(function(){const e=document.createElement("link").relList;if(e&&e.supports&&e.supports("modulepreload"))return;for(const o of document.querySelectorAll('link[rel="modulepreload"]'))n(o);new MutationObserver(o=>{for(const i of o)if(i.type==="childList")for(const a of i.addedNodes)a.tagName==="LINK"&&a.rel==="modulepreload"&&n(a)}).observe(document,{childList:!0,subtree:!0});function t(o){const i={};return o.integrity&&(i.integrity=o.integrity),o.referrerPolicy&&(i.referrerPolicy=o.referrerPolicy),o.crossOrigin==="use-credentials"?i.credentials="include":o.crossOrigin==="anonymous"?i.credentials="omit":i.credentials="same-origin",i}function n(o){if(o.ep)return;o.ep=!0;const i=t(o);fetch(o.href,i)}})();/*! @azure/msal-common v15.7.1 2025-06-18 */const u={LIBRARY_NAME:"MSAL.JS",SKU:"msal.js.common",CACHE_PREFIX:"msal",DEFAULT_AUTHORITY:"https://login.microsoftonline.com/common/",DEFAULT_AUTHORITY_HOST:"login.microsoftonline.com",DEFAULT_COMMON_TENANT:"common",ADFS:"adfs",DSTS:"dstsv2",AAD_INSTANCE_DISCOVERY_ENDPT:"https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",CIAM_AUTH_URL:".ciamlogin.com",AAD_TENANT_DOMAIN_SUFFIX:".onmicrosoft.com",RESOURCE_DELIM:"|",NO_ACCOUNT:"NO_ACCOUNT",CLAIMS:"claims",CONSUMER_UTID:"9188040d-6c67-4c5b-b112-36a304b66dad",OPENID_SCOPE:"openid",PROFILE_SCOPE:"profile",OFFLINE_ACCESS_SCOPE:"offline_access",EMAIL_SCOPE:"email",CODE_GRANT_TYPE:"authorization_code",RT_GRANT_TYPE:"refresh_token",S256_CODE_CHALLENGE_METHOD:"S256",URL_FORM_CONTENT_TYPE:"application/x-www-form-urlencoded;charset=utf-8",AUTHORIZATION_PENDING:"authorization_pending",NOT_DEFINED:"not_defined",EMPTY_STRING:"",NOT_APPLICABLE:"N/A",NOT_AVAILABLE:"Not Available",FORWARD_SLASH:"/",IMDS_ENDPOINT:"http://169.254.169.254/metadata/instance/compute/location",IMDS_VERSION:"2020-06-01",IMDS_TIMEOUT:2e3,AZURE_REGION_AUTO_DISCOVER_FLAG:"TryAutoDetect",REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX:"login.microsoft.com",KNOWN_PUBLIC_CLOUDS:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"],SHR_NONCE_VALIDITY:240,INVALID_INSTANCE:"invalid_instance"},ue={SUCCESS:200,SUCCESS_RANGE_START:200,SUCCESS_RANGE_END:299,REDIRECT:302,CLIENT_ERROR:400,CLIENT_ERROR_RANGE_START:400,BAD_REQUEST:400,UNAUTHORIZED:401,NOT_FOUND:404,REQUEST_TIMEOUT:408,GONE:410,TOO_MANY_REQUESTS:429,CLIENT_ERROR_RANGE_END:499,SERVER_ERROR:500,SERVER_ERROR_RANGE_START:500,SERVICE_UNAVAILABLE:503,GATEWAY_TIMEOUT:504,SERVER_ERROR_RANGE_END:599,MULTI_SIDED_ERROR:600},je=[u.OPENID_SCOPE,u.PROFILE_SCOPE,u.OFFLINE_ACCESS_SCOPE],Ao=[...je,u.EMAIL_SCOPE],K={CONTENT_TYPE:"Content-Type",CONTENT_LENGTH:"Content-Length",RETRY_AFTER:"Retry-After",CCS_HEADER:"X-AnchorMailbox",WWWAuthenticate:"WWW-Authenticate",AuthenticationInfo:"Authentication-Info",X_MS_REQUEST_ID:"x-ms-request-id",X_MS_HTTP_VERSION:"x-ms-httpver"},Io={ACTIVE_ACCOUNT_FILTERS:"active-account-filters"},ge={COMMON:"common",ORGANIZATIONS:"organizations",CONSUMERS:"consumers"},Ze={ACCESS_TOKEN:"access_token",XMS_CC:"xms_cc"},L={LOGIN:"login",SELECT_ACCOUNT:"select_account",CONSENT:"consent",NONE:"none",CREATE:"create",NO_SESSION:"no_session"},Eo={PLAIN:"plain",S256:"S256"},Wo={CODE:"code",IDTOKEN_TOKEN_REFRESHTOKEN:"id_token token refresh_token"},vt={QUERY:"query",FRAGMENT:"fragment"},la={QUERY:"query"},Jo={AUTHORIZATION_CODE_GRANT:"authorization_code",REFRESH_TOKEN_GRANT:"refresh_token"},et={MSSTS_ACCOUNT_TYPE:"MSSTS",ADFS_ACCOUNT_TYPE:"ADFS",GENERIC_ACCOUNT_TYPE:"Generic"},x={CACHE_KEY_SEPARATOR:"-",CLIENT_INFO_SEPARATOR:"."},I={ID_TOKEN:"IdToken",ACCESS_TOKEN:"AccessToken",ACCESS_TOKEN_WITH_AUTH_SCHEME:"AccessToken_With_AuthScheme",REFRESH_TOKEN:"RefreshToken"},fn="appmetadata",ha="client_info",Ke="1",lt={CACHE_KEY:"authority-metadata",REFRESH_TIME_SECONDS:3600*24},$={CONFIG:"config",CACHE:"cache",NETWORK:"network",HARDCODED_VALUES:"hardcoded_values"},D={SCHEMA_VERSION:5,MAX_LAST_HEADER_BYTES:330,MAX_CACHED_ERRORS:50,CACHE_KEY:"server-telemetry",CATEGORY_SEPARATOR:"|",VALUE_SEPARATOR:",",OVERFLOW_TRUE:"1",OVERFLOW_FALSE:"0",UNKNOWN_ERROR:"unknown_error"},v={BEARER:"Bearer",POP:"pop",SSH:"ssh-cert"},Be={DEFAULT_THROTTLE_TIME_SECONDS:60,DEFAULT_MAX_THROTTLE_TIME_SECONDS:3600,THROTTLING_PREFIX:"throttling",X_MS_LIB_CAPABILITY_VALUE:"retry-after, h429"},wo={INVALID_GRANT_ERROR:"invalid_grant",CLIENT_MISMATCH_ERROR:"client_mismatch"},_e={FAILED_AUTO_DETECTION:"1",INTERNAL_CACHE:"2",ENVIRONMENT_VARIABLE:"3",IMDS:"4"},qt={CONFIGURED_NO_AUTO_DETECTION:"2",AUTO_DETECTION_REQUESTED_SUCCESSFUL:"4",AUTO_DETECTION_REQUESTED_FAILED:"5"},ye={NOT_APPLICABLE:"0",FORCE_REFRESH_OR_CLAIMS:"1",NO_CACHED_ACCESS_TOKEN:"2",CACHED_ACCESS_TOKEN_EXPIRED:"3",PROACTIVELY_REFRESHED:"4"},da={Pop:"pop"},ua=300;/*! @azure/msal-common v15.7.1 2025-06-18 */const ht="unexpected_error",ga="post_request_failed";/*! @azure/msal-common v15.7.1 2025-06-18 */const So={[ht]:"Unexpected error in authentication.",[ga]:"Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details."};class b extends Error{constructor(e,t,n){const o=t?`${e}: ${t}`:e;super(o),Object.setPrototypeOf(this,b.prototype),this.errorCode=e||u.EMPTY_STRING,this.errorMessage=t||u.EMPTY_STRING,this.subError=n||u.EMPTY_STRING,this.name="AuthError"}setCorrelationId(e){this.correlationId=e}}function Wt(r,e){return new b(r,e?`${So[r]} ${e}`:So[r])}/*! @azure/msal-common v15.7.1 2025-06-18 */const mn="client_info_decoding_error",Xo="client_info_empty_error",pn="token_parsing_error",Zo="null_or_empty_token",se="endpoints_resolution_error",er="network_error",tr="openid_config_error",nr="hash_not_deserialized",Pe="invalid_state",or="state_mismatch",Jt="state_not_found",rr="nonce_mismatch",Cn="auth_time_not_found",ir="max_age_transpired",fa="multiple_matching_tokens",ma="multiple_matching_accounts",ar="multiple_matching_appMetadata",sr="request_cannot_be_made",cr="cannot_remove_empty_scope",lr="cannot_append_scopeset",Xt="empty_input_scopeset",pa="device_code_polling_cancelled",Ca="device_code_expired",ya="device_code_unknown_error",yn="no_account_in_silent_request",hr="invalid_cache_record",Tn="invalid_cache_environment",Zt="no_account_found",en="no_crypto_object",tn="unexpected_credential_type",Ta="invalid_assertion",Aa="invalid_client_credential",fe="token_refresh_required",Ia="user_timeout_reached",dr="token_claims_cnf_required_for_signedjwt",ur="authorization_code_missing_from_server_response",gr="binding_key_not_removed",fr="end_session_endpoint_not_supported",An="key_id_missing",Ea="no_network_connectivity",wa="user_canceled",Sa="missing_tenant_id_error",E="method_not_implemented",_a="nested_app_auth_bridge_disabled";/*! @azure/msal-common v15.7.1 2025-06-18 */const _o={[mn]:"The client info could not be parsed/decoded correctly",[Xo]:"The client info was empty",[pn]:"Token cannot be parsed",[Zo]:"The token is null or empty",[se]:"Endpoints cannot be resolved",[er]:"Network request failed",[tr]:"Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints.",[nr]:"The hash parameters could not be deserialized",[Pe]:"State was not the expected format",[or]:"State mismatch error",[Jt]:"State not found",[rr]:"Nonce mismatch error",[Cn]:"Max Age was requested and the ID token is missing the auth_time variable. auth_time is an optional claim and is not enabled by default - it must be enabled. See https://aka.ms/msaljs/optional-claims for more information.",[ir]:"Max Age is set to 0, or too much time has elapsed since the last end-user authentication.",[fa]:"The cache contains multiple tokens satisfying the requirements. Call AcquireToken again providing more requirements such as authority or account.",[ma]:"The cache contains multiple accounts satisfying the given parameters. Please pass more info to obtain the correct account",[ar]:"The cache contains multiple appMetadata satisfying the given parameters. Please pass more info to obtain the correct appMetadata",[sr]:"Token request cannot be made without authorization code or refresh token.",[cr]:"Cannot remove null or empty scope from ScopeSet",[lr]:"Cannot append ScopeSet",[Xt]:"Empty input ScopeSet cannot be processed",[pa]:"Caller has cancelled token endpoint polling during device code flow by setting DeviceCodeRequest.cancel = true.",[Ca]:"Device code is expired.",[ya]:"Device code stopped polling for unknown reasons.",[yn]:"Please pass an account object, silent flow is not supported without account information",[hr]:"Cache record object was null or undefined.",[Tn]:"Invalid environment when attempting to create cache entry",[Zt]:"No account found in cache for given key.",[en]:"No crypto object detected.",[tn]:"Unexpected credential type.",[Ta]:"Client assertion must meet requirements described in https://tools.ietf.org/html/rfc7515",[Aa]:"Client credential (secret, certificate, or assertion) must not be empty when creating a confidential client. An application should at most have one credential",[fe]:"Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.",[Ia]:"User defined timeout for device code polling reached",[dr]:"Cannot generate a POP jwt if the token_claims are not populated",[ur]:"Server response does not contain an authorization code to proceed",[gr]:"Could not remove the credential's binding key from storage.",[fr]:"The provided authority does not support logout",[An]:"A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key.",[Ea]:"No network connectivity. Check your internet connection.",[wa]:"User cancelled the flow.",[Sa]:"A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",[E]:"This method has not been implemented",[_a]:"The nested app auth bridge is disabled"};class In extends b{constructor(e,t){super(e,t?`${_o[e]}: ${t}`:_o[e]),this.name="ClientAuthError",Object.setPrototypeOf(this,In.prototype)}}function m(r,e){return new In(r,e)}/*! @azure/msal-common v15.7.1 2025-06-18 */const dt={createNewGuid:()=>{throw m(E)},base64Decode:()=>{throw m(E)},base64Encode:()=>{throw m(E)},base64UrlEncode:()=>{throw m(E)},encodeKid:()=>{throw m(E)},async getPublicKeyThumbprint(){throw m(E)},async removeTokenBindingKey(){throw m(E)},async clearKeystore(){throw m(E)},async signJwt(){throw m(E)},async hashString(){throw m(E)}};/*! @azure/msal-common v15.7.1 2025-06-18 */var O;(function(r){r[r.Error=0]="Error",r[r.Warning=1]="Warning",r[r.Info=2]="Info",r[r.Verbose=3]="Verbose",r[r.Trace=4]="Trace"})(O||(O={}));class pe{constructor(e,t,n){this.level=O.Info;const o=()=>{},i=e||pe.createDefaultLoggerOptions();this.localCallback=i.loggerCallback||o,this.piiLoggingEnabled=i.piiLoggingEnabled||!1,this.level=typeof i.logLevel=="number"?i.logLevel:O.Info,this.correlationId=i.correlationId||u.EMPTY_STRING,this.packageName=t||u.EMPTY_STRING,this.packageVersion=n||u.EMPTY_STRING}static createDefaultLoggerOptions(){return{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:O.Info}}clone(e,t,n){return new pe({loggerCallback:this.localCallback,piiLoggingEnabled:this.piiLoggingEnabled,logLevel:this.level,correlationId:n||this.correlationId},e,t)}logMessage(e,t){if(t.logLevel>this.level||!this.piiLoggingEnabled&&t.containsPii)return;const i=`${`[${new Date().toUTCString()}] : [${t.correlationId||this.correlationId||""}]`} : ${this.packageName}@${this.packageVersion} : ${O[t.logLevel]} - ${e}`;this.executeCallback(t.logLevel,i,t.containsPii||!1)}executeCallback(e,t,n){this.localCallback&&this.localCallback(e,t,n)}error(e,t){this.logMessage(e,{logLevel:O.Error,containsPii:!1,correlationId:t||u.EMPTY_STRING})}errorPii(e,t){this.logMessage(e,{logLevel:O.Error,containsPii:!0,correlationId:t||u.EMPTY_STRING})}warning(e,t){this.logMessage(e,{logLevel:O.Warning,containsPii:!1,correlationId:t||u.EMPTY_STRING})}warningPii(e,t){this.logMessage(e,{logLevel:O.Warning,containsPii:!0,correlationId:t||u.EMPTY_STRING})}info(e,t){this.logMessage(e,{logLevel:O.Info,containsPii:!1,correlationId:t||u.EMPTY_STRING})}infoPii(e,t){this.logMessage(e,{logLevel:O.Info,containsPii:!0,correlationId:t||u.EMPTY_STRING})}verbose(e,t){this.logMessage(e,{logLevel:O.Verbose,containsPii:!1,correlationId:t||u.EMPTY_STRING})}verbosePii(e,t){this.logMessage(e,{logLevel:O.Verbose,containsPii:!0,correlationId:t||u.EMPTY_STRING})}trace(e,t){this.logMessage(e,{logLevel:O.Trace,containsPii:!1,correlationId:t||u.EMPTY_STRING})}tracePii(e,t){this.logMessage(e,{logLevel:O.Trace,containsPii:!0,correlationId:t||u.EMPTY_STRING})}isPiiLoggingEnabled(){return this.piiLoggingEnabled||!1}}/*! @azure/msal-common v15.7.1 2025-06-18 */const mr="@azure/msal-common",En="15.7.1";/*! @azure/msal-common v15.7.1 2025-06-18 */const wn={None:"none"};/*! @azure/msal-common v15.7.1 2025-06-18 */function Me(r,e){const t=va(r);try{const n=e(t);return JSON.parse(n)}catch{throw m(pn)}}function va(r){if(!r)throw m(Zo);const t=/^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/.exec(r);if(!t||t.length<4)throw m(pn);return t[2]}function pr(r,e){if(e===0||Date.now()-3e5>r+e)throw m(ir)}/*! @azure/msal-common v15.7.1 2025-06-18 */function V(){return Math.round(new Date().getTime()/1e3)}function vo(r){return r.getTime()/1e3}function Re(r){return r?new Date(Number(r)*1e3):new Date}function nn(r,e){const t=Number(r)||0;return V()+e>t}function ka(r){return Number(r)>V()}/*! @azure/msal-common v15.7.1 2025-06-18 */function Ge(r){return[Pa(r),Na(r),Ma(r),Ua(r),Da(r)].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}function kt(r,e,t,n,o){return{credentialType:I.ID_TOKEN,homeAccountId:r,environment:e,clientId:n,secret:t,realm:o}}function Rt(r,e,t,n,o,i,a,s,c,l,d,g,p,y,w){var M,G;const S={homeAccountId:r,credentialType:I.ACCESS_TOKEN,secret:t,cachedAt:V().toString(),expiresOn:a.toString(),extendedExpiresOn:s.toString(),environment:e,clientId:n,realm:o,target:i,tokenType:d||v.BEARER};if(g&&(S.userAssertionHash=g),l&&(S.refreshOn=l.toString()),y&&(S.requestedClaims=y,S.requestedClaimsHash=w),((M=S.tokenType)==null?void 0:M.toLowerCase())!==v.BEARER.toLowerCase())switch(S.credentialType=I.ACCESS_TOKEN_WITH_AUTH_SCHEME,S.tokenType){case v.POP:const Q=Me(t,c);if(!((G=Q==null?void 0:Q.cnf)!=null&&G.kid))throw m(dr);S.keyId=Q.cnf.kid;break;case v.SSH:S.keyId=p}return S}function Cr(r,e,t,n,o,i,a){const s={credentialType:I.REFRESH_TOKEN,homeAccountId:r,environment:e,clientId:n,secret:t};return i&&(s.userAssertionHash=i),o&&(s.familyId=o),a&&(s.expiresOn=a.toString()),s}function Sn(r){return r.hasOwnProperty("homeAccountId")&&r.hasOwnProperty("environment")&&r.hasOwnProperty("credentialType")&&r.hasOwnProperty("clientId")&&r.hasOwnProperty("secret")}function Ra(r){return r?Sn(r)&&r.hasOwnProperty("realm")&&r.hasOwnProperty("target")&&(r.credentialType===I.ACCESS_TOKEN||r.credentialType===I.ACCESS_TOKEN_WITH_AUTH_SCHEME):!1}function ba(r){return r?Sn(r)&&r.hasOwnProperty("realm")&&r.credentialType===I.ID_TOKEN:!1}function Oa(r){return r?Sn(r)&&r.credentialType===I.REFRESH_TOKEN:!1}function Pa(r){return[r.homeAccountId,r.environment].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}function Na(r){const e=r.credentialType===I.REFRESH_TOKEN&&r.familyId||r.clientId;return[r.credentialType,e,r.realm||""].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}function Ma(r){return(r.target||"").toLowerCase()}function Ua(r){return(r.requestedClaimsHash||"").toLowerCase()}function Da(r){return r.tokenType&&r.tokenType.toLowerCase()!==v.BEARER.toLowerCase()?r.tokenType.toLowerCase():""}function La(r,e){const t=r.indexOf(D.CACHE_KEY)===0;let n=!0;return e&&(n=e.hasOwnProperty("failedRequests")&&e.hasOwnProperty("errors")&&e.hasOwnProperty("cacheHits")),t&&n}function Ha(r,e){let t=!1;r&&(t=r.indexOf(Be.THROTTLING_PREFIX)===0);let n=!0;return e&&(n=e.hasOwnProperty("throttleTime")),t&&n}function xa({environment:r,clientId:e}){return[fn,r,e].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}function Fa(r,e){return e?r.indexOf(fn)===0&&e.hasOwnProperty("clientId")&&e.hasOwnProperty("environment"):!1}function Ka(r,e){return e?r.indexOf(lt.CACHE_KEY)===0&&e.hasOwnProperty("aliases")&&e.hasOwnProperty("preferred_cache")&&e.hasOwnProperty("preferred_network")&&e.hasOwnProperty("canonical_authority")&&e.hasOwnProperty("authorization_endpoint")&&e.hasOwnProperty("token_endpoint")&&e.hasOwnProperty("issuer")&&e.hasOwnProperty("aliasesFromNetwork")&&e.hasOwnProperty("endpointsFromNetwork")&&e.hasOwnProperty("expiresAt")&&e.hasOwnProperty("jwks_uri"):!1}function ko(){return V()+lt.REFRESH_TIME_SECONDS}function tt(r,e,t){r.authorization_endpoint=e.authorization_endpoint,r.token_endpoint=e.token_endpoint,r.end_session_endpoint=e.end_session_endpoint,r.issuer=e.issuer,r.endpointsFromNetwork=t,r.jwks_uri=e.jwks_uri}function Vt(r,e,t){r.aliases=e.aliases,r.preferred_cache=e.preferred_cache,r.preferred_network=e.preferred_network,r.aliasesFromNetwork=t}function Ro(r){return r.expiresAt<=V()}/*! @azure/msal-common v15.7.1 2025-06-18 */const yr="redirect_uri_empty",Ba="claims_request_parsing_error",Tr="authority_uri_insecure",xe="url_parse_error",Ar="empty_url_error",Ir="empty_input_scopes_error",Er="invalid_prompt_value",bt="invalid_claims",wr="token_request_empty",Sr="logout_request_empty",_r="invalid_code_challenge_method",Ot="pkce_params_missing",_n="invalid_cloud_discovery_metadata",vr="invalid_authority_metadata",kr="untrusted_authority",Pt="missing_ssh_jwk",Rr="missing_ssh_kid",Ga="missing_nonce_authentication_header",za="invalid_authentication_header",br="cannot_set_OIDCOptions",Or="cannot_allow_platform_broker",Pr="authority_mismatch";/*! @azure/msal-common v15.7.1 2025-06-18 */const $a={[yr]:"A redirect URI is required for all calls, and none has been set.",[Ba]:"Could not parse the given claims request object.",[Tr]:"Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",[xe]:"URL could not be parsed into appropriate segments.",[Ar]:"URL was empty or null.",[Ir]:"Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",[Er]:"Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",[bt]:"Given claims parameter must be a stringified JSON object.",[wr]:"Token request was empty and not found in cache.",[Sr]:"The logout request was null or undefined.",[_r]:'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',[Ot]:"Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",[_n]:"Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",[vr]:"Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",[kr]:"The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",[Pt]:"Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",[Rr]:"Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",[Ga]:"Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",[za]:"Invalid authentication header provided",[br]:"Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",[Or]:"Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",[Pr]:"Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."};class vn extends b{constructor(e){super(e,$a[e]),this.name="ClientConfigurationError",Object.setPrototypeOf(this,vn.prototype)}}function k(r){return new vn(r)}/*! @azure/msal-common v15.7.1 2025-06-18 */class ie{static isEmptyObj(e){if(e)try{const t=JSON.parse(e);return Object.keys(t).length===0}catch{}return!0}static startsWith(e,t){return e.indexOf(t)===0}static endsWith(e,t){return e.length>=t.length&&e.lastIndexOf(t)===e.length-t.length}static queryStringToObject(e){const t={},n=e.split("&"),o=i=>decodeURIComponent(i.replace(/\+/g," "));return n.forEach(i=>{if(i.trim()){const[a,s]=i.split(/=(.+)/g,2);a&&s&&(t[o(a)]=o(s))}}),t}static trimArrayEntries(e){return e.map(t=>t.trim())}static removeEmptyStringsFromArray(e){return e.filter(t=>!!t)}static jsonParseHelper(e){try{return JSON.parse(e)}catch{return null}}static matchPattern(e,t){return new RegExp(e.replace(/\\/g,"\\\\").replace(/\*/g,"[^ ]*").replace(/\?/g,"\\?")).test(t)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class N{constructor(e){const t=e?ie.trimArrayEntries([...e]):[],n=t?ie.removeEmptyStringsFromArray(t):[];if(!n||!n.length)throw k(Ir);this.scopes=new Set,n.forEach(o=>this.scopes.add(o))}static fromString(e){const n=(e||u.EMPTY_STRING).split(" ");return new N(n)}static createSearchScopes(e){const t=new N(e);return t.containsOnlyOIDCScopes()?t.removeScope(u.OFFLINE_ACCESS_SCOPE):t.removeOIDCScopes(),t}containsScope(e){const t=this.printScopesLowerCase().split(" "),n=new N(t);return e?n.scopes.has(e.toLowerCase()):!1}containsScopeSet(e){return!e||e.scopes.size<=0?!1:this.scopes.size>=e.scopes.size&&e.asArray().every(t=>this.containsScope(t))}containsOnlyOIDCScopes(){let e=0;return Ao.forEach(t=>{this.containsScope(t)&&(e+=1)}),this.scopes.size===e}appendScope(e){e&&this.scopes.add(e.trim())}appendScopes(e){try{e.forEach(t=>this.appendScope(t))}catch{throw m(lr)}}removeScope(e){if(!e)throw m(cr);this.scopes.delete(e.trim())}removeOIDCScopes(){Ao.forEach(e=>{this.scopes.delete(e)})}unionScopeSets(e){if(!e)throw m(Xt);const t=new Set;return e.scopes.forEach(n=>t.add(n.toLowerCase())),this.scopes.forEach(n=>t.add(n.toLowerCase())),t}intersectingScopeSets(e){if(!e)throw m(Xt);e.containsOnlyOIDCScopes()||e.removeOIDCScopes();const t=this.unionScopeSets(e),n=e.getScopeCount(),o=this.getScopeCount();return t.size<o+n}getScopeCount(){return this.scopes.size}asArray(){const e=[];return this.scopes.forEach(t=>e.push(t)),e}printScopes(){return this.scopes?this.asArray().join(" "):u.EMPTY_STRING}printScopesLowerCase(){return this.printScopes().toLowerCase()}}/*! @azure/msal-common v15.7.1 2025-06-18 */function ut(r,e){if(!r)throw m(Xo);try{const t=e(r);return JSON.parse(t)}catch{throw m(mn)}}function be(r){if(!r)throw m(mn);const e=r.split(x.CLIENT_INFO_SEPARATOR,2);return{uid:e[0],utid:e.length<2?u.EMPTY_STRING:e[1]}}/*! @azure/msal-common v15.7.1 2025-06-18 */function bo(r,e){return!!r&&!!e&&r===e.split(".")[1]}function kn(r,e,t,n){if(n){const{oid:o,sub:i,tid:a,name:s,tfp:c,acr:l}=n,d=a||c||l||"";return{tenantId:d,localAccountId:o||i||"",name:s,isHomeTenant:bo(d,r)}}else return{tenantId:t,localAccountId:e,isHomeTenant:bo(t,r)}}function Rn(r,e,t,n){let o=r;if(e){const{isHomeTenant:i,...a}=e;o={...r,...a}}if(t){const{isHomeTenant:i,...a}=kn(r.homeAccountId,r.localAccountId,r.tenantId,t);return o={...o,...a,idTokenClaims:t,idToken:n},o}return o}/*! @azure/msal-common v15.7.1 2025-06-18 */const W={Default:0,Adfs:1,Dsts:2,Ciam:3};/*! @azure/msal-common v15.7.1 2025-06-18 */function Nr(r){return r&&(r.tid||r.tfp||r.acr)||null}/*! @azure/msal-common v15.7.1 2025-06-18 */const q={AAD:"AAD",OIDC:"OIDC",EAR:"EAR"};/*! @azure/msal-common v15.7.1 2025-06-18 */class B{generateAccountId(){return[this.homeAccountId,this.environment].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}generateAccountKey(){return B.generateAccountCacheKey({homeAccountId:this.homeAccountId,environment:this.environment,tenantId:this.realm,username:this.username,localAccountId:this.localAccountId})}getAccountInfo(){return{homeAccountId:this.homeAccountId,environment:this.environment,tenantId:this.realm,username:this.username,localAccountId:this.localAccountId,name:this.name,nativeAccountId:this.nativeAccountId,authorityType:this.authorityType,tenantProfiles:new Map((this.tenantProfiles||[]).map(e=>[e.tenantId,e]))}}isSingleTenant(){return!this.tenantProfiles}static generateAccountCacheKey(e){const t=e.homeAccountId.split(".")[1];return[e.homeAccountId,e.environment||"",t||e.tenantId||""].join(x.CACHE_KEY_SEPARATOR).toLowerCase()}static createAccount(e,t,n){var l,d,g,p,y,w;const o=new B;t.authorityType===W.Adfs?o.authorityType=et.ADFS_ACCOUNT_TYPE:t.protocolMode===q.OIDC?o.authorityType=et.GENERIC_ACCOUNT_TYPE:o.authorityType=et.MSSTS_ACCOUNT_TYPE;let i;e.clientInfo&&n&&(i=ut(e.clientInfo,n)),o.clientInfo=e.clientInfo,o.homeAccountId=e.homeAccountId,o.nativeAccountId=e.nativeAccountId;const a=e.environment||t&&t.getPreferredCache();if(!a)throw m(Tn);o.environment=a,o.realm=(i==null?void 0:i.utid)||Nr(e.idTokenClaims)||"",o.localAccountId=(i==null?void 0:i.uid)||((l=e.idTokenClaims)==null?void 0:l.oid)||((d=e.idTokenClaims)==null?void 0:d.sub)||"";const s=((g=e.idTokenClaims)==null?void 0:g.preferred_username)||((p=e.idTokenClaims)==null?void 0:p.upn),c=(y=e.idTokenClaims)!=null&&y.emails?e.idTokenClaims.emails[0]:null;if(o.username=s||c||"",o.name=((w=e.idTokenClaims)==null?void 0:w.name)||"",o.cloudGraphHostName=e.cloudGraphHostName,o.msGraphHost=e.msGraphHost,e.tenantProfiles)o.tenantProfiles=e.tenantProfiles;else{const S=kn(e.homeAccountId,o.localAccountId,o.realm,e.idTokenClaims);o.tenantProfiles=[S]}return o}static createFromAccountInfo(e,t,n){var i;const o=new B;return o.authorityType=e.authorityType||et.GENERIC_ACCOUNT_TYPE,o.homeAccountId=e.homeAccountId,o.localAccountId=e.localAccountId,o.nativeAccountId=e.nativeAccountId,o.realm=e.tenantId,o.environment=e.environment,o.username=e.username,o.name=e.name,o.cloudGraphHostName=t,o.msGraphHost=n,o.tenantProfiles=Array.from(((i=e.tenantProfiles)==null?void 0:i.values())||[]),o}static generateHomeAccountId(e,t,n,o,i){if(!(t===W.Adfs||t===W.Dsts)){if(e)try{const a=ut(e,o.base64Decode);if(a.uid&&a.utid)return`${a.uid}.${a.utid}`}catch{}n.warning("No client info in response")}return(i==null?void 0:i.sub)||""}static isAccountEntity(e){return e?e.hasOwnProperty("homeAccountId")&&e.hasOwnProperty("environment")&&e.hasOwnProperty("realm")&&e.hasOwnProperty("localAccountId")&&e.hasOwnProperty("username")&&e.hasOwnProperty("authorityType"):!1}static accountInfoIsEqual(e,t,n){if(!e||!t)return!1;let o=!0;if(n){const i=e.idTokenClaims||{},a=t.idTokenClaims||{};o=i.iat===a.iat&&i.nonce===a.nonce}return e.homeAccountId===t.homeAccountId&&e.localAccountId===t.localAccountId&&e.username===t.username&&e.tenantId===t.tenantId&&e.environment===t.environment&&e.nativeAccountId===t.nativeAccountId&&o}}/*! @azure/msal-common v15.7.1 2025-06-18 */function Mr(r){return r.startsWith("#/")?r.substring(2):r.startsWith("#")||r.startsWith("?")?r.substring(1):r}function gt(r){if(!r||r.indexOf("=")<0)return null;try{const e=Mr(r),t=Object.fromEntries(new URLSearchParams(e));if(t.code||t.ear_jwe||t.error||t.error_description||t.state)return t}catch{throw m(nr)}return null}function $e(r,e=!0,t){const n=new Array;return r.forEach((o,i)=>{!e&&t&&i in t?n.push(`${i}=${o}`):n.push(`${i}=${encodeURIComponent(o)}`)}),n.join("&")}/*! @azure/msal-common v15.7.1 2025-06-18 */class _{get urlString(){return this._urlString}constructor(e){if(this._urlString=e,!this._urlString)throw k(Ar);e.includes("#")||(this._urlString=_.canonicalizeUri(e))}static canonicalizeUri(e){if(e){let t=e.toLowerCase();return ie.endsWith(t,"?")?t=t.slice(0,-1):ie.endsWith(t,"?/")&&(t=t.slice(0,-2)),ie.endsWith(t,"/")||(t+="/"),t}return e}validateAsUri(){let e;try{e=this.getUrlComponents()}catch{throw k(xe)}if(!e.HostNameAndPort||!e.PathSegments)throw k(xe);if(!e.Protocol||e.Protocol.toLowerCase()!=="https:")throw k(Tr)}static appendQueryString(e,t){return t?e.indexOf("?")<0?`${e}?${t}`:`${e}&${t}`:e}static removeHashFromUrl(e){return _.canonicalizeUri(e.split("#")[0])}replaceTenantPath(e){const t=this.getUrlComponents(),n=t.PathSegments;return e&&n.length!==0&&(n[0]===ge.COMMON||n[0]===ge.ORGANIZATIONS)&&(n[0]=e),_.constructAuthorityUriFromObject(t)}getUrlComponents(){const e=RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?"),t=this.urlString.match(e);if(!t)throw k(xe);const n={Protocol:t[1],HostNameAndPort:t[4],AbsolutePath:t[5],QueryString:t[7]};let o=n.AbsolutePath.split("/");return o=o.filter(i=>i&&i.length>0),n.PathSegments=o,n.QueryString&&n.QueryString.endsWith("/")&&(n.QueryString=n.QueryString.substring(0,n.QueryString.length-1)),n}static getDomainFromUrl(e){const t=RegExp("^([^:/?#]+://)?([^/?#]*)"),n=e.match(t);if(!n)throw k(xe);return n[2]}static getAbsoluteUrl(e,t){if(e[0]===u.FORWARD_SLASH){const o=new _(t).getUrlComponents();return o.Protocol+"//"+o.HostNameAndPort+e}return e}static constructAuthorityUriFromObject(e){return new _(e.Protocol+"//"+e.HostNameAndPort+"/"+e.PathSegments.join("/"))}static hashContainsKnownProperties(e){return!!gt(e)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const Ur={endpointMetadata:{"login.microsoftonline.com":{token_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.com/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.com/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/logout"},"login.chinacloudapi.cn":{token_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.chinacloudapi.cn/{tenantid}/discovery/v2.0/keys",issuer:"https://login.partner.microsoftonline.cn/{tenantid}/v2.0",authorization_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/logout"},"login.microsoftonline.us":{token_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.us/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.us/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/logout"}},instanceDiscoveryMetadata:{metadata:[{preferred_network:"login.microsoftonline.com",preferred_cache:"login.windows.net",aliases:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{preferred_network:"login.partner.microsoftonline.cn",preferred_cache:"login.partner.microsoftonline.cn",aliases:["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{preferred_network:"login.microsoftonline.de",preferred_cache:"login.microsoftonline.de",aliases:["login.microsoftonline.de"]},{preferred_network:"login.microsoftonline.us",preferred_cache:"login.microsoftonline.us",aliases:["login.microsoftonline.us","login.usgovcloudapi.net"]},{preferred_network:"login-us.microsoftonline.com",preferred_cache:"login-us.microsoftonline.com",aliases:["login-us.microsoftonline.com"]}]}},Oo=Ur.endpointMetadata,bn=Ur.instanceDiscoveryMetadata,Dr=new Set;bn.metadata.forEach(r=>{r.aliases.forEach(e=>{Dr.add(e)})});function qa(r,e){var o;let t;const n=r.canonicalAuthority;if(n){const i=new _(n).getUrlComponents().HostNameAndPort;t=Po(i,(o=r.cloudDiscoveryMetadata)==null?void 0:o.metadata,$.CONFIG,e)||Po(i,bn.metadata,$.HARDCODED_VALUES,e)||r.knownAuthorities}return t||[]}function Po(r,e,t,n){if(n==null||n.trace(`getAliasesFromMetadata called with source: ${t}`),r&&e){const o=ft(e,r);if(o)return n==null||n.trace(`getAliasesFromMetadata: found cloud discovery metadata in ${t}, returning aliases`),o.aliases;n==null||n.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in ${t}`)}return null}function Va(r){return ft(bn.metadata,r)}function ft(r,e){for(let t=0;t<r.length;t++){const n=r[t];if(n.aliases.includes(e))return n}return null}/*! @azure/msal-common v15.7.1 2025-06-18 */const Lr="cache_quota_exceeded",On="cache_error_unknown";/*! @azure/msal-common v15.7.1 2025-06-18 */const Qt={[Lr]:"Exceeded cache storage capacity.",[On]:"Unexpected error occurred when using cache storage."};class Oe extends Error{constructor(e,t){const n=t||(Qt[e]?Qt[e]:Qt[On]);super(`${e}: ${n}`),Object.setPrototypeOf(this,Oe.prototype),this.name="CacheError",this.errorCode=e,this.errorMessage=n}}/*! @azure/msal-common v15.7.1 2025-06-18 */class on{constructor(e,t,n,o,i){this.clientId=e,this.cryptoImpl=t,this.commonLogger=n.clone(mr,En),this.staticAuthorityOptions=i,this.performanceClient=o}getAllAccounts(e){return this.buildTenantProfiles(this.getAccountsFilteredBy(e||{}),e)}getAccountInfoFilteredBy(e){const t=this.getAllAccounts(e);return t.length>1?t.sort(o=>o.idTokenClaims?