@microsoft/managed-apps-cli 0.19.0 → 0.21.0

package/dist/chunk-3YRE4IQ3.js

@@ -0,0 +1,132 @@
+import { createRequire as __createRequire } from 'node:module';
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __pathDirname } from 'node:path';
+const require = __createRequire(import.meta.url);
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __pathDirname(__filename);
+import{a as Vt}from"./chunk-HBLO3WDD.js";import{a as Jn}from"./chunk-TYRVM4PP.js";import{a as X,b as I,c as J,d as fl}from"./chunk-UT667QSU.js";var Os=I((QC,Tc)=>{var vn=Vt().Buffer,Cu=X("stream"),_u=X("util");function bn(r){if(this.buffer=null,this.writable=!0,this.readable=!0,!r)return this.buffer=vn.alloc(0),this;if(typeof r.pipe=="function")return this.buffer=vn.alloc(0),r.pipe(this),this;if(r.length||typeof r=="object")return this.buffer=r,this.writable=!1,process.nextTick(function(){this.emit("end",r),this.readable=!1,this.emit("close")}.bind(this)),this;throw new TypeError("Unexpected data type ("+typeof r+")")}_u.inherits(bn,Cu);bn.prototype.write=function(e){this.buffer=vn.concat([this.buffer,vn.from(e)]),this.emit("data",e)};bn.prototype.end=function(e){e&&this.write(e),this.emit("end",e),this.emit("close"),this.writable=!1,this.readable=!1};Tc.exports=bn});var Ac=I((XC,yc)=>{"use strict";function ws(r){var e=(r/8|0)+(r%8===0?0:1);return e}var Iu={ES256:ws(256),ES384:ws(384),ES512:ws(521)};function Su(r){var e=Iu[r];if(e)return e;throw new Error('Unknown algorithm "'+r+'"')}yc.exports=Su});var wc=I((JC,Oc)=>{"use strict";var Mn=Vt().Buffer,_c=Ac(),Pn=128,Ic=0,Ru=32,Ou=16,wu=2,Sc=Ou|Ru|Ic<<6,Dn=wu|Ic<<6;function ku(r){return r.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Rc(r){if(Mn.isBuffer(r))return r;if(typeof r=="string")return Mn.from(r,"base64");throw new TypeError("ECDSA signature must be a Base64 string or a Buffer")}function Nu(r,e){r=Rc(r);var t=_c(e),n=t+1,o=r.length,i=0;if(r[i++]!==Sc)throw new Error('Could not find expected "seq"');var s=r[i++];if(s===(Pn|1)&&(s=r[i++]),o-i<s)throw new Error('"seq" specified length of "'+s+'", only "'+(o-i)+'" remaining');if(r[i++]!==Dn)throw new Error('Could not find expected "int" for "r"');var a=r[i++];if(o-i-2<a)throw new Error('"r" specified length of "'+a+'", only "'+(o-i-2)+'" available');if(n<a)throw new Error('"r" specified length of "'+a+'", max of "'+n+'" is acceptable');var d=i;if(i+=a,r[i++]!==Dn)throw new Error('Could not find expected "int" for "s"');var c=r[i++];if(o-i!==c)throw new Error('"s" specified length of "'+c+'", expected "'+(o-i)+'"');if(n<c)throw new Error('"s" specified length of "'+c+'", max of "'+n+'" is acceptable');var u=i;if(i+=c,i!==o)throw new Error('Expected to consume entire buffer, but "'+(o-i)+'" bytes remain');var h=t-a,g=t-c,p=Mn.allocUnsafe(h+a+g+c);for(i=0;i<h;++i)p[i]=0;r.copy(p,i,d+Math.max(-h,0),d+a),i=t;for(var E=i;i<E+g;++i)p[i]=0;return r.copy(p,i,u+Math.max(-g,0),u+c),p=p.toString("base64"),p=ku(p),p}function Cc(r,e,t){for(var n=0;e+n<t&&r[e+n]===0;)++n;var o=r[e+n]>=Pn;return o&&--n,n}function vu(r,e){r=Rc(r);var t=_c(e),n=r.length;if(n!==t*2)throw new TypeError('"'+e+'" signatures must be "'+t*2+'" bytes, saw "'+n+'"');var o=Cc(r,0,t),i=Cc(r,t,r.length),s=t-o,a=t-i,d=2+s+1+1+a,c=d<Pn,u=Mn.allocUnsafe((c?2:3)+d),h=0;return u[h++]=Sc,c?u[h++]=d:(u[h++]=Pn|1,u[h++]=d&255),u[h++]=Dn,u[h++]=s,o<0?(u[h++]=0,h+=r.copy(u,h,0,t)):h+=r.copy(u,h,o,t),u[h++]=Dn,u[h++]=a,i<0?(u[h++]=0,r.copy(u,h,t)):r.copy(u,h,t+i),u}Oc.exports={derToJose:Nu,joseToDer:vu}});var Nc=I((ZC,kc)=>{"use strict";var Ur=X("buffer").Buffer,ks=X("buffer").SlowBuffer;kc.exports=Un;function Un(r,e){if(!Ur.isBuffer(r)||!Ur.isBuffer(e)||r.length!==e.length)return!1;for(var t=0,n=0;n<r.length;n++)t|=r[n]^e[n];return t===0}Un.install=function(){Ur.prototype.equal=ks.prototype.equal=function(e){return Un(this,e)}};var bu=Ur.prototype.equal,Mu=ks.prototype.equal;Un.restore=function(){Ur.prototype.equal=bu,ks.prototype.equal=Mu}});var Ms=I((e_,Hc)=>{var Ut=Vt().Buffer,ae=X("crypto"),bc=wc(),vc=X("util"),Pu=`"%s" is not a valid algorithm.
+  Supported algorithms are:
+  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,xr="secret must be a string or buffer",Dt="key must be a string or a buffer",Du="key must be a string, a buffer or an object",vs=typeof ae.createPublicKey=="function";vs&&(Dt+=" or a KeyObject",xr+="or a KeyObject");function Mc(r){if(!Ut.isBuffer(r)&&typeof r!="string"&&(!vs||typeof r!="object"||typeof r.type!="string"||typeof r.asymmetricKeyType!="string"||typeof r.export!="function"))throw me(Dt)}function Pc(r){if(!Ut.isBuffer(r)&&typeof r!="string"&&typeof r!="object")throw me(Du)}function Uu(r){if(!Ut.isBuffer(r)){if(typeof r=="string")return r;if(!vs||typeof r!="object"||r.type!=="secret"||typeof r.export!="function")throw me(xr)}}function bs(r){return r.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Dc(r){r=r.toString();var e=4-r.length%4;if(e!==4)for(var t=0;t<e;++t)r+="=";return r.replace(/\-/g,"+").replace(/_/g,"/")}function me(r){var e=[].slice.call(arguments,1),t=vc.format.bind(vc,r).apply(null,e);return new TypeError(t)}function xu(r){return Ut.isBuffer(r)||typeof r=="string"}function Lr(r){return xu(r)||(r=JSON.stringify(r)),r}function Uc(r){return function(t,n){Uu(n),t=Lr(t);var o=ae.createHmac("sha"+r,n),i=(o.update(t),o.digest("base64"));return bs(i)}}var Ns,Lu="timingSafeEqual"in ae?function(e,t){return e.byteLength!==t.byteLength?!1:ae.timingSafeEqual(e,t)}:function(e,t){return Ns||(Ns=Nc()),Ns(e,t)};function Hu(r){return function(t,n,o){var i=Uc(r)(t,o);return Lu(Ut.from(n),Ut.from(i))}}function xc(r){return function(t,n){Pc(n),t=Lr(t);var o=ae.createSign("RSA-SHA"+r),i=(o.update(t),o.sign(n,"base64"));return bs(i)}}function Lc(r){return function(t,n,o){Mc(o),t=Lr(t),n=Dc(n);var i=ae.createVerify("RSA-SHA"+r);return i.update(t),i.verify(o,n,"base64")}}function Fu(r){return function(t,n){Pc(n),t=Lr(t);var o=ae.createSign("RSA-SHA"+r),i=(o.update(t),o.sign({key:n,padding:ae.constants.RSA_PKCS1_PSS_PADDING,saltLength:ae.constants.RSA_PSS_SALTLEN_DIGEST},"base64"));return bs(i)}}function Bu(r){return function(t,n,o){Mc(o),t=Lr(t),n=Dc(n);var i=ae.createVerify("RSA-SHA"+r);return i.update(t),i.verify({key:o,padding:ae.constants.RSA_PKCS1_PSS_PADDING,saltLength:ae.constants.RSA_PSS_SALTLEN_DIGEST},n,"base64")}}function Ku(r){var e=xc(r);return function(){var n=e.apply(null,arguments);return n=bc.derToJose(n,"ES"+r),n}}function Gu(r){var e=Lc(r);return function(n,o,i){o=bc.joseToDer(o,"ES"+r).toString("base64");var s=e(n,o,i);return s}}function Vu(){return function(){return""}}function $u(){return function(e,t){return t===""}}Hc.exports=function(e){var t={hs:Uc,rs:xc,ps:Fu,es:Ku,none:Vu},n={hs:Hu,rs:Lc,ps:Bu,es:Gu,none:$u},o=e.match(/^(RS|PS|ES|HS)(256|384|512)$|^(none)$/);if(!o)throw me(Pu,e);var i=(o[1]||o[3]).toLowerCase(),s=o[2];return{sign:t[i](s),verify:n[i](s)}}});var Ps=I((t_,Fc)=>{var ju=X("buffer").Buffer;Fc.exports=function(e){return typeof e=="string"?e:typeof e=="number"||ju.isBuffer(e)?e.toString():JSON.stringify(e)}});var jc=I((r_,$c)=>{var zu=Vt().Buffer,Bc=Os(),Yu=Ms(),Wu=X("stream"),Kc=Ps(),Ds=X("util");function Gc(r,e){return zu.from(r,e).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function qu(r,e,t){t=t||"utf8";var n=Gc(Kc(r),"binary"),o=Gc(Kc(e),t);return Ds.format("%s.%s",n,o)}function Vc(r){var e=r.header,t=r.payload,n=r.secret||r.privateKey,o=r.encoding,i=Yu(e.alg),s=qu(e,t,o),a=i.sign(s,n);return Ds.format("%s.%s",s,a)}function xn(r){var e=r.secret;if(e=e??r.privateKey,e=e??r.key,/^hs/i.test(r.header.alg)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var t=new Bc(e);this.readable=!0,this.header=r.header,this.encoding=r.encoding,this.secret=this.privateKey=this.key=t,this.payload=new Bc(r.payload),this.secret.once("close",function(){!this.payload.writable&&this.readable&&this.sign()}.bind(this)),this.payload.once("close",function(){!this.secret.writable&&this.readable&&this.sign()}.bind(this))}Ds.inherits(xn,Wu);xn.prototype.sign=function(){try{var e=Vc({header:this.header,payload:this.payload.buffer,secret:this.secret.buffer,encoding:this.encoding});return this.emit("done",e),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(t){this.readable=!1,this.emit("error",t),this.emit("close")}};xn.sign=Vc;$c.exports=xn});var td=I((n_,ed)=>{var Yc=Vt().Buffer,zc=Os(),Qu=Ms(),Xu=X("stream"),Wc=Ps(),Ju=X("util"),Zu=/^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;function ef(r){return Object.prototype.toString.call(r)==="[object Object]"}function tf(r){if(ef(r))return r;try{return JSON.parse(r)}catch{return}}function qc(r){var e=r.split(".",1)[0];return tf(Yc.from(e,"base64").toString("binary"))}function rf(r){return r.split(".",2).join(".")}function Qc(r){return r.split(".")[2]}function nf(r,e){e=e||"utf8";var t=r.split(".")[1];return Yc.from(t,"base64").toString(e)}function Xc(r){return Zu.test(r)&&!!qc(r)}function Jc(r,e,t){if(!e){var n=new Error("Missing algorithm parameter for jws.verify");throw n.code="MISSING_ALGORITHM",n}r=Wc(r);var o=Qc(r),i=rf(r),s=Qu(e);return s.verify(i,o,t)}function Zc(r,e){if(e=e||{},r=Wc(r),!Xc(r))return null;var t=qc(r);if(!t)return null;var n=nf(r);return(t.typ==="JWT"||e.json)&&(n=JSON.parse(n,e.encoding)),{header:t,payload:n,signature:Qc(r)}}function xt(r){r=r||{};var e=r.secret;if(e=e??r.publicKey,e=e??r.key,/^hs/i.test(r.algorithm)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var t=new zc(e);this.readable=!0,this.algorithm=r.algorithm,this.encoding=r.encoding,this.secret=this.publicKey=this.key=t,this.signature=new zc(r.signature),this.secret.once("close",function(){!this.signature.writable&&this.readable&&this.verify()}.bind(this)),this.signature.once("close",function(){!this.secret.writable&&this.readable&&this.verify()}.bind(this))}Ju.inherits(xt,Xu);xt.prototype.verify=function(){try{var e=Jc(this.signature.buffer,this.algorithm,this.key.buffer),t=Zc(this.signature.buffer,this.encoding);return this.emit("done",e,t),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(n){this.readable=!1,this.emit("error",n),this.emit("close")}};xt.decode=Zc;xt.isValid=Xc;xt.verify=Jc;ed.exports=xt});var Hn=I(Fe=>{var rd=jc(),Ln=td(),of=["HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512"];Fe.ALGORITHMS=of;Fe.sign=rd.sign;Fe.verify=Ln.verify;Fe.decode=Ln.decode;Fe.isValid=Ln.isValid;Fe.createSign=function(e){return new rd(e)};Fe.createVerify=function(e){return new Ln(e)}});var Us=I((i_,nd)=>{var sf=Hn();nd.exports=function(r,e){e=e||{};var t=sf.decode(r,e);if(!t)return null;var n=t.payload;if(typeof n=="string")try{var o=JSON.parse(n);o!==null&&typeof o=="object"&&(n=o)}catch{}return e.complete===!0?{header:t.header,payload:n,signature:t.signature}:n}});var Hr=I((s_,od)=>{var Fn=function(r,e){Error.call(this,r),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor),this.name="JsonWebTokenError",this.message=r,e&&(this.inner=e)};Fn.prototype=Object.create(Error.prototype);Fn.prototype.constructor=Fn;od.exports=Fn});var xs=I((a_,sd)=>{var id=Hr(),Bn=function(r,e){id.call(this,r),this.name="NotBeforeError",this.date=e};Bn.prototype=Object.create(id.prototype);Bn.prototype.constructor=Bn;sd.exports=Bn});var Ls=I((c_,cd)=>{var ad=Hr(),Kn=function(r,e){ad.call(this,r),this.name="TokenExpiredError",this.expiredAt=e};Kn.prototype=Object.create(ad.prototype);Kn.prototype.constructor=Kn;cd.exports=Kn});var ld=I((d_,dd)=>{var Lt=1e3,Ht=Lt*60,Ft=Ht*60,mt=Ft*24,af=mt*7,cf=mt*365.25;dd.exports=function(r,e){e=e||{};var t=typeof r;if(t==="string"&&r.length>0)return df(r);if(t==="number"&&isFinite(r))return e.long?hf(r):lf(r);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(r))};function df(r){if(r=String(r),!(r.length>100)){var e=/^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(r);if(e){var t=parseFloat(e[1]),n=(e[2]||"ms").toLowerCase();switch(n){case"years":case"year":case"yrs":case"yr":case"y":return t*cf;case"weeks":case"week":case"w":return t*af;case"days":case"day":case"d":return t*mt;case"hours":case"hour":case"hrs":case"hr":case"h":return t*Ft;case"minutes":case"minute":case"mins":case"min":case"m":return t*Ht;case"seconds":case"second":case"secs":case"sec":case"s":return t*Lt;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return t;default:return}}}}function lf(r){var e=Math.abs(r);return e>=mt?Math.round(r/mt)+"d":e>=Ft?Math.round(r/Ft)+"h":e>=Ht?Math.round(r/Ht)+"m":e>=Lt?Math.round(r/Lt)+"s":r+"ms"}function hf(r){var e=Math.abs(r);return e>=mt?Gn(r,e,mt,"day"):e>=Ft?Gn(r,e,Ft,"hour"):e>=Ht?Gn(r,e,Ht,"minute"):e>=Lt?Gn(r,e,Lt,"second"):r+" ms"}function Gn(r,e,t,n){var o=e>=t*1.5;return Math.round(r/t)+" "+n+(o?"s":"")}});var Hs=I((l_,hd)=>{var uf=ld();hd.exports=function(r,e){var t=e||Math.floor(Date.now()/1e3);if(typeof r=="string"){var n=uf(r);return typeof n>"u"?void 0:Math.floor(t+n/1e3)}else return typeof r=="number"?t+r:void 0}});var fd=I((h_,ud)=>{var ff=Jn();ud.exports=ff.satisfies(process.version,">=15.7.0")});var pd=I((u_,md)=>{var mf=Jn();md.exports=mf.satisfies(process.version,">=16.9.0")});var Fs=I((f_,gd)=>{var pf=fd(),gf=pd(),Ef={ec:["ES256","ES384","ES512"],rsa:["RS256","PS256","RS384","PS384","RS512","PS512"],"rsa-pss":["PS256","PS384","PS512"]},Tf={ES256:"prime256v1",ES384:"secp384r1",ES512:"secp521r1"};gd.exports=function(r,e){if(!r||!e)return;let t=e.asymmetricKeyType;if(!t)return;let n=Ef[t];if(!n)throw new Error(`Unknown key type "${t}".`);if(!n.includes(r))throw new Error(`"alg" parameter for "${t}" key type must be one of: ${n.join(", ")}.`);if(pf)switch(t){case"ec":let o=e.asymmetricKeyDetails.namedCurve,i=Tf[r];if(o!==i)throw new Error(`"alg" parameter "${r}" requires curve "${i}".`);break;case"rsa-pss":if(gf){let s=parseInt(r.slice(-3),10),{hashAlgorithm:a,mgf1HashAlgorithm:d,saltLength:c}=e.asymmetricKeyDetails;if(a!==`sha${s}`||d!==a)throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${r}.`);if(c!==void 0&&c>s>>3)throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${r}.`)}break}}});var Bs=I((m_,Ed)=>{var yf=Jn();Ed.exports=yf.satisfies(process.version,"^6.12.0 || >=8.0.0")});var Ad=I((p_,yd)=>{var R=Hr(),Af=xs(),Td=Ls(),Cf=Us(),_f=Hs(),If=Fs(),Sf=Bs(),Rf=Hn(),{KeyObject:Of,createSecretKey:wf,createPublicKey:kf}=X("crypto"),Ks=["RS256","RS384","RS512"],Nf=["ES256","ES384","ES512"],Gs=["RS256","RS384","RS512"],vf=["HS256","HS384","HS512"];Sf&&(Ks.splice(Ks.length,0,"PS256","PS384","PS512"),Gs.splice(Gs.length,0,"PS256","PS384","PS512"));yd.exports=function(r,e,t,n){typeof t=="function"&&!n&&(n=t,t={}),t||(t={}),t=Object.assign({},t);let o;if(n?o=n:o=function(u,h){if(u)throw u;return h},t.clockTimestamp&&typeof t.clockTimestamp!="number")return o(new R("clockTimestamp must be a number"));if(t.nonce!==void 0&&(typeof t.nonce!="string"||t.nonce.trim()===""))return o(new R("nonce must be a non-empty string"));if(t.allowInvalidAsymmetricKeyTypes!==void 0&&typeof t.allowInvalidAsymmetricKeyTypes!="boolean")return o(new R("allowInvalidAsymmetricKeyTypes must be a boolean"));let i=t.clockTimestamp||Math.floor(Date.now()/1e3);if(!r)return o(new R("jwt must be provided"));if(typeof r!="string")return o(new R("jwt must be a string"));let s=r.split(".");if(s.length!==3)return o(new R("jwt malformed"));let a;try{a=Cf(r,{complete:!0})}catch(u){return o(u)}if(!a)return o(new R("invalid token"));let d=a.header,c;if(typeof e=="function"){if(!n)return o(new R("verify must be called asynchronous if secret or public key is provided as a callback"));c=e}else c=function(u,h){return h(null,e)};return c(d,function(u,h){if(u)return o(new R("error in secret or public key callback: "+u.message));let g=s[2].trim()!=="";if(!g&&h)return o(new R("jwt signature is required"));if(g&&!h)return o(new R("secret or public key must be provided"));if(!g&&!t.algorithms)return o(new R('please specify "none" in "algorithms" to verify unsigned tokens'));if(h!=null&&!(h instanceof Of))try{h=kf(h)}catch{try{h=wf(typeof h=="string"?Buffer.from(h):h)}catch{return o(new R("secretOrPublicKey is not valid key material"))}}if(t.algorithms||(h.type==="secret"?t.algorithms=vf:["rsa","rsa-pss"].includes(h.asymmetricKeyType)?t.algorithms=Gs:h.asymmetricKeyType==="ec"?t.algorithms=Nf:t.algorithms=Ks),t.algorithms.indexOf(a.header.alg)===-1)return o(new R("invalid algorithm"));if(d.alg.startsWith("HS")&&h.type!=="secret")return o(new R(`secretOrPublicKey must be a symmetric key when using ${d.alg}`));if(/^(?:RS|PS|ES)/.test(d.alg)&&h.type!=="public")return o(new R(`secretOrPublicKey must be an asymmetric key when using ${d.alg}`));if(!t.allowInvalidAsymmetricKeyTypes)try{If(d.alg,h)}catch(_){return o(_)}let p;try{p=Rf.verify(r,a.header.alg,h)}catch(_){return o(_)}if(!p)return o(new R("invalid signature"));let E=a.payload;if(typeof E.nbf<"u"&&!t.ignoreNotBefore){if(typeof E.nbf!="number")return o(new R("invalid nbf value"));if(E.nbf>i+(t.clockTolerance||0))return o(new Af("jwt not active",new Date(E.nbf*1e3)))}if(typeof E.exp<"u"&&!t.ignoreExpiration){if(typeof E.exp!="number")return o(new R("invalid exp value"));if(i>=E.exp+(t.clockTolerance||0))return o(new Td("jwt expired",new Date(E.exp*1e3)))}if(t.audience){let _=Array.isArray(t.audience)?t.audience:[t.audience];if(!(Array.isArray(E.aud)?E.aud:[E.aud]).some(function(Y){return _.some(function(W){return W instanceof RegExp?W.test(Y):W===Y})}))return o(new R("jwt audience invalid. expected: "+_.join(" or ")))}if(t.issuer&&(typeof t.issuer=="string"&&E.iss!==t.issuer||Array.isArray(t.issuer)&&t.issuer.indexOf(E.iss)===-1))return o(new R("jwt issuer invalid. expected: "+t.issuer));if(t.subject&&E.sub!==t.subject)return o(new R("jwt subject invalid. expected: "+t.subject));if(t.jwtid&&E.jti!==t.jwtid)return o(new R("jwt jwtid invalid. expected: "+t.jwtid));if(t.nonce&&E.nonce!==t.nonce)return o(new R("jwt nonce invalid. expected: "+t.nonce));if(t.maxAge){if(typeof E.iat!="number")return o(new R("iat required when maxAge is specified"));let _=_f(t.maxAge,E.iat);if(typeof _>"u")return o(new R('"maxAge" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));if(i>=_+(t.clockTolerance||0))return o(new Td("maxAge exceeded",new Date(_*1e3)))}if(t.complete===!0){let _=a.signature;return o(null,{header:d,payload:E,signature:_})}return o(null,E)})}});var Od=I((g_,Rd)=>{var Cd=1/0,Id=9007199254740991,bf=17976931348623157e292,_d=NaN,Mf="[object Arguments]",Pf="[object Function]",Df="[object GeneratorFunction]",Uf="[object String]",xf="[object Symbol]",Lf=/^\s+|\s+$/g,Hf=/^[-+]0x[0-9a-f]+$/i,Ff=/^0b[01]+$/i,Bf=/^0o[0-7]+$/i,Kf=/^(?:0|[1-9]\d*)$/,Gf=parseInt;function Vf(r,e){for(var t=-1,n=r?r.length:0,o=Array(n);++t<n;)o[t]=e(r[t],t,r);return o}function $f(r,e,t,n){for(var o=r.length,i=t+(n?1:-1);n?i--:++i<o;)if(e(r[i],i,r))return i;return-1}function jf(r,e,t){if(e!==e)return $f(r,zf,t);for(var n=t-1,o=r.length;++n<o;)if(r[n]===e)return n;return-1}function zf(r){return r!==r}function Yf(r,e){for(var t=-1,n=Array(r);++t<r;)n[t]=e(t);return n}function Wf(r,e){return Vf(e,function(t){return r[t]})}function qf(r,e){return function(t){return r(e(t))}}var Vn=Object.prototype,$s=Vn.hasOwnProperty,$n=Vn.toString,Qf=Vn.propertyIsEnumerable,Xf=qf(Object.keys,Object),Jf=Math.max;function Zf(r,e){var t=Sd(r)||om(r)?Yf(r.length,String):[],n=t.length,o=!!n;for(var i in r)(e||$s.call(r,i))&&!(o&&(i=="length"||tm(i,n)))&&t.push(i);return t}function em(r){if(!rm(r))return Xf(r);var e=[];for(var t in Object(r))$s.call(r,t)&&t!="constructor"&&e.push(t);return e}function tm(r,e){return e=e??Id,!!e&&(typeof r=="number"||Kf.test(r))&&r>-1&&r%1==0&&r<e}function rm(r){var e=r&&r.constructor,t=typeof e=="function"&&e.prototype||Vn;return r===t}function nm(r,e,t,n){r=js(r)?r:mm(r),t=t&&!n?hm(t):0;var o=r.length;return t<0&&(t=Jf(o+t,0)),cm(r)?t<=o&&r.indexOf(e,t)>-1:!!o&&jf(r,e,t)>-1}function om(r){return im(r)&&$s.call(r,"callee")&&(!Qf.call(r,"callee")||$n.call(r)==Mf)}var Sd=Array.isArray;function js(r){return r!=null&&am(r.length)&&!sm(r)}function im(r){return zs(r)&&js(r)}function sm(r){var e=Vs(r)?$n.call(r):"";return e==Pf||e==Df}function am(r){return typeof r=="number"&&r>-1&&r%1==0&&r<=Id}function Vs(r){var e=typeof r;return!!r&&(e=="object"||e=="function")}function zs(r){return!!r&&typeof r=="object"}function cm(r){return typeof r=="string"||!Sd(r)&&zs(r)&&$n.call(r)==Uf}function dm(r){return typeof r=="symbol"||zs(r)&&$n.call(r)==xf}function lm(r){if(!r)return r===0?r:0;if(r=um(r),r===Cd||r===-Cd){var e=r<0?-1:1;return e*bf}return r===r?r:0}function hm(r){var e=lm(r),t=e%1;return e===e?t?e-t:e:0}function um(r){if(typeof r=="number")return r;if(dm(r))return _d;if(Vs(r)){var e=typeof r.valueOf=="function"?r.valueOf():r;r=Vs(e)?e+"":e}if(typeof r!