer.getEpochTime();\n        }\n    }\n\n    /** Computed value indicating if the access token is expired. */\n    public get expired(): boolean | undefined {\n        const expires_in = this.expires_in;\n        if (expires_in === undefined) {\n            return undefined;\n        }\n        return expires_in <= 0;\n    }\n\n    /** Array representing the parsed values from the `scope`. */\n    public get scopes(): string[] {\n        return this.scope?.split(\" \") ?? [];\n    }\n\n    public toStorageString(): string {\n        new Logger(\"User\").create(\"toStorageString\");\n        return JSON.stringify({\n            id_token: this.id_token,\n            session_state: this.session_state,\n            access_token: this.access_token,\n            refresh_token: this.refresh_token,\n            token_type: this.token_type,\n            scope: this.scope,\n            profile: this.profile,\n            expires_at: this.expires_at,\n        });\n    }\n\n    public static fromStorageString(storageString: string): User {\n        Logger.createStatic(\"User\", \"fromStorageString\");\n        return new User(JSON.parse(storageString));\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Event, Logger, UrlUtils } from \"../utils\";\nimport type { IWindow, NavigateParams, NavigateResponse } from \"./IWindow\";\n\nconst messageSource = \"oidc-client\";\n\ninterface MessageData {\n    source: string;\n    url: string;\n    keepOpen: boolean;\n}\n\n/**\n * Window implementation which resolves via communication from a child window\n * via the `Window.postMessage()` interface.\n *\n * @internal\n */\nexport abstract class AbstractChildWindow implements IWindow {\n    protected abstract readonly _logger: Logger;\n    protected readonly _abort = new Event<[reason: Error]>(\n        \"Window navigation aborted\",\n    );\n    protected readonly _disposeHandlers = new Set<() => void>();\n\n    protected _window: WindowProxy | null = null;\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"navigate\");\n        if (!this._window) {\n            throw new Error(\"Attempted to navigate on a disposed window\");\n        }\n\n        logger.debug(\"setting URL in window\");\n        this._window.location.replace(params.url);\n\n        const { url, keepOpen } = await new Promise<MessageData>(\n            (resolve, reject) => {\n                const listener = (e: MessageEvent) => {\n                    const data: MessageData | undefined = e.data;\n                    //TODO: Lock down the origin to the initialized origin in settings\n                    if (!data) return;\n                    try {\n                        const state = UrlUtils.readParams(\n                            data.url,\n                            params.response_mode,\n                        ).get(\"state\");\n                        if (!state) {\n                            logger.warn(\"no state found in response url\");\n                        }\n                        if (\n                            e.source !== this._window &&\n                            state !== params.state\n                        ) {\n                            // MessageEvent source is a relatively modern feature, we can't rely on it\n                            // so we also inspect the payload for a matching state key as an alternative\n                            return;\n                        }\n                    } catch (err) {\n                        return;\n                        // this._dispose();\n                        // reject(new Error(\"Invalid response from window\"));\n                    }\n                    resolve(data);\n                };\n                window.addEventListener(\"message\", listener, false);\n                this._disposeHandlers.add(() =>\n                    window.removeEventListener(\"message\", listener, false),\n                );\n                this._disposeHandlers.add(\n                    this._abort.addHandler((reason) => {\n                        this._dispose();\n                        reject(reason);\n                    }),\n                );\n            },\n        );\n        logger.debug(\"got response from window\");\n        this._dispose();\n\n        if (!keepOpen) {\n            this.close();\n        }\n\n        return { url };\n    }\n\n    public abstract close(): void;\n\n    private _dispose(): void {\n        this._logger.create(\"_dispose\");\n\n        for (const dispose of this._disposeHandlers) {\n            dispose();\n        }\n        this._disposeHandlers.clear();\n    }\n\n    protected static _notifyParent(\n        parent: Window,\n        url: string,\n        keepOpen = false,\n        targetOrigin = window.location.origin,\n    ): void {\n        parent.postMessage(\n            {\n                source: messageSource,\n                url,\n                keepOpen,\n            } as MessageData,\n            targetOrigin,\n        );\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport {\n    OidcClientSettings,\n    OidcClientSettingsStore,\n} from \"./OidcClientSettings\";\nimport type { PopupWindowFeatures } from \"./utils/PopupUtils\";\nimport { WebStorageStateStore } from \"./WebStorageStateStore\";\nimport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\n\nexport const DefaultPopupWindowFeatures: PopupWindowFeatures = {\n    location: false,\n    toolbar: false,\n    height: 640,\n};\nexport const DefaultPopupTarget = \"_blank\";\nconst DefaultAccessTokenExpiringNotificationTimeInSeconds = 60;\nconst DefaultCheckSessionIntervalInSeconds = 2;\nexport const DefaultSilentRequestTimeoutInSeconds = 60 * 5;\n\n/**\n * The settings used to configure the {@link UserManager}.\n *\n * @public\n */\nexport interface UserManagerSettings extends OidcClientSettings {\n    /** The URL for the page containing the call to signinPopupCallback to handle the callback from the OIDC/OAuth2 */\n    popup_redirect_uri?: string;\n    popup_post_logout_redirect_uri?: string;\n    /**\n     * The features parameter to window.open for the popup signin window. By default, the popup is\n     * placed centered in front of the window opener.\n     * (default: \\{ location: false, menubar: false, height: 640 \\})\n     */\n    popupWindowFeatures?: PopupWindowFeatures;\n    /** The target parameter to window.open for the popup signin window (default: \"_blank\") */\n    popupWindowTarget?: string;\n    /** The methods window.location method used to redirect (default: \"assign\") */\n    redirectMethod?: \"replace\" | \"assign\";\n    /** The methods target window being redirected (default: \"self\") */\n    redirectTarget?: \"top\" | \"self\";\n\n    /** The target to pass while calling postMessage inside iframe for callback (default: window.location.origin) */\n    iframeNotifyParentOrigin?: string;\n\n    /** The script origin to check during 'message' callback execution while performing silent auth via iframe (default: window.location.origin) */\n    iframeScriptOrigin?: string;\n\n    /** The URL for the page containing the code handling the silent renew */\n    silent_redirect_uri?: string;\n    /** Number of seconds to wait for the silent renew to return before assuming it has failed or timed out (default: 10) */\n    silentRequestTimeoutInSeconds?: number;\n    // Whether the iFrame is hidden\n    iframeHidden?: boolean;\n    /** Flag to indicate if there should be an automatic attempt to renew the access token prior to its expiration (default: true) */\n    automaticSilentRenew?: boolean;\n    /** Flag to validate user.profile.sub in silent renew calls (default: true) */\n    validateSubOnSilentRenew?: boolean;\n    /** Flag to control if id_token is included as id_token_hint in silent renew calls (default: false) */\n    includeIdTokenInSilentRenew?: boolean;\n\n    /** Will raise events for when user has performed a signout at the OP (default: false) */\n    monitorSession?: boolean;\n    monitorAnonymousSession?: boolean;\n    /** Interval in seconds to check the user's session (default: 2) */\n    checkSessionIntervalInSeconds?: number;\n    query_status_response_type?: string;\n    stopCheckSessionOnError?: boolean;\n\n    /**\n     * The `token_type_hint`s to pass to the authority server by default (default: [\"access_token\", \"refresh_token\"])\n     *\n     * Token types will be revoked in the same order as they are given here.