-1:1)[0]:t.length===1?t[0]:null}getBaseAccountInfo(e){const t=this.getAccountsFilteredBy(e);return t.length>0?t[0].getAccountInfo():null}buildTenantProfiles(e,t){return e.flatMap(n=>this.getTenantProfilesFromAccountEntity(n,t==null?void 0:t.tenantId,t))}getTenantedAccountInfoByFilter(e,t,n,o){let i=null,a;if(o&&!this.tenantProfileMatchesFilter(n,o))return null;const s=this.getIdToken(e,t,n.tenantId);return s&&(a=Me(s.secret,this.cryptoImpl.base64Decode),!this.idTokenClaimsMatchTenantProfileFilter(a,o))?null:(i=Rn(e,n,a,s==null?void 0:s.secret),i)}getTenantProfilesFromAccountEntity(e,t,n){const o=e.getAccountInfo();let i=o.tenantProfiles||new Map;const a=this.getTokenKeys();if(t){const c=i.get(t);if(c)i=new Map([[t,c]]);else return[]}const s=[];return i.forEach(c=>{const l=this.getTenantedAccountInfoByFilter(o,a,c,n);l&&s.push(l)}),s}tenantProfileMatchesFilter(e,t){return!(t.localAccountId&&!this.matchLocalAccountIdFromTenantProfile(e,t.localAccountId)||t.name&&e.name!==t.name||t.isHomeTenant!==void 0&&e.isHomeTenant!==t.isHomeTenant)}idTokenClaimsMatchTenantProfileFilter(e,t){return!(t&&(t.localAccountId&&!this.matchLocalAccountIdFromTokenClaims(e,t.localAccountId)||t.loginHint&&!this.matchLoginHintFromTokenClaims(e,t.loginHint)||t.username&&!this.matchUsername(e.preferred_username,t.username)||t.name&&!this.matchName(e,t.name)||t.sid&&!this.matchSid(e,t.sid)))}async saveCacheRecord(e,t,n){var o,i,a,s;if(!e)throw m(hr);try{e.account&&await this.setAccount(e.account,t),e.idToken&&(n==null?void 0:n.idToken)!==!1&&await this.setIdTokenCredential(e.idToken,t),e.accessToken&&(n==null?void 0:n.accessToken)!==!1&&await this.saveAccessToken(e.accessToken,t),e.refreshToken&&(n==null?void 0:n.refreshToken)!==!1&&await this.setRefreshTokenCredential(e.refreshToken,t),e.appMetadata&&this.setAppMetadata(e.appMetadata)}catch(c){throw(o=this.commonLogger)==null||o.error("CacheManager.saveCacheRecord: failed"),c instanceof Error?((i=this.commonLogger)==null||i.errorPii(`CacheManager.saveCacheRecord: ${c.message}`,t),c.name==="QuotaExceededError"||c.name==="NS_ERROR_DOM_QUOTA_REACHED"||c.message.includes("exceeded the quota")?((a=this.commonLogger)==null||a.error("CacheManager.saveCacheRecord: exceeded storage quota",t),new Oe(Lr)):new Oe(c.name,c.message)):((s=this.commonLogger)==null||s.errorPii(`CacheManager.saveCacheRecord: ${c}`,t),new Oe(On))}}async saveAccessToken(e,t){const n={clientId:e.clientId,credentialType:e.credentialType,environment:e.environment,homeAccountId:e.homeAccountId,realm:e.realm,tokenType:e.tokenType,requestedClaimsHash:e.requestedClaimsHash},o=this.getTokenKeys(),i=N.fromString(e.target);o.accessToken.forEach(a=>{if(!this.accessTokenKeyMatchesFilter(a,n,!1))return;const s=this.getAccessTokenCredential(a);s&&this.credentialMatchesFilter(s,n)&&N.fromString(s.target).intersectingScopeSets(i)&&this.removeAccessToken(a,t)}),await this.setAccessTokenCredential(e,t)}getAccountsFilteredBy(e){const t=this.getAccountKeys(),n=[];return t.forEach(o=>{var c;if(!this.isAccountKey(o,e.homeAccountId))return;const i=this.getAccount(o,this.commonLogger);if(!i||e.homeAccountId&&!this.matchHomeAccountId(i,e.homeAccountId)||e.username&&!this.matchUsername(i.username,e.username)||e.environment&&!this.matchEnvironment(i,e.environment)||e.realm&&!this.matchRealm(i,e.realm)||e.nativeAccountId&&!this.matchNativeAccountId(i,e.nativeAccountId)||e.authorityType&&!this.matchAuthorityType(i,e.authorityType))return;const a={localAccountId:e==null?void 0:e.localAccountId,name:e==null?void 0:e.name},s=(c=i.tenantProfiles)==null?void 0:c.filter(l=>this.tenantProfileMatchesFilter(l,a));s&&s.length===0||n.push(i)}),n}isAccountKey(e,t,n){return!(e.split(x.CACHE_KEY_SEPARATOR).length<3||t&&!e.toLowerCase().includes(t.toLowerCase())||n&&!e.toLowerCase().includes(n.toLowerCase()))}isCredentialKey(e){if(e.split(x.CACHE_KEY_SEPARATOR).length<6)return!1;const t=e.toLowerCase();if(t.indexOf(I.ID_TOKEN.toLowerCase())===-1&&t.indexOf(I.ACCESS_TOKEN.toLowerCase())===-1&&t.indexOf(I.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())===-1&&t.indexOf(I.REFRESH_TOKEN.toLowerCase())===-1)return!1;if(t.indexOf(I.REFRESH_TOKEN.toLowerCase())>-1){const n=`${I.REFRESH_TOKEN}${x.CACHE_KEY_SEPARATOR}${this.clientId}${x.CACHE_KEY_SEPARATOR}`,o=`${I.REFRESH_TOKEN}${x.CACHE_KEY_SEPARATOR}${Ke}${x.CACHE_KEY_SEPARATOR}`;if(t.indexOf(n.toLowerCase())===-1&&t.indexOf(o.toLowerCase())===-1)return!1}else if(t.indexOf(this.clientId.toLowerCase())===-1)return!1;return!0}credentialMatchesFilter(e,t){return!(t.clientId&&!this.matchClientId(e,t.clientId)||t.userAssertionHash&&!this.matchUserAssertionHash(e,t.userAssertionHash)||typeof t.homeAccountId=="string"&&!this.matchHomeAccountId(e,t.homeAccountId)||t.environment&&!this.matchEnvironment(e,t.environment)||t.realm&&!this.matchRealm(e,t.realm)||t.credentialType&&!this.matchCredentialType(e,t.credentialType)||t.familyId&&!this.matchFamilyId(e,t.familyId)||t.target&&!this.matchTarget(e,t.target)||(t.requestedClaimsHash||e.requestedClaimsHash)&&e.requestedClaimsHash!==t.requestedClaimsHash||e.credentialType===I.ACCESS_TOKEN_WITH_AUTH_SCHEME&&(t.tokenType&&!this.matchTokenType(e,t.tokenType)||t.tokenType===v.SSH&&t.keyId&&!this.matchKeyId(e,t.keyId)))}getAppMetadataFilteredBy(e){const t=this.getKeys(),n={};return t.forEach(o=>{if(!this.isAppMetadata(o))return;const i=this.getAppMetadata(o);i&&(e.environment&&!this.matchEnvironment(i,e.environment)||e.clientId&&!this.matchClientId(i,e.clientId)||(n[o]=i))}),n}getAuthorityMetadataByAlias(e){const t=this.getAuthorityMetadataKeys();let n=null;return t.forEach(o=>{if(!this.isAuthorityMetadata(o)||o.indexOf(this.clientId)===-1)return;const i=this.getAuthorityMetadata(o);i&&i.aliases.indexOf(e)!==-1&&(n=i)}),n}removeAllAccounts(e){this.getAccountKeys().forEach(n=>{this.removeAccount(n,e)})}removeAccount(e,t){const n=this.getAccount(e,this.commonLogger);n&&(this.removeAccountContext(n,t),this.removeItem(e))}removeAccountContext(e,t){const n=this.getTokenKeys(),o=e.generateAccountId();n.idToken.forEach(i=>{i.indexOf(o)===0&&this.removeIdToken(i)}),n.accessToken.forEach(i=>{i.indexOf(o)===0&&this.removeAccessToken(i,t)}),n.refreshToken.forEach(i=>{i.indexOf(o)===0&&this.removeRefreshToken(i)})}removeAccessToken(e,t){const n=this.getAccessTokenCredential(e);if(n&&(this.removeItem(e),n.credentialType.toLowerCase()===I.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()&&n.tokenType===v.POP)){const i=n.keyId;i&&this.cryptoImpl.removeTokenBindingKey(i).catch(()=>{var a;this.commonLogger.error(`Failed to remove token binding key ${i}`,t),(a=this.performanceClient)==null||a.incrementFields({removeTokenBindingKeyFailure:1},t)})}}removeAppMetadata(){return this.getKeys().forEach(t=>{this.isAppMetadata(t)&&this.removeItem(t)}),!0}readAccountFromCache(e){const t=B.generateAccountCacheKey(e);return this.getAccount(t,this.commonLogger)}getIdToken(e,t,n,o,i){this.commonLogger.trace("CacheManager - getIdToken called");const a={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:I.ID_TOKEN,clientId:this.clientId,realm:n},s=this.getIdTokensByFilter(a,t),c=s.size;if(c<1)return this.commonLogger.info("CacheManager:getIdToken - No token found"),null;if(c>1){let l=s;if(!n){const d=new Map;s.forEach((p,y)=>{p.realm===e.tenantId&&d.set(y,p)});const g=d.size;if(g<1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result"),s.values().next().value;if(g===1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile"),d.values().next().value;l=d}return this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them"),l.forEach((d,g)=>{this.removeIdToken(g)}),o&&i&&o.addFields({multiMatchedID:s.size},i),null}return this.commonLogger.info("CacheManager:getIdToken - Returning ID token"),s.values().next().value}getIdTokensByFilter(e,t){const n=t&&t.idToken||this.getTokenKeys().idToken,o=new Map;return n.forEach(i=>{if(!this.idTokenKeyMatchesFilter(i,{clientId:this.clientId,...e}))return;const a=this.getIdTokenCredential(i);a&&this.credentialMatchesFilter(a,e)&&o.set(i,a)}),o}idTokenKeyMatchesFilter(e,t){const n=e.toLowerCase();return!(t.clientId&&n.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&n.indexOf(t.homeAccountId.toLowerCase())===-1)}removeIdToken(e){this.removeItem(e)}removeRefreshToken(e){this.removeItem(e)}getAccessToken(e,t,n,o){const i=t.correlationId;this.commonLogger.trace("CacheManager - getAccessToken called",i);const a=N.createSearchScopes(t.scopes),s=t.authenticationScheme||v.BEARER,c=s.toLowerCase()!==v.BEARER.toLowerCase()?I.ACCESS_TOKEN_WITH_AUTH_SCHEME:I.ACCESS_TOKEN,l={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:c,clientId:this.clientId,realm:o||e.tenantId,target:a,tokenType:s,keyId:t.sshKid,requestedClaimsHash:t.requestedClaimsHash},d=n&&n.accessToken||this.getTokenKeys().accessToken,g=[];d.forEach(y=>{if(this.accessTokenKeyMatchesFilter(y,l,!0)){const w=this.getAccessTokenCredential(y);w&&this.credentialMatchesFilter(w,l)&&g.push(w)}});const p=g.length;return p<1?(this.commonLogger.info("CacheManager:getAccessToken - No token found",i),null):p>1?(this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them",i),g.forEach(y=>{this.removeAccessToken(Ge(y),i)}),this.performanceClient.addFields({multiMatchedAT:g.length},i),null):(this.commonLogger.info("CacheManager:getAccessToken - Returning access token",i),g[0])}accessTokenKeyMatchesFilter(e,t,n){const o=e.toLowerCase();if(t.clientId&&o.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&o.indexOf(t.homeAccountId.toLowerCase())===-1||t.realm&&o.indexOf(t.realm.toLowerCase())===-1||t.requestedClaimsHash&&o.indexOf(t.requestedClaimsHash.toLowerCase())===-1)return!1;if(t.target){const i=t.target.asArray();for(let a=0;a<i.length;a++){if(n&&!o.includes(i[a].toLowerCase()))return!1;if(!n&&o.includes(i[a].toLowerCase()))return!0}}return!0}getAccessTokensByFilter(e){const t=this.getTokenKeys(),n=[];return t.accessToken.forEach(o=>{if(!this.accessTokenKeyMatchesFilter(o,e,!0))return;const i=this.getAccessTokenCredential(o);i&&this.credentialMatchesFilter(i,e)&&n.push(i)}),n}getRefreshToken(e,t,n,o,i){this.commonLogger.trace("CacheManager - getRefreshToken called");const a=t?Ke:void 0,s={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:I.REFRESH_TOKEN,clientId:this.clientId,familyId:a},c=n&&n.refreshToken||this.getTokenKeys().refreshToken,l=[];c.forEach(g=>{if(this.refreshTokenKeyMatchesFilter(g,s)){const p=this.getRefreshTokenCredential(g);p&&this.credentialMatchesFilter(p,s)&&l.push(p)}});const d=l.length;return d<1?(this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found."),null):(d>1&&o&&i&&o.addFields({multiMatchedRT:d},i),this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token"),l[0])}refreshTokenKeyMatchesFilter(e,t){const n=e.toLowerCase();return!(t.familyId&&n.indexOf(t.familyId.toLowerCase())===-1||!t.familyId&&t.clientId&&n.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&n.indexOf(t.homeAccountId.toLowerCase())===-1)}readAppMetadataFromCache(e){const t={environment:e,clientId:this.clientId},n=this.getAppMetadataFilteredBy(t),o=Object.keys(n).map(a=>n[a]),i=o.length;if(i<1)return null;if(i>1)throw m(ar);return o[0]}isAppMetadataFOCI(e){const t=this.readAppMetadataFromCache(e);return!!(t&&t.familyId===Ke)}matchHomeAccountId(e,t){return typeof e.homeAccountId=="string"&&t===e.homeAccountId}matchLocalAccountIdFromTokenClaims(e,t){const n=e.oid||e.sub;return t===n}matchLocalAccountIdFromTenantProfile(e,t){return e.localAccountId===t}matchName(e,t){var n;return t.toLowerCase()===((n=e.name)==null?void 0:n.toLowerCase())}matchUsername(e,t){return!!(e&&typeof e=="string"&&(t==null?void 0:t.toLowerCase())===e.toLowerCase())}matchUserAssertionHash(e,t){return!!(e.userAssertionHash&&t===e.userAssertionHash)}matchEnvironment(e,t){if(this.staticAuthorityOptions){const o=qa(this.staticAuthorityOptions,this.commonLogger);if(o.includes(t)&&o.includes(e.environment))return!0}const n=this.getAuthorityMetadataByAlias(t);return!!(n&&n.aliases.indexOf(e.environment)>-1)}matchCredentialType(e,t){return e.credentialType&&t.toLowerCase()===e.credentialType.toLowerCase()}matchClientId(e,t){return!!(e.clientId&&t===e.clientId)}matchFamilyId(e,t){return!!(e.familyId&&t===e.familyId)}matchRealm(e,t){var n;return((n=e.realm)==null?void 0:n.toLowerCase())===t.toLowerCase()}matchNativeAccountId(e,t){return!!(e.nativeAccountId&&t===e.nativeAccountId)}matchLoginHintFromTokenClaims(e,t){return e.login_hint===t||e.preferred_username===t||e.upn===t}matchSid(e,t){return e.sid===t}matchAuthorityType(e,t){return!!(e.authorityType&&t.toLowerCase()===e.authorityType.toLowerCase())}matchTarget(e,t){return e.credentialType!==I.ACCESS_TOKEN&&e.credentialType!==I.ACCESS_TOKEN_WITH_AUTH_SCHEME||!e.target?!1:N.fromString(e.target).containsScopeSet(t)}matchTokenType(e,t){return!!(e.tokenType&&e.tokenType===t)}matchKeyId(e,t){return!!(e.keyId&&e.keyId===t)}isAppMetadata(e){return e.indexOf(fn)!==-1}isAuthorityMetadata(e){return e.indexOf(lt.CACHE_KEY)!==-1}generateAuthorityMetadataCacheKey(e){return`${lt.CACHE_KEY}-${this.clientId}-${e}`}static toObject(e,t){for(const n in t)e[n]=t[n];return e}}class Qa extends on{async setAccount(){throw m(E)}getAccount(){throw m(E)}async setIdTokenCredential(){throw m(E)}getIdTokenCredential(){throw m(E)}async setAccessTokenCredential(){throw m(E)}getAccessTokenCredential(){throw m(E)}async setRefreshTokenCredential(){throw m(E)}getRefreshTokenCredential(){throw m(E)}setAppMetadata(){throw m(E)}getAppMetadata(){throw m(E)}setServerTelemetry(){throw m(E)}getServerTelemetry(){throw m(E)}setAuthorityMetadata(){throw m(E)}getAuthorityMetadata(){throw m(E)}getAuthorityMetadataKeys(){throw m(E)}setThrottlingCache(){throw m(E)}getThrottlingCache(){throw m(E)}removeItem(){throw m(E)}getKeys(){throw m(E)}getAccountKeys(){throw m(E)}getTokenKeys(){throw m(E)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const h={AcquireTokenByCode:"acquireTokenByCode",AcquireTokenByRefreshToken:"acquireTokenByRefreshToken",AcquireTokenSilent:"acquireTokenSilent",AcquireTokenSilentAsync:"acquireTokenSilentAsync",AcquireTokenPopup:"acquireTokenPopup",AcquireTokenPreRedirect:"acquireTokenPreRedirect",AcquireTokenRedirect:"acquireTokenRedirect",CryptoOptsGetPublicKeyThumbprint:"cryptoOptsGetPublicKeyThumbprint",CryptoOptsSignJwt:"cryptoOptsSignJwt",SilentCacheClientAcquireToken:"silentCacheClientAcquireToken",SilentIframeClientAcquireToken:"silentIframeClientAcquireToken",AwaitConcurrentIframe:"awaitConcurrentIframe",SilentRefreshClientAcquireToken:"silentRefreshClientAcquireToken",SsoSilent:"ssoSilent",StandardInteractionClientGetDiscoveredAuthority:"standardInteractionClientGetDiscoveredAuthority",FetchAccountIdWithNativeBroker:"fetchAccountIdWithNativeBroker",NativeInteractionClientAcquireToken:"nativeInteractionClientAcquireToken",BaseClientCreateTokenRequestHeaders:"baseClientCreateTokenRequestHeaders",NetworkClientSendPostRequestAsync:"networkClientSendPostRequestAsync",RefreshTokenClientExecutePostToTokenEndpoint:"refreshTokenClientExecutePostToTokenEndpoint",AuthorizationCodeClientExecutePostToTokenEndpoint:"authorizationCodeClientExecutePostToTokenEndpoint",BrokerHandhshake:"brokerHandshake",AcquireTokenByRefreshTokenInBroker:"acquireTokenByRefreshTokenInBroker",AcquireTokenByBroker:"acquireTokenByBroker",RefreshTokenClientExecuteTokenRequest:"refreshTokenClientExecuteTokenRequest",RefreshTokenClientAcquireToken:"refreshTokenClientAcquireToken",RefreshTokenClientAcquireTokenWithCachedRefreshToken:"refreshTokenClientAcquireTokenWithCachedRefreshToken",RefreshTokenClientAcquireTokenByRefreshToken:"refreshTokenClientAcquireTokenByRefreshToken",RefreshTokenClientCreateTokenRequestBody:"refreshTokenClientCreateTokenRequestBody",AcquireTokenFromCache:"acquireTokenFromCache",SilentFlowClientAcquireCachedToken:"silentFlowClientAcquireCachedToken",SilentFlowClientGenerateResultFromCacheRecord:"silentFlowClientGenerateResultFromCacheRecord",AcquireTokenBySilentIframe:"acquireTokenBySilentIframe",InitializeBaseRequest:"initializeBaseRequest",InitializeSilentRequest:"initializeSilentRequest",InitializeClientApplication:"initializeClientApplication",InitializeCache:"initializeCache",SilentIframeClientTokenHelper:"silentIframeClientTokenHelper",SilentHandlerInitiateAuthRequest:"silentHandlerInitiateAuthRequest",SilentHandlerMonitorIframeForHash:"silentHandlerMonitorIframeForHash",SilentHandlerLoadFrame:"silentHandlerLoadFrame",SilentHandlerLoadFrameSync:"silentHandlerLoadFrameSync",StandardInteractionClientCreateAuthCodeClient:"standardInteractionClientCreateAuthCodeClient",StandardInteractionClientGetClientConfiguration:"standardInteractionClientGetClientConfiguration",StandardInteractionClientInitializeAuthorizationRequest:"standardInteractionClientInitializeAuthorizationRequest",GetAuthCodeUrl:"getAuthCodeUrl",GetStandardParams:"getStandardParams",HandleCodeResponseFromServer:"handleCodeResponseFromServer",HandleCodeResponse:"handleCodeResponse",HandleResponseEar:"handleResponseEar",HandleResponsePlatformBroker:"handleResponsePlatformBroker",HandleResponseCode:"handleResponseCode",UpdateTokenEndpointAuthority:"updateTokenEndpointAuthority",AuthClientAcquireToken:"authClientAcquireToken",AuthClientExecuteTokenRequest:"authClientExecuteTokenRequest",AuthClientCreateTokenRequestBody:"authClientCreateTokenRequestBody",PopTokenGenerateCnf:"popTokenGenerateCnf",PopTokenGenerateKid:"popTokenGenerateKid",HandleServerTokenResponse:"handleServerTokenResponse",DeserializeResponse:"deserializeResponse",AuthorityFactoryCreateDiscoveredInstance:"authorityFactoryCreateDiscoveredInstance",AuthorityResolveEndpointsAsync:"authorityResolveEndpointsAsync",AuthorityResolveEndpointsFromLocalSources:"authorityResolveEndpointsFromLocalSources",AuthorityGetCloudDiscoveryMetadataFromNetwork:"authorityGetCloudDiscoveryMetadataFromNetwork",AuthorityUpdateCloudDiscoveryMetadata:"authorityUpdateCloudDiscoveryMetadata",AuthorityGetEndpointMetadataFromNetwork:"authorityGetEndpointMetadataFromNetwork",AuthorityUpdateEndpointMetadata:"authorityUpdateEndpointMetadata",AuthorityUpdateMetadataWithRegionalInformation:"authorityUpdateMetadataWithRegionalInformation",RegionDiscoveryDetectRegion:"regionDiscoveryDetectRegion",RegionDiscoveryGetRegionFromIMDS:"regionDiscoveryGetRegionFromIMDS",RegionDiscoveryGetCurrentVersion:"regionDiscoveryGetCurrentVersion",AcquireTokenByCodeAsync:"acquireTokenByCodeAsync",GetEndpointMetadataFromNetwork:"getEndpointMetadataFromNetwork",GetCloudDiscoveryMetadataFromNetworkMeasurement:"getCloudDiscoveryMetadataFromNetworkMeasurement",HandleRedirectPromiseMeasurement:"handleRedirectPromise",HandleNativeRedirectPromiseMeasurement:"handleNativeRedirectPromise",UpdateCloudDiscoveryMetadataMeasurement:"updateCloudDiscoveryMetadataMeasurement",UsernamePasswordClientAcquireToken:"usernamePasswordClientAcquireToken",NativeMessageHandlerHandshake:"nativeMessageHandlerHandshake",NativeGenerateAuthResult:"nativeGenerateAuthResult",RemoveHiddenIframe:"removeHiddenIframe",ClearTokensAndKeysWithClaims:"clearTokensAndKeysWithClaims",CacheManagerGetRefreshToken:"cacheManagerGetRefreshToken",ImportExistingCache:"importExistingCache",SetUserData:"setUserData",LocalStorageUpdated:"localStorageUpdated",GeneratePkceCodes:"generatePkceCodes",GenerateCodeVerifier:"generateCodeVerifier",GenerateCodeChallengeFromVerifier:"generateCodeChallengeFromVerifier",Sha256Digest:"sha256Digest",GetRandomValues:"getRandomValues",GenerateHKDF:"generateHKDF",GenerateBaseKey:"generateBaseKey",Base64Decode:"base64Decode",UrlEncodeArr:"urlEncodeArr",Encrypt:"encrypt",Decrypt:"decrypt",GenerateEarKey:"generateEarKey",DecryptEarResponse:"decryptEarResponse"},Ya={InProgress:1};/*! @azure/msal-common v15.7.1 2025-06-18 */class No{startMeasurement(){}endMeasurement(){}flushMeasurement(){return null}}class Hr{generateId(){return"callback-id"}startMeasurement(e,t){return{end:()=>null,discard:()=>{},add:()=>{},increment:()=>{},event:{eventId:this.generateId(),status:Ya.InProgress,authority:"",libraryName:"",libraryVersion:"",clientId:"",name:e,startTimeMs:Date.now(),correlationId:t||""},measurement:new No}}startPerformanceMeasurement(){return new No}calculateQueuedTime(){return 0}addQueueMeasurement(){}setPreQueueTime(){}endMeasurement(){return null}discardMeasurements(){}removePerformanceCallback(){return!0}addPerformanceCallback(){return""}emitEvents(){}addFields(){}incrementFields(){}cacheEventByCorrelationId(){}}/*! @azure/msal-common v15.7.1 2025-06-18 */const xr={tokenRenewalOffsetSeconds:ua,preventCorsPreflight:!1},ja={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:O.Info,correlationId:u.EMPTY_STRING},Wa={claimsBasedCachingEnabled:!1},Ja={async sendGetRequestAsync(){throw m(E)},async sendPostRequestAsync(){throw m(E)}},Xa={sku:u.SKU,version:En,cpu:u.EMPTY_STRING,os:u.EMPTY_STRING},Za={clientSecret:u.EMPTY_STRING,clientAssertion:void 0},es={azureCloudInstance:wn.None,tenant:`${u.DEFAULT_COMMON_TENANT}`},ts={application:{appName:"",appVersion:""}};function ns({authOptions:r,systemOptions:e,loggerOptions:t,cacheOptions:n,storageInterface:o,networkInterface:i,cryptoInterface:a,clientCredentials:s,libraryInfo:c,telemetry:l,serverTelemetryManager:d,persistencePlugin:g,serializableCache:p}){const y={...ja,...t};return{authOptions:os(r),systemOptions:{...xr,...e},loggerOptions:y,cacheOptions:{...Wa,...n},storageInterface:o||new Qa(r.clientId,dt,new pe(y),new Hr),networkInterface:i||Ja,cryptoInterface:a||dt,clientCredentials:s||Za,libraryInfo:{...Xa,...c},telemetry:{...ts,...l},serverTelemetryManager:d||null,persistencePlugin:g||null,serializableCache:p||null}}function os(r){return{clientCapabilities:[],azureCloudOptions:es,skipAuthorityMetadataCache:!1,instanceAware:!1,encodeExtraQueryParams:!1,...r}}function Fr(r){return r.authOptions.authority.options.protocolMode===q.OIDC}/*! @azure/msal-common v15.7.1 2025-06-18 */const J={HOME_ACCOUNT_ID:"home_account_id",UPN:"UPN"};/*! @azure/msal-common v15.7.1 2025-06-18 */const Ae="client_id",Kr="redirect_uri",rs="response_type",is="response_mode",as="grant_type",ss="claims",cs="scope",ls="refresh_token",hs="state",ds="nonce",us="prompt",gs="code",fs="code_challenge",ms="code_challenge_method",ps="code_verifier",Cs="client-request-id",ys="x-client-SKU",Ts="x-client-VER",As="x-client-OS",Is="x-client-CPU",Es="x-client-current-telemetry",ws="x-client-last-telemetry",Ss="x-ms-lib-capability",_s="x-app-name",vs="x-app-ver",ks="post_logout_redirect_uri",Rs="id_token_hint",bs="client_secret",Os="client_assertion",Ps="client_assertion_type",Br="token_type",Gr="req_cnf",Mo="return_spa_code",Ns="nativebroker",Ms="logout_hint",Us="sid",Ds="login_hint",Ls="domain_hint",Hs="x-client-xtra-sku",mt="brk_client_id",pt="brk_redirect_uri",rn="instance_aware",xs="ear_jwk",Fs="ear_jwe_crypto";/*! @azure/msal-common v15.7.1 2025-06-18 */function Nt(r,e,t){if(!e)return;const n=r.get(Ae);n&&r.has(mt)&&(t==null||t.addFields({embeddedClientId:n,embeddedRedirectUri:r.get(Kr)},e))}function zr(r,e){r.set(rs,e)}function Ks(r,e){r.set(is,e||la.QUERY)}function Bs(r){r.set(Ns,"1")}function Pn(r,e,t=!0,n=je){t&&!n.includes("openid")&&!e.includes("openid")&&n.push("openid");const o=t?[...e||[],...n]:e||[],i=new N(o);r.set(cs,i.printScopes())}function Nn(r,e){r.set(Ae,e)}function Mn(r,e){r.set(Kr,e)}function Gs(r,e){r.set(ks,e)}function zs(r,e){r.set(Rs,e)}function $s(r,e){r.set(Ls,e)}function nt(r,e){r.set(Ds,e)}function Ct(r,e){r.set(K.CCS_HEADER,`UPN:${e}`)}function ze(r,e){r.set(K.CCS_HEADER,`Oid:${e.uid}@${e.utid}`)}function Uo(r,e){r.set(Us,e)}function Un(r,e,t){const n=Js(e,t);try{JSON.parse(n)}catch{throw k(bt)}r.set(ss,n)}function Dn(r,e){r.set(Cs,e)}function Ln(r,e){r.set(ys,e.sku),r.set(Ts,e.version),e.os&&r.set(As,e.os),e.cpu&&r.set(Is,e.cpu)}function Hn(r,e){e!=null&&e.appName&&r.set(_s,e.appName),e!=null&&e.appVersion&&r.set(vs,e.appVersion)}function qs(r,e){r.set(us,e)}function $r(r,e){e&&r.set(hs,e)}function Vs(r,e){r.set(ds,e)}function Qs(r,e,t){if(e&&t)r.set(fs,e),r.set(ms,t);else throw k(Ot)}function Ys(r,e){r.set(gs,e)}function js(r,e){r.set(ls,e)}function Ws(r,e){r.set(ps,e)}function qr(r,e){r.set(bs,e)}function Vr(r,e){e&&r.set(Os,e)}function Qr(r,e){e&&r.set(Ps,e)}function Yr(r,e){r.set(as,e)}function xn(r){r.set(ha,"1")}function jr(r){r.has(rn)||r.set(rn,"true")}function Te(r,e){Object.entries(e).forEach(([t,n])=>{!r.has(t)&&n&&r.set(t,n)})}function Js(r,e){let t;if(!r)t={};else try{t=JSON.parse(r)}catch{throw k(bt)}return e&&e.length>0&&(t.hasOwnProperty(Ze.ACCESS_TOKEN)||(t[Ze.ACCESS_TOKEN]={}),t[Ze.ACCESS_TOKEN][Ze.XMS_CC]={values:e}),JSON.stringify(t)}function Fn(r,e){e&&(r.set(Br,v.POP),r.set(Gr,e))}function Wr(r,e){e&&(r.set(Br,v.SSH),r.set(Gr,e))}function Jr(r,e){r.set(Es,e.generateCurrentRequestHeaderValue()),r.set(ws,e.generateLastRequestHeaderValue())}function Xr(r){r.set(Ss,Be.X_MS_LIB_CAPABILITY_VALUE)}function Xs(r,e){r.set(Ms,e)}function Mt(r,e,t){r.has(mt)||r.set(mt,e),r.has(pt)||r.set(pt,t)}function Zs(r,e){r.set(xs,encodeURIComponent(e)),r.set(Fs,"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0")}/*! @azure/msal-common v15.7.1 2025-06-18 */function ec(r){return r.hasOwnProperty("authorization_endpoint")&&r.hasOwnProperty("token_endpoint")&&r.hasOwnProperty("issuer")&&r.hasOwnProperty("jwks_uri")}/*! @azure/msal-common v15.7.1 2025-06-18 */function tc(r){return r.hasOwnProperty("tenant_discovery_endpoint")&&r.hasOwnProperty("metadata")}/*! @azure/msal-common v15.7.1 2025-06-18 */function nc(r){return r.hasOwnProperty("error")&&r.hasOwnProperty("error_description")}/*! @azure/msal-common v15.7.1 2025-06-18 */const j=(r,e,t,n,o)=>(...i)=>{t.trace(`Executing function ${e}`);const a=n==null?void 0:n.startMeasurement(e,o);if(o){const s=e+"CallCount";n==null||n.incrementFields({[s]:1},o)}try{const s=r(...i);return a==null||a.end({success:!0}),t.trace(`Returning result from ${e}`),s}catch(s){t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(s))}catch{t.trace("Unable to print error message.")}throw a==null||a.end({success:!1},s),s}},f=(r,e,t,n,o)=>(...i)=>{t.trace(`Executing function ${e}`);const a=n==null?void 0:n.startMeasurement(e,o);if(o){const s=e+"CallCount";n==null||n.incrementFields({[s]:1},o)}return n==null||n.setPreQueueTime(e,o),r(...i).then(s=>(t.trace(`Returning result from ${e}`),a==null||a.end({success:!0}),s)).catch(s=>{t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(s))}catch{t.trace("Unable to print error message.")}throw a==null||a.end({success:!1},s),s})};/*! @azure/msal-common v15.7.1 2025-06-18 */class Ut{constructor(e,t,n,o){this.networkInterface=e,this.logger=t,this.performanceClient=n,this.correlationId=o}async detectRegion(e,t){var o;(o=this.performanceClient)==null||o.addQueueMeasurement(h.RegionDiscoveryDetectRegion,this.correlationId);let n=e;if(n)t.region_source=_e.ENVIRONMENT_VARIABLE;else{const i=Ut.IMDS_OPTIONS;try{const a=await f(this.getRegionFromIMDS.bind(this),h.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(u.IMDS_VERSION,i);if(a.status===ue.SUCCESS&&(n=a.body,t.region_source=_e.IMDS),a.status===ue.BAD_REQUEST){const s=await f(this.getCurrentVersion.bind(this),h.RegionDiscoveryGetCurrentVersion,this.logger,this.performanceClient,this.correlationId)(i);if(!s)return t.region_source=_e.FAILED_AUTO_DETECTION,null;const c=await f(this.getRegionFromIMDS.bind(this),h.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(s,i);c.status===ue.SUCCESS&&(n=c.body,t.region_source=_e.IMDS)}}catch{return t.region_source=_e.FAILED_AUTO_DETECTION,null}}return n||(t.region_source=_e.FAILED_AUTO_DETECTION),n||null}async getRegionFromIMDS(e,t){var n;return(n=this.performanceClient)==null||n.addQueueMeasurement(h.RegionDiscoveryGetRegionFromIMDS,this.correlationId),this.networkInterface.sendGetRequestAsync(`${u.IMDS_ENDPOINT}?api-version=${e}&format=text`,t,u.IMDS_TIMEOUT)}async getCurrentVersion(e){var t;(t=this.performanceClient)==null||t.addQueueMeasurement(h.RegionDiscoveryGetCurrentVersion,this.correlationId);try{const n=await this.networkInterface.sendGetRequestAsync(`${u.IMDS_ENDPOINT}?format=json`,e);return n.status===ue.BAD_REQUEST&&n.body&&n.body["newest-versions"]&&n.body["newest-versions"].length>0?n.body["newest-versions"][0]:null}catch{return null}}}Ut.IMDS_OPTIONS={headers:{Metadata:"true"}};/*! @azure/msal-common v15.7.1 2025-06-18 */class H{constructor(e,t,n,o,i,a,s,c){this.canonicalAuthority=e,this._canonicalAuthority.validateAsUri(),this.networkInterface=t,this.cacheManager=n,this.authorityOptions=o,this.regionDiscoveryMetadata={region_used:void 0,region_source:void 0,region_outcome:void 0},this.logger=i,this.performanceClient=s,this.correlationId=a,this.managedIdentity=c||!1,this.regionDiscovery=new Ut(t,this.logger,this.performanceClient,this.correlationId)}getAuthorityType(e){if(e.HostNameAndPort.endsWith(u.CIAM_AUTH_URL))return W.Ciam;const t=e.PathSegments;if(t.length)switch(t[0].toLowerCase()){case u.ADFS:return W.Adfs;case u.DSTS:return W.Dsts}return W.Default}get authorityType(){return this.getAuthorityType(this.canonicalAuthorityUrlComponents)}get protocolMode(){return this.authorityOptions.protocolMode}get options(){return this.authorityOptions}get canonicalAuthority(){return this._canonicalAuthority.urlString}set canonicalAuthority(e){this._canonicalAuthority=new _(e),this._canonicalAuthority.validateAsUri(),this._canonicalAuthorityUrlComponents=null}get canonicalAuthorityUrlComponents(){return this._canonicalAuthorityUrlComponents||(this._canonicalAuthorityUrlComponents=this._canonicalAuthority.getUrlComponents()),this._canonicalAuthorityUrlComponents}get hostnameAndPort(){return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase()}get tenant(){return this.canonicalAuthorityUrlComponents.PathSegments[0]}get authorizationEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.authorization_endpoint);throw m(se)}get tokenEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint);throw m(se)}get deviceCodeEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint.replace("/token","/devicecode"));throw m(se)}get endSessionEndpoint(){if(this.discoveryComplete()){if(!this.metadata.end_session_endpoint)throw m(fr);return this.replacePath(this.metadata.end_session_endpoint)}else throw m(se)}get selfSignedJwtAudience(){if(this.discoveryComplete())return this.replacePath(this.metadata.issuer);throw m(se)}get jwksUri(){if(this.discoveryComplete())return this.replacePath(this.metadata.jwks_uri);throw m(se)}canReplaceTenant(e){return e.PathSegments.length===1&&!H.reservedTenantDomains.has(e.PathSegments[0])&&this.getAuthorityType(e)===W.Default&&this.protocolMode!==q.OIDC}replaceTenant(e){return e.replace(/{tenant}|{tenantid}/g,this.tenant)}replacePath(e){let t=e;const o=new _(this.metadata.canonical_authority).getUrlComponents(),i=o.PathSegments;return this.canonicalAuthorityUrlComponents.PathSegments.forEach((s,c)=>{let l=i[c];if(c===0&&this.canReplaceTenant(o)){const d=new _(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];l!==d&&(this.logger.verbose(`Replacing tenant domain name ${l} with id ${d}`),l=d)}s!==l&&(t=t.replace(`/${l}/`,`/${s}/`))}),this.replaceTenant(t)}get defaultOpenIdConfigurationEndpoint(){const e=this.hostnameAndPort;return this.canonicalAuthority.endsWith("v2.0/")||this.authorityType===W.Adfs||this.protocolMode===q.OIDC&&!this.isAliasOfKnownMicrosoftAuthority(e)?