="string")return r===0?r:+r;r=r.replace(Lf,"");var t=Ff.test(r);return t||Bf.test(r)?Gf(r.slice(2),t?2:8):Hf.test(r)?_d:+r}function fm(r){return js(r)?Zf(r):em(r)}function mm(r){return r?Wf(r,fm(r)):[]}Rd.exports=nm});var kd=I((E_,wd)=>{var pm="[object Boolean]",gm=Object.prototype,Em=gm.toString;function Tm(r){return r===!0||r===!1||ym(r)&&Em.call(r)==pm}function ym(r){return!!r&&typeof r=="object"}wd.exports=Tm});var Pd=I((T_,Md)=>{var Nd=1/0,Am=17976931348623157e292,vd=NaN,Cm="[object Symbol]",_m=/^\s+|\s+$/g,Im=/^[-+]0x[0-9a-f]+$/i,Sm=/^0b[01]+$/i,Rm=/^0o[0-7]+$/i,Om=parseInt,wm=Object.prototype,km=wm.toString;function Nm(r){return typeof r=="number"&&r==Pm(r)}function bd(r){var e=typeof r;return!!r&&(e=="object"||e=="function")}function vm(r){return!!r&&typeof r=="object"}function bm(r){return typeof r=="symbol"||vm(r)&&km.call(r)==Cm}function Mm(r){if(!r)return r===0?r:0;if(r=Dm(r),r===Nd||r===-Nd){var e=r<0?-1:1;return e*Am}return r===r?r:0}function Pm(r){var e=Mm(r),t=e%1;return e===e?t?e-t:e:0}function Dm(r){if(typeof r=="number")return r;if(bm(r))return vd;if(bd(r)){var e=typeof r.valueOf=="function"?r.valueOf():r;r=bd(e)?e+"":e}if(typeof r!="string")return r===0?r:+r;r=r.replace(_m,"");var t=Sm.test(r);return t||Rm.test(r)?Om(r.slice(2),t?2:8):Im.test(r)?vd:+r}Md.exports=Nm});var Ud=I((y_,Dd)=>{var Um="[object Number]",xm=Object.prototype,Lm=xm.toString;function Hm(r){return!!r&&typeof r=="object"}function Fm(r){return typeof r=="number"||Hm(r)&&Lm.call(r)==Um}Dd.exports=Fm});var Fd=I((A_,Hd)=>{var Bm="[object Object]";function Km(r){var e=!1;if(r!=null&&typeof r.toString!="function")try{e=!!(r+"")}catch{}return e}function Gm(r,e){return function(t){return r(e(t))}}var Vm=Function.prototype,xd=Object.prototype,Ld=Vm.toString,$m=xd.hasOwnProperty,jm=Ld.call(Object),zm=xd.toString,Ym=Gm(Object.getPrototypeOf,Object);function Wm(r){return!!r&&typeof r=="object"}function qm(r){if(!Wm(r)||zm.call(r)!=Bm||Km(r))return!1;var e=Ym(r);if(e===null)return!0;var t=$m.call(e,"constructor")&&e.constructor;return typeof t=="function"&&t instanceof t&&Ld.call(t)==jm}Hd.exports=qm});var Kd=I((C_,Bd)=>{var Qm="[object String]",Xm=Object.prototype,Jm=Xm.toString,Zm=Array.isArray;function ep(r){return!!r&&typeof r=="object"}function tp(r){return typeof r=="string"||!Zm(r)&&ep(r)&&Jm.call(r)==Qm}Bd.exports=tp});var zd=I((__,jd)=>{var rp="Expected a function",Gd=1/0,np=17976931348623157e292,Vd=NaN,op="[object Symbol]",ip=/^\s+|\s+$/g,sp=/^[-+]0x[0-9a-f]+$/i,ap=/^0b[01]+$/i,cp=/^0o[0-7]+$/i,dp=parseInt,lp=Object.prototype,hp=lp.toString;function up(r,e){var t;if(typeof e!="function")throw new TypeError(rp);return r=Ep(r),function(){return--r>0&&(t=e.apply(this,arguments)),r<=1&&(e=void 0),t}}function fp(r){return up(2,r)}function $d(r){var e=typeof r;return!!r&&(e=="object"||e=="function")}function mp(r){return!!r&&typeof r=="object"}function pp(r){return typeof r=="symbol"||mp(r)&&hp.call(r)==op}function gp(r){if(!r)return r===0?r:0;if(r=Tp(r),r===Gd||r===-Gd){var e=r<0?-1:1;return e*np}return r===r?r:0}function Ep(r){var e=gp(r),t=e%1;return e===e?t?e-t:e:0}function Tp(r){if(typeof r=="number")return r;if(pp(r))return Vd;if($d(r)){var e=typeof r.valueOf=="function"?r.valueOf():r;r=$d(e)?e+"":e}if(typeof r!="string")return r===0?r:+r;r=r.replace(ip,"");var t=ap.test(r);return t||cp.test(r)?dp(r.slice(2),t?2:8):sp.test(r)?Vd:+r}jd.exports=fp});var tl=I((I_,el)=>{var Yd=Hs(),yp=Bs(),Ap=Fs(),Wd=Hn(),Cp=Od(),jn=kd(),qd=Pd(),Ys=Ud(),Xd=Fd(),Be=Kd(),_p=zd(),{KeyObject:Ip,createSecretKey:Sp,createPrivateKey:Rp}=X("crypto"),Jd=["RS256","RS384","RS512","ES256","ES384","ES512","HS256","HS384","HS512","none"];yp&&Jd.splice(3,0,"PS256","PS384","PS512");var Op={expiresIn:{isValid:function(r){return qd(r)||Be(r)&&r},message:'"expiresIn" should be a number of seconds or string representing a timespan'},notBefore:{isValid:function(r){return qd(r)||Be(r)&&r},message:'"notBefore" should be a number of seconds or string representing a timespan'},audience:{isValid:function(r){return Be(r)||Array.isArray(r)},message:'"audience" must be a string or array'},algorithm:{isValid:Cp.bind(null,Jd),message:'"algorithm" must be a valid string enum value'},header:{isValid:Xd,message:'"header" must be an object'},encoding:{isValid:Be,message:'"encoding" must be a string'},issuer:{isValid:Be,message:'"issuer" must be a string'},subject:{isValid:Be,message:'"subject" must be a string'},jwtid:{isValid:Be,message:'"jwtid" must be a string'},noTimestamp:{isValid:jn,message:'"noTimestamp" must be a boolean'},keyid:{isValid:Be,message:'"keyid" must be a string'},mutatePayload:{isValid:jn,message:'"mutatePayload" must be a boolean'},allowInsecureKeySizes:{isValid:jn,message:'"allowInsecureKeySizes" must be a boolean'},allowInvalidAsymmetricKeyTypes:{isValid:jn,message:'"allowInvalidAsymmetricKeyTypes" must be a boolean'}},wp={iat:{isValid:Ys,message:'"iat" should be a number of seconds'},exp:{isValid:Ys,message:'"exp" should be a number of seconds'},nbf:{isValid:Ys,message:'"nbf" should be a number of seconds'}};function Zd(r,e,t,n){if(!Xd(t))throw new Error('Expected "'+n+'" to be a plain object.');Object.keys(t).forEach(function(o){let i=r[o];if(!i){if(!e)throw new Error('"'+o+'" is not allowed in "'+n+'"');return}if(!i.isValid(t[o]))throw new Error(i.message)})}function kp(r){return Zd(Op,!1,r,"options")}function Np(r){return Zd(wp,!0,r,"payload")}var Qd={audience:"aud",issuer:"iss",subject:"sub",jwtid:"jti"},vp=["expiresIn","notBefore","noTimestamp","audience","issuer","subject","jwtid"];el.exports=function(r,e,t,n){typeof t=="function"?(n=t,t={}):t=t||{};let o=typeof r=="object"&&!Buffer.isBuffer(r),i=Object.assign({alg:t.algorithm||"HS256",typ:o?"JWT":void 0,kid:t.keyid},t.header);function s(c){if(n)return n(c);throw c}if(!e&&t.algorithm!=="none")return s(new Error("secretOrPrivateKey must have a value"));if(e!=null&&!(e instanceof Ip))try{e=Rp(e)}catch{try{e=Sp(typeof e=="string"?Buffer.from(e):e)}catch{return s(new Error("secretOrPrivateKey is not valid key material"))}}if(i.alg.startsWith("HS")&&e.type!=="secret")return s(new Error(`secretOrPrivateKey must be a symmetric key when using ${i.alg}`));if(/^(?:RS|PS|ES)/.test(i.alg)){if(e.type!=="private")return s(new Error(`secretOrPrivateKey must be an asymmetric key when using ${i.alg}`));if(!t.allowInsecureKeySizes&&!i.alg.startsWith("ES")&&e.asymmetricKeyDetails!==void 0&&e.asymmetricKeyDetails.modulusLength<2048)return s(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`))}if(typeof r>"u")return s(new Error("payload is required"));if(o){try{Np(r)}catch(c){return s(c)}t.mutatePayload||(r=Object.assign({},r))}else{let c=vp.filter(function(u){return typeof t[u]<"u"});if(c.length>0)return s(new Error("invalid "+c.join(",")+" option for "+typeof r+" payload"))}if(typeof r.exp<"u"&&typeof t.expiresIn<"u")return s(new Error('Bad "options.expiresIn" option the payload already has an "exp" property.'));if(typeof r.nbf<"u"&&typeof t.notBefore<"u")return s(new Error('Bad "options.notBefore" option the payload already has an "nbf" property.'));try{kp(t)}catch(c){return s(c)}if(!t.allowInvalidAsymmetricKeyTypes)try{Ap(i.alg,e)}catch(c){return s(c)}let a=r.iat||Math.floor(Date.now()/1e3);if(t.noTimestamp?delete r.iat:o&&(r.iat=a),typeof t.notBefore<"u"){try{r.nbf=Yd(t.notBefore,a)}catch(c){return s(c)}if(typeof r.nbf>"u")return s(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}if(typeof t.expiresIn<"u"&&typeof r=="object"){try{r.exp=Yd(t.expiresIn,a)}catch(c){return s(c)}if(typeof r.exp>"u")return s(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}Object.keys(Qd).forEach(function(c){let u=Qd[c];if(typeof t[c]<"u"){if(typeof r[u]<"u")return s(new Error('Bad "options.'+c+'" option. The payload already has an "'+u+'" property.'));r[u]=t[c]}});let d=t.encoding||"utf8";if(typeof n=="function")n=n&&_p(n),Wd.createSign({header:i,privateKey:e,payload:r,encoding:d}).once("error",n).once("done",function(c){if(!t.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)return n(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`));n(null,c)});else{let c=Wd.sign({header:i,payload:r,secret:e,encoding:d});if(!t.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)throw new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`);return c}}});var nl=I((S_,rl)=>{rl.exports={decode:Us(),verify:Ad(),sign:tl(),JsonWebTokenError:Hr(),NotBeforeError:xs(),TokenExpiredError:Ls()}});function Gr(r){return`See https://aka.ms/msal.js.errors#${r} for details`}var T=class r extends Error{constructor(e,t,n){let o=t||(e?Gr(e):""),i=o?`${e}: ${o}`:e;super(i),Object.setPrototypeOf(this,r.prototype),this.errorCode=e||"",this.errorMessage=o||"",this.subError=n||"",this.name="AuthError"}setCorrelationId(e){this.correlationId=e}};function Ve(r,e){return new T(r,e||Gr(r))}var Zn="no_tokens_found";var Xs="refresh_token_expired",Js="ux_not_allowed",Zs="interaction_required",ea="consent_required",ta="login_required",Vr="bad_token",ra="interrupted_user";var na=[Zs,ea,ta,Vr,Js,ra],pl=["message_only","additional_action","basic_action","user_password_expired","consent_required","bad_token","ux_not_allowed","interrupted_user"],ne=class r extends T{constructor(e,t,n,o,i,s,a,d){super(e,t,n),Object.setPrototypeOf(this,r.prototype),this.timestamp=o||"",this.traceId=i||"",this.correlationId=s||"",this.claims=a||"",this.name="InteractionRequiredAuthError",this.errorNo=d}};function $r(r,e,t){let n=!!r&&na.indexOf(r)>-1,o=!!t&&pl.indexOf(t)>-1,i=!!e&&na.some(s=>e.indexOf(s)>-1);return n||i||o}function jr(r,e){return new ne(r,e)}var m={};J(m,{addApplicationTelemetry:()=>nr,addAuthorizationCode:()=>Yi,addBrokerParameters:()=>Se,addCcsOid:()=>_e,addCcsUpn:()=>Me,addClaims:()=>et,addCliData:()=>Qi,addClientAssertion:()=>sr,addClientAssertionType:()=>ar,addClientCapabilitiesToClaims:()=>Ea,addClientId:()=>Je,addClientInfo:()=>rt,addClientSecret:()=>ir,addCodeChallengeParams:()=>fh,addCodeVerifier:()=>qi,addCorrelationId:()=>tt,addDeviceCode:()=>mh,addDomainHint:()=>$i,addEARParameters:()=>yh,addExtraParameters:()=>Ie,addGrantType:()=>cr,addIdTokenHint:()=>Vi,addInstanceAware:()=>dr,addLibraryInfo:()=>rr,addLoginHint:()=>St,addLogoutHint:()=>Xi,addNativeBroker:()=>uh,addNonce:()=>zi,addOboAssertion:()=>ph,addPassword:()=>Th,addPopToken:()=>lr,addPostLogoutRedirectUri:()=>Gi,addPrompt:()=>ji,addRedirectUri:()=>Ze,addRefreshToken:()=>Wi,addRequestTokenUse:()=>gh,addResource:()=>mr,addResponseMode:()=>Ki,addResponseType:()=>hh,addScopes:()=>Xe,addServerTelemetry:()=>ur,addSid:()=>pn,addSshJwk:()=>hr,addState:()=>or,addThrottling:()=>fr,addUsername:()=>Eh,instrumentBrokerParams:()=>Qe});var f={};J(f,{AADAuthority:()=>de,AAD_INSTANCE_DISCOVERY_ENDPT:()=>oo,AAD_TENANT_DOMAIN_SUFFIX:()=>$e,ADFS:()=>ro,APP_METADATA:()=>yt,AUTHORITY_METADATA_CACHE_KEY:()=>At,AUTHORITY_METADATA_REFRESH_TIME_SECONDS:()=>Co,AUTHORIZATION_PENDING:()=>yl,AZURE_REGION_AUTO_DISCOVER_FLAG:()=>co,AuthenticationScheme:()=>k,AuthorityMetadataSource:()=>F,CACHE_ACCOUNT_TYPE_ADFS:()=>yo,CACHE_ACCOUNT_TYPE_GENERIC:()=>Jr,CACHE_ACCOUNT_TYPE_MSAV1:()=>Hl,CACHE_ACCOUNT_TYPE_MSSTS:()=>To,CACHE_KEY_SEPARATOR:()=>ze,CIAM_AUTH_URL:()=>jt,CLIENT_INFO:()=>Ao,CLIENT_INFO_SEPARATOR:()=>Tt,CLIENT_MISMATCH_ERROR:()=>bo,CODE_GRANT_TYPE:()=>El,CONSUMER_UTID:()=>gl,CacheOutcome:()=>le,CacheType:()=>Fl,ClaimsRequestKeys:()=>Et,CodeChallengeMethodValues:()=>xl,CredentialType:()=>U,DEFAULT_AUTHORITY:()=>oa,DEFAULT_AUTHORITY_HOST:()=>to,DEFAULT_COMMON_TENANT:()=>$t,DEFAULT_MAX_THROTTLE_TIME_SECONDS:()=>ko,DEFAULT_THROTTLE_TIME_SECONDS:()=>wo,DEFAULT_TOKEN_RENEWAL_OFFSET_SEC:()=>Mo,DSTS:()=>no,EMAIL_SCOPE:()=>aa,EncodingTypes:()=>Vl,FORWARD_SLASH:()=>pt,GrantType:()=>Wt,HTTP_BAD_REQUEST:()=>Qr,HTTP_CLIENT_ERROR:()=>Sl,HTTP_CLIENT_ERROR_RANGE_END:()=>mo,HTTP_CLIENT_ERROR_RANGE_START:()=>fo,HTTP_GATEWAY_TIMEOUT:()=>Ml,HTTP_GONE:()=>kl,HTTP_MULTI_SIDED_ERROR:()=>Pl,HTTP_NOT_FOUND:()=>Ol,HTTP_REDIRECT:()=>Il,HTTP_REQUEST_TIMEOUT:()=>wl,HTTP_SERVER_ERROR:()=>vl,HTTP_SERVER_ERROR_RANGE_END:()=>go,HTTP_SERVER_ERROR_RANGE_START:()=>po,HTTP_SERVICE_UNAVAILABLE:()=>bl,HTTP_SUCCESS:()=>qr,HTTP_SUCCESS_RANGE_END:()=>_l,HTTP_SUCCESS_RANGE_START:()=>Cl,HTTP_TOO_MANY_REQUESTS:()=>Nl,HTTP_UNAUTHORIZED:()=>Rl,HeaderNames:()=>b,HttpMethod:()=>Dl,IMDS_ENDPOINT:()=>Wr,IMDS_TIMEOUT:()=>ao,IMDS_VERSION:()=>so,INVALID_GRANT_ERROR:()=>vo,INVALID_INSTANCE:()=>uo,JsonWebTokenTypes:()=>Kl,KNOWN_PUBLIC_CLOUDS:()=>ho,NOT_APPLICABLE:()=>zt,NOT_AVAILABLE:()=>je,OAuthResponseType:()=>Ll,OFFLINE_ACCESS_SCOPE:()=>Yr,OIDC_DEFAULT_SCOPES:()=>gt,OIDC_SCOPES:()=>Xr,ONE_DAY_IN_MS:()=>Gl,OPENID_SCOPE:()=>ia,PROFILE_SCOPE:()=>sa,PasswordGrantConstants:()=>tn,PersistentCacheKeys:()=>Ul,PromptValue:()=>Yt,REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX:()=>lo,RESOURCE_DELIM:()=>zr,RegionDiscoveryOutcomes:()=>Xt,RegionDiscoverySources:()=>be,ResponseMode:()=>Eo,S256_CODE_CHALLENGE_METHOD:()=>Tl,SERVER_TELEM_CACHE_KEY:()=>qt,SERVER_TELEM_CATEGORY_SEPARATOR:()=>en,SERVER_TELEM_MAX_CACHED_ERRORS:()=>Io,SERVER_TELEM_MAX_CUR_HEADER_BYTES:()=>Bl,SERVER_TELEM_MAX_LAST_HEADER_BYTES:()=>_o,SERVER_TELEM_OVERFLOW_FALSE:()=>Ro,SERVER_TELEM_OVERFLOW_TRUE:()=>So,SERVER_TELEM_SCHEMA_VERSION:()=>Zr,SERVER_TELEM_UNKNOWN_ERROR:()=>Oo,SERVER_TELEM_VALUE_SEPARATOR:()=>ve,SHR_NONCE_VALIDITY:()=>Al,SKU:()=>eo,THE_FAMILY_ID:()=>Ye,THROTTLING_PREFIX:()=>Qt,URL_FORM_CONTENT_TYPE:()=>io,X_MS_LIB_CAPABILITY_VALUE:()=>No});var eo="msal.js.common",oa="https://login.microsoftonline.com/common/",to="login.microsoftonline.com",$t="common",ro="adfs",no="dstsv2",oo=`${oa}discovery/instance?api-version=1.1&authorization_endpoint=`,jt=".ciamlogin.com",$e=".onmicrosoft.com",zr="|",gl="9188040d-6c67-4c5b-b112-36a304b66dad",ia="openid",sa="profile",Yr="offline_access",aa="email",El="authorization_code",Tl="S256",io="application/x-www-form-urlencoded;charset=utf-8",yl="authorization_pending",zt="N/A",je="Not Available",pt="/",Wr="http://169.254.169.254/metadata/instance/compute/location",so="2020-06-01",ao=2e3,co="TryAutoDetect",lo="login.microsoft.com",ho=["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"],Al=240,uo="invalid_instance",qr=200,Cl=200,_l=299,Il=302,Sl=400,fo=400,Qr=400,Rl=401,Ol=404,wl=408,kl=410,Nl=429,mo=499,vl=500,po=500,bl=503,Ml=504,go=599,Pl=600,Dl={GET:"GET",POST:"POST"},gt=[ia,sa,Yr],Xr=[...gt,aa],b={CONTENT_TYPE:"Content-Type",CONTENT_LENGTH:"Content-Length",RETRY_AFTER:"Retry-After",CCS_HEADER:"X-AnchorMailbox",WWWAuthenticate:"WWW-Authenticate",AuthenticationInfo:"Authentication-Info",X_MS_REQUEST_ID:"x-ms-request-id",X_MS_HTTP_VERSION:"x-ms-httpver"},Ul={ACTIVE_ACCOUNT_FILTERS:"active-account-filters"},de={COMMON:"common",ORGANIZATIONS:"organizations",CONSUMERS:"consumers"},Et={ACCESS_TOKEN:"access_token",XMS_CC:"xms_cc"},Yt={LOGIN:"login",SELECT_ACCOUNT:"select_account",CONSENT:"consent",NONE:"none",CREATE:"create",NO_SESSION:"no_session"},xl={PLAIN:"plain",S256:"S256"},Ll={CODE:"code",IDTOKEN_TOKEN:"id_token token",IDTOKEN_TOKEN_REFRESHTOKEN:"id_token token refresh_token"},Eo={QUERY:"query",FRAGMENT:"fragment",FORM_POST:"form_post"},Wt={IMPLICIT_GRANT:"implicit",AUTHORIZATION_CODE_GRANT:"authorization_code",CLIENT_CREDENTIALS_GRANT:"client_credentials",RESOURCE_OWNER_PASSWORD_GRANT:"password",REFRESH_TOKEN_GRANT:"refresh_token",DEVICE_CODE_GRANT:"device_code",JWT_BEARER:"urn:ietf:params:oauth:grant-type:jwt-bearer"},To="MSSTS",yo="ADFS",Hl="MSA",Jr="Generic",ze="-",Tt=".",U={ID_TOKEN:"IdToken",ACCESS_TOKEN:"AccessToken",ACCESS_TOKEN_WITH_AUTH_SCHEME:"AccessToken_With_AuthScheme",REFRESH_TOKEN:"RefreshToken"},Fl={ADFS:1001,MSA:1002,MSSTS:1003,GENERIC:1004,ACCESS_TOKEN:2001,REFRESH_TOKEN:2002,ID_TOKEN:2003,APP_METADATA:3001,UNDEFINED:9999},yt="appmetadata",Ao="client_info",Ye="1",At="authority-metadata",Co=3600*24,F={CONFIG:"config",CACHE:"cache",NETWORK:"network",HARDCODED_VALUES:"hardcoded_values"},Zr=5,Bl=80,_o=330,Io=50,qt="server-telemetry",en="|",ve=",",So="1",Ro="0",Oo="unknown_error",k={BEARER:"Bearer",POP:"pop",SSH:"ssh-cert"},wo=60,ko=3600,Qt="throttling",No="retry-after, h429",vo="invalid_grant",bo="client_mismatch",tn={username:"username",password:"password"},be={FAILED_AUTO_DETECTION:"1",INTERNAL_CACHE:"2",ENVIRONMENT_VARIABLE:"3",IMDS:"4"},Xt={CONFIGURED_MATCHES_DETECTED:"1",CONFIGURED_NO_AUTO_DETECTION:"2",CONFIGURED_NOT_DETECTED:"3",AUTO_DETECTION_REQUESTED_SUCCESSFUL:"4",AUTO_DETECTION_REQUESTED_FAILED:"5"},le={NOT_APPLICABLE:"0",FORCE_REFRESH_OR_CLAIMS:"1",NO_CACHED_ACCESS_TOKEN:"2",CACHED_ACCESS_TOKEN_EXPIRED:"3",PROACTIVELY_REFRESHED:"4"},Kl={Jwt:"JWT",Jwk:"JWK",Pop:"pop"},Gl=864e5,Mo=300,Vl={BASE64:"base64",HEX:"hex",UTF8:"utf-8"};var Ee={};J(Ee,{ACCESS_TOKEN:()=>zl,BROKER_CLIENT_ID:()=>Ct,BROKER_REDIRECT_URI:()=>an,CCS_HEADER:()=>eh,CLAIMS:()=>xo,CLIENT_ASSERTION:()=>si,CLIENT_ASSERTION_TYPE:()=>ai,CLIENT_ID:()=>ge,CLIENT_INFO:()=>Xl,CLIENT_REQUEST_ID:()=>zo,CLIENT_SECRET:()=>ii,CLI_DATA:()=>Ti,CODE:()=>Go,CODE_CHALLENGE:()=>Vo,CODE_CHALLENGE_METHOD:()=>$o,CODE_VERIFIER:()=>jo,DEVICE_CODE:()=>oi,DOMAIN_HINT:()=>mi,EAR_JWE_CRYPTO:()=>gi,EAR_JWK:()=>pi,ERROR:()=>$l,ERROR_DESCRIPTION:()=>jl,EXPIRES_IN:()=>Wl,FOCI:()=>Zl,GRANT_TYPE:()=>Uo,ID_TOKEN:()=>Yl,ID_TOKEN_HINT:()=>ni,INSTANCE_AWARE:()=>_t,LOGIN_HINT:()=>fi,LOGOUT_HINT:()=>hi,NATIVE_BROKER:()=>li,NONCE:()=>Bo,OBO_ASSERTION:()=>ci,ON_BEHALF_OF:()=>Jl,POST_LOGOUT_URI:()=>ri,PROMPT:()=>Ko,REDIRECT_URI:()=>rn,REFRESH_TOKEN:()=>Ho,REFRESH_TOKEN_EXPIRES_IN:()=>ql,REQUESTED_TOKEN_USE:()=>di,REQ_CNF:()=>on,RESOURCE:()=>Ei,RESPONSE_MODE:()=>Do,RESPONSE_TYPE:()=>Po,RETURN_SPA_CODE:()=>sn,SCOPE:()=>Lo,SESSION_STATE:()=>Ql,SID:()=>ui,STATE:()=>Fo,TOKEN_TYPE:()=>nn,X_APP_NAME:()=>ei,X_APP_VER:()=>ti,X_CLIENT_CPU:()=>Qo,X_CLIENT_CURR_TELEM:()=>Xo,X_CLIENT_EXTRA_SKU:()=>th,X_CLIENT_LAST_TELEM:()=>Jo,X_CLIENT_OS:()=>qo,X_CLIENT_SKU:()=>Yo,X_CLIENT_VER:()=>Wo,X_MS_LIB_CAPABILITY:()=>Zo});var ge="client_id",rn="redirect_uri",Po="response_type",Do="response_mode",Uo="grant_type",xo="claims",Lo="scope",$l="error",jl="error_description",zl="access_token",Yl="id_token",Ho="refresh_token",Wl="expires_in",ql="refresh_token_expires_in",Fo="state",Bo="nonce",Ko="prompt",Ql="session_state",Xl="client_info",Go="code",Vo="code_challenge",$o="code_challenge_method",jo="code_verifier",zo="client-request-id",Yo="x-client-SKU",Wo="x-client-VER",qo="x-client-OS",Qo="x-client-CPU",Xo="x-client-current-telemetry",Jo="x-client-last-telemetry",Zo="x-ms-lib-capability",ei="x-app-name",ti="x-app-ver",ri="post_logout_redirect_uri",ni="id_token_hint",oi="device_code",ii="client_secret",si="client_assertion",ai="client_assertion_type",nn="token_type",on="req_cnf",ci="assertion",di="requested_token_use",Jl="on_behalf_of",Zl="foci",eh="X-AnchorMailbox",sn="return_spa_code",li="nativebroker",hi="logout_hint",ui="sid",fi="login_hint",mi="domain_hint",th="x-client-xtra-sku",Ct="brk_client_id",an="brk_redirect_uri",_t="instance_aware",pi="ear_jwk",gi="ear_jwe_crypto",Ei="resource",Ti="clidata";var cn=class r extends T{constructor(e){super(e),this.name="ClientConfigurationError",Object.setPrototypeOf(this,r.prototype)}};function S(r){return new cn(r)}var w=class{static isEmptyObj(e){if(e)try{let t=JSON.parse(e);return Object.keys(t).length===0}catch{}return!0}static startsWith(e,t){return e.indexOf(t)===0}static endsWith(e,t){return e.length>=t.length&&e.lastIndexOf(t)===e.length-t.length}static queryStringToObject(e){let t={},n=e.split("&"),o=i=>decodeURIComponent(i.replace(/\+/g," "));return n.forEach(i=>{if(i.trim()){let[s,a]=i.split(/=(.