\n     */\n    revokeTokenTypes?: (\"access_token\" | \"refresh_token\")[];\n    /** Will invoke the revocation endpoint on signout if there is an access token for the user (default: false) */\n    revokeTokensOnSignout?: boolean;\n    /** Flag to control if id_token is included as id_token_hint in silent signout calls (default: false) */\n    includeIdTokenInSilentSignout?: boolean;\n\n    /** The number of seconds before an access token is to expire to raise the accessTokenExpiring event (default: 60) */\n    accessTokenExpiringNotificationTimeInSeconds?: number;\n\n    /**\n     * Storage object used to persist User for currently authenticated user (default: window.sessionStorage, InMemoryWebStorage iff no window).\n     *  E.g. `userStore: new WebStorageStateStore({ store: window.localStorage })`\n     */\n    userStore?: WebStorageStateStore;\n}\n\n/**\n * The settings with defaults applied of the {@link UserManager}.\n * @see {@link UserManagerSettings}\n *\n * @public\n */\nexport class UserManagerSettingsStore extends OidcClientSettingsStore {\n    public readonly popup_redirect_uri: string;\n    public readonly popup_post_logout_redirect_uri: string | undefined;\n    public readonly popupWindowFeatures: PopupWindowFeatures;\n    public readonly popupWindowTarget: string;\n    public readonly redirectMethod: \"replace\" | \"assign\";\n    public readonly redirectTarget: \"top\" | \"self\";\n\n    public readonly iframeNotifyParentOrigin: string | undefined;\n    public readonly iframeScriptOrigin: string | undefined;\n\n    public readonly silent_redirect_uri: string;\n    public readonly silentRequestTimeoutInSeconds: number;\n    public readonly iframeHidden?: boolean;\n    public readonly parentElementId?: string;\n    public readonly automaticSilentRenew: boolean;\n    public readonly validateSubOnSilentRenew: boolean;\n    public readonly includeIdTokenInSilentRenew: boolean;\n\n    public readonly monitorSession: boolean;\n    public readonly monitorAnonymousSession: boolean;\n    public readonly checkSessionIntervalInSeconds: number;\n    public readonly query_status_response_type: string;\n    public readonly stopCheckSessionOnError: boolean;\n\n    public readonly revokeTokenTypes: (\"access_token\" | \"refresh_token\")[];\n    public readonly revokeTokensOnSignout: boolean;\n    public readonly includeIdTokenInSilentSignout: boolean;\n\n    public readonly accessTokenExpiringNotificationTimeInSeconds: number;\n\n    public readonly userStore: WebStorageStateStore;\n\n    public constructor(args: UserManagerSettings) {\n        console.log(\"Args\", args);\n        const {\n            popup_redirect_uri = args.redirect_uri,\n            popup_post_logout_redirect_uri = args.post_logout_redirect_uri,\n            popupWindowFeatures = DefaultPopupWindowFeatures,\n            popupWindowTarget = DefaultPopupTarget,\n            redirectMethod = \"assign\",\n            redirectTarget = \"self\",\n\n            iframeNotifyParentOrigin = args.iframeNotifyParentOrigin,\n            iframeScriptOrigin = args.iframeScriptOrigin,\n\n            silent_redirect_uri = args.redirect_uri,\n            silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds,\n            iframeHidden = args.iframeHidden,\n            automaticSilentRenew = true,\n            validateSubOnSilentRenew = true,\n            includeIdTokenInSilentRenew = false,\n\n            monitorSession = false,\n            monitorAnonymousSession = false,\n            checkSessionIntervalInSeconds = DefaultCheckSessionIntervalInSeconds,\n            query_status_response_type = \"code\",\n            stopCheckSessionOnError = true,\n\n            revokeTokenTypes = [\"access_token\", \"refresh_token\"],\n            revokeTokensOnSignout = false,\n            includeIdTokenInSilentSignout = false,\n\n            accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,\n\n            userStore,\n        } = args;\n\n        super(args);\n\n        this.popup_redirect_uri = popup_redirect_uri;\n        this.popup_post_logout_redirect_uri = popup_post_logout_redirect_uri;\n        this.popupWindowFeatures = popupWindowFeatures;\n        this.popupWindowTarget = popupWindowTarget;\n        this.redirectMethod = redirectMethod;\n        this.redirectTarget = redirectTarget;\n\n        this.iframeNotifyParentOrigin = iframeNotifyParentOrigin;\n        this.iframeScriptOrigin = iframeScriptOrigin;\n\n        this.silent_redirect_uri = silent_redirect_uri;\n        this.silentRequestTimeoutInSeconds = silentRequestTimeoutInSeconds;\n        this.iframeHidden = iframeHidden;\n        this.automaticSilentRenew = automaticSilentRenew;\n        this.validateSubOnSilentRenew = validateSubOnSilentRenew;\n        this.includeIdTokenInSilentRenew = includeIdTokenInSilentRenew;\n\n        this.monitorSession = monitorSession;\n        this.monitorAnonymousSession = monitorAnonymousSession;\n        this.checkSessionIntervalInSeconds = checkSessionIntervalInSeconds;\n        this.stopCheckSessionOnError = stopCheckSessionOnError;\n        this.query_status_response_type = query_status_response_type;\n\n        this.revokeTokenTypes = revokeTokenTypes;\n        this.revokeTokensOnSignout = revokeTokensOnSignout;\n        this.includeIdTokenInSilentSignout = includeIdTokenInSilentSignout;\n\n        this.accessTokenExpiringNotificationTimeInSeconds =\n            accessTokenExpiringNotificationTimeInSeconds;\n\n        if (userStore) {\n            this.userStore = userStore;\n        } else {\n            const store =\n                typeof window !== \"undefined\"\n                    ? window.sessionStorage\n                    : new InMemoryWebStorage();\n            this.userStore = new WebStorageStateStore({ store });\n        }\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport { ErrorTimeout } from \"../errors\";\nimport type { NavigateParams, NavigateResponse } from \"./IWindow\";\nimport { AbstractChildWindow } from \"./AbstractChildWindow\";\nimport { DefaultSilentRequestTimeoutInSeconds } from \"../UserManagerSettings\";\nimport MicroModal from \"micromodal\";\nMicroModal.init();\n/**\n * @public\n */\nexport interface IFrameWindowParams {\n    silentRequestTimeoutInSeconds?: number;\n    hidden: boolean;\n    parentId?: string;\n}\n\n/**\n * @internal\n */\nexport class IFrameWindow extends AbstractChildWindow {\n    protected readonly _logger = new Logger(\"IFrameWindow\");\n    private _frame: HTMLIFrameElement | null;\n    private _timeoutInSeconds: number;\n\n    public constructor({\n        silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds,\n        hidden = false,\n    }: IFrameWindowParams) {\n        super();\n        this._timeoutInSeconds = silentRequestTimeoutInSeconds;\n\n        this._frame = IFrameWindow.createVisibleIframe();\n        this._window = this._frame.contentWindow;\n    }\n\n    private static createHiddenIframe(): HTMLIFrameElement {\n        const iframe = window.document.createElement(\"iframe\");\n\n        // shotgun approach\n        iframe.style.visibility = \"hidden\";\n        iframe.style.position = \"fixed\";\n        iframe.style.left = \"-1000px\";\n        iframe.style.top = \"0\";\n        iframe.width = \"0\";\n        iframe.height = \"0\";\n        iframe.setAttribute(\n            \"sandbox\",\n            \"allow-forms allow-storage-access-by-user-activation allow-scripts allow-same-origin\",\n        );\n\n        window.document.body.appendChild(iframe);\n        return iframe;\n    }\n\n    private static createVisibleIframe(): HTMLIFrameElement {\n        const iframe = window.document.createElement(\"iframe\");\n\n        // shotgun approach\n        iframe.style.position = \"absolute\";\n        iframe.style.left = \"0\";\n        iframe.style.top = \"0\";\n        iframe.width = \"100%\";\n        iframe.height = \"100%\";\n        iframe.setAttribute(\n            \"sandbox\",\n            \"allow-forms allow-storage-access-by-user-activation allow-scripts allow-same-origin\",\n        );\n\n        let iframeParent = window.document.getElementById(\n            \"trinsic-iframe-parent\",\n        );\n        if (!iframeParent) {\n            const html = `<div class=\"modal micromodal-slide\" id=\"iframe-modal\" aria-hidden=\"true\">\n            <div class=\"modal__overlay\" tabindex=\"-1\" data-micromodal-close>\n              <div\n                class=\"modal__container\"\n                role=\"dialog\"\n                aria-modal=\"true\"\n                aria-labelledby=\"modal-1-title\"\n              >\n                <main class=\"modal__content\" id=\"trinsic-iframe-parent\">\n                </main>\n              </div>\n            </div>\n            </div>`;\n            window.document.body.insertAdjacentHTML(\"beforeend\", html);\n        }\n        iframeParent = window.document.getElementById(\n            \"trinsic-iframe-parent\",\n        ) as HTMLElement;\n        iframeParent.appendChild(iframe);\n        MicroModal.show(\"iframe-modal\");\n        return iframe;\n    }\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        this._logger.debug(\n            \"navigate: Using timeout of:\",\n            this._timeoutInSeconds,\n        );\n        const timer = setTimeout(\n            () =>\n                this._abort.raise(\n                    new ErrorTimeout(\"IFrame timed out without a response\"),\n                ),\n            this._timeoutInSeconds * 1000,\n        );\n        this._disposeHandlers.add(() => clearTimeout(timer));\n\n        return await super.navigate(params);\n    }\n\n    public close(): void {\n        if (this._frame) {\n            if (this._frame.parentNode) {\n                this._frame.addEventListener(\n                    \"load\",\n                    (ev) => {\n                        const frame = ev.target as HTMLIFrameElement;\n                        frame.parentNode?.removeChild(frame);\n                        this._abort.raise(new Error(\"IFrame removed from DOM\"));\n                    },\n                    true,\n                );\n                this._frame.contentWindow?.location.replace(\"about:blank\");\n            }\n            this._frame = null;\n        }\n        this._window = null;\n    }\n\n    public static notifyParent(url: string, targetOrigin?: string): void {\n        return super._notifyParent(window.parent, url, false, targetOrigin);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\nimport { IFrameWindow, IFrameWindowParams } from \"./IFrameWindow\";\nimport type { INavigator } from \"./INavigator\";\n\n/**\n * @internal\n */\nexport class IFrameNavigator implements INavigator {\n    private readonly _logger = new Logger(\"IFrameNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) {}\n\n    public async prepare({\n        silentRequestTimeoutInSeconds = this._settings\n            .silentRequestTimeoutInSeconds,\n        hidden = this._settings.iframeHidden!,\n    }: IFrameWindowParams): Promise<IFrameWindow> {\n        return new IFrameWindow({\n            silentRequestTimeoutInSeconds,\n            hidden,\n        });\n    }\n\n    public async callback(url: string): Promise<void> {\n        this._logger.create(\"callback\");\n        IFrameWindow.notifyParent(url, this._settings.iframeNotifyParentOrigin);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, PopupUtils, PopupWindowFeatures } from \"../utils\";\nimport { DefaultPopupWindowFeatures, DefaultPopupTarget } from \"../UserManagerSettings\";\nimport { AbstractChildWindow } from \"./AbstractChildWindow\";\nimport type { NavigateParams, NavigateResponse } from \"./IWindow\";\n\nconst checkForPopupClosedInterval = 500;\n\n/**\n * @public\n */\nexport interface PopupWindowParams {\n    popupWindowFeatures?: PopupWindowFeatures;\n    popupWindowTarget?: string;\n}\n\n/**\n * @internal\n */\nexport class PopupWindow extends AbstractChildWindow {\n    protected readonly _logger = new Logger(\"PopupWindow\");\n\n    protected _window: WindowProxy | null;\n\n    public constructor({\n        popupWindowTarget = DefaultPopupTarget,\n        popupWindowFeatures = {},\n    }: PopupWindowParams) {\n        super();\n        const centeredPopup = PopupUtils.center({ ...DefaultPopupWindowFeatures, ...popupWindowFeatures });\n        this._window = window.open(undefined, popupWindowTarget, PopupUtils.serialize(centeredPopup));\n    }\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        this._window?.focus();\n\n        const popupClosedInterval = setInterval(() => {\n            if (!this._window || this._window.closed) {\n                this._abort.raise(new Error(\"Popup closed by user\"));\n            }\n        }, checkForPopupClosedInterval);\n        this._disposeHandlers.add(() => clearInterval(popupClosedInterval));\n\n        return await super.navigate(params);\n    }\n\n    public close(): void {\n        if (this._window) {\n            if (!this._window.closed) {\n                this._window.close();\n                this._abort.raise(new Error(\"Popup closed\"));\n            }\n        }\n        this._window = null;\n    }\n\n    public static notifyOpener(url: string, keepOpen: boolean): void {\n        if (!window.opener) {\n            throw new Error(\"No window.opener. Can't complete notification.\");\n        }\n        return super._notifyParent(window.opener, url, keepOpen);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport { PopupWindow, PopupWindowParams } from \"./PopupWindow\";\nimport type { INavigator } from \"./INavigator\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\n\n/**\n * @internal\n */\nexport class PopupNavigator implements INavigator {\n    private readonly _logger = new Logger(\"PopupNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) {}\n\n    public async prepare({\n        popupWindowFeatures = this._settings.popupWindowFeatures,\n        popupWindowTarget = this._settings.popupWindowTarget,\n    }: PopupWindowParams): Promise<PopupWindow> {\n        return new PopupWindow({ popupWindowFeatures, popupWindowTarget });\n    }\n\n    public async callback(url: string, keepOpen = false): Promise<void> {\n        this._logger.create(\"callback\");\n\n        PopupWindow.notifyOpener(url, keepOpen);\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\nimport type { INavigator } from \"./INavigator\";\nimport type { IWindow } from \"./IWindow\";\n\n/**\n * @public\n */\nexport interface RedirectParams {\n    redirectMethod?: \"replace\" | \"assign\";\n    redirectTarget?: \"top\" | \"self\";\n}\n\n/**\n * @internal\n */\nexport class