`${this.canonicalAuthority}.well-known/openid-configuration`:`${this.canonicalAuthority}v2.0/.well-known/openid-configuration`}discoveryComplete(){return!!this.metadata}async resolveEndpointsAsync(){var o,i;(o=this.performanceClient)==null||o.addQueueMeasurement(h.AuthorityResolveEndpointsAsync,this.correlationId);const e=this.getCurrentMetadataEntity(),t=await f(this.updateCloudDiscoveryMetadata.bind(this),h.AuthorityUpdateCloudDiscoveryMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.canonicalAuthority=this.canonicalAuthority.replace(this.hostnameAndPort,e.preferred_network);const n=await f(this.updateEndpointMetadata.bind(this),h.AuthorityUpdateEndpointMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.updateCachedMetadata(e,t,{source:n}),(i=this.performanceClient)==null||i.addFields({cloudDiscoverySource:t,authorityEndpointSource:n},this.correlationId)}getCurrentMetadataEntity(){let e=this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort);return e||(e={aliases:[],preferred_cache:this.hostnameAndPort,preferred_network:this.hostnameAndPort,canonical_authority:this.canonicalAuthority,authorization_endpoint:"",token_endpoint:"",end_session_endpoint:"",issuer:"",aliasesFromNetwork:!1,endpointsFromNetwork:!1,expiresAt:ko(),jwks_uri:""}),e}updateCachedMetadata(e,t,n){t!==$.CACHE&&(n==null?void 0:n.source)!==$.CACHE&&(e.expiresAt=ko(),e.canonical_authority=this.canonicalAuthority);const o=this.cacheManager.generateAuthorityMetadataCacheKey(e.preferred_cache);this.cacheManager.setAuthorityMetadata(o,e),this.metadata=e}async updateEndpointMetadata(e){var o,i,a;(o=this.performanceClient)==null||o.addQueueMeasurement(h.AuthorityUpdateEndpointMetadata,this.correlationId);const t=this.updateEndpointMetadataFromLocalSources(e);if(t){if(t.source===$.HARDCODED_VALUES&&(i=this.authorityOptions.azureRegionConfiguration)!=null&&i.azureRegion&&t.metadata){const s=await f(this.updateMetadataWithRegionalInformation.bind(this),h.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(t.metadata);tt(e,s,!1),e.canonical_authority=this.canonicalAuthority}return t.source}let n=await f(this.getEndpointMetadataFromNetwork.bind(this),h.AuthorityGetEndpointMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(n)return(a=this.authorityOptions.azureRegionConfiguration)!=null&&a.azureRegion&&(n=await f(this.updateMetadataWithRegionalInformation.bind(this),h.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(n)),tt(e,n,!0),$.NETWORK;throw m(tr,this.defaultOpenIdConfigurationEndpoint)}updateEndpointMetadataFromLocalSources(e){this.logger.verbose("Attempting to get endpoint metadata from authority configuration");const t=this.getEndpointMetadataFromConfig();if(t)return this.logger.verbose("Found endpoint metadata in authority configuration"),tt(e,t,!1),{source:$.CONFIG};if(this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values."),this.authorityOptions.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");else{const o=this.getEndpointMetadataFromHardcodedValues();if(o)return tt(e,o,!1),{source:$.HARDCODED_VALUES,metadata:o};this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.")}const n=Ro(e);return this.isAuthoritySameType(e)&&e.endpointsFromNetwork&&!n?(this.logger.verbose("Found endpoint metadata in the cache."),{source:$.CACHE}):(n&&this.logger.verbose("The metadata entity is expired."),null)}isAuthoritySameType(e){return new _(e.canonical_authority).getUrlComponents().PathSegments.length===this.canonicalAuthorityUrlComponents.PathSegments.length}getEndpointMetadataFromConfig(){if(this.authorityOptions.authorityMetadata)try{return JSON.parse(this.authorityOptions.authorityMetadata)}catch{throw k(vr)}return null}async getEndpointMetadataFromNetwork(){var n;(n=this.performanceClient)==null||n.addQueueMeasurement(h.AuthorityGetEndpointMetadataFromNetwork,this.correlationId);const e={},t=this.defaultOpenIdConfigurationEndpoint;this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from ${t}`);try{const o=await this.networkInterface.sendGetRequestAsync(t,e);return ec(o.body)?o.body:(this.logger.verbose("Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration"),null)}catch(o){return this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${o}`),null}}getEndpointMetadataFromHardcodedValues(){return this.hostnameAndPort in Oo?Oo[this.hostnameAndPort]:null}async updateMetadataWithRegionalInformation(e){var n,o,i;(n=this.performanceClient)==null||n.addQueueMeasurement(h.AuthorityUpdateMetadataWithRegionalInformation,this.correlationId);const t=(o=this.authorityOptions.azureRegionConfiguration)==null?void 0:o.azureRegion;if(t){if(t!==u.AZURE_REGION_AUTO_DISCOVER_FLAG)return this.regionDiscoveryMetadata.region_outcome=qt.CONFIGURED_NO_AUTO_DETECTION,this.regionDiscoveryMetadata.region_used=t,H.replaceWithRegionalInformation(e,t);const a=await f(this.regionDiscovery.detectRegion.bind(this.regionDiscovery),h.RegionDiscoveryDetectRegion,this.logger,this.performanceClient,this.correlationId)((i=this.authorityOptions.azureRegionConfiguration)==null?void 0:i.environmentRegion,this.regionDiscoveryMetadata);if(a)return this.regionDiscoveryMetadata.region_outcome=qt.AUTO_DETECTION_REQUESTED_SUCCESSFUL,this.regionDiscoveryMetadata.region_used=a,H.replaceWithRegionalInformation(e,a);this.regionDiscoveryMetadata.region_outcome=qt.AUTO_DETECTION_REQUESTED_FAILED}return e}async updateCloudDiscoveryMetadata(e){var o;(o=this.performanceClient)==null||o.addQueueMeasurement(h.AuthorityUpdateCloudDiscoveryMetadata,this.correlationId);const t=this.updateCloudDiscoveryMetadataFromLocalSources(e);if(t)return t;const n=await f(this.getCloudDiscoveryMetadataFromNetwork.bind(this),h.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(n)return Vt(e,n,!0),$.NETWORK;throw k(kr)}updateCloudDiscoveryMetadataFromLocalSources(e){this.logger.verbose("Attempting to get cloud discovery metadata  from authority configuration"),this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities||u.NOT_APPLICABLE}`),this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata||u.NOT_APPLICABLE}`),this.logger.verbosePii(`Canonical Authority: ${e.canonical_authority||u.NOT_APPLICABLE}`);const t=this.getCloudDiscoveryMetadataFromConfig();if(t)return this.logger.verbose("Found cloud discovery metadata in authority configuration"),Vt(e,t,!1),$.CONFIG;if(this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values."),this.options.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");else{const o=Va(this.hostnameAndPort);if(o)return this.logger.verbose("Found cloud discovery metadata from hardcoded values."),Vt(e,o,!1),$.HARDCODED_VALUES;this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.")}const n=Ro(e);return this.isAuthoritySameType(e)&&e.aliasesFromNetwork&&!n?(this.logger.verbose("Found cloud discovery metadata in the cache."),$.CACHE):(n&&this.logger.verbose("The metadata entity is expired."),null)}getCloudDiscoveryMetadataFromConfig(){if(this.authorityType===W.Ciam)return this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host."),H.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);if(this.authorityOptions.cloudDiscoveryMetadata){this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.");try{this.logger.verbose("Attempting to parse the cloud discovery metadata.");const e=JSON.parse(this.authorityOptions.cloudDiscoveryMetadata),t=ft(e.metadata,this.hostnameAndPort);if(this.logger.verbose("Parsed the cloud discovery metadata."),t)return this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata."),t;this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.")}catch{throw this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error."),k(_n)}}return this.isInKnownAuthorities()?(this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host."),H.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)):null}async getCloudDiscoveryMetadataFromNetwork(){var o;(o=this.performanceClient)==null||o.addQueueMeasurement(h.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.correlationId);const e=`${u.AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`,t={};let n=null;try{const i=await this.networkInterface.sendGetRequestAsync(e,t);let a,s;if(tc(i.body))a=i.body,s=a.metadata,this.logger.verbosePii(`tenant_discovery_endpoint is: ${a.tenant_discovery_endpoint}`);else if(nc(i.body)){if(this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: ${i.status}`),a=i.body,a.error===u.INVALID_INSTANCE)return this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance."),null;this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is ${a.error}`),this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is ${a.error_description}`),this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network) to []"),s=[]}else return this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse"),null;this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request."),n=ft(s,this.hostnameAndPort)}catch(i){if(i instanceof b)this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.
Error: ${i.errorCode}
Error Description: ${i.errorMessage}`);else{const a=i;this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.
Error: ${a.name}
Error Description: ${a.message}`)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request."),this.logger.verbose("Creating custom Authority for custom domain scenario."),n=H.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),n}isInKnownAuthorities(){return this.authorityOptions.knownAuthorities.filter(t=>t&&_.getDomainFromUrl(t).toLowerCase()===this.hostnameAndPort).length>0}static generateAuthority(e,t){let n;if(t&&t.azureCloudInstance!==wn.None){const o=t.tenant?t.tenant:u.DEFAULT_COMMON_TENANT;n=`${t.azureCloudInstance}/${o}/`}return n||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return u.DEFAULT_AUTHORITY_HOST;if(this.discoveryComplete())return this.metadata.preferred_cache;throw m(se)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return Dr.has(e)}static isPublicCloudAuthority(e){return u.KNOWN_PUBLIC_CLOUDS.indexOf(e)>=0}static buildRegionalAuthorityString(e,t,n){const o=new _(e);o.validateAsUri();const i=o.getUrlComponents();let a=`${t}.${i.HostNameAndPort}`;this.isPublicCloudAuthority(i.HostNameAndPort)&&(a=`${t}.${u.REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`);const s=_.constructAuthorityUriFromObject({...o.getUrlComponents(),HostNameAndPort:a}).urlString;return n?`${s}?${n}`:s}static replaceWithRegionalInformation(e,t){const n={...e};return n.authorization_endpoint=H.buildRegionalAuthorityString(n.authorization_endpoint,t),n.token_endpoint=H.buildRegionalAuthorityString(n.token_endpoint,t),n.end_session_endpoint&&(n.end_session_endpoint=H.buildRegionalAuthorityString(n.end_session_endpoint,t)),n}static transformCIAMAuthority(e){let t=e;const o=new _(e).getUrlComponents();if(o.PathSegments.length===0&&o.HostNameAndPort.endsWith(u.CIAM_AUTH_URL)){const i=o.HostNameAndPort.split(".")[0];t=`${t}${i}${u.AAD_TENANT_DOMAIN_SUFFIX}`}return t}}H.reservedTenantDomains=new Set(["{tenant}","{tenantid}",ge.COMMON,ge.CONSUMERS,ge.ORGANIZATIONS]);function oc(r){var o;const n=(o=new _(r).getUrlComponents().PathSegments.slice(-1)[0])==null?void 0:o.toLowerCase();switch(n){case ge.COMMON:case ge.ORGANIZATIONS:case ge.CONSUMERS:return;default:return n}}function Zr(r){return r.endsWith(u.FORWARD_SLASH)?r:`${r}${u.FORWARD_SLASH}`}function rc(r){const e=r.cloudDiscoveryMetadata;let t;if(e)try{t=JSON.parse(e)}catch{throw k(_n)}return{canonicalAuthority:r.authority?Zr(r.authority):void 0,knownAuthorities:r.knownAuthorities,cloudDiscoveryMetadata:t}}/*! @azure/msal-common v15.7.1 2025-06-18 */async function ei(r,e,t,n,o,i,a){a==null||a.addQueueMeasurement(h.AuthorityFactoryCreateDiscoveredInstance,i);const s=H.transformCIAMAuthority(Zr(r)),c=new H(s,e,t,n,o,i,a);try{return await f(c.resolveEndpointsAsync.bind(c),h.AuthorityResolveEndpointsAsync,o,a,i)(),c}catch{throw m(se)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class Se extends b{constructor(e,t,n,o,i){super(e,t,n),this.name="ServerError",this.errorNo=o,this.status=i,Object.setPrototypeOf(this,Se.prototype)}}/*! @azure/msal-common v15.7.1 2025-06-18 */function Dt(r,e,t){var n;return{clientId:r,authority:e.authority,scopes:e.scopes,homeAccountIdentifier:t,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid,embeddedClientId:e.embeddedClientId||((n=e.tokenBodyParameters)==null?void 0:n.clientId)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class oe{static generateThrottlingStorageKey(e){return`${Be.THROTTLING_PREFIX}.${JSON.stringify(e)}`}static preProcess(e,t){var i;const n=oe.generateThrottlingStorageKey(t),o=e.getThrottlingCache(n);if(o){if(o.throttleTime<Date.now()){e.removeItem(n);return}throw new Se(((i=o.errorCodes)==null?void 0:i.join(" "))||u.EMPTY_STRING,o.errorMessage,o.subError)}}static postProcess(e,t,n){if(oe.checkResponseStatus(n)||oe.checkResponseForRetryAfter(n)){const o={throttleTime:oe.calculateThrottleTime(parseInt(n.headers[K.RETRY_AFTER])),error:n.body.error,errorCodes:n.body.error_codes,errorMessage:n.body.error_description,subError:n.body.suberror};e.setThrottlingCache(oe.generateThrottlingStorageKey(t),o)}}static checkResponseStatus(e){return e.status===429||e.status>=500&&e.status<600}static checkResponseForRetryAfter(e){return e.headers?e.headers.hasOwnProperty(K.RETRY_AFTER)&&(e.status<200||e.status>=300):!1}static calculateThrottleTime(e){const t=e<=0?0:e,n=Date.now()/1e3;return Math.floor(Math.min(n+(t||Be.DEFAULT_THROTTLE_TIME_SECONDS),n+Be.DEFAULT_MAX_THROTTLE_TIME_SECONDS)*1e3)}static removeThrottle(e,t,n,o){const i=Dt(t,n,o),a=this.generateThrottlingStorageKey(i);e.removeItem(a)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class Lt extends b{constructor(e,t,n){super(e.errorCode,e.errorMessage,e.subError),Object.setPrototypeOf(this,Lt.prototype),this.name="NetworkError",this.error=e,this.httpStatus=t,this.responseHeaders=n}}function Fe(r,e,t,n){return r.errorMessage=`${r.errorMessage}, additionalErrorInfo: error.name:${n==null?void 0:n.name}, error.message:${n==null?void 0:n.message}`,new Lt(r,e,t)}/*! @azure/msal-common v15.7.1 2025-06-18 */class Kn{constructor(e,t){this.config=ns(e),this.logger=new pe(this.config.loggerOptions,mr,En),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t}createTokenRequestHeaders(e){const t={};if(t[K.CONTENT_TYPE]=u.URL_FORM_CONTENT_TYPE,!this.config.systemOptions.preventCorsPreflight&&e)switch(e.type){case J.HOME_ACCOUNT_ID:try{const n=be(e.credential);t[K.CCS_HEADER]=`Oid:${n.uid}@${n.utid}`}catch(n){this.logger.verbose("Could not parse home account ID for CCS Header: "+n)}break;case J.UPN:t[K.CCS_HEADER]=`UPN: ${e.credential}`;break}return t}async executePostToTokenEndpoint(e,t,n,o,i,a){var c;a&&((c=this.performanceClient)==null||c.addQueueMeasurement(a,i));const s=await this.sendPostRequest(o,e,{body:t,headers:n},i);return this.config.serverTelemetryManager&&s.status<500&&s.status!==429&&this.config.serverTelemetryManager.clearTelemetryCache(),s}async sendPostRequest(e,t,n,o){var a,s,c;oe.preProcess(this.cacheManager,e);let i;try{i=await f(this.networkClient.sendPostRequestAsync.bind(this.networkClient),h.NetworkClientSendPostRequestAsync,this.logger,this.performanceClient,o)(t,n);const l=i.headers||{};(s=this.performanceClient)==null||s.addFields({refreshTokenSize:((a=i.body.refresh_token)==null?void 0:a.length)||0,httpVerToken:l[K.X_MS_HTTP_VERSION]||"",requestId:l[K.X_MS_REQUEST_ID]||""},o)}catch(l){if(l instanceof Lt){const d=l.responseHeaders;throw d&&((c=this.performanceClient)==null||c.addFields({httpVerToken:d[K.X_MS_HTTP_VERSION]||"",requestId:d[K.X_MS_REQUEST_ID]||"",contentTypeHeader:d[K.CONTENT_TYPE]||void 0,contentLengthHeader:d[K.CONTENT_LENGTH]||void 0,httpStatus:l.httpStatus},o)),l.error}throw l instanceof b?l:m(er)}return oe.postProcess(this.cacheManager,e,i),i}async updateAuthority(e,t){var i;(i=this.performanceClient)==null||i.addQueueMeasurement(h.UpdateTokenEndpointAuthority,t);const n=`https://${e}/${this.authority.tenant}/`,o=await ei(n,this.networkClient,this.cacheManager,this.authority.options,this.logger,t,this.performanceClient);this.authority=o}createTokenQueryParameters(e){const t=new Map;return e.embeddedClientId&&Mt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenQueryParameters&&Te(t,e.tokenQueryParameters),Dn(t,e.correlationId),Nt(t,e.correlationId,this.performanceClient),$e(t)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const yt="no_tokens_found",ti="native_account_unavailable",Bn="refresh_token_expired",Gn="ux_not_allowed",ic="interaction_required",ac="consent_required",sc="login_required",Ht="bad_token";/*! @azure/msal-common v15.7.1 2025-06-18 */const Do=[ic,ac,sc,Ht,Gn],cc=["message_only","additional_action","basic_action","user_password_expired","consent_required","bad_token"],lc={[yt]:"No refresh token found in the cache. Please sign-in.",[ti]:"The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",[Bn]:"Refresh token has expired.",[Ht]:"Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",[Gn]:"`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve."};class Z extends b{constructor(e,t,n,o,i,a,s,c){super(e,t,n),Object.setPrototypeOf(this,Z.prototype),this.timestamp=o||u.EMPTY_STRING,this.traceId=i||u.EMPTY_STRING,this.correlationId=a||u.EMPTY_STRING,this.claims=s||u.EMPTY_STRING,this.name="InteractionRequiredAuthError",this.errorNo=c}}function ni(r,e,t){const n=!!r&&Do.indexOf(r)>-1,o=!!t&&cc.indexOf(t)>-1,i=!!e&&Do.some(a=>e.indexOf(a)>-1);return n||i||o}function Tt(r){return new Z(r,lc[r])}/*! @azure/msal-common v15.7.1 2025-06-18 */class Ue{static setRequestState(e,t,n){const o=Ue.generateLibraryState(e,n);return t?`${o}${u.RESOURCE_DELIM}${t}`:o}static generateLibraryState(e,t){if(!e)throw m(en);const n={id:e.createNewGuid()};t&&(n.meta=t);const o=JSON.stringify(n);return e.base64Encode(o)}static parseRequestState(e,t){if(!e)throw m(en);if(!t)throw m(Pe);try{const n=t.split(u.RESOURCE_DELIM),o=n[0],i=n.length>1?n.slice(1).join(u.RESOURCE_DELIM):u.EMPTY_STRING,a=e.base64Decode(o),s=JSON.parse(a);return{userRequestState:i||u.EMPTY_STRING,libraryState:s}}catch{throw m(Pe)}}}/*! @azure/msal-common v15.7.1 2025-06-18 */const hc={SW:"sw"};class Ne{constructor(e,t){this.cryptoUtils=e,this.performanceClient=t}async generateCnf(e,t){var i;(i=this.performanceClient)==null||i.addQueueMeasurement(h.PopTokenGenerateCnf,e.correlationId);const n=await f(this.generateKid.bind(this),h.PopTokenGenerateCnf,t,this.performanceClient,e.correlationId)(e),o=this.cryptoUtils.base64UrlEncode(JSON.stringify(n));return{kid:n.kid,reqCnfString:o}}async generateKid(e){var n;return(n=this.performanceClient)==null||n.addQueueMeasurement(h.PopTokenGenerateKid,e.correlationId),{kid:await this.cryptoUtils.getPublicKeyThumbprint(e),xms_ksl:hc.SW}}async signPopToken(e,t,n){return this.signPayload(e,t,n)}async signPayload(e,t,n,o){const{resourceRequestMethod:i,resourceRequestUri:a,shrClaims:s,shrNonce:c,shrOptions:l}=n,d=a?new _(a):void 0,g=d==null?void 0:d.getUrlComponents();return this.cryptoUtils.signJwt({at:e,ts:V(),m:i==null?void 0:i.toUpperCase(),u:g==null?void 0:g.HostNameAndPort,nonce:c||this.cryptoUtils.createNewGuid(),p:g==null?void 0:g.AbsolutePath,q:g!=null&&g.QueryString?[[],g.QueryString]:void 0,client_claims:s||void 0,...o},t,l,n.correlationId)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class dc{constructor(e,t){this.cache=e,this.hasChanged=t}get cacheHasChanged(){return this.hasChanged}get tokenCache(){return this.cache}}/*! @azure/msal-common v15.7.1 2025-06-18 */class Ie{constructor(e,t,n,o,i,a,s){this.clientId=e,this.cacheStorage=t,this.cryptoObj=n,this.logger=o,this.serializableCache=i,this.persistencePlugin=a,this.performanceClient=s}validateTokenResponse(e,t){var n;if(e.error||e.error_description||e.suberror){const o=`Error(s): ${e.error_codes||u.NOT_AVAILABLE} - Timestamp: ${e.timestamp||u.NOT_AVAILABLE} - Description: ${e.error_description||u.NOT_AVAILABLE} - Correlation ID: ${e.correlation_id||u.NOT_AVAILABLE} - Trace ID: ${e.trace_id||u.NOT_AVAILABLE}`,i=(n=e.error_codes)!=null&&n.length?e.error_codes[0]:void 0,a=new Se(e.error,o,e.suberror,i,e.status);if(t&&e.status&&e.status>=ue.SERVER_ERROR_RANGE_START&&e.status<=ue.SERVER_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.
${a}`);return}else if(t&&e.status&&e.status>=ue.CLIENT_ERROR_RANGE_START&&e.status<=ue.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.
${a}`);return}throw ni(e.error,e.error_description,e.suberror)?new Z(e.error,e.error_description,e.suberror,e.timestamp||u.EMPTY_STRING,e.trace_id||u.EMPTY_STRING,e.correlation_id||u.EMPTY_STRING,e.claims||u.EMPTY_STRING,i):a}}async handleServerTokenResponse(e,t,n,o,i,a,s,c,l){var w;(w=this.performanceClient)==null||w.addQueueMeasurement(h.HandleServerTokenResponse,e.correlation_id);let d;if(e.id_token){if(d=Me(e.id_token||u.EMPTY_STRING,this.cryptoObj.base64Decode),i&&i.nonce&&d.nonce!==i.nonce)throw m(rr);if(o.maxAge||o.maxAge===0){const S=d.auth_time;if(!S)throw m(Cn);pr(S,o.maxAge)}}this.homeAccountIdentifier=B.generateHomeAccountId(e.client_info||u.EMPTY_STRING,t.authorityType,this.logger,this.cryptoObj,d);let g;i&&i.state&&(g=Ue.parseRequestState(this.cryptoObj,i.state)),e.key_id=e.key_id||o.sshKid||void 0;const p=this.generateCacheRecord(e,t,n,o,d,a,i);let y;try{if(this.persistencePlugin&&this.serializableCache&&(this.logger.verbose("Persistence enabled, calling beforeCacheAccess"),y=new dc(this.serializableCache,!0),await this.persistencePlugin.beforeCacheAccess(y)),s&&!c&&p.account){const S=p.account.generateAccountKey();if(!this.cacheStorage.getAccount(S))return this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"),await Ie.generateAuthenticationResult(this.cryptoObj,t,p,!1,o,d,g,void 0,l)}await this.cacheStorage.saveCacheRecord(p,o.correlationId,o.storeInCache)}finally{this.persistencePlugin&&this.serializableCache&&y&&(this.logger.verbose("Persistence enabled, calling afterCacheAccess"),await this.persistencePlugin.afterCacheAccess(y))}return Ie.generateAuthenticationResult(this.cryptoObj,t,p,!1,o,d,g,e,l)}generateCacheRecord(e,t,n,o,i,a,s){const c=t.getPreferredCache();if(!c)throw m(Tn);const l=Nr(i);let d,g;e.id_token&&i&&(d=kt(this.homeAccountIdentifier,c,e.id_token,this.clientId,l||""),g=zn(this.cacheStorage,t,this.homeAccountIdentifier,this.cryptoObj.base64Decode,i,e.client_info,c,l,s,void 0,this.logger));let p=null;if(e.access_token){const S=e.scope?N.fromString(e.scope):new N(o.scopes||[]),M=(typeof e.expires_in=="string"?parseInt(e.expires_in,10):e.expires_in)||0,G=(typeof e.ext_expires_in=="string"?parseInt(e.ext_expires_in,10):e.ext_expires_in)||0,Q=(typeof e.refresh_in=="string"?parseInt(e.refresh_in,10):e.refresh_in)||void 0,he=n+M,Je=he+G,Xe=Q&&Q>0?n+Q:void 0;p=Rt(this.homeAccountIdentifier,c,e.access_token,this.clientId,l||t.tenant||"",S.printScopes(),he,Je,this.cryptoObj.base64Decode,Xe,e.token_type,a,e.key_id,o.claims,o.requestedClaimsHash)}let y=null;if(e.refresh_token){let S;if(e.refresh_token_expires_in){const M=typeof e.refresh_token_expires_in=="string"?parseInt(e.refresh_token_expires_in,10):e.refresh_token_expires_in;S=n+M}y=Cr(this.homeAccountIdentifier,c,e.refresh_token,this.clientId,e.foci,a,S)}let w=null;return e.foci&&(w={clientId:this.clientId,environment:c,familyId:e.foci}),{account:g,idToken:d,accessToken:p,refreshToken:y,appMetadata:w}}static async generateAuthenticationResult(e,t,n,o,i,a,s,c,l){var he,Je,Xe,Co,yo;let d=u.EMPTY_STRING,g=[],p=null,y,w,S=u.EMPTY_STRING;if(n.accessToken){if(n.accessToken.tokenType===v.POP&&!i.popKid){const sa=new Ne(e),{secret:ca,keyId:To}=n.accessToken;if(!To)throw m(An);d=await sa.signPopToken(ca,To,i)}else d=n.accessToken.secret;g=N.fromString(n.accessToken.target).asArray(),p=Re(n.accessToken.expiresOn),y=Re(n.accessToken.extendedExpiresOn),n.accessToken.refreshOn&&(w=Re(n.accessToken.refreshOn))}n.appMetadata&&(S=n.appMetadata.familyId===Ke?Ke:"");const M=(a==null?void 0:a.oid)||(a==null?void 0:a.sub)||"",G=(a==null?void 0:a.tid)||"";c!=null&&c.spa_accountid&&n.account&&(n.account.nativeAccountId=c==null?void 0:c.spa_accountid);const Q=n.account?Rn(n.account.getAccountInfo(),void 0,a,(he=n.idToken)==null?void 0:he.secret):null;return{authority:t.canonicalAuthority,uniqueId:M,tenantId:G,scopes:g,account:Q,idToken:((Je=n==null?void 0:n.idToken)==null?void 0:Je.secret)||"",idTokenClaims:a||{},accessToken:d,fromCache:o,expiresOn:p,extExpiresOn:y,refreshOn:w,correlationId:i.correlationId,requestId:l||u.EMPTY_STRING,familyId:S,tokenType:((Xe=n.accessToken)==null?void 0:Xe.tokenType)||u.EMPTY_STRING,state:s?s.userRequestState:u.EMPTY_STRING,cloudGraphHostName:((Co=n.account)==null?void 0:Co.cloudGraphHostName)||u.EMPTY_STRING,msGraphHost:((yo=n.account)==null?void 0:yo.msGraphHost)||u.EMPTY_STRING,code:c==null?void 0:c.spa_code,fromNativeBroker:!1}}}function zn(r,e,t,n,o,i,a,s,c,l,d){d==null||d.verbose("setCachedAccount called");const p=r.getAccountKeys().find(G=>G.startsWith(t));let y=null;p&&(y=r.getAccount(p));const w=y||B.createAccount({homeAccountId:t,idTokenClaims:o,clientInfo:i,environment:a,cloudGraphHostName:c==null?void 0:c.cloud_graph_host_name,msGraphHost:c==null?void 0:c.msgraph_host,nativeAccountId:l},e,n),S=w.tenantProfiles||[],M=s||w.realm;if(M&&!S.find(G=>G.tenantId===M)){const G=kn(t,w.localAccountId,M,o);S.push(G)}return w.tenantProfiles=S,w}/*! @azure/msal-common v15.7.1 2025-06-18 */class uc{static validateRedirectUri(e){if(!e)throw k(yr)}static validatePrompt(e){const t=[];for(const n in L)t.push(L[n]);if(t.indexOf(e)<0)throw k(Er)}static validateClaims(e){try{JSON.parse(e)}catch{throw k(bt)}}static validateCodeChallengeParams(e,t){if(!e||!t)throw k(Ot);this.validateCodeChallengeMethod(t)}static validateCodeChallengeMethod(e){if([Eo.PLAIN,Eo.S256].indexOf(e)<0)throw k(_r)}}/*! @azure/msal-common v15.7.1 2025-06-18 */async function oi(r,e,t){return typeof r=="string"?r:r({clientId:e,tokenEndpoint:t})}/*! @azure/msal-common v15.7.1 2025-06-18 */class ri extends Kn{constructor(e,t){var n;super(e,t),this.includeRedirectUri=!0,this.oidcDefaultScopes=(n=this.config.authOptions.authority.options.OIDCOptions)==null?void 0:n.defaultScopes}async acquireToken(e,t){var s,c;if((s=this.performanceClient)==null||s.addQueueMeasurement(h.AuthClientAcquireToken,e.correlationId),!e.code)throw m(sr);const n=V(),o=await f(this.executeTokenRequest.bind(this),h.AuthClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(this.authority,e),i=(c=o.headers)==null?void 0:c[K.X_MS_REQUEST_ID],a=new Ie(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin,this.performanceClient);return a.validateTokenResponse(o.body),f(a.handleServerTokenResponse.bind(a),h.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,n,e,t,void 0,void 0,void 0,i)}getLogoutUri(e){if(!e)throw k(Sr);const t=this.createLogoutUrlQueryString(e);return _.appendQueryString(this.authority.endSessionEndpoint,t)}async executeTokenRequest(e,t){var l;(l=this.performanceClient)==null||l.addQueueMeasurement(h.AuthClientExecuteTokenRequest,t.correlationId);const n=this.createTokenQueryParameters(t),o=_.appendQueryString(e.tokenEndpoint,n),i=await f(this.createTokenRequestBody.bind(this),h.AuthClientCreateTokenRequestBody,this.logger,this.performanceClient,t.correlationId)(t);let a;if(t.clientInfo)try{const d=ut(t.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${d.uid}${x.CLIENT_INFO_SEPARATOR}${d.utid}`,type:J.HOME_ACCOUNT_ID}}catch(d){this.logger.verbose("Could not parse client info for CCS Header: "+d)}const s=this.createTokenRequestHeaders(a||t.ccsCredential),c=Dt(this.config.authOptions.clientId,t);return f(this.executePostToTokenEndpoint.bind(this),h.AuthorizationCodeClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,t.correlationId)(o,i,s,c,t.correlationId,h.AuthorizationCodeClientExecutePostToTokenEndpoint)}async createTokenRequestBody(e){var o,i;(o=this.performanceClient)==null||o.addQueueMeasurement(h.AuthClientCreateTokenRequestBody,e.correlationId);const t=new Map;if(Nn(t,e.embeddedClientId||((i=e.tokenBodyParameters)==null?void 0:i[Ae])||this.config.authOptions.clientId),this.includeRedirectUri?Mn(t,e.redirectUri):uc.validateRedirectUri(e.redirectUri),Pn(t,e.scopes,!0,this.oidcDefaultScopes),Ys(t,e.code),Ln(t,this.config.libraryInfo),Hn(t,this.config.telemetry.application),Xr(t),this.serverTelemetryManager&&!Fr(this.config)&&Jr(t,this.serverTelemetryManager),e.codeVerifier&&Ws(t,e.codeVerifier),this.config.clientCredentials.clientSecret&&qr(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){const a=this.config.clientCredentials.clientAssertion;Vr(t,await oi(a.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Qr(t,a.assertionType)}if(Yr(t,Jo.AUTHORIZATION_CODE_GRANT),xn(t),e.authenticationScheme===v.POP){const a=new Ne(this.cryptoUtils,this.performanceClient);let s;e.popKid?s=this.cryptoUtils.encodeKid(e.popKid):s=(await f(a.generateCnf.bind(a),h.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Fn(t,s)}else if(e.authenticationScheme===v.SSH)if(e.sshJwk)Wr(t,e.sshJwk);else throw k(Pt);(!ie.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&Un(t,e.claims,this.config.authOptions.clientCapabilities);let n;if(e.clientInfo)try{const a=ut(e.clientInfo,this.cryptoUtils.base64Decode);n={credential:`${a.uid}${x.CLIENT_INFO_SEPARATOR}${a.utid}`,type:J.HOME_ACCOUNT_ID}}catch(a){this.logger.verbose("Could not parse client info for CCS Header: "+a)}else n=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&n)switch(n.type){case J.HOME_ACCOUNT_ID:try{const a=be(n.credential);ze(t,a)}catch(a){this.logger.verbose("Could not parse home account ID for CCS Header: "+a)}break;case J.UPN:Ct(t,n.credential);break}return e.embeddedClientId&&Mt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenBodyParameters&&Te(t,e.tokenBodyParameters),e.enableSpaAuthorizationCode&&(!e.tokenBodyParameters||!e.tokenBodyParameters[Mo])&&Te(t,{[Mo]:"1"}),Nt(t,e.correlationId,this.performanceClient),$e(t)}createLogoutUrlQueryString(e){const t=new Map;return e.postLogoutRedirectUri&&Gs(t,e.postLogoutRedirectUri),e.correlationId&&Dn(t,e.correlationId),e.idTokenHint&&zs(t,e.idTokenHint),e.state&&$r(t,e.state),e.logoutHint&&Xs(t,e.logoutHint),e.extraQueryParameters&&Te(t,e.extraQueryParameters),this.config.authOptions.instanceAware&&jr(t),$e(t,this.config.authOptions.encodeExtraQueryParams,e.extraQueryParameters)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const gc=300;class fc extends Kn{constructor(e,t){super(e,t)}async acquireToken(e){var a,s;(a=this.performanceClient)==null||a.addQueueMeasurement(h.RefreshTokenClientAcquireToken,e.correlationId);const t=V(),n=await f(this.executeTokenRequest.bind(this),h.RefreshTokenClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(e,this.authority),o=(s=n.headers)==null?void 0:s[K.X_MS_REQUEST_ID],i=new Ie(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(n.body),f(i.handleServerTokenResponse.bind(i),h.