+)/g,2);s&&a&&(t[o(s)]=o(a))}}),t}static trimArrayEntries(e){return e.map(t=>t.trim())}static removeEmptyStringsFromArray(e){return e.filter(t=>!!t)}static jsonParseHelper(e){try{return JSON.parse(e)}catch{return null}}};var We=class r extends T{constructor(e,t){super(e,t),this.name="ClientAuthError",Object.setPrototypeOf(this,r.prototype)}};function l(r,e){return new We(r,e)}var ca="redirect_uri_empty";var da="authority_uri_insecure",Jt="url_parse_error",la="empty_url_error",ha="empty_input_scopes_error",yi="invalid_claims",ua="token_request_empty",fa="logout_request_empty";var ma="pkce_params_missing",Ai="invalid_cloud_discovery_metadata",pa="invalid_authority_metadata",ga="untrusted_authority",dn="missing_ssh_jwk";var ln="issuer_validation_failed";var x={};J(x,{authTimeNotFound:()=>Zt,authorizationCodeMissingFromServerResponse:()=>xi,bindingKeyNotRemoved:()=>sh,cannotAppendScopeSet:()=>Mi,cannotRemoveEmptyScope:()=>bi,clientInfoDecodingError:()=>hn,clientInfoEmptyError:()=>Ci,emptyInputScopeSet:()=>mn,endSessionEndpointNotSupported:()=>Li,endpointResolutionError:()=>he,hashNotDeserialized:()=>Ri,invalidCacheEnvironment:()=>tr,invalidCacheRecord:()=>Pi,invalidState:()=>qe,keyIdMissing:()=>Hi,maxAgeTranspired:()=>ki,methodNotImplemented:()=>y,misplacedResourceParam:()=>Bi,multipleMatchingAppMetadata:()=>Ni,multipleMatchingTokens:()=>nh,nestedAppAuthBridgeDisabled:()=>dh,networkError:()=>Ii,noAccountFound:()=>oh,noAccountInSilentRequest:()=>er,noCryptoObject:()=>Di,noNetworkConnectivity:()=>ah,nonceMismatch:()=>wi,nullOrEmptyToken:()=>_i,openIdConfigError:()=>Si,platformBrokerError:()=>lh,requestCannotBeMade:()=>vi,resourceParameterRequired:()=>Fi,stateMismatch:()=>Oi,stateNotFound:()=>fn,tokenClaimsCnfRequiredForSignedJwt:()=>Ui,tokenParsingError:()=>un,tokenRefreshRequired:()=>It,unexpectedCredentialType:()=>ih,userCanceled:()=>ch});var hn="client_info_decoding_error",Ci="client_info_empty_error",un="token_parsing_error",_i="null_or_empty_token",he="endpoints_resolution_error",Ii="network_error",Si="openid_config_error",Ri="hash_not_deserialized",qe="invalid_state",Oi="state_mismatch",fn="state_not_found",wi="nonce_mismatch",Zt="auth_time_not_found",ki="max_age_transpired",nh="multiple_matching_tokens",Ni="multiple_matching_appMetadata",vi="request_cannot_be_made",bi="cannot_remove_empty_scope",Mi="cannot_append_scopeset",mn="empty_input_scopeset",er="no_account_in_silent_request",Pi="invalid_cache_record",tr="invalid_cache_environment",oh="no_account_found",Di="no_crypto_object",ih="unexpected_credential_type",It="token_refresh_required",Ui="token_claims_cnf_required_for_signedjwt",xi="authorization_code_missing_from_server_response",sh="binding_key_not_removed",Li="end_session_endpoint_not_supported",Hi="key_id_missing",ah="no_network_connectivity",ch="user_canceled",y="method_not_implemented",dh="nested_app_auth_bridge_disabled",lh="platform_broker_error",Fi="resource_parameter_required",Bi="misplaced_resource_parameter";var P=class r{constructor(e){let t=e?w.trimArrayEntries([...e]):[],n=t?w.removeEmptyStringsFromArray(t):[];if(!n||!n.length)throw S(ha);this.scopes=new Set,n.forEach(o=>this.scopes.add(o))}static fromString(e){let n=(e||"").split(" ");return new r(n)}static createSearchScopes(e){let t=e&&e.length>0?e:[...gt],n=new r(t);return n.containsOnlyOIDCScopes()?n.removeScope(Yr):n.removeOIDCScopes(),n}containsScope(e){let t=this.printScopesLowerCase().split(" "),n=new r(t);return e?n.scopes.has(e.toLowerCase()):!1}containsScopeSet(e){return!e||e.scopes.size<=0?!1:this.scopes.size>=e.scopes.size&&e.asArray().every(t=>this.containsScope(t))}containsOnlyOIDCScopes(){let e=0;return Xr.forEach(t=>{this.containsScope(t)&&(e+=1)}),this.scopes.size===e}appendScope(e){e&&this.scopes.add(e.trim())}appendScopes(e){try{e.forEach(t=>this.appendScope(t))}catch{throw l(Mi)}}removeScope(e){if(!e)throw l(bi);this.scopes.delete(e.trim())}removeOIDCScopes(){Xr.forEach(e=>{this.scopes.delete(e)})}unionScopeSets(e){if(!e)throw l(mn);let t=new Set;return e.scopes.forEach(n=>t.add(n.toLowerCase())),this.scopes.forEach(n=>t.add(n.toLowerCase())),t}intersectingScopeSets(e){if(!e)throw l(mn);e.containsOnlyOIDCScopes()||e.removeOIDCScopes();let t=this.unionScopeSets(e),n=e.getScopeCount(),o=this.getScopeCount();return t.size<o+n}getScopeCount(){return this.scopes.size}asArray(){let e=[];return this.scopes.forEach(t=>e.push(t)),e}printScopes(){return this.scopes?this.asArray().join(" "):""}printScopesLowerCase(){return this.printScopes().toLowerCase()}};function Qe(r,e,t){if(!e)return;let n=r.get(ge);n&&r.has(Ct)&&t?.addFields({embeddedClientId:n,embeddedRedirectUri:r.get(rn)},e)}function hh(r,e){r.set(Po,e)}function Ki(r,e){r.set(Do,e||Eo.QUERY)}function uh(r){r.set(li,"1")}function Xe(r,e,t=!0,n=gt){t&&!n.includes("openid")&&!e.includes("openid")&&n.push("openid");let o=t?[...e||[],...n]:e||[],i=new P(o);r.set(Lo,i.printScopes())}function Je(r,e){r.set(ge,e)}function Ze(r,e){r.set(rn,e)}function Gi(r,e){r.set(ri,e)}function Vi(r,e){r.set(ni,e)}function $i(r,e){r.set(mi,e)}function St(r,e){r.set(fi,e)}function Me(r,e){r.set(b.CCS_HEADER,`UPN:${e}`)}function _e(r,e){r.set(b.CCS_HEADER,`Oid:${e.uid}@${e.utid}`)}function pn(r,e){r.set("sid",e)}function et(r,e,t,n){let o=n&&r.has(Ct)?void 0:t;if(!w.isEmptyObj(e)||o&&o.length>0){let i=Ea(e,o);try{JSON.parse(i)}catch{throw S(yi)}r.set(xo,i)}}function tt(r,e){r.set(zo,e)}function rr(r,e){r.set(Yo,e.sku),r.set(Wo,e.version),e.os&&r.set(qo,e.os),e.cpu&&r.set(Qo,e.cpu)}function nr(r,e){e?.appName&&r.set(ei,e.appName),e?.appVersion&&r.set(ti,e.appVersion)}function ji(r,e){r.set(Ko,e)}function or(r,e){e&&r.set(Fo,e)}function zi(r,e){r.set(Bo,e)}function fh(r,e,t){if(e&&t)r.set(Vo,e),r.set($o,t);else throw S(ma)}function Yi(r,e){r.set(Go,e)}function mh(r,e){r.set(oi,e)}function Wi(r,e){r.set(Ho,e)}function qi(r,e){r.set(jo,e)}function ir(r,e){r.set(ii,e)}function sr(r,e){e&&r.set(si,e)}function ar(r,e){e&&r.set(ai,e)}function ph(r,e){r.set(ci,e)}function gh(r,e){r.set(di,e)}function cr(r,e){r.set(Uo,e)}function rt(r){r.set(Ao,"1")}function Qi(r){r.set(Ti,"1")}function dr(r){r.has(_t)||r.set(_t,"true")}function Ie(r,e){Object.entries(e).forEach(([t,n])=>{!r.has(t)&&n&&r.set(t,n)})}function Ea(r,e){let t;if(!r)t={};else try{t=JSON.parse(r)}catch{throw S(yi)}return e&&e.length>0&&(t.hasOwnProperty(Et.ACCESS_TOKEN)||(t[Et.ACCESS_TOKEN]={}),t[Et.ACCESS_TOKEN][Et.XMS_CC]={values:e}),JSON.stringify(t)}function Eh(r,e){r.set(tn.username,e)}function Th(r,e){r.set(tn.password,e)}function lr(r,e){e&&(r.set(nn,k.POP),r.set(on,e))}function hr(r,e){e&&(r.set(nn,k.SSH),r.set(on,e))}function ur(r,e){r.set(Xo,e.generateCurrentRequestHeaderValue()),r.set(Jo,e.generateLastRequestHeaderValue())}function fr(r){r.set(Zo,No)}function Xi(r,e){r.set(hi,e)}function Se(r,e,t){r.has(Ct)||r.set(Ct,e),r.has(an)||r.set(an,t)}function yh(r,e){r.set(pi,encodeURIComponent(e)),r.set(gi,"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0")}function mr(r,e){e&&r.set(Ei,e)}var q={};J(q,{getDeserializedResponse:()=>Ah,mapToQueryString:()=>Te,normalizeUrlForComparison:()=>Ch,stripLeadingHashOrQuery:()=>ya});function Ta(r){if(!r)return r;let e=r.toLowerCase();return w.endsWith(e,"?")?e=e.slice(0,-1):w.endsWith(e,"?/")&&(e=e.slice(0,-2)),w.endsWith(e,"/")||(e+="/"),e}function ya(r){return r.startsWith("#/")?r.substring(2):r.startsWith("#")||r.startsWith("?")?r.substring(1):r}function Ah(r){if(!r||r.indexOf("=")<0)return null;try{let e=ya(r),t=Object.fromEntries(new URLSearchParams(e));if(t.code||t.ear_jwe||t.error||t.error_description||t.state)return t}catch{throw l(Ri)}return null}function Te(r){let e=new Array;return r.forEach((t,n)=>{e.push(`${n}=${encodeURIComponent(t)}`)}),e.join("&")}function Ch(r){if(!r)return r;let e=r.split("#")[0];try{let t=new URL(e),n=t.origin+t.pathname+t.search;return Ta(n)}catch{return Ta(e)}}var Ji={createNewGuid:()=>{throw l(y)},base64Decode:()=>{throw l(y)},base64Encode:()=>{throw l(y)},base64UrlEncode:()=>{throw l(y)},encodeKid:()=>{throw l(y)},async getPublicKeyThumbprint(){throw l(y)},async removeTokenBindingKey(){throw l(y)},async clearKeystore(){throw l(y)},async signJwt(){throw l(y)},async hashString(){throw l(y)}};var v;(function(r){r[r.Error=0]="Error",r[r.Warning=1]="Warning",r[r.Info=2]="Info",r[r.Verbose=3]="Verbose",r[r.Trace=4]="Trace"})(v||(v={}));var _h=50,Ih=500,nt=new Map;function Sh(r,e){nt.delete(r),nt.set(r,e)}function Rh(r,e){let t=Date.now(),n=nt.get(r);if(n)Sh(r,n);else if(n={logs:[],firstEventTime:t},nt.set(r,n),nt.size>_h){let o=nt.keys().next().value;o&&nt.delete(o)}n.logs.push({...e,milliseconds:t-n.firstEventTime}),n.logs.length>Ih&&n.logs.shift()}function Oh(r){if(r.length!==6)return!1;for(let e=0;e<r.length;e++){let t=r[e];if(!(t>="a"&&t<="z"||t>="A"&&t<="Z"||t>="0"&&t<="9"))return!1}return!0}var B=class r{constructor(e,t,n){this.level=v.Info;let o=()=>{},i=e||r.createDefaultLoggerOptions();this.localCallback=i.loggerCallback||o,this.piiLoggingEnabled=i.piiLoggingEnabled||!1,this.level=typeof i.logLevel=="number"?i.logLevel:v.Info,this.packageName=t||"",this.packageVersion=n||""}static createDefaultLoggerOptions(){return{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:v.Info}}clone(e,t){return new r({loggerCallback:this.localCallback,piiLoggingEnabled:this.piiLoggingEnabled,logLevel:this.level},e,t)}logMessage(e,t){let n=t.correlationId;if(Oh(e)){let d={hash:e,level:t.logLevel,containsPii:t.containsPii||!1,milliseconds:0};Rh(n,d)}if(t.logLevel>this.level||!this.piiLoggingEnabled&&t.containsPii)return;let a=`${`[${new Date().toUTCString()}] : [${n}]`} : ${this.packageName}@${this.packageVersion} : ${v[t.logLevel]} - ${e}`;this.executeCallback(t.logLevel,a,t.containsPii||!1)}executeCallback(e,t,n){this.localCallback&&this.localCallback(e,t,n)}error(e,t){this.logMessage(e,{logLevel:v.Error,containsPii:!1,correlationId:t})}errorPii(e,t){this.logMessage(e,{logLevel:v.Error,containsPii:!0,correlationId:t})}warning(e,t){this.logMessage(e,{logLevel:v.Warning,containsPii:!1,correlationId:t})}warningPii(e,t){this.logMessage(e,{logLevel:v.Warning,containsPii:!0,correlationId:t})}info(e,t){this.logMessage(e,{logLevel:v.Info,containsPii:!1,correlationId:t})}infoPii(e,t){this.logMessage(e,{logLevel:v.Info,containsPii:!0,correlationId:t})}verbose(e,t){this.logMessage(e,{logLevel:v.Verbose,containsPii:!1,correlationId:t})}verbosePii(e,t){this.logMessage(e,{logLevel:v.Verbose,containsPii:!0,correlationId:t})}trace(e,t){this.logMessage(e,{logLevel:v.Trace,containsPii:!1,correlationId:t})}tracePii(e,t){this.logMessage(e,{logLevel:v.Trace,containsPii:!0,correlationId:t})}isPiiLoggingEnabled(){return this.piiLoggingEnabled||!1}};var Pe="@azure/msal-common",ye="16.6.2";var De={None:"none",AzurePublic:"https://login.microsoftonline.com",AzurePpe:"https://login.windows-ppe.net",AzureChina:"https://login.chinacloudapi.cn",AzureGermany:"https://login.microsoftonline.de",AzureUsGovernment:"https://login.microsoftonline.us"};function Aa(r,e){return!!r&&!!e&&r===e.split(".")[1]}function ot(r,e,t,n){if(n){let{oid:o,sub:i,tid:s,name:a,tfp:d,acr:c,preferred_username:u,upn:h,login_hint:g}=n,p=s||d||c||"";return{tenantId:p,localAccountId:o||i||"",name:a,username:u||h||"",loginHint:g,isHomeTenant:Aa(p,r),upn:h}}else return{tenantId:t,localAccountId:e,username:"",isHomeTenant:Aa(t,r)}}function gn(r,e,t,n){let o=r;if(e){let{isHomeTenant:i,...s}=e;o={...r,...s}}if(t){let{isHomeTenant:i,...s}=ot(r.homeAccountId,r.localAccountId,r.tenantId,t);return o={...o,...s,idTokenClaims:t,idToken:n},o}return o}var En={};J(En,{checkMaxAge:()=>pr,extractTokenClaims:()=>Re,getJWSPayload:()=>Ca,isKmsi:()=>Zi});function Re(r,e){let t=Ca(r);try{let n=e(t);return JSON.parse(n)}catch{throw l(un)}}function Zi(r){if(!r.signin_state)return!1;let e=["kmsi","dvc_dmjd"];return r.signin_state.some(t=>e.includes(t.trim().toLowerCase()))}function Ca(r){if(!r)throw l(_i);let t=/^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/.exec(r);if(!t||t.length<4)throw l(un);return t[2]}function pr(r,e){if(e===0||Date.now()-3e5>r+e)throw l(ki)}var A=class r{get urlString(){return this._urlString}constructor(e){if(this._urlString=e,!this._urlString)throw S(la);e.includes("#")||(this._urlString=r.canonicalizeUri(e))}static canonicalizeUri(e){if(e){let t=e.toLowerCase();return w.endsWith(t,"?")?t=t.slice(0,-1):w.endsWith(t,"?/")&&(t=t.slice(0,-2)),w.endsWith(t,"/")||(t+="/"),t}return e}validateAsUri(){let e;try{e=this.getUrlComponents()}catch{throw S(Jt)}if(!e.HostNameAndPort||!e.PathSegments)throw S(Jt);if(!e.Protocol||e.Protocol.toLowerCase()!=="https:")throw S(da)}static appendQueryString(e,t){return t?e.indexOf("?")<0?`${e}?${t}`:`${e}&${t}`:e}static removeHashFromUrl(e){return r.canonicalizeUri(e.split("#")[0])}replaceTenantPath(e){let t=this.getUrlComponents(),n=t.PathSegments;return e&&n.length!==0&&(n[0]===de.COMMON||n[0]===de.ORGANIZATIONS)&&(n[0]=e),r.constructAuthorityUriFromObject(t)}getUrlComponents(){let e=RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?"),t=this.urlString.match(e);if(!t)throw S(Jt);let n={Protocol:t[1],HostNameAndPort:t[4],AbsolutePath:t[5],QueryString:t[7]},o=n.AbsolutePath.split("/");return o=o.filter(i=>i&&i.length>0),n.PathSegments=o,n.QueryString&&n.QueryString.endsWith("/")&&(n.QueryString=n.QueryString.substring(0,n.QueryString.length-1)),n}static getDomainFromUrl(e){let t=RegExp("^([^:/?#]+://)?([^/?#]*)"),n=e.match(t);if(!n)throw S(Jt);return n[2]}static getAbsoluteUrl(e,t){if(e[0]===pt){let o=new r(t).getUrlComponents();return o.Protocol+"//"+o.HostNameAndPort+e}return e}static constructAuthorityUriFromObject(e){return new r(e.Protocol+"//"+e.HostNameAndPort+"/"+e.PathSegments.join("/"))}};var wh=[{host:"login.microsoftonline.com"},{host:"login.chinacloudapi.cn",issuerHost:"login.partner.microsoftonline.cn"},{host:"login.microsoftonline.us"},{host:"login.sovcloud-identity.fr"},{host:"login.sovcloud-identity.de"},{host:"login.sovcloud-identity.sg"}];function kh(r,e){return{token_endpoint:`https://${r}/{tenantid}/oauth2/v2.0/token`,jwks_uri:`https://${r}/{tenantid}/discovery/v2.0/keys`,issuer:`https://${e}/{tenantid}/v2.0`,authorization_endpoint:`https://${r}/{tenantid}/oauth2/v2.0/authorize`,end_session_endpoint:`https://${r}/{tenantid}/oauth2/v2.0/logout`}}var Nh=wh.reduce((r,{host:e,issuerHost:t})=>(r[e]=kh(e,t||e),r),{}),Ia={endpointMetadata:Nh,instanceDiscoveryMetadata:{metadata:[{preferred_network:"login.microsoftonline.com",preferred_cache:"login.windows.net",aliases:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{preferred_network:"login.partner.microsoftonline.cn",preferred_cache:"login.partner.microsoftonline.cn",aliases:["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{preferred_network:"login.microsoftonline.de",preferred_cache:"login.microsoftonline.de",aliases:["login.microsoftonline.de"]},{preferred_network:"login.microsoftonline.us",preferred_cache:"login.microsoftonline.us",aliases:["login.microsoftonline.us","login.usgovcloudapi.net"]},{preferred_network:"login-us.microsoftonline.com",preferred_cache:"login-us.microsoftonline.com",aliases:["login-us.microsoftonline.com"]},{preferred_network:"login.sovcloud-identity.fr",preferred_cache:"login.sovcloud-identity.fr",aliases:["login.sovcloud-identity.fr"]},{preferred_network:"login.sovcloud-identity.de",preferred_cache:"login.sovcloud-identity.de",aliases:["login.sovcloud-identity.de"]},{preferred_network:"login.sovcloud-identity.sg",preferred_cache:"login.sovcloud-identity.sg",aliases:["login.sovcloud-identity.sg"]},{preferred_network:"login.windows-ppe.net",preferred_cache:"login.windows-ppe.net",aliases:["login.windows-ppe.net","sts.windows-ppe.net","login.microsoft-ppe.com"]}]}},es=Ia.endpointMetadata,ts=Ia.instanceDiscoveryMetadata,rs=new Set;ts.metadata.forEach(r=>{r.aliases.forEach(e=>{rs.add(e)})});function Sa(r,e,t){let n,o=r.canonicalAuthority;if(o){let i=new A(o).getUrlComponents().HostNameAndPort;n=_a(e,t,i,r.cloudDiscoveryMetadata?.metadata,F.CONFIG)||_a(e,t,i,ts.metadata,F.HARDCODED_VALUES)||r.knownAuthorities}return n||[]}function _a(r,e,t,n,o){if(r.trace(`getAliasesFromMetadata called with source: '${o}'`,e),t&&n){let i=gr(n,t);if(i)return r.trace(`getAliasesFromMetadata: found cloud discovery metadata in '${o}', returning aliases`,e),i.aliases;r.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in '${o}'`,e)}return null}function Ra(r){return gr(ts.metadata,r)}function gr(r,e){for(let t=0;t<r.length;t++){let n=r[t];if(n.aliases.includes(e))return n}return null}var Oa="cache_quota_exceeded",wa="cache_error_unknown";var Er=class r extends Error{constructor(e,t){let n=t||Gr(e);super(n),Object.setPrototypeOf(this,r.prototype),this.name="CacheError",this.errorCode=e,this.errorMessage=n}};function ka(r){return r instanceof Error?r.name==="QuotaExceededError"||r.name==="NS_ERROR_DOM_QUOTA_REACHED"||r.message.includes("exceeded the quota")?new Er(Oa):new Er(r.name,r.message):new Er(wa)}var Tr={};J(Tr,{createAccountEntity:()=>ns,createAccountEntityFromAccountInfo:()=>Mh,generateAccountId:()=>vh,generateHomeAccountId:()=>os,getAccountInfo:()=>Ot,isAccountEntity:()=>Ph,isSingleTenant:()=>bh});function Rt(r,e){if(!r)throw l(Ci);try{let t=e(r);return JSON.parse(t)}catch{throw l(hn)}}function Ae(r){if(!r)throw l(hn);let e=r.split(Tt,2);return{uid:e[0],utid:e.length<2?"":e[1]}}var oe={Default:0,Adfs:1,Dsts:2,Ciam:3};function Tn(r){return r&&(r.tid||r.tfp||r.acr)||null}var Z={AAD:"AAD",OIDC:"OIDC",EAR:"EAR"};function vh(r){return[r.homeAccountId,r.environment].join(ze).toLowerCase()}function Ot(r){let e=r.tenantProfiles||[];return e.length===0&&r.realm&&r.localAccountId&&e.push(ot(r.homeAccountId,r.localAccountId,r.realm)),{homeAccountId:r.homeAccountId,environment:r.environment,tenantId:r.realm,username:r.username,localAccountId:r.localAccountId,loginHint:r.loginHint,name:r.name,nativeAccountId:r.nativeAccountId,authorityType:r.authorityType,tenantProfiles:new Map(e.map(t=>[t.tenantId,t])),dataBoundary:r.dataBoundary}}function bh(r){return!r.tenantProfiles}function ns(r,e,t){let n;e.authorityType===oe.Adfs?n=yo:e.protocolMode===Z.OIDC?n=Jr:n=To;let o,i;r.clientInfo&&t&&(o=Rt(r.clientInfo,t),o.xms_tdbr&&(i=o.xms_tdbr==="EU"?"EU":"None"));let s=r.environment||e&&e.getPreferredCache();if(!s)throw l(tr);let a=r.idTokenClaims?.preferred_username||r.idTokenClaims?.upn,d=r.idTokenClaims?.emails?r.idTokenClaims.emails[0]:null,c=a||d||"",u=r.idTokenClaims?.login_hint,h=o?.utid||Tn(r.idTokenClaims)||"",g=o?.uid||r.idTokenClaims?.oid||r.idTokenClaims?.sub||"",p;return r.tenantProfiles?p=r.tenantProfiles:p=[ot(r.homeAccountId,g,h,r.idTokenClaims)],{homeAccountId:r.homeAccountId,environment:s,realm:h,localAccountId:g,username:c,authorityType:n,loginHint:u,clientInfo:r.clientInfo,name:r.idTokenClaims?.name||"",lastModificationTime:void 0,lastModificationApp:void 0,cloudGraphHostName:r.cloudGraphHostName,msGraphHost:r.msGraphHost,nativeAccountId:r.nativeAccountId,tenantProfiles:p,dataBoundary:i}}function Mh(r,e,t){let n=Array.from(r.tenantProfiles?.values()||[]);return n.length===0&&r.tenantId&&r.localAccountId&&n.push(ot(r.homeAccountId,r.localAccountId,r.tenantId,r.idTokenClaims)),{authorityType:r.authorityType||Jr,homeAccountId:r.homeAccountId,localAccountId:r.localAccountId,nativeAccountId:r.nativeAccountId,realm:r.tenantId,environment:r.environment,username:r.username,loginHint:r.loginHint,name:r.name,cloudGraphHostName:e,msGraphHost:t,tenantProfiles:n,dataBoundary:r.dataBoundary}}function os(r,e,t,n,o,i){if(!(e===oe.Adfs||e===oe.Dsts)){if(r)try{let s=Rt(r,n.base64Decode);if(s.uid&&s.utid)return`${s.uid}.${s.utid}`}catch{}t.warning("No client info in response",o)}return i?.sub||""}function Ph(r){return r?r.hasOwnProperty("homeAccountId")&&r.hasOwnProperty("environment")&&r.hasOwnProperty("realm")&&r.hasOwnProperty("localAccountId")&&r.hasOwnProperty("username")&&r.hasOwnProperty("authorityType"):!1}var Ue=class{constructor(e,t,n,o,i){this.clientId=e,this.cryptoImpl=t,this.commonLogger=n.clone(Pe,ye),this.staticAuthorityOptions=i,this.performanceClient=o}getAllAccounts(e={},t){return this.buildTenantProfiles(this.getAccountsFilteredBy(e,t),t,e)}getAccountInfoFilteredBy(e,t){if(Object.keys(e).length===0||Object.values(e).every(o=>o==null||o===""))return this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null",t),null;let n=this.getAllAccounts(e,t);return n.length>1?n.sort((i,s)=>{let a=i.idTokenClaims?1:0;return(s.idTokenClaims?1:0)-a})[0]:n.length===1?n[0]:null}getBaseAccountInfo(e,t){let n=this.getAccountsFilteredBy(e,t);return n.length>0?Ot(n[0]):null}buildTenantProfiles(e,t,n){return e.flatMap(o=>this.getTenantProfilesFromAccountEntity(o,t,n?.tenantId,n))}getTenantedAccountInfoByFilter(e,t,n,o,i){let s=null,a;if(i&&!this.tenantProfileMatchesFilter(n,i))return null;let d=this.getIdToken(e,o,t,n.tenantId);return d&&(a=Re(d.secret,this.cryptoImpl.base64Decode),!this.idTokenClaimsMatchTenantProfileFilter(a,i))?null:(s=gn(e,n,a,d?.secret),s)}getTenantProfilesFromAccountEntity(e,t,n,o){let i=Ot(e),s=i.tenantProfiles||new Map,a=this.getTokenKeys();if(n){let c=s.get(n);if(c)s=new Map([[n,c]]);else return[]}let d=[];return s.forEach(c=>{let u=this.getTenantedAccountInfoByFilter(i,a,c,t,o);u&&d.push(u)}),d}tenantProfileMatchesFilter(e,t){return!(t.localAccountId&&!this.matchLocalAccountIdFromTenantProfile(e,t.localAccountId)||t.name&&e.name!==t.name||t.isHomeTenant!==void 0&&e.isHomeTenant!==t.isHomeTenant||t.username&&!(this.matchUsername(e.username,t.username)||!this.matchUsername(e.upn,t.username))||t.loginHint&&!this.matchLoginHintWithTenantProfile(e,t.loginHint)||t.upn&&e.upn!==t.upn)}idTokenClaimsMatchTenantProfileFilter(e,t){return!