1import{a as Qc}from"./chunk-CHAIIRIE.js";import{Ac as bt,Bc as Kc,Cc as sn,Dc as ee,Gc,Hc as qc,He as $s,Rb as nn,Sb as Lc,Sc as zc,Se as Vc,Tb as xc,Xe as wi,Yb as ke,Zb as it,_e as jc,cc as qs,ed as $c,jf as Jr,kc as Hc,lc as zs,qc as Fc,vc as Bc,vh as Wc,xh as Yc}from"./chunk-ZDEXLJGG.js";import{a as y,b as S,d as nt,g as ye,j as Gs,k as d}from"./chunk-XU43R4EC.js";var gs={};ye(gs,{addClientCapabilitiesToClaims:()=>Fh,blockAPICallsBeforeInitialize:()=>ms,blockAcquireTokenInPopups:()=>Kl,blockNonBrowserEnvironment:()=>us,blockRedirectInIframe:()=>Bl,blockReloadInHiddenIframes:()=>Fl,clearHash:()=>fi,createGuid:()=>wc,getCurrentUri:()=>fe,getHomepage:()=>vc,invoke:()=>G,invokeAsync:()=>u,isInIframe:()=>Ci,isInPopup:()=>Hl,preconnect:()=>Ai,preflightCheck:()=>yi,redirectPreflightCheck:()=>ps,replaceHash:()=>Sc});var g={LIBRARY_NAME:"MSAL.JS",SKU:"msal.js.common",DEFAULT_AUTHORITY:"https://login.microsoftonline.com/common/",DEFAULT_AUTHORITY_HOST:"login.microsoftonline.com",DEFAULT_COMMON_TENANT:"common",ADFS:"adfs",DSTS:"dstsv2",AAD_INSTANCE_DISCOVERY_ENDPT:"https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",CIAM_AUTH_URL:".ciamlogin.com",AAD_TENANT_DOMAIN_SUFFIX:".onmicrosoft.com",RESOURCE_DELIM:"|",NO_ACCOUNT:"NO_ACCOUNT",CLAIMS:"claims",CONSUMER_UTID:"9188040d-6c67-4c5b-b112-36a304b66dad",OPENID_SCOPE:"openid",PROFILE_SCOPE:"profile",OFFLINE_ACCESS_SCOPE:"offline_access",EMAIL_SCOPE:"email",CODE_GRANT_TYPE:"authorization_code",RT_GRANT_TYPE:"refresh_token",S256_CODE_CHALLENGE_METHOD:"S256",URL_FORM_CONTENT_TYPE:"application/x-www-form-urlencoded;charset=utf-8",AUTHORIZATION_PENDING:"authorization_pending",NOT_DEFINED:"not_defined",EMPTY_STRING:"",NOT_APPLICABLE:"N/A",NOT_AVAILABLE:"Not Available",FORWARD_SLASH:"/",IMDS_ENDPOINT:"http://169.254.169.254/metadata/instance/compute/location",IMDS_VERSION:"2020-06-01",IMDS_TIMEOUT:2e3,AZURE_REGION_AUTO_DISCOVER_FLAG:"TryAutoDetect",REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX:"login.microsoft.com",KNOWN_PUBLIC_CLOUDS:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"],SHR_NONCE_VALIDITY:240,INVALID_INSTANCE:"invalid_instance"},Me={SUCCESS:200,SUCCESS_RANGE_START:200,SUCCESS_RANGE_END:299,REDIRECT:302,CLIENT_ERROR:400,CLIENT_ERROR_RANGE_START:400,BAD_REQUEST:400,UNAUTHORIZED:401,NOT_FOUND:404,REQUEST_TIMEOUT:408,GONE:410,TOO_MANY_REQUESTS:429,CLIENT_ERROR_RANGE_END:499,SERVER_ERROR:500,SERVER_ERROR_RANGE_START:500,SERVICE_UNAVAILABLE:503,GATEWAY_TIMEOUT:504,SERVER_ERROR_RANGE_END:599,MULTI_SIDED_ERROR:600},Re={GET:"GET",POST:"POST"},Ie=[g.OPENID_SCOPE,g.PROFILE_SCOPE,g.OFFLINE_ACCESS_SCOPE],Vs=[...Ie,g.EMAIL_SCOPE],W={CONTENT_TYPE:"Content-Type",CONTENT_LENGTH:"Content-Length",RETRY_AFTER:"Retry-After",CCS_HEADER:"X-AnchorMailbox",WWWAuthenticate:"WWW-Authenticate",AuthenticationInfo:"Authentication-Info",X_MS_REQUEST_ID:"x-ms-request-id",X_MS_HTTP_VERSION:"x-ms-httpver"},ki={ACTIVE_ACCOUNT_FILTERS:"active-account-filters"},Ue={COMMON:"common",ORGANIZATIONS:"organizations",CONSUMERS:"consumers"},Xr={ACCESS_TOKEN:"access_token",XMS_CC:"xms_cc"},K={LOGIN:"login",SELECT_ACCOUNT:"select_account",CONSENT:"consent",NONE:"none",CREATE:"create",NO_SESSION:"no_session"};var an={CODE:"code",IDTOKEN_TOKEN:"id_token token",IDTOKEN_TOKEN_REFRESHTOKEN:"id_token token refresh_token"},Ge={QUERY:"query",FRAGMENT:"fragment"},js={QUERY:"query",FRAGMENT:"fragment",FORM_POST:"form_post"},cn={IMPLICIT_GRANT:"implicit",AUTHORIZATION_CODE_GRANT:"authorization_code",CLIENT_CREDENTIALS_GRANT:"client_credentials",RESOURCE_OWNER_PASSWORD_GRANT:"password",REFRESH_TOKEN_GRANT:"refresh_token",DEVICE_CODE_GRANT:"device_code",JWT_BEARER:"urn:ietf:params:oauth:grant-type:jwt-bearer"},Zr={MSSTS_ACCOUNT_TYPE:"MSSTS",ADFS_ACCOUNT_TYPE:"ADFS",MSAV1_ACCOUNT_TYPE:"MSA",GENERIC_ACCOUNT_TYPE:"Generic"},st={CACHE_KEY_SEPARATOR:"-",CLIENT_INFO_SEPARATOR:"."},Q={ID_TOKEN:"IdToken",ACCESS_TOKEN:"AccessToken",ACCESS_TOKEN_WITH_AUTH_SCHEME:"AccessToken_With_AuthScheme",REFRESH_TOKEN:"RefreshToken"};var ln="appmetadata",Jc="client_info",rr="1",eo={CACHE_KEY:"authority-metadata",REFRESH_TIME_SECONDS:3600*24}
1,he={CONFIG:"config",CACHE:"cache",NETWORK:"network",HARDCODED_VALUES:"hardcoded_values"},te={SCHEMA_VERSION:5,MAX_LAST_HEADER_BYTES:330,MAX_CACHED_ERRORS:50,CACHE_KEY:"server-telemetry",CATEGORY_SEPARATOR:"|",VALUE_SEPARATOR:",",OVERFLOW_TRUE:"1",OVERFLOW_FALSE:"0",UNKNOWN_ERROR:"unknown_error"},N={BEARER:"Bearer",POP:"pop",SSH:"ssh-cert"},at={DEFAULT_THROTTLE_TIME_SECONDS:60,DEFAULT_MAX_THROTTLE_TIME_SECONDS:3600,THROTTLING_PREFIX:"throttling",X_MS_LIB_CAPABILITY_VALUE:"retry-after, h429"},Ri={INVALID_GRANT_ERROR:"invalid_grant",CLIENT_MISMATCH_ERROR:"client_mismatch"},_i={username:"username",password:"password"},or={FAILED_AUTO_DETECTION:"1",INTERNAL_CACHE:"2",ENVIRONMENT_VARIABLE:"3",IMDS:"4"},bi={CONFIGURED_NO_AUTO_DETECTION:"2",AUTO_DETECTION_REQUESTED_SUCCESSFUL:"4",AUTO_DETECTION_REQUESTED_FAILED:"5"},qe={NOT_APPLICABLE:"0",FORCE_REFRESH_OR_CLAIMS:"1",NO_CACHED_ACCESS_TOKEN:"2",CACHED_ACCESS_TOKEN_EXPIRED:"3",PROACTIVELY_REFRESHED:"4"},Pi={Jwt:"JWT",Jwk:"JWK",Pop:"pop"};var dn=300;var Pt={};ye(Pt,{postRequestFailed:()=>un,unexpectedError:()=>hn});var hn="unexpected_error",un="post_request_failed";var Oi={[hn]:"Unexpected error in authentication.",[un]:"Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details."},Xc={unexpectedError:{code:hn,desc:Oi[hn]},postRequestFailed:{code:un,desc:Oi[un]}},v=class n extends Error{constructor(e,t,r){let o=t?`${e}: ${t}`:e;super(o),Object.setPrototypeOf(this,n.prototype),this.errorCode=e||g.EMPTY_STRING,this.errorMessage=t||g.EMPTY_STRING,this.subError=r||g.EMPTY_STRING,this.name="AuthError"}setCorrelationId(e){this.correlationId=e}};function to(n,e){return new v(n,e?`${Oi[n]} ${e}`:Oi[n])}var re={};ye(re,{authTimeNotFound:()=>ct,authorizationCodeMissingFromServerResponse:()=>yr,bindingKeyNotRemoved:()=>Sn,cannotAppendScopeSet:()=>gr,cannotRemoveEmptyScope:()=>pr,clientInfoDecodingError:()=>Ot,clientInfoEmptyError:()=>nr,deviceCodeExpired:()=>fn,deviceCodePollingCancelled:()=>gn,deviceCodeUnknownError:()=>Cn,emptyInputScopeSet:()=>Ut,endSessionEndpointNotSupported:()=>Ar,endpointResolutionError:()=>ue,hashNotDeserialized:()=>cr,invalidAssertion:()=>Tn,invalidCacheEnvironment:()=>