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(n.body,this.authority,t,e,void 0,void 0,!0,e.forceCache,o)}async acquireTokenByRefreshToken(e){var n;if(!e)throw k(wr);if((n=this.performanceClient)==null||n.addQueueMeasurement(h.RefreshTokenClientAcquireTokenByRefreshToken,e.correlationId),!e.account)throw m(yn);if(this.cacheManager.isAppMetadataFOCI(e.account.environment))try{return await f(this.acquireTokenWithCachedRefreshToken.bind(this),h.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!0)}catch(o){const i=o instanceof Z&&o.errorCode===yt,a=o instanceof Se&&o.errorCode===wo.INVALID_GRANT_ERROR&&o.subError===wo.CLIENT_MISMATCH_ERROR;if(i||a)return f(this.acquireTokenWithCachedRefreshToken.bind(this),h.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1);throw o}return f(this.acquireTokenWithCachedRefreshToken.bind(this),h.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1)}async acquireTokenWithCachedRefreshToken(e,t){var i,a,s;(i=this.performanceClient)==null||i.addQueueMeasurement(h.RefreshTokenClientAcquireTokenWithCachedRefreshToken,e.correlationId);const n=j(this.cacheManager.getRefreshToken.bind(this.cacheManager),h.CacheManagerGetRefreshToken,this.logger,this.performanceClient,e.correlationId)(e.account,t,void 0,this.performanceClient,e.correlationId);if(!n)throw Tt(yt);if(n.expiresOn&&nn(n.expiresOn,e.refreshTokenExpirationOffsetSeconds||gc))throw(a=this.performanceClient)==null||a.addFields({rtExpiresOnMs:Number(n.expiresOn)},e.correlationId),Tt(Bn);const o={...e,refreshToken:n.secret,authenticationScheme:e.authenticationScheme||v.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:J.HOME_ACCOUNT_ID}};try{return await f(this.acquireToken.bind(this),h.RefreshTokenClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(o)}catch(c){if(c instanceof Z&&((s=this.performanceClient)==null||s.addFields({rtExpiresOnMs:Number(n.expiresOn)},e.correlationId),c.subError===Ht)){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");const l=Ge(n);this.cacheManager.removeRefreshToken(l)}throw c}}async executeTokenRequest(e,t){var c;(c=this.performanceClient)==null||c.addQueueMeasurement(h.RefreshTokenClientExecuteTokenRequest,e.correlationId);const n=this.createTokenQueryParameters(e),o=_.appendQueryString(t.tokenEndpoint,n),i=await f(this.createTokenRequestBody.bind(this),h.RefreshTokenClientCreateTokenRequestBody,this.logger,this.performanceClient,e.correlationId)(e),a=this.createTokenRequestHeaders(e.ccsCredential),s=Dt(this.config.authOptions.clientId,e);return f(this.executePostToTokenEndpoint.bind(this),h.RefreshTokenClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,e.correlationId)(o,i,a,s,e.correlationId,h.RefreshTokenClientExecutePostToTokenEndpoint)}async createTokenRequestBody(e){var n,o,i;(n=this.performanceClient)==null||n.addQueueMeasurement(h.RefreshTokenClientCreateTokenRequestBody,e.correlationId);const t=new Map;if(Nn(t,e.embeddedClientId||((o=e.tokenBodyParameters)==null?void 0:o[Ae])||this.config.authOptions.clientId),e.redirectUri&&Mn(t,e.redirectUri),Pn(t,e.scopes,!0,(i=this.config.authOptions.authority.options.OIDCOptions)==null?void 0:i.defaultScopes),Yr(t,Jo.REFRESH_TOKEN_GRANT),xn(t),Ln(t,this.config.libraryInfo),Hn(t,this.config.telemetry.application),Xr(t),this.serverTelemetryManager&&!Fr(this.config)&&Jr(t,this.serverTelemetryManager),js(t,e.refreshToken),this.config.clientCredentials.clientSecret&&qr(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){const a=this.config.clientCredentials.clientAssertion;Vr(t,await oi(a.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Qr(t,a.assertionType)}if(e.authenticationScheme===v.POP){const a=new Ne(this.cryptoUtils,this.performanceClient);let s;e.popKid?s=this.cryptoUtils.encodeKid(e.popKid):s=(await f(a.generateCnf.bind(a),h.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Fn(t,s)}else if(e.authenticationScheme===v.SSH)if(e.sshJwk)Wr(t,e.sshJwk);else throw k(Pt);if((!ie.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&Un(t,e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case J.HOME_ACCOUNT_ID:try{const a=be(e.ccsCredential.credential);ze(t,a)}catch(a){this.logger.verbose("Could not parse home account ID for CCS Header: "+a)}break;case J.UPN:Ct(t,e.ccsCredential.credential);break}return e.embeddedClientId&&Mt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenBodyParameters&&Te(t,e.tokenBodyParameters),Nt(t,e.correlationId,this.performanceClient),$e(t)}}/*! @azure/msal-common v15.7.1 2025-06-18 */class mc extends Kn{constructor(e,t){super(e,t)}async acquireCachedToken(e){var c;(c=this.performanceClient)==null||c.addQueueMeasurement(h.SilentFlowClientAcquireCachedToken,e.correlationId);let t=ye.NOT_APPLICABLE;if(e.forceRefresh||!this.config.cacheOptions.claimsBasedCachingEnabled&&!ie.isEmptyObj(e.claims))throw this.setCacheOutcome(ye.FORCE_REFRESH_OR_CLAIMS,e.correlationId),m(fe);if(!e.account)throw m(yn);const n=e.account.tenantId||oc(e.authority),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,n);if(i){if(ka(i.cachedAt)||nn(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(ye.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),m(fe);i.refreshOn&&nn(i.refreshOn,0)&&(t=ye.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(ye.NO_CACHED_ACCESS_TOKEN,e.correlationId),m(fe);const a=e.authority||this.authority.getPreferredCache(),s={account:this.cacheManager.readAccountFromCache(e.account),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,o,n,this.performanceClient,e.correlationId),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCache(a)};return this.setCacheOutcome(t,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[await f(this.generateResultFromCacheRecord.bind(this),h.SilentFlowClientGenerateResultFromCacheRecord,this.logger,this.performanceClient,e.correlationId)(s,e),t]}setCacheOutcome(e,t){var n,o;(n=this.serverTelemetryManager)==null||n.setCacheOutcome(e),(o=this.performanceClient)==null||o.addFields({cacheOutcome:e},t),e!==ye.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: ${e}`)}async generateResultFromCacheRecord(e,t){var o;(o=this.performanceClient)==null||o.addQueueMeasurement(h.SilentFlowClientGenerateResultFromCacheRecord,t.correlationId);let n;if(e.idToken&&(n=Me(e.idToken.secret,this.config.cryptoInterface.base64Decode)),t.maxAge||t.maxAge===0){const i=n==null?void 0:n.auth_time;if(!i)throw m(Cn);pr(i,t.maxAge)}return Ie.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,t,n)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const pc={sendGetRequestAsync:()=>Promise.reject(m(E)),sendPostRequestAsync:()=>Promise.reject(m(E))};/*! @azure/msal-common v15.7.1 2025-06-18 */function Cc(r,e,t,n){var s,c;const o=e.correlationId,i=new Map;Nn(i,e.embeddedClientId||((s=e.extraQueryParameters)==null?void 0:s[Ae])||r.clientId);const a=[...e.scopes||[],...e.extraScopesToConsent||[]];if(Pn(i,a,!0,(c=r.authority.options.OIDCOptions)==null?void 0:c.defaultScopes),Mn(i,e.redirectUri),Dn(i,o),Ks(i,e.responseMode),xn(i),e.prompt&&(qs(i,e.prompt),n==null||n.addFields({prompt:e.prompt},o)),e.domainHint&&($s(i,e.domainHint),n==null||n.addFields({domainHintFromRequest:!0},o)),e.prompt!==L.SELECT_ACCOUNT)if(e.sid&&e.prompt===L.NONE)t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request"),Uo(i,e.sid),n==null||n.addFields({sidFromRequest:!0},o);else if(e.account){const l=Ac(e.account);let d=Ic(e.account);if(d&&e.domainHint&&(t.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint'),d=null),d){t.verbose("createAuthCodeUrlQueryString: login_hint claim present on account"),nt(i,d),n==null||n.addFields({loginHintFromClaim:!0},o);try{const g=be(e.account.homeAccountId);ze(i,g)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(l&&e.prompt===L.NONE){t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account"),Uo(i,l),n==null||n.addFields({sidFromClaim:!0},o);try{const g=be(e.account.homeAccountId);ze(i,g)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(e.loginHint)t.verbose("createAuthCodeUrlQueryString: Adding login_hint from request"),nt(i,e.loginHint),Ct(i,e.loginHint),n==null||n.addFields({loginHintFromRequest:!0},o);else if(e.account.username){t.verbose("createAuthCodeUrlQueryString: Adding login_hint from account"),nt(i,e.account.username),n==null||n.addFields({loginHintFromUpn:!0},o);try{const g=be(e.account.homeAccountId);ze(i,g)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}}else e.loginHint&&(t.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request"),nt(i,e.loginHint),Ct(i,e.loginHint),n==null||n.addFields({loginHintFromRequest:!0},o));else t.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");return e.nonce&&Vs(i,e.nonce),e.state&&$r(i,e.state),(e.claims||r.clientCapabilities&&r.clientCapabilities.length>0)&&Un(i,e.claims,r.clientCapabilities),e.embeddedClientId&&Mt(i,r.clientId,r.redirectUri),r.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(rn))&&jr(i),i}function ii(r,e,t,n){const o=$e(e,t,n);return _.appendQueryString(r.authorizationEndpoint,o)}function yc(r,e){if(ai(r,e),!r.code)throw m(ur);return r}function ai(r,e){if(!r.state||!e)throw r.state?m(Jt,"Cached State"):m(Jt,"Server State");let t,n;try{t=decodeURIComponent(r.state)}catch{throw m(Pe,r.state)}try{n=decodeURIComponent(e)}catch{throw m(Pe,r.state)}if(t!==n)throw m(or);if(r.error||r.error_description||r.suberror){const o=Tc(r);throw ni(r.error,r.error_description,r.suberror)?new Z(r.error||"",r.error_description,r.suberror,r.timestamp||"",r.trace_id||"",r.correlation_id||"",r.claims||"",o):new Se(r.error||"",r.error_description,r.suberror,o)}}function Tc(r){var n,o;const e="code=",t=(n=r.error_uri)==null?void 0:n.lastIndexOf(e);return t&&t>=0?(o=r.error_uri)==null?void 0:o.substring(t+e.length):void 0}function Ac(r){var e;return((e=r.idTokenClaims)==null?void 0:e.sid)||null}function Ic(r){var e;return((e=r.idTokenClaims)==null?void 0:e.login_hint)||null}/*! @azure/msal-common v15.7.1 2025-06-18 */const Lo=",",si="|";function Ec(r){const{skus:e,libraryName:t,libraryVersion:n,extensionName:o,extensionVersion:i}=r,a=new Map([[0,[t,n]],[2,[o,i]]]);let s=[];if(e!=null&&e.length){if(s=e.split(Lo),s.length<4)return e}else s=Array.from({length:4},()=>si);return a.forEach((c,l)=>{var d,g;c.length===2&&((d=c[0])!=null&&d.length)&&((g=c[1])!=null&&g.length)&&wc({skuArr:s,index:l,skuName:c[0],skuVersion:c[1]})}),s.join(Lo)}function wc(r){const{skuArr:e,index:t,skuName:n,skuVersion:o}=r;t>=e.length||(e[t]=[n,o].join(si))}class qe{constructor(e,t){this.cacheOutcome=ye.NOT_APPLICABLE,this.cacheManager=t,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||u.EMPTY_STRING,this.wrapperVer=e.wrapperVer||u.EMPTY_STRING,this.telemetryCacheKey=D.CACHE_KEY+x.CACHE_KEY_SEPARATOR+e.clientId}generateCurrentRequestHeaderValue(){const e=`${this.apiId}${D.VALUE_SEPARATOR}${this.cacheOutcome}`,t=[this.wrapperSKU,this.wrapperVer],n=this.getNativeBrokerErrorCode();n!=null&&n.length&&t.push(`broker_error=${n}`);const o=t.join(D.VALUE_SEPARATOR),i=this.getRegionDiscoveryFields(),a=[e,i].join(D.VALUE_SEPARATOR);return[D.SCHEMA_VERSION,a,o].join(D.CATEGORY_SEPARATOR)}generateLastRequestHeaderValue(){const e=this.getLastRequests(),t=qe.maxErrorsToSend(e),n=e.failedRequests.slice(0,2*t).join(D.VALUE_SEPARATOR),o=e.errors.slice(0,t).join(D.VALUE_SEPARATOR),i=e.errors.length,a=t<i?D.OVERFLOW_TRUE:D.OVERFLOW_FALSE,s=[i,a].join(D.VALUE_SEPARATOR);return[D.SCHEMA_VERSION,e.cacheHits,n,o,s].join(D.CATEGORY_SEPARATOR)}cacheFailedRequest(e){const t=this.getLastRequests();t.errors.length>=D.MAX_CACHED_ERRORS&&(t.failedRequests.shift(),t.failedRequests.shift(),t.errors.shift()),t.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof b?e.subError?t.errors.push(e.subError):e.errorCode?t.errors.push(e.errorCode):t.errors.push(e.toString()):t.errors.push(e.toString()):t.errors.push(D.UNKNOWN_ERROR),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t)}incrementCacheHits(){const e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e),e.cacheHits}getLastRequests(){const e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey)||e}clearTelemetryCache(){const e=this.getLastRequests(),t=qe.maxErrorsToSend(e),n=e.errors.length;if(t===n)this.cacheManager.removeItem(this.telemetryCacheKey);else{const o={failedRequests:e.failedRequests.slice(t*2),errors:e.errors.slice(t),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o)}}static maxErrorsToSend(e){let t,n=0,o=0;const i=e.errors.length;for(t=0;t<i;t++){const a=e.failedRequests[2*t]||u.EMPTY_STRING,s=e.failedRequests[2*t+1]||u.EMPTY_STRING,c=e.errors[t]||u.EMPTY_STRING;if(o+=a.toString().length+s.toString().length+c.length+3,o<D.MAX_LAST_HEADER_BYTES)n+=1;else break}return n}getRegionDiscoveryFields(){const e=[];return e.push(this.regionUsed||u.EMPTY_STRING),e.push(this.regionSource||u.EMPTY_STRING),e.push(this.regionOutcome||u.EMPTY_STRING),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){const t=this.getLastRequests();t.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){const e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e)}static makeExtraSkuString(e){return Ec(e)}}/*! @azure/msal-common v15.7.1 2025-06-18 */const ci="missing_kid_error",li="missing_alg_error";/*! @azure/msal-common v15.7.1 2025-06-18 */const Sc={[ci]:"The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",[li]:"The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."};class $n extends b{constructor(e,t){super(e,t),this.name="JoseHeaderError",Object.setPrototypeOf(this,$n.prototype)}}function Ho(r){return new $n(r,Sc[r])}/*! @azure/msal-common v15.7.1 2025-06-18 */class qn{constructor(e){this.typ=e.typ,this.alg=e.alg,this.kid=e.kid}static getShrHeaderString(e){if(!e.kid)throw Ho(ci);if(!e.alg)throw Ho(li);const t=new qn({typ:e.typ||da.Pop,kid:e.kid,alg:e.alg});return JSON.stringify(t)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Vn="pkce_not_created",Qn="ear_jwk_empty",hi="ear_jwe_empty",an="crypto_nonexistent",xt="empty_navigate_uri",di="hash_empty_error",Yn="no_state_in_hash",ui="hash_does_not_contain_known_properties",gi="unable_to_parse_state",fi="state_interaction_type_mismatch",mi="interaction_in_progress",pi="popup_window_error",Ci="empty_window_error",Ve="user_cancelled",_c="monitor_popup_timeout",yi="monitor_window_timeout",Ti="redirect_in_iframe",Ai="block_iframe_reload",Ii="block_nested_popups",vc="iframe_closed_prematurely",Ft="silent_logout_unsupported",Ei="no_account_error",kc="silent_prompt_value_error",wi="no_token_request_cache_error",Si="unable_to_parse_token_request_cache_error",Rc="auth_request_not_set_error",bc="invalid_cache_type",Kt="non_browser_environment",ve="database_not_open",At="no_network_connectivity",_i="post_request_failed",vi="get_request_failed",sn="failed_to_parse_response",ki="unable_to_load_token",jn="crypto_key_not_found",Ri="auth_code_required",bi="auth_code_or_nativeAccountId_required",Oi="spa_code_and_nativeAccountId_present",Wn="database_unavailable",Pi="unable_to_acquire_token_from_native_platform",Ni="native_handshake_timeout",Mi="native_extension_not_installed",Jn="native_connection_not_established",It="uninitialized_public_client_application",Ui="native_prompt_not_supported",Di="invalid_base64_string",Li="invalid_pop_token_request",Hi="failed_to_build_headers",xi="failed_to_parse_headers",at="failed_to_decrypt_ear_response";/*! @azure/msal-browser v4.13.2 2025-06-18 */const ae="For more visit: aka.ms/msaljs/browser-errors",Oc={[Vn]:"The PKCE code challenge and verifier could not be generated.",[Qn]:"No EAR encryption key provided. This is unexpected.",[hi]:"Server response does not contain ear_jwe property. This is unexpected.",[an]:"The crypto object or function is not available.",[xt]:"Navigation URI is empty. Please check stack trace for more info.",[di]:`Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. ${ae}`,[Yn]:"Hash does not contain state. Please verify that the request originated from msal.",[ui]:`Hash does not contain known properites. Please verify that your redirectUri is not changing the hash.  ${ae}`,[gi]:"Unable to parse state. Please verify that the request originated from msal.",[fi]:"Hash contains state but the interaction type does not match the caller.",[mi]:`Interaction is currently in progress. Please ensure that this interaction has been completed before calling an interactive API.   ${ae}`,[pi]:"Error opening popup window. This can happen if you are using IE or if popups are blocked in the browser.",[Ci]:"window.open returned null or undefined window object.",[Ve]:"User cancelled the flow.",[_c]:`Token acquisition in popup failed due to timeout.  ${ae}`,[yi]:`Token acquisition in iframe failed due to timeout.  ${ae}`,[Ti]:"Redirects are not supported for iframed or brokered applications. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs.",[Ai]:`Request was blocked inside an iframe because MSAL detected an authentication response.  ${ae}`,[Ii]:"Request was blocked inside a popup because MSAL detected it was running in a popup.",[vc]:"The iframe being monitored was closed prematurely.",[Ft]:"Silent logout not supported. Please call logoutRedirect or logoutPopup instead.",[Ei]:"No account object provided to acquireTokenSilent and no active account has been set. Please call setActiveAccount or provide an account on the request.",[kc]:"The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'.",[wi]:"No token request found in cache.",[Si]:"The cached token request could not be parsed.",[Rc]:"Auth Request not set. Please ensure initiateAuthRequest was called from the InteractionHandler",[bc]:"Invalid cache type",[Kt]:"Login and token requests are not supported in non-browser environments.",[ve]:"Database is not open!",[At]:"No network connectivity. Check your internet connection.",[_i]:"Network request failed: If the browser threw a CORS error, check that the redirectUri is registered in the Azure App Portal as type 'SPA'",[vi]:"Network request failed. Please check the network trace to determine root cause.",[sn]:"Failed to parse network response. Check network trace.",[ki]:"Error loading token to cache.",[jn]:"Cryptographic Key or Keypair not found in browser storage.",[Ri]:"An authorization code must be provided (as the `code` property on the request) to this flow.",[bi]:"An authorization code or nativeAccountId must be provided to this flow.",[Oi]:"Request cannot contain both spa code and native account id.",[Wn]:"IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts.",[Pi]:`Unable to acquire token from native platform.  ${ae}`,[Ni]:"Timed out while attempting to establish connection to browser extension",[Mi]:"Native extension is not installed. If you think this is a mistake call the initialize function.",[Jn]:`Connection to native platform has not been established. Please install a compatible browser extension and run initialize().  ${ae}`,[It]:`You must call and await the initialize function before attempting to call any other MSAL API.  ${ae}`,[Ui]:"The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",[Di]:"Invalid base64 encoded string.",[Li]:"Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",[Hi]:"Failed to build request headers object.",[xi]:"Failed to parse response headers",[at]:"Failed to decrypt ear response"};class We extends b{constructor(e,t){super(e,Oc[e],t),Object.setPrototypeOf(this,We.prototype),this.name="BrowserAuthError"}}function C(r,e){return new We(r,e)}/*! @azure/msal-browser v4.13.2 2025-06-18 */const z={INVALID_GRANT_ERROR:"invalid_grant",POPUP_WIDTH:483,POPUP_HEIGHT:600,POPUP_NAME_PREFIX:"msal",DEFAULT_POLL_INTERVAL_MS:30,MSAL_SKU:"msal.js.browser"},Y={CHANNEL_ID:"53ee284d-920a-4b59-9d30-a60315b26836",PREFERRED_EXTENSION_ID:"ppnbnpeolgkicgegkbkbjmhlideopiji",MATS_TELEMETRY:"MATS",MICROSOFT_ENTRA_BROKERID:"MicrosoftEntra",DOM_API_NAME:"DOM API",PLATFORM_DOM_APIS:"get-token-and-sign-out",PLATFORM_DOM_PROVIDER:"PlatformAuthDOMHandler",PLATFORM_EXTENSION_PROVIDER:"PlatformAuthExtensionHandler"},He={HandshakeRequest:"Handshake",HandshakeResponse:"HandshakeResponse",GetToken:"GetToken",Response:"Response"},U={LocalStorage:"localStorage",SessionStorage:"sessionStorage",MemoryStorage:"memoryStorage"},xo={GET:"GET",POST:"POST"},de={SIGNIN:"signin",SIGNOUT:"signout"},P={ORIGIN_URI:"request.origin",URL_HASH:"urlHash",REQUEST_PARAMS:"request.params",VERIFIER:"code.verifier",INTERACTION_STATUS_KEY:"interaction.status",NATIVE_REQUEST:"request.native"},ne={ACCOUNT_KEYS:"msal.account.keys",TOKEN_KEYS:"msal.token.keys",VERSION:"msal.version"},ot={WRAPPER_SKU:"wrapper.sku",WRAPPER_VER:"wrapper.version"},R={acquireTokenRedirect:861,acquireTokenPopup:862,ssoSilent:863,acquireTokenSilent_authCode:864,handleRedirectPromise:865,acquireTokenByCode:866,acquireTokenSilent_silentFlow:61,logout:961,logoutPopup:962};var A;(function(r){r.Redirect="redirect",r.Popup="popup",r.Silent="silent",r.None="none"})(A||(A={}));const Fo={scopes:je},Fi="jwk",cn="msal.db",Pc=1,Nc=`${cn}.keys`,F={Default:0,AccessToken:1,AccessTokenAndRefreshToken:2,RefreshToken:3,RefreshTokenAndNetwork:4,Skip:5},Mc=[F.Default,F.Skip,F.RefreshTokenAndNetwork],Uc="msal.browser.log.level",Dc="msal.browser.log.pii",Lc="msal.browser.platform.auth.dom";/*! @azure/msal-browser v4.13.2 2025-06-18 */function rt(r){return encodeURIComponent(Qe(r).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"))}function Ce(r){return Ki(r).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Qe(r){return Ki(new TextEncoder().encode(r))}function Ki(r){const e=Array.from(r,t=>String.fromCodePoint(t)).join("");return btoa(e)}/*! @azure/msal-browser v4.13.2 2025-06-18 */function X(r){return new TextDecoder().decode(me(r))}function me(r){let e=r.replace(/-/g,"+").replace(/_/g,"/");switch(e.length%4){case 0:break;case 2:e+="==";break;case 3:e+="=";break;default:throw C(Di)}const t=atob(e);return Uint8Array.from(t,n=>n.codePointAt(0)||0)}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Hc="RSASSA-PKCS1-v1_5",De="AES-GCM",Bi="HKDF",Xn="SHA-256",xc=2048,Fc=new Uint8Array([1,0,1]),Ko="0123456789abcdef",Bo=new Uint32Array(1),Zn="raw",Gi="encrypt",eo="decrypt",Kc="deriveKey",Bc="crypto_subtle_undefined",to={name:Hc,hash:Xn,modulusLength:xc,publicExponent:Fc};function Gc(r){if(!window)throw C(Kt);if(!window.crypto)throw C(an);if(!r&&!window.crypto.subtle)throw C(an,Bc)}async function zi(r,e,t){e==null||e.addQueueMeasurement(h.Sha256Digest,t);const o=new TextEncoder().encode(r);return window.crypto.subtle.digest(Xn,o)}function zc(r){return window.crypto.getRandomValues(r)}function Yt(){return window.crypto.getRandomValues(Bo),Bo[0]}function ee(){const r=Date.now(),e=Yt()*1024+(Yt()&1023),t=new Uint8Array(16),n=Math.trunc(e/2**30),o=e&2**30-1,i=Yt();t[0]=r/2**40,t[1]=r/2**32,t[2]=r/2**24,t[3]=r/2**16,t[4]=r/2**8,t[5]=r,t[6]=112|n>>>8,t[7]=n,t[8]=128|o>>>24,t[9]=o>>>16,t[10]=o>>>8,t[11]=o,t[12]=i>>>24,t[13]=i>>>16,t[14]=i>>>8,t[15]=i;let a="";for(let s=0;s<t.length;s++)a+=Ko.charAt(t[s]>>>4),a+=Ko.charAt(t[s]&15),(s===3||s===5||s===7||s===9)&&(a+="-");return a}async function $c(r,e){return window.crypto.subtle.generateKey(to,r,e)}async function jt(r){return window.crypto.subtle.exportKey(Fi,r)}async function qc(r,e,t){return window.crypto.subtle.importKey(Fi,r,to,e,t)}async function Vc(r,e){return window.crypto.subtle.sign(to,r,e)}async function no(){const r=await $i(),t={alg:"dir",kty:"oct",k:Ce(new Uint8Array(r))};return Qe(JSON.stringify(t))}async function Qc(r){const e=X(r),n=JSON.parse(e).k,o=me(n);return window.crypto.subtle.importKey(Zn,o,De,!1,[eo])}async function Yc(r,e){const t=e.split(".");if(t.length!==5)throw C(at,"jwe_length");const n=await Qc(r).catch(()=>{throw C(at,"import_key")});try{const o=new TextEncoder().encode(t[0]),i=me(t[2]),a=me(t[3]),s=me(t[4]),c=s.byteLength*8,l=new Uint8Array(a.length+s.length);l.set(a),l.set(s,a.length);const d=await window.crypto.subtle.decrypt({name:De,iv:i,tagLength:c,additionalData:o},n,l);return new TextDecoder().decode(d)}catch{throw C(at,"decrypt")}}async function $i(){const r=await window.crypto.subtle.generateKey({name:De,length:256},!0,[Gi,eo]);return window.crypto.subtle.exportKey(Zn,r)}async function Go(r){return window.crypto.subtle.importKey(Zn,r,Bi,!1,[Kc])}async function qi(r,e,t){return window.crypto.subtle.deriveKey({name:Bi,salt:e,hash:Xn,info:new TextEncoder().encode(t)},r,{name:De,length:256},!1,[Gi,eo])}async function jc(r,e,t){const n=new TextEncoder().encode(e),o=window.crypto.getRandomValues(new Uint8Array(16)),i=await qi(r,o,t),a=await window.crypto.subtle.encrypt({name:De,iv:new Uint8Array(12)},i,n);return{data:Ce(new Uint8Array(a)),nonce:Ce(o)}}async function Wc(r,e,t,n){const o=me(n),i=await qi(r,me(e),t),a=await window.crypto.subtle.decrypt({name:De,iv:new Uint8Array(12)},i,o);return new TextDecoder().decode(a)}async function Vi(r){const e=await zi(r),t=new Uint8Array(e);return Ce(t)}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Bt="storage_not_supported",Qi="stubbed_public_client_application_called",oo="in_mem_redirect_unavailable";/*! @azure/msal-browser v4.13.2 2025-06-18 */const st={[Bt]:"Given storage configuration option was not supported.",[Qi]:"Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",[oo]:"Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."};st[Bt],st[Qi],st[oo];class ro extends b{constructor(e,t){super(e,t),this.name="BrowserConfigurationAuthError",Object.setPrototypeOf(this,ro.prototype)}}function io(r){return new ro(r,st[r])}/*! @azure/msal-browser v4.13.2 2025-06-18 */function Yi(r){r.location.hash="",typeof r.history.replaceState=="function"&&r.history.replaceState(null,"",`${r.location.origin}${r.location.pathname}${r.location.search}`)}function Jc(r){const e=r.split("#");e.shift(),window.location.hash=e.length>0?e.join("#"):""}function ao(){return window.parent!==window}function Xc(){return typeof window<"u"&&!!window.opener&&window.opener!==window&&typeof window.name=="string"&&window.name.indexOf(`${z.POPUP_NAME_PREFIX}.`)===0}function ce(){return typeof window<"u"&&window.location?window.location.href.split("?")[0].split("#")[0]:""}function Zc(){const e=new _(window.location.href).getUrlComponents();return`${e.Protocol}//${e.HostNameAndPort}/`}function el(){if(_.hashContainsKnownProperties(window.location.hash)&&ao())throw C(Ai)}function tl(r){if(ao()&&!r)throw C(Ti)}function nl(){if(Xc())throw C(Ii)}function ji(){if(typeof window>"u")throw C(Kt)}function Wi(r){if(!r)throw C(It)}function so(r){ji(),el(),nl(),Wi(r)}function zo(r,e){if(so(r),tl(e.system.allowRedirectInIframe),e.cache.cacheLocation===U.MemoryStorage&&!e.cache.storeAuthStateInCookie)throw io(oo)}function Ji(r){const e=document.createElement("link");e.rel="preconnect",e.href=new URL(r).origin,e.crossOrigin="anonymous",document.head.appendChild(e),window.setTimeout(()=>{try{document.head.removeChild(e)}catch{}},1e4)}function ol(){return ee()}/*! @azure/msal-browser v4.13.2 2025-06-18 */class Et{navigateInternal(e,t){return Et.defaultNavigateWindow(e,t)}navigateExternal(e,t){return Et.defaultNavigateWindow(e,t)}static defaultNavigateWindow(e,t){return t.noHistory?window.location.replace(e):window.location.assign(e),new Promise(n=>{setTimeout(()=>{n(!0)},t.timeout)})}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class rl{async sendGetRequestAsync(e,t){let n,o={},i=0;const a=$o(t);try{n=await fetch(e,{method:xo.GET,headers:a})}catch(s){throw Fe(C(window.navigator.onLine?vi:At),void 0,void 0,s)}o=qo(n.headers);try{return i=n.status,{headers:o,body:await n.json(),status:i}}catch(s){throw Fe(C(sn),i,o,s)}}async sendPostRequestAsync(e,t){const n=t&&t.body||"",o=$o(t);let i,a=0,s={};try{i=await fetch(e,{method:xo.POST,headers:o,body:n})}catch(c){throw Fe(C(window.navigator.onLine?_i:At),void 0,void 0,c)}s=qo(i.headers);try{return a=i.status,{headers:s,body:await i.json(),status:a}}catch(c){throw Fe(C(sn),a,s,c)}}}function $o(r){try{const e=new Headers;if(!(r&&r.headers))return e;const t=r.headers;return Object.entries(t).forEach(([n,o])=>{e.append(n,o)}),e}catch(e){throw Fe(C(Hi),void 0,void 0,e)}}function qo(r){try{const e={};return r.forEach((t,n)=>{e[n]=t}),e}catch{throw C(xi)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const il=6e4,ln=1e4,al=3e4,Xi=2e3;function sl({auth:r,cache:e,system:t,telemetry:n},o){const i={clientId:u.EMPTY_STRING,authority:`${u.DEFAULT_AUTHORITY}`,knownAuthorities:[],cloudDiscoveryMetadata:u.EMPTY_STRING,authorityMetadata:u.EMPTY_STRING,redirectUri:typeof window<"u"?ce():"",postLogoutRedirectUri:u.EMPTY_STRING,navigateToLoginRequestUrl:!0,clientCapabilities:[],protocolMode:q.AAD,OIDCOptions:{serverResponseType:vt.FRAGMENT,defaultScopes:[u.OPENID_SCOPE,u.PROFILE_SCOPE,u.OFFLINE_ACCESS_SCOPE]},azureCloudOptions:{azureCloudInstance:wn.None,tenant:u.EMPTY_STRING},skipAuthorityMetadataCache:!1,supportsNestedAppAuth:!1,instanceAware:!1,encodeExtraQueryParams:!1},a={cacheLocation:U.SessionStorage,temporaryCacheLocation:U.SessionStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!!(e&&e.cacheLocation===U.LocalStorage),claimsBasedCachingEnabled:!1},s={loggerCallback:()=>{},logLevel:O.Info,piiLoggingEnabled:!1},l={...{...xr,loggerOptions:s,networkClient:o?new rl:pc,navigationClient:new Et,loadFrameTimeout:0,windowHashTimeout:(t==null?void 0:t.loadFrameTimeout)||il,iframeHashTimeout:(t==null?void 0:t.loadFrameTimeout)||ln,navigateFrameWait:0,redirectNavigationTimeout:al,asyncPopups:!1,allowRedirectInIframe:!1,allowPlatformBroker:!1,nativeBrokerHandshakeTimeout:(t==null?void 0:t.nativeBrokerHandshakeTimeout)||Xi,pollIntervalMilliseconds:z.DEFAULT_POLL_INTERVAL_MS},...t,loggerOptions:(t==null?void 0:t.loggerOptions)||s},d={application:{appName:u.EMPTY_STRING,appVersion:u.EMPTY_STRING},client:new Hr};if((r==null?void 0:r.protocolMode)!==q.OIDC&&(r!=null&&r.OIDCOptions)&&new pe(l.loggerOptions).warning(JSON.stringify(k(br))),r!=null&&r.protocolMode&&r.protocolMode===q.OIDC&&(l!=null&&l.allowPlatformBroker))throw k(Or);return{auth:{...i,...r,OIDCOptions:{...i.OIDCOptions,...r==null?void 0:r.OIDCOptions}},cache:{...a,...e},system:l,telemetry:{...d,...n}}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const cl="@azure/msal-browser",Ee="4.13.2";/*! @azure/msal-browser v4.13.2 2025-06-18 */class co{static loggerCallback(e,t){switch(e){case O.Error:console.error(t);return;case O.Info:console.info(t);return;case O.Verbose:console.debug(t);return;case O.Warning:console.warn(t);return;default:console.log(t);return}}constructor(e){var c;this.browserEnvironment=typeof window<"u",this.config=sl(e,this.browserEnvironment);let t;try{t=window[U.SessionStorage]}catch{}const n=t==null?void 0:t.getItem(Uc),o=(c=t==null?void 0:t.getItem(Dc))==null?void 0:c.toLowerCase(),i=o==="true"?!0:o==="false"?!1:void 0,a={...this.config.system.loggerOptions},s=n&&Object.keys(O).includes(n)?O[n]:void 0;s&&(a.loggerCallback=co.loggerCallback,a.logLevel=s),i!