(t&&(t.localAccountId&&!this.matchLocalAccountIdFromTokenClaims(e,t.localAccountId)||t.loginHint&&!this.matchLoginHintFromTokenClaims(e,t.loginHint)||t.username&&!this.matchUsername(e.preferred_username,t.username)&&!this.matchUsername(e.upn,t.username)||t.name&&!this.matchName(e,t.name)||t.sid&&!this.matchSid(e,t.sid)))}async saveCacheRecord(e,t,n,o,i){if(!e)throw l(Pi);try{e.account&&await this.setAccount(e.account,t,n,o),e.idToken&&i?.idToken!==!1&&await this.setIdTokenCredential(e.idToken,t,n),e.accessToken&&i?.accessToken!==!1&&await this.saveAccessToken(e.accessToken,t,n),e.refreshToken&&i?.refreshToken!==!1&&await this.setRefreshTokenCredential(e.refreshToken,t,n),e.appMetadata&&this.setAppMetadata(e.appMetadata,t)}catch(s){throw this.commonLogger?.error("CacheManager.saveCacheRecord: failed",t),s instanceof T?s:ka(s)}}async saveAccessToken(e,t,n){let o={clientId:e.clientId,credentialType:e.credentialType,environment:e.environment,homeAccountId:e.homeAccountId,realm:e.realm,tokenType:e.tokenType},i=this.getTokenKeys(),s=P.fromString(e.target);i.accessToken.forEach(a=>{if(!this.accessTokenKeyMatchesFilter(a,o,!1))return;let d=this.getAccessTokenCredential(a,t);d&&this.credentialMatchesFilter(d,o,t)&&P.fromString(d.target).intersectingScopeSets(s)&&this.removeAccessToken(a,t)}),await this.setAccessTokenCredential(e,t,n)}getAccountsFilteredBy(e,t){let n=this.getAccountKeys(),o=[];return n.forEach(i=>{let s=this.getAccount(i,t);if(!s||e.homeAccountId&&!this.matchHomeAccountId(s,e.homeAccountId)||e.environment&&!this.matchEnvironment(s,e.environment,t)||e.realm&&!this.matchRealm(s,e.realm)||e.nativeAccountId&&!this.matchNativeAccountId(s,e.nativeAccountId)||e.authorityType&&!this.matchAuthorityType(s,e.authorityType))return;let a={localAccountId:e?.localAccountId,name:e?.name,username:e?.username,loginHint:e?.loginHint,upn:e?.upn},d=s.tenantProfiles?.filter(c=>this.tenantProfileMatchesFilter(c,a));d&&d.length===0||o.push(s)}),o}credentialMatchesFilter(e,t,n){return!(t.clientId&&!this.matchClientId(e,t.clientId)||t.userAssertionHash&&!this.matchUserAssertionHash(e,t.userAssertionHash)||typeof t.homeAccountId=="string"&&!this.matchHomeAccountId(e,t.homeAccountId)||t.environment&&!this.matchEnvironment(e,t.environment,n)||t.realm&&!this.matchRealm(e,t.realm)||t.credentialType&&!this.matchCredentialType(e,t.credentialType)||t.familyId&&!this.matchFamilyId(e,t.familyId)||t.target&&!this.matchTarget(e,t.target)||e.credentialType===U.ACCESS_TOKEN_WITH_AUTH_SCHEME&&(t.tokenType&&!this.matchTokenType(e,t.tokenType)||t.tokenType===k.SSH&&t.keyId&&!this.matchKeyId(e,t.keyId)))}getAppMetadataFilteredBy(e,t){let n=this.getKeys(),o={};return n.forEach(i=>{if(!this.isAppMetadata(i))return;let s=this.getAppMetadata(i,t);s&&(e.environment&&!this.matchEnvironment(s,e.environment,t)||e.clientId&&!this.matchClientId(s,e.clientId)||(o[i]=s))}),o}getAuthorityMetadataByAlias(e,t){let n=this.getAuthorityMetadataKeys(),o=null;return n.forEach(i=>{if(!this.isAuthorityMetadata(i)||i.indexOf(this.clientId)===-1)return;let s=this.getAuthorityMetadata(i,t);s&&s.aliases.indexOf(e)!==-1&&(o=s)}),o}removeAllAccounts(e){this.getAllAccounts({},e).forEach(n=>{this.removeAccount(n,e)})}removeAccount(e,t){this.removeAccountContext(e,t);let n=this.getAccountKeys(),o=i=>i.includes(e.homeAccountId)&&i.includes(e.environment);n.filter(o).forEach(i=>{this.removeItem(i,t),this.performanceClient.incrementFields({accountsRemoved:1},t)})}removeAccountContext(e,t){let n=this.getTokenKeys(),o=i=>i.includes(e.homeAccountId)&&i.includes(e.environment);n.idToken.filter(o).forEach(i=>{this.removeIdToken(i,t)}),n.accessToken.filter(o).forEach(i=>{this.removeAccessToken(i,t)}),n.refreshToken.filter(o).forEach(i=>{this.removeRefreshToken(i,t)})}removeAccessToken(e,t){let n=this.getAccessTokenCredential(e,t);if(n&&(this.removeItem(e,t),this.performanceClient.incrementFields({accessTokensRemoved:1},t),n.credentialType.toLowerCase()===U.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()&&n.tokenType===k.POP)){let i=n.keyId;i&&this.cryptoImpl.removeTokenBindingKey(i,t).catch(()=>{this.commonLogger.error(`Failed to remove token binding key '${i}'`,t),this.performanceClient?.incrementFields({removeTokenBindingKeyFailure:1},t)})}}removeAppMetadata(e){return this.getKeys().forEach(n=>{this.isAppMetadata(n)&&this.removeItem(n,e)}),!0}getIdToken(e,t,n,o){this.commonLogger.trace("CacheManager - getIdToken called",t);let i={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:U.ID_TOKEN,clientId:this.clientId,realm:o},s=this.getIdTokensByFilter(i,t,n),a=s.size;if(a<1)return this.commonLogger.info("CacheManager:getIdToken - No token found",t),null;if(a>1){let d=s;if(!o){let c=new Map;s.forEach((h,g)=>{h.realm===e.tenantId&&c.set(g,h)});let u=c.size;if(u<1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result",t),s.values().next().value??null;if(u===1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile",t),c.values().next().value??null;d=c}return this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them",t),d.forEach((c,u)=>{this.removeIdToken(u,t)}),this.performanceClient.addFields({multiMatchedID:s.size},t),null}return this.commonLogger.info("CacheManager:getIdToken - Returning ID token",t),s.values().next().value??null}getIdTokensByFilter(e,t,n){let o=n&&n.idToken||this.getTokenKeys().idToken,i=new Map;return o.forEach(s=>{if(!this.idTokenKeyMatchesFilter(s,{clientId:this.clientId,...e}))return;let a=this.getIdTokenCredential(s,t);a&&this.credentialMatchesFilter(a,e,t)&&i.set(s,a)}),i}idTokenKeyMatchesFilter(e,t){let n=e.toLowerCase();return!(t.clientId&&n.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&n.indexOf(t.homeAccountId.toLowerCase())===-1)}removeIdToken(e,t){this.removeItem(e,t)}removeRefreshToken(e,t){this.removeItem(e,t)}getAccessToken(e,t,n,o){let i=t.correlationId;this.commonLogger.trace("CacheManager - getAccessToken called",i);let s=P.createSearchScopes(t.scopes),a=t.authenticationScheme||k.BEARER,d=a&&a.toLowerCase()!==k.BEARER.toLowerCase()?U.ACCESS_TOKEN_WITH_AUTH_SCHEME:U.ACCESS_TOKEN,c={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:d,clientId:this.clientId,realm:o||e.tenantId,target:s,tokenType:a,keyId:t.sshKid},u=n&&n.accessToken||this.getTokenKeys().accessToken,h=[];u.forEach(p=>{if(this.accessTokenKeyMatchesFilter(p,c,!0)){let E=this.getAccessTokenCredential(p,i);E&&this.credentialMatchesFilter(E,c,i)&&h.push(E)}});let g=h.length;return g<1?(this.commonLogger.info("CacheManager:getAccessToken - No token found",i),null):g>1?(this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them",i),h.forEach(p=>{this.removeAccessToken(this.generateCredentialKey(p),i)}),this.performanceClient.addFields({multiMatchedAT:h.length},i),null):(this.commonLogger.info("CacheManager:getAccessToken - Returning access token",i),h[0])}accessTokenKeyMatchesFilter(e,t,n){let o=e.toLowerCase();if(t.clientId&&o.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&o.indexOf(t.homeAccountId.toLowerCase())===-1||t.realm&&o.indexOf(t.realm.toLowerCase())===-1)return!1;if(t.target){let i=t.target.asArray();for(let s=0;s<i.length;s++){if(n&&!o.includes(i[s].toLowerCase()))return!1;if(!n&&o.includes(i[s].toLowerCase()))return!0}}return!0}getAccessTokensByFilter(e,t){let n=this.getTokenKeys(),o=[];return n.accessToken.forEach(i=>{if(!this.accessTokenKeyMatchesFilter(i,e,!0))return;let s=this.getAccessTokenCredential(i,t);s&&this.credentialMatchesFilter(s,e,t)&&o.push(s)}),o}getRefreshToken(e,t,n,o){this.commonLogger.trace("CacheManager - getRefreshToken called",n);let i=t?Ye:void 0,s={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:U.REFRESH_TOKEN,clientId:this.clientId,familyId:i},a=o&&o.refreshToken||this.getTokenKeys().refreshToken,d=[];a.forEach(u=>{if(this.refreshTokenKeyMatchesFilter(u,s)){let h=this.getRefreshTokenCredential(u,n);h&&this.credentialMatchesFilter(h,s,n)&&d.push(h)}});let c=d.length;return c<1?(this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found.",n),null):(c>1&&this.performanceClient.addFields({multiMatchedRT:c},n),this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token",n),d[0])}refreshTokenKeyMatchesFilter(e,t){let n=e.toLowerCase();return!(t.familyId&&n.indexOf(t.familyId.toLowerCase())===-1||!t.familyId&&t.clientId&&n.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&n.indexOf(t.homeAccountId.toLowerCase())===-1)}readAppMetadataFromCache(e,t){let n={environment:e,clientId:this.clientId},o=this.getAppMetadataFilteredBy(n,t),i=Object.keys(o).map(a=>o[a]),s=i.length;if(s<1)return null;if(s>1)throw l(Ni);return i[0]}isAppMetadataFOCI(e,t){let n=this.readAppMetadataFromCache(e,t);return!!(n&&n.familyId===Ye)}matchHomeAccountId(e,t){return typeof e.homeAccountId=="string"&&t===e.homeAccountId}matchLocalAccountIdFromTokenClaims(e,t){let n=e.oid||e.sub;return t===n}matchLocalAccountIdFromTenantProfile(e,t){return e.localAccountId===t}matchName(e,t){return t.toLowerCase()===e.name?.toLowerCase()}matchUsername(e,t){return!!(e&&typeof e=="string"&&t?.toLowerCase()===e.toLowerCase())}matchLoginHintWithTenantProfile(e,t){return e.loginHint===t||e.username===t||e.upn===t}matchUserAssertionHash(e,t){return!!(e.userAssertionHash&&t===e.userAssertionHash)}matchEnvironment(e,t,n){if(this.staticAuthorityOptions){let i=Sa(this.staticAuthorityOptions,this.commonLogger,n);if(i.includes(t)&&i.includes(e.environment))return!0}let o=this.getAuthorityMetadataByAlias(t,n);return!!(o&&o.aliases.indexOf(e.environment)>-1)}matchCredentialType(e,t){return e.credentialType&&t.toLowerCase()===e.credentialType.toLowerCase()}matchClientId(e,t){return!!(e.clientId&&t===e.clientId)}matchFamilyId(e,t){return!!(e.familyId&&t===e.familyId)}matchRealm(e,t){return e.realm?.toLowerCase()===t.toLowerCase()}matchNativeAccountId(e,t){return!!(e.nativeAccountId&&t===e.nativeAccountId)}matchLoginHintFromTokenClaims(e,t){return!!(e.login_hint===t||e.preferred_username===t||e.upn===t||e.emails&&e.emails.includes(t))}matchSid(e,t){return e.sid===t}matchAuthorityType(e,t){return!!(e.authorityType&&t.toLowerCase()===e.authorityType.toLowerCase())}matchTarget(e,t){return e.credentialType!==U.ACCESS_TOKEN&&e.credentialType!==U.ACCESS_TOKEN_WITH_AUTH_SCHEME||!e.target?!1:P.fromString(e.target).containsScopeSet(t)}matchTokenType(e,t){return!!(e.tokenType&&e.tokenType===t)}matchKeyId(e,t){return!!(e.keyId&&e.keyId===t)}isAppMetadata(e){return e.indexOf(yt)!==-1}isAuthorityMetadata(e){return e.indexOf(At)!==-1}generateAuthorityMetadataCacheKey(e){return`${At}-${this.clientId}-${e}`}static toObject(e,t){for(let n in t)e[n]=t[n];return e}},yr=class extends Ue{async setAccount(){throw l(y)}getAccount(){throw l(y)}async setIdTokenCredential(){throw l(y)}getIdTokenCredential(){throw l(y)}async setAccessTokenCredential(){throw l(y)}getAccessTokenCredential(){throw l(y)}async setRefreshTokenCredential(){throw l(y)}getRefreshTokenCredential(){throw l(y)}setAppMetadata(){throw l(y)}getAppMetadata(){throw l(y)}setServerTelemetry(){throw l(y)}getServerTelemetry(){throw l(y)}setAuthorityMetadata(){throw l(y)}getAuthorityMetadata(){throw l(y)}getAuthorityMetadataKeys(){throw l(y)}setThrottlingCache(){throw l(y)}getThrottlingCache(){throw l(y)}removeItem(){throw l(y)}getKeys(){throw l(y)}getAccountKeys(){throw l(y)}getTokenKeys(){throw l(y)}generateCredentialKey(){throw l(y)}generateAccountKey(){throw l(y)}};var Na={NotStarted:0,InProgress:1,Completed:2};var L=class{generateId(){return"callback-id"}startMeasurement(e,t){return{end:()=>null,discard:()=>{},add:()=>{},increment:()=>{},event:{eventId:this.generateId(),status:Na.InProgress,authority:"",libraryName:"",libraryVersion:"",clientId:"",name:e,startTimeMs:Date.now(),correlationId:t||""}}}endMeasurement(){return null}discardMeasurements(){}removePerformanceCallback(){return!0}addPerformanceCallback(){return""}emitEvents(){}addFields(){}incrementFields(){}cacheEventByCorrelationId(){}};var va={tokenRenewalOffsetSeconds:Mo,preventCorsPreflight:!1},Dh={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:v.Info,correlationId:""},Uh={async sendGetRequestAsync(){throw l(y)},async sendPostRequestAsync(){throw l(y)}},xh={sku:eo,version:ye,cpu:"",os:""},Lh={clientSecret:"",clientAssertion:void 0},Hh={azureCloudInstance:De.None,tenant:`${$t}`},Fh={application:{appName:"",appVersion:""}};function Oe({authOptions:r,systemOptions:e,loggerOptions:t,storageInterface:n,networkInterface:o,cryptoInterface:i,clientCredentials:s,libraryInfo:a,telemetry:d,serverTelemetryManager:c,persistencePlugin:u,serializableCache:h}){let g={...Dh,...t};return{authOptions:Bh(r),systemOptions:{...va,...e},loggerOptions:g,storageInterface:n||new yr(r.clientId,Ji,new B(g),new L),networkInterface:o||Uh,cryptoInterface:i||Ji,clientCredentials:s||Lh,libraryInfo:{...xh,...a},telemetry:{...Fh,...d},serverTelemetryManager:c||null,persistencePlugin:u||null,serializableCache:h||null}}function Bh(r){return{clientCapabilities:[],azureCloudOptions:Hh,instanceAware:!1,isMcp:!1,...r}}function yn(r){return r.authOptions.authority.options.protocolMode===Z.OIDC}var ie=class{constructor(e,t){this.cache=e,this.hasChanged=t}get cacheHasChanged(){return this.hasChanged}get tokenCache(){return this.cache}};var $={};J($,{createAccessTokenEntity:()=>as,createIdTokenEntity:()=>ss,createRefreshTokenEntity:()=>cs,generateAppMetadataKey:()=>qh,generateAuthorityMetadataExpiresAt:()=>Cn,isAccessTokenEntity:()=>$h,isAppMetadataEntity:()=>Qh,isAuthorityMetadataEntity:()=>Xh,isAuthorityMetadataExpired:()=>_n,isCredentialEntity:()=>An,isIdTokenEntity:()=>jh,isRefreshTokenEntity:()=>zh,isServerTelemetryEntity:()=>Yh,isThrottlingEntity:()=>Wh,updateAuthorityEndpointMetadata:()=>kt,updateCloudDiscoveryMetadata:()=>Cr});var O={};J(O,{delay:()=>Vh,isCacheExpired:()=>Gh,isTokenExpired:()=>wt,nowSeconds:()=>ee,toDateFromSeconds:()=>Ar,toSecondsFromDate:()=>Kh,wasClockTurnedBack:()=>is});function ee(){return Math.round(new Date().getTime()/1e3)}function Kh(r){return r.getTime()/1e3}function Ar(r){return r?new Date(Number(r)*1e3):new Date}function wt(r,e){let t=Number(r)||0;return ee()+e>t}function Gh(r,e){let t=Number(r)+e*24*60*60*1e3;return Date.now()>t}function is(r){return Number(r)>ee()}function Vh(r,e){return new Promise(t=>setTimeout(()=>t(e),r))}function ss(r,e,t,n,o){return{credentialType:U.ID_TOKEN,homeAccountId:r,environment:e,clientId:n,secret:t,realm:o,lastUpdatedAt:Date.now().toString()}}function as(r,e,t,n,o,i,s,a,d,c,u,h,g){let p={homeAccountId:r,credentialType:U.ACCESS_TOKEN,secret:t,cachedAt:ee().toString(),expiresOn:s.toString(),extendedExpiresOn:a.toString(),environment:e,clientId:n,realm:o,target:i,tokenType:u||k.BEARER,lastUpdatedAt:Date.now().toString()};if(h&&(p.userAssertionHash=h),c&&(p.refreshOn=c.toString()),p.tokenType?.toLowerCase()!==k.BEARER.toLowerCase())switch(p.credentialType=U.ACCESS_TOKEN_WITH_AUTH_SCHEME,p.tokenType){case k.POP:let E=Re(t,d);if(!E?.cnf?.kid)throw l(Ui);p.keyId=E.cnf.kid;break;case k.SSH:p.keyId=g}return p}function cs(r,e,t,n,o,i,s){let a={credentialType:U.REFRESH_TOKEN,homeAccountId:r,environment:e,clientId:n,secret:t,lastUpdatedAt:Date.now().toString()};return i&&(a.userAssertionHash=i),o&&(a.familyId=o),s&&(a.expiresOn=s.toString()),a}function An(r){return r.hasOwnProperty("homeAccountId")&&r.hasOwnProperty("environment")&&r.hasOwnProperty("credentialType")&&r.hasOwnProperty("clientId")&&r.hasOwnProperty("secret")}function $h(r){return r?An(r)&&r.hasOwnProperty("realm")&&r.hasOwnProperty("target")&&(r.credentialType===U.ACCESS_TOKEN||r.credentialType===U.ACCESS_TOKEN_WITH_AUTH_SCHEME):!1}function jh(r){return r?An(r)&&r.hasOwnProperty("realm")&&r.credentialType===U.ID_TOKEN:!1}function zh(r){return r?An(r)&&r.credentialType===U.REFRESH_TOKEN:!1}function Yh(r,e){let t=r.indexOf(qt)===0,n=!0;return e&&(n=e.hasOwnProperty("failedRequests")&&e.hasOwnProperty("errors")&&e.hasOwnProperty("cacheHits")),t&&n}function Wh(r,e){let t=!1;r&&(t=r.indexOf(Qt)===0);let n=!0;return e&&(n=e.hasOwnProperty("throttleTime")),t&&n}function qh({environment:r,clientId:e}){return[yt,r,e].join(ze).toLowerCase()}function Qh(r,e){return e?r.indexOf(yt)===0&&e.hasOwnProperty("clientId")&&e.hasOwnProperty("environment"):!1}function Xh(r,e){return e?r.indexOf(At)===0&&e.hasOwnProperty("aliases")&&e.hasOwnProperty("preferred_cache")&&e.hasOwnProperty("preferred_network")&&e.hasOwnProperty("canonical_authority")&&e.hasOwnProperty("authorization_endpoint")&&e.hasOwnProperty("token_endpoint")&&e.hasOwnProperty("issuer")&&e.hasOwnProperty("aliasesFromNetwork")&&e.hasOwnProperty("endpointsFromNetwork")&&e.hasOwnProperty("expiresAt")&&e.hasOwnProperty("jwks_uri"):!1}function Cn(){return ee()+Co}function kt(r,e,t){r.authorization_endpoint=e.authorization_endpoint,r.token_endpoint=e.token_endpoint,r.end_session_endpoint=e.end_session_endpoint,r.issuer=e.issuer,r.endpointsFromNetwork=t,r.jwks_uri=e.jwks_uri}function Cr(r,e,t){r.aliases=e.aliases,r.preferred_cache=e.preferred_cache,r.preferred_network=e.preferred_network,r.aliasesFromNetwork=t}function _n(r){return r.expiresAt<=ee()}var ba="networkClientSendPostRequestAsync",Ma="refreshTokenClientExecutePostToTokenEndpoint",Pa="authorizationCodeClientExecutePostToTokenEndpoint",Da="refreshTokenClientExecuteTokenRequest",Ua="refreshTokenClientAcquireToken",In="refreshTokenClientAcquireTokenWithCachedRefreshToken",xa="refreshTokenClientCreateTokenRequestBody",La="silentFlowClientGenerateResultFromCacheRecord";var Ha="authClientExecuteTokenRequest",Fa="authClientCreateTokenRequestBody",Ba="updateTokenEndpointAuthority",Nt="popTokenGenerateCnf",Sn="handleServerTokenResponse",Ka="authorityResolveEndpointsAsync",Ga="authorityGetCloudDiscoveryMetadataFromNetwork",Va="authorityUpdateCloudDiscoveryMetadata",$a="authorityGetEndpointMetadataFromNetwork",ja="authorityUpdateEndpointMetadata",ds="authorityUpdateMetadataWithRegionalInformation",za="regionDiscoveryDetectRegion",ls="regionDiscoveryGetRegionFromIMDS",Ya="regionDiscoveryGetCurrentVersion",Wa="cacheManagerGetRefreshToken";var qa=(r,e,t,n,o)=>(...i)=>{t.trace(`Executing function '${e}'`,o);let s=n.startMeasurement(e,o);o&&n.incrementFields({[`ext.${e}CallCount`]:1},o);try{let a=r(...i);return s.end({success:!0}),t.trace(`Returning result from '${e}'`,o),a}catch(a){t.trace(`Error occurred in '${e}'`,o);try{t.trace(JSON.stringify(a),o)}catch{t.trace("Unable to print error message.",o)}throw s.end({success:!1},a),a}},C=(r,e,t,n,o)=>(...i)=>{t.trace(`Executing function '${e}'`,o);let s=n.startMeasurement(e,o);return o&&n.incrementFields({[`ext.${e}CallCount`]:1},o),r(...i).then(a=>(t.trace(`Returning result from '${e}'`,o),s.end({success:!0}),a)).catch(a=>{t.trace(`Error occurred in '${e}'`,o);try{t.trace(JSON.stringify(a),o)}catch{t.trace("Unable to print error message.",o)}throw s.end({success:!1},a),a})};var Jh={SW:"sw"},xe=class{constructor(e,t){this.cryptoUtils=e,this.performanceClient=t}async generateCnf(e,t){let n=await C(this.generateKid.bind(this),Nt,t,this.performanceClient,e.correlationId)(e),o=this.cryptoUtils.base64UrlEncode(JSON.stringify(n));return{kid:n.kid,reqCnfString:o}}async generateKid(e){return{kid:await this.cryptoUtils.getPublicKeyThumbprint(e),xms_ksl:Jh.SW}}async signPopToken(e,t,n){return this.signPayload(e,t,n)}async signPayload(e,t,n,o){let{resourceRequestMethod:i,resourceRequestUri:s,shrClaims:a,shrNonce:d,shrOptions:c}=n,h=(s?new A(s):void 0)?.getUrlComponents();return this.cryptoUtils.signJwt({at:e,ts:ee(),m:i?.toUpperCase(),u:h?.HostNameAndPort,nonce:d||this.cryptoUtils.createNewGuid(),p:h?.AbsolutePath,q:h?.QueryString?[[],h.QueryString]:void 0,client_claims:a||void 0,...o},t,c,n.correlationId)}};var Q=class r extends T{constructor(e,t,n,o,i){super(e,t,n),this.name="ServerError",this.errorNo=o,this.status=i,Object.setPrototypeOf(this,r.prototype)}};function Qa(r,e){if(!r)throw l(Di);if(!e)throw l(qe);try{let t=e.split(zr),n=t[0],o=t.length>1?t.slice(1).join(zr):"",i=r(n),s=JSON.parse(i);return{userRequestState:o||"",libraryState:s}}catch{throw l(qe)}}var M=class r{constructor(e,t,n,o,i,s,a){this.clientId=e,this.cacheStorage=t,this.cryptoObj=n,this.logger=o,this.performanceClient=i,this.serializableCache=s,this.persistencePlugin=a}validateTokenResponse(e,t,n){if(e.error||e.error_description||e.suberror){let o=`Error(s): ${e.error_codes||je} - Timestamp: ${e.timestamp||je} - Description: ${e.error_description||je} - Correlation ID: ${e.correlation_id||je} - Trace ID: ${e.trace_id||je}`,i=e.error_codes?.length?e.error_codes[0]:void 0,s=new Q(e.error,o,e.suberror,i,e.status);if(n&&e.status&&e.status>=po&&e.status<=go){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.
+${s}`,t);return}else if(n&&e.status&&e.status>=fo&&e.status<=mo){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.
+${s}`,t);return}throw $r(e.error,e.error_description,e.suberror)?new ne(e.error,e.error_description,e.suberror,e.timestamp||"",e.trace_id||"",e.correlation_id||"",e.claims||"",i):s}}async handleServerTokenResponse(e,t,n,o,i,s,a,d,c,u){let h;if(e.id_token){if(h=Re(e.id_token||"",this.cryptoObj.base64Decode),s&&s.nonce&&h.nonce!==s.nonce)throw l(wi);if(o.maxAge||o.maxAge===0){let _=h.auth_time;if(!_)throw l(Zt);pr(_,o.maxAge)}}this.homeAccountIdentifier=os(e.client_info||"",t.authorityType,this.logger,this.cryptoObj,o.correlationId,h);let g;s&&s.state&&(g=Qa(this.cryptoObj.base64Decode,s.state)),e.key_id=e.key_id||o.sshKid||void 0;let p=this.generateCacheRecord(e,t,n,o,h,a,s),E;try{if(this.persistencePlugin&&this.serializableCache&&(this.logger.verbose("Persistence enabled, calling beforeCacheAccess",o.correlationId),E=new ie(this.serializableCache,!0),await this.persistencePlugin.beforeCacheAccess(E)),d&&!c&&p.account&&this.cacheStorage.getAllAccounts({homeAccountId:p.account.homeAccountId,environment:p.account.environment},o.correlationId).length<1)return this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache",o.correlationId),this.performanceClient?.addFields({acntLoggedOut:!0},o.correlationId),await r.generateAuthenticationResult(this.cryptoObj,t,p,!1,o,this.performanceClient,h,g,void 0,u);await this.cacheStorage.saveCacheRecord(p,o.correlationId,Zi(h||{}),i,o.storeInCache)}finally{this.persistencePlugin&&this.serializableCache&&E&&(this.logger.verbose("Persistence enabled, calling afterCacheAccess",o.correlationId),await this.persistencePlugin.afterCacheAccess(E))}return r.generateAuthenticationResult(this.cryptoObj,t,p,!1,o,this.performanceClient,h,g,e,u)}generateCacheRecord(e,t,n,o,i,s,a){let d=t.getPreferredCache();if(!d)throw l(tr);let c=Tn(i),u,h;e.id_token&&i&&(u=ss(this.homeAccountIdentifier,d,e.id_token,this.clientId,c||""),h=Xa(this.cacheStorage,t,this.homeAccountIdentifier,this.cryptoObj.base64Decode,o.correlationId,i,e.client_info,d,c,a,void 0,this.logger,this.performanceClient));let g=null;if(e.access_token){let _=e.scope?P.fromString(e.scope):new P(o.scopes||[]),H=(typeof e.expires_in=="string"?parseInt(e.expires_in,10):e.expires_in)||0,pe=(typeof e.ext_expires_in=="string"?parseInt(e.ext_expires_in,10):e.ext_expires_in)||0,Y=(typeof e.refresh_in=="string"?parseInt(e.refresh_in,10):e.refresh_in)||void 0,W=n+H,Ge=W+pe,Xn=Y&&Y>0?n+Y:void 0;g=as(this.homeAccountIdentifier,d,e.access_token,this.clientId,c||t.tenant||"",_.printScopes(),W,Ge,this.cryptoObj.base64Decode,Xn,e.token_type,s,e.key_id);let Gt=o.resource||null;Gt&&(g.resource=Gt)}let p=null;if(e.refresh_token){let _;if(e.refresh_token_expires_in){let H=typeof e.refresh_token_expires_in=="string"?parseInt(e.refresh_token_expires_in,10):e.refresh_token_expires_in;_=n+H,this.performanceClient?.addFields({ntwkRtExpiresOnSeconds:_},o.correlationId)}p=cs(this.homeAccountIdentifier,d,e.refresh_token,this.clientId,e.foci,s,_)}let E=null;return e.foci&&(E={clientId:this.clientId,environment:d,familyId:e.foci}),{account:h,idToken:u,accessToken:g,refreshToken:p,appMetadata:E}}static async generateAuthenticationResult(e,t,n,o,i,s,a,d,c,u){let h="",g=[],p=null,E,_,H="";if(n.accessToken){if(n.accessToken.tokenType===k.POP&&!i.popKid){let Ge=new xe(e,s),{secret:Xn,keyId:Gt}=n.accessToken;if(!Gt)throw l(Hi);h=await Ge.signPopToken(Xn,Gt,i)}else h=n.accessToken.secret;g=P.fromString(n.accessToken.target).asArray(),p=Ar(n.accessToken.expiresOn),E=Ar(n.accessToken.extendedExpiresOn),n.accessToken.refreshOn&&(_=Ar(n.accessToken.refreshOn))}n.appMetadata&&(H=n.appMetadata.familyId===Ye?Ye:"");let pe=a?.oid||a?.sub||"",Y=a?.tid||"";c?.spa_accountid&&n.account&&(n.account.nativeAccountId=c?.spa_accountid);let W=n.account?gn(Ot(n.account),void 0,a,n.idToken?.secret):null;return{authority:t.canonicalAuthority,uniqueId:pe,tenantId:Y,scopes:g,account:W,idToken:n?.idToken?.secret||"",idTokenClaims:a||{},accessToken:h,fromCache:o,expiresOn:p,extExpiresOn:E,refreshOn:_,correlationId:i.correlationId,requestId:u||"",familyId:H,tokenType:n.accessToken?.tokenType||"",state:d?d.userRequestState:"",cloudGraphHostName:n.account?.cloudGraphHostName||"",msGraphHost:n.account?.msGraphHost||"",code:c?.spa_code,fromPlatformBroker:!1}}};function Xa(r,e,t,n,o,i,s,a,d,c,u,h,g){h?.verbose("setCachedAccount called",o);let p=a||e.getPreferredCache(),E=r.getAccountsFilteredBy({homeAccountId:t,environment:p},o);g?.addFields({cacheMatchedAccounts:E.length},o),E.length>1&&h?.warning("Multiple base accounts matched homeAccountId. Ignoring cached account and creating a new base account.",o);let H=(E.length===1?E[0]:null)||ns({homeAccountId:t,idTokenClaims:i,clientInfo:s,environment:a,cloudGraphHostName:c?.cloud_graph_host_name,msGraphHost:c?.msgraph_host,nativeAccountId:u},e,n),pe=H.tenantProfiles||[],Y=d||H.realm;if(Y&&!pe.find(W=>W.tenantId===Y)){let W=ot(t,H.localAccountId,Y,i);pe.push(W)}return H.tenantProfiles=pe,H}var j={HOME_ACCOUNT_ID:"home_account_id",UPN:"UPN"};async function z(r,e,t){return typeof r=="string"?r:r({clientId:e,tokenEndpoint:t})}function vt(r,e,t){return{clientId:r,authority:e.authority,scopes:e.scopes,homeAccountIdentifier:t,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid,embeddedClientId:e.embeddedClientId||e.extraParameters?.clientId}}var it={};J(it,{createTokenQueryParameters:()=>Sr,createTokenRequestHeaders:()=>Ir,executePostToTokenEndpoint:()=>Rr,sendPostRequest:()=>Ja});var _r=class r{static generateThrottlingStorageKey(e){return`${Qt}.${JSON.stringify(e)}`}static preProcess(e,t,n){let o=r.generateThrottlingStorageKey(t),i=e.getThrottlingCache(o,n);if(i){if(i.throttleTime<Date.now()){e.removeItem(o,n);return}throw new Q(i.errorCodes?.join(" ")||"",i.errorMessage,i.subError)}}static postProcess(e,t,n,o){if(r.checkResponseStatus(n)||r.checkResponseForRetryAfter(n)){let i={throttleTime:r.calculateThrottleTime(parseInt(n.headers[b.RETRY_AFTER])),error:n.body.error,errorCodes:n.body.error_codes,errorMessage:n.body.error_description,subError:n.body.suberror};e.setThrottlingCache(r.generateThrottlingStorageKey(t),i,o)}}static checkResponseStatus(e){return e.status===429||e.status>=500&&e.status<600}static checkResponseForRetryAfter(e){return e.headers?e.headers.hasOwnProperty(b.RETRY_AFTER)&&(e.status<200||e.status>=300):!1}static calculateThrottleTime(e){let t=e<=0?0:e,n=Date.now()/1e3;return Math.floor(Math.min(n+(t||wo),n+ko)*1e3)}static removeThrottle(e,t,n,o){let i=vt(t,n,o),s=this.generateThrottlingStorageKey(i);e.removeItem(s,n.correlationId)}};var bt=class r extends T{constructor(e,t,n){super(e.errorCode,e.errorMessage,e.subError),Object.setPrototypeOf(this,r.prototype),this.name="NetworkError",this.error=e,this.httpStatus=t,this.responseHeaders=n}};function hs(r,e,t,n){return r.errorMessage=`${r.errorMessage}, additionalErrorInfo: error.name:${n?.name}, error.message:${n?.message}`,new bt(r,e,t)}function Ir(r,e,t){let n={};if(n[b.CONTENT_TYPE]=io,!e&&t)switch(t.type){case j.HOME_ACCOUNT_ID:try{let o=Ae(t.credential);n[b.CCS_HEADER]=`Oid:${o.uid}@${o.utid}`}catch(o){r.verbose(`Could not parse home account ID for CCS Header: '${o}'`,"")}break;case j.UPN:n[b.CCS_HEADER]=`UPN: ${t.credential}`;break}return n}function Sr(r,e,t,n){let o=new Map;return r.embeddedClientId&&Se(o,e,t),r.extraQueryParameters&&Ie(o,r.extraQueryParameters),tt(o,r.correlationId),Qe(o,r.correlationId,n),Te(o)}async function Rr(r,e,t,n,o,i,s,a,d,c){let u=await Ja(n,r,{body:e,headers:t},o,i,s,a,d);return c&&u.status<500&&u.status!==429&&c.clearTelemetryCache(),u}async function Ja(r,e,t,n,o,i,s,a){_r.preProcess(o,r,n);let d;try{d=await C(i.sendPostRequestAsync.bind(i),ba,s,a,n)(e,t);let c=d.headers||{};a?.addFields({refreshTokenSize:d.body.refresh_token?.length||0,httpVerToken:c[b.X_MS_HTTP_VERSION]||"",requestId:c[b.X_MS_REQUEST_ID]||""},n)}catch(c){if(c instanceof bt){let u=c.responseHeaders;throw u&&a?.addFields({httpVerToken:u[b.X_MS_HTTP_VERSION]||"",requestId:u[b.X_MS_REQUEST_ID]||"",contentTypeHeader:u[b.CONTENT_TYPE]||void 0,contentLengthHeader:u[b.CONTENT_LENGTH]||void 0,httpStatus:c.httpStatus},n),c.error}throw c instanceof T?c:l(Ii)}return _r.postProcess(o,r,d,n),d}var On={};J(On,{createDiscoveredInstance:()=>fs});function Za(r){return r.hasOwnProperty("authorization_endpoint")&&r.hasOwnProperty("token_endpoint")&&r.hasOwnProperty("issuer")&&r.hasOwnProperty("jwks_uri")}function ec(r){return r.hasOwnProperty("tenant_discovery_endpoint")&&r.hasOwnProperty("metadata")}function tc(r){return r.hasOwnProperty("error")&&r.hasOwnProperty("error_description")}var Or=class r{constructor(e,t,n,o){this.networkInterface=e,this.logger=t,this.performanceClient=n,this.correlationId=o}async detectRegion(e,t){let n=e;if(n)t.region_source=be.ENVIRONMENT_VARIABLE;else{let o=r.IMDS_OPTIONS;try{let i=await C(this.getRegionFromIMDS.bind(this),ls,this.logger,this.performanceClient,this.correlationId)(so,o);if(i.status===qr&&(n=i.body,t.region_source=be.IMDS),i.status===Qr){let s=await C(this.getCurrentVersion.bind(this),Ya,this.logger,this.performanceClient,this.correlationId)(o);if(!s)return t.region_source=be.FAILED_AUTO_DETECTION,null;let a=await C(this.getRegionFromIMDS.bind(this),ls,this.logger,this.performanceClient,this.correlationId)(s,o);a.status===qr&&(n=a.body,t.region_source=be.IMDS)}}catch{return t.region_source=be.FAILED_AUTO_DETECTION,null}}return n||(t.region_source=be.FAILED_AUTO_DETECTION),n||null}async getRegionFromIMDS(e,t){return this.networkInterface.sendGetRequestAsync(`${Wr}?api-version=${e}&format=text`,t,ao)}async getCurrentVersion(e){try{let t=await this.networkInterface.sendGetRequestAsync(`${Wr}?format=json`,e);return t.status===Qr&&t.body&&t.body["newest-versions"]&&t.body["newest-versions"].length>0?t.body["newest-versions"][0]:null}catch{return null}}};Or.IMDS_OPTIONS={headers:{Metadata:"true"}};var we=class r{constructor(e,t,n,o,i,s,a,d){this.canonicalAuthority=e,this._canonicalAuthority.validateAsUri(),this.networkInterface=t,this.cacheManager=n,this.authorityOptions=o,this.regionDiscoveryMetadata={region_used:void 0,region_source:void 0,region_outcome:void 0},this.logger=i,this.performanceClient=a,this.correlationId=s,this.managedIdentity=d||!1,this.regionDiscovery=new Or(t,this.logger,this.performanceClient,this.correlationId)}getAuthorityType(e){if(e.HostNameAndPort.endsWith(jt))return oe.Ciam;let t=e.PathSegments;if(t.length)switch(t[0].toLowerCase()){case ro:return oe.Adfs;case no:return oe.Dsts}return oe.Default}get authorityType(){return this.getAuthorityType(this.canonicalAuthorityUrlComponents)}get protocolMode(){return this.authorityOptions.protocolMode}get options(){return this.authorityOptions}get canonicalAuthority(){return this._canonicalAuthority.urlString}set canonicalAuthority(e){this._canonicalAuthority=new A(e),this._canonicalAuthority.validateAsUri(),this._canonicalAuthorityUrlComponents=null}get canonicalAuthorityUrlComponents(){return this._canonicalAuthorityUrlComponents||(this._canonicalAuthorityUrlComponents=this._canonicalAuthority.getUrlComponents()),this._canonicalAuthorityUrlComponents}get hostnameAndPort(){return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase()}get tenant(){return this.canonicalAuthorityUrlComponents.PathSegments[0]}get authorizationEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.authorization_endpoint);throw l(he)}get tokenEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint);throw l(he)}get deviceCodeEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint.replace("/token","/devicecode"));throw l(he)}get endSessionEndpoint(){if(this.discoveryComplete()){if(!this.metadata.end_session_endpoint)throw l(Li);return this.replacePath(this.metadata.end_session_endpoint)}else throw l(he)}get selfSignedJwtAudience(){if(this.discoveryComplete())return this.replacePath(this.metadata.issuer);throw l(he)}get jwksUri(){if(this.discoveryComplete())return this.replacePath(this.metadata.jwks_uri);throw l(he)}canReplaceTenant(e){return e.PathSegments.length===1&&!r.reservedTenantDomains.has(e.PathSegments[0])&&this.getAuthorityType(e)===oe.Default&&this.protocolMode!==Z.OIDC}replaceTenant(e){return e.replace(/{tenant}|{tenantid}/g,this.tenant)}replacePath(e){let t=e,o=new A(this.metadata.canonical_authority).getUrlComponents(),i=o.PathSegments;return this.canonicalAuthorityUrlComponents.PathSegments.forEach((a,d)=>{let c=i[d];if(d===0&&this.canReplaceTenant(o)){let u=new A(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];c!==u&&(this.logger.verbose(`Replacing tenant domain name '${c}' with id '${u}'`,this.correlationId),c=u)}a!==c&&(t=t.replace(`/${c}/`,`/${a}/`))}),this.replaceTenant(t)}get defaultOpenIdConfigurationEndpoint(){let e=this.hostnameAndPort;return this.canonicalAuthority.endsWith("v2.0/")||this.authorityType===oe.Adfs||this.protocolMode===Z.OIDC&&!this.isAliasOfKnownMicrosoftAuthority(e)?`${this.canonicalAuthority}.well-known/openid-configuration`:`${this.canonicalAuthority}v2.0/.well-known/openid-configuration`}discoveryComplete(){return!!this.metadata}async resolveEndpointsAsync(){let e=this.getCurrentMetadataEntity(),t=await C(this.updateCloudDiscoveryMetadata.bind(this),Va,this.logger,this.performanceClient,this.correlationId)(e);this.canonicalAuthority=this.canonicalAuthority.replace(this.hostnameAndPort,e.preferred_network);let n=await C(this.updateEndpointMetadata.bind(this),ja,this.logger,this.performanceClient,this.correlationId)(e);this.updateCachedMetadata(e,t,{source:n}),this.performanceClient?.addFields({cloudDiscoverySource:t,authorityEndpointSource:n},this.correlationId)}getCurrentMetadataEntity(){let e=this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort,this.correlationId);return e||(e={aliases:[],preferred_cache:this.hostnameAndPort,preferred_network:this.hostnameAndPort,canonical_authority:this.canonicalAuthority,authorization_endpoint:"",token_endpoint:"",end_session_endpoint:"",issuer:"",aliasesFromNetwork:!1,endpointsFromNetwork:!1,expiresAt:Cn(),jwks_uri:""}),e}updateCachedMetadata(e,t,n){t!==F.CACHE&&n?.source!==F.CACHE&&(e.expiresAt=Cn(),e.canonical_authority=this.canonicalAuthority);let o=this.cacheManager.generateAuthorityMetadataCacheKey(e.preferred_cache,this.correlationId);this.cacheManager.setAuthorityMetadata(o,e,this.correlationId),this.metadata=e}async updateEndpointMetadata(e){let t=this.updateEndpointMetadataFromLocalSources(e);if(t){if(t.source===F.HARDCODED_VALUES&&this.authorityOptions.azureRegionConfiguration?.azureRegion&&t.metadata){let o=await C(this.updateMetadataWithRegionalInformation.bind(this),ds,this.logger,this.performanceClient,this.correlationId)(t.metadata);kt(e,o,!1),e.canonical_authority=this.canonicalAuthority}return t.source}let n=await C(this.getEndpointMetadataFromNetwork.bind(this),$a,this.logger,this.performanceClient,this.correlationId)();if(n)return this.validateIssuer(n.issuer),this.authorityOptions.azureRegionConfiguration?.azureRegion&&(n=await C(this.updateMetadataWithRegionalInformation.bind(this),ds,this.logger,this.performanceClient,this.correlationId)(n)),kt(e,n,!0),F.NETWORK;throw l(Si,this.defaultOpenIdConfigurationEndpoint)}updateEndpointMetadataFromLocalSources(e){this.logger.verbose("Attempting to get endpoint metadata from authority configuration",this.correlationId);let t=this.getEndpointMetadataFromConfig();if(t)return this.logger.verbose("Found endpoint metadata in authority configuration",this.correlationId),kt(e,t,!1),{source:F.CONFIG};this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.",this.correlationId);let n=this.getEndpointMetadataFromHardcodedValues();if(n)return kt(e,n,!1),{source:F.HARDCODED_VALUES,metadata:n};this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.",this.correlationId);let o=_n(e);return this.isAuthoritySameType(e)&&e.endpointsFromNetwork&&!o?(this.logger.verbose("Found endpoint metadata in the cache.",""),{source:F.CACHE}):(o&&this.logger.verbose("The metadata entity is expired.",""),null)}isAuthoritySameType(e){return new A(e.canonical_authority).getUrlComponents().PathSegments.length===this.canonicalAuthorityUrlComponents.PathSegments.length}getEndpointMetadataFromConfig(){if(this.authorityOptions.authorityMetadata)try{return JSON.parse(this.authorityOptions.authorityMetadata)}catch{throw S(pa)}return null}async getEndpointMetadataFromNetwork(){let e={},t=this.defaultOpenIdConfigurationEndpoint;this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from '${t}'`,this.correlationId);try{let n=await this.networkInterface.sendGetRequestAsync(t,e);return Za(n.body)?n.body:(this.logger.verbose("Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration",this.correlationId),null)}catch(n){return this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: '${n}'`,this.correlationId),null}}getEndpointMetadataFromHardcodedValues(){return this.hostnameAndPort in es?es[this.hostnameAndPort]:null}async updateMetadataWithRegionalInformation(e){let t=this.authorityOptions.azureRegionConfiguration?.azureRegion;if(t){if(t!==co)return this.regionDiscoveryMetadata.region_outcome=Xt.CONFIGURED_NO_AUTO_DETECTION,this.regionDiscoveryMetadata.region_used=t,r.replaceWithRegionalInformation(e,t);let n=await C(this.regionDiscovery.detectRegion.bind(this.regionDiscovery),za,this.logger,this.performanceClient,this.correlationId)(this.authorityOptions.azureRegionConfiguration?.environmentRegion,this.regionDiscoveryMetadata);if(n)return this.regionDiscoveryMetadata.region_outcome=Xt.AUTO_DETECTION_REQUESTED_SUCCESSFUL,this.regionDiscoveryMetadata.region_used=n,r.replaceWithRegionalInformation(e,n);this.regionDiscoveryMetadata.region_outcome=Xt.AUTO_DETECTION_REQUESTED_FAILED}return e}async updateCloudDiscoveryMetadata(e){let t=this.updateCloudDiscoveryMetadataFromLocalSources(e);if(t)return t;let n=await C(this.getCloudDiscoveryMetadataFromNetwork.bind(this),Ga,this.logger,this.performanceClient,this.correlationId)();if(n)return Cr(e,n,!0),F.NETWORK;throw S(ga)}updateCloudDiscoveryMetadataFromLocalSources(e){this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration",this.correlationId),this.logger.verbosePii(`Known Authorities: '${this.authorityOptions.knownAuthorities||zt}'`,this.correlationId),this.logger.verbosePii(`Authority Metadata: '${this.authorityOptions.authorityMetadata||zt}'`,this.correlationId),this.logger.verbosePii(`Canonical Authority: '${e.canonical_authority||zt}'`,this.correlationId);let t=this.getCloudDiscoveryMetadataFromConfig();if(t)return this.logger.verbose("Found cloud discovery metadata in authority configuration",this.correlationId),Cr(e,t,!1),F.CONFIG;this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.",this.correlationId);let n=Ra(this.hostnameAndPort);if(n)return this.logger.verbose("Found cloud discovery metadata from hardcoded values.",this.correlationId),Cr(e,n,!1),F.HARDCODED_VALUES;this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.",this.correlationId);let o=_n(e);return this.isAuthoritySameType(e)&&e.aliasesFromNetwork&&!o?(this.logger.verbose("Found cloud discovery metadata in the cache.",""),F.CACHE):(o&&this.logger.verbose("The metadata entity is expired.",""),null)}getCloudDiscoveryMetadataFromConfig(){if(this.authorityType===oe.Ciam)return this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host.",this.correlationId),r.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);if(this.authorityOptions.cloudDiscoveryMetadata){this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.",this.correlationId);try{this.logger.verbose("Attempting to parse the cloud discovery metadata.",this.correlationId);let e=JSON.parse(this.authorityOptions.cloudDiscoveryMetadata),t=gr(e.metadata,this.hostnameAndPort);if(this.logger.verbose("Parsed the cloud discovery metadata.",""),t)return this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata.",this.correlationId),t;this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.",this.correlationId)}catch{throw this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.",this.correlationId),S(Ai)}}return this.isInKnownAuthorities()?(this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.",this.correlationId),r.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)):null}async getCloudDiscoveryMetadataFromNetwork(){let e=`${oo}${this.canonicalAuthority}oauth2/v2.0/authorize`,t={},n=null;try{let o=await this.networkInterface.sendGetRequestAsync(e,t),i,s;if(ec(o.body))i=o.body,s=i.metadata,this.logger.verbosePii(`tenant_discovery_endpoint is: '${i.tenant_discovery_endpoint}'`,this.correlationId);else if(tc(o.body)){if(this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: '${o.status}'`,this.correlationId),i=o.body,i.error===uo)return this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance.",this.correlationId),null;this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is '${i.error}'`,this.correlationId),this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is '${i.error_description}'`,this.correlationId),this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network, correlationId) to []",this.correlationId),s=[]}else return this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse",this.correlationId),null;this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.",this.correlationId),n=gr(s,this.hostnameAndPort)}catch(o){if(o instanceof T)this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.
+Error: '${o.errorCode}'
+Error Description: '${o.errorMessage}'`,this.correlationId);else{let i=o;this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.
+Error: '${i.name}'
+Error Description: '${i.message}'`,this.correlationId)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.",this.correlationId),this.logger.verbose("Creating custom Authority for custom domain scenario.",this.correlationId),n=r.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),n}isInKnownAuthorities(){return this.authorityOptions.knownAuthorities.filter(t=>t&&A.getDomainFromUrl(t).toLowerCase()===this.hostnameAndPort).length>0}static generateAuthority(e,t){let n;if(t&&t.azureCloudInstance!==De.None){let o=t.tenant?t.tenant:$t;n=`${t.azureCloudInstance}/${o}/`}return n||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return to;if(this.discoveryComplete())return this.metadata.preferred_cache;throw l(he)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return rs.has(e)}validateIssuer(e){if(!e)throw S(ln);let t;try{t=new URL(e)}catch{throw S(ln)}let n=t.protocol,o=t.host,i=(this.canonicalAuthorityUrlComponents.Protocol||"").toLowerCase(),s=(this.canonicalAuthorityUrlComponents.HostNameAndPort||"").toLowerCase(),a=this.matchesAuthorityOrigin(n,o,i,s),d=n==="https:"&&this.isAliasOfKnownMicrosoftAuthority(o),c=n==="https:"&&this.matchesRegionalMicrosoftHost(o),u=this.matchesCiamTenantPattern(t,s,this.canonicalAuthorityUrlComponents.PathSegments);if(!(a||d||c||u))throw S(ln)}matchesAuthorityOrigin(e,t,n,o){return e===n&&t===o}matchesRegionalMicrosoftHost(e){let t=e.indexOf(".");if(t>0&&t<e.length-1){let n=e.substring(t+1);return this.isAliasOfKnownMicrosoftAuthority(n)}return!1}matchesCiamTenantPattern(e,t,n){let o=n[0],i=o?o.endsWith($e)?o.slice(0,-$e.length):o:t.split(".")[0];if(!i)return!1;let s=`https://${i}${jt}`,a=[s,`${s}/${i}`,`${s}/${i}/v2.0`,`${s}/${i}${$e}`,`${s}/${i}${$e}/v2.0`],d=e.pathname.replace(/\/+$/,""),c=`${e.protocol}//${e.host}${d}`;return a.some(u=>u===c)}static isPublicCloudAuthority(e){return ho.indexOf(e)>=0}static buildRegionalAuthorityString(e,t,n){let o=new A(e);o.validateAsUri();let i=o.getUrlComponents(),s=`${t}.${i.HostNameAndPort}`;this.isPublicCloudAuthority(i.HostNameAndPort)&&(s=`${t}.${lo}`);let a=A.constructAuthorityUriFromObject({...o.getUrlComponents(),HostNameAndPort:s}).urlString;return n?`${a}?${n}`:a}static replaceWithRegionalInformation(e,t){let n={...e};return n.authorization_endpoint=r.buildRegionalAuthorityString(n.authorization_endpoint,t),n.token_endpoint=r.buildRegionalAuthorityString(n.token_endpoint,t),n.end_session_endpoint&&(n.end_session_endpoint=r.buildRegionalAuthorityString(n.end_session_endpoint,t)),n}static transformCIAMAuthority(e){let t=e,o=new A(e).getUrlComponents();if(o.PathSegments.length===0&&o.HostNameAndPort.endsWith(jt)){let i=o.HostNameAndPort.split(".")[0];t=`${t}${i}${$e}`}return t}};we.reservedTenantDomains=new Set(["{tenant}","{tenantid}",de.COMMON,de.CONSUMERS,de.ORGANIZATIONS]);function rc(r){let n=new A(r).getUrlComponents().PathSegments.slice(-1)[0]?.toLowerCase();switch(n){case de.COMMON:case de.ORGANIZATIONS:case de.CONSUMERS:return;default:return n}}function Rn(r){return r.endsWith(pt)?r:`${r}${pt}`}function us(r){let e=r.cloudDiscoveryMetadata,t;if(e)try{t=JSON.parse(e)}catch{throw S(Ai)}return{canonicalAuthority:r.authority?Rn(r.authority):void 0,knownAuthorities:r.knownAuthorities,cloudDiscoveryMetadata:t}}async function fs(r,e,t,n,o,i,s){let a=we.transformCIAMAuthority(Rn(r)),d=new we(a,e,t,n,o,i,s);try{return await C(d.resolveEndpointsAsync.bind(d),Ka,o,s,i)(),d}catch{throw l(he)}}var wr=class{constructor(e,t){this.includeRedirectUri=!0,this.config=Oe(e),this.logger=new B(this.config.loggerOptions,Pe,ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}async acquireToken(e,t,n){if(!e.code)throw l(vi);n&&n.cloud_instance_host_name&&await C(this.updateTokenEndpointAuthority.bind(this),Ba,this.logger,this.performanceClient,e.correlationId)(n.cloud_instance_host_name,e.correlationId);let o=ee(),i=await C(this.executeTokenRequest.bind(this),Ha,this.logger,this.performanceClient,e.correlationId)(this.authority,e,this.serverTelemetryManager),s=i.headers?.[b.X_MS_REQUEST_ID],a=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i.body,e.correlationId),C(a.handleServerTokenResponse.bind(a),Sn,this.logger,this.performanceClient,e.correlationId)(i.body,this.authority,o,e,t,n,void 0,void 0,void 0,s)}getLogoutUri(e){if(!e)throw S(fa);let t=this.createLogoutUrlQueryString(e);return A.appendQueryString(this.authority.endSessionEndpoint,t)}async executeTokenRequest(e,t,n){let o=Sr(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),i=A.appendQueryString(e.tokenEndpoint,o),s=await C(this.createTokenRequestBody.bind(this),Fa,this.logger,this.performanceClient,t.correlationId)(t),a;if(t.clientInfo)try{let u=Rt(t.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${u.uid}${Tt}${u.utid}`,type:j.HOME_ACCOUNT_ID}}catch(u){this.logger.verbose(`Could not parse client info for CCS Header: '${u}'`,t.correlationId)}let d=Ir(this.logger,this.config.systemOptions.preventCorsPreflight,a||t.ccsCredential),c=vt(this.config.authOptions.clientId,t);return C(Rr,Pa,this.logger,this.performanceClient,t.correlationId)(i,s,d,c,t.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,n)}async createTokenRequestBody(e){let t=new Map;if(Je(t,e.embeddedClientId||e.extraParameters?.[ge]||this.config.authOptions.clientId),this.includeRedirectUri)Ze(t,e.redirectUri);else if(!e.redirectUri)throw S(ca);if(Xe(t,e.scopes,!0,this.oidcDefaultScopes),mr(t,e.resource),Yi(t,e.code),rr(t,this.config.libraryInfo),nr(t,this.config.telemetry.application),fr(t),this.serverTelemetryManager&&!yn(this.config)&&ur(t,this.serverTelemetryManager),e.codeVerifier&&qi(t,e.codeVerifier),this.config.clientCredentials.clientSecret&&ir(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;sr(t,await z(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),ar(t,o.assertionType)}if(cr(t,Wt.AUTHORIZATION_CODE_GRANT),rt(t),e.authenticationScheme===k.POP){let o=new xe(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(await C(o.generateCnf.bind(o),Nt,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,lr(t,i)}else if(e.authenticationScheme===k.SSH)if(e.sshJwk)hr(t,e.sshJwk);else throw S(dn);let n;if(e.clientInfo)try{let o=Rt(e.clientInfo,this.cryptoUtils.base64Decode);n={credential:`${o.uid}${Tt}${o.utid}`,type:j.HOME_ACCOUNT_ID}}catch(o){this.logger.verbose(`Could not parse client info for CCS Header: '${o}'`,e.correlationId)}else n=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&n)switch(n.type){case j.HOME_ACCOUNT_ID:try{let o=Ae(n.credential);_e(t,o)}catch(o){this.logger.verbose(`Could not parse home account ID for CCS Header: '${o}'`,e.correlationId)}break;case j.UPN:Me(t,n.credential);break}return e.embeddedClientId&&Se(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&Ie(t,e.extraParameters),e.enableSpaAuthorizationCode&&(!e.extraParameters||!e.extraParameters[sn])&&Ie(t,{[sn]:"1"}),Qe(t,e.correlationId,this.performanceClient),et(t,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Te(t)}createLogoutUrlQueryString(e){let t=new Map;return e.postLogoutRedirectUri&&Gi(t,e.postLogoutRedirectUri),e.correlationId&&tt(t,e.correlationId),e.idTokenHint&&Vi(t,e.idTokenHint),e.state&&or(t,e.state),e.logoutHint&&Xi(t,e.logoutHint),e.extraQueryParameters&&Ie(t,e.extraQueryParameters),this.config.authOptions.instanceAware&&dr(t),Te(t)}async updateTokenEndpointAuthority(e,t){let n=`https://${e}/${this.authority.tenant}/`,o=await fs(n,this.networkClient,this.cacheManager,this.authority.options,this.logger,t,this.performanceClient);this.authority=o}};var Zh=300,st=class{constructor(e,t){this.config=Oe(e),this.logger=new B(this.config.loggerOptions,Pe,ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t}async acquireToken(e,t){let n=ee(),o=await C(this.executeTokenRequest.bind(this),Da,this.logger,this.performanceClient,e.correlationId)(e,this.authority),i=o.headers?.[b.X_MS_REQUEST_ID],s=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o.body,e.correlationId),C(s.handleServerTokenResponse.bind(s),Sn,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,n,e,t,void 0,void 0,!0,e.forceCache,i)}async acquireTokenByRefreshToken(e,t){if(!e)throw S(ua);if(!e.account)throw l(er);if(this.cacheManager.isAppMetadataFOCI(e.account.environment,e.correlationId))try{return await C(this.acquireTokenWithCachedRefreshToken.bind(this),In,this.logger,this.performanceClient,e.correlationId)(e,!0,t)}catch(o){let i=o instanceof ne&&o.errorCode===Zn,s=o instanceof Q&&o.errorCode===vo&&o.subError===bo;if(i||s)return C(this.acquireTokenWithCachedRefreshToken.bind(this),In,this.logger,this.performanceClient,e.correlationId)(e,!1,t);throw o}return C(this.acquireTokenWithCachedRefreshToken.bind(this),In,this.logger,this.performanceClient,e.correlationId)(e,!1,t)}async acquireTokenWithCachedRefreshToken(e,t,n){let o=qa(this.cacheManager.getRefreshToken.bind(this.cacheManager),Wa,this.logger,this.performanceClient,e.correlationId)(e.account,t,e.correlationId,void 0);if(!o)throw jr(Zn);if(o.expiresOn){let s=e.refreshTokenExpirationOffsetSeconds||Zh;if(this.performanceClient?.addFields({cacheRtExpiresOnSeconds:Number(o.expiresOn),rtOffsetSeconds:s},e.correlationId),wt(o.expiresOn,s))throw jr(Xs)}let i={...e,refreshToken:o.secret,authenticationScheme:e.authenticationScheme||k.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:j.HOME_ACCOUNT_ID}};try{return await C(this.acquireToken.bind(this),Ua,this.logger,this.performanceClient,e.correlationId)(i,n)}catch(s){if(s instanceof ne&&s.subError===Vr){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache",e.correlationId);let a=this.cacheManager.generateCredentialKey(o);this.cacheManager.removeRefreshToken(a,e.correlationId)}throw s}}async executeTokenRequest(e,t){let n=Sr(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),o=A.appendQueryString(t.tokenEndpoint,n),i=await C(this.createTokenRequestBody.bind(this),xa,this.logger,this.performanceClient,e.correlationId)(e),s=Ir(this.logger,this.config.systemOptions.preventCorsPreflight,e.ccsCredential),a=vt(this.config.authOptions.clientId,e);return C(Rr,Ma,this.logger,this.performanceClient,e.correlationId)(o,i,s,a,e.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async createTokenRequestBody(e){let t=new Map;if(Je(t,e.embeddedClientId||e.extraParameters?.[ge]||this.config.authOptions.clientId),e.redirectUri&&Ze(t,e.redirectUri),Xe(t,e.scopes,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),cr(t,Wt.REFRESH_TOKEN_GRANT),rt(t),rr(t,this.config.libraryInfo),nr(t,this.config.telemetry.application),fr(t),this.serverTelemetryManager&&!yn(this.config)&&ur(t,this.serverTelemetryManager),Wi(t,e.refreshToken),this.config.clientCredentials.clientSecret&&ir(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let n=this.config.clientCredentials.clientAssertion;sr(t,await z(n.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),ar(t,n.assertionType)}if(e.authenticationScheme===k.POP){let n=new xe(this.cryptoUtils,this.performanceClient),o;e.popKid?o=this.cryptoUtils.encodeKid(e.popKid):o=(await C(n.generateCnf.bind(n),Nt,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,lr(t,o)}else if(e.authenticationScheme===k.SSH)if(e.sshJwk)hr(t,e.sshJwk);else throw S(dn);if(this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case j.HOME_ACCOUNT_ID:try{let n=Ae(e.ccsCredential.credential);_e(t,n)}catch(n){this.logger.verbose(`Could not parse home account ID for CCS Header: '${n}'`,e.correlationId)}break;case j.UPN:Me(t,e.ccsCredential.credential);break}return e.embeddedClientId&&Se(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&Ie(t,{...e.extraParameters}),Qe(t,e.correlationId,this.performanceClient),et(t,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Te(t)}};var kr=class{constructor(e,t){this.config=Oe(e),this.logger=new B(this.config.loggerOptions,Pe,ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t}async acquireCachedToken(e){let t=le.NOT_APPLICABLE;if(e.forceRefresh||!w.isEmptyObj(e.claims))throw this.setCacheOutcome(le.FORCE_REFRESH_OR_CLAIMS,e.correlationId),l(It);if(!e.account)throw l(er);let n=e.account.tenantId||rc(e.authority),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,n);if(i){if(is(i.cachedAt)||wt(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(le.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),l(It);if(e.resource){if(i.resource!==e.resource)throw this.setCacheOutcome(le.NO_CACHED_ACCESS_TOKEN,e.correlationId),l(It)}else i.refreshOn&&wt(i.refreshOn,0)&&(t=le.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(le.NO_CACHED_ACCESS_TOKEN,e.correlationId),l(It);let s=e.authority||this.authority.getPreferredCache(),a={account:this.cacheManager.getAccount(this.cacheManager.generateAccountKey(e.account),e.correlationId),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,e.correlationId,o,n),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCache(s,e.correlationId)};return this.setCacheOutcome(t,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[await C(this.generateResultFromCacheRecord.bind(this),La,this.logger,this.performanceClient,e.correlationId)(a,e),t]}setCacheOutcome(e,t){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},t),e!==le.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: '${e}'`,t)}async generateResultFromCacheRecord(e,t){let n;if(e.idToken&&(n=Re(e.idToken.secret,this.config.cryptoInterface.base64Decode)),t.maxAge||t.maxAge===0){let o=n?.auth_time;if(!o)throw l(Zt);pr(o,t.maxAge)}return M.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,t,this.performanceClient,n)}};var Nr={};J(Nr,{getAuthorizationCodePayload:()=>ru,getAuthorizeUrl:()=>tu,getStandardAuthorizeRequestParameters:()=>eu,validateAuthorizationResponse:()=>nc});function eu(r,e,t,n){let o=e.correlationId,i=new Map;Je(i,e.embeddedClientId||e.extraQueryParameters?.[ge]||r.clientId);let s=[...e.scopes||[],...e.extraScopesToConsent||[]];if(Xe(i,s,!0,r.authority.options.OIDCOptions?.defaultScopes),mr(i,e.resource),Ze(i,e.redirectUri),tt(i,o),Ki(i,e.responseMode),rt(i),Qi(i),e.prompt&&(ji(i,e.prompt),n?.addFields({prompt:e.prompt},o)),e.domainHint&&($i(i,e.domainHint),n?.addFields({domainHintFromRequest:!0},o)),e.prompt!==Yt.SELECT_ACCOUNT)if(e.sid&&e.prompt===Yt.NONE)t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request",e.correlationId),pn(i,e.sid),n?.addFields({sidFromRequest:!0},o);else if(e.account){let a=ou(e.account),d=iu(e.account);if(d&&e.domainHint&&(t.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint',e.correlationId),d=null),d){t.verbose("createAuthCodeUrlQueryString: login_hint claim present on account",e.correlationId),St(i,d),n?.addFields({loginHintFromClaim:!0},o);try{let c=Ae(e.account.homeAccountId);_e(i,c)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(a&&e.prompt===Yt.NONE){t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account",e.correlationId),pn(i,a),n?.addFields({sidFromClaim:!0},o);try{let c=Ae(e.account.homeAccountId);_e(i,c)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(e.loginHint)t.verbose("createAuthCodeUrlQueryString: Adding login_hint from request",e.correlationId),St(i,e.loginHint),Me(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o);else if(e.account.username){t.verbose("createAuthCodeUrlQueryString: Adding login_hint from account",e.correlationId),St(i,e.account.username),n?.addFields({loginHintFromUpn:!0},o);try{let c=Ae(e.account.homeAccountId);_e(i,c)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}}else e.loginHint&&(t.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request",e.correlationId),St(i,e.loginHint),Me(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o));else t.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints",e.correlationId);return e.nonce&&zi(i,e.nonce),e.state&&or(i,e.state),e.embeddedClientId&&Se(i,r.clientId,r.redirectUri),et(i,e.claims,r.clientCapabilities,e.skipBrokerClaims),r.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(_t))&&dr(i),i}function tu(r,e){let t=Te(e);return A.appendQueryString(r.authorizationEndpoint,t)}function ru(r,e){if(nc(r,e),!r.code)throw l(xi);return r}function nc(r,e){if(!r.state||!e)throw r.state?l(fn,"Cached State"):l(fn,"Server State");let t,n;try{t=decodeURIComponent(r.state)}catch{throw l(qe,r.state)}try{n=decodeURIComponent(e)}catch{throw l(qe,r.state)}if(t!==n)throw l(Oi);if(r.error||r.error_description||r.suberror){let o=nu(r);throw $r(r.error,r.error_description,r.suberror)?new ne(r.error||"",r.error_description,r.suberror,r.timestamp||"",r.trace_id||"",r.correlation_id||"",r.claims||"",o):new Q(r.error||"",r.error_description,r.suberror,o)}}function nu(r){let e="code=",t=r.error_uri?.lastIndexOf(e);return t&&t>=0?r.error_uri?.substring(t+e.length):void 0}function ou(r){return r.idTokenClaims?.sid||null}function iu(r){return r.loginHint||r.idTokenClaims?.login_hint||null}function at(r,e){if(r){if(e.resource&&(oc(e.extraParameters)||oc(e.extraQueryParameters)))throw l(Bi);if(!e.resource)throw l(Fi)}}function oc(r){return r?Object.prototype.hasOwnProperty.call(r,"resource"):!1}var vr={};J(vr,{postRequestFailed:()=>au,unexpectedError:()=>su});var su="unexpected_error",au="post_request_failed";var ic=",",sc="|";function cu(r){let{skus:e,libraryName:t,libraryVersion:n,extensionName:o,extensionVersion:i}=r,s=new Map([[0,[t,n]],[2,[o,i]]]),a=[];if(e?.length){if(a=e.split(ic),a.length<4)return e}else a=Array.from({length:4},()=>sc);return s.forEach((d,c)=>{d.length===2&&d[0]?.length&&d[1]?.length&&du({skuArr:a,index:c,skuName:d[0],skuVersion:d[1]})}),a.join(ic)}function du(r){let{skuArr:e,index:t,skuName:n,skuVersion:o}=r;t>=e.length||(e[t]=[n,o].join(sc))}var ct=class r{constructor(e,t){this.cacheOutcome=le.NOT_APPLICABLE,this.cacheManager=t,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||"",this.wrapperVer=e.wrapperVer||"",this.telemetryCacheKey=qt+ze+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${ve}${this.cacheOutcome}`,t=[this.wrapperSKU,this.wrapperVer],n=this.getNativeBrokerErrorCode();n?.length&&t.push(`broker_error=${n}`);let o=t.join(ve),i=this.getRegionDiscoveryFields(),s=[e,i].join(ve);return[Zr,s,o].join(en)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),t=r.maxErrorsToSend(e),n=e.failedRequests.slice(0,2*t).join(ve),o=e.errors.slice(0,t).join(ve),i=e.errors.length,s=t<i?So:Ro,a=[i,s].join(ve);return[Zr,e.cacheHits,n,o,a].join(en)}cacheFailedRequest(e){let t=this.getLastRequests();t.errors.length>=Io&&(t.failedRequests.shift(),t.failedRequests.shift(),t.errors.shift()),t.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof T?e.subError?t.errors.push(e.subError):e.errorCode?t.errors.push(e.errorCode):t.errors.push(e.toString()):t.errors.push(e.toString()):t.errors.push(Oo),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t,this.correlationId)}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey,this.correlationId)||e}clearTelemetryCache(){let e=this.getLastRequests(),t=r.maxErrorsToSend(e),n=e.errors.length;if(t===n)this.cacheManager.removeItem(this.telemetryCacheKey,this.correlationId);else{let o={failedRequests:e.failedRequests.slice(t*2),errors:e.errors.slice(t),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o,this.correlationId)}}static maxErrorsToSend(e){let t,n=0,o=0,i=e.errors.length;for(t=0;t<i;t++){let s=e.failedRequests[2*t]||"",a=e.failedRequests[2*t+1]||"",d=e.errors[t]||"";if(o+=s.toString().length+a.toString().length+d.length+3,o<_o)n+=1;else break}return n}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||""),e.push(this.regionSource||""),e.push(this.regionOutcome||""),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let t=this.getLastRequests();t.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t,this.correlationId)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId)}static makeExtraSkuString(e){return cu(e)}};var lu="managed_identity",hu=`https://login.microsoftonline.com/${lu}/`,Mt={AUTHORIZATION_HEADER_NAME:"Authorization",METADATA_HEADER_NAME:"Metadata",APP_SERVICE_SECRET_HEADER_NAME:"X-IDENTITY-HEADER",ML_AND_SF_SECRET_HEADER_NAME:"secret",CLIENT_SKU:Ee.X_CLIENT_SKU,CLIENT_VER:Ee.X_CLIENT_VER,CLIENT_REQUEST_ID:"x-ms-client-request-id"},ke={API_VERSION:"api-version",RESOURCE:"resource",SHA256_TOKEN_TO_REFRESH:"token_sha256_to_refresh",XMS_CC:"xms_cc"},K={AZURE_POD_IDENTITY_AUTHORITY_HOST:"AZURE_POD_IDENTITY_AUTHORITY_HOST",DEFAULT_IDENTITY_CLIENT_ID:"DEFAULT_IDENTITY_CLIENT_ID",IDENTITY_ENDPOINT:"IDENTITY_ENDPOINT",IDENTITY_HEADER:"IDENTITY_HEADER",IDENTITY_SERVER_THUMBPRINT:"IDENTITY_SERVER_THUMBPRINT",IMDS_ENDPOINT:"IMDS_ENDPOINT",MSI_ENDPOINT:"MSI_ENDPOINT",MSI_SECRET:"MSI_SECRET"},ue={APP_SERVICE:"AppService",AZURE_ARC:"AzureArc",CLOUD_SHELL:"CloudShell",DEFAULT_TO_IMDS:"DefaultToImds",IMDS:"Imds",MACHINE_LEARNING:"MachineLearning",SERVICE_FABRIC:"ServiceFabric"},fe={SYSTEM_ASSIGNED:"system-assigned",USER_ASSIGNED_CLIENT_ID:"user-assigned-client-id",USER_ASSIGNED_RESOURCE_ID:"user-assigned-resource-id",USER_ASSIGNED_OBJECT_ID:"user-assigned-object-id"},G={GET:"GET",POST:"POST"},ac="REGION_NAME",cc="MSAL_FORCE_REGION",dc=32,lc={SHA256:"sha256"},wn={CV_CHARSET:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"},ms={KEY_SEPARATOR:"-"},te={MSAL_SKU:"msal.js.node",JWT_BEARER_ASSERTION_TYPE:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",HTTP_PROTOCOL:"http://",LOCALHOST:"localhost"},N={acquireTokenSilent:62,acquireTokenByUsernamePassword:371,acquireTokenByDeviceCode:671,acquireTokenByClientCredential:771,acquireTokenByOBO:772,acquireTokenWithManagedIdentity:773,acquireTokenByCode:871,acquireTokenByRefreshToken:872},se={RSA_256:"RS256",PSS_256:"PS256",X5T_256:"x5t#S256",X5T:"x5t",X5C:"x5c",AUDIENCE:"aud",EXPIRATION_TIME:"exp",ISSUER:"iss",SUBJECT:"sub",NOT_BEFORE:"nbf",JWT_ID:"jti"},kn={INTERVAL_MS:100,TIMEOUT_MS:5e3};var br=class{async sendGetRequestAsync(e,t,n){return this.sendRequest(e,G.GET,t,n)}async sendPostRequestAsync(e,t){return this.sendRequest(e,G.POST,t)}async sendRequest(e,t,n,o){let i=new AbortController,s;o&&(s=setTimeout(()=>{i.abort()},o));let a={method:t,headers:fu(n),signal:i.signal};t===G.POST&&(a.body=n?.body||"");let d;try{d=await fetch(e,a)}catch(c){if(s&&clearTimeout(s),c instanceof Error&&c.name==="AbortError")throw Ve(x.networkError,"Request timeout");let u=Ve(x.networkError,`Network request failed: ${c instanceof Error?c.message:"unknown"}`);throw hs(u,void 0,void 0,c instanceof Error?c:void 0)}s&&clearTimeout(s);try{return{headers:uu(d.headers),body:await d.json(),status:d.status}}catch(c){throw Ve(x.tokenParsingError,`Failed to parse response: ${c instanceof Error?c.message:"unknown"}`)}}};function uu(r){let e={};return r.forEach((t,n)=>{e[n]=t}),e}function fu(r){let e=new Headers;return r&&r.headers&&Object.entries(r.headers).forEach(([t,n])=>{e.append(t,n)}),e}var ps="invalid_file_extension",gs="invalid_file_path",Mr="invalid_managed_identity_id_type",Es="invalid_secret",hc="missing_client_id",uc="network_unavailable",Ts="platform_not_supported",ys="unable_to_create_azure_arc",As="unable_to_create_cloud_shell",Cs="unable_to_create_source",_s="unable_to_read_secret_file",fc="user_assigned_not_available_at_runtime",Is="www_authenticate_header_missing",Ss="www_authenticate_header_unsupported_format",dt={[K.AZURE_POD_IDENTITY_AUTHORITY_HOST]:"azure_pod_identity_authority_host_url_malformed",[K.IDENTITY_ENDPOINT]:"identity_endpoint_url_malformed",[K.IMDS_ENDPOINT]:"imds_endpoint_url_malformed",[K.MSI_ENDPOINT]:"msi_endpoint_url_malformed"};var mu={[ps]:"The file path in the WWW-Authenticate header does not contain a .key file.",[gs]:"The file path in the WWW-Authenticate header is not in a valid Windows or Linux Format.",[Mr]:"More than one ManagedIdentityIdType was provided.",[Es]:"The secret in the file on the file path in the WWW-Authenticate header is greater than 4096 bytes.",[Ts]:"The platform is not supported by Azure Arc. Azure Arc only supports Windows and Linux.",[hc]:"A ManagedIdentityId id was not provided.",[dt.AZURE_POD_IDENTITY_AUTHORITY_HOST]:`The Managed Identity's '${K.AZURE_POD_IDENTITY_AUTHORITY_HOST}' environment variable is malformed.`,[dt.IDENTITY_ENDPOINT]:`The Managed Identity's '${K.IDENTITY_ENDPOINT}' environment variable is malformed.`,[dt.IMDS_ENDPOINT]:`The Managed Identity's '${K.IMDS_ENDPOINT}' environment variable is malformed.`,[dt.MSI_ENDPOINT]:`The Managed Identity's '${K.MSI_ENDPOINT}' environment variable is malformed.`,[uc]:"Authentication unavailable. The request to the managed identity endpoint timed out.",[ys]:"Azure Arc Managed Identities can only be system assigned.",[As]:"Cloud Shell Managed Identities can only be system assigned.",[Cs]:"Unable to create a Managed Identity source based on environment variables.",[_s]:"Unable to read the secret file.",[fc]:"Service Fabric user assigned managed identity ClientId or ResourceId is not configurable at runtime.",[Is]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is missing.",[Ss]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format."},Rs=class r extends T{constructor(e){super(e,mu[e]),this.name="ManagedIdentityError",Object.setPrototypeOf(this,r.prototype)}};function lt(r){return new Rs(r)}var D={invalidLoopbackAddressType:{code:"invalid_loopback_server_address_type",desc:"Loopback server address is not type string. This is unexpected."},unableToLoadRedirectUri:{code:"unable_to_load_redirectUrl",desc:"Loopback server callback was invoked without a url. This is unexpected."},noAuthCodeInResponse:{code:"no_auth_code_in_response",desc:"No auth code found in the server response. Please check your network trace to determine what happened."},noLoopbackServerExists:{code:"no_loopback_server_exists",desc:"No loopback server exists yet."},loopbackServerAlreadyExists:{code:"loopback_server_already_exists",desc:"Loopback server already exists. Cannot create another."},loopbackServerTimeout:{code:"loopback_server_timeout",desc:"Timed out waiting for auth code listener to be registered."},stateNotFoundError:{code:"state_not_found",desc:"State not found. Please verify that the request originated from msal."},thumbprintMissing:{code:"thumbprint_missing_from_client_certificate",desc:"Client certificate does not contain a SHA-1 or SHA-256 thumbprint."},redirectUriNotSupported:{code:"redirect_uri_not_supported",desc:"RedirectUri is not supported in this scenario. Please remove redirectUri from the request."}},V=class r extends T{constructor(e,t){super(e,t),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new r(D.invalidLoopbackAddressType.code,`${D.invalidLoopbackAddressType.desc}`)}static createUnableToLoadRedirectUrlError(){return new r(D.unableToLoadRedirectUri.code,`${D.unableToLoadRedirectUri.desc}`)}static createNoAuthCodeInResponseError(){return new r(D.noAuthCodeInResponse.code,`${D.noAuthCodeInResponse.desc}`)}static createNoLoopbackServerExistsError(){return new r(D.noLoopbackServerExists.code,`${D.noLoopbackServerExists.desc}`)}static createLoopbackServerAlreadyExistsError(){return new r(D.loopbackServerAlreadyExists.code,`${D.loopbackServerAlreadyExists.desc}`)}static createLoopbackServerTimeoutError(){return new r(D.loopbackServerTimeout.code,`${D.loopbackServerTimeout.desc}`)}static createStateNotFoundError(){return new r(D.stateNotFoundError.code,D.stateNotFoundError.desc)}static createThumbprintMissingError(){return new r(D.thumbprintMissing.code,D.thumbprintMissing.desc)}static createRedirectUriNotSupportedError(){return new r(D.redirectUriNotSupported.code,D.redirectUriNotSupported.desc)}};var pu={clientId:"",authority:f.DEFAULT_AUTHORITY,clientSecret:"",clientAssertion:"",clientCertificate:{thumbprint:"",thumbprintSha256:"",privateKey:"",x5c:""},knownAuthorities:[],cloudDiscoveryMetadata:"",authorityMetadata:"",clientCapabilities:[],azureCloudOptions:{azureCloudInstance:De.None,tenant:""},isMcp:!1},mc={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:v.Info},gu={loggerOptions:mc,networkClient:new br,disableInternalRetries:!1,protocolMode:Z.AAD},Eu={application:{appName:"",appVersion:""}};function pc({auth:r,broker:e,cache:t,system:n,telemetry:o}){let i={...gu,networkClient:new br,loggerOptions:n?.loggerOptions||mc,disableInternalRetries:n?.disableInternalRetries||!1};if(r.clientCertificate&&!r.clientCertificate.thumbprint&&!r.clientCertificate.thumbprintSha256)throw V.createStateNotFoundError();return{auth:{...pu,...r},broker:{...e},cache:{...t},system:{...i,...n},telemetry:{...Eu,...o}}}import{randomUUID as Tu}from"node:crypto";var Pt=class{generateGuid(){return Tu()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}};var re=class r{static base64Encode(e,t){return Buffer.from(e,t).toString(f.EncodingTypes.BASE64)}static base64EncodeUrl(e,t){return r.base64Encode(e,t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,f.EncodingTypes.BASE64).toString("utf8")}static base64DecodeUrl(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");for(;t.length%4;)t+="=";return r.base64Decode(t)}};import yu from"crypto";var ht=class{sha256(e){return yu.createHash(lc.SHA256).update(e).digest()}};import Au from"crypto";var Nn=class{constructor(){this.hashUtils=new ht}async generatePkceCodes(){let e=this.generateCodeVerifier(),t=this.generateCodeChallengeFromVerifier(e);return{verifier:e,challenge:t}}generateCodeVerifier(){let e=[],t=256-256%wn.CV_CHARSET.length;for(;e.length<=dc;){let o=Au.randomBytes(1)[0];if(o>=t)continue;let i=o%wn.CV_CHARSET.length;e.push(wn.CV_CHARSET[i])}let n=e.join("");return re.base64EncodeUrl(n)}generateCodeChallengeFromVerifier(e){return re.base64EncodeUrl(this.hashUtils.sha256(e).toString(f.EncodingTypes.BASE64),f.EncodingTypes.BASE64)}};var Le=class{constructor(){this.pkceGenerator=new Nn,this.guidGenerator=new Pt,this.hashUtils=new ht}base64UrlEncode(){throw new Error("Method not implemented.")}encodeKid(){throw new Error("Method not implemented.")}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return re.base64Encode(e)}base64Decode(e){return re.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return re.base64EncodeUrl(this.hashUtils.sha256(e).toString(f.EncodingTypes.BASE64),f.EncodingTypes.BASE64)}};var He=class{static deserializeJSONBlob(e){return e?JSON.parse(e):{}}static deserializeAccounts(e){let t={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,realm:o.realm,localAccountId:o.local_account_id,username:o.username,authorityType:o.authority_type,name:o.name,clientInfo:o.client_info,lastModificationTime:o.last_modification_time,lastModificationApp:o.last_modification_app,tenantProfiles:o.tenantProfiles?.map(a=>JSON.parse(a)),lastUpdatedAt:Date.now().toString()},s={};Ue.toObject(s,i),t[n]=s}),t}static deserializeIdTokens(e){let t={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,lastUpdatedAt:Date.now().toString()};t[n]=i}),t}static deserializeAccessTokens(e){let t={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,target:o.target,cachedAt:o.cached_at,expiresOn:o.expires_on,extendedExpiresOn:o.extended_expires_on,refreshOn:o.refresh_on,keyId:o.key_id,tokenType:o.token_type,userAssertionHash:o.userAssertionHash,resource:o.resource,lastUpdatedAt:Date.now().toString()};t[n]=i}),t}static deserializeRefreshTokens(e){let t={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,familyId:o.family_id,target:o.target,realm:o.realm,lastUpdatedAt:Date.now().toString()};t[n]=i}),t}static deserializeAppMetadata(e){let t={};return e&&Object.keys(e).map(function(n){let o=e[n];t[n]={clientId:o.client_id,environment:o.environment,familyId:o.family_id}}),t}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}};var ut=class{static serializeJSONBlob(e){return JSON.stringify(e)}static serializeAccounts(e){let t={};return Object.keys(e).map(function(n){let o=e[n];t[n]={home_account_id:o.homeAccountId,environment:o.environment,realm:o.realm,local_account_id:o.localAccountId,username:o.username,authority_type:o.authorityType,name:o.name,client_info:o.clientInfo,last_modification_time:o.lastModificationTime,last_modification_app:o.lastModificationApp,tenantProfiles:o.tenantProfiles?.map(i=>JSON.stringify(i))}}),t}static serializeIdTokens(e){let t={};return Object.keys(e).map(function(n){let o=e[n];t[n]={home_account_id:o.homeAccountId,environment:o.environment,credential_type:o.credentialType,client_id:o.clientId,secret:o.secret,realm:o.realm}}),t}static serializeAccessTokens(e){let t={};return Object.keys(e).map(function(n){let o=e[n];t[n]={home_account_id:o.homeAccountId,environment:o.environment,credential_type:o.credentialType,client_id:o.clientId,secret:o.secret,realm:o.realm,target:o.target,cached_at:o.cachedAt,expires_on:o.expiresOn,extended_expires_on:o.extendedExpiresOn,refresh_on:o.refreshOn,key_id:o.keyId,token_type:o.tokenType,userAssertionHash:o.userAssertionHash,resource:o.resource}}),t}static serializeRefreshTokens(e){let t={};return Object.keys(e).map(function(n){let o=e[n];t[n]={home_account_id:o.homeAccountId,environment:o.environment,credential_type:o.credentialType,client_id:o.clientId,secret:o.secret,family_id:o.familyId,target:o.target,realm:o.realm}}),t}static serializeAppMetadata(e){let t={};return Object.keys(e).map(function(n){let o=e[n];t[n]={client_id:o.clientId,environment:o.environment,family_id:o.familyId}}),t}static serializeAllCache(e){return{Account:this.serializeAccounts(e.accounts),IdToken:this.serializeIdTokens(e.idTokens),AccessToken:this.serializeAccessTokens(e.accessTokens),RefreshToken:this.serializeRefreshTokens(e.refreshTokens),AppMetadata:this.serializeAppMetadata(e.appMetadata)}}};function gc(r){let e=r.credentialType===f.CredentialType.REFRESH_TOKEN&&r.familyId||r.clientId,t=r.tokenType&&r.tokenType.toLowerCase()!==f.AuthenticationScheme.BEARER.toLowerCase()?r.tokenType.toLowerCase():"";return[r.homeAccountId,r.environment,r.credentialType,e,r.realm||"",r.target||"",t].join(ms.KEY_SEPARATOR).toLowerCase()}function Ec(r){let e=r.homeAccountId.split(".")[1];return[r.homeAccountId,r.environment,e||r.tenantId||""].join(ms.KEY_SEPARATOR).toLowerCase()}var ft=class extends Ue{constructor(e,t,n,o){super(t,n,e,new L,o),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){let t={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(let n in e){let o=e[n];if(typeof o=="object")if(Tr.isAccountEntity(o))t.accounts[n]=o;else if($.isIdTokenEntity(o))t.idTokens[n]=o;else if($.isAccessTokenEntity(o))t.accessTokens[n]=o;else if($.isRefreshTokenEntity(o))t.refreshTokens[n]=o;else if($.isAppMetadataEntity(n,o))t.appMetadata[n]=o;else continue}return t}inMemoryCacheToCache(e){let t=this.getCache();return t={...t,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},t}getInMemoryCache(){return this.logger.trace("Getting in-memory cache",""),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache","");let t=this.inMemoryCacheToCache(e);this.setCache(t),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store",""),this.cache}setCache(e){this.logger.trace("Setting cache key value store",""),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii(`Item key: ${e}`,""),this.getCache()[e]}setItem(e,t){this.logger.tracePii(`Item key: ${e}`,"");let n=this.getCache();n[e]=t,this.setCache(n)}generateCredentialKey(e){return gc(e)}generateAccountKey(e){return Ec(e)}getAccountKeys(){let e=this.getInMemoryCache();return Object.keys(e.accounts)}getTokenKeys(){let e=this.getInMemoryCache();return{idToken:Object.keys(e.idTokens),accessToken:Object.keys(e.accessTokens),refreshToken:Object.keys(e.refreshTokens)}}getAccount(e){let t=this.getItem(e);return t&&typeof t=="object"?{...t}:null}async setAccount(e){let t=this.generateAccountKey(Tr.getAccountInfo(e));this.setItem(t,e)}getIdTokenCredential(e){let t=this.getItem(e);return $.isIdTokenEntity(t)?t:null}async setIdTokenCredential(e){let t=this.generateCredentialKey(e);this.setItem(t,e)}getAccessTokenCredential(e){let t=this.getItem(e);return $.isAccessTokenEntity(t)?t:null}async setAccessTokenCredential(e){let t=this.generateCredentialKey(e);this.setItem(t,e)}getRefreshTokenCredential(e){let t=this.getItem(e);return $.isRefreshTokenEntity(t)?t:null}async setRefreshTokenCredential(e){let t=this.generateCredentialKey(e);this.setItem(t,e)}getAppMetadata(e){let t=this.getItem(e);return $.isAppMetadataEntity(e,t)?t:null}setAppMetadata(e){let t=$.generateAppMetadataKey(e);this.setItem(t,e)}getServerTelemetry(e){let t=this.getItem(e);return t&&$.isServerTelemetryEntity(e,t)?t:null}setServerTelemetry(e,t){this.setItem(e,t)}getAuthorityMetadata(e){let t=this.getItem(e);return t&&$.isAuthorityMetadataEntity(e,t)?t:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,t){this.setItem(e,t)}getThrottlingCache(e){let t=this.getItem(e);return t&&$.isThrottlingEntity(e,t)?t:null}setThrottlingCache(e,t){this.setItem(e,t)}removeItem(e){this.logger.tracePii(`Item key: ${e}`,"");let t=!1,n=this.getCache();return n[e]&&(delete n[e],t=!0),t&&(this.setCache(n),this.emitChange()),t}removeOutdatedAccount(e){this.removeItem(e)}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys","");let e=this.getCache();return[...Object.keys(e)]}clear(){this.logger.trace("Clearing cache entries created by MSAL",""),this.getKeys().forEach(t=>{this.isAuthorityMetadata(t)||this.removeItem(t)}),this.emitChange()}static generateInMemoryCache(e){return He.deserializeAllCache(He.deserializeJSONBlob(e))}static generateJsonCache(e){return ut.serializeAllCache(e)}updateCredentialCacheKey(e,t){let n=this.generateCredentialKey(t);if(e!==n){let o=this.getItem(e);if(o)return this.removeItem(e),this.setItem(n,o),this.logger.verbose(`Updated an outdated ${t.credentialType} cache key`,""),n;this.logger.error(`Attempted to update an outdated ${t.credentialType} cache key but no item matching the outdated key was found in storage`,"")}return e}};var Pr={Account:{},IdToken:{},AccessToken:{},RefreshToken:{},AppMetadata:{}},Dr=class{constructor(e,t,n){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),n&&(this.persistence=n),this.logger=t}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache","");let e=ut.serializeAllCache(this.storage.getInMemoryCache());return this.cacheSnapshot?(this.logger.trace("Reading cache snapshot from disk",""),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)):this.logger.trace("No cache snapshot to merge",""),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache",""),this.cacheSnapshot=e,this.cacheSnapshot){this.logger.trace("Reading cache snapshot from disk","");let t=He.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(t)}else this.logger.trace("No cache snapshot to deserialize","")}getKVStore(){return this.storage.getCache()}getCacheSnapshot(){let e=ft.generateInMemoryCache(this.cacheSnapshot);return this.storage.inMemoryCacheToCache(e)}async getAllAccounts(e=new Le().createNewGuid()){this.logger.trace("getAllAccounts called",e);let t;try{return this.persistence&&(t=new ie(this,!1),await this.persistence.beforeCacheAccess(t)),this.storage.getAllAccounts({},e)}finally{this.persistence&&t&&await this.persistence.afterCacheAccess(t)}}async getAccountByHomeId(e){let t=await this.getAllAccounts();return e&&t&&t.length&&t.filter(n=>n.homeAccountId===e)[0]||null}async getAccountByLocalId(e){let t=await this.getAllAccounts();return e&&t&&t.length&&t.filter(n=>n.localAccountId===e)[0]||null}async removeAccount(e,t){this.logger.trace("removeAccount called",t||"");let n;try{this.persistence&&(n=new ie(this,!0),await this.persistence.beforeCacheAccess(n)),this.storage.removeAccount(e,t||new Pt().generateGuid())}finally{this.persistence&&n&&await this.persistence.afterCacheAccess(n)}}async overwriteCache(){if(!this.persistence){this.logger.info("No persistence layer specified, cache cannot be overwritten","");return}this.logger.info("Overwriting in-memory cache with persistent cache",""),this.storage.clear();let e=new ie(this,!1);await this.persistence.beforeCacheAccess(e);let t=this.getCacheSnapshot();this.storage.setCache(t),await this.persistence.afterCacheAccess(e)}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,t){this.logger.trace("Merging in-memory cache with cache snapshot","");let n=this.mergeRemovals(e,t);return this.mergeUpdates(n,t)}mergeUpdates(e,t){return Object.keys(t).forEach(n=>{let o=t[n];if(!e.hasOwnProperty(n))o!==null&&(e[n]=o);else{let i=o!==null,s=typeof o=="object",a=!Array.isArray(o),d=typeof e[n]<"u"&&e[n]!==null;i&&s&&a&&d?this.mergeUpdates(e[n],o):e[n]=o}}),e}mergeRemovals(e,t){this.logger.trace("Remove updated entries in cache","");let n=e.Account?this.mergeRemovalsDict(e.Account,t.Account):e.Account,o=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,t.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,t.RefreshToken):e.RefreshToken,s=e.IdToken?this.mergeRemovalsDict(e.IdToken,t.IdToken):e.IdToken,a=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,t.AppMetadata):e.AppMetadata;return{...e,Account:n,AccessToken:o,RefreshToken:i,IdToken:s,AppMetadata:a}}mergeRemovalsDict(e,t){let n={...e};return Object.keys(e).forEach(o=>{(!t||!t.hasOwnProperty(o))&&delete n[o]}),n}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache",""),{Account:{...Pr.Account,...e.Account},IdToken:{...Pr.IdToken,...e.IdToken},AccessToken:{...Pr.AccessToken,...e.AccessToken},RefreshToken:{...Pr.RefreshToken,...e.RefreshToken},AppMetadata:{...Pr.AppMetadata,...e.AppMetadata}}}};var ll=fl(nl(),1);var ol="missing_tenant_id_error",il="user_timeout_reached",sl="invalid_assertion",Ws="invalid_client_credential",al="device_code_polling_cancelled",cl="device_code_expired",dl="device_code_unknown_error";var Ke=class r{static fromAssertion(e){let t=new r;return t.jwt=e,t}static fromCertificate(e,t,n){let o=new r;return o.privateKey=t,o.thumbprint=e,o.useSha256=!1,n&&(o.publicCertificate=this.parseCertificate(n)),o}static fromCertificateWithSha256Thumbprint(e,t,n){let o=new r;return o.privateKey=t,o.thumbprint=e,o.useSha256=!0,n&&(o.publicCertificate=this.parseCertificate(n)),o}getJwt(e,t,n){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&t===this.issuer&&n===this.jwtAudience?this.jwt:this.createJwt(e,t,n);if(this.jwt)return this.jwt;throw l(sl)}createJwt(e,t,n){this.issuer=t,this.jwtAudience=n;let o=O.nowSeconds();this.expirationTime=o+600;let s={alg:this.useSha256?se.PSS_256:se.RSA_256},a=this.useSha256?se.X5T_256:se.X5T;Object.assign(s,{[a]:re.base64EncodeUrl(this.thumbprint,f.EncodingTypes.HEX)}),this.publicCertificate&&Object.assign(s,{[se.X5C]:this.publicCertificate});let d={[se.AUDIENCE]:this.jwtAudience,[se.EXPIRATION_TIME]:this.expirationTime,[se.ISSUER]:this.issuer,[se.SUBJECT]:this.issuer,[se.NOT_BEFORE]:o,[se.JWT_ID]:e.createNewGuid()};return this.jwt=ll.default.sign(d,this.privateKey,{header:s}),this.jwt}isExpired(){return this.expirationTime<O.nowSeconds()}static parseCertificate(e){let t=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,n=[],o;for(;(o=t.exec(e))!==null;)n.push(o[1].replace(/\r*\n/g,""));return n}};var Fr="@azure/msal-node",ce="5.2.2";var Ce=class{constructor(e){this.config=Oe(e),this.logger=new B(this.config.loggerOptions,Fr,ce),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=new L}createTokenRequestHeaders(e){return it.createTokenRequestHeaders(this.logger,!1,e)}async executePostToTokenEndpoint(e,t,n,o,i){return it.executePostToTokenEndpoint(e,t,n,o,i,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async sendPostRequest(e,t,n,o){return it.sendPostRequest(e,t,n,o,this.cacheManager,this.networkClient,this.logger,this.performanceClient)}createTokenQueryParameters(e){return it.createTokenQueryParameters(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient)}};var zn=class extends Ce{constructor(e){super(e)}async acquireToken(e){this.logger.info("in acquireToken call in username-password client",e.correlationId);let t=O.nowSeconds(),n=await this.executeTokenRequest(this.authority,e),o=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return o.validateTokenResponse(n.body,e.correlationId),o.handleServerTokenResponse(n.body,this.authority,t,e,N.acquireTokenByUsernamePassword)}async executeTokenRequest(e,t){let n=this.createTokenQueryParameters(t),o=A.appendQueryString(e.tokenEndpoint,n),i=await this.createTokenRequestBody(t),s=this.createTokenRequestHeaders({credential:t.username,type:j.UPN}),a={clientId:this.config.authOptions.clientId,authority:e.canonicalAuthority,scopes:t.scopes,claims:t.claims,authenticationScheme:t.authenticationScheme,resourceRequestMethod:t.resourceRequestMethod,resourceRequestUri:t.resourceRequestUri,shrClaims:t.shrClaims,sshKid:t.sshKid};return this.executePostToTokenEndpoint(o,i,s,a,t.correlationId)}async createTokenRequestBody(e){let t=new Map;m.addClientId(t,this.config.authOptions.clientId),m.addUsername(t,e.username),m.addPassword(t,e.password),m.addScopes(t,e.scopes),m.addResponseType(t,f.OAuthResponseType.IDTOKEN_TOKEN),m.addGrantType(t,f.GrantType.RESOURCE_OWNER_PASSWORD_GRANT),m.addClientInfo(t),m.addLibraryInfo(t,this.config.libraryInfo),m.addApplicationTelemetry(t,this.config.telemetry.application),m.addThrottling(t),this.serverTelemetryManager&&m.addServerTelemetry(t,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();m.addCorrelationId(t,n),this.config.clientCredentials.clientSecret&&m.addClientSecret(t,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(m.addClientAssertion(t,await z(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),m.addClientAssertionType(t,o.assertionType)),(!w.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&m.addClaims(t,e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.username&&m.addCcsUpn(t,e.username),q.mapToQueryString(t)}};function hl(r,e,t,n){let o=Nr.getStandardAuthorizeRequestParameters({...r.auth,authority:e,redirectUri:t.redirectUri||""},t,n);return m.addLibraryInfo(o,{sku:te.MSAL_SKU,version:ce,cpu:process.arch||"",os:process.platform||""}),r.system.protocolMode!==Z.OIDC&&m.addApplicationTelemetry(o,r.telemetry.application),m.addResponseType(o,f.OAuthResponseType.CODE),t.codeChallenge&&t.codeChallengeMethod&&m.addCodeChallengeParams(o,t.codeChallenge,t.codeChallengeMethod),m.addExtraParameters(o,t.extraQueryParameters||{}),Nr.getAuthorizeUrl(e,o)}var Bt=class{constructor(e){this.config=pc(e),this.cryptoProvider=new Le,this.logger=new B(this.config.system.loggerOptions,Fr,ce),this.storage=new ft(this.logger,this.config.auth.clientId,this.cryptoProvider,us(this.config.auth)),this.tokenCache=new Dr(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId||"");let t={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||f.ResponseMode.QUERY,authenticationScheme:f.AuthenticationScheme.BEARER,state:e.state||"",nonce:e.nonce||""},n=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions);return hl(this.config,n,t,this.logger)}async acquireTokenByCode(e,t){this.logger.info("acquireTokenByCode called",e.correlationId||""),e.state&&t&&(this.logger.info("acquireTokenByCode - validating state",e.correlationId||""),this.validateState(e.state,t.state||""),t={...t,state:""});let n={...e,...await this.initializeBaseRequest(e),authenticationScheme:f.AuthenticationScheme.BEARER},o=this.initializeServerTelemetryManager(N.acquireTokenByCode,n.correlationId);try{let i=await this.createAuthority(n.authority,n.correlationId,void 0,e.azureCloudOptions),s=await this.buildOauthClientConfiguration(i,n.correlationId,n.redirectUri,o),a=new wr(s,new L);return this.logger.verbose("Auth code client created",n.correlationId),await a.acquireToken(n,N.acquireTokenByCode,t)}catch(i){throw i instanceof T&&i.setCorrelationId(n.correlationId),o.cacheFailedRequest(i),i}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId||"");let t={...e,...await this.initializeBaseRequest(e),authenticationScheme:f.AuthenticationScheme.BEARER},n=this.initializeServerTelemetryManager(N.acquireTokenByRefreshToken,t.correlationId);try{let o=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,t.correlationId,t.redirectUri||"",n),s=new st(i,new L);return this.logger.verbose("Refresh token client created",t.correlationId),await s.acquireToken(t,N.acquireTokenByRefreshToken)}catch(o){throw o instanceof T&&o.setCorrelationId(t.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenSilent(e){let t={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},n=this.initializeServerTelemetryManager(N.acquireTokenSilent,t.correlationId,t.forceRefresh);try{let o=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,t.correlationId,t.redirectUri||"",n),s=new kr(i,new L);this.logger.verbose("Silent flow client created",t.correlationId);try{return await this.tokenCache.overwriteCache(),await this.acquireCachedTokenSilent(t,s,i)}catch(a){if(a instanceof We&&a.errorCode===x.tokenRefreshRequired)return new st(i,new L).acquireTokenByRefreshToken(t,N.acquireTokenSilent);throw a}}catch(o){throw o instanceof T&&o.setCorrelationId(t.correlationId),n.cacheFailedRequest(o),o}}async acquireCachedTokenSilent(e,t,n){let[o,i]=await t.acquireCachedToken({...e,scopes:e.scopes?.length?e.scopes:[...f.OIDC_DEFAULT_SCOPES]});if(i===f.CacheOutcome.PROACTIVELY_REFRESHED){this.logger.info("ClientApplication:acquireCachedTokenSilent - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId);let s=new st(n,new L);try{await s.acquireTokenByRefreshToken(e,N.acquireTokenSilent)}catch{}}return o}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId||"");let t={...e,...await this.initializeBaseRequest(e)},n=this.initializeServerTelemetryManager(N.acquireTokenByUsernamePassword,t.correlationId);try{let o=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,t.correlationId,"",n),s=new zn(i);return this.logger.verbose("Username password client created",t.correlationId),await s.acquireToken(t)}catch(o){throw o instanceof T&&o.setCorrelationId(t.correlationId),n.cacheFailedRequest(o),o}}getTokenCache(){return this.logger.info("getTokenCache called",""),this.tokenCache}validateState(e,t){if(!e)throw V.createStateNotFoundError();if(e!==t)throw l(x.stateMismatch)}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,t,n,o){return this.logger.verbose("buildOauthClientConfiguration called",t),this.logger.info(`Building oauth client configuration with the following authority: ${e.tokenEndpoint}.`,t),o?.updateRegionDiscoveryMetadata(e.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:e,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:n,isMcp:this.config.auth.isMcp},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:t},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:o,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:await this.getClientAssertion(e)},libraryInfo:{sku:te.MSAL_SKU,version:ce,cpu:process.arch||"",os:process.platform||""},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}async getClientAssertion(e){return this.developerProvidedClientAssertion&&(this.clientAssertion=Ke.fromAssertion(await z(this.developerProvidedClientAssertion,this.config.auth.clientId,e.tokenEndpoint))),this.clientAssertion&&{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:te.JWT_BEARER_ASSERTION_TYPE}}async initializeBaseRequest(e){let t=e.correlationId||this.cryptoProvider.createNewGuid();return this.logger.verbose("initializeRequestScopes called",t),e.authenticationScheme&&e.authenticationScheme===f.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",t),e.authenticationScheme=f.AuthenticationScheme.BEARER,{...e,scopes:[...e&&e.scopes||[],...f.OIDC_DEFAULT_SCOPES],correlationId:t,authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,t,n){let o={clientId:this.config.auth.clientId,correlationId:t,apiId:e,forceRefresh:n||!1};return new ct(o,this.storage)}async createAuthority(e,t,n,o){this.logger.verbose("createAuthority called",t);let i=we.generateAuthority(e,o||this.config.auth.azureCloudOptions),s={protocolMode:this.config.system.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:n};return On.createDiscoveredInstance(i,this.config.system.networkClient,this.storage,s,this.logger,t,new L)}clearCache(){this.storage.clear()}};import bp from"http";var Yn=class{async listenForAuthCode(e,t){if(this.server)throw V.createLoopbackServerAlreadyExistsError();return new Promise((n,o)=>{this.server=bp.createServer((i,s)=>{let a=i.url;if(a){if(a===f.FORWARD_SLASH){s.end(e||"Auth code was successfully acquired. You can close this window now.");return}}else{s.end(t||"Error occurred loading redirectUrl"),o(V.createUnableToLoadRedirectUrlError());return}let d=this.getRedirectUri(),c=new URL(a,d),u=q.getDeserializedResponse(c.search)||{};u.code&&(s.writeHead(f.HTTP_REDIRECT,{location:d}),s.end()),u.error&&s.end(t||`Error occurred: ${u.error}`),n(u)}),this.server.listen(0,"127.0.0.1")})}getRedirectUri(){if(!this.server||!this.server.listening)throw V.createNoLoopbackServerExistsError();let e=this.server.address();if(!e||typeof e=="string"||!e.port)throw this.closeServer(),V.createInvalidLoopbackAddressTypeError();let t=e&&e.port;return`${te.HTTP_PROTOCOL}${te.LOCALHOST}:${t}`}closeServer(){this.server&&(this.server.close(),typeof this.server.closeAllConnections=="function"&&this.server.closeAllConnections(),this.server.unref(),this.server=void 0)}};var Wn=class extends Ce{constructor(e){super(e)}async acquireToken(e){let t=await this.getDeviceCode(e);e.deviceCodeCallback(t);let n=O.nowSeconds(),o=await this.acquireTokenWithDeviceCode(e,t),i=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(o,e.correlationId),i.handleServerTokenResponse(o,this.authority,n,e,N.acquireTokenByDeviceCode)}async getDeviceCode(e){let t=this.createExtraQueryParameters(e),n=A.appendQueryString(this.authority.deviceCodeEndpoint,t),o=this.createQueryString(e),i=this.createTokenRequestHeaders(),s={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};return this.executePostRequestToDeviceCodeEndpoint(n,o,i,s,e.correlationId)}createExtraQueryParameters(e){let t=new Map;return e.extraQueryParameters&&m.addExtraParameters(t,e.extraQueryParameters),q.mapToQueryString(t)}async executePostRequestToDeviceCodeEndpoint(e,t,n,o,i){let{body:{user_code:s,device_code:a,verification_uri:d,expires_in:c,interval:u,message:h}}=await this.sendPostRequest(o,e,{body:t,headers:n},i);return{userCode:s,deviceCode:a,verificationUri:d,expiresIn:c,interval:u,message:h}}createQueryString(e){let t=new Map;return m.addScopes(t,e.scopes),m.addClientId(t,this.config.authOptions.clientId),e.extraQueryParameters&&m.addExtraParameters(t,e.extraQueryParameters),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&m.addClaims(t,e.claims,this.config.authOptions.clientCapabilities),q.mapToQueryString(t)}continuePolling(e,t,n){if(n)throw this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true",""),l(al);if(t&&t<e&&O.nowSeconds()>t)throw this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${t}`,""),l(il);if(O.nowSeconds()>e)throw t&&this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${t}`,""),this.logger.error(`Device code expired. Expiration time of device code was ${e}`,""),l(cl);return!0}async acquireTokenWithDeviceCode(e,t){let n=this.createTokenQueryParameters(e),o=A.appendQueryString(this.authority.tokenEndpoint,n),i=this.createTokenRequestBody(e,t),s=this.createTokenRequestHeaders(),a=e.timeout?O.nowSeconds()+e.timeout:void 0,d=O.nowSeconds()+t.expiresIn,c=t.interval*1e3;for(;this.continuePolling(d,a,e.cancel);){let u={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},h=await this.executePostToTokenEndpoint(o,i,s,u,e.correlationId);if(h.body&&h.body.error)if(h.body.error===f.AUTHORIZATION_PENDING)this.logger.info("Authorization pending. Continue polling.",e.correlationId),await O.delay(c);else throw this.logger.info("Unexpected error in polling from the server",e.correlationId),Ve(vr.postRequestFailed,h.body.error);else return this.logger.verbose("Authorization completed successfully. Polling stopped.",e.correlationId),h.body}throw this.logger.error("Polling stopped for unknown reasons.",e.correlationId),l(dl)}createTokenRequestBody(e,t){let n=new Map;m.addScopes(n,e.scopes),m.addClientId(n,this.config.authOptions.clientId),m.addGrantType(n,f.GrantType.DEVICE_CODE_GRANT),m.addDeviceCode(n,t.deviceCode);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();return m.addCorrelationId(n,o),m.addClientInfo(n),m.addLibraryInfo(n,this.config.libraryInfo),m.addApplicationTelemetry(n,this.config.telemetry.application),m.addThrottling(n),this.serverTelemetryManager&&m.addServerTelemetry(n,this.serverTelemetryManager),(!w.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&m.addClaims(n,e.claims,this.config.authOptions.clientCapabilities),q.mapToQueryString(n)}};var qs=class extends Bt{constructor(e){super(e),this.config.broker.nativeBrokerPlugin&&(this.config.broker.nativeBrokerPlugin.isBrokerAvailable?(this.nativeBrokerPlugin=this.config.broker.nativeBrokerPlugin,this.nativeBrokerPlugin.setLogger(this.config.system.loggerOptions)):this.logger.warning("NativeBroker implementation was provided but the broker is unavailable.","")),this.skus=ct.makeExtraSkuString({libraryName:te.MSAL_SKU,libraryVersion:ce})}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId||""),at(this.config.auth.isMcp,e);let t=Object.assign(e,await this.initializeBaseRequest(e)),n=this.initializeServerTelemetryManager(N.acquireTokenByDeviceCode,t.correlationId);try{let o=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,t.correlationId,"",n),s=new Wn(i);return this.logger.verbose("Device code client created",t.correlationId),await s.acquireToken(t)}catch(o){throw o instanceof T&&o.setCorrelationId(t.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenInteractive(e){let t=e.correlationId||this.cryptoProvider.createNewGuid();this.logger.trace("acquireTokenInteractive called",t),at(this.config.auth.isMcp,e);let{openBrowser:n,successTemplate:o,errorTemplate:i,windowHandle:s,loopbackClient:a,...d}=e;if(this.nativeBrokerPlugin){let E={...d,clientId:this.config.auth.clientId,scopes:e.scopes||f.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:t,extraParameters:{...d.extraQueryParameters,...d.extraParameters,[Ee.X_CLIENT_EXTRA_SKU]:this.skus},accountId:d.account?.nativeAccountId};return this.nativeBrokerPlugin.acquireTokenInteractive(E,s)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw V.createRedirectUriNotSupportedError();e.redirectUri=""}let{verifier:c,challenge:u}=await this.cryptoProvider.generatePkceCodes(),h=a||new Yn,g={},p=null;try{let E=h.listenForAuthCode(o,i).then(Ge=>{g=Ge}).catch(Ge=>{p=Ge}),_=await this.waitForRedirectUri(h),H={...d,correlationId:t,scopes:e.scopes||f.OIDC_DEFAULT_SCOPES,redirectUri:_,responseMode:f.ResponseMode.QUERY,codeChallenge:u,codeChallengeMethod:f.CodeChallengeMethodValues.S256},pe=await this.getAuthCodeUrl(H);if(await n(pe),await E,p)throw p;if(g.error)throw new Q(g.error,g.error_description,g.suberror);if(!g.code)throw V.createNoAuthCodeInResponseError();let Y=g.client_info,W={code:g.code,codeVerifier:c,clientInfo:Y||"",...H};return await this.acquireTokenByCode(W)}finally{h.closeServer()}}async acquireTokenSilent(e){let t=e.correlationId||this.cryptoProvider.createNewGuid();if(this.logger.trace("acquireTokenSilent called",t),at(this.config.auth.isMcp,e),this.nativeBrokerPlugin){let n={...e,clientId:this.config.auth.clientId,scopes:e.scopes||f.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:t,extraParameters:{...e.extraQueryParameters,...e.extraParameters,[Ee.X_CLIENT_EXTRA_SKU]:this.skus},accountId:e.account.nativeAccountId,forceRefresh:e.forceRefresh||!1};return this.nativeBrokerPlugin.acquireTokenSilent(n)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw V.createRedirectUriNotSupportedError();e.redirectUri=""}return super.acquireTokenSilent(e)}async acquireTokenByCode(e,t){return at(this.config.auth.isMcp,e),super.acquireTokenByCode(e,t)}async acquireTokenByRefreshToken(e){return at(this.config.auth.isMcp,e),super.acquireTokenByRefreshToken(e)}async signOut(e){if(this.nativeBrokerPlugin&&e.account.nativeAccountId){let t={clientId:this.config.auth.clientId,accountId:e.account.nativeAccountId,correlationId:e.correlationId||this.cryptoProvider.createNewGuid()};await this.nativeBrokerPlugin.signOut(t)}await this.getTokenCache().removeAccount(e.account,e.correlationId)}async getAllAccounts(){if(this.nativeBrokerPlugin){let e=this.cryptoProvider.createNewGuid();return this.nativeBrokerPlugin.getAllAccounts(this.config.auth.clientId,e)}return this.getTokenCache().getAllAccounts()}async waitForRedirectUri(e){return new Promise((t,n)=>{let o=0,i=setInterval(()=>{if(kn.TIMEOUT_MS/kn.INTERVAL_MS<o){clearInterval(i),n(V.createLoopbackServerTimeoutError());return}try{let s=e.getRedirectUri();clearInterval(i),t(s);return}catch(s){if(s instanceof T&&s.errorCode===D.noLoopbackServerExists.code){o++;return}clearInterval(i),n(s);return}},kn.INTERVAL_MS)})}};var Br=class extends Ce{constructor(e,t){super(e),this.appTokenProvider=t}async acquireToken(e){if(e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority);let[t,n]=await this.getCachedAuthenticationResult(e,this.config,this.cryptoUtils,this.authority,this.cacheManager,this.serverTelemetryManager);return t?(n===f.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId),await this.executeTokenRequest(e,this.authority,!0)),t):this.executeTokenRequest(e,this.authority)}async getCachedAuthenticationResult(e,t,n,o,i,s){let a=t,d=t,c=f.CacheOutcome.NOT_APPLICABLE,u;a.serializableCache&&a.persistencePlugin&&(u=new ie(a.serializableCache,!1),await a.persistencePlugin.beforeCacheAccess(u));let h=this.readAccessTokenFromCache(o,d.managedIdentityId?.id||a.authOptions.clientId,new P(e.scopes||[]),i,e.correlationId);return a.serializableCache&&a.persistencePlugin&&u&&await a.persistencePlugin.afterCacheAccess(u),h?O.isTokenExpired(h.expiresOn,a.systemOptions?.tokenRenewalOffsetSeconds||f.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)?(s?.setCacheOutcome(f.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),[null,f.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED]):(h.refreshOn&&O.isTokenExpired(h.refreshOn.toString(),0)&&(c=f.CacheOutcome.PROACTIVELY_REFRESHED,s?.setCacheOutcome(f.CacheOutcome.PROACTIVELY_REFRESHED)),[await M.generateAuthenticationResult(n,o,{account:null,idToken:null,accessToken:h,refreshToken:null,appMetadata:null},!0,e,this.performanceClient),c]):(s?.setCacheOutcome(f.CacheOutcome.NO_CACHED_ACCESS_TOKEN),[null,f.CacheOutcome.NO_CACHED_ACCESS_TOKEN])}readAccessTokenFromCache(e,t,n,o,i){let s={homeAccountId:"",environment:e.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:f.CredentialType.ACCESS_TOKEN,clientId:t,realm:e.tenant,target:P.createSearchScopes(n.asArray())},a=o.getAccessTokensByFilter(s,i);if(a.length<1)return null;if(a.length>1)throw l(x.multipleMatchingTokens);return a[0]}async executeTokenRequest(e,t,n){let o,i;if(this.appTokenProvider){this.logger.info("Using appTokenProvider extensibility.",e.correlationId);let d={correlationId:e.correlationId,tenantId:this.config.authOptions.authority.tenant,scopes:e.scopes,claims:e.claims};i=O.nowSeconds();let c=await this.appTokenProvider(d);o={access_token:c.accessToken,expires_in:c.expiresInSeconds,refresh_in:c.refreshInSeconds,token_type:f.AuthenticationScheme.BEARER}}else{let d=this.createTokenQueryParameters(e),c=A.appendQueryString(t.tokenEndpoint,d),u=await this.createTokenRequestBody(e),h=this.createTokenRequestHeaders(),g={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};this.logger.info("Sending token request to endpoint: "+t.tokenEndpoint,e.correlationId),i=O.nowSeconds();let p=await this.executePostToTokenEndpoint(c,u,h,g,e.correlationId);o=p.body,o.status=p.status}let s=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o,e.correlationId,n),await s.handleServerTokenResponse(o,this.authority,i,e,N.acquireTokenByClientCredential)}async createTokenRequestBody(e){let t=new Map;m.addClientId(t,this.config.authOptions.clientId),m.addScopes(t,e.scopes,!1),m.addGrantType(t,f.GrantType.CLIENT_CREDENTIALS_GRANT),m.addLibraryInfo(t,this.config.libraryInfo),m.addApplicationTelemetry(t,this.config.telemetry.application),m.addThrottling(t),this.serverTelemetryManager&&m.addServerTelemetry(t,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();m.addCorrelationId(t,n),this.config.clientCredentials.clientSecret&&m.addClientSecret(t,this.config.clientCredentials.clientSecret);let o=e.clientAssertion||this.config.clientCredentials.clientAssertion;return o&&(m.addClientAssertion(t,await z(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),m.addClientAssertionType(t,o.assertionType)),(!w.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&m.addClaims(t,e.claims,this.config.authOptions.clientCapabilities),q.mapToQueryString(t)}};var qn=class extends Ce{constructor(e){super(e)}async acquireToken(e){if(this.scopeSet=new P(e.scopes||[]),this.userAssertionHash=await this.cryptoUtils.hashString(e.oboAssertion),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,this.userAssertionHash);try{return await this.getCachedAuthenticationResult(e)}catch{return await this.executeTokenRequest(e,this.authority,this.userAssertionHash)}}async getCachedAuthenticationResult(e){let t=this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId,e);if(t){if(O.isTokenExpired(t.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.serverTelemetryManager?.setCacheOutcome(f.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`,e.correlationId),l(x.tokenRefreshRequired)}else throw this.serverTelemetryManager?.setCacheOutcome(f.CacheOutcome.NO_CACHED_ACCESS_TOKEN),this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.",e.correlationId),l(x.tokenRefreshRequired);let n=this.readIdTokenFromCacheForOBO(t.homeAccountId,e.correlationId),o,i=null;if(n){o=En.extractTokenClaims(n.secret,re.base64Decode);let s=o.oid||o.sub,a={homeAccountId:n.homeAccountId,environment:n.environment,tenantId:n.realm,username:"",localAccountId:s||""};i=this.cacheManager.getAccount(this.cacheManager.generateAccountKey(a),e.correlationId)}return this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),M.generateAuthenticationResult(this.cryptoUtils,this.authority,{account:i,accessToken:t,idToken:n,refreshToken:null,appMetadata:null},!0,e,this.performanceClient,o)}readIdTokenFromCacheForOBO(e,t){let n={homeAccountId:e,environment:this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:f.CredentialType.ID_TOKEN,clientId:this.config.authOptions.clientId,realm:this.authority.tenant},o=this.cacheManager.getIdTokensByFilter(n,t);return Object.values(o).length<1?null:Object.values(o)[0]}readAccessTokenFromCacheForOBO(e,t){let n=t.authenticationScheme||f.AuthenticationScheme.BEARER,i={credentialType:n&&n.toLowerCase()!==f.AuthenticationScheme.BEARER.toLowerCase()?f.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:f.CredentialType.ACCESS_TOKEN,clientId:e,target:P.createSearchScopes(this.scopeSet.asArray()),tokenType:n,keyId:t.sshKid,userAssertionHash:this.userAssertionHash},s=this.cacheManager.getAccessTokensByFilter(i,t.correlationId),a=s.length;if(a<1)return null;if(a>1)throw l(x.multipleMatchingTokens);return s[0]}async executeTokenRequest(e,t,n){let o=this.createTokenQueryParameters(e),i=A.appendQueryString(t.tokenEndpoint,o),s=await this.createTokenRequestBody(e),a=this.createTokenRequestHeaders(),d={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},c=O.nowSeconds(),u=await this.executePostToTokenEndpoint(i,s,a,d,e.correlationId),h=new M(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return h.validateTokenResponse(u.body,e.correlationId),await h.handleServerTokenResponse(u.body,this.authority,c,e,N.acquireTokenByOBO,void 0,n)}async createTokenRequestBody(e){let t=new Map;m.addClientId(t,this.config.authOptions.clientId),m.addScopes(t,e.scopes),m.addGrantType(t,f.GrantType.JWT_BEARER),m.addClientInfo(t),m.addLibraryInfo(t,this.config.libraryInfo),m.addApplicationTelemetry(t,this.config.telemetry.application),m.addThrottling(t),this.serverTelemetryManager&&m.addServerTelemetry(t,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();m.addCorrelationId(t,n),m.addRequestTokenUse(t,Ee.ON_BEHALF_OF),m.addOboAssertion(t,e.oboAssertion),this.config.clientCredentials.clientSecret&&m.addClientSecret(t,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(m.addClientAssertion(t,await z(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),m.addClientAssertionType(t,o.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&m.addClaims(t,e.claims,this.config.authOptions.clientCapabilities),q.mapToQueryString(t)}};var Qs=class extends Bt{constructor(e){super(e);let t=!!this.config.auth.clientSecret,n=!!this.config.auth.clientAssertion,o=(!!this.config.auth.clientCertificate?.thumbprint||!!this.config.auth.clientCertificate?.thumbprintSha256)&&!!this.config.auth.clientCertificate?.privateKey;if(!this.appTokenProvider){if(t&&n||n&&o||t&&o)throw l(Ws);if(this.config.auth.clientSecret){this.clientSecret=this.config.auth.clientSecret;return}if(this.config.auth.clientAssertion){this.developerProvidedClientAssertion=this.config.auth.clientAssertion;return}if(o)this.clientAssertion=this.config.auth.clientCertificate.thumbprintSha256?Ke.fromCertificateWithSha256Thumbprint(this.config.auth.clientCertificate.thumbprintSha256,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c):Ke.fromCertificate(this.config.auth.clientCertificate.thumbprint,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c);else throw l(Ws);this.appTokenProvider=void 0}}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){this.logger.info("acquireTokenByClientCredential called",e.correlationId||"");let t;e.clientAssertion&&(t={assertion:await z(e.clientAssertion,this.config.auth.clientId),assertionType:te.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...n,scopes:n.scopes.filter(g=>!f.OIDC_DEFAULT_SCOPES.includes(g))},i={...e,...o,clientAssertion:t},a=new A(i.authority).getUrlComponents().PathSegments[0];if(Object.values(f.AADAuthority).includes(a))throw l(ol);let d=process.env[cc],c;i.azureRegion!=="DisableMsalForceRegion"&&(!i.azureRegion&&d?c=d:c=i.azureRegion);let u={azureRegion:c,environmentRegion:process.env[ac]},h=this.initializeServerTelemetryManager(N.acquireTokenByClientCredential,i.correlationId,i.skipCache);try{let g=await this.createAuthority(i.authority,i.correlationId,u,e.azureCloudOptions),p=await this.buildOauthClientConfiguration(g,i.correlationId,"",h),E=new Br(p,this.appTokenProvider);return this.logger.verbose("Client credential client created",i.correlationId),await E.acquireToken(i)}catch(g){throw g instanceof T&&g.setCorrelationId(i.correlationId),h.cacheFailedRequest(g),g}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId||"");let t={...e,...await this.initializeBaseRequest(e)};try{let n=await this.createAuthority(t.authority,t.correlationId,void 0,e.azureCloudOptions),o=await this.buildOauthClientConfiguration(n,t.correlationId,"",void 0),i=new qn(o);return this.logger.verbose("On behalf of client created",t.correlationId),await i.acquireToken(t)}catch(n){throw n instanceof T&&n.setCorrelationId(t.correlationId),n}}};function ul(r){if(typeof r!="string")return!1;let e=new Date(r);return!isNaN(e.getTime())&&e.toISOString()===r}var Qn=class{constructor(e,t,n){this.httpClientNoRetries=e,this.retryPolicy=t,this.logger=n}async sendNetworkRequestAsyncHelper(e,t,n){return e===G.GET?this.httpClientNoRetries.sendGetRequestAsync(t,n):this.httpClientNoRetries.sendPostRequestAsync(t,n)}async sendNetworkRequestAsync(e,t,n){let o=await this.sendNetworkRequestAsyncHelper(e,t,n);"isNewRequest"in this.retryPolicy&&(this.retryPolicy.isNewRequest=!0);let i=0;for(;await this.retryPolicy.pauseForRetry(o.status,i,this.logger,o.headers[f.HeaderNames.RETRY_AFTER]);)o=await this.sendNetworkRequestAsyncHelper(e,t,n),i++;return o}async sendGetRequestAsync(e,t){return this.sendNetworkRequestAsync(G.GET,e,t)}async sendPostRequestAsync(e,t){return this.sendNetworkRequestAsync(G.POST,e,t)}};var Kt={MANAGED_IDENTITY_CLIENT_ID_2017:"clientid",MANAGED_IDENTITY_CLIENT_ID:"client_id",MANAGED_IDENTITY_OBJECT_ID:"object_id",MANAGED_IDENTITY_RESOURCE_ID_IMDS:"msi_res_id",MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS:"mi_res_id"},Ne=class{constructor(e,t,n,o,i){this.logger=e,this.nodeStorage=t,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}createCorrelationId(){return this.cryptoProvider.createNewGuid()}async getServerTokenResponseAsync(e,t,n,o){return this.getServerTokenResponse(e)}getServerTokenResponse(e){let t,n;return e.body.expires_on&&(ul(e.body.expires_on)&&(e.body.expires_on=new Date(e.body.expires_on).getTime()/1e3),n=e.body.expires_on-O.nowSeconds(),n>2*3600&&(t=n/2)),{status:e.status,access_token:e.body.access_token,expires_in:n,scope:e.body.resource,token_type:e.body.token_type,refresh_in:t,correlation_id:e.body.correlation_id||e.body.correlationId,error:typeof e.body.error=="string"?e.body.error:e.body.error?.code,error_description:e.body.message||(typeof e.body.error=="string"?e.body.error_description:e.body.error?.message),error_codes:e.body.error_codes,timestamp:e.body.timestamp,trace_id:e.body.trace_id}}async acquireTokenWithManagedIdentity(e,t,n,o){let i=this.createRequest(e.resource,t);if(e.revokedTokenSha256Hash&&(this.logger.info(`[Managed Identity] The following claims are present in the request: ${e.claims}`,""),i.queryParameters[ke.SHA256_TOKEN_TO_REFRESH]=e.revokedTokenSha256Hash),e.clientCapabilities?.length){let p=e.clientCapabilities.toString();this.logger.info(`[Managed Identity] The following client capabilities are present in the request: ${p}`,""),i.queryParameters[ke.XMS_CC]=p}let s=i.headers;s[f.HeaderNames.CONTENT_TYPE]=f.URL_FORM_CONTENT_TYPE;let a={headers:s};Object.keys(i.bodyParameters).length&&(a.body=i.computeParametersBodyString());let d=this.disableInternalRetries?this.networkClient:new Qn(this.networkClient,i.retryPolicy,this.logger),c=O.nowSeconds(),u;try{i.httpMethod===G.POST?u=await d.sendPostRequestAsync(i.computeUri(),a):u=await d.sendGetRequestAsync(i.computeUri(),a)}catch(p){throw p instanceof T?p:l(x.networkError)}let h=new M(t.id,this.nodeStorage,this.cryptoProvider,this.logger,new L,null,null),g=await this.getServerTokenResponseAsync(u,d,i,a);return h.validateTokenResponse(g,g.correlation_id||"",o),h.handleServerTokenResponse(g,n,c,e,N.acquireTokenWithManagedIdentity)}getManagedIdentityUserAssignedIdQueryParameterKey(e,t,n){switch(e){case fe.USER_ASSIGNED_CLIENT_ID:return this.logger.info(`[Managed Identity] [API version ${n?"2017+":"2019+"}] Adding user assigned client id to the request.`,""),n?Kt.MANAGED_IDENTITY_CLIENT_ID_2017:Kt.MANAGED_IDENTITY_CLIENT_ID;case fe.USER_ASSIGNED_RESOURCE_ID:return this.logger.info("[Managed Identity] Adding user assigned resource id to the request.",""),t?Kt.MANAGED_IDENTITY_RESOURCE_ID_IMDS:Kt.MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS;case fe.USER_ASSIGNED_OBJECT_ID:return this.logger.info("[Managed Identity] Adding user assigned object id to the request.",""),Kt.MANAGED_IDENTITY_OBJECT_ID;default:throw lt(Mr)}}};Ne.getValidatedEnvVariableUrlString=(r,e,t,n)=>{try{return new A(e).urlString}catch{throw n.info(`[Managed Identity] ${t} managed identity is unavailable because the '${r}' environment variable is malformed.`,""),lt(dt[r])}};var ZI=[f.HTTP_NOT_FOUND,f.HTTP_REQUEST_TIMEOUT,f.HTTP_TOO_MANY_REQUESTS,f.HTTP_SERVER_ERROR,f.HTTP_SERVICE_UNAVAILABLE,f.HTTP_GATEWAY_TIMEOUT];var mS={win32:`${process.env.ProgramData}\\AzureConnectedMachineAgent\\Tokens\\`,linux:"/var/opt/azcmagent/tokens/"},pS={win32:`${process.env.ProgramFiles}\\AzureConnectedMachineAgent\\himds.exe`,linux:"/opt/azcmagent/bin/himds"};var wS=[f.HTTP_NOT_FOUND,f.HTTP_REQUEST_TIMEOUT,f.HTTP_GONE,f.HTTP_TOO_MANY_REQUESTS];var kS=10*1e3;var Pp="/metadata/identity/oauth2/token",xS=`http://169.254.169.254${Pp}`;var jS=`Only client id is supported for user-assigned managed identity in ${ue.MACHINE_LEARNING}.`;var yR=[ue.SERVICE_FABRIC];var RR=f.PromptValue,OR=f.ResponseMode;export{ne as a,qs as b,Qs as c};
+/*! Bundled license information:
+
+@azure/msal-common/dist/error/AuthError.mjs:
+@azure/msal-common/dist/error/InteractionRequiredAuthErrorCodes.mjs:
+@azure/msal-common/dist/error/InteractionRequiredAuthError.mjs:
+@azure/msal-common/dist/utils/Constants.mjs:
+@azure/msal-common/dist/constants/AADServerParamKeys.mjs:
+@azure/msal-common/dist/error/ClientConfigurationError.mjs:
+@azure/msal-common/dist/utils/StringUtils.mjs:
+@azure/msal-common/dist/error/ClientAuthError.mjs:
+@azure/msal-common/dist/error/ClientConfigurationErrorCodes.mjs:
+@azure/msal-common/dist/error/ClientAuthErrorCodes.mjs:
+@azure/msal-common/dist/request/ScopeSet.mjs:
+@azure/msal-common/dist/request/RequestParameterBuilder.mjs:
+@azure/msal-common/dist/utils/UrlUtils.mjs:
+@azure/msal-common/dist/crypto/ICrypto.mjs:
+@azure/msal-common/dist/logger/Logger.mjs:
+@azure/msal-common/dist/packageMetadata.mjs:
+@azure/msal-common/dist/authority/AuthorityOptions.mjs:
+@azure/msal-common/dist/account/AccountInfo.mjs:
+@azure/msal-common/dist/account/AuthToken.mjs:
+@azure/msal-common/dist/url/UrlString.mjs:
+@azure/msal-common/dist/authority/AuthorityMetadata.mjs:
+@azure/msal-common/dist/error/CacheErrorCodes.mjs:
+@azure/msal-common/dist/error/CacheError.mjs:
+@azure/msal-common/dist/account/ClientInfo.mjs:
+@azure/msal-common/dist/authority/AuthorityType.mjs:
+@azure/msal-common/dist/account/TokenClaims.mjs:
+@azure/msal-common/dist/authority/ProtocolMode.mjs:
+@azure/msal-common/dist/cache/utils/AccountEntityUtils.mjs:
+@azure/msal-common/dist/cache/CacheManager.mjs:
+@azure/msal-common/dist/telemetry/performance/PerformanceEvent.mjs:
+@azure/msal-common/dist/telemetry/performance/StubPerformanceClient.mjs:
+@azure/msal-common/dist/config/ClientConfiguration.mjs:
+@azure/msal-common/dist/cache/persistence/TokenCacheContext.mjs:
+@azure/msal-common/dist/utils/TimeUtils.mjs:
+@azure/msal-common/dist/cache/utils/CacheHelpers.mjs:
+@azure/msal-common/dist/telemetry/performance/PerformanceEvents.mjs:
+@azure/msal-common/dist/utils/FunctionWrappers.mjs:
+@azure/msal-common/dist/crypto/PopTokenGenerator.mjs:
+@azure/msal-common/dist/error/ServerError.mjs:
+@azure/msal-common/dist/utils/ProtocolUtils.mjs:
+@azure/msal-common/dist/response/ResponseHandler.mjs:
+@azure/msal-common/dist/account/CcsCredential.mjs:
+@azure/msal-common/dist/utils/ClientAssertionUtils.mjs:
+@azure/msal-common/dist/network/RequestThumbprint.mjs:
+@azure/msal-common/dist/network/ThrottlingUtils.mjs:
+@azure/msal-common/dist/error/NetworkError.mjs:
+@azure/msal-common/dist/protocol/Token.mjs:
+@azure/msal-common/dist/authority/OpenIdConfigResponse.mjs:
+@azure/msal-common/dist/authority/CloudInstanceDiscoveryResponse.mjs:
+@azure/msal-common/dist/authority/CloudInstanceDiscoveryErrorResponse.mjs:
+@azure/msal-common/dist/authority/RegionDiscovery.mjs:
+@azure/msal-common/dist/authority/Authority.mjs:
+@azure/msal-common/dist/authority/AuthorityFactory.mjs:
+@azure/msal-common/dist/client/AuthorizationCodeClient.mjs:
+@azure/msal-common/dist/client/RefreshTokenClient.mjs:
+@azure/msal-common/dist/client/SilentFlowClient.mjs:
+@azure/msal-common/dist/protocol/Authorize.mjs:
+@azure/msal-common/dist/request/BaseAuthRequest.mjs:
+@azure/msal-common/dist/error/AuthErrorCodes.mjs:
+@azure/msal-common/dist/telemetry/server/ServerTelemetryManager.mjs:
+@azure/msal-common/dist/index-node.mjs:
+  (*! @azure/msal-common v16.6.2 2026-05-19 *)
+
+@azure/msal-node/dist/utils/Constants.mjs:
+@azure/msal-node/dist/network/HttpClient.mjs:
+@azure/msal-node/dist/error/ManagedIdentityErrorCodes.mjs:
+@azure/msal-node/dist/error/ManagedIdentityError.mjs:
+@azure/msal-node/dist/config/ManagedIdentityId.mjs:
+@azure/msal-node/dist/error/NodeAuthError.mjs:
+@azure/msal-node/dist/config/Configuration.mjs:
+@azure/msal-node/dist/crypto/GuidGenerator.mjs:
+@azure/msal-node/dist/utils/EncodingUtils.mjs:
+@azure/msal-node/dist/crypto/HashUtils.mjs:
+@azure/msal-node/dist/crypto/PkceGenerator.mjs:
+@azure/msal-node/dist/crypto/CryptoProvider.mjs:
+@azure/msal-node/dist/cache/serializer/Deserializer.mjs:
+@azure/msal-node/dist/cache/serializer/Serializer.mjs:
+@azure/msal-node/dist/cache/CacheHelpers.mjs:
+@azure/msal-node/dist/cache/NodeStorage.mjs:
+@azure/msal-node/dist/cache/TokenCache.mjs:
+@azure/msal-node/dist/error/ClientAuthErrorCodes.mjs:
+@azure/msal-node/dist/client/ClientAssertion.mjs:
+@azure/msal-node/dist/packageMetadata.mjs:
+@azure/msal-node/dist/client/BaseClient.mjs:
+@azure/msal-node/dist/client/UsernamePasswordClient.mjs:
+@azure/msal-node/dist/protocol/Authorize.mjs:
+@azure/msal-node/dist/client/ClientApplication.mjs:
+@azure/msal-node/dist/network/LoopbackClient.mjs:
+@azure/msal-node/dist/client/DeviceCodeClient.mjs:
+@azure/msal-node/dist/client/PublicClientApplication.mjs:
+@azure/msal-node/dist/client/ClientCredentialClient.mjs:
+@azure/msal-node/dist/client/OnBehalfOfClient.mjs:
+@azure/msal-node/dist/client/ConfidentialClientApplication.mjs:
+@azure/msal-node/dist/internals.mjs:
+@azure/msal-node/dist/utils/TimeUtils.mjs:
+@azure/msal-node/dist/network/HttpClientWithRetries.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/BaseManagedIdentitySource.mjs:
+@azure/msal-node/dist/retry/LinearRetryStrategy.mjs:
+@azure/msal-node/dist/retry/DefaultManagedIdentityRetryPolicy.mjs:
+@azure/msal-node/dist/config/ManagedIdentityRequestParameters.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/AppService.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/AzureArc.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/CloudShell.mjs:
+@azure/msal-node/dist/retry/ExponentialRetryStrategy.mjs:
+@azure/msal-node/dist/retry/ImdsRetryPolicy.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/Imds.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/ServiceFabric.mjs:
+@azure/msal-node/dist/client/ManagedIdentitySources/MachineLearning.mjs:
+@azure/msal-node/dist/client/ManagedIdentityClient.mjs:
+@azure/msal-node/dist/client/ManagedIdentityApplication.mjs:
+@azure/msal-node/dist/cache/distributed/DistributedCachePlugin.mjs:
+@azure/msal-node/dist/index.mjs:
+  (*! @azure/msal-node v5.2.2 2026-05-19 *)
+*/
+//# sourceMappingURL=chunk-3YRE4IQ3.js.map