RedirectNavigator implements INavigator {\n    private readonly _logger = new Logger(\"RedirectNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) {}\n\n    public async prepare({\n        redirectMethod = this._settings.redirectMethod,\n        redirectTarget = this._settings.redirectTarget,\n    }: RedirectParams): Promise<IWindow> {\n        this._logger.create(\"prepare\");\n        let targetWindow = window.self as Window;\n\n        if (redirectTarget === \"top\") {\n            targetWindow = window.top ?? window.self;\n        }\n    \n        const redirect = targetWindow.location[redirectMethod].bind(targetWindow.location) as (url: string) => never;\n        let abort: (reason: Error) => void;\n        return {\n            navigate: async (params): Promise<never> => {\n                this._logger.create(\"navigate\");\n                // We use a promise that never resolves to block the caller\n                const promise = new Promise((resolve, reject) => {\n                    abort = reject;\n                });\n                redirect(params.url);\n                return await (promise as Promise<never>);\n            },\n            close: () => {\n                this._logger.create(\"close\");\n                abort?.(new Error(\"Redirect aborted\"));\n                targetWindow.stop();\n            },\n        };\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Event } from \"./utils\";\nimport { AccessTokenEvents } from \"./AccessTokenEvents\";\nimport type { UserManagerSettingsStore } from \"./UserManagerSettings\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport type UserLoadedCallback = (user: User) => Promise<void> | void;\n/**\n * @public\n */\nexport type UserUnloadedCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type SilentRenewErrorCallback = (error: Error) => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSignedInCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSignedOutCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSessionChangedCallback = () => Promise<void> | void;\n\n/**\n * @public\n */\nexport class UserManagerEvents extends AccessTokenEvents {\n    protected readonly _logger = new Logger(\"UserManagerEvents\");\n\n    private readonly _userLoaded = new Event<[User]>(\"User loaded\");\n    private readonly _userUnloaded = new Event<[]>(\"User unloaded\");\n    private readonly _silentRenewError = new Event<[Error]>(\"Silent renew error\");\n    private readonly _userSignedIn = new Event<[]>(\"User signed in\");\n    private readonly _userSignedOut = new Event<[]>(\"User signed out\");\n    private readonly _userSessionChanged = new Event<[]>(\"User session changed\");\n\n    public constructor(settings: UserManagerSettingsStore) {\n        super({ expiringNotificationTimeInSeconds: settings.accessTokenExpiringNotificationTimeInSeconds });\n    }\n\n    public load(user: User, raiseEvent=true): void {\n        super.load(user);\n        if (raiseEvent) {\n            this._userLoaded.raise(user);\n        }\n    }\n    public unload(): void {\n        super.unload();\n        this._userUnloaded.raise();\n    }\n\n    /**\n     * Add callback: Raised when a user session has been established (or re-established).\n     */\n    public addUserLoaded(cb: UserLoadedCallback): () => void {\n        return this._userLoaded.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when a user session has been established (or re-established).\n     */\n    public removeUserLoaded(cb: UserLoadedCallback): void {\n        return this._userLoaded.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised when a user session has been terminated.\n     */\n    public addUserUnloaded(cb: UserUnloadedCallback): () => void {\n        return this._userUnloaded.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when a user session has been terminated.\n     */\n    public removeUserUnloaded(cb: UserUnloadedCallback): void {\n        return this._userUnloaded.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised when the automatic silent renew has failed.\n     */\n    public addSilentRenewError(cb: SilentRenewErrorCallback): () => void {\n        return this._silentRenewError.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the automatic silent renew has failed.\n     */\n    public removeSilentRenewError(cb: SilentRenewErrorCallback): void {\n        return this._silentRenewError.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public _raiseSilentRenewError(e: Error): void {\n        this._silentRenewError.raise(e);\n    }\n\n    /**\n     * Add callback: Raised when the user is signed in (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSignedIn(cb: UserSignedInCallback): () => void {\n        return this._userSignedIn.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user is signed in (when `monitorSession` is set).\n     */\n    public removeUserSignedIn(cb: UserSignedInCallback): void {\n        this._userSignedIn.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public _raiseUserSignedIn(): void {\n        this._userSignedIn.raise();\n    }\n\n    /**\n     * Add callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSignedOut(cb: UserSignedOutCallback): () => void {\n        return this._userSignedOut.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n     */\n    public removeUserSignedOut(cb: UserSignedOutCallback): void {\n        this._userSignedOut.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public _raiseUserSignedOut(): void {\n        this._userSignedOut.raise();\n    }\n\n    /**\n     * Add callback: Raised when the user session changed (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSessionChanged(cb: UserSessionChangedCallback): () => void {\n        return this._userSessionChanged.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user session changed (when `monitorSession` is set).\n     */\n    public removeUserSessionChanged(cb: UserSessionChangedCallback): void {\n        this._userSessionChanged.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public _raiseUserSessionChanged(): void {\n        this._userSessionChanged.raise();\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport { ErrorTimeout } from \"./errors\";\nimport type { UserManager } from \"./UserManager\";\nimport type { AccessTokenCallback } from \"./AccessTokenEvents\";\n\n/**\n * @internal\n */\nexport class SilentRenewService {\n    protected _logger = new Logger(\"SilentRenewService\");\n    private _isStarted = false;\n    private readonly _retryTimer = new Timer(\"Retry Silent Renew\");\n\n    public constructor(private _userManager: UserManager) {}\n\n    public async start(): Promise<void> {\n        const logger = this._logger.create(\"start\");\n        if (!this._isStarted) {\n            this._isStarted = true;\n            this._userManager.events.addAccessTokenExpiring(this._tokenExpiring);\n            this._retryTimer.addHandler(this._tokenExpiring);\n\n            // this will trigger loading of the user so the expiring events can be initialized\n            try {\n                await this._userManager.getUser();\n                // deliberate nop\n            }\n            catch (err) {\n                // catch to suppress errors since we're in a ctor\n                logger.error(\"getUser error\", err);\n            }\n        }\n    }\n\n    public stop(): void {\n        if (this._isStarted) {\n            this._retryTimer.cancel();\n            this._retryTimer.removeHandler(this._tokenExpiring);\n            this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring);\n            this._isStarted = false;\n        }\n    }\n\n    protected _tokenExpiring: AccessTokenCallback = async () => {\n        const logger = this._logger.create(\"_tokenExpiring\");\n        try {\n            await this._userManager.signinSilent();\n            logger.debug(\"silent token renewal successful\");\n        }\n        catch (err) {\n            if (err instanceof ErrorTimeout) {\n                // no response from authority server, e.g. IFrame timeout, ...\n                logger.warn(\"ErrorTimeout from signinSilent:\", err, \"retry in 5s\");\n                this._retryTimer.init(5);\n                return;\n            }\n\n            logger.error(\"Error from signinSilent:\", err);\n            this._userManager.events._raiseSilentRenewError(err as Error);\n        }\n    };\n}\n","// Copyright (C) AuthTS Contributors\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport type { UserProfile } from \"./User\";\n\n/**\n * Fake state store implementation necessary for validating refresh token requests.\n *\n * @internal\n */\nexport class RefreshState {\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    public readonly data: unknown | undefined;\n\n    public readonly refresh_token: string;\n    public readonly id_token?: string;\n    public readonly session_state: string | null;\n    public readonly scope?: string;\n    public readonly profile: UserProfile;\n\n    constructor(args: {\n        refresh_token: string;\n        id_token?: string;\n        session_state: string | null;\n        scope?: string;\n        profile: UserProfile;\n\n        state?: unknown;\n    }) {\n        this.refresh_token = args.refresh_token;\n        this.id_token = args.id_token;\n        this.session_state = args.session_state;\n        this.scope = args.scope;\n        this.profile = args.profile;\n\n        this.data = args.state;\n    }\n}\n","// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport {\n    IFrameNavigator,\n    NavigateResponse,\n    PopupNavigator,\n    RedirectNavigator,\n    PopupWindowParams,\n    IWindow,\n    IFrameWindowParams,\n    RedirectParams,\n} from \"./navigators\";\nimport {\n    OidcClient,\n    CreateSigninRequestArgs,\n    CreateSignoutRequestArgs,\n    ProcessResourceOwnerPasswordCredentialsArgs,\n} from \"./OidcClient\";\nimport {\n    UserManagerSettings,\n    UserManagerSettingsStore,\n} from \"./UserManagerSettings\";\nimport { User } from \"./User\";\nimport { UserManagerEvents } from \"./UserManagerEvents\";\nimport { SilentRenewService } from \"./SilentRenewService\";\nimport { SessionMonitor } from \"./SessionMonitor\";\nimport type { SessionStatus } from \"./SessionStatus\";\nimport type { SignoutResponse } from \"./SignoutResponse\";\nimport type { MetadataService } from \"./MetadataService\";\nimport { RefreshState } from \"./RefreshState\";\nimport type { SigninResponse } from \"./SigninResponse\";\nimport MicroModal from \"micromodal\";\nimport { SignInMode, getExtraQueryParameters } from \"./utils/TrinsicUtils\";\n\n/**\n * @public\n */\nexport type ExtraSigninRequestArgs = Pick<\nCreateSigninRequestArgs,\n| \"nonce\"\n| \"extraQueryParams\"\n| \"extraTokenParams\"\n| \"state\"\n| \"redirect_uri\"\n| \"prompt\"\n| \"acr_values\"\n>;\n/**\n * @public\n */\nexport type ExtraSignoutRequestArgs = Pick<\nCreateSignoutRequestArgs,\n\"extraQueryParams\" | \"state\" | \"id_token_hint\" | \"post_logout_redirect_uri\"\n>;\n\n/**\n * @public\n */\nexport type RevokeTokensTypes = UserManagerSettings[\"revokeTokenTypes\"];\n\n/**\n * @public\n */\nexport type SigninRedirectArgs = RedirectParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SigninPopupArgs = PopupWindowParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SigninSilentArgs = IFrameWindowParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SigninResourceOwnerCredentialsArgs =\n    ProcessResourceOwnerPasswordCredentialsArgs;\n\n/**\n * @public\n */\nexport type QuerySessionStatusArgs = IFrameWindowParams &\nExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutRedirectArgs = RedirectParams & ExtraSignoutRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutPopupArgs = PopupWindowParams & ExtraSignoutRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutSilentArgs = IFrameWindowParams & ExtraSignoutRequestArgs;\n\ndeclare global {\n    interface Window {\n        OIDCSettings?: UserManagerSettings;\n    }\n}\n\n/**\n * Provides a higher level API for signing a user in, signing out, managing the user's claims returned from the OIDC provider,\n * and managing an access token returned from the OIDC/OAuth2 provider.\n *\n * @public\n */\nexport class UserManager {\n    /** Returns the settings used to configure the `UserManager`. */\n    public readonly settings: UserManagerSettingsStore;\n    protected readonly _logger = new Logger(\"UserManager\");\n\n    protected readonly _client: OidcClient;\n    protected readonly _redirectNavigator: RedirectNavigator;\n    protected readonly _popupNavigator: PopupNavigator;\n    protected readonly _iframeNavigator: IFrameNavigator;\n    protected readonly _events: UserManagerEvents;\n    protected readonly _silentRenewService: SilentRenewService;\n    protected readonly _sessionMonitor: SessionMonitor | null;\n\n    public constructor(providedSettings?: UserManagerSettings) {\n        const settings =\n            providedSettings ??\n            window.OIDCSettings ??\n            ({} as UserManagerSettings);\n        this.settings = new UserManagerSettingsStore(settings);\n\n        this._client = new OidcClient(settings);\n\n        this._redirectNavigator = new RedirectNavigator(this.settings);\n        this._popupNavigator = new PopupNavigator(this.settings);\n        this._iframeNavigator = new IFrameNavigator(this.settings);\n\n        this._events = new UserManagerEvents(this.settings);\n        this._silentRenewService = new SilentRenewService(this);\n\n        // order is important for the following properties; these services depend upon the events.\n        if (this.settings.automaticSilentRenew) {\n            this.startSilentRenew();\n        }\n\n        this._sessionMonitor = null;\n        if (this.settings.monitorSession) {\n            this._sessionMonitor = new SessionMonitor(this);\n        }\n    }\n\n    /** Returns an object used to register for events raised by the `UserManager`. */\n    public get events(): UserManagerEvents {\n        return this._events;\n    }\n\n    /** Returns an object used to access the metadata configuration of the OIDC provider. */\n    public get metadataService(): MetadataService {\n        return this._client.metadataService;\n    }\n\n    /**\n     * Returns promise to load the `User` object for the currently authenticated user.\n     */\n    public async getUser(): Promise<User | null> {\n        const logger = this._logger.create(\"getUser\");\n        const user = await this._loadUser();\n        if (user) {\n            logger.info(\"user loaded\");\n            this._events.load(user, false);\n            return user;\n        }\n\n        logger.info(\"user not found in storage\");\n        return null;\n    }\n\n    /**\n     * Returns promise to remove from any storage the currently authenticated user.\n     */\n    public async removeUser(): Promise<void> {\n        const logger = this._logger.create(\"removeUser\");\n        await this.storeUser(null);\n        logger.info(\"user removed from storage\");\n        this._events.unload();\n    }\n\n    /**\n     * Returns promise to trigger a redirect of the current window to the authorization endpoint.\n     */\n    public async signinRedirect(args: SigninRedirectArgs = {}): Promise<void> {\n        this._logger.create(\"signinRedirect\");\n        const { redirectMethod, ...requestArgs } = args;\n        const handle = await this._redirectNavigator.prepare({\n            redirectMethod,\n        });\n\n        const extraQueryParams = getExtraQueryParameters(\n            SignInMode.REDIRECT,\n            requestArgs.extraQueryParams,\n        );\n\n        await this._signinStart(\n            {\n                request_type: \"si:r\",\n                ...requestArgs,\n                ...extraQueryParams,\n            },\n            handle,\n        );\n    }\n\n    /**\n     * Returns promise to process response from the authorization endpoint. The result of the promise is the authenticated `User`.\n     */\n    public async signinRedirectCallback(\n        url = window.location.href,\n    ): Promise<User> {\n        const logger = this._logger.create(\"signinRedirectCallback\");\n        const user = await this._signinEnd(url);\n        if (user.profile && user.profile.sub) {\n            logger.info(\"success, signed in subject\", user.profile.sub);\n        } else {\n            logger.info(\"no subject\");\n        }\n\n        return user;\n    }\n\n    /**\n     * Returns promise to process the signin with user/password. The result of the promise is the authenticated `User`.\n     *\n     * Throws an ErrorResponse in case of wrong authentication.\n     */\n    public async signinResourceOwnerCredentials({\n        username,\n        password,\n        skipUserInfo = false,\n    }: SigninResourceOwnerCredentialsArgs) {\n        const logger = this._logger.create(\"signinResourceOwnerCredential\");\n\n        const signinResponse =\n            await this._client.processResourceOwnerPasswordCredentials({\n                username,\n                password,\n                skipUserInfo,\n            });\n        logger.debug(\"got signin response\");\n\n        const user = await this._buildUser(signinResponse);\n        if (user.profile && user.profile.sub) {\n            logger.info(\"success, signed in subject\", user.profile.sub);\n        } else {\n            logger.info(\"no subject\");\n        }\n        return user;\n    }\n\n    /**\n     * Returns promise to trigger a request (via a popup window) to the authorization endpoint. The result of the promise is the authenticated `User`.\n     */\n    public async signinPopup(args: SigninPopupArgs = {}): Promise<User> {\n        const logger = this._logger.create(\"signinPopup\");\n        const { popupWindowFeatures, popupWindowTarget, ...requestArgs } = args;\n\n        const handle = await this._popupNavigator.prepare({\n            popupWindowFeatures,\n            popupWindowTarget,\n        });\n\n        const extraQueryParams = getExtraQueryParameters(\n            SignInMode.POPUP,\n            requestArgs.extraQueryParams,\n        );\n\n        const user = await this._signin(\n            {\n                request_type: \"si:p\",\n                redirect_uri: \" \",\n                display: \"popup\",\n                ...requestArgs,\n                ...extraQueryParams,\n            },\n            handle,\n        );\n        if (user) {\n            if (user.profile && user.profile.sub) {\n                logger.info(\"success, signed in subject\", user.profile.sub);\n            } else {\n                logger.info(\"no subject\");\n            }\n        }\n\n        return user;\n    }\n    /**\n     * Returns promise to notify the opening window of response from the authorization endpoint.\n     */\n    public async signinPopupCallback(\n        url = window.location.href,\n        keepOpen = false,\n    ): Promise<void> {\n        const logger = this._logger.create(\"signinPopupCallback\");\n        await this._popupNavigator.callback(url, keepOpen);\n        logger.info(\"success\");\n    }\n\n    /**\n     * Returns promise to trigger a silent request (via an iframe) to the authorization endpoint.\n     * The result of the promise is the authenticated `User`.\n     */\n    public async signinSilent(\n        args: SigninSilentArgs = { hidden: false, parentId: undefined },\n    ): Promise<User | null> {\n        const logger = this._logger.create(\"signinSilent\");\n        const {\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n            ...requestArgs\n        } = args;\n        // first determine if we have a refresh token, or need to use iframe\n        let user = await this._loadUser();\n        if (user?.refresh_token) {\n            logger.debug(\"using refresh token\");\n            const state = new RefreshState(user as Required<User>);\n            return await this._useRefreshToken(state);\n        }\n\n        let verifySub: string | undefined;\n        if (user && this.settings.validateSubOnSilentRenew) {\n            logger.debug(\"subject prior to silent renew:\", user.profile.sub);\n            verifySub = user.profile.sub;\n        }\n\n        const handle = await this._iframeNavigator.prepare({\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n        });\n\n        const extraQueryParams = getExtraQueryParameters(\n            SignInMode.SILENT,\n            requestArgs.extraQueryParams,\n        );\n\n        user = await this._signin(\n            {\n                request_type: \"si:s\",\n                redirect_uri: \" \",\n                display: \"popup\",\n                id_token_hint: this.settings.includeIdTokenInSilentRenew\n                    ? user?.id_token\n                    : undefined,\n                ...requestArgs,\n                ...extraQueryParams,\n            },\n            handle,\n            verifySub,\n        );\n        MicroModal.close(\"iframe-modal\");\n        if (user) {\n            if (user.profile?.sub) {\n                logger.info(\"success, signed in subject\", user.profile.sub);\n            } else {\n                logger.info(\"no subject\");\n            }\n        }\n\n        return user;\n    }\n\n    protected async _useRefreshToken(state: RefreshState): Promise<User> {\n        const response = await this._client.useRefreshToken({\n            state,\n            timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,\n        });\n        const user = new User({ ...state, ...response });\n\n        await this.storeUser(user);\n        this._events.load(user);\n        return user;\n    }\n\n    /**\n     * Returns promise to notify the parent window of response from the authorization endpoint.\n     */\n    public async signinSilentCallback(\n        url = window.location.href,\n    ): Promise<void> {\n        const logger = this._logger.create(\"signinSilentCallback\");\n        await this._iframeNavigator.callback(url);\n        logger.info(\"success\");\n    }\n\n    public async signinCallback(\n        url = window.location.href,\n    ): Promise<User | void> {\n        const { state } = await this._client.readSigninResponseState(url);\n        switch (state.request_type) {\n            case \"si:r\":\n                return await this.signinRedirectCallback(url);\n            case \"si:p\":\n                return await this.signinPopupCallback(url);\n            case \"si:s\":\n                return await this.signinSilentCallback(url);\n            default:\n                throw new Error(\"invalid response_type in state\");\n        }\n    }\n\n    public async signoutCallback(\n        url = window.location.href,\n        keepOpen = false,\n    ): Promise<void> {\n        const { state } = await this._client.readSignoutResponseState(url);\n        if (!state) {\n            return;\n        }\n\n        switch (state.request_type) {\n            case \"so:r\":\n                await this.signoutRedirectCallback(url);\n                break;\n            case \"so:p\":\n                await this.signoutPopupCallback(url, keepOpen);\n                break;\n            case \"so:s\":\n                await this.signoutSilentCallback(url);\n                break;\n            default:\n                throw new Error(\"invalid response_type in state\");\n        }\n    }\n\n    /**\n     * Returns promise to query OP for user's current signin status. Returns object with session_state and subject identifier.\n     */\n    public async querySessionStatus(\n        args: QuerySessionStatusArgs = { hidden: false, parentId: undefined },\n    ): Promise<SessionStatus | null> {\n        const logger = this._logger.create(\"querySessionStatus\");\n        const {\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n            ...requestArgs\n        } = args;\n        const url = this.settings.silent_redirect_uri;\n        if (!url) {\n            logger.throw(new Error(\"No silent_redirect_uri configured\"));\n        }\n\n        const user = await this._loadUser();\n        const handle = await this._iframeNavigator.prepare({\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n        });\n\n        const navResponse = await this._signinStart(\n            {\n                request_type: \"si:s\", // this acts like a signin silent\n                redirect_uri: url,\n                prompt: \"none\",\n                id_token_hint: this.settings.includeIdTokenInSilentRenew\n                    ? user?.id_token\n                    : undefined,\n                response_type: this.settings.query_status_response_type,\n                scope: \"openid\",\n                skipUserInfo: true,\n                ...requestArgs,\n            },\n            handle,\n        );\n        try {\n            const signinResponse = await this._client.processSigninResponse(\n                navResponse.url,\n            );\n            logger.debug(\"got signin response\");\n\n            if (signinResponse.session_state && signinResponse.profile.sub) {\n                logger.info(\"success for subject\", signinResponse.profile.sub);\n                return {\n                    session_state: signinResponse.session_state,\n                    sub: signinResponse.profile.sub,\n                    sid: signinResponse.profile.sid,\n                };\n            }\n\n            logger.info(\"success, user not authenticated\");\n            return null;\n        } catch (err) {\n            if (\n                this.settings.monitorAnonymousSession &&\n                err instanceof ErrorResponse\n            ) {\n                switch (err.error) {\n                    case \"login_required\":\n                    case \"consent_required\":\n                    case \"interaction_required\":\n                    case \"account_selection_required\":\n                        logger.info(\"success for anonymous user\");\n                        return {\n                            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n                            session_state: err.session_state!,\n                        };\n                }\n            }\n            throw err;\n        }\n    }\n\n    protected async _signin(\n        args: CreateSigninRequestArgs,\n        handle: IWindow,\n        verifySub?: string,\n    ): Promise<User> {\n        const navResponse = await this._signinStart(args, handle);\n        return await this._signinEnd(navResponse.url, verifySub);\n    }\n    protected async _signinStart(\n        args: CreateSigninRequestArgs,\n        handle: IWindow,\n    ): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"_signinStart\");\n\n        try {\n            const signinRequest = await this._client.createSigninRequest(args);\n            logger.debug(\"got signin request\");\n\n            return await handle.navigate({\n                url: signinRequest.url,\n                state: signinRequest.state.id,\n                response_mode: signinRequest.state.response_mode,\n                scriptOrigin: this.settings.iframeScriptOrigin,\n            });\n        } catch (err) {\n            logger.debug(\n                \"error after preparing navigator, closing navigator window\",\n            );\n            handle.close();\n            throw err;\n        }\n    }\n    protected async _signinEnd(url: string, verifySub?: string): Promise<User> {\n        const logger = this._logger.create(\"_signinEnd\");\n        const signinResponse = await this._client.processSigninResponse(url);\n        logger.debug(\"got signin response\");\n\n        const user = await this._buildUser(signinResponse, verifySub);\n        return user;\n    }\n\n    protected async _buildUser(\n        signinResponse: SigninResponse,\n        verifySub?: string,\n    ) {\n        const logger = this._logger.create(\"_buildUser\");\n        const user = new User(signinResponse);\n        // if (verifySub) {\n        //     if (verifySub !== user.profile.sub) {\n        //         logger.debug(\n        //             \"current user does not match user returned from signin. sub from signin:\",\n        //             user.profile.sub,\n        //         );\n        //         throw new ErrorResponse({\n        //             ...signinResponse,\n        //             error: \"login_required\",\n        //         });\n        //     }\n        //     logger.debug(\"current user matches user returned from signin\");\n        // }\n\n        await this.storeUser(user);\n        logger.debug(\"user stored\");\n        this._events.load(user);\n\n        return user;\n    }\n\n    /**\n     * Returns promise to trigger a redirect of the current window to the end session endpoint.\n     */\n    public async signoutRedirect(\n        args: SignoutRedirectArgs = {},\n    ): Promise<void> {\n        const logger = this._logger.create(\"signoutRedirect\");\n        const { redirectMethod, ...requestArgs } = args;\n        const handle = await this._redirectNavigator.prepare({\n            redirectMethod,\n        });\n        await this._signoutStart(\n            {\n                request_type: \"so:r\",\n                post_logout_redirect_uri:\n                    this.settings.post_logout_redirect_uri,\n                ...requestArgs,\n            },\n            handle,\n        );\n        logger.info(\"success\");\n    }\n\n    /**\n     * Returns promise to process response from the end session endpoint.\n     */\n    public async signoutRedirectCallback(\n        url = window.location.href,\n    ): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"signoutRedirectCallback\");\n        const response = await this._signoutEnd(url);\n        logger.info(\"success\");\n        return response;\n    }\n\n    /**\n     * Returns promise to trigger a redirect of a popup window window to the end session endpoint.\n     */\n    public async signoutPopup(args: SignoutPopupArgs = {}): Promise<void> {\n        const logger = this._logger.create(\"signoutPopup\");\n        const { popupWindowFeatures, popupWindowTarget, ...requestArgs } = args;\n        const url = this.settings.popup_post_logout_redirect_uri;\n\n        const handle = await this._popupNavigator.prepare({\n            popupWindowFeatures,\n            popupWindowTarget,\n        });\n        await this._signout(\n            {\n                request_type: \"so:p\",\n                post_logout_redirect_uri: url,\n                // we're putting a dummy entry in here because we\n                // need a unique id from the state for notification\n                // to the parent window, which is necessary if we\n                // plan to return back to the client after signout\n                // and so we can close the popup after signout\n                state: url == null ? undefined : {},\n                ...requestArgs,\n            },\n            handle,\n        );\n        logger.info(\"success\");\n    }\n\n    /**\n     * Returns promise to process response from the end session endpoint from a popup window.\n     */\n    public async signoutPopupCallback(\n        url = window.location.href,\n        keepOpen = false,\n    ): Promise<void> {\n        const logger = this._logger.create(\"signoutPopupCallback\");\n        await this._popupNavigator.callback(url, keepOpen);\n        logger.info(\"success\");\n    }\n\n    protected async _signout(\n        args: CreateSignoutRequestArgs,\n        handle: IWindow,\n    ): Promise<SignoutResponse> {\n        const navResponse = await this._signoutStart(args, handle);\n        return await this._signoutEnd(navResponse.url);\n    }\n    protected async _signoutStart(\n        args: CreateSignoutRequestArgs = {},\n        handle: IWindow,\n    ): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"_signoutStart\");\n\n        try {\n            const user = await this._loadUser();\n            logger.debug(\"loaded current user from storage\");\n\n            if (this.settings.revokeTokensOnSignout) {\n                await this._revokeInternal(user);\n            }\n\n            const id_token = args.id_token_hint || (user && user.id_token);\n            if (id_token) {\n                logger.debug(\"setting id_token_hint in signout request\");\n                args.id_token_hint = id_token;\n            }\n\n            await this.removeUser();\n            logger.debug(\"user removed, creating signout request\");\n\n            const signoutRequest = await this._client.createSignoutRequest(\n                args,\n            );\n            logger.debug(\"got signout request\");\n\n            return await handle.navigate({\n                url: signoutRequest.url,\n                state: signoutRequest.state?.id,\n            });\n        } catch (err) {\n            logger.debug(\n                \"error after preparing navigator, closing navigator window\",\n            );\n            handle.close();\n            throw err;\n        }\n    }\n    protected async _signoutEnd(url: string): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"_signoutEnd\");\n        const signoutResponse = await this._client.processSignoutResponse(url);\n        logger.debug(\"got signout response\");\n\n        return signoutResponse;\n    }\n\n    /**\n     * Returns promise to trigger a silent request (via an iframe) to the end session endpoint.\n     */\n    public async signoutSilent(\n        args: SignoutSilentArgs = { hidden: false, parentId: undefined },\n    ): Promise<void> {\n        const logger = this._logger.create(\"signoutSilent\");\n        const {\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n            ...requestArgs\n        } = args;\n\n        const id_token_hint = this.settings.includeIdTokenInSilentSignout\n            ? (await this._loadUser())?.id_token\n            : undefined;\n\n        const url = this.settings.popup_post_logout_redirect_uri;\n        const handle = await this._iframeNavigator.prepare({\n            silentRequestTimeoutInSeconds,\n            hidden,\n            parentId,\n        });\n        await this._signout(\n            {\n                request_type: \"so:s\",\n                post_logout_redirect_uri: url,\n                id_token_hint: id_token_hint,\n                ...requestArgs,\n            },\n            handle,\n        );\n\n        logger.info(\"success\");\n    }\n\n    /**\n     * Returns promise to notify the parent window of response from the end session endpoint.\n     */\n    public async signoutSilentCallback(\n        url = window.location.href,\n    ): Promise<void> {\n        const logger = this._logger.create(\"signoutSilentCallback\");\n        await this._iframeNavigator.callback(url);\n        logger.info(\"success\");\n    }\n\n    public async revokeTokens(types?: RevokeTokensTypes): Promise<void> {\n        const user = await this._loadUser();\n        await this._revokeInternal(user, types);\n    }\n\n    protected async _revokeInternal(\n        user: User | null,\n        types = this.settings.revokeTokenTypes,\n    ): Promise<void> {\n        const logger = this._logger.create(\"_revokeInternal\");\n        if (!user) return;\n\n        const typesPresent = types.filter(\n            (type) => typeof user[type] === \"string\",\n        );\n\n        if (!typesPresent.length) {\n            logger.debug(\"no need to revoke due to no token(s)\");\n            return;\n        }\n\n        // don't Promise.all, order matters\n        for (const type of typesPresent) {\n            await this._client.revokeToken(\n                user[type]!, // eslint-disable-line @typescript-eslint/no-non-null-assertion\n                type,\n            );\n            logger.info(`${type} revoked successfully`);\n            if (type !== \"access_token\") {\n                user[type] = null as never;\n            }\n        }\n\n        await this.storeUser(user);\n        logger.debug(\"user stored\");\n        this._events.load(user);\n    }\n\n    /**\n     * Enables silent renew for the `UserManager`.\n     */\n    public startSilentRenew(): void {\n        this._logger.create(\"startSilentRenew\");\n        void this._silentRenewService.start();\n    }\n\n    /**\n     * Disables silent renew for the `UserManager`.\n     */\n    public stopSilentRenew(): void {\n        this._silentRenewService.stop();\n    }\n\n    protected get _userStoreKey(): string {\n        return `user:${this.settings.authority}:${this.settings.client_id}`;\n    }\n\n    protected async _loadUser(): Promise<User | null> {\n        const logger = this._logger.create(\"_loadUser\");\n        const storageString = await this.settings.userStore.get(\n            this._userStoreKey,\n        );\n        if (storageString) {\n            logger.debug(\"user storageString loaded\");\n            return User.fromStorageString(storageString);\n        }\n\n        logger.debug(\"no user storageString\");\n        return null;\n    }\n\n    public async storeUser(user: User | null): Promise<void> {\n        const logger = this._logger.create(\"storeUser\");\n        if (user) {\n            logger.debug(\"storing user\");\n            const storageString = user.toStorageString();\n            await this.settings.userStore.set(\n                this._userStoreKey,\n                storageString,\n            );\n        } else {\n            this._logger.debug(\"removing user\");\n            await this.settings.userStore.remove(this._userStoreKey);\n        }\n    }\n\n    /**\n     * Removes stale state entries in storage for incomplete authorize requests.\n     */\n    public async clearStaleState(): Promise<void> {\n        await this._client.clearStaleState();\n    }\n}\n","export enum SignInMode {\n    REDIRECT = \"redirect\",\n    POPUP = \"popup\",\n    SILENT = \"silent\",\n}\n\ninterface GetExtraQueryParametersProps {\n    mode: SignInMode;\n    params?: Record<string, string | number | boolean>;\n}\n\nexport const getExtraQueryParameters = (\n    mode: GetExtraQueryParametersProps[\"mode\"],\n    params: GetExtraQueryParametersProps[\"params\"],\n) => ({\n    ...(params ?? {}),\n    \"trinsic:mode\": mode,\n});\n","// @ts-expect-error avoid enabling resolveJsonModule to keep build process simple\nimport { version } from \"../package.json\";\n\n/**\n * @public\n */\nexport const Version: string = version;\n"]}