==void 0&&(a.piiLoggingEnabled=i),this.logger=new pe(a,cl,Ee),this.available=!1}getConfig(){return this.config}getLogger(){return this.logger}isAvailable(){return this.available}isBrowserEnvironment(){return this.browserEnvironment}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class we extends co{getModuleName(){return we.MODULE_NAME}getId(){return we.ID}async initialize(){return this.available=typeof window<"u",this.available}}we.MODULE_NAME="";we.ID="StandardOperatingContext";/*! @azure/msal-browser v4.13.2 2025-06-18 */class ll{constructor(){this.dbName=cn,this.version=Pc,this.tableName=Nc,this.dbOpen=!1}async open(){return new Promise((e,t)=>{const n=window.indexedDB.open(this.dbName,this.version);n.addEventListener("upgradeneeded",o=>{o.target.result.createObjectStore(this.tableName)}),n.addEventListener("success",o=>{const i=o;this.db=i.target.result,this.dbOpen=!0,e()}),n.addEventListener("error",()=>t(C(Wn)))})}closeConnection(){const e=this.db;e&&this.dbOpen&&(e.close(),this.dbOpen=!1)}async validateDbIsOpen(){if(!this.dbOpen)return this.open()}async getItem(e){return await this.validateDbIsOpen(),new Promise((t,n)=>{if(!this.db)return n(C(ve));const a=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).get(e);a.addEventListener("success",s=>{const c=s;this.closeConnection(),t(c.target.result)}),a.addEventListener("error",s=>{this.closeConnection(),n(s)})})}async setItem(e,t){return await this.validateDbIsOpen(),new Promise((n,o)=>{if(!this.db)return o(C(ve));const s=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).put(t,e);s.addEventListener("success",()=>{this.closeConnection(),n()}),s.addEventListener("error",c=>{this.closeConnection(),o(c)})})}async removeItem(e){return await this.validateDbIsOpen(),new Promise((t,n)=>{if(!this.db)return n(C(ve));const a=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).delete(e);a.addEventListener("success",()=>{this.closeConnection(),t()}),a.addEventListener("error",s=>{this.closeConnection(),n(s)})})}async getKeys(){return await this.validateDbIsOpen(),new Promise((e,t)=>{if(!this.db)return t(C(ve));const i=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).getAllKeys();i.addEventListener("success",a=>{const s=a;this.closeConnection(),e(s.target.result)}),i.addEventListener("error",a=>{this.closeConnection(),t(a)})})}async containsKey(e){return await this.validateDbIsOpen(),new Promise((t,n)=>{if(!this.db)return n(C(ve));const a=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).count(e);a.addEventListener("success",s=>{const c=s;this.closeConnection(),t(c.target.result===1)}),a.addEventListener("error",s=>{this.closeConnection(),n(s)})})}async deleteDatabase(){return this.db&&this.dbOpen&&this.closeConnection(),new Promise((e,t)=>{const n=window.indexedDB.deleteDatabase(cn),o=setTimeout(()=>t(!1),200);n.addEventListener("success",()=>(clearTimeout(o),e(!0))),n.addEventListener("blocked",()=>(clearTimeout(o),e(!0))),n.addEventListener("error",()=>(clearTimeout(o),t(!1)))})}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class Gt{constructor(){this.cache=new Map}async initialize(){}getItem(e){return this.cache.get(e)||null}getUserData(e){return this.getItem(e)}setItem(e,t){this.cache.set(e,t)}async setUserData(e,t){this.setItem(e,t)}removeItem(e){this.cache.delete(e)}getKeys(){const e=[];return this.cache.forEach((t,n)=>{e.push(n)}),e}containsKey(e){return this.cache.has(e)}clear(){this.cache.clear()}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class hl{constructor(e){this.inMemoryCache=new Gt,this.indexedDBCache=new ll,this.logger=e}handleDatabaseAccessError(e){if(e instanceof We&&e.errorCode===Wn)this.logger.error("Could not access persistent storage. This may be caused by browser privacy features which block persistent storage in third-party contexts.");else throw e}async getItem(e){const t=this.inMemoryCache.getItem(e);if(!t)try{return this.logger.verbose("Queried item not found in in-memory cache, now querying persistent storage."),await this.indexedDBCache.getItem(e)}catch(n){this.handleDatabaseAccessError(n)}return t}async setItem(e,t){this.inMemoryCache.setItem(e,t);try{await this.indexedDBCache.setItem(e,t)}catch(n){this.handleDatabaseAccessError(n)}}async removeItem(e){this.inMemoryCache.removeItem(e);try{await this.indexedDBCache.removeItem(e)}catch(t){this.handleDatabaseAccessError(t)}}async getKeys(){const e=this.inMemoryCache.getKeys();if(e.length===0)try{return this.logger.verbose("In-memory cache is empty, now querying persistent storage."),await this.indexedDBCache.getKeys()}catch(t){this.handleDatabaseAccessError(t)}return e}async containsKey(e){const t=this.inMemoryCache.containsKey(e);if(!t)try{return this.logger.verbose("Key not found in in-memory cache, now querying persistent storage."),await this.indexedDBCache.containsKey(e)}catch(n){this.handleDatabaseAccessError(n)}return t}clearInMemory(){this.logger.verbose("Deleting in-memory keystore"),this.inMemoryCache.clear(),this.logger.verbose("In-memory keystore deleted")}async clearPersistent(){try{this.logger.verbose("Deleting persistent keystore");const e=await this.indexedDBCache.deleteDatabase();return e&&this.logger.verbose("Persistent keystore deleted"),e}catch(e){return this.handleDatabaseAccessError(e),!1}}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class le{constructor(e,t,n){this.logger=e,Gc(n??!1),this.cache=new hl(this.logger),this.performanceClient=t}createNewGuid(){return ee()}base64Encode(e){return Qe(e)}base64Decode(e){return X(e)}base64UrlEncode(e){return rt(e)}encodeKid(e){return this.base64UrlEncode(JSON.stringify({kid:e}))}async getPublicKeyThumbprint(e){var d;const t=(d=this.performanceClient)==null?void 0:d.startMeasurement(h.CryptoOptsGetPublicKeyThumbprint,e.correlationId),n=await $c(le.EXTRACTABLE,le.POP_KEY_USAGES),o=await jt(n.publicKey),i={e:o.e,kty:o.kty,n:o.n},a=Vo(i),s=await this.hashString(a),c=await jt(n.privateKey),l=await qc(c,!1,["sign"]);return await this.cache.setItem(s,{privateKey:l,publicKey:n.publicKey,requestMethod:e.resourceRequestMethod,requestUri:e.resourceRequestUri}),t&&t.end({success:!0}),s}async removeTokenBindingKey(e){if(await this.cache.removeItem(e),await this.cache.containsKey(e))throw m(gr)}async clearKeystore(){this.cache.clearInMemory();try{return await this.cache.clearPersistent(),!0}catch(e){return e instanceof Error?this.logger.error(`Clearing keystore failed with error: ${e.message}`):this.logger.error("Clearing keystore failed with unknown error"),!1}}async signJwt(e,t,n,o){var he;const i=(he=this.performanceClient)==null?void 0:he.startMeasurement(h.CryptoOptsSignJwt,o),a=await this.cache.getItem(t);if(!a)throw C(jn);const s=await jt(a.publicKey),c=Vo(s),l=rt(JSON.stringify({kid:t})),d=qn.getShrHeaderString({...n==null?void 0:n.header,alg:s.alg,kid:l}),g=rt(d);e.cnf={jwk:JSON.parse(c)};const p=rt(JSON.stringify(e)),y=`${g}.${p}`,S=new TextEncoder().encode(y),M=await Vc(a.privateKey,S),G=Ce(new Uint8Array(M)),Q=`${y}.${G}`;return i&&i.end({success:!0}),Q}async hashString(e){return Vi(e)}}le.POP_KEY_USAGES=["sign","verify"];le.EXTRACTABLE=!0;function Vo(r){return JSON.stringify(r,Object.keys(r).sort())}/*! @azure/msal-browser v4.13.2 2025-06-18 */const dl=24*60*60*1e3,hn={Lax:"Lax",None:"None"};class Zi{initialize(){return Promise.resolve()}getItem(e){const t=`${encodeURIComponent(e)}`,n=document.cookie.split(";");for(let o=0;o<n.length;o++){const i=n[o],[a,...s]=decodeURIComponent(i).trim().split("="),c=s.join("=");if(a===t)return c}return""}getUserData(){throw m(E)}setItem(e,t,n,o=!0,i=hn.Lax){let a=`${encodeURIComponent(e)}=${encodeURIComponent(t)};path=/;SameSite=${i};`;if(n){const s=ul(n);a+=`expires=${s};`}(o||i===hn.None)&&(a+="Secure;"),document.cookie=a}async setUserData(){return Promise.reject(m(E))}removeItem(e){this.setItem(e,"",-1)}getKeys(){const e=document.cookie.split(";"),t=[];return e.forEach(n=>{const o=decodeURIComponent(n).trim().split("=");t.push(o[0])}),t}containsKey(e){return this.getKeys().includes(e)}}function ul(r){const e=new Date;return new Date(e.getTime()+r*dl).toUTCString()}/*! @azure/msal-browser v4.13.2 2025-06-18 */function dn(r){const e=r.getItem(ne.ACCOUNT_KEYS);return e?JSON.parse(e):[]}function un(r,e){const t=e.getItem(`${ne.TOKEN_KEYS}.${r}`);if(t){const n=JSON.parse(t);if(n&&n.hasOwnProperty("idToken")&&n.hasOwnProperty("accessToken")&&n.hasOwnProperty("refreshToken"))return n}return{idToken:[],accessToken:[],refreshToken:[]}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Qo="msal.cache.encryption",gl="msal.broadcast.cache";class fl{constructor(e,t,n){if(!window.localStorage)throw io(Bt);this.memoryStorage=new Gt,this.initialized=!1,this.clientId=e,this.logger=t,this.performanceClient=n,this.broadcast=new BroadcastChannel(gl)}async initialize(e){const t=new Zi,n=t.getItem(Qo);let o={key:"",id:""};if(n)try{o=JSON.parse(n)}catch{}if(o.key&&o.id){const i=j(me,h.Base64Decode,this.logger,this.performanceClient,e)(o.key);this.encryptionCookie={id:o.id,key:await f(Go,h.GenerateHKDF,this.logger,this.performanceClient,e)(i)},await f(this.importExistingCache.bind(this),h.ImportExistingCache,this.logger,this.performanceClient,e)(e)}else{this.clear();const i=ee(),a=await f($i,h.GenerateBaseKey,this.logger,this.performanceClient,e)(),s=j(Ce,h.UrlEncodeArr,this.logger,this.performanceClient,e)(new Uint8Array(a));this.encryptionCookie={id:i,key:await f(Go,h.GenerateHKDF,this.logger,this.performanceClient,e)(a)};const c={id:i,key:s};t.setItem(Qo,JSON.stringify(c),0,!0,hn.None)}this.broadcast.addEventListener("message",this.updateCache.bind(this)),this.initialized=!0}getItem(e){return window.localStorage.getItem(e)}getUserData(e){if(!this.initialized)throw C(It);return this.memoryStorage.getItem(e)}setItem(e,t){window.localStorage.setItem(e,t)}async setUserData(e,t,n){if(!this.initialized||!this.encryptionCookie)throw C(It);const{data:o,nonce:i}=await f(jc,h.Encrypt,this.logger,this.performanceClient,n)(this.encryptionCookie.key,t,this.getContext(e)),a={id:this.encryptionCookie.id,nonce:i,data:o};this.memoryStorage.setItem(e,t),this.setItem(e,JSON.stringify(a)),this.broadcast.postMessage({key:e,value:t,context:this.getContext(e)})}removeItem(e){this.memoryStorage.containsKey(e)&&(this.memoryStorage.removeItem(e),this.broadcast.postMessage({key:e,value:null,context:this.getContext(e)})),window.localStorage.removeItem(e)}getKeys(){return Object.keys(window.localStorage)}containsKey(e){return window.localStorage.hasOwnProperty(e)}clear(){this.memoryStorage.clear(),dn(this).forEach(n=>this.removeItem(n));const t=un(this.clientId,this);t.idToken.forEach(n=>this.removeItem(n)),t.accessToken.forEach(n=>this.removeItem(n)),t.refreshToken.forEach(n=>this.removeItem(n)),this.getKeys().forEach(n=>{(n.startsWith(u.CACHE_PREFIX)||n.indexOf(this.clientId)!==-1)&&this.removeItem(n)})}async importExistingCache(e){if(!this.encryptionCookie)return;let t=dn(this);t=await this.importArray(t,e),this.setItem(ne.ACCOUNT_KEYS,JSON.stringify(t));const n=un(this.clientId,this);n.idToken=await this.importArray(n.idToken,e),n.accessToken=await this.importArray(n.accessToken,e),n.refreshToken=await this.importArray(n.refreshToken,e),this.setItem(`${ne.TOKEN_KEYS}.${this.clientId}`,JSON.stringify(n))}async getItemFromEncryptedCache(e,t){if(!this.encryptionCookie)return null;const n=this.getItem(e);if(!n)return null;let o;try{o=JSON.parse(n)}catch{return null}return!o.id||!o.nonce||!o.data?(this.performanceClient.incrementFields({unencryptedCacheCount:1},t),null):o.id!==this.encryptionCookie.id?(this.performanceClient.incrementFields({encryptedCacheExpiredCount:1},t),null):f(Wc,h.Decrypt,this.logger,this.performanceClient,t)(this.encryptionCookie.key,o.nonce,this.getContext(e),o.data)}async importArray(e,t){const n=[],o=[];return e.forEach(i=>{const a=this.getItemFromEncryptedCache(i,t).then(s=>{s?(this.memoryStorage.setItem(i,s),n.push(i)):this.removeItem(i)});o.push(a)}),await Promise.all(o),n}getContext(e){let t="";return e.includes(this.clientId)&&(t=this.clientId),t}updateCache(e){this.logger.trace("Updating internal cache from broadcast event");const t=this.performanceClient.startMeasurement(h.LocalStorageUpdated);t.add({isBackground:!0});const{key:n,value:o,context:i}=e.data;if(!n){this.logger.error("Broadcast event missing key"),t.end({success:!1,errorCode:"noKey"});return}if(i&&i!==this.clientId){this.logger.trace(`Ignoring broadcast event from clientId: ${i}`),t.end({success:!1,errorCode:"contextMismatch"});return}o?(this.memoryStorage.setItem(n,o),this.logger.verbose("Updated item in internal cache")):(this.memoryStorage.removeItem(n),this.logger.verbose("Removed item from internal cache")),t.end({success:!0})}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class ml{constructor(){if(!window.sessionStorage)throw io(Bt)}async initialize(){}getItem(e){return window.sessionStorage.getItem(e)}getUserData(e){return this.getItem(e)}setItem(e,t){window.sessionStorage.setItem(e,t)}async setUserData(e,t){this.setItem(e,t)}removeItem(e){window.sessionStorage.removeItem(e)}getKeys(){return Object.keys(window.sessionStorage)}containsKey(e){return window.sessionStorage.hasOwnProperty(e)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const T={INITIALIZE_START:"msal:initializeStart",INITIALIZE_END:"msal:initializeEnd",ACCOUNT_ADDED:"msal:accountAdded",ACCOUNT_REMOVED:"msal:accountRemoved",ACTIVE_ACCOUNT_CHANGED:"msal:activeAccountChanged",LOGIN_START:"msal:loginStart",LOGIN_SUCCESS:"msal:loginSuccess",LOGIN_FAILURE:"msal:loginFailure",ACQUIRE_TOKEN_START:"msal:acquireTokenStart",ACQUIRE_TOKEN_SUCCESS:"msal:acquireTokenSuccess",ACQUIRE_TOKEN_FAILURE:"msal:acquireTokenFailure",ACQUIRE_TOKEN_NETWORK_START:"msal:acquireTokenFromNetworkStart",SSO_SILENT_START:"msal:ssoSilentStart",SSO_SILENT_SUCCESS:"msal:ssoSilentSuccess",SSO_SILENT_FAILURE:"msal:ssoSilentFailure",ACQUIRE_TOKEN_BY_CODE_START:"msal:acquireTokenByCodeStart",ACQUIRE_TOKEN_BY_CODE_SUCCESS:"msal:acquireTokenByCodeSuccess",ACQUIRE_TOKEN_BY_CODE_FAILURE:"msal:acquireTokenByCodeFailure",HANDLE_REDIRECT_START:"msal:handleRedirectStart",HANDLE_REDIRECT_END:"msal:handleRedirectEnd",POPUP_OPENED:"msal:popupOpened",LOGOUT_START:"msal:logoutStart",LOGOUT_SUCCESS:"msal:logoutSuccess",LOGOUT_FAILURE:"msal:logoutFailure",LOGOUT_END:"msal:logoutEnd",RESTORE_FROM_BFCACHE:"msal:restoreFromBFCache",BROKER_CONNECTION_ESTABLISHED:"msal:brokerConnectionEstablished"};/*! @azure/msal-browser v4.13.2 2025-06-18 */class gn extends on{constructor(e,t,n,o,i,a,s){super(e,n,o,i,s),this.cacheConfig=t,this.logger=o,this.internalStorage=new Gt,this.browserStorage=Yo(e,t.cacheLocation,o,i),this.temporaryCacheStorage=Yo(e,t.temporaryCacheLocation,o,i),this.cookieStorage=new Zi,this.eventHandler=a}async initialize(e){await this.browserStorage.initialize(e),this.trackVersionChanges(e)}trackVersionChanges(e){const t=this.browserStorage.getItem(ne.VERSION);t&&(this.logger.info(`MSAL.js was last initialized by version: ${t}`),this.performanceClient.addFields({previousLibraryVersion:t},e)),t!==Ee&&this.browserStorage.setItem(ne.VERSION,Ee)}validateAndParseJson(e){try{const t=JSON.parse(e);return t&&typeof t=="object"?t:null}catch{return null}}getAccount(e){this.logger.trace("BrowserCacheManager.getAccount called");const t=this.browserStorage.getUserData(e);if(!t)return this.removeAccountKeyFromMap(e),null;const n=this.validateAndParseJson(t);return!n||!B.isAccountEntity(n)?(this.removeAccountKeyFromMap(e),null):on.toObject(new B,n)}async setAccount(e,t){this.logger.trace("BrowserCacheManager.setAccount called");const n=e.generateAccountKey();await f(this.browserStorage.setUserData.bind(this.browserStorage),h.SetUserData,this.logger,this.performanceClient)(n,JSON.stringify(e),t);const o=this.addAccountKeyToMap(n);this.cacheConfig.cacheLocation===U.LocalStorage&&o&&this.eventHandler.emitEvent(T.ACCOUNT_ADDED,void 0,e.getAccountInfo())}getAccountKeys(){return dn(this.browserStorage)}addAccountKeyToMap(e){this.logger.trace("BrowserCacheManager.addAccountKeyToMap called"),this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${e}`);const t=this.getAccountKeys();return t.indexOf(e)===-1?(t.push(e),this.browserStorage.setItem(ne.ACCOUNT_KEYS,JSON.stringify(t)),this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added"),!0):(this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map"),!1)}removeAccountKeyFromMap(e){this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called"),this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${e}`);const t=this.getAccountKeys(),n=t.indexOf(e);n>-1?(t.splice(n,1),this.browserStorage.setItem(ne.ACCOUNT_KEYS,JSON.stringify(t)),this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed")):this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map")}removeAccount(e,t){super.removeAccount(e,t),this.removeAccountKeyFromMap(e)}removeAccountContext(e,t){super.removeAccountContext(e,t),this.cacheConfig.cacheLocation===U.LocalStorage&&this.eventHandler.emitEvent(T.ACCOUNT_REMOVED,void 0,e.getAccountInfo())}removeIdToken(e){super.removeIdToken(e),this.removeTokenKey(e,I.ID_TOKEN)}removeAccessToken(e,t){super.removeAccessToken(e,t),this.removeTokenKey(e,I.ACCESS_TOKEN)}removeRefreshToken(e){super.removeRefreshToken(e),this.removeTokenKey(e,I.REFRESH_TOKEN)}getTokenKeys(){return un(this.clientId,this.browserStorage)}addTokenKey(e,t){this.logger.trace("BrowserCacheManager addTokenKey called");const n=this.getTokenKeys();switch(t){case I.ID_TOKEN:n.idToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map"),n.idToken.push(e));break;case I.ACCESS_TOKEN:n.accessToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map"),n.accessToken.push(e));break;case I.REFRESH_TOKEN:n.refreshToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map"),n.refreshToken.push(e));break;default:throw this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${t}`),m(tn)}this.browserStorage.setItem(`${ne.TOKEN_KEYS}.${this.clientId}`,JSON.stringify(n))}removeTokenKey(e,t){this.logger.trace("BrowserCacheManager removeTokenKey called");const n=this.getTokenKeys();switch(t){case I.ID_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${e} from map`);const o=n.idToken.indexOf(e);o>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map"),n.idToken.splice(o,1)):this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");break;case I.ACCESS_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: ${e} from map`);const i=n.accessToken.indexOf(e);i>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map"),n.accessToken.splice(i,1)):this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");break;case I.REFRESH_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: ${e} from map`);const a=n.refreshToken.indexOf(e);a>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map"),n.refreshToken.splice(a,1)):this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");break;default:throw this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${t}`),m(tn)}this.browserStorage.setItem(`${ne.TOKEN_KEYS}.${this.clientId}`,JSON.stringify(n))}getIdTokenCredential(e){const t=this.browserStorage.getUserData(e);if(!t)return this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ID_TOKEN),null;const n=this.validateAndParseJson(t);return!n||!ba(n)?(this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ID_TOKEN),null):(this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit"),n)}async setIdTokenCredential(e,t){this.logger.trace("BrowserCacheManager.setIdTokenCredential called");const n=Ge(e);await f(this.browserStorage.setUserData.bind(this.browserStorage),h.SetUserData,this.logger,this.performanceClient)(n,JSON.stringify(e),t),this.addTokenKey(n,I.ID_TOKEN)}getAccessTokenCredential(e){const t=this.browserStorage.getUserData(e);if(!t)return this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ACCESS_TOKEN),null;const n=this.validateAndParseJson(t);return!n||!Ra(n)?(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ACCESS_TOKEN),null):(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit"),n)}async setAccessTokenCredential(e,t){this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");const n=Ge(e);await f(this.browserStorage.setUserData.bind(this.browserStorage),h.SetUserData,this.logger,this.performanceClient)(n,JSON.stringify(e),t),this.addTokenKey(n,I.ACCESS_TOKEN)}getRefreshTokenCredential(e){const t=this.browserStorage.getUserData(e);if(!t)return this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.REFRESH_TOKEN),null;const n=this.validateAndParseJson(t);return!n||!Oa(n)?(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.REFRESH_TOKEN),null):(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit"),n)}async setRefreshTokenCredential(e,t){this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");const n=Ge(e);await f(this.browserStorage.setUserData.bind(this.browserStorage),h.SetUserData,this.logger,this.performanceClient)(n,JSON.stringify(e),t),this.addTokenKey(n,I.REFRESH_TOKEN)}getAppMetadata(e){const t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null;const n=this.validateAndParseJson(t);return!n||!Fa(e,n)?(this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit"),n)}setAppMetadata(e){this.logger.trace("BrowserCacheManager.setAppMetadata called");const t=xa(e);this.browserStorage.setItem(t,JSON.stringify(e))}getServerTelemetry(e){const t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null;const n=this.validateAndParseJson(t);return!n||!La(e,n)?(this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit"),n)}setServerTelemetry(e,t){this.logger.trace("BrowserCacheManager.setServerTelemetry called"),this.browserStorage.setItem(e,JSON.stringify(t))}getAuthorityMetadata(e){const t=this.internalStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAuthorityMetadata: called, no cache hit"),null;const n=this.validateAndParseJson(t);return n&&Ka(e,n)?(this.logger.trace("BrowserCacheManager.getAuthorityMetadata: cache hit"),n):null}getAuthorityMetadataKeys(){return this.internalStorage.getKeys().filter(t=>this.isAuthorityMetadata(t))}setWrapperMetadata(e,t){this.internalStorage.setItem(ot.WRAPPER_SKU,e),this.internalStorage.setItem(ot.WRAPPER_VER,t)}getWrapperMetadata(){const e=this.internalStorage.getItem(ot.WRAPPER_SKU)||u.EMPTY_STRING,t=this.internalStorage.getItem(ot.WRAPPER_VER)||u.EMPTY_STRING;return[e,t]}setAuthorityMetadata(e,t){this.logger.trace("BrowserCacheManager.setAuthorityMetadata called"),this.internalStorage.setItem(e,JSON.stringify(t))}getActiveAccount(){const e=this.generateCacheKey(Io.ACTIVE_ACCOUNT_FILTERS),t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters found"),null;const n=this.validateAndParseJson(t);return n?(this.logger.trace("BrowserCacheManager.getActiveAccount: Active account filters schema found"),this.getAccountInfoFilteredBy({homeAccountId:n.homeAccountId,localAccountId:n.localAccountId,tenantId:n.tenantId})):(this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found"),null)}setActiveAccount(e){const t=this.generateCacheKey(Io.ACTIVE_ACCOUNT_FILTERS);if(e){this.logger.verbose("setActiveAccount: Active account set");const n={homeAccountId:e.homeAccountId,localAccountId:e.localAccountId,tenantId:e.tenantId};this.browserStorage.setItem(t,JSON.stringify(n))}else this.logger.verbose("setActiveAccount: No account passed, active account not set"),this.browserStorage.removeItem(t);this.eventHandler.emitEvent(T.ACTIVE_ACCOUNT_CHANGED)}getThrottlingCache(e){const t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null;const n=this.validateAndParseJson(t);return!n||!Ha(e,n)?(this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit"),n)}setThrottlingCache(e,t){this.logger.trace("BrowserCacheManager.setThrottlingCache called"),this.browserStorage.setItem(e,JSON.stringify(t))}getTemporaryCache(e,t){const n=t?this.generateCacheKey(e):e;if(this.cacheConfig.storeAuthStateInCookie){const i=this.cookieStorage.getItem(n);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: storeAuthStateInCookies set to true, retrieving from cookies"),i}const o=this.temporaryCacheStorage.getItem(n);if(!o){if(this.cacheConfig.cacheLocation===U.LocalStorage){const i=this.browserStorage.getItem(n);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item found in local storage"),i}return this.logger.trace("BrowserCacheManager.getTemporaryCache: No cache item found in local storage"),null}return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item returned"),o}setTemporaryCache(e,t,n){const o=n?this.generateCacheKey(e):e;this.temporaryCacheStorage.setItem(o,t),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.setTemporaryCache: storeAuthStateInCookie set to true, setting item cookie"),this.cookieStorage.setItem(o,t,void 0,this.cacheConfig.secureCookies))}removeItem(e){this.browserStorage.removeItem(e)}removeTemporaryItem(e){this.temporaryCacheStorage.removeItem(e),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie"),this.cookieStorage.removeItem(e))}getKeys(){return this.browserStorage.getKeys()}clear(e){this.removeAllAccounts(e),this.removeAppMetadata(),this.temporaryCacheStorage.getKeys().forEach(t=>{(t.indexOf(u.CACHE_PREFIX)!==-1||t.indexOf(this.clientId)!==-1)&&this.removeTemporaryItem(t)}),this.browserStorage.getKeys().forEach(t=>{(t.indexOf(u.CACHE_PREFIX)!==-1||t.indexOf(this.clientId)!==-1)&&this.browserStorage.removeItem(t)}),this.internalStorage.clear()}clearTokensAndKeysWithClaims(e){this.performanceClient.addQueueMeasurement(h.ClearTokensAndKeysWithClaims,e);const t=this.getTokenKeys();let n=0;t.accessToken.forEach(o=>{const i=this.getAccessTokenCredential(o);i!=null&&i.requestedClaimsHash&&o.includes(i.requestedClaimsHash.toLowerCase())&&(this.removeAccessToken(o,e),n++)}),n>0&&this.logger.warning(`${n} access tokens with claims in the cache keys have been removed from the cache.`)}generateCacheKey(e){return this.validateAndParseJson(e)?JSON.stringify(e):ie.startsWith(e,u.CACHE_PREFIX)?e:`${u.CACHE_PREFIX}.${this.clientId}.${e}`}resetRequestCache(){this.logger.trace("BrowserCacheManager.resetRequestCache called"),this.removeTemporaryItem(this.generateCacheKey(P.REQUEST_PARAMS)),this.removeTemporaryItem(this.generateCacheKey(P.VERIFIER)),this.removeTemporaryItem(this.generateCacheKey(P.ORIGIN_URI)),this.removeTemporaryItem(this.generateCacheKey(P.URL_HASH)),this.removeTemporaryItem(this.generateCacheKey(P.NATIVE_REQUEST)),this.setInteractionInProgress(!1)}cacheAuthorizeRequest(e,t){this.logger.trace("BrowserCacheManager.cacheAuthorizeRequest called");const n=Qe(JSON.stringify(e));if(this.setTemporaryCache(P.REQUEST_PARAMS,n,!0),t){const o=Qe(t);this.setTemporaryCache(P.VERIFIER,o,!0)}}getCachedRequest(){this.logger.trace("BrowserCacheManager.getCachedRequest called");const e=this.getTemporaryCache(P.REQUEST_PARAMS,!0);if(!e)throw C(wi);const t=this.getTemporaryCache(P.VERIFIER,!0);let n,o="";try{n=JSON.parse(X(e)),t&&(o=X(t))}catch(i){throw this.logger.errorPii(`Attempted to parse: ${e}`),this.logger.error(`Parsing cached token request threw with error: ${i}`),C(Si)}return[n,o]}getCachedNativeRequest(){this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");const e=this.getTemporaryCache(P.NATIVE_REQUEST,!0);if(!e)return this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found"),null;const t=this.validateAndParseJson(e);return t||(this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request"),null)}isInteractionInProgress(e){var n;const t=(n=this.getInteractionInProgress())==null?void 0:n.clientId;return e?t===this.clientId:!!t}getInteractionInProgress(){const e=`${u.CACHE_PREFIX}.${P.INTERACTION_STATUS_KEY}`,t=this.getTemporaryCache(e,!1);try{return t?JSON.parse(t):null}catch{return this.logger.error("Cannot parse interaction status. Removing temporary cache items and clearing url hash. Retrying interaction should fix the error"),this.removeTemporaryItem(e),this.resetRequestCache(),Yi(window),null}}setInteractionInProgress(e,t=de.SIGNIN){var o;const n=`${u.CACHE_PREFIX}.${P.INTERACTION_STATUS_KEY}`;if(e){if(this.getInteractionInProgress())throw C(mi);this.setTemporaryCache(n,JSON.stringify({clientId:this.clientId,type:t}),!1)}else!e&&((o=this.getInteractionInProgress())==null?void 0:o.clientId)===this.clientId&&this.removeTemporaryItem(n)}async hydrateCache(e,t){var s,c,l;const n=kt((s=e.account)==null?void 0:s.homeAccountId,(c=e.account)==null?void 0:c.environment,e.idToken,this.clientId,e.tenantId);let o;t.claims&&(o=await this.cryptoImpl.hashString(t.claims));const i=Rt((l=e.account)==null?void 0:l.homeAccountId,e.account.environment,e.accessToken,this.clientId,e.tenantId,e.scopes.join(" "),e.expiresOn?vo(e.expiresOn):0,e.extExpiresOn?vo(e.extExpiresOn):0,X,void 0,e.tokenType,void 0,t.sshKid,t.claims,o),a={idToken:n,accessToken:i};return this.saveCacheRecord(a,e.correlationId)}async saveCacheRecord(e,t,n){try{await super.saveCacheRecord(e,t,n)}catch(o){if(o instanceof Oe&&this.performanceClient&&t)try{const i=this.getTokenKeys();this.performanceClient.addFields({cacheRtCount:i.refreshToken.length,cacheIdCount:i.idToken.length,cacheAtCount:i.accessToken.length},t)}catch{}throw o}}}function Yo(r,e,t,n){try{switch(e){case U.LocalStorage:return new fl(r,t,n);case U.SessionStorage:return new ml;case U.MemoryStorage:default:break}}catch(o){t.error(o)}return new Gt}const pl=(r,e,t,n)=>{const o={cacheLocation:U.MemoryStorage,temporaryCacheLocation:U.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};return new gn(r,o,dt,e,t,n)};/*! @azure/msal-browser v4.13.2 2025-06-18 */function Cl(r,e,t,n){return r.verbose("getAllAccounts called"),t?e.getAllAccounts(n):[]}function yl(r,e,t){if(e.trace("getAccount called"),Object.keys(r).length===0)return e.warning("getAccount: No accountFilter provided"),null;const n=t.getAccountInfoFilteredBy(r);return n?(e.verbose("getAccount: Account matching provided filter found, returning"),n):(e.verbose("getAccount: No matching account found, returning null"),null)}function Tl(r,e,t){if(e.trace("getAccountByUsername called"),!r)return e.warning("getAccountByUsername: No username provided"),null;const n=t.getAccountInfoFilteredBy({username:r});return n?(e.verbose("getAccountByUsername: Account matching username found, returning"),e.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${r}`),n):(e.verbose("getAccountByUsername: No matching account found, returning null"),null)}function Al(r,e,t){if(e.trace("getAccountByHomeId called"),!r)return e.warning("getAccountByHomeId: No homeAccountId provided"),null;const n=t.getAccountInfoFilteredBy({homeAccountId:r});return n?(e.verbose("getAccountByHomeId: Account matching homeAccountId found, returning"),e.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${r}`),n):(e.verbose("getAccountByHomeId: No matching account found, returning null"),null)}function Il(r,e,t){if(e.trace("getAccountByLocalId called"),!r)return e.warning("getAccountByLocalId: No localAccountId provided"),null;const n=t.getAccountInfoFilteredBy({localAccountId:r});return n?(e.verbose("getAccountByLocalId: Account matching localAccountId found, returning"),e.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${r}`),n):(e.verbose("getAccountByLocalId: No matching account found, returning null"),null)}function El(r,e){e.setActiveAccount(r)}function wl(r){return r.getActiveAccount()}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Sl="msal.broadcast.event";class _l{constructor(e){this.eventCallbacks=new Map,this.logger=e||new pe({}),typeof BroadcastChannel<"u"&&(this.broadcastChannel=new BroadcastChannel(Sl)),this.invokeCrossTabCallbacks=this.invokeCrossTabCallbacks.bind(this)}addEventCallback(e,t,n){if(typeof window<"u"){const o=n||ol();return this.eventCallbacks.has(o)?(this.logger.error(`Event callback with id: ${o} is already registered. Please provide a unique id or remove the existing callback and try again.`),null):(this.eventCallbacks.set(o,[e,t||[]]),this.logger.verbose(`Event callback registered with id: ${o}`),o)}return null}removeEventCallback(e){this.eventCallbacks.delete(e),this.logger.verbose(`Event callback ${e} removed.`)}emitEvent(e,t,n,o){var a;const i={eventType:e,interactionType:t||null,payload:n||null,error:o||null,timestamp:Date.now()};switch(e){case T.ACCOUNT_ADDED:case T.ACCOUNT_REMOVED:case T.ACTIVE_ACCOUNT_CHANGED:(a=this.broadcastChannel)==null||a.postMessage(i);break;default:this.invokeCallbacks(i);break}}invokeCallbacks(e){this.eventCallbacks.forEach(([t,n],o)=>{(n.length===0||n.includes(e.eventType))&&(this.logger.verbose(`Emitting event to callback ${o}: ${e.eventType}`),t.apply(null,[e]))})}invokeCrossTabCallbacks(e){const t=e.data;this.invokeCallbacks(t)}subscribeCrossTab(){var e;(e=this.broadcastChannel)==null||e.addEventListener("message",this.invokeCrossTabCallbacks)}unsubscribeCrossTab(){var e;(e=this.broadcastChannel)==null||e.removeEventListener("message",this.invokeCrossTabCallbacks)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class ea{constructor(e,t,n,o,i,a,s,c,l){this.config=e,this.browserStorage=t,this.browserCrypto=n,this.networkClient=this.config.system.networkClient,this.eventHandler=i,this.navigationClient=a,this.platformAuthProvider=c,this.correlationId=l||ee(),this.logger=o.clone(z.MSAL_SKU,Ee,this.correlationId),this.performanceClient=s}async clearCacheOnLogout(e){if(e){B.accountInfoIsEqual(e,this.browserStorage.getActiveAccount(),!1)&&(this.logger.verbose("Setting active account to null"),this.browserStorage.setActiveAccount(null));try{this.browserStorage.removeAccount(B.generateAccountCacheKey(e),this.correlationId),this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.")}catch{this.logger.error("Account provided in logout request was not found. Local cache unchanged.")}}else try{this.logger.verbose("No account provided in logout request, clearing all cache items.",this.correlationId),this.browserStorage.clear(this.correlationId),await this.browserCrypto.clearKeystore()}catch{this.logger.error("Attempted to clear all MSAL cache items and failed. Local cache unchanged.")}}getRedirectUri(e){this.logger.verbose("getRedirectUri called");const t=e||this.config.auth.redirectUri;return _.getAbsoluteUrl(t,ce())}initializeServerTelemetryManager(e,t){this.logger.verbose("initializeServerTelemetryManager called");const n={clientId:this.config.auth.clientId,correlationId:this.correlationId,apiId:e,forceRefresh:t||!1,wrapperSKU:this.browserStorage.getWrapperMetadata()[0],wrapperVer:this.browserStorage.getWrapperMetadata()[1]};return new qe(n,this.browserStorage)}async getDiscoveredAuthority(e){const{account:t}=e,n=e.requestExtraQueryParameters&&e.requestExtraQueryParameters.hasOwnProperty("instance_aware")?e.requestExtraQueryParameters.instance_aware:void 0;this.performanceClient.addQueueMeasurement(h.StandardInteractionClientGetDiscoveredAuthority,this.correlationId);const o={protocolMode:this.config.auth.protocolMode,OIDCOptions:this.config.auth.OIDCOptions,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},i=e.requestAuthority||this.config.auth.authority,a=n!=null&&n.length?n==="true":this.config.auth.instanceAware,s=t&&a?this.config.auth.authority.replace(_.getDomainFromUrl(i),t.environment):i,c=H.generateAuthority(s,e.requestAzureCloudOptions||this.config.auth.azureCloudOptions),l=await f(ei,h.AuthorityFactoryCreateDiscoveredInstance,this.logger,this.performanceClient,this.correlationId)(c,this.config.system.networkClient,this.browserStorage,o,this.logger,this.correlationId,this.performanceClient);if(t&&!l.isAlias(t.environment))throw k(Pr);return l}}/*! @azure/msal-browser v4.13.2 2025-06-18 */async function lo(r,e,t,n){t.addQueueMeasurement(h.InitializeBaseRequest,r.correlationId);const o=r.authority||e.auth.authority,i=[...r&&r.scopes||[]],a={...r,correlationId:r.correlationId,authority:o,scopes:i};if(!a.authenticationScheme)a.authenticationScheme=v.BEARER,n.verbose(`Authentication Scheme wasn't explicitly set in request, defaulting to "Bearer" request`);else{if(a.authenticationScheme===v.SSH){if(!r.sshJwk)throw k(Pt);if(!r.sshKid)throw k(Rr)}n.verbose(`Authentication Scheme set to "${a.authenticationScheme}" as configured in Auth request`)}return e.cache.claimsBasedCachingEnabled&&r.claims&&!ie.isEmptyObj(r.claims)&&(a.requestedClaimsHash=await Vi(r.claims)),a}async function vl(r,e,t,n,o){n.addQueueMeasurement(h.InitializeSilentRequest,r.correlationId);const i=await f(lo,h.InitializeBaseRequest,o,n,r.correlationId)(r,t,n,o);return{...r,...i,account:e,forceRefresh:r.forceRefresh||!1}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class Le extends ea{initializeLogoutRequest(e){this.logger.verbose("initializeLogoutRequest called",e==null?void 0:e.correlationId);const t={correlationId:this.correlationId||ee(),...e};if(e)if(e.logoutHint)this.logger.verbose("logoutHint has already been set in logoutRequest");else if(e.account){const n=this.getLogoutHintFromIdTokenClaims(e.account);n&&(this.logger.verbose("Setting logoutHint to login_hint ID Token Claim value for the account provided"),t.logoutHint=n)}else this.logger.verbose("logoutHint was not set and account was not passed into logout request, logoutHint will not be set");else this.logger.verbose("logoutHint will not be set since no logout request was configured");return!e||e.postLogoutRedirectUri!==null?e&&e.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to uri set on logout request",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(e.postLogoutRedirectUri,ce())):this.config.auth.postLogoutRedirectUri===null?this.logger.verbose("postLogoutRedirectUri configured as null and no uri set on request, not passing post logout redirect",t.correlationId):this.config.auth.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to configured uri",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri,ce())):(this.logger.verbose("Setting postLogoutRedirectUri to current page",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(ce(),ce())):this.logger.verbose("postLogoutRedirectUri passed as null, not setting post logout redirect uri",t.correlationId),t}getLogoutHintFromIdTokenClaims(e){const t=e.idTokenClaims;if(t){if(t.login_hint)return t.login_hint;this.logger.verbose("The ID Token Claims tied to the provided account do not contain a login_hint claim, logoutHint will not be added to logout request")}else this.logger.verbose("The provided account does not contain ID Token Claims, logoutHint will not be added to logout request");return null}async createAuthCodeClient(e){this.performanceClient.addQueueMeasurement(h.StandardInteractionClientCreateAuthCodeClient,this.correlationId);const t=await f(this.getClientConfiguration.bind(this),h.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)(e);return new ri(t,this.performanceClient)}async getClientConfiguration(e){const{serverTelemetryManager:t,requestAuthority:n,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:a}=e;this.performanceClient.addQueueMeasurement(h.StandardInteractionClientGetClientConfiguration,this.correlationId);const s=await f(this.getDiscoveredAuthority.bind(this),h.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,this.correlationId)({requestAuthority:n,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:a}),c=this.config.system.loggerOptions;return{authOptions:{clientId:this.config.auth.clientId,authority:s,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:this.config.auth.redirectUri},systemOptions:{tokenRenewalOffsetSeconds:this.config.system.tokenRenewalOffsetSeconds,preventCorsPreflight:!0},loggerOptions:{loggerCallback:c.loggerCallback,piiLoggingEnabled:c.piiLoggingEnabled,logLevel:c.logLevel,correlationId:this.correlationId},cacheOptions:{claimsBasedCachingEnabled:this.config.cache.claimsBasedCachingEnabled},cryptoInterface:this.browserCrypto,networkInterface:this.networkClient,storageInterface:this.browserStorage,serverTelemetryManager:t,libraryInfo:{sku:z.MSAL_SKU,version:Ee,cpu:u.EMPTY_STRING,os:u.EMPTY_STRING},telemetry:this.config.telemetry}}async initializeAuthorizationRequest(e,t){this.performanceClient.addQueueMeasurement(h.StandardInteractionClientInitializeAuthorizationRequest,this.correlationId);const n=this.getRedirectUri(e.redirectUri),o={interactionType:t},i=Ue.setRequestState(this.browserCrypto,e&&e.state||u.EMPTY_STRING,o),s={...await f(lo,h.InitializeBaseRequest,this.logger,this.performanceClient,this.correlationId)({...e,correlationId:this.correlationId},this.config,this.performanceClient,this.logger),redirectUri:n,state:i,nonce:e.nonce||ee(),responseMode:this.config.auth.OIDCOptions.serverResponseType};if(e.loginHint||e.sid)return s;const c=e.account||this.browserStorage.getActiveAccount();return c&&(this.logger.verbose("Setting validated request account",this.correlationId),this.logger.verbosePii(`Setting validated request account: ${c.homeAccountId}`,this.correlationId),s.account=c),s}}/*! @azure/msal-browser v4.13.2 2025-06-18 */function kl(r,e){if(!e)return null;try{return Ue.parseRequestState(r,e).libraryState.meta}catch{throw m(Pe)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */function wt(r,e,t){const n=gt(r);if(!n)throw Mr(r)?(t.error(`A ${e} is present in the iframe but it does not contain known properties. It's likely that the ${e} has been replaced by code running on the redirectUri page.`),t.errorPii(`The ${e} detected is: ${r}`),C(ui)):(t.error(`The request has returned to the redirectUri but a ${e} is not present. It's likely that the ${e} has been removed or the page has been redirected by code running on the redirectUri page.`),C(di));return n}function Rl(r,e,t){if(!r.state)throw C(Yn);const n=kl(e,r.state);if(!n)throw C(gi);if(n.interactionType!==t)throw C(fi)}/*! @azure/msal-browser v4.13.2 2025-06-18 */class ta{constructor(e,t,n,o,i){this.authModule=e,this.browserStorage=t,this.authCodeRequest=n,this.logger=o,this.performanceClient=i}async handleCodeResponse(e,t){this.performanceClient.addQueueMeasurement(h.HandleCodeResponse,t.correlationId);let n;try{n=yc(e,t.state)}catch(o){throw o instanceof Se&&o.subError===Ve?C(Ve):o}return f(this.handleCodeResponseFromServer.bind(this),h.HandleCodeResponseFromServer,this.logger,this.performanceClient,t.correlationId)(n,t)}async handleCodeResponseFromServer(e,t,n=!0){if(this.performanceClient.addQueueMeasurement(h.HandleCodeResponseFromServer,t.correlationId),this.logger.trace("InteractionHandler.handleCodeResponseFromServer called"),this.authCodeRequest.code=e.code,e.cloud_instance_host_name&&await f(this.authModule.updateAuthority.bind(this.authModule),h.UpdateTokenEndpointAuthority,this.logger,this.performanceClient,t.correlationId)(e.cloud_instance_host_name,t.correlationId),n&&(e.nonce=t.nonce||void 0),e.state=t.state,e.client_info)this.authCodeRequest.clientInfo=e.client_info;else{const i=this.createCcsCredentials(t);i&&(this.authCodeRequest.ccsCredential=i)}return await f(this.authModule.acquireToken.bind(this.authModule),h.AuthClientAcquireToken,this.logger,this.performanceClient,t.correlationId)(this.authCodeRequest,e)}createCcsCredentials(e){return e.account?{credential:e.account.homeAccountId,type:J.HOME_ACCOUNT_ID}:e.loginHint?{credential:e.loginHint,type:J.UPN}:null}}/*! @azure/msal-browser v4.13.2 2025-06-18 */const bl="ContentError",na="user_switch";/*! @azure/msal-browser v4.13.2 2025-06-18 */const Ol="USER_INTERACTION_REQUIRED",Pl="USER_CANCEL",Nl="NO_NETWORK",Ml="PERSISTENT_ERROR",Ul="DISABLED",Dl="ACCOUNT_UNAVAILABLE",Ll="UX_NOT_ALLOWED";/*! @azure/msal-browser v4.13.2 2025-06-18 */const Hl=-2147186943,xl={[na]:"User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."};class re extends b{constructor(e,t,n){super(e,t),Object.setPrototypeOf(this,re.prototype),this.name="NativeAuthError",this.ext=n}}function ke(r){if(r.ext&&r.ext.status&&(r.ext.status===Ml||r.ext.status===Ul)||r.ext&&r.ext.error&&r.ext.error===Hl)return!0;switch(r.errorCode){case bl:return!0;default:return!1}}function St(r,e,t){if(t&&t.status)switch(t.status){case Dl:return Tt(ti);case Ol:return new Z(r,e);case Pl:return C(Ve);case Nl:return C(At);case Ll:return Tt(Gn)}return new re(r,xl[r]||e,t)}/*! @azure/msal-browser v4.13.2 2025-06-18 */class oa extends Le{async acquireToken(e){this.performanceClient.addQueueMeasurement(h.SilentCacheClientAcquireToken,e.correlationId);const t=this.initializeServerTelemetryManager(R.acquireTokenSilent_silentFlow),n=await f(this.getClientConfiguration.bind(this),h.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:t,requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,account:e.account}),o=new mc(n,this.performanceClient);this.logger.verbose("Silent auth client created");try{const a=(await f(o.acquireCachedToken.bind(o),h.SilentFlowClientAcquireCachedToken,this.logger,this.performanceClient,e.correlationId)(e))[0];return this.performanceClient.addFields({fromCache:!0},e.correlationId),a}catch(i){throw i instanceof We&&i.errorCode===jn&&this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."),i}}logout(e){this.logger.verbose("logoutRedirect called");const t=this.initializeLogoutRequest(e);return this.clearCacheOnLogout(t==null?void 0:t.account)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class ct extends ea{constructor(e,t,n,o,i,a,s,c,l,d,g,p){super(e,t,n,o,i,a,c,l,p),this.apiId=s,this.accountId=d,this.platformAuthProvider=l,this.nativeStorageManager=g,this.silentCacheClient=new oa(e,this.nativeStorageManager,n,o,i,a,c,l,p);const y=this.platformAuthProvider.getExtensionName();this.skus=qe.makeExtraSkuString({libraryName:z.MSAL_SKU,libraryVersion:Ee,extensionName:y,extensionVersion:this.platformAuthProvider.getExtensionVersion()})}addRequestSKUs(e){e.extraParameters={...e.extraParameters,[Hs]:this.skus}}async acquireToken(e,t){this.performanceClient.addQueueMeasurement(h.NativeInteractionClientAcquireToken,e.correlationId),this.logger.trace("NativeInteractionClient - acquireToken called.");const n=this.performanceClient.startMeasurement(h.NativeInteractionClientAcquireToken,e.correlationId),o=V(),i=this.initializeServerTelemetryManager(this.apiId);try{const a=await this.initializeNativeRequest(e);try{const c=await this.acquireTokensFromCache(this.accountId,a);return n.end({success:!0,isNativeBroker:!1,fromCache:!0}),c}catch(c){if(t===F.AccessToken)throw this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy"),c;this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call")}const s=await this.platformAuthProvider.sendMessage(a);return await this.handleNativeResponse(s,a,o).then(c=>(n.end({success:!0,isNativeBroker:!0,requestId:c.requestId}),i.clearNativeBrokerErrorCode(),c)).catch(c=>{throw n.end({success:!1,errorCode:c.errorCode,subErrorCode:c.subError,isNativeBroker:!0}),c})}catch(a){throw a instanceof re&&i.setNativeBrokerErrorCode(a.errorCode),a}}createSilentCacheRequest(e,t){return{authority:e.authority,correlationId:this.correlationId,scopes:N.fromString(e.scope).asArray(),account:t,forceRefresh:!1}}async acquireTokensFromCache(e,t){if(!e)throw this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided"),m(Zt);const n=this.browserStorage.getBaseAccountInfo({nativeAccountId:e});if(!n)throw m(Zt);try{const o=this.createSilentCacheRequest(t,n),i=await this.silentCacheClient.acquireToken(o),a={...n,idTokenClaims:i==null?void 0:i.idTokenClaims,idToken:i==null?void 0:i.idToken};return{...i,account:a}}catch(o){throw o}}async acquireTokenRedirect(e,t){this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");const{...n}=e;delete n.onRedirectNavigate;const o=await this.initializeNativeRequest(n);try{await this.platformAuthProvider.sendMessage(o)}catch(s){if(s instanceof re&&(this.initializeServerTelemetryManager(this.apiId).setNativeBrokerErrorCode(s.errorCode),ke(s)))throw s}this.browserStorage.setTemporaryCache(P.NATIVE_REQUEST,JSON.stringify(o),!0);const i={apiId:R.acquireTokenRedirect,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},a=this.config.auth.navigateToLoginRequestUrl?window.location.href:this.getRedirectUri(e.redirectUri);t.end({success:!0}),await this.navigationClient.navigateExternal(a,i)}async handleRedirectPromise(e,t){if(this.logger.trace("NativeInteractionClient - handleRedirectPromise called."),!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;const n=this.browserStorage.getCachedNativeRequest();if(!n)return this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null."),e&&t&&(e==null||e.addFields({errorCode:"no_cached_request"},t)),null;const{prompt:o,...i}=n;o&&this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window."),this.browserStorage.removeItem(this.browserStorage.generateCacheKey(P.NATIVE_REQUEST));const a=V();try{this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");const s=await this.platformAuthProvider.sendMessage(i),c=await this.handleNativeResponse(s,i,a);return this.initializeServerTelemetryManager(this.apiId).clearNativeBrokerErrorCode(),c}catch(s){throw s}}logout(){return this.logger.trace("NativeInteractionClient - logout called."),Promise.reject("Logout not implemented yet")}async handleNativeResponse(e,t,n){var d,g;this.logger.trace("NativeInteractionClient - handleNativeResponse called.");const o=Me(e.id_token,X),i=this.createHomeAccountIdentifier(e,o),a=(d=this.browserStorage.getAccountInfoFilteredBy({nativeAccountId:t.accountId}))==null?void 0:d.homeAccountId;if((g=t.extraParameters)!=null&&g.child_client_id&&e.account.id!==t.accountId)this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");else if(i!==a&&e.account.id!==t.accountId)throw St(na);const s=await this.getDiscoveredAuthority({requestAuthority:t.authority}),c=zn(this.browserStorage,s,i,X,o,e.client_info,void 0,o.tid,void 0,e.account.id,this.logger);e.expires_in=Number(e.expires_in);const l=await this.generateAuthenticationResult(e,t,o,c,s.canonicalAuthority,n);return await this.cacheAccount(c),await this.cacheNativeTokens(e,t,i,o,e.access_token,l.tenantId,n),l}createHomeAccountIdentifier(e,t){return B.generateHomeAccountId(e.client_info||u.EMPTY_STRING,W.Default,this.logger,this.browserCrypto,t)}generateScopes(e,t){return t?N.fromString(t):N.fromString(e)}async generatePopAccessToken(e,t){if(t.tokenType===v.POP&&t.signPopToken){if(e.shr)return this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer"),e.shr;const n=new Ne(this.browserCrypto),o={resourceRequestMethod:t.resourceRequestMethod,resourceRequestUri:t.resourceRequestUri,shrClaims:t.shrClaims,shrNonce:t.shrNonce};if(!t.keyId)throw m(An);return n.signPopToken(e.access_token,t.keyId,o)}else return e.access_token}async generateAuthenticationResult(e,t,n,o,i,a){const s=this.addTelemetryFromNativeResponse(e.properties.MATS),c=this.generateScopes(t.scope,e.scope),l=e.account.properties||{},d=l.UID||n.oid||n.sub||u.EMPTY_STRING,g=l.TenantId||n.tid||u.EMPTY_STRING,p=Rn(o.getAccountInfo(),void 0,n,e.id_token);p.nativeAccountId!==e.account.id&&(p.nativeAccountId=e.account.id);const y=await this.generatePopAccessToken(e,t),w=t.tokenType===v.POP?v.POP:v.BEARER;return{authority:i,uniqueId:d,tenantId:g,scopes:c.asArray(),account:p,idToken:e.id_token,idTokenClaims:n,accessToken:y,fromCache:s?this.isResponseFromCache(s):!1,expiresOn:Re(a+e.expires_in),tokenType:w,correlationId:this.correlationId,state:e.state,fromNativeBroker:!0}}async cacheAccount(e){await this.browserStorage.setAccount(e,this.correlationId),this.browserStorage.removeAccountContext(e,this.correlationId)}cacheNativeTokens(e,t,n,o,i,a,s){const c=kt(n,t.authority,e.id_token||"",t.clientId,o.tid||""),l=t.tokenType===v.POP?u.SHR_NONCE_VALIDITY:(typeof e.expires_in=="string"?parseInt(e.expires_in,10):e.expires_in)||0,d=s+l,g=this.generateScopes(e.scope,t.scope),p=Rt(n,t.authority,i,t.clientId,o.tid||a,g.printScopes(),d,0,X,void 0,t.tokenType,void 0,t.keyId),y={idToken:c,accessToken:p};return this.nativeStorageManager.saveCacheRecord(y,this.correlationId,t.storeInCache)}getExpiresInValue(e,t){return e===v.POP?u.SHR_NONCE_VALIDITY:(typeof t=="string"?parseInt(t,10):t)||0}addTelemetryFromNativeResponse(e){const t=this.getMATSFromResponse(e);return t?(this.performanceClient.addFields({extensionId:this.platformAuthProvider.getExtensionId(),extensionVersion:this.platformAuthProvider.getExtensionVersion(),matsBrokerVersion:t.broker_version,matsAccountJoinOnStart:t.account_join_on_start,matsAccountJoinOnEnd:t.account_join_on_end,matsDeviceJoin:t.device_join,matsPromptBehavior:t.prompt_behavior,matsApiErrorCode:t.api_error_code,matsUiVisible:t.ui_visible,matsSilentCode:t.silent_code,matsSilentBiSubCode:t.silent_bi_sub_code,matsSilentMessage:t.silent_message,matsSilentStatus:t.silent_status,matsHttpStatus:t.http_status,matsHttpEventCount:t.http_event_count},this.correlationId),t):null}getMATSFromResponse(e){if(e)try{return JSON.parse(e)}catch{this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead")}return null}isResponseFromCache(e){return typeof e.is_cached>"u"?(this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false."),!1):!!e.is_cached}async initializeNativeRequest(e){this.logger.trace("NativeInteractionClient - initializeNativeRequest called");const t=await this.getCanonicalAuthority(e),{scopes:n,...o}=e,i=new N(n||[]);i.appendScopes(je);const a={...o,accountId:this.accountId,clientId:this.config.auth.clientId,authority:t.urlString,scope:i.printScopes(),redirectUri:this.getRedirectUri(e.redirectUri),prompt:this.getPrompt(e.prompt),correlationId:this.correlationId,tokenType:e.authenticationScheme,windowTitleSubstring:document.title,extraParameters:{...e.extraQueryParameters,...e.tokenQueryParameters},extendedExpiryToken:!1,keyId:e.popKid};if(a.signPopToken&&e.popKid)throw C(Li);if(this.handleExtraBrokerParams(a),a.extraParameters=a.extraParameters||{},a.extraParameters.telemetry=Y.MATS_TELEMETRY,e.authenticationScheme===v.POP){const s={resourceRequestUri:e.resourceRequestUri,resourceRequestMethod:e.resourceRequestMethod,shrClaims:e.shrClaims,shrNonce:e.shrNonce},c=new Ne(this.browserCrypto);let l;if(a.keyId)l=this.browserCrypto.base64UrlEncode(JSON.stringify({kid:a.keyId})),a.signPopToken=!1;else{const d=await f(c.generateCnf.bind(c),h.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(s,this.logger);l=d.reqCnfString,a.keyId=d.kid,a.signPopToken=!0}a.reqCnf=l}return this.addRequestSKUs(a),a}async getCanonicalAuthority(e){const t=e.authority||this.config.auth.authority;e.account&&await this.getDiscoveredAuthority({requestAuthority:t,requestAzureCloudOptions:e.azureCloudOptions,account:e.account});const n=new _(t);return n.validateAsUri(),n}getPrompt(e){switch(this.apiId){case R.ssoSilent:case R.acquireTokenSilent_silentFlow:return this.logger.trace("initializeNativeRequest: silent request sets prompt to none"),L.NONE}if(!e){this.logger.trace("initializeNativeRequest: prompt was not provided");return}switch(e){case L.NONE:case L.CONSENT:case L.LOGIN:return this.logger.trace("initializeNativeRequest: prompt is compatible with native flow"),e;default:throw this.logger.trace(`initializeNativeRequest: prompt = ${e} is not compatible with native flow`),C(Ui)}}handleExtraBrokerParams(e){var i;const t=e.extraParameters&&e.extraParameters.hasOwnProperty(mt)&&e.extraParameters.hasOwnProperty(pt)&&e.extraParameters.hasOwnProperty(Ae);if(!e.embeddedClientId&&!t)return;let n="";const o=e.redirectUri;e.embeddedClientId?(e.redirectUri=this.config.auth.redirectUri,n=e.embeddedClientId):e.extraParameters&&(e.redirectUri=e.extraParameters[pt],n=e.extraParameters[Ae]),e.extraParameters={child_client_id:n,child_redirect_uri:o},(i=this.performanceClient)==null||i.addFields({embeddedClientId:n,embeddedRedirectUri:o},e.correlationId)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */async function ra(r,e,t,n,o){const i=Cc({...r.auth,authority:e},t,n,o);if(Ln(i,{sku:z.MSAL_SKU,version:Ee,os:"",cpu:""}),r.auth.protocolMode!==q.OIDC&&Hn(i,r.telemetry.application),t.platformBroker&&(Bs(i),t.authenticationScheme===v.POP)){const a=new le(n,o),s=new Ne(a);let c;t.popKid?c=a.encodeKid(t.popKid):c=(await f(s.generateCnf.bind(s),h.PopTokenGenerateCnf,n,o,t.correlationId)(t,n)).reqCnfString,Fn(i,c)}return Nt(i,t.correlationId,o),i}async function ho(r,e,t,n,o){if(!t.codeChallenge)throw k(Ot);const i=await f(ra,h.GetStandardParams,n,o,t.correlationId)(r,e,t,n,o);return zr(i,Wo.CODE),Qs(i,t.codeChallenge,u.S256_CODE_CHALLENGE_METHOD),Te(i,t.extraQueryParameters||{}),ii(e,i,r.auth.encodeExtraQueryParams,t.extraQueryParameters)}async function uo(r,e,t,n,o,i){if(!n.earJwk)throw C(Qn);const a=await ra(e,t,n,o,i);zr(a,Wo.IDTOKEN_TOKEN_REFRESHTOKEN),Zs(a,n.earJwk);const s=new Map;Te(s,n.extraQueryParameters||{});const c=ii(t,s,e.auth.encodeExtraQueryParams,n.extraQueryParameters);return Fl(r,c,a)}function Fl(r,e,t){const n=r.createElement("form");return n.method="post",n.action=e,t.forEach((o,i)=>{const a=r.createElement("input");a.hidden=!0,a.name=i,a.value=o,n.appendChild(a)}),r.body.appendChild(n),n}async function ia(r,e,t,n,o,i,a,s,c,l){if(s.verbose("Account id found, calling WAM for token"),!l)throw C(Jn);const d=new le(s,c),g=new ct(n,o,d,s,a,n.system.navigationClient,t,c,l,e,i,r.correlationId),{userRequestState:p}=Ue.parseRequestState(d,r.state);return f(g.acquireToken.bind(g),h.NativeInteractionClientAcquireToken,s,c,r.correlationId)({...r,state:p,prompt:void 0})}async function go(r,e,t,n,o,i,a,s,c,l,d,g){if(oe.removeThrottle(a,o.auth.clientId,r),e.accountId)return f(ia,h.HandleResponsePlatformBroker,l,d,r.correlationId)(r,e.accountId,n,o,a,s,c,l,d,g);const p={...r,code:e.code||"",codeVerifier:t},y=new ta(i,a,p,l,d);return await f(y.handleCodeResponse.bind(y),h.HandleCodeResponse,l,d,r.correlationId)(e,r)}async function fo(r,e,t,n,o,i,a,s,c,l,d){if(oe.removeThrottle(i,n.auth.clientId,r),ai(e,r.state),!e.ear_jwe)throw C(hi);if(!r.earJwk)throw C(Qn);const g=JSON.parse(await f(Yc,h.DecryptEarResponse,c,l,r.correlationId)(r.earJwk,e.ear_jwe));if(g.accountId)return f(ia,h.HandleResponsePlatformBroker,c,l,r.correlationId)(r,g.accountId,t,n,i,a,s,c,l,d);const p=new Ie(n.auth.clientId,i,new le(c,l),c,null,null,l);p.validateTokenResponse(g);const y={code:"",state:r.state,nonce:r.nonce,client_info:g.client_info,cloud_graph_host_name:g.cloud_graph_host_name,cloud_instance_host_name:g.cloud_instance_host_name,cloud_instance_name:g.cloud_instance_name,msgraph_host:g.msgraph_host};return await f(p.handleServerTokenResponse.bind(p),h.HandleServerTokenResponse,c,l,r.correlationId)(g,o,V(),r,y,void 0,void 0,void 0,void 0)}/*! @azure/msal-browser v4.13.2 2025-06-18 */const Kl=32;async function zt(r,e,t){r.addQueueMeasurement(h.GeneratePkceCodes,t);const n=j(Bl,h.GenerateCodeVerifier,e,r,t)(r,e,t),o=await f(Gl,h.GenerateCodeChallengeFromVerifier,e,r,t)(n,r,e,t);return{verifier:n,challenge:o}}function Bl(r,e,t){try{const n=new Uint8Array(Kl);return j(zc,h.GetRandomValues,e,r,t)(n),Ce(n)}catch{throw C(Vn)}}async function Gl(r,e,t,n){e.addQueueMeasurement(h.GenerateCodeChallengeFromVerifier,n);try{const o=await f(zi,h.Sha256Digest,t,e,n)(r,e,n);return Ce(new Uint8Array(o))}catch{throw C(Vn)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class _t{constructor(e,t,n,o){this.logger=e,this.handshakeTimeoutMs=t,this.extensionId=o,this.resolvers=new Map,this.handshakeResolvers=new Map,this.messageChannel=new MessageChannel,this.windowListener=this.onWindowMessage.bind(this),this.performanceClient=n,this.handshakeEvent=n.startMeasurement(h.NativeMessageHandlerHandshake),this.platformAuthType=Y.PLATFORM_EXTENSION_PROVIDER}async sendMessage(e){this.logger.trace(this.platformAuthType+" - sendMessage called.");const t={method:He.GetToken,request:e},n={channel:Y.CHANNEL_ID,extensionId:this.extensionId,responseId:ee(),body:t};this.logger.trace(this.platformAuthType+" - Sending request to browser extension"),this.logger.tracePii(this.platformAuthType+` - Sending request to browser extension: ${JSON.stringify(n)}`),this.messageChannel.port1.postMessage(n);const o=await new Promise((a,s)=>{this.resolvers.set(n.responseId,{resolve:a,reject:s})});return this.validatePlatformBrokerResponse(o)}static async createProvider(e,t,n){e.trace("PlatformAuthExtensionHandler - createProvider called.");try{const o=new _t(e,t,n,Y.PREFERRED_EXTENSION_ID);return await o.sendHandshakeRequest(),o}catch{const i=new _t(e,t,n);return await i.sendHandshakeRequest(),i}}async sendHandshakeRequest(){this.logger.trace(this.platformAuthType+" - sendHandshakeRequest called."),window.addEventListener("message",this.windowListener,!1);const e={channel:Y.CHANNEL_ID,extensionId:this.extensionId,responseId:ee(),body:{method:He.HandshakeRequest}};return this.handshakeEvent.add({extensionId:this.extensionId,extensionHandshakeTimeoutMs:this.handshakeTimeoutMs}),this.messageChannel.port1.onmessage=t=>{this.onChannelMessage(t)},window.postMessage(e,window.origin,[this.messageChannel.port2]),new Promise((t,n)=>{this.handshakeResolvers.set(e.responseId,{resolve:t,reject:n}),this.timeoutId=window.setTimeout(()=>{window.removeEventListener("message",this.windowListener,!1),this.messageChannel.port1.close(),this.messageChannel.port2.close(),this.handshakeEvent.end({extensionHandshakeTimedOut:!0,success:!1}),n(C(Ni)),this.handshakeResolvers.delete(e.responseId)},this.handshakeTimeoutMs)})}onWindowMessage(e){if(this.logger.trace(this.platformAuthType+" - onWindowMessage called"),e.source!==window)return;const t=e.data;if(!(!t.channel||t.channel!==Y.CHANNEL_ID)&&!(t.extensionId&&t.extensionId!==this.extensionId)&&t.body.method===He.HandshakeRequest){const n=this.handshakeResolvers.get(t.responseId);if(!n){this.logger.trace(this.platformAuthType+`.onWindowMessage - resolver can't be found for request ${t.responseId}`);return}this.logger.verbose(t.extensionId?`Extension with id: ${t.extensionId} not installed`:"No extension installed"),clearTimeout(this.timeoutId),this.messageChannel.port1.close(),this.messageChannel.port2.close(),window.removeEventListener("message",this.windowListener,!1),this.handshakeEvent.end({success:!1,extensionInstalled:!1}),n.reject(C(Mi))}}onChannelMessage(e){this.logger.trace(this.platformAuthType+" - onChannelMessage called.");const t=e.data,n=this.resolvers.get(t.responseId),o=this.handshakeResolvers.get(t.responseId);try{const i=t.body.method;if(i===He.Response){if(!n)return;const a=t.body.response;if(this.logger.trace(this.platformAuthType+" - Received response from browser extension"),this.logger.tracePii(this.platformAuthType+` - Received response from browser extension: ${JSON.stringify(a)}`),a.status!=="Success")n.reject(St(a.code,a.description,a.ext));else if(a.result)a.result.code&&a.result.description?n.reject(St(a.result.code,a.result.description,a.result.ext)):n.resolve(a.result);else throw Wt(ht,"Event does not contain result.");this.resolvers.delete(t.responseId)}else if(i===He.HandshakeResponse){if(!o){this.logger.trace(this.platformAuthType+`.onChannelMessage - resolver can't be found for request ${t.responseId}`);return}clearTimeout(this.timeoutId),window.removeEventListener("message",this.windowListener,!1),this.extensionId=t.extensionId,this.extensionVersion=t.body.version,this.logger.verbose(this.platformAuthType+` - Received HandshakeResponse from extension: ${this.extensionId}`),this.handshakeEvent.end({extensionInstalled:!0,success:!0}),o.resolve(),this.handshakeResolvers.delete(t.responseId)}}catch(i){this.logger.error("Error parsing response from WAM Extension"),this.logger.errorPii(`Error parsing response from WAM Extension: ${i}`),this.logger.errorPii(`Unable to parse ${e}`),n?n.reject(i):o&&o.reject(i)}}validatePlatformBrokerResponse(e){if(e.hasOwnProperty("access_token")&&e.hasOwnProperty("id_token")&&e.hasOwnProperty("client_info")&&e.hasOwnProperty("account")&&e.hasOwnProperty("scope")&&e.hasOwnProperty("expires_in"))return e;throw Wt(ht,"Response missing expected properties.")}getExtensionId(){return this.extensionId}getExtensionVersion(){return this.extensionVersion}getExtensionName(){var e;return this.getExtensionId()===Y.PREFERRED_EXTENSION_ID?"chrome":(e=this.getExtensionId())!=null&&e.length?"unknown":void 0}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class mo{constructor(e,t,n){this.logger=e,this.performanceClient=t,this.correlationId=n,this.platformAuthType=Y.PLATFORM_DOM_PROVIDER}static async createProvider(e,t,n){var o;if(e.trace("PlatformAuthDOMHandler: createProvider called"),(o=window.navigator)!=null&&o.platformAuthentication){const i=await window.navigator.platformAuthentication.getSupportedContracts(Y.MICROSOFT_ENTRA_BROKERID);if(i!=null&&i.includes(Y.PLATFORM_DOM_APIS))return e.trace("Platform auth api available in DOM"),new mo(e,t,n)}}getExtensionId(){return Y.MICROSOFT_ENTRA_BROKERID}getExtensionVersion(){return""}getExtensionName(){return Y.DOM_API_NAME}async sendMessage(e){this.logger.trace(this.platformAuthType+" - Sending request to browser DOM API");try{const t=this.initializePlatformDOMRequest(e),n=await window.navigator.platformAuthentication.executeGetToken(t);return this.validatePlatformBrokerResponse(n)}catch(t){throw this.logger.error(this.platformAuthType+" - executeGetToken DOM API error"),t}}initializePlatformDOMRequest(e){this.logger.trace(this.platformAuthType+" - initializeNativeDOMRequest called");const{accountId:t,clientId:n,authority:o,scope:i,redirectUri:a,correlationId:s,state:c,storeInCache:l,embeddedClientId:d,extraParameters:g,...p}=e,y=this.getDOMExtraParams(p);return{accountId:t,brokerId:this.getExtensionId(),authority:o,clientId:n,correlationId:s||this.correlationId,extraParameters:{...g,...y},isSecurityTokenService:!1,redirectUri:a,scope:i,state:c,storeInCache:l,embeddedClientId:d}}validatePlatformBrokerResponse(e){if(e.hasOwnProperty("isSuccess")){if(e.hasOwnProperty("accessToken")&&e.hasOwnProperty("idToken")&&e.hasOwnProperty("clientInfo")&&e.hasOwnProperty("account")&&e.hasOwnProperty("scopes")&&e.hasOwnProperty("expiresIn"))return this.logger.trace(this.platformAuthType+" - platform broker returned successful and valid response"),this.convertToPlatformBrokerResponse(e);if(e.hasOwnProperty("error")){const t=e;if(t.isSuccess===!1&&t.error&&t.error.code)throw this.logger.trace(this.platformAuthType+" - platform broker returned error response"),St(t.error.code,t.error.description,{error:parseInt(t.error.errorCode),protocol_error:t.error.protocolError,status:t.error.status,properties:t.error.properties})}}throw Wt(ht,"Response missing expected properties.")}convertToPlatformBrokerResponse(e){return this.logger.trace(this.platformAuthType+" - convertToNativeResponse called"),{access_token:e.accessToken,id_token:e.idToken,client_info:e.clientInfo,account:e.account,expires_in:e.expiresIn,scope:e.scopes,state:e.state||"",properties:e.properties||{},extendedLifetimeToken:e.extendedLifetimeToken??!1,shr:e.proofOfPossessionPayload}}getDOMExtraParams(e){return{...Object.entries(e).reduce((o,[i,a])=>(o[i]=String(a),o),{})}}}/*! @azure/msal-browser v4.13.2 2025-06-18 */async function zl(r,e,t,n){r.trace("getPlatformAuthProvider called",t);const o=$l();r.trace("Has client allowed platform auth via DOM API: "+o);let i;try{o&&(i=await mo.createProvider(r,e,t)),i||(r.trace("Platform auth via DOM API not available, checking for extension"),i=await _t.createProvider(r,n||Xi,e))}catch(a){r.trace("Platform auth not available",a)}return i}function $l(){let r;try{return r=window[U.SessionStorage],(r==null?void 0:r.getItem(Lc))==="true"}catch{return!1}}function Ye(r,e,t,n){if(e.trace("isPlatformAuthAllowed called"),!r.system.allowPlatformBroker)return e.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false"),!1;if(!t)return e.trace("isPlatformAuthAllowed: Platform auth provider is not initialized, returning false"),!1;if(n)switch(n){case v.BEARER:case v.POP:return e.trace("isPlatformAuthAllowed: authenticationScheme is supported, returning true"),!0;default:return e.trace("isPlatformAuthAllowed: authenticationScheme is not supported, returning false"),!1}return!0}/*! @azure/msal-browser v4.13.2 2025-06-18 */class ql extends Le{constructor(e,t,n,o,i,a,s,c,l,d){super(e,t,n,o,i,a,s,l,d),this.unloadWindow=this.unloadWindow.bind(this),this.nativeStorage=c,this.eventHandler=i}acquireToken(e,t){try{const o={popupName:this.generatePopupName(e.scopes||je,e.authority||this.config.auth.authority),popupWindowAttributes:e.popupWindowAttributes||{},popupWindowParent:e.popupWindowParent??window};return this.performanceClient.addFields({isAsyncPopup:this.config.system.asyncPopups},this.correlationId),this.config.system.asyncPopups?(this.logger.verbose("asyncPopups set to true, acquiring token"),this.acquireTokenPopupAsync(e,o,t)):(this.logger.verbose("asyncPopup set to false, opening popup before acquiring token"),o.popup=this.openSizedPopup("about:blank",o),this.acquireTokenPopupAsync(e,o,t))}catch(n){return Promise.reject(n)}}logout(e){try{this.logger.verbose("logoutPopup called");const t=this.initializeLogoutRequest(e),n={popupName:this.generateLogoutPopupName(t),popupWindowAttributes:(e==null?void 0:e.popupWindowAttributes)||{},popupWindowParent:(e==null?void 0:e.popupWindowParent)??window},o=e&&e.authority,i=e&&e.mainWindowRedirectUri;return this.config.system.asyncPopups?(this.logger.verbose("asyncPopups set to true"),this.logoutPopupAsync(t,n,o,i)):(this.logger.verbose("asyncPopup set to false, opening popup"),n.popup=this.openSizedPopup("about:blank",n),this.logoutPopupAsync(t,n,o,i))}catch(t){return Promise.reject(t)}}async acquireTokenPopupAsync(e,t,n){this.logger.verbose("acquireTokenPopupAsync called");const o=await f(this.initializeAuthorizationRequest.bind(this),h.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,A.Popup);t.popup&&Ji(o.authority);const i=Ye(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme);return o.platformBroker=i,this.config.auth.protocolMode===q.EAR?this.executeEarFlow(o,t):this.executeCodeFlow(o,t,n)}async executeCodeFlow(e,t,n){var c;const o=e.correlationId,i=this.initializeServerTelemetryManager(R.acquireTokenPopup),a=n||await f(zt,h.GeneratePkceCodes,this.logger,this.performanceClient,o)(this.performanceClient,this.logger,o),s={...e,codeChallenge:a.challenge};try{const l=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,o)({serverTelemetryManager:i,requestAuthority:s.authority,requestAzureCloudOptions:s.azureCloudOptions,requestExtraQueryParameters:s.extraQueryParameters,account:s.account}),d=await f(ho,h.GetAuthCodeUrl,this.logger,this.performanceClient,o)(this.config,l.authority,s,this.logger,this.performanceClient),g=this.initiateAuthRequest(d,t);this.eventHandler.emitEvent(T.POPUP_OPENED,A.Popup,{popupWindow:g},null);const p=await this.monitorPopupForHash(g,t.popupWindowParent),y=j(wt,h.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(p,this.config.auth.OIDCOptions.serverResponseType,this.logger);return await f(go,h.HandleResponseCode,this.logger,this.performanceClient,o)(e,y,a.verifier,R.acquireTokenPopup,this.config,l,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}catch(l){throw(c=t.popup)==null||c.close(),l instanceof b&&(l.setCorrelationId(this.correlationId),i.cacheFailedRequest(l)),l}}async executeEarFlow(e,t){const n=e.correlationId,o=await f(this.getDiscoveredAuthority.bind(this),h.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,n)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),i=await f(no,h.GenerateEarKey,this.logger,this.performanceClient,n)(),a={...e,earJwk:i},s=t.popup||this.openPopup("about:blank",t);(await uo(s.document,this.config,o,a,this.logger,this.performanceClient)).submit();const l=await f(this.monitorPopupForHash.bind(this),h.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,n)(s,t.popupWindowParent),d=j(wt,h.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(l,this.config.auth.OIDCOptions.serverResponseType,this.logger);return f(fo,h.HandleResponseEar,this.logger,this.performanceClient,n)(a,d,R.acquireTokenPopup,this.config,o,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}async logoutPopupAsync(e,t,n,o){var a,s,c,l;this.logger.verbose("logoutPopupAsync called"),this.eventHandler.emitEvent(T.LOGOUT_START,A.Popup,e);const i=this.initializeServerTelemetryManager(R.logoutPopup);try{await this.clearCacheOnLogout(e.account);const d=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:i,requestAuthority:n,account:e.account||void 0});try{d.authority.endSessionEndpoint}catch{if((a=e.account)!=null&&a.homeAccountId&&e.postLogoutRedirectUri&&d.authority.protocolMode===q.OIDC){if(this.browserStorage.removeAccount((s=e.account)==null?void 0:s.homeAccountId,this.correlationId),this.eventHandler.emitEvent(T.LOGOUT_SUCCESS,A.Popup,e),o){const y={apiId:R.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},w=_.getAbsoluteUrl(o,ce());await this.navigationClient.navigateInternal(w,y)}(c=t.popup)==null||c.close();return}}const g=d.getLogoutUri(e);this.eventHandler.emitEvent(T.LOGOUT_SUCCESS,A.Popup,e);const p=this.openPopup(g,t);if(this.eventHandler.emitEvent(T.POPUP_OPENED,A.Popup,{popupWindow:p},null),await this.monitorPopupForHash(p,t.popupWindowParent).catch(()=>{}),o){const y={apiId:R.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},w=_.getAbsoluteUrl(o,ce());this.logger.verbose("Redirecting main window to url specified in the request"),this.logger.verbosePii(`Redirecting main window to: ${w}`),await this.navigationClient.navigateInternal(w,y)}else this.logger.verbose("No main window navigation requested")}catch(d){throw(l=t.popup)==null||l.close(),d instanceof b&&(d.setCorrelationId(this.correlationId),i.cacheFailedRequest(d)),this.eventHandler.emitEvent(T.LOGOUT_FAILURE,A.Popup,null,d),this.eventHandler.emitEvent(T.LOGOUT_END,A.Popup),d}this.eventHandler.emitEvent(T.LOGOUT_END,A.Popup)}initiateAuthRequest(e,t){if(e)return this.logger.infoPii(`Navigate to: ${e}`),this.openPopup(e,t);throw this.logger.error("Navigate url is empty"),C(xt)}monitorPopupForHash(e,t){return new Promise((n,o)=>{this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");const i=setInterval(()=>{if(e.closed){this.logger.error("PopupHandler.monitorPopupForHash - window closed"),clearInterval(i),o(C(Ve));return}let a="";try{a=e.location.href}catch{}if(!a||a==="about:blank")return;clearInterval(i);let s="";const c=this.config.auth.OIDCOptions.serverResponseType;e&&(c===vt.QUERY?s=e.location.search:s=e.location.hash),this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller"),n(s)},this.config.system.pollIntervalMilliseconds)}).finally(()=>{this.cleanPopup(e,t)})}openPopup(e,t){try{let n;if(t.popup?(n=t.popup,this.logger.verbosePii(`Navigating popup window to: ${e}`),n.location.assign(e)):typeof t.popup>"u"&&(this.logger.verbosePii(`Opening popup window to: ${e}`),n=this.openSizedPopup(e,t)),!n)throw C(Ci);return n.focus&&n.focus(),this.currentWindow=n,t.popupWindowParent.addEventListener("beforeunload",this.unloadWindow),n}catch(n){throw this.logger.error("error opening popup "+n.message),C(pi)}}openSizedPopup(e,{popupName:t,popupWindowAttributes:n,popupWindowParent:o}){var y,w,S,M;const i=o.screenLeft?o.screenLeft:o.screenX,a=o.screenTop?o.screenTop:o.screenY,s=o.innerWidth||document.documentElement.clientWidth||document.body.clientWidth,c=o.innerHeight||document.documentElement.clientHeight||document.body.clientHeight;let l=(y=n.popupSize)==null?void 0:y.width,d=(w=n.popupSize)==null?void 0:w.height,g=(S=n.popupPosition)==null?void 0:S.top,p=(M=n.popupPosition)==null?void 0:M.left;return(!l||l<0||l>s)&&(this.logger.verbose("Default popup window width used. Window width not configured or invalid."),l=z.POPUP_WIDTH),(!d||d<0||d>c)&&(this.logger.verbose("Default popup window height used. Window height not configured or invalid."),d=z.POPUP_HEIGHT),(!g||g<0||g>c)&&(this.logger.verbose("Default popup window top position used. Window top not configured or invalid."),g=Math.max(0,c/2-z.POPUP_HEIGHT/2+a)),(!p||p<0||p>s)&&(this.logger.verbose("Default popup window left position used. Window left not configured or invalid."),p=Math.max(0,s/2-z.POPUP_WIDTH/2+i)),o.open(e,t,`width=${l}, height=${d}, top=${g}, left=${p}, scrollbars=yes`)}unloadWindow(e){this.currentWindow&&this.currentWindow.close(),e.preventDefault()}cleanPopup(e,t){e.close(),t.removeEventListener("beforeunload",this.unloadWindow)}generatePopupName(e,t){return`${z.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${e.join("-")}.${t}.${this.correlationId}`}generateLogoutPopupName(e){const t=e.account&&e.account.homeAccountId;return`${z.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${t}.${this.correlationId}`}}/*! @azure/msal-browser v4.13.2 2025-06-18 */function Vl(){if(typeof window>"u"||typeof window.performance>"u"||typeof window.performance.getEntriesByType!="function")return;const r=window.performance.getEntriesByType("navigation"),e=r.length?r[0]:void 0;return e==null?void 0:e.type}class Ql extends Le{constructor(e,t,n,o,i,a,s,c,l,d){super(e,t,n,o,i,a,s,l,d),this.nativeStorage=c}async acquireToken(e){const t=await f(this.initializeAuthorizationRequest.bind(this),h.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,A.Redirect);t.platformBroker=Ye(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme);const n=i=>{i.persisted&&(this.logger.verbose("Page was restored from back/forward cache. Clearing temporary cache."),this.browserStorage.resetRequestCache(),this.eventHandler.emitEvent(T.RESTORE_FROM_BFCACHE,A.Redirect))},o=this.getRedirectStartPage(e.redirectStartPage);this.logger.verbosePii(`Redirect start page: ${o}`),this.browserStorage.setTemporaryCache(P.ORIGIN_URI,o,!0),window.addEventListener("pageshow",n);try{this.config.auth.protocolMode===q.EAR?await this.executeEarFlow(t):await this.executeCodeFlow(t,e.onRedirectNavigate)}catch(i){throw i instanceof b&&i.setCorrelationId(this.correlationId),window.removeEventListener("pageshow",n),i}}async executeCodeFlow(e,t){const n=e.correlationId,o=this.initializeServerTelemetryManager(R.acquireTokenRedirect),i=await f(zt,h.GeneratePkceCodes,this.logger,this.performanceClient,n)(this.performanceClient,this.logger,n),a={...e,codeChallenge:i.challenge};this.browserStorage.cacheAuthorizeRequest(a,i.verifier);try{const s=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:o,requestAuthority:a.authority,requestAzureCloudOptions:a.azureCloudOptions,requestExtraQueryParameters:a.extraQueryParameters,account:a.account}),c=await f(ho,h.GetAuthCodeUrl,this.logger,this.performanceClient,e.correlationId)(this.config,s.authority,a,this.logger,this.performanceClient);return await this.initiateAuthRequest(c,t)}catch(s){throw s instanceof b&&(s.setCorrelationId(this.correlationId),o.cacheFailedRequest(s)),s}}async executeEarFlow(e){const t=e.correlationId,n=await f(this.getDiscoveredAuthority.bind(this),h.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),o=await f(no,h.GenerateEarKey,this.logger,this.performanceClient,t)(),i={...e,earJwk:o};this.browserStorage.cacheAuthorizeRequest(i),(await uo(document,this.config,n,i,this.logger,this.performanceClient)).submit()}async handleRedirectPromise(e="",t,n,o){const i=this.initializeServerTelemetryManager(R.handleRedirectPromise);try{const[a,s]=this.getRedirectResponse(e||"");if(!a)return this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."),this.browserStorage.resetRequestCache(),Vl()!=="back_forward"?o.event.errorCode="no_server_response":this.logger.verbose("Back navigation event detected. Muting no_server_response error"),null;const c=this.browserStorage.getTemporaryCache(P.ORIGIN_URI,!0)||u.EMPTY_STRING,l=_.removeHashFromUrl(c),d=_.removeHashFromUrl(window.location.href);if(l===d&&this.config.auth.navigateToLoginRequestUrl)return this.logger.verbose("Current page is loginRequestUrl, handling response"),c.indexOf("#")>-1&&Jc(c),await this.handleResponse(a,t,n,i);if(this.config.auth.navigateToLoginRequestUrl){if(!ao()||this.config.system.allowRedirectInIframe){this.browserStorage.setTemporaryCache(P.URL_HASH,s,!0);const g={apiId:R.handleRedirectPromise,timeout:this.config.system.redirectNavigationTimeout,noHistory:!0};let p=!0;if(!c||c==="null"){const y=Zc();this.browserStorage.setTemporaryCache(P.ORIGIN_URI,y,!0),this.logger.warning("Unable to get valid login request url from cache, redirecting to home page"),p=await this.navigationClient.navigateInternal(y,g)}else this.logger.verbose(`Navigating to loginRequestUrl: ${c}`),p=await this.navigationClient.navigateInternal(c,g);if(!p)return await this.handleResponse(a,t,n,i)}}else return this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response"),await this.handleResponse(a,t,n,i);return null}catch(a){throw a instanceof b&&(a.setCorrelationId(this.correlationId),i.cacheFailedRequest(a)),a}}getRedirectResponse(e){this.logger.verbose("getRedirectResponseHash called");let t=e;t||(this.config.auth.OIDCOptions.serverResponseType===vt.QUERY?t=window.location.search:t=window.location.hash);let n=gt(t);if(n){try{Rl(n,this.browserCrypto,A.Redirect)}catch(i){return i instanceof b&&this.logger.error(`Interaction type validation failed due to ${i.errorCode}: ${i.errorMessage}`),[null,""]}return Yi(window),this.logger.verbose("Hash contains known properties, returning response hash"),[n,t]}const o=this.browserStorage.getTemporaryCache(P.URL_HASH,!0);return this.browserStorage.removeItem(this.browserStorage.generateCacheKey(P.URL_HASH)),o&&(n=gt(o),n)?(this.logger.verbose("Hash does not contain known properties, returning cached hash"),[n,o]):[null,""]}async handleResponse(e,t,n,o){if(!e.state)throw C(Yn);if(e.ear_jwe){const s=await f(this.getDiscoveredAuthority.bind(this),h.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t.correlationId)({requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account});return f(fo,h.HandleResponseEar,this.logger,this.performanceClient,t.correlationId)(t,e,R.acquireTokenRedirect,this.config,s,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}const a=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:o,requestAuthority:t.authority});return f(go,h.HandleResponseCode,this.logger,this.performanceClient,t.correlationId)(t,e,n,R.acquireTokenRedirect,this.config,a,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}async initiateAuthRequest(e,t){if(this.logger.verbose("RedirectHandler.initiateAuthRequest called"),e){this.logger.infoPii(`RedirectHandler.initiateAuthRequest: Navigate to: ${e}`);const n={apiId:R.acquireTokenRedirect,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},o=t||this.config.auth.onRedirectNavigate;if(typeof o=="function")if(this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback"),o(e)!==!1){this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating"),await this.navigationClient.navigateExternal(e,n);return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url"),await this.navigationClient.navigateExternal(e,n);return}}else throw this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty"),C(xt)}async logout(e){var o,i;this.logger.verbose("logoutRedirect called");const t=this.initializeLogoutRequest(e),n=this.initializeServerTelemetryManager(R.logout);try{this.eventHandler.emitEvent(T.LOGOUT_START,A.Redirect,e),await this.clearCacheOnLogout(t.account);const a={apiId:R.logout,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},s=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:n,requestAuthority:e&&e.authority,requestExtraQueryParameters:e==null?void 0:e.extraQueryParameters,account:e&&e.account||void 0});if(s.authority.protocolMode===q.OIDC)try{s.authority.endSessionEndpoint}catch{if((o=t.account)!=null&&o.homeAccountId){this.browserStorage.removeAccount((i=t.account)==null?void 0:i.homeAccountId,this.correlationId),this.eventHandler.emitEvent(T.LOGOUT_SUCCESS,A.Redirect,t);return}}const c=s.getLogoutUri(t);if(this.eventHandler.emitEvent(T.LOGOUT_SUCCESS,A.Redirect,t),e&&typeof e.onRedirectNavigate=="function")if(e.onRedirectNavigate(c)!==!1){this.logger.verbose("Logout onRedirectNavigate did not return false, navigating"),this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0,de.SIGNOUT),await this.navigationClient.navigateExternal(c,a);return}else this.browserStorage.setInteractionInProgress(!1),this.logger.verbose("Logout onRedirectNavigate returned false, stopping navigation");else{this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0,de.SIGNOUT),await this.navigationClient.navigateExternal(c,a);return}}catch(a){throw a instanceof b&&(a.setCorrelationId(this.correlationId),n.cacheFailedRequest(a)),this.eventHandler.emitEvent(T.LOGOUT_FAILURE,A.Redirect,null,a),this.eventHandler.emitEvent(T.LOGOUT_END,A.Redirect),a}this.eventHandler.emitEvent(T.LOGOUT_END,A.Redirect)}getRedirectStartPage(e){const t=e||window.location.href;return _.getAbsoluteUrl(t,ce())}}/*! @azure/msal-browser v4.13.2 2025-06-18 */async function Yl(r,e,t,n,o){if(e.addQueueMeasurement(h.SilentHandlerInitiateAuthRequest,n),!r)throw t.info("Navigate url is empty"),C(xt);return o?f(Wl,h.SilentHandlerLoadFrame,t,e,n)(r,o,e,n):j(Jl,h.SilentHandlerLoadFrameSync,t,e,n)(r)}async function jl(r,e,t,n,o){const i=po();if(!i.contentDocument)throw"No document associated with iframe!";return(await uo(i.contentDocument,r,e,t,n,o)).submit(),i}async function jo(r,e,t,n,o,i,a){return n.addQueueMeasurement(h.SilentHandlerMonitorIframeForHash,i),new Promise((s,c)=>{e<ln&&o.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${e}ms) than the default (${ln}ms). This may result in timeouts.`);const l=window.setTimeout(()=>{window.clearInterval(d),c(C(yi))},e),d=window.setInterval(()=>{let g="";const p=r.contentWindow;try{g=p?p.location.href:""}catch{}if(!g||g==="about:blank")return;let y="";p&&(a===vt.QUERY?y=p.location.search:y=p.location.hash),window.clearTimeout(l),window.clearInterval(d),s(y)},t)}).finally(()=>{j(Xl,h.RemoveHiddenIframe,o,n,i)(r)})}function Wl(r,e,t,n){return t.addQueueMeasurement(h.SilentHandlerLoadFrame,n),new Promise((o,i)=>{const a=po();window.setTimeout(()=>{if(!a){i("Unable to load iframe");return}a.src=r,o(a)},e)})}function Jl(r){const e=po();return e.src=r,e}function po(){const r=document.createElement("iframe");return r.className="msalSilentIframe",r.style.visibility="hidden",r.style.position="absolute",r.style.width=r.style.height="0",r.style.border="0",r.setAttribute("sandbox","allow-scripts allow-same-origin allow-forms"),document.body.appendChild(r),r}function Xl(r){document.body===r.parentNode&&document.body.removeChild(r)}/*! @azure/msal-browser v4.13.2 2025-06-18 */class Zl extends Le{constructor(e,t,n,o,i,a,s,c,l,d,g){super(e,t,n,o,i,a,c,d,g),this.apiId=s,this.nativeStorage=l}async acquireToken(e){this.performanceClient.addQueueMeasurement(h.SilentIframeClientAcquireToken,e.correlationId),!e.loginHint&&!e.sid&&(!e.account||!e.account.username)&&this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");const t={...e};t.prompt?t.prompt!==L.NONE&&t.prompt!==L.NO_SESSION&&(this.logger.warning(`SilentIframeClient. Replacing invalid prompt ${t.prompt} with ${L.NONE}`),t.prompt=L.NONE):t.prompt=L.NONE;const n=await f(this.initializeAuthorizationRequest.bind(this),h.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(t,A.Silent);return n.platformBroker=Ye(this.config,this.logger,this.platformAuthProvider,n.authenticationScheme),Ji(n.authority),this.config.auth.protocolMode===q.EAR?this.executeEarFlow(n):this.executeCodeFlow(n)}async executeCodeFlow(e){let t;const n=this.initializeServerTelemetryManager(this.apiId);try{return t=await f(this.createAuthCodeClient.bind(this),h.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:n,requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),await f(this.silentTokenHelper.bind(this),h.SilentIframeClientTokenHelper,this.logger,this.performanceClient,e.correlationId)(t,e)}catch(o){if(o instanceof b&&(o.setCorrelationId(this.correlationId),n.cacheFailedRequest(o)),!t||!(o instanceof b)||o.errorCode!==z.INVALID_GRANT_ERROR)throw o;return this.performanceClient.addFields({retryError:o.errorCode},this.correlationId),await f(this.silentTokenHelper.bind(this),h.SilentIframeClientTokenHelper,this.logger,this.performanceClient,this.correlationId)(t,e)}}async executeEarFlow(e){const t=e.correlationId,n=await f(this.getDiscoveredAuthority.bind(this),h.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),o=await f(no,h.GenerateEarKey,this.logger,this.performanceClient,t)(),i={...e,earJwk:o},a=await f(jl,h.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,t)(this.config,n,i,this.logger,this.performanceClient),s=this.config.auth.OIDCOptions.serverResponseType,c=await f(jo,h.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,t)(a,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,t,s),l=j(wt,h.DeserializeResponse,this.logger,this.performanceClient,t)(c,s,this.logger);return f(fo,h.HandleResponseEar,this.logger,this.performanceClient,t)(i,l,this.apiId,this.config,n,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}logout(){return Promise.reject(C(Ft))}async silentTokenHelper(e,t){const n=t.correlationId;this.performanceClient.addQueueMeasurement(h.SilentIframeClientTokenHelper,n);const o=await f(zt,h.GeneratePkceCodes,this.logger,this.performanceClient,n)(this.performanceClient,this.logger,n),i={...t,codeChallenge:o.challenge},a=await f(ho,h.GetAuthCodeUrl,this.logger,this.performanceClient,n)(this.config,e.authority,i,this.logger,this.performanceClient),s=await f(Yl,h.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,n)(a,this.performanceClient,this.logger,n,this.config.system.navigateFrameWait),c=this.config.auth.OIDCOptions.serverResponseType,l=await f(jo,h.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,n)(s,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,n,c),d=j(wt,h.DeserializeResponse,this.logger,this.performanceClient,n)(l,c,this.logger);return f(go,h.HandleResponseCode,this.logger,this.performanceClient,n)(t,d,o.verifier,this.apiId,this.config,e,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class eh extends Le{async acquireToken(e){this.performanceClient.addQueueMeasurement(h.SilentRefreshClientAcquireToken,e.correlationId);const t=await f(lo,h.InitializeBaseRequest,this.logger,this.performanceClient,e.correlationId)(e,this.config,this.performanceClient,this.logger),n={...e,...t};e.redirectUri&&(n.redirectUri=this.getRedirectUri(e.redirectUri));const o=this.initializeServerTelemetryManager(R.acquireTokenSilent_silentFlow),i=await this.createRefreshTokenClient({serverTelemetryManager:o,authorityUrl:n.authority,azureCloudOptions:n.azureCloudOptions,account:n.account});return f(i.acquireTokenByRefreshToken.bind(i),h.RefreshTokenClientAcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(n).catch(a=>{throw a.setCorrelationId(this.correlationId),o.cacheFailedRequest(a),a})}logout(){return Promise.reject(C(Ft))}async createRefreshTokenClient(e){const t=await f(this.getClientConfiguration.bind(this),h.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:e.serverTelemetryManager,requestAuthority:e.authorityUrl,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account});return new fc(t,this.performanceClient)}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class th{constructor(e,t,n,o){this.isBrowserEnvironment=typeof window<"u",this.config=e,this.storage=t,this.logger=n,this.cryptoObj=o}async loadExternalTokens(e,t,n){if(!this.isBrowserEnvironment)throw C(Kt);const o=e.correlationId||ee(),i=t.id_token?Me(t.id_token,X):void 0,a={protocolMode:this.config.auth.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},s=e.authority?new H(H.generateAuthority(e.authority,e.azureCloudOptions),this.config.system.networkClient,this.storage,a,this.logger,e.correlationId||ee()):void 0,c=await this.loadAccount(e,n.clientInfo||t.client_info||"",o,i,s),l=await this.loadIdToken(t,c.homeAccountId,c.environment,c.realm,o),d=await this.loadAccessToken(e,t,c.homeAccountId,c.environment,c.realm,n,o),g=await this.loadRefreshToken(t,c.homeAccountId,c.environment,o);return this.generateAuthenticationResult(e,{account:c,idToken:l,accessToken:d,refreshToken:g},i,s)}async loadAccount(e,t,n,o,i){if(this.logger.verbose("TokenCache - loading account"),e.account){const l=B.createFromAccountInfo(e.account);return await this.storage.setAccount(l,n),l}else if(!i||!t&&!o)throw this.logger.error("TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead."),C(ki);const a=B.generateHomeAccountId(t,i.authorityType,this.logger,this.cryptoObj,o),s=o==null?void 0:o.tid,c=zn(this.storage,i,a,X,o,t,i.hostnameAndPort,s,void 0,void 0,this.logger);return await this.storage.setAccount(c,n),c}async loadIdToken(e,t,n,o,i){if(!e.id_token)return this.logger.verbose("TokenCache - no id token found in response"),null;this.logger.verbose("TokenCache - loading id token");const a=kt(t,n,e.id_token,this.config.auth.clientId,o);return await this.storage.setIdTokenCredential(a,i),a}async loadAccessToken(e,t,n,o,i,a,s){if(t.access_token)if(t.expires_in){if(!t.scope&&(!e.scopes||!e.scopes.length))return this.logger.error("TokenCache - scopes not specified in the request or response. Cannot add token to the cache."),null}else return this.logger.error("TokenCache - no expiration set on the access token. Cannot add it to the cache."),null;else return this.logger.verbose("TokenCache - no access token found in response"),null;this.logger.verbose("TokenCache - loading access token");const c=t.scope?N.fromString(t.scope):new N(e.scopes),l=a.expiresOn||t.expires_in+V(),d=a.extendedExpiresOn||(t.ext_expires_in||t.expires_in)+V(),g=Rt(n,o,t.access_token,this.config.auth.clientId,i,c.printScopes(),l,d,X);return await this.storage.setAccessTokenCredential(g,s),g}async loadRefreshToken(e,t,n,o){if(!e.refresh_token)return this.logger.verbose("TokenCache - no refresh token found in response"),null;this.logger.verbose("TokenCache - loading refresh token");const i=Cr(t,n,e.refresh_token,this.config.auth.clientId,e.foci,void 0,e.refresh_token_expires_in);return await this.storage.setRefreshTokenCredential(i,o),i}generateAuthenticationResult(e,t,n,o){var d,g,p;let i="",a=[],s=null,c;t!=null&&t.accessToken&&(i=t.accessToken.secret,a=N.fromString(t.accessToken.target).asArray(),s=Re(t.accessToken.expiresOn),c=Re(t.accessToken.extendedExpiresOn));const l=t.account;return{authority:o?o.canonicalAuthority:"",uniqueId:t.account.localAccountId,tenantId:t.account.realm,scopes:a,account:l.getAccountInfo(),idToken:((d=t.idToken)==null?void 0:d.secret)||"",idTokenClaims:n||{},accessToken:i,fromCache:!0,expiresOn:s,correlationId:e.correlationId||"",requestId:"",extExpiresOn:c,familyId:((g=t.refreshToken)==null?void 0:g.familyId)||"",tokenType:((p=t==null?void 0:t.accessToken)==null?void 0:p.tokenType)||"",state:e.state||"",cloudGraphHostName:l.cloudGraphHostName||"",msGraphHost:l.msGraphHost||"",fromNativeBroker:!1}}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class nh extends ri{constructor(e){super(e),this.includeRedirectUri=!1}}/*! @azure/msal-browser v4.13.2 2025-06-18 */class oh extends Le{constructor(e,t,n,o,i,a,s,c,l,d){super(e,t,n,o,i,a,c,l,d),this.apiId=s}async acquireToken(e){if(!e.code)throw C(Ri);const t=await f(this.initializeAuthorizationRequest.bind(this),h.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(e,A.Silent),n=this.initializeServerTelemetryManager(this.apiId);try{const o={...t,code:e.code},i=await f(this.getClientConfiguration.bind(this),h.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:n,requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account}),a=new nh(i);this.logger.verbose("Auth code client created");const s=new ta(a,this.browserStorage,o,this.logger,this.performanceClient);return await f(s.handleCodeResponseFromServer.bind(s),h.HandleCodeResponseFromServer,this.logger,this.performanceClient,e.correlationId)({code:e.code,msgraph_host:e.msGraphHost,cloud_graph_host_name:e.cloudGraphHostName,cloud_instance_host_name:e.cloudInstanceHostName},t,!1)}catch(o){throw o instanceof b&&(o.setCorrelationId(this.correlationId),n.cacheFailedRequest(o)),o}}logout(){return Promise.reject(C(Ft))}}/*! @azure/msal-browser v4.13.2 2025-06-18 */function rh(r,e,t){var a;const n=((a=window.msal)==null?void 0:a.clientIds)||[],o=n.length,i=n.filter(s=>s===r).length;i>1&&t.warning("There is already an instance of MSAL.js in the window with the same client id."),e.add({msalInstanceCount:o,sameClientIdInstanceCount:i})}/*! @azure/msal-browser v4.13.2 2025-06-18 */function te(r){const e=r==null?void 0:r.idTokenClaims;if(e!=null&&e.tfp||e!=null&&e.acr)return"B2C";if(e!=null&&e.tid){if((e==null?void 0:e.tid)==="9188040d-6c67-4c5b-b112-36a304b66dad")return"MSA"}else return;return"AAD"}function it(r,e){try{so(r)}catch(t){throw e.end({success:!1},t),t}}class $t{constructor(e){this.operatingContext=e,this.isBrowserEnvironment=this.operatingContext.isBrowserEnvironment(),this.config=e.getConfig(),this.initialized=!1,this.logger=this.operatingContext.getLogger(),this.networkClient=this.config.system.networkClient,this.navigationClient=this.config.system.navigationClient,this.redirectResponse=new Map,this.hybridAuthCodeResponses=new Map,this.performanceClient=this.config.telemetry.client,this.browserCrypto=this.isBrowserEnvironment?new le(this.logger,this.performanceClient):dt,this.eventHandler=new _l(this.logger),this.browserStorage=this.isBrowserEnvironment?new gn(this.config.auth.clientId,this.config.cache,this.browserCrypto,this.logger,this.performanceClient,this.eventHandler,rc(this.config.auth)):pl(this.config.auth.clientId,this.logger,this.performanceClient,this.eventHandler);const t={cacheLocation:U.MemoryStorage,temporaryCacheLocation:U.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};this.nativeInternalStorage=new gn(this.config.auth.clientId,t,this.browserCrypto,this.logger,this.performanceClient,this.eventHandler),this.tokenCache=new th(this.config,this.browserStorage,this.logger,this.browserCrypto),this.activeSilentTokenRequests=new Map,this.trackPageVisibility=this.trackPageVisibility.bind(this),this.trackPageVisibilityWithMeasurement=this.trackPageVisibilityWithMeasurement.bind(this)}static async createController(e,t){const n=new $t(e);return await n.initialize(t),n}trackPageVisibility(e){e&&(this.logger.info("Perf: Visibility change detected"),this.performanceClient.incrementFields({visibilityChangeCount:1},e))}async initialize(e,t){if(this.logger.trace("initialize called"),this.initialized){this.logger.info("initialize has already been called, exiting early.");return}if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, exiting early."),this.initialized=!0,this.eventHandler.emitEvent(T.INITIALIZE_END);return}const n=(e==null?void 0:e.correlationId)||this.getRequestCorrelationId(),o=this.config.system.allowPlatformBroker,i=this.performanceClient.startMeasurement(h.InitializeClientApplication,n);if(this.eventHandler.emitEvent(T.INITIALIZE_START),!t)try{this.logMultipleInstances(i)}catch{}if(await f(this.browserStorage.initialize.bind(this.browserStorage),h.InitializeCache,this.logger,this.performanceClient,n)(n),o)try{this.platformAuthProvider=await zl(this.logger,this.performanceClient,n,this.config.system.nativeBrokerHandshakeTimeout)}catch(a){this.logger.verbose(a)}this.config.cache.claimsBasedCachingEnabled||(this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims"),j(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage),h.ClearTokensAndKeysWithClaims,this.logger,this.performanceClient,n)(n)),this.config.system.asyncPopups&&await this.preGeneratePkceCodes(n),this.initialized=!0,this.eventHandler.emitEvent(T.INITIALIZE_END),i.end({allowPlatformBroker:o,success:!0})}async handleRedirectPromise(e){if(this.logger.verbose("handleRedirectPromise called"),Wi(this.initialized),this.isBrowserEnvironment){const t=e||"";let n=this.redirectResponse.get(t);return typeof n>"u"?(n=this.handleRedirectPromiseInternal(e),this.redirectResponse.set(t,n),this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise")):this.logger.verbose("handleRedirectPromise has been called previously, returning the result from the first call"),n}return this.logger.verbose("handleRedirectPromise returns null, not browser environment"),null}async handleRedirectPromiseInternal(e){var c;if(!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;if(((c=this.browserStorage.getInteractionInProgress())==null?void 0:c.type)===de.SIGNOUT)return this.logger.verbose("handleRedirectPromise removing interaction_in_progress flag and returning null after sign-out"),this.browserStorage.setInteractionInProgress(!1),Promise.resolve(null);const n=this.getAllAccounts(),o=this.browserStorage.getCachedNativeRequest(),i=o&&this.platformAuthProvider&&!e;let a;this.eventHandler.emitEvent(T.HANDLE_REDIRECT_START,A.Redirect);let s;try{if(i&&this.platformAuthProvider){a=this.performanceClient.startMeasurement(h.AcquireTokenRedirect,(o==null?void 0:o.correlationId)||""),this.logger.trace("handleRedirectPromise - acquiring token from native platform");const l=new ct(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,R.handleRedirectPromise,this.performanceClient,this.platformAuthProvider,o.accountId,this.nativeInternalStorage,o.correlationId);s=f(l.handleRedirectPromise.bind(l),h.HandleNativeRedirectPromiseMeasurement,this.logger,this.performanceClient,a.event.correlationId)(this.performanceClient,a.event.correlationId)}else{const[l,d]=this.browserStorage.getCachedRequest(),g=l.correlationId;a=this.performanceClient.startMeasurement(h.AcquireTokenRedirect,g),this.logger.trace("handleRedirectPromise - acquiring token from web flow");const p=this.createRedirectClient(g);s=f(p.handleRedirectPromise.bind(p),h.HandleRedirectPromiseMeasurement,this.logger,this.performanceClient,a.event.correlationId)(e,l,d,a)}}catch(l){throw this.browserStorage.resetRequestCache(),l}return s.then(l=>(l?(this.browserStorage.resetRequestCache(),n.length<this.getAllAccounts().length?(this.eventHandler.emitEvent(T.LOGIN_SUCCESS,A.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, login success")):(this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_SUCCESS,A.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, acquire token success")),a.end({success:!0,accountType:te(l.account)})):a.event.errorCode?a.end({success:!1}):a.discard(),this.eventHandler.emitEvent(T.HANDLE_REDIRECT_END,A.Redirect),l)).catch(l=>{this.browserStorage.resetRequestCache();const d=l;throw n.length>0?this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_FAILURE,A.Redirect,null,d):this.eventHandler.emitEvent(T.LOGIN_FAILURE,A.Redirect,null,d),this.eventHandler.emitEvent(T.HANDLE_REDIRECT_END,A.Redirect),a.end({success:!1},d),l})}async acquireTokenRedirect(e){const t=this.getRequestCorrelationId(e);this.logger.verbose("acquireTokenRedirect called",t);const n=this.performanceClient.startMeasurement(h.AcquireTokenPreRedirect,t);n.add({accountType:te(e.account),scenarioId:e.scenarioId});const o=e.onRedirectNavigate;if(o)e.onRedirectNavigate=a=>{const s=typeof o=="function"?o(a):void 0;return s!==!1?n.end({success:!0}):n.discard(),s};else{const a=this.config.auth.onRedirectNavigate;this.config.auth.onRedirectNavigate=s=>{const c=typeof a=="function"?a(s):void 0;return c!==!1?n.end({success:!0}):n.discard(),c}}const i=this.getAllAccounts().length>0;try{zo(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0,de.SIGNIN),i?this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_START,A.Redirect,e):this.eventHandler.emitEvent(T.LOGIN_START,A.Redirect,e);let a;return this.platformAuthProvider&&this.canUsePlatformBroker(e)?a=new ct(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,R.acquireTokenRedirect,this.performanceClient,this.platformAuthProvider,this.getNativeAccountId(e),this.nativeInternalStorage,t).acquireTokenRedirect(e,n).catch(c=>{if(c instanceof re&&ke(c))return this.platformAuthProvider=void 0,this.createRedirectClient(t).acquireToken(e);if(c instanceof Z)return this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createRedirectClient(t).acquireToken(e);throw c}):a=this.createRedirectClient(t).acquireToken(e),await a}catch(a){throw this.browserStorage.resetRequestCache(),n.end({success:!1},a),i?this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_FAILURE,A.Redirect,null,a):this.eventHandler.emitEvent(T.LOGIN_FAILURE,A.Redirect,null,a),a}}acquireTokenPopup(e){const t=this.getRequestCorrelationId(e),n=this.performanceClient.startMeasurement(h.AcquireTokenPopup,t);n.add({scenarioId:e.scenarioId,accountType:te(e.account)});try{this.logger.verbose("acquireTokenPopup called",t),it(this.initialized,n),this.browserStorage.setInteractionInProgress(!0,de.SIGNIN)}catch(s){return Promise.reject(s)}const o=this.getAllAccounts();o.length>0?this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_START,A.Popup,e):this.eventHandler.emitEvent(T.LOGIN_START,A.Popup,e);let i;const a=this.getPreGeneratedPkceCodes(t);return this.canUsePlatformBroker(e)?i=this.acquireTokenNative({...e,correlationId:t},R.acquireTokenPopup).then(s=>(n.end({success:!0,isNativeBroker:!0,accountType:te(s.account)}),s)).catch(s=>{if(s instanceof re&&ke(s))return this.platformAuthProvider=void 0,this.createPopupClient(t).acquireToken(e,a);if(s instanceof Z)return this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createPopupClient(t).acquireToken(e,a);throw s}):i=this.createPopupClient(t).acquireToken(e,a),i.then(s=>(o.length<this.getAllAccounts().length?this.eventHandler.emitEvent(T.LOGIN_SUCCESS,A.Popup,s):this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_SUCCESS,A.Popup,s),n.end({success:!0,accessTokenSize:s.accessToken.length,idTokenSize:s.idToken.length,accountType:te(s.account)}),s)).catch(s=>(o.length>0?this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_FAILURE,A.Popup,null,s):this.eventHandler.emitEvent(T.LOGIN_FAILURE,A.Popup,null,s),n.end({success:!1},s),Promise.reject(s))).finally(async()=>{this.browserStorage.setInteractionInProgress(!1),this.config.system.asyncPopups&&await this.preGeneratePkceCodes(t)})}trackPageVisibilityWithMeasurement(){const e=this.ssoSilentMeasurement||this.acquireTokenByCodeAsyncMeasurement;e&&(this.logger.info("Perf: Visibility change detected in ",e.event.name),e.increment({visibilityChangeCount:1}))}async ssoSilent(e){var i,a;const t=this.getRequestCorrelationId(e),n={...e,prompt:e.prompt,correlationId:t};this.ssoSilentMeasurement=this.performanceClient.startMeasurement(h.SsoSilent,t),(i=this.ssoSilentMeasurement)==null||i.add({scenarioId:e.scenarioId,accountType:te(e.account)}),it(this.initialized,this.ssoSilentMeasurement),(a=this.ssoSilentMeasurement)==null||a.increment({visibilityChangeCount:0}),document.addEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement),this.logger.verbose("ssoSilent called",t),this.eventHandler.emitEvent(T.SSO_SILENT_START,A.Silent,n);let o;return this.canUsePlatformBroker(n)?o=this.acquireTokenNative(n,R.ssoSilent).catch(s=>{if(s instanceof re&&ke(s))return this.platformAuthProvider=void 0,this.createSilentIframeClient(n.correlationId).acquireToken(n);throw s}):o=this.createSilentIframeClient(n.correlationId).acquireToken(n),o.then(s=>{var c;return this.eventHandler.emitEvent(T.SSO_SILENT_SUCCESS,A.Silent,s),(c=this.ssoSilentMeasurement)==null||c.end({success:!0,isNativeBroker:s.fromNativeBroker,accessTokenSize:s.accessToken.length,idTokenSize:s.idToken.length,accountType:te(s.account)}),s}).catch(s=>{var c;throw this.eventHandler.emitEvent(T.SSO_SILENT_FAILURE,A.Silent,null,s),(c=this.ssoSilentMeasurement)==null||c.end({success:!1},s),s}).finally(()=>{document.removeEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement)})}async acquireTokenByCode(e){const t=this.getRequestCorrelationId(e);this.logger.trace("acquireTokenByCode called",t);const n=this.performanceClient.startMeasurement(h.AcquireTokenByCode,t);it(this.initialized,n),this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_BY_CODE_START,A.Silent,e),n.add({scenarioId:e.scenarioId});try{if(e.code&&e.nativeAccountId)throw C(Oi);if(e.code){const o=e.code;let i=this.hybridAuthCodeResponses.get(o);return i?(this.logger.verbose("Existing acquireTokenByCode request found",t),n.discard()):(this.logger.verbose("Initiating new acquireTokenByCode request",t),i=this.acquireTokenByCodeAsync({...e,correlationId:t}).then(a=>(this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_BY_CODE_SUCCESS,A.Silent,a),this.hybridAuthCodeResponses.delete(o),n.end({success:!0,isNativeBroker:a.fromNativeBroker,accessTokenSize:a.accessToken.length,idTokenSize:a.idToken.length,accountType:te(a.account)}),a)).catch(a=>{throw this.hybridAuthCodeResponses.delete(o),this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_BY_CODE_FAILURE,A.Silent,null,a),n.end({success:!1},a),a}),this.hybridAuthCodeResponses.set(o,i)),await i}else if(e.nativeAccountId)if(this.canUsePlatformBroker(e,e.nativeAccountId)){const o=await this.acquireTokenNative({...e,correlationId:t},R.acquireTokenByCode,e.nativeAccountId).catch(i=>{throw i instanceof re&&ke(i)&&(this.platformAuthProvider=void 0),i});return n.end({accountType:te(o.account),success:!0}),o}else throw C(Pi);else throw C(bi)}catch(o){throw this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_BY_CODE_FAILURE,A.Silent,null,o),n.end({success:!1},o),o}}async acquireTokenByCodeAsync(e){var o;return this.logger.trace("acquireTokenByCodeAsync called",e.correlationId),this.acquireTokenByCodeAsyncMeasurement=this.performanceClient.startMeasurement(h.AcquireTokenByCodeAsync,e.correlationId),(o=this.acquireTokenByCodeAsyncMeasurement)==null||o.increment({visibilityChangeCount:0}),document.addEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement),await this.createSilentAuthCodeClient(e.correlationId).acquireToken(e).then(i=>{var a;return(a=this.acquireTokenByCodeAsyncMeasurement)==null||a.end({success:!0,fromCache:i.fromCache,isNativeBroker:i.fromNativeBroker}),i}).catch(i=>{var a;throw(a=this.acquireTokenByCodeAsyncMeasurement)==null||a.end({success:!1},i),i}).finally(()=>{document.removeEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement)})}async acquireTokenFromCache(e,t){switch(this.performanceClient.addQueueMeasurement(h.AcquireTokenFromCache,e.correlationId),t){case F.Default:case F.AccessToken:case F.AccessTokenAndRefreshToken:const n=this.createSilentCacheClient(e.correlationId);return f(n.acquireToken.bind(n),h.SilentCacheClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw m(fe)}}async acquireTokenByRefreshToken(e,t){switch(this.performanceClient.addQueueMeasurement(h.AcquireTokenByRefreshToken,e.correlationId),t){case F.Default:case F.AccessTokenAndRefreshToken:case F.RefreshToken:case F.RefreshTokenAndNetwork:const n=this.createSilentRefreshClient(e.correlationId);return f(n.acquireToken.bind(n),h.SilentRefreshClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw m(fe)}}async acquireTokenBySilentIframe(e){this.performanceClient.addQueueMeasurement(h.AcquireTokenBySilentIframe,e.correlationId);const t=this.createSilentIframeClient(e.correlationId);return f(t.acquireToken.bind(t),h.SilentIframeClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e)}async logout(e){const t=this.getRequestCorrelationId(e);return this.logger.warning("logout API is deprecated and will be removed in msal-browser v3.0.0. Use logoutRedirect instead.",t),this.logoutRedirect({correlationId:t,...e})}async logoutRedirect(e){const t=this.getRequestCorrelationId(e);return zo(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0,de.SIGNOUT),this.createRedirectClient(t).logout(e)}logoutPopup(e){try{const t=this.getRequestCorrelationId(e);return so(this.initialized),this.browserStorage.setInteractionInProgress(!0,de.SIGNOUT),this.createPopupClient(t).logout(e).finally(()=>{this.browserStorage.setInteractionInProgress(!1)})}catch(t){return Promise.reject(t)}}async clearCache(e){if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, returning early.");return}const t=this.getRequestCorrelationId(e);return this.createSilentCacheClient(t).logout(e)}getAllAccounts(e){return Cl(this.logger,this.browserStorage,this.isBrowserEnvironment,e)}getAccount(e){return yl(e,this.logger,this.browserStorage)}getAccountByUsername(e){return Tl(e,this.logger,this.browserStorage)}getAccountByHomeId(e){return Al(e,this.logger,this.browserStorage)}getAccountByLocalId(e){return Il(e,this.logger,this.browserStorage)}setActiveAccount(e){El(e,this.browserStorage)}getActiveAccount(){return wl(this.browserStorage)}async hydrateCache(e,t){this.logger.verbose("hydrateCache called");const n=B.createFromAccountInfo(e.account,e.cloudGraphHostName,e.msGraphHost);return await this.browserStorage.setAccount(n,e.correlationId),e.fromNativeBroker?(this.logger.verbose("Response was from native broker, storing in-memory"),this.nativeInternalStorage.hydrateCache(e,t)):this.browserStorage.hydrateCache(e,t)}async acquireTokenNative(e,t,n,o){if(this.logger.trace("acquireTokenNative called"),!this.platformAuthProvider)throw C(Jn);return new ct(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,t,this.performanceClient,this.platformAuthProvider,n||this.getNativeAccountId(e),this.nativeInternalStorage,e.correlationId).acquireToken(e,o)}canUsePlatformBroker(e,t){if(this.logger.trace("canUsePlatformBroker called"),!this.platformAuthProvider)return this.logger.trace("canUsePlatformBroker: platform broker unavilable, returning false"),!1;if(!Ye(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme))return this.logger.trace("canUsePlatformBroker: isBrokerAvailable returned false, returning false"),!1;if(e.prompt)switch(e.prompt){case L.NONE:case L.CONSENT:case L.LOGIN:this.logger.trace("canUsePlatformBroker: prompt is compatible with platform broker flow");break;default:return this.logger.trace(`canUsePlatformBroker: prompt = ${e.prompt} is not compatible with platform broker flow, returning false`),!1}return!t&&!this.getNativeAccountId(e)?(this.logger.trace("canUsePlatformBroker: nativeAccountId is not available, returning false"),!1):!0}getNativeAccountId(e){const t=e.account||this.getAccount({loginHint:e.loginHint,sid:e.sid})||this.getActiveAccount();return t&&t.nativeAccountId||""}createPopupClient(e){return new ql(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createRedirectClient(e){return new Ql(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createSilentIframeClient(e){return new Zl(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,R.ssoSilent,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createSilentCacheClient(e){return new oa(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.platformAuthProvider,e)}createSilentRefreshClient(e){return new eh(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.platformAuthProvider,e)}createSilentAuthCodeClient(e){return new oh(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,R.acquireTokenByCode,this.performanceClient,this.platformAuthProvider,e)}addEventCallback(e,t){return this.eventHandler.addEventCallback(e,t)}removeEventCallback(e){this.eventHandler.removeEventCallback(e)}addPerformanceCallback(e){return ji(),this.performanceClient.addPerformanceCallback(e)}removePerformanceCallback(e){return this.performanceClient.removePerformanceCallback(e)}enableAccountStorageEvents(){if(this.config.cache.cacheLocation!==U.LocalStorage){this.logger.info("Account storage events are only available when cacheLocation is set to localStorage");return}this.eventHandler.subscribeCrossTab()}disableAccountStorageEvents(){if(this.config.cache.cacheLocation!==U.LocalStorage){this.logger.info("Account storage events are only available when cacheLocation is set to localStorage");return}this.eventHandler.unsubscribeCrossTab()}getTokenCache(){return this.tokenCache}getLogger(){return this.logger}setLogger(e){this.logger=e}initializeWrapperLibrary(e,t){this.browserStorage.setWrapperMetadata(e,t)}setNavigationClient(e){this.navigationClient=e}getConfiguration(){return this.config}getPerformanceClient(){return this.performanceClient}isBrowserEnv(){return this.isBrowserEnvironment}getRequestCorrelationId(e){return e!=null&&e.correlationId?e.correlationId:this.isBrowserEnvironment?ee():u.EMPTY_STRING}async loginRedirect(e){const t=this.getRequestCorrelationId(e);return this.logger.verbose("loginRedirect called",t),this.acquireTokenRedirect({correlationId:t,...e||Fo})}loginPopup(e){const t=this.getRequestCorrelationId(e);return this.logger.verbose("loginPopup called",t),this.acquireTokenPopup({correlationId:t,...e||Fo})}async acquireTokenSilent(e){const t=this.getRequestCorrelationId(e),n=this.performanceClient.startMeasurement(h.AcquireTokenSilent,t);n.add({cacheLookupPolicy:e.cacheLookupPolicy,scenarioId:e.scenarioId}),it(this.initialized,n),this.logger.verbose("acquireTokenSilent called",t);const o=e.account||this.getActiveAccount();if(!o)throw C(Ei);return n.add({accountType:te(o)}),this.acquireTokenSilentDeduped(e,o,t).then(i=>(n.end({success:!0,fromCache:i.fromCache,isNativeBroker:i.fromNativeBroker,accessTokenSize:i.accessToken.length,idTokenSize:i.idToken.length}),{...i,state:e.state,correlationId:t})).catch(i=>{throw i instanceof b&&i.setCorrelationId(t),n.end({success:!1},i),i})}async acquireTokenSilentDeduped(e,t,n){const o=Dt(this.config.auth.clientId,{...e,authority:e.authority||this.config.auth.authority},t.homeAccountId),i=JSON.stringify(o),a=this.activeSilentTokenRequests.get(i);if(typeof a>"u"){this.logger.verbose("acquireTokenSilent called for the first time, storing active request",n),this.performanceClient.addFields({deduped:!1},n);const s=f(this.acquireTokenSilentAsync.bind(this),h.AcquireTokenSilentAsync,this.logger,this.performanceClient,n)({...e,correlationId:n},t);return this.activeSilentTokenRequests.set(i,s),s.finally(()=>{this.activeSilentTokenRequests.delete(i)})}else return this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call",n),this.performanceClient.addFields({deduped:!0},n),a}async acquireTokenSilentAsync(e,t){const n=()=>this.trackPageVisibility(e.correlationId);this.performanceClient.addQueueMeasurement(h.AcquireTokenSilentAsync,e.correlationId),this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_START,A.Silent,e),e.correlationId&&this.performanceClient.incrementFields({visibilityChangeCount:0},e.correlationId),document.addEventListener("visibilitychange",n);const o=await f(vl,h.InitializeSilentRequest,this.logger,this.performanceClient,e.correlationId)(e,t,this.config,this.performanceClient,this.logger),i=e.cacheLookupPolicy||F.Default;return this.acquireTokenSilentNoIframe(o,i).catch(async s=>{if(ih(s,i))if(this.activeIframeRequest)if(i!==F.Skip){const[l,d]=this.activeIframeRequest;this.logger.verbose(`Iframe request is already in progress, awaiting resolution for request with correlationId: ${d}`,o.correlationId);const g=this.performanceClient.startMeasurement(h.AwaitConcurrentIframe,o.correlationId);g.add({awaitIframeCorrelationId:d});const p=await l;if(g.end({success:p}),p)return this.logger.verbose(`Parallel iframe request with correlationId: ${d} succeeded. Retrying cache and/or RT redemption`,o.correlationId),this.acquireTokenSilentNoIframe(o,i);throw this.logger.info(`Iframe request with correlationId: ${d} failed. Interaction is required.`),s}else return this.logger.warning("Another iframe request is currently in progress and CacheLookupPolicy is set to Skip. This may result in degraded performance and/or reliability for both calls. Please consider changing the CacheLookupPolicy to take advantage of request queuing and token cache.",o.correlationId),f(this.acquireTokenBySilentIframe.bind(this),h.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o);else{let l;return this.activeIframeRequest=[new Promise(d=>{l=d}),o.correlationId],this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",o.correlationId),f(this.acquireTokenBySilentIframe.bind(this),h.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o).then(d=>(l(!0),d)).catch(d=>{throw l(!1),d}).finally(()=>{this.activeIframeRequest=void 0})}else throw s}).then(s=>(this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_SUCCESS,A.Silent,s),e.correlationId&&this.performanceClient.addFields({fromCache:s.fromCache,isNativeBroker:s.fromNativeBroker},e.correlationId),s)).catch(s=>{throw this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_FAILURE,A.Silent,null,s),s}).finally(()=>{document.removeEventListener("visibilitychange",n)})}async acquireTokenSilentNoIframe(e,t){return Ye(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme)&&e.account.nativeAccountId?(this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform"),this.acquireTokenNative(e,R.acquireTokenSilent_silentFlow,e.account.nativeAccountId,t).catch(async n=>{throw n instanceof re&&ke(n)?(this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow"),this.platformAuthProvider=void 0,m(fe)):n})):(this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow"),t===F.AccessToken&&this.logger.verbose("acquireTokenSilent - cache lookup policy set to AccessToken, attempting to acquire token from local cache"),f(this.acquireTokenFromCache.bind(this),h.AcquireTokenFromCache,this.logger,this.performanceClient,e.correlationId)(e,t).catch(n=>{if(t===F.AccessToken)throw n;return this.eventHandler.emitEvent(T.ACQUIRE_TOKEN_NETWORK_START,A.Silent,e),f(this.acquireTokenByRefreshToken.bind(this),h.AcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,t)}))}async preGeneratePkceCodes(e){return this.logger.verbose("Generating new PKCE codes"),this.pkceCode=await f(zt,h.GeneratePkceCodes,this.logger,this.performanceClient,e)(this.performanceClient,this.logger,e),Promise.resolve()}getPreGeneratedPkceCodes(e){this.logger.verbose("Attempting to pick up pre-generated PKCE codes");const t=this.pkceCode?{...this.pkceCode}:void 0;return this.pkceCode=void 0,this.logger.verbose(`${t?"Found":"Did not find"} pre-generated PKCE codes`),this.performanceClient.addFields({usePreGeneratedPkce:!!t},e),t}logMultipleInstances(e){const t=this.config.auth.clientId;if(!window)return;window.msal=window.msal||{},window.msal.clientIds=window.msal.clientIds||[],window.msal.clientIds.length>0&&this.logger.verbose("There is already an instance of MSAL.js in the window."),window.msal.clientIds.push(t),rh(t,e,this.logger)}}function ih(r,e){const t=!(r instanceof Z&&r.subError!==Ht),n=r.errorCode===z.INVALID_GRANT_ERROR||r.errorCode===fe,o=t&&n||r.errorCode===yt||r.errorCode===Bn,i=Mc.includes(e);return o&&i}/*! @azure/msal-browser v4.13.2 2025-06-18 */async function ah(r,e){const t=new we(r);return await t.initialize(),$t.createController(t,e)}/*! @azure/msal-browser v4.13.2 2025-06-18 */class aa{static async createPublicClientApplication(e){const t=await ah(e);return new aa(e,t)}constructor(e,t){this.isBroker=!1,this.controller=t||new $t(new we(e))}async initialize(e){return this.controller.initialize(e,this.isBroker)}async acquireTokenPopup(e){return this.controller.acquireTokenPopup(e)}acquireTokenRedirect(e){return this.controller.acquireTokenRedirect(e)}acquireTokenSilent(e){return this.controller.acquireTokenSilent(e)}acquireTokenByCode(e){return this.controller.acquireTokenByCode(e)}addEventCallback(e,t){return this.controller.addEventCallback(e,t)}removeEventCallback(e){return this.controller.removeEventCallback(e)}addPerformanceCallback(e){return this.controller.addPerformanceCallback(e)}removePerformanceCallback(e){return this.controller.removePerformanceCallback(e)}enableAccountStorageEvents(){this.controller.enableAccountStorageEvents()}disableAccountStorageEvents(){this.controller.disableAccountStorageEvents()}getAccount(e){return this.controller.getAccount(e)}getAccountByHomeId(e){return this.controller.getAccountByHomeId(e)}getAccountByLocalId(e){return this.controller.getAccountByLocalId(e)}getAccountByUsername(e){return this.controller.getAccountByUsername(e)}getAllAccounts(e){return this.controller.getAllAccounts(e)}handleRedirectPromise(e){return this.controller.handleRedirectPromise(e)}loginPopup(e){return this.controller.loginPopup(e)}loginRedirect(e){return this.controller.loginRedirect(e)}logout(e){return this.controller.logout(e)}logoutRedirect(e){return this.controller.logoutRedirect(e)}logoutPopup(e){return this.controller.logoutPopup(e)}ssoSilent(e){return this.controller.ssoSilent(e)}getTokenCache(){return this.controller.getTokenCache()}getLogger(){return this.controller.getLogger()}setLogger(e){this.controller.setLogger(e)}setActiveAccount(e){this.controller.setActiveAccount(e)}getActiveAccount(){return this.controller.getActiveAccount()}initializeWrapperLibrary(e,t){return this.controller.initializeWrapperLibrary(e,t)}setNavigationClient(e){this.controller.setNavigationClient(e)}getConfiguration(){return this.controller.getConfiguration()}async hydrateCache(e,t){return this.controller.hydrateCache(e,t)}clearCache(e){return this.controller.clearCache(e)}}const sh={auth:{clientId:"bd8612b2-59ef-41fe-a30e-640f0a35eebb",authority:"https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47",redirectUri:"https://localhost:5001/auth.html",postLogoutRedirectUri:"https://localhost:5001",navigateToLoginRequestUrl:!1},cache:{cacheLocation:"sessionStorage",storeAuthStateInCookie:!1},system:{loggerOptions:{loggerCallback:(r,e,t)=>{if(!t)switch(r){case 0:console.error(e);return;case 1:console.warn(e);return;case 2:console.info(e);return;case 3:console.debug(e);return}}},windowHashTimeout:6e4,iframeHashTimeout:6e3,loadFrameTimeout:0,asyncPopups:!1}},ch={scopes:["openid","profile","User.Read"]},lh={scopes:["https://graph.microsoft.com/User.Read"]},hh={scopes:["433365e3-be67-404c-a3b3-684bb28f41e0/.default"]},dh={graphMeEndpoint:"https://graph.microsoft.com/v1.0/me"};export{aa as P,dh as a,hh as c,lh as g,ch as l,sh as m};