1dt,invalidCacheRecord:()=>fr,invalidClientCredential:()=>En,invalidState:()=>De,keyIdMissing:()=>Tr,maxAgeTranspired:()=>hr,methodNotImplemented:()=>R,missingTenantIdError:()=>kn,multipleMatchingAccounts:()=>pn,multipleMatchingAppMetadata:()=>ur,multipleMatchingTokens:()=>mn,nestedAppAuthBridgeDisabled:()=>Rn,networkError:()=>sr,noAccountFound:()=>yn,noAccountInSilentRequest:()=>lt,noCryptoObject:()=>Dt,noNetworkConnectivity:()=>vn,nonceMismatch:()=>dr,nullOrEmptyToken:()=>ir,openIdConfigError:()=>ar,platformBrokerError:()=>_n,requestCannotBeMade:()=>mr,stateMismatch:()=>lr,stateNotFound:()=>Mt,tokenClaimsCnfRequiredForSignedJwt:()=>Cr,tokenParsingError:()=>Nt,tokenRefreshRequired:()=>ht,unexpectedCredentialType:()=>An,userCanceled:()=>wn,userTimeoutReached:()=>In});var Ot="client_info_decoding_error",nr="client_info_empty_error",Nt="token_parsing_error",ir="null_or_empty_token",ue="endpoints_resolution_error",sr="network_error",ar="openid_config_error",cr="hash_not_deserialized",De="invalid_state",lr="state_mismatch",Mt="state_not_found",dr="nonce_mismatch",ct="auth_time_not_found",hr="max_age_transpired",mn="multiple_matching_tokens",pn="multiple_matching_accounts",ur="multiple_matching_appMetadata",mr="request_cannot_be_made",pr="cannot_remove_empty_scope",gr="cannot_append_scopeset",Ut="empty_input_scopeset",gn="device_code_polling_cancelled",fn="device_code_expired",Cn="device_code_unknown_error",lt="no_account_in_silent_request",fr="invalid_cache_record",dt="invalid_cache_environment",yn="no_account_found",Dt="no_crypto_object",An="unexpected_credential_type",Tn="invalid_assertion",En="invalid_client_credential",ht="token_refresh_required",In="user_timeout_reached",Cr="token_claims_cnf_required_for_signedjwt",yr="authorization_code_missing_from_server_response",Sn="binding_key_not_removed",Ar="end_session_endpoint_not_supported",Tr="key_id_missing",vn="no_network_connectivity",wn="user_canceled",kn="missing_tenant_id_error",R="method_not_implemented",Rn="nested_app_auth_bridge_disabled",_n="platform_broker_error";var w={[Ot]:"The client info could not be parsed/decoded correctly",[nr]:"The client info was empty",[Nt]:"Token cannot be parsed",[ir]:"The token is null or empty",[ue]:"Endpoints cannot be resolved",[sr]:"Network request failed",[ar]:"Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints.",[cr]:"The hash parameters could not be deserialized",[De]:"State was not the expected format",[lr]:"State mismatch error",[Mt]:"State not found",[dr]:"Nonce mismatch error",[ct]:"Max Age was requested and the ID token is missing the auth_time variable. auth_time is an optional claim and is not enabled by default - it must be enabled. See https://aka.ms/msaljs/optional-claims for more information.",[hr]:"Max Age is set to 0, or too much time has elapsed since the last end-user authentication.",[mn]:"The cache contains multiple tokens satisfying the requirements. Call AcquireToken again providing more requirements such as authority or account.",[pn]:"The cache contains multiple accounts satisfying the given parameters. Please pass more info to obtain the correct account",[ur]:"The cache contains multiple appMetadata satisfying the given parameters. Please pass more info to obtain the correct appMetadata",[mr]:"Token request cannot be made without authorization code or refresh token.",[pr]:"Cannot remove null or empty scope from ScopeSet",[gr]:"Cannot append ScopeSet",[Ut]:"Empty input ScopeSet cannot be processed",[gn]:"Caller has cancelled token endpoint polling during device code flow by setting DeviceCodeRequest.cancel = true.",[fn]:"Device code is expired.",[Cn]:"Device code stopped polling for unknown reasons.",[lt]:"Please pass an account object, silent flow is not supported without account information",[fr]:"Cache record object was null or undefined.",[dt]:"Invalid environment when attempting to create cache entry",[yn]:"No account found in cache for given key.",[Dt]:"No crypto object detected.",[An]:"Unexpected credential type.",[Tn]:"Client assertion must meet requirements described
1in https://tools.ietf.org/html/rfc7515",[En]:"Client credential (secret, certificate, or assertion) must not be empty when creating a confidential client. An application should at most have one credential",[ht]:"Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.",[In]:"User defined timeout for device code polling reached",[Cr]:"Cannot generate a POP jwt if the token_claims are not populated",[yr]:"Server response does not contain an authorization code to proceed",[Sn]:"Could not remove the credential's binding key from storage.",[Ar]:"The provided authority does not support logout",[Tr]:"A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key.",[vn]:"No network connectivity. Check your internet connection.",[wn]:"User cancelled the flow.",[kn]:"A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",[R]:"This method has not been implemented",[Rn]:"The nested app auth bridge is disabled",[_n]:"An error occurred in the native broker. See the platformBrokerError property for details."},Zc={clientInfoDecodingError:{code:Ot,desc:w[Ot]},clientInfoEmptyError:{code:nr,desc:w[nr]},tokenParsingError:{code:Nt,desc:w[Nt]},nullOrEmptyToken:{code:ir,desc:w[ir]},endpointResolutionError:{code:ue,desc:w[ue]},networkError:{code:sr,desc:w[sr]},unableToGetOpenidConfigError:{code:ar,desc:w[ar]},hashNotDeserialized:{code:cr,desc:w[cr]},invalidStateError:{code:De,desc:w[De]},stateMismatchError:{code:lr,desc:w[lr]},stateNotFoundError:{code:Mt,desc:w[Mt]},nonceMismatchError:{code:dr,desc:w[dr]},authTimeNotFoundError:{code:ct,desc:w[ct]},maxAgeTranspired:{code:hr,desc:w[hr]},multipleMatchingTokens:{code:mn,desc:w[mn]},multipleMatchingAccounts:{code:pn,desc:w[pn]},multipleMatchingAppMetadata:{code:ur,desc:w[ur]},tokenRequestCannotBeMade:{code:mr,desc:w[mr]},removeEmptyScopeError:{code:pr,desc:w[pr]},appendScopeSetError:{code:gr,desc:w[gr]},emptyInputScopeSetError:{code:Ut,desc:w[Ut]},DeviceCodePollingCancelled:{code:gn,desc:w[gn]},DeviceCodeExpired:{code:fn,desc:w[fn]},DeviceCodeUnknownError:{code:Cn,desc:w[Cn]},NoAccountInSilentRequest:{code:lt,desc:w[lt]},invalidCacheRecord:{code:fr,desc:w[fr]},invalidCacheEnvironment:{code:dt,desc:w[dt]},noAccountFound:{code:yn,desc:w[yn]},noCryptoObj:{code:Dt,desc:w[Dt]},unexpectedCredentialType:{code:An,desc:w[An]},invalidAssertion:{code:Tn,desc:w[Tn]},invalidClientCredential:{code:En,desc:w[En]},tokenRefreshRequired:{code:ht,desc:w[ht]},userTimeoutReached:{code:In,desc:w[In]},tokenClaimsRequired:{code:Cr,desc:w[Cr]},noAuthorizationCodeFromServer:{code:yr,desc:w[yr]},bindingKeyNotRemovedError:{code:Sn,desc:w[Sn]},logoutNotSupported:{code:Ar,desc:w[Ar]},keyIdMissing:{code:Tr,desc:w[Tr]},noNetworkConnectivity:{code:vn,desc:w[vn]},userCanceledError:{code:wn,desc:w[wn]},missingTenantIdError:{code:kn,desc:w[kn]},nestedAppAuthBridgeDisabled:{code:Rn,desc:w[Rn]},platformBrokerError:{code:_n,desc:w[_n]}},bn=class n extends v{constructor(e,t){super(e,t?`${w[e]}: ${t}`:w[e]),this.name="ClientAuthError",Object.setPrototypeOf(this,n.prototype)}};function f(n,e){return new bn(n,e)}var Lt={createNewGuid:()=>{throw f(R)},base64Decode:()=>{throw f(R)},base64Encode:()=>{throw f(R)},base64UrlEncode:()=>{throw f(R)},encodeKid:()=>{throw f(R)},getPublicKeyThumbprint(){return d(this,null,function*(){throw f(R)})},removeTokenBindingKey(){return d(this,null,function*(){throw f(R)})},clearKeystore(){return d(this,null,function*(){throw f(R)})},signJwt(){return d(this,null,function*(){throw f(R)})},hashString(){return d(this,null,function*(){throw f(R)})}};var U=function(n){return n[n.Error=0]="Error",n[n.Warning=1]="Warning",n[n.Info=2]="Info",n[n.Verbose=3]="Verbose",n[n.Trace=4]="Trace",n}(U||{}),me=class n{constructor(e,t,r){this.level=U.Info;let o=()=>{},i=e||n.createDefaultLoggerOptions();this.localCallback=i.loggerCallback||o,this.piiLoggingEnabled=i.piiLoggingEnabled||!1,this.level=typeof i.logLevel=="number"?i.logLevel:U.Info,this.correlationId=i.correlationId||g.EMPTY_STRING,this.packageName=t||g.EMPTY_STRING,this.packageVersion=r||g.EMPTY_STRING}static createDefaultLoggerOptions(){return{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:U.Info}}clone(e,t,r){return new n({loggerCallback:this.localCallback,piiLoggingEnabled:this.piiLoggingEnabled,logLevel:this.level,correlationId:r||this.correlationId},e,t)}logMessage(e,t){if(t.logLevel>this.level||!this.piiLoggingEnabled&&t.containsPii)return;let i=`${`[${new Date().toUTCString()}] : [${t.correlationId||this.correlationId||""}]`} : ${this.packageName}@${this.packageVersion} : ${U[t.logLevel]} - ${e}`;this.executeCallback(t.logLevel,i,t.containsPii||!1)}executeCallback(e,t,r){this.localCallback&&this.localCallback(e,t,r)}error(e,t){this.logMessage(e,{logLevel:U.Error,containsPii:!1,correlationId:t||g.EMPTY_STRING})}errorPii(e,t){this.logMessage(e,{logLevel:U.Error,containsPii:!0,correlationId:t||g.EMPTY_STRING})}warning(e,t){this.logMessage(e,{logLevel:U.Warning,containsPii:!1,correlationId:t||g.EMPTY_STRING})}warningPii(e,t){this.logMessage(e,{logLevel:U.Warning,containsPii:!0,correlationId:t||g.EMPTY_STRING})}info(e,t){this.logMessage(e,{logLevel:U.Info,containsPii:!1,correlationId:t||g.EMPTY_STRING})}infoPii(e,t){this.logMessage(e,{logLevel:U.Info,containsPii:!0,correlationId:t||g.EMPTY_STRING})}verbose(e,t){this.logMessage(e,{logLevel:U.Verbose,containsPii:!1,correlationId:t||g.EMPTY_STRING})}verbosePii(e,t){this.logMessage(e,{logLevel:U.Verbose,containsPii:!0,correlationId:t||g.EMPTY_STRING})}trace(e,t){this.logMessage(e,{logLevel:U.Trace,containsPii:!1,correlationId:t||g.EMPTY_STRING})}tracePii(e,t){this.logMessage(e,{logLevel:U.Trace,containsPii:!0,correlationId:t||g.EMPTY_STRING})}isPiiLoggingEnabled(){return this.piiLoggingEnabled||!1}};var Ni="@azure/msal-common",ro="15.17.0";var xt={None:"none",AzurePublic:"https://login.microsoftonline.com",AzurePpe:"https://login.windows-ppe.net",AzureChina:"https://login.chinacloudapi.cn",AzureGermany:"https://login.microsoftonline.de",AzureUsGovernment:"https://login.microsoftonline.us"};var ce={};ye(ce,{authorityMismatch:()=>xn,authorityUriInsecure:()=>Ir,cannotAllowPlatformBroker:()=>Ln,cannotSetOIDCOptions:()=>Dn,claimsRequestParsingError:()=>Pn,emptyInputScopesError:()=>vr,invalidAuthenticationHeader:()=>Un,invalidAuthorityMetadata:()=>_r,invalidAuthorizePostBodyParameters:()=>Fn,invalidClaims:()=>
1Ht,invalidCloudDiscoveryMetadata:()=>Ft,invalidCodeChallengeMethod:()=>On,invalidPlatformBrokerConfiguration:()=>Bn,invalidRequestMethodForEAR:()=>Hn,logoutRequestEmpty:()=>kr,missingNonceAuthenticationHeader:()=>Mn,missingSshJwk:()=>ut,missingSshKid:()=>Nn,pkceParamsMissing:()=>Rr,redirectUriEmpty:()=>Er,tokenRequestEmpty:()=>wr,untrustedAuthority:()=>br,urlEmptyError:()=>Sr,urlParseError:()=>ze});var Er="redirect_uri_empty",Pn="claims_request_parsing_error",Ir="authority_uri_insecure",ze="url_parse_error",Sr="empty_url_error",vr="empty_input_scopes_error",Ht="invalid_claims",wr="token_request_empty",kr="logout_request_empty",On="invalid_code_challenge_method",Rr="pkce_params_missing",Ft="invalid_cloud_discovery_metadata",_r="invalid_authority_metadata",br="untrusted_authority",ut="missing_ssh_jwk",Nn="missing_ssh_kid",Mn="missing_nonce_authentication_header",Un="invalid_authentication_header",Dn="cannot_set_OIDCOptions",Ln="cannot_allow_platform_broker",xn="authority_mismatch",Hn="invalid_request_method_for_EAR",Fn="invalid_authorize_post_body_parameters",Bn="invalid_platform_broker_configuration";var x={[Er]:"A redirect URI is required for all calls, and none has been set.",[Pn]:"Could not parse the given claims request object.",[Ir]:"Authority URIs must use https. Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",[ze]:"URL could not be parsed into appropriate segments.",[Sr]:"URL was empty or null.",[vr]:"Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",[Ht]:"Given claims parameter must be a stringified JSON object.",[wr]:"Token request was empty and not found in cache.",[kr]:"The logout request was null or undefined.",[On]:'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',[Rr]:"Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",[Ft]:"Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",[_r]:"Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",[br]:"The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",[ut]:"Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",[Nn]:"Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",[Mn]:"Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",[Un]:"Invalid authentication header provided",[Dn]:"Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",[Ln]:"Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",[xn]:"Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",[Fn]:"Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",[Hn]:"Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",[Bn]:"Invalid platform broker configuration. `allowPlatformBrokerWithDOM` can only be enabled when `allowPlatformBroker` is enabled."},el={redirectUriNotSet:{code:Er,desc:x[Er]},claimsRequestParsingError:{code:Pn,desc:x[Pn]},authorityUriInsecure:{code:Ir,desc:x[Ir]},urlParseError:{code:ze,desc:x[ze]},urlEmptyError:{code:Sr,desc:x[Sr]},emptyScopesError:{code:vr,desc:x[vr]},invalidClaimsRequest:{code:Ht,desc:x[Ht]},tokenRequestEmptyError:{code:wr,desc:x[wr]},logoutRequestEmptyError:{code:kr,desc:x[kr]},invalidCodeChallengeMethod:{code:On,desc:x[On]},invalidCodeChallengeParams:{code:Rr,desc:x[Rr]},invalidCloudDiscoveryMetadata:{code:Ft,desc:x[Ft]},invalidAuthorityMetadata:{code:_r,desc:x[_r]},untrustedAuthority:{code:br,desc:x[br]},missingSshJwk:{code:ut,desc:x[ut]},missingSshKid:{code:Nn,desc:x[Nn]},missingNonceAuthenticationHeader:{code:Mn,desc:x[Mn]},invalidAuthenticationHeader:{code:Un,desc:x[Un]},cannotSetOIDCOptions:{code:Dn,desc:x[Dn]},cannotAllowPlatformBroker:{code:Ln,desc:x[Ln]},authorityMismatch:{code:xn,desc:x[xn]},invalidAuthorizePostBodyParameters:{code:Fn,desc:x[Fn]},invalidRequestMethodForEAR:{code:Hn,desc:x[Hn]},invalidPlatformBrokerConfiguration:{code:Bn,desc:x[Bn]}},Kn=class n extends v{constructor(e){super(e,x[e]),this.name="ClientConfigurationError",Object.setPrototypeOf(this,n.prototype)}};function M(n){return new Kn(n)}var L=class{static isEmptyObj(e){if(e)try{let t=JSON.parse(e);return Object.keys(t).length===0}catch{}return!0}static startsWith(e,t){return e.indexOf(t)===0}static endsWith(e,t){return e.length>=t.length&&e.lastIndexOf(t)===e.length-t.length}static queryStringToObject(e){let t={},r=e.split("&"),o=i=>decodeURIComponent(i.replace(/\+/g," "));return r.forEach(i=>
1{if(i.trim()){let[s,a]=i.split(/=(.+)/g,2);s&&a&&(t[o(s)]=o(a))}}),t}static trimArrayEntries(e){return e.map(t=>t.trim())}static removeEmptyStringsFromArray(e){return e.filter(t=>!!t)}static jsonParseHelper(e){try{return JSON.parse(e)}catch{return null}}static matchPattern(e,t){return new RegExp(e.replace(/\\/g,"\\\\").replace(/\*/g,"[^ ]*").replace(/\?/g,"\\?")).test(t)}static matchPatternStrict(e,t,r){let o=r?.component,i=e.replace(/[.+^${}()|[\]\\*?]/g,"\\$&");return o==="host"?i=i.replace(/\\\*/g,"[^.]*"):i=i.replace(/\\\*/g,".*"),new RegExp(`^${i}$`).test(t)}};var z=class n{constructor(e){let t=e?L.trimArrayEntries([...e]):[],r=t?L.removeEmptyStringsFromArray(t):[];if(!r||!r.length)throw M(vr);this.scopes=new Set,r.forEach(o=>this.scopes.add(o))}static fromString(e){let r=(e||g.EMPTY_STRING).split(" ");return new n(r)}static createSearchScopes(e){let t=e&&e.length>0?e:[...Ie],r=new n(t);return r.containsOnlyOIDCScopes()?r.removeScope(g.OFFLINE_ACCESS_SCOPE):r.removeOIDCScopes(),r}containsScope(e){let t=this.printScopesLowerCase().split(" "),r=new n(t);return e?r.scopes.has(e.toLowerCase()):!1}containsScopeSet(e){return!e||e.scopes.size<=0?!1:this.scopes.size>=e.scopes.size&&e.asArray().every(t=>this.containsScope(t))}containsOnlyOIDCScopes(){let e=0;return Vs.forEach(t=>{this.containsScope(t)&&(e+=1)}),this.scopes.size===e}appendScope(e){e&&this.scopes.add(e.trim())}appendScopes(e){try{e.forEach(t=>this.appendScope(t))}catch{throw f(gr)}}removeScope(e){if(!e)throw f(pr);this.scopes.delete(e.trim())}removeOIDCScopes(){Vs.forEach(e=>{this.scopes.delete(e)})}unionScopeSets(e){if(!e)throw f(Ut);let t=new Set;return e.scopes.forEach(r=>t.add(r.toLowerCase())),this.scopes.forEach(r=>t.add(r.toLowerCase())),t}intersectingScopeSets(e){if(!e)throw f(Ut);e.containsOnlyOIDCScopes()||e.removeOIDCScopes();let t=this.unionScopeSets(e),r=e.getScopeCount(),o=this.getScopeCount();return t.size<o+r}getScopeCount(){return this.scopes.size}asArray(){let e=[];return this.scopes.forEach(t=>e.push(t)),e}printScopes(){return this.scopes?this.asArray().join(" "):g.EMPTY_STRING}printScopesLowerCase(){return this.printScopes().toLowerCase()}};function oo(n,e){if(!n)throw f(nr);try{let t=e(n);return JSON.parse(t)}catch{throw f(Ot)}}function $e(n){if(!n)throw f(Ot);let e=n.split(st.CLIENT_INFO_SEPARATOR,2);return{uid:e[0],utid:e.length<2?g.EMPTY_STRING:e[1]}}function Ws(n,e){return!!n&&!!e&&n===e.split(".")[1]}function Ve(n,e,t,r){if(r){let{oid:o,sub:i,tid:s,name:a,tfp:l,acr:h,preferred_username:m,upn:p,login_hint:C}=r,T=s||l||h||"";return{tenantId:T,localAccountId:o||i||"",name:a,username:m||p||"",loginHint:C,isHomeTenant:Ws(T,n)}}else return{tenantId:t,localAccountId:e,username:"",isHomeTenant:Ws(t,n)}}function Pr(n,e,t,r){let o=n;if(e){let i=e,{isHomeTenant:a}=i,l=nt(i,["isHomeTenant"]);o=y(y({},n),l)}if(t){let s=Ve(n.homeAccountId,n.localAccountId,n.tenantId,t),{isHomeTenant:a}=s,l=nt(s,["isHomeTenant"]);return o=S(y(y({},o),l),{idTokenClaims:t,idToken:r}),o}return o}var pe={Default:0,Adfs:1,Dsts:2,Ciam:3};function Or(n){return n&&(n.tid||n.tfp||n.acr)||null}var H={AAD:"AAD",OIDC:"OIDC",EAR:"EAR"};var D=class n{static getAccountInfo(e){let t=e.tenantProfiles||[];return t.length===0&&e.realm&&e.localAccountId&&t.push(Ve(e.homeAccountId,e.localAccountId,e.realm)),{homeAccountId:e.homeAccountId,environment:e.environment,tenantId:e.realm,username:e.username,localAccountId:e.localAccountId,loginHint:e.loginHint,name:e.name,nativeAccountId:e.nativeAccountId,authorityType:e.authorityType,tenantProfiles:new Map(t.map(r=>[r.tenantId,r])),dataBoundary:e.dataBoundary}}isSingleTenant(){return!this.tenantProfiles}static createAccount(e,t,r){let o=new n;t.authorityType===pe.Adfs?o.authorityType=Zr.ADFS_ACCOUNT_TYPE:t.protocolMode===H.OIDC?o.authorityType=Zr.GENERIC_ACCOUNT_TYPE:o.authorityType=Zr.MSSTS_ACCOUNT_TYPE;let i;e.clientInfo&&r&&(i=oo(e.clientInfo,r),i.xms_tdbr&&(o.dataBoundary=i.xms_tdbr==="EU"?"EU":"None")),o.clientInfo=e.clientInfo,o.homeAccountId=e.homeAccountId,o.nativeAccountId=e.nativeAccountId;let s=e.environment||t&&t.getPreferredCache();if(!s)throw f(dt);o.environment=s,o.realm=i?.utid||Or(e.idTokenClaims)||"",o.localAccountId=i?.uid||e.idTokenClaims?.oid||e.idTokenClaims?.sub||"";
1let a=e.idTokenClaims?.preferred_username||e.idTokenClaims?.upn,l=e.idTokenClaims?.emails?e.idTokenClaims.emails[0]:null;if(o.username=a||l||"",o.loginHint=e.idTokenClaims?.login_hint,o.name=e.idTokenClaims?.name||"",o.cloudGraphHostName=e.cloudGraphHostName,o.msGraphHost=e.msGraphHost,e.tenantProfiles)o.tenantProfiles=e.tenantProfiles;else{let h=Ve(e.homeAccountId,o.localAccountId,o.realm,e.idTokenClaims);o.tenantProfiles=[h]}return o}static createFromAccountInfo(e,t,r){let o=new n;o.authorityType=e.authorityType||Zr.GENERIC_ACCOUNT_TYPE,o.homeAccountId=e.homeAccountId,o.localAccountId=e.localAccountId,o.nativeAccountId=e.nativeAccountId,o.realm=e.tenantId,o.environment=e.environment,o.username=e.username,o.name=e.name,o.loginHint=e.loginHint,o.cloudGraphHostName=t,o.msGraphHost=r;let i=Array.from(e.tenantProfiles?.values()||[]);return i.length===0&&e.tenantId&&e.localAccountId&&i.push(Ve(e.homeAccountId,e.localAccountId,e.tenantId,e.idTokenClaims)),o.tenantProfiles=i,o.dataBoundary=e.dataBoundary,o}static generateHomeAccountId(e,t,r,o,i){if(!(t===pe.Adfs||t===pe.Dsts)){if(e)try{let s=oo(e,o.base64Decode);if(s.uid&&s.utid)return`${s.uid}.${s.utid}`}catch{}r.warning("No client info in response")}return i?.sub||""}static isAccountEntity(e){return e?e.hasOwnProperty("homeAccountId")&&e.hasOwnProperty("environment")&&e.hasOwnProperty("realm")&&e.hasOwnProperty("localAccountId")&&e.hasOwnProperty("username")&&e.hasOwnProperty("authorityType"):!1}static accountInfoIsEqual(e,t,r){if(!e||!t)return!1;let o=!0;if(r){let i=e.idTokenClaims||{},s=t.idTokenClaims||{};o=i.iat===s.iat&&i.nonce===s.nonce}return e.homeAccountId===t.homeAccountId&&e.localAccountId===t.localAccountId&&e.username===t.username&&e.tenantId===t.tenantId&&e.loginHint===t.loginHint&&e.environment===t.environment&&e.nativeAccountId===t.nativeAccountId&&o}};var Y={};ye(Y,{checkMaxAge:()=>Gn,extractTokenClaims:()=>mt,getJWSPayload:()=>tl,isKmsi:()=>Qs});function mt(n,e){let t=tl(n);try{let r=e(t);return JSON.parse(r)}catch{throw f(Nt)}}function Qs(n){if(!n.signin_state)return!1;let e=["kmsi","dvc_dmjd"];return n.signin_state.some(r=>e.includes(r.trim().toLowerCase()))}function tl(n){if(!n)throw f(ir);let t=/^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/.exec(n);if(!t||t.length<4)throw f(Nt);return t[2]}function Gn(n,e){if(e===0||Date.now()-3e5>n+e)throw f(hr)}var We={};ye(We,{getDeserializedResponse:()=>Ys,mapToQueryString:()=>je,normalizeUrlForComparison:()=>Nd,stripLeadingHashOrQuery:()=>ol});function rl(n){if(!n)return n;let e=n.toLowerCase();return L.endsWith(e,"?")?e=e.slice(0,-1):L.endsWith(e,"?/")&&(e=e.slice(0,-2)),L.endsWith(e,"/")||(e+="/"),e}function ol(n){return n.startsWith("#/")?n.substring(2):n.startsWith("#")||n.startsWith("?")?n.substring(1):n}function Ys(n){if(!n||n.indexOf("=")<0)return null;try{let e=ol(n),t=Object.fromEntries(new URLSearchParams(e));if(t.code||t.ear_jwe||t.error||t.error_description||t.state)return t}catch{throw f(cr)}return null}function je(n,e=!0,t){let r=new Array;return n.forEach((o,i)=>{!e&&t&&i in t?r.push(`${i}=${o}`):r.push(`${i}=${encodeURIComponent(o)}`)}),r.join("&")}function Nd(n){if(!n)return n;let e=n.split("#")[0];try{let t=new URL(e),r=t.origin+t.pathname+t.search;return rl(r)}catch{return rl(e)}}var _=class n{get urlString(){return this._urlString}constructor(e){if(this._urlString=e,!this._urlString)throw M(Sr);e.includes("#")||(this._urlString=n.canonicalizeUri(e))}static canonicalizeUri(e){if(e){let t=e.toLowerCase();return L.endsWith(t,"?")?t=t.slice(0,-1):L.endsWith(t,"?/")&&(t=t.
1slice(0,-2)),L.endsWith(t,"/")||(t+="/"),t}return e}validateAsUri(){let e;try{e=this.getUrlComponents()}catch{throw M(ze)}if(!e.HostNameAndPort||!e.PathSegments)throw M(ze);if(!e.Protocol||e.Protocol.toLowerCase()!=="https:")throw M(Ir)}static appendQueryString(e,t){return t?e.indexOf("?")<0?`${e}?${t}`:`${e}&${t}`:e}static removeHashFromUrl(e){return n.canonicalizeUri(e.split("#")[0])}replaceTenantPath(e){let t=this.getUrlComponents(),r=t.PathSegments;return e&&r.length!==0&&(r[0]===Ue.COMMON||r[0]===Ue.ORGANIZATIONS)&&(r[0]=e),n.constructAuthorityUriFromObject(t)}getUrlComponents(){let e=RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?"),t=this.urlString.match(e);if(!t)throw M(ze);let r={Protocol:t[1],HostNameAndPort:t[4],AbsolutePath:t[5],QueryString:t[7]},o=r.AbsolutePath.split("/");return o=o.filter(i=>i&&i.length>0),r.PathSegments=o,r.QueryString&&r.QueryString.endsWith("/")&&(r.QueryString=r.QueryString.substring(0,r.QueryString.length-1)),r}static getDomainFromUrl(e){let t=RegExp("^([^:/?#]+://)?([^/?#]*)"),r=e.match(t);if(!r)throw M(ze);return r[2]}static getAbsoluteUrl(e,t){if(e[0]===g.FORWARD_SLASH){let o=new n(t).getUrlComponents();return o.Protocol+"//"+o.HostNameAndPort+e}return e}static constructAuthorityUriFromObject(e){return new n(e.Protocol+"//"+e.HostNameAndPort+"/"+e.PathSegments.join("/"))}static hashContainsKnownProperties(e){return!!Ys(e)}};var il={endpointMetadata:{"login.microsoftonline.com":{token_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.com/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.com/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/logout"},"login.chinacloudapi.cn":{token_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.chinacloudapi.cn/{tenantid}/discovery/v2.0/keys",issuer:"https://login.partner.microsoftonline.cn/{tenantid}/v2.0",authorization_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/logout"},"login.microsoftonline.us":{token_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.us/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.us/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/logout"},"login.sovcloud-identity.fr":{token_endpoint:"https://login.sovcloud-identity.fr/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.sovcloud-identity.fr/{tenantid}/discovery/v2.0/keys",issuer:"https://login.sovcloud-identity.fr/{tenantid}/v2.0",authorization_endpoint:"https://login.sovcloud-identity.fr/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.sovcloud-identity.fr/{tenantid}/oauth2/v2.0/logout"},"login.sovcloud-identity.de":{token_endpoint:"https://login.sovcloud-identity.de/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.sovcloud-identity.de/{tenantid}/discovery/v2.0/keys",issuer:"https://login.sovcloud-identity.de/{tenantid}/v2.0",authorization_endpoint:"https://login.sovcloud-identity.de/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.sovcloud-identity.de/{tenantid}/oauth2/v2.0/logout"},"login.sovcloud-identity.sg":{token_endpoint:"https://login.sovcloud-identity.sg/common/oauth2/v2.0/token",jwks_uri:"https://login.sovcloud-identity.sg/common/discovery/v2.0/keys",issuer:"https://login.sovcloud-identity.sg/{tenantid}/v2.0",authorization_endpoint:"https://login.sovcloud-identity.sg/common/oauth2/v2.0/authorize",end_session_endpoint:"https://login.sovcloud-identity.sg/common/oauth2/v2.0/logout"}},instanceDiscoveryMetadata:{metadata:[{preferred_network:"login.microsoftonline.com",preferred_cache:"login.windows.net",aliases:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{preferred_network:"login.partner.microsoftonline.cn",preferred_cache:"login.partner.microsoftonline.cn",aliases:["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{preferred_network:"login.microsoftonline.de",preferred_cache:"login.microsoftonline.de",aliases:["login.microsoftonline.de"]},{preferred_network:"login.microsoftonline.us",preferred_cache:"login.microsoftonline.us",aliases:["login.microsoftonline.us","login.usgovcloudapi.net"]},{preferred_network:"login-us.microsoftonline.com",preferred_cache:"login-us.microsoftonline.com",aliases:["login-us.microsoftonline.com"]},{preferred_network:"login.sovcloud-identity.fr",preferred_cache:"login.sovcloud-identity.fr",aliases:["login.sovcloud-identity.fr"]},{preferred_network:"login.sovcloud-identity.de",preferred_cache:"login.sovcloud-identity.de",aliases:["login.sovcloud-identity.de"]},{preferred_network:"login.sovcloud-identity.sg",preferred_cache:"login.sovcloud-identity.sg",aliases:["login.sovcloud-identity.sg"]}]}},Js=il.endpointMetadata,Xs=il.instanceDiscoveryMetadata,Zs=new Set;Xs.metadata.forEach(n=>
1{n.aliases.forEach(e=>{Zs.add(e)})});function sl(n,e){let t,r=n.canonicalAuthority;if(r){let o=new _(r).getUrlComponents().HostNameAndPort;t=nl(o,n.cloudDiscoveryMetadata?.metadata,he.CONFIG,e)||nl(o,Xs.metadata,he.HARDCODED_VALUES,e)||n.knownAuthorities}return t||[]}function nl(n,e,t,r){if(r?.trace(`getAliasesFromMetadata called with source: ${t}`),n&&e){let o=qn(e,n);if(o)return r?.trace(`getAliasesFromMetadata: found cloud discovery metadata in ${t}, returning aliases`),o.aliases;r?.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in ${t}`)}return null}function al(n){return qn(Xs.metadata,n)}function qn(n,e){for(let t=0;t<n.length;t++){let r=n[t];if(r.aliases.includes(e))return r}return null}var $n={};ye($n,{cacheErrorUnknown:()=>zn,cacheQuotaExceeded:()=>Mi});var Mi="cache_quota_exceeded",zn="cache_error_unknown";var ea={[Mi]:"Exceeded cache storage capacity.",[zn]:"Unexpected error occurred when using cache storage."},Bt=class n extends v{constructor(e,t){let r=t||(ea[e]?ea[e]:ea[zn]);super(`${e}: ${r}`),Object.setPrototypeOf(this,n.prototype),this.name="CacheError",this.errorCode=e,this.errorMessage=r}};function no(n){return n instanceof Error?n.name==="QuotaExceededError"||n.name==="NS_ERROR_DOM_QUOTA_REACHED"||n.message.includes("exceeded the quota")?new Bt(Mi):new Bt(n.name,n.message):new Bt(zn)}var Nr=class{constructor(e,t,r,o,i){this.clientId=e,this.cryptoImpl=t,this.commonLogger=r.clone(Ni,ro),this.staticAuthorityOptions=i,this.performanceClient=o}getAllAccounts(e,t){return this.buildTenantProfiles(this.getAccountsFilteredBy(e,t),t,e)}getAccountInfoFilteredBy(e,t){if(Object.keys(e).length===0||Object.values(e).every(o=>!o))return this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null"),null;let r=this.getAllAccounts(e,t);return r.length>1?r.sort(i=>i.idTokenClaims?-1:1)[0]:r.length===1?r[0]:null}getBaseAccountInfo(e,t){let r=this.getAccountsFilteredBy(e,t);return r.length>0?D.getAccountInfo(r[0]):null}buildTenantProfiles(e,t,r){return e.flatMap(o=>this.getTenantProfilesFromAccountEntity(o,t,r?.tenantId,r))}getTenantedAccountInfoByFilter(e,t,r,o,i){let s=null,a;if(i&&!this.tenantProfileMatchesFilter(r,i))return null;let l=this.getIdToken(e,o,t,r.tenantId);return l&&(a=mt(l.secret,this.cryptoImpl.base64Decode),!this.idTokenClaimsMatchTenantProfileFilter(a,i))?null:(s=Pr(e,r,a,l?.secret),s)}getTenantProfilesFromAccountEntity(e,t,r,o){let i=D.getAccountInfo(e),s=i.tenantProfiles||new Map,a=this.getTokenKeys();if(r){let h=s.get(r);if(h)s=new Map([[r,h]]);else return[]}let l=[];return s.forEach(h=>{let m=this.getTenantedAccountInfoByFilter(i,a,h,t,o);m&&l.push(m)}),l}tenantProfileMatchesFilter(e,t){return!(t.localAccountId&&!this.matchLocalAccountIdFromTenantProfile(e,t.localAccountId)||t.name&&e.name!==t.name||t.isHomeTenant!==void 0&&e.isHomeTenant!==t.isHomeTenant)}idTokenClaimsMatchTenantProfileFilter(e,t){return!(t&&(t.localAccountId&&!this.matchLocalAccountIdFromTokenClaims(e,t.localAccountId)||t.loginHint&&!this.matchLoginHintFromTokenClaims(e,t.loginHint)||t.username&&!this.matchUsername(e.preferred_username,t.username)||t.name&&!this.matchName(e,t.name)||t.sid&&!this.matchSid(e,t.sid)))}saveCacheRecord(e,t,r,o,i){return d(this,null,function*(){if(!e)throw f(fr);try{e.account&&(yield this.setAccount(e.account,t,r,o)),e.idToken&&i?.idToken!==!1&&(yield this.setIdTokenCredential(e.idToken,t,r)),e.accessToken&&i?.accessToken!==!1&&(yield this.saveAccessToken(e.accessToken,t,r)),e.refreshToken&&i?.refreshToken!==!1&&(yield this.setRefreshTokenCredential(e.refreshToken,t,r)),e.appMetadata&&this.setAppMetadata(e.appMetadata,t)}catch(s){throw this.commonLogger?.error("CacheManager.saveCacheRecord: failed"),s instanceof v?s:no(s)}})}saveAccessToken(e,t,r){return d(this,null,function*(){let o={clientId:e.clientId,credentialType:e.credentialType,environment:e.environment,homeAccountId:e.homeAccountId,realm:e.realm,tokenType:e.tokenType,requestedClaimsHash:e.requestedClaimsHash},i=this.getTokenKeys(),s=z.fromString(e.target);i.accessToken.forEach(a=>{if(!this.accessTokenKeyMatchesFilter(a,o,!1))return;let l=this.getAccessTokenCredential(a,t);l&&this.credentialMatchesFilter(l,o)&&z.fromString(l.target).intersectingScopeSets(s)&&this.removeAccessToken(a,t)}),yield this.setAccessTokenCredential(e,t,r)})}getAccountsFilteredBy(e,t){let r=this.getAccountKeys(),o=[];return r.forEach(i=>
1{let s=this.getAccount(i,t);if(!s||e.homeAccountId&&!this.matchHomeAccountId(s,e.homeAccountId)||e.username&&!this.matchUsername(s.username,e.username)||e.environment&&!this.matchEnvironment(s,e.environment)||e.realm&&!this.matchRealm(s,e.realm)||e.nativeAccountId&&!this.matchNativeAccountId(s,e.nativeAccountId)||e.authorityType&&!this.matchAuthorityType(s,e.authorityType))return;let a={localAccountId:e?.localAccountId,name:e?.name},l=s.tenantProfiles?.filter(h=>this.tenantProfileMatchesFilter(h,a));l&&l.length===0||o.push(s)}),o}credentialMatchesFilter(e,t){return!(t.clientId&&!this.matchClientId(e,t.clientId)||t.userAssertionHash&&!this.matchUserAssertionHash(e,t.userAssertionHash)||typeof t.homeAccountId=="string"&&!this.matchHomeAccountId(e,t.homeAccountId)||t.environment&&!this.matchEnvironment(e,t.environment)||t.realm&&!this.matchRealm(e,t.realm)||t.credentialType&&!this.matchCredentialType(e,t.credentialType)||t.familyId&&!this.matchFamilyId(e,t.familyId)||t.target&&!this.matchTarget(e,t.target)||(t.requestedClaimsHash||e.requestedClaimsHash)&&e.requestedClaimsHash!==t.requestedClaimsHash||e.credentialType===Q.ACCESS_TOKEN_WITH_AUTH_SCHEME&&(t.tokenType&&!this.matchTokenType(e,t.tokenType)||t.tokenType===N.SSH&&t.keyId&&!this.matchKeyId(e,t.keyId)))}getAppMetadataFilteredBy(e){let t=this.getKeys(),r={};return t.forEach(o=>{if(!this.isAppMetadata(o))return;let i=this.getAppMetadata(o);i&&(e.environment&&!this.matchEnvironment(i,e.environment)||e.clientId&&!this.matchClientId(i,e.clientId)||(r[o]=i))}),r}getAuthorityMetadataByAlias(e){let t=this.getAuthorityMetadataKeys(),r=null;return t.forEach(o=>{if(!this.isAuthorityMetadata(o)||o.indexOf(this.clientId)===-1)return;let i=this.getAuthorityMetadata(o);i&&i.aliases.indexOf(e)!==-1&&(r=i)}),r}removeAllAccounts(e){this.getAllAccounts({},e).forEach(r=>{this.removeAccount(r,e)})}removeAccount(e,t){this.removeAccountContext(e,t);let r=this.getAccountKeys(),o=i=>i.includes(e.homeAccountId)&&i.includes(e.environment);r.filter(o).forEach(i=>{this.removeItem(i,t),this.performanceClient.incrementFields({accountsRemoved:1},t)})}removeAccountContext(e,t){let r=this.getTokenKeys(),o=i=>i.includes(e.homeAccountId)&&i.includes(e.environment);r.idToken.filter(o).forEach(i=>{this.removeIdToken(i,t)}),r.accessToken.filter(o).forEach(i=>{this.removeAccessToken(i,t)}),r.refreshToken.filter(o).forEach(i=>{this.removeRefreshToken(i,t)})}removeAccessToken(e,t){let r=this.getAccessTokenCredential(e,t);if(this.removeItem(e,t),this.performanceClient.incrementFields({accessTokensRemoved:1},t),!r||r.credentialType.toLowerCase()!==Q.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()||r.tokenType!==N.POP)return;let o=r.keyId;o&&this.cryptoImpl.removeTokenBindingKey(o).catch(()=>{this.commonLogger.error(`Failed to remove token binding key ${o}`,t),this.performanceClient?.incrementFields({removeTokenBindingKeyFailure:1},t)})}removeAppMetadata(e){return this.getKeys().forEach(r=>{this.isAppMetadata(r)&&this.removeItem(r,e)}),!0}getIdToken(e,t,r,o,i){this.commonLogger.trace("CacheManager - getIdToken called");let s={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:Q.ID_TOKEN,clientId:this.clientId,realm:o},a=this.getIdTokensByFilter(s,t,r),l=a.size;if(l<1)return this.commonLogger.info("CacheManager:getIdToken - No token found"),null;if(l>1){let h=a;if(!o){let m=new Map;a.forEach((C,T)=>{C.realm===e.tenantId&&m.set(T,C)});let p=m.size;if(p<1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result"),a.values().next().value;if(p===1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile"),m.values().next().value;h=m}return this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them"),h.forEach((m,p)=>{this.removeIdToken(p,t)}),i&&t&&i.addFields({multiMatchedID:a.size},t),null}return this.commonLogger.info("CacheManager:getIdToken - Returning ID token"),a.values().next().value}getIdTokensByFilter(e,t,r){let o=r&&r.idToken||this.getTokenKeys().idToken,i=new Map;return o.forEach(s=>{if(!this.idTokenKeyMatchesFilter(s,y({clientId:this.clientId},e)))return;let a=this.getIdTokenCredential(s,t);a&&this.credentialMatchesFilter(a,e)&&i.set(s,a)}),i}idTokenKeyMatchesFilter(e,t){let r=e.toLowerCase();return!(t.clientId&&r.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&r.indexOf(t.homeAccountId.toLowerCase())===-1)}removeIdToken(e,t){this.removeItem(e,t)}removeRefreshToken(e,t){this.removeItem(e,t)}getAccessToken(e,t,r,o){let i=t.correlationId;this.commonLogger.trace("CacheManager - getAccessToken called",i);let s=z.createSearchScopes(t.scopes),a=t.authenticationScheme||N.BEARER,l=a&&a.toLowerCase()!==N.BEARER.toLowerCase()?Q.ACCESS_TOKEN_WITH_AUTH_SCHEME:Q.ACCESS_TOKEN,h={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:l,clientId:this.clientId,realm:o||e.tenantId,target:s,tokenType:a,keyId:t.sshKid,requestedClaimsHash:t.requestedClaimsHash},m=r&&r.accessToken||this.getTokenKeys().accessToken,p=[];m.forEach(T=>{if(this.accessTokenKeyMatchesFilter(T,h,!0)){let P=this.getAccessTokenCredential(T,i);P&&this.credentialMatchesFilter(P,h)&&p.push(P)}});let C=p.length;return C<1?(this.commonLogger.info("CacheManager:getAccessToken - No token found",i),null):C>1?(this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them",i),p.forEach(T=>{this.removeAccessToken(this.generateCredentialKey(T),i)}),this.performanceClient.addFields({multiMatchedAT:p.length},i),null):(this.commonLogger.info("CacheManager:getAccessToken - Returning access token",i),p[0])}accessTokenKeyMatchesFilter(e,t,r){let o=e.toLowerCase();if(t.clientId&&o.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&o.indexOf(t.homeAccountId.toLowerCase())===-1||t.realm&&o.indexOf(t.realm.toLowerCase())===-1||t.requestedClaimsHash&&o.indexOf(t.requestedClaimsHash.toLowerCase())===-1)return!1;if(t.target){let i=t.target.asArray();for(let s=0;s<i.length;s++){if(r&&!o.includes(i[s].toLowerCase()))return!1;if(!r&&o.includes(i[s].toLowerCase()))return!0}}return!0}getAccessTokensByFilter(e,t){let r=this.getTokenKeys(),o=[];
1return r.accessToken.forEach(i=>{if(!this.accessTokenKeyMatchesFilter(i,e,!0))return;let s=this.getAccessTokenCredential(i,t);s&&this.credentialMatchesFilter(s,e)&&o.push(s)}),o}getRefreshToken(e,t,r,o,i){this.commonLogger.trace("CacheManager - getRefreshToken called");let s=t?rr:void 0,a={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:Q.REFRESH_TOKEN,clientId:this.clientId,familyId:s},l=o&&o.refreshToken||this.getTokenKeys().refreshToken,h=[];l.forEach(p=>{if(this.refreshTokenKeyMatchesFilter(p,a)){let C=this.getRefreshTokenCredential(p,r);C&&this.credentialMatchesFilter(C,a)&&h.push(C)}});let m=h.length;return m<1?(this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found."),null):(m>1&&i&&r&&i.addFields({multiMatchedRT:m},r),this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token"),h[0])}refreshTokenKeyMatchesFilter(e,t){let r=e.toLowerCase();return!(t.familyId&&r.indexOf(t.familyId.toLowerCase())===-1||!t.familyId&&t.clientId&&r.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&r.indexOf(t.homeAccountId.toLowerCase())===-1)}readAppMetadataFromCache(e){let t={environment:e,clientId:this.clientId},r=this.getAppMetadataFilteredBy(t),o=Object.keys(r).map(s=>r[s]),i=o.length;if(i<1)return null;if(i>1)throw f(ur);return o[0]}isAppMetadataFOCI(e){let t=this.readAppMetadataFromCache(e);return!!(t&&t.familyId===rr)}matchHomeAccountId(e,t){return typeof e.homeAccountId=="string"&&t===e.homeAccountId}matchLocalAccountIdFromTokenClaims(e,t){let r=e.oid||e.sub;return t===r}matchLocalAccountIdFromTenantProfile(e,t){return e.localAccountId===t}matchName(e,t){return t.toLowerCase()===e.name?.toLowerCase()}matchUsername(e,t){return!!(e&&typeof e=="string"&&t?.toLowerCase()===e.toLowerCase())}matchUserAssertionHash(e,t){return!!(e.userAssertionHash&&t===e.userAssertionHash)}matchEnvironment(e,t){if(this.staticAuthorityOptions){let o=sl(this.staticAuthorityOptions,this.commonLogger);if(o.includes(t)&&o.includes(e.environment))return!0}let r=this.getAuthorityMetadataByAlias(t);return!!(r&&r.aliases.indexOf(e.environment)>-1)}matchCredentialType(e,t){return e.credentialType&&t.toLowerCase()===e.credentialType.toLowerCase()}matchClientId(e,t){return!!(e.clientId&&t===e.clientId)}matchFamilyId(e,t){return!!(e.familyId&&t===e.familyId)}matchRealm(e,t){return e.realm?.toLowerCase()===t.toLowerCase()}matchNativeAccountId(e,t){return!!(e.nativeAccountId&&t===e.nativeAccountId)}matchLoginHintFromTokenClaims(e,t){return e.login_hint===t||e.preferred_username===t||e.upn===t}matchSid(e,t){return e.sid===t}matchAuthorityType(e,t){return!!(e.authorityType&&t.toLowerCase()===e.authorityType.toLowerCase())}matchTarget(e,t){return e.credentialType!==Q.ACCESS_TOKEN&&e.credentialType!==Q.ACCESS_TOKEN_WITH_AUTH_SCHEME||!e.target?!1:z.fromString(e.target).containsScopeSet(t)}matchTokenType(e,t){return!!(e.tokenType&&e.tokenType===t)}matchKeyId(e,t){return!!(e.keyId&&e.keyId===t)}isAppMetadata(e){return e.indexOf(ln)!==-1}isAuthorityMetadata(e){return e.indexOf(eo.CACHE_KEY)!==-1}generateAuthorityMetadataCacheKey(e){return`${eo.CACHE_KEY}-${this.clientId}-${e}`}static toObject(e,t){for(let r in t)e[r]=t[r];return e}},Vn=class extends Nr{setAccount(){return d(this,null,function*(){throw f(R)})}getAccount(){throw f(R)}setIdTokenCredential(){return d(this,null,function*(){throw f(R)})}getIdTokenCredential(){throw f(R)}setAccessTokenCredential(){return d(this,null,function*(){throw f(R)})}getAccessTokenCredential(){throw f(R)}setRefreshTokenCredential(){return d(this,null,function*(){throw f(R)})}getRefreshTokenCredential(){throw f(R)}setAppMetadata(){throw f(R)}getAppMetadata(){throw f(R)}setServerTelemetry(){throw f(R)}getServerTelemetry(){throw f(R)}setAuthorityMetadata(){throw f(R)}getAuthorityMetadata(){throw f(R)}getAuthorityMetadataKeys(){throw f(R)}setThrottlingCache(){throw f(R)}getThrottlingCache(){throw f(R)}removeItem(){throw f(R)}getKeys(){throw f(R)}getAccountKeys(){throw f(R)}getTokenKeys(){throw f(R)}generateCredentialKey(){throw f(R)}generateAccountKey(){throw f(R)}};var c={AcquireTokenByCode:"acquireTokenByCode",AcquireTokenByRefreshToken:"acquireTokenByRefreshToken",AcquireTokenSilent:"acquireTokenSilent",AcquireTokenSilentAsync:"acquireTokenSilentAsync",AcquireTokenPopup:"acquireTokenPopup",AcquireTokenPreRedirect:"acquireTokenPreRedirect",AcquireTokenRedirect:"acquireTokenRedirect",CryptoOptsGetPublicKeyThumbprint:"cryptoOptsGetPublicKeyThumbprint",CryptoOptsSignJwt:"cryptoOptsSignJwt",SilentCacheClientAcquireToken:"silentCacheClientAcquireToken",SilentIframeClientAcquireToken:"silentIframeClientAcquireToken",AwaitConcurrentIframe:"awaitConcurrentIframe",SilentRefreshClientAcquireToken:"silentRefreshClientAcquireToken",SsoSilent:"ssoSilent",StandardInteractionClientGetDiscoveredAuthority:"standardInteractionClientGetDiscoveredAuthority",FetchAccountIdWithNativeBroker:"fetchAccountIdWithNativeBroker",NativeInteractionClientAcquireToken:"nativeInteractionClientAcquireToken",BaseClientCreateTokenRequestHeaders:"baseClientCreateTokenRequestHeaders",NetworkClientSendPostRequestAsync:"networkClientSendPostRequestAsync",RefreshTokenClientExecutePostToTokenEndpoint:"refreshTokenClientExecutePostToTokenEndpoint",AuthorizationCodeClientExecutePostToTokenEndpoint:"authorizationCodeClientExecutePostToTokenEndpoint",BrokerHandhshake:"brokerHandshake",AcquireTokenByRefreshTokenInBroker:"acquireTokenByRefreshTokenInBroker",AcquireTokenByBroker:"acquireTokenByBroker",RefreshTokenClientExecuteTokenRequest:"refreshTokenClientExecuteTokenRequest",RefreshTokenClientAcquireToken:"refreshTokenClientAcquireToken",RefreshTokenClientAcquireTokenWithCachedRefreshToken:"refreshTokenClientAcquireTokenWithCachedRefreshToken",RefreshTokenClientAcquireTokenByRefreshToken:"refreshTokenClientAcquireTokenByRefreshToken",RefreshTokenClientCreateTokenRequestBody:"refreshTokenClientCreateTokenRequestBody",AcquireTokenFromCache:"acquireTokenFromCache",SilentFlowClientAcquireCachedToken:"silentFlowClientAcquireCachedToken",SilentFlowClientGenerateResultFromCacheRecord:"silentFlowClientGenerateResultFromCacheRecord",AcquireTokenBySilentIframe:"acquireTokenBySilentIframe",InitializeBaseRequest:"initializeBaseRequest",InitializeSilentRequest:"initializeSilentRequest",InitializeClientApplication:"initializeClientApplication",InitializeCache:"initializeCache",SilentIframeClientTokenHelper:"silentIframeClientTokenHelper",SilentHandlerInitiateAuthRequest:"silentHandlerInitiateAuthRequest",SilentHandlerMonitorIframeForHash:"silentHandlerMonitorIframeForHash",SilentHandlerLoadFrame:"silentHandlerLoadFrame",SilentHandlerLoadFrameSync:"silentHandlerLoadFrameSync",StandardInteractionClientCreateAuthCodeClient:"standardInteractionClientCreateAuthCodeClient",
1StandardInteractionClientGetClientConfiguration:"standardInteractionClientGetClientConfiguration",StandardInteractionClientInitializeAuthorizationRequest:"standardInteractionClientInitializeAuthorizationRequest",GetAuthCodeUrl:"getAuthCodeUrl",GetStandardParams:"getStandardParams",HandleCodeResponseFromServer:"handleCodeResponseFromServer",HandleCodeResponse:"handleCodeResponse",HandleResponseEar:"handleResponseEar",HandleResponsePlatformBroker:"handleResponsePlatformBroker",HandleResponseCode:"handleResponseCode",UpdateTokenEndpointAuthority:"updateTokenEndpointAuthority",AuthClientAcquireToken:"authClientAcquireToken",AuthClientExecuteTokenRequest:"authClientExecuteTokenRequest",AuthClientCreateTokenRequestBody:"authClientCreateTokenRequestBody",PopTokenGenerateCnf:"popTokenGenerateCnf",PopTokenGenerateKid:"popTokenGenerateKid",HandleServerTokenResponse:"handleServerTokenResponse",DeserializeResponse:"deserializeResponse",AuthorityFactoryCreateDiscoveredInstance:"authorityFactoryCreateDiscoveredInstance",AuthorityResolveEndpointsAsync:"authorityResolveEndpointsAsync",AuthorityResolveEndpointsFromLocalSources:"authorityResolveEndpointsFromLocalSources",AuthorityGetCloudDiscoveryMetadataFromNetwork:"authorityGetCloudDiscoveryMetadataFromNetwork",AuthorityUpdateCloudDiscoveryMetadata:"authorityUpdateCloudDiscoveryMetadata",AuthorityGetEndpointMetadataFromNetwork:"authorityGetEndpointMetadataFromNetwork",AuthorityUpdateEndpointMetadata:"authorityUpdateEndpointMetadata",AuthorityUpdateMetadataWithRegionalInformation:"authorityUpdateMetadataWithRegionalInformation",RegionDiscoveryDetectRegion:"regionDiscoveryDetectRegion",RegionDiscoveryGetRegionFromIMDS:"regionDiscoveryGetRegionFromIMDS",RegionDiscoveryGetCurrentVersion:"regionDiscoveryGetCurrentVersion",AcquireTokenByCodeAsync:"acquireTokenByCodeAsync",GetEndpointMetadataFromNetwork:"getEndpointMetadataFromNetwork",GetCloudDiscoveryMetadataFromNetworkMeasurement:"getCloudDiscoveryMetadataFromNetworkMeasurement",HandleRedirectPromiseMeasurement:"handleRedirectPromise",HandleNativeRedirectPromiseMeasurement:"handleNativeRedirectPromise",UpdateCloudDiscoveryMetadataMeasurement:"updateCloudDiscoveryMetadataMeasurement",UsernamePasswordClientAcquireToken:"usernamePasswordClientAcquireToken",NativeMessageHandlerHandshake:"nativeMessageHandlerHandshake",NativeGenerateAuthResult:"nativeGenerateAuthResult",RemoveHiddenIframe:"removeHiddenIframe",ClearTokensAndKeysWithClaims:"clearTokensAndKeysWithClaims",CacheManagerGetRefreshToken:"cacheManagerGetRefreshToken",ImportExistingCache:"importExistingCache",SetUserData:"setUserData",LocalStorageUpdated:"localStorageUpdated",GeneratePkceCodes:"generatePkceCodes",GenerateCodeVerifier:"generateCodeVerifier",GenerateCodeChallengeFromVerifier:"generateCodeChallengeFromVerifier",Sha256Digest:"sha256Digest",GetRandomValues:"getRandomValues",GenerateHKDF:"generateHKDF",GenerateBaseKey:"generateBaseKey",Base64Decode:"base64Decode",UrlEncodeArr:"urlEncodeArr",Encrypt:"encrypt",Decrypt:"decrypt",GenerateEarKey:"generateEarKey",DecryptEarResponse:"decryptEarResponse",LoadExternalTokens:"LoadExternalTokens",LoadAccount:"loadAccount",LoadIdToken:"loadIdToken",LoadAccessToken:"loadAccessToken",LoadRefreshToken:"loadRefreshToken",SsoCapable:"ssoCapable"},Pm=new Map([[c.AcquireTokenByCode,"ATByCode"],[c.AcquireTokenByRefreshToken,"ATByRT"],[c.AcquireTokenSilent,"ATS"],[c.AcquireTokenSilentAsync,"ATSAsync"],[c.AcquireTokenPopup,"ATPopup"],[c.AcquireTokenRedirect,"ATRedirect"],[c.CryptoOptsGetPublicKeyThumbprint,"CryptoGetPKThumb"],[c.CryptoOptsSignJwt,"CryptoSignJwt"],[c.SilentCacheClientAcquireToken,"SltCacheClientAT"],[c.SilentIframeClientAcquireToken,"SltIframeClientAT"],[c.SilentRefreshClientAcquireToken,"SltRClientAT"],[c.SsoSilent,"SsoSlt"],[c.StandardInteractionClientGetDiscoveredAuthority,"StdIntClientGetDiscAuth"],[c.FetchAccountIdWithNativeBroker,"FetchAccIdWithNtvBroker"],[c.NativeInteractionClientAcquireToken,"NtvIntClientAT"],[c.BaseClientCreateTokenRequestHeaders,"BaseClientCreateTReqHead"],[c.NetworkClientSendPostRequestAsync,"NetClientSendPost"],[c.RefreshTokenClientExecutePostToTokenEndpoint,"RTClientExecPost"],[c.AuthorizationCodeClientExecutePostToTokenEndpoint,"AuthCodeClientExecPost"],[c.BrokerHandhshake,"BrokerHandshake"],[c.AcquireTokenByRefreshTokenInBroker,"ATByRTInBroker"],[c.AcquireTokenByBroker,"ATByBroker"],[c.RefreshTokenClientExecuteTokenRequest,"RTClientExecTReq"],[c.RefreshTokenClientAcquireToken,"RTClientAT"],[c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,"RTClientATWithCachedRT"],[c.RefreshTokenClientAcquireTokenByRefreshToken,"RTClientATByRT"],[c.RefreshTokenClientCreateTokenRequestBody,"RTClientCreateTReqBody"],[c.AcquireTokenFromCache,"ATFromCache"],[c.SilentFlowClientAcquireCachedToken,"SltFlowClientATCached"],[c.SilentFlowClientGenerateResultFromCacheRecord,"SltFlowClientGenResFromCache"],[c.AcquireTokenBySilentIframe,"ATBySltIframe"],[c.InitializeBaseRequest,"InitBaseReq"],[c.InitializeSilentRequest,"InitSltReq"],[c.InitializeClientApplication,"InitClientApplication"],[c.InitializeCache,"InitCache"],[c.ImportExistingCache,"importCache"],[c.SetUserData,"setUserData"],[c.LocalStorageUpdated,"localStorageUpdated"],[c.SilentIframeClientTokenHelper,"SIClientTHelper"],[c.SilentHandlerInitiateAuthRequest,"SHandlerInitAuthReq"],[c.SilentHandlerMonitorIframeForHash,"SltHandlerMonitorIframeForHash"],[c.SilentHandlerLoadFrame,"SHandlerLoadFrame"],[c.SilentHandlerLoadFrameSync,"SHandlerLoadFrameSync"],[c.StandardInteractionClientCreateAuthCodeClient,"StdIntClientCreateAuthCodeClient"],[c.StandardInteractionClientGetClientConfiguration,"StdIntClientGetClientConf"],[c.StandardInteractionClientInitializeAuthorizationRequest,"StdIntClientInitAuthReq"],[c.GetAuthCodeUrl,"GetAuthCodeUrl"],[c.HandleCodeResponseFromServer,"HandleCodeResFromServer"],[c.HandleCodeResponse,"HandleCodeResp"],[c.HandleResponseEar,"HandleRespEar"],[c.HandleResponseCode,"HandleRespCode"],[c.HandleResponsePlatformBroker,"HandleRespPlatBroker"],[c.UpdateTokenEndpointAuthority,"UpdTEndpointAuth"],[c.AuthClientAcquireToken,"AuthClientAT"],[c.AuthClientExecuteTokenRequest,"AuthClientExecTReq"],[c.AuthClientCreateTokenRequestBody,"AuthClientCreateTReqBody"],[c.PopTokenGenerateCnf,"PopTGenCnf"],[c.PopTokenGenerateKid,"PopTGenKid"],[c.HandleServerTokenResponse,"HandleServerTRes"],[c.DeserializeResponse,"DeserializeRes"],[c.AuthorityFactoryCreateDiscoveredInstance,"AuthFactCreateDiscInst"],[c.AuthorityResolveEndpointsAsync,"AuthResolveEndpointsAsync"],[c.AuthorityResolveEndpointsFromLocalSources,"AuthResolveEndpointsFromLocal"],[c.AuthorityGetCloudDiscoveryMetadataFromNetwork,"AuthGetCDMetaFromNet"],[c.AuthorityUpdateCloudDiscoveryMetadata,"AuthUpdCDMeta"],[c.AuthorityGetEndpointMetadataFromNetwork,"AuthUpdCDMetaFromNet"],[c.AuthorityUpdateEndpointMetadata,"AuthUpdEndpointMeta"],[c.AuthorityUpdateMetadataWithRegionalInformation,"AuthUpdMetaWithRegInfo"],[c.RegionDiscoveryDetectRegion,"RegDiscDetectReg"],[c.RegionDiscoveryGetRegionFromIMDS,"RegDiscGetRegFromIMDS"],[c.RegionDiscoveryGetCurrentVersion,"RegDiscGetCurrentVer"],[c.AcquireTokenByCodeAsync,"ATByCodeAsync"],[c.GetEndpointMetadataFromNetwork,"GetEndpointMetaFromNet"],[c.GetCloudDiscoveryMetadataFromNetworkMeasurement,"GetCDMetaFromNet"],[c.HandleRedirectPromiseMeasurement,"HandleRedirectPromise"],[c.HandleNativeRedirectPromiseMeasurement,"HandleNtvRedirectPromise"],[c.UpdateCloudDiscoveryMetadataMeasurement,"UpdateCDMeta"],[c.UsernamePasswordCl
1ientAcquireToken,"UserPassClientAT"],[c.NativeMessageHandlerHandshake,"NtvMsgHandlerHandshake"],[c.NativeGenerateAuthResult,"NtvGenAuthRes"],[c.RemoveHiddenIframe,"RemoveHiddenIframe"],[c.ClearTokensAndKeysWithClaims,"ClearTAndKeysWithClaims"],[c.CacheManagerGetRefreshToken,"CacheManagerGetRT"],[c.GeneratePkceCodes,"GenPkceCodes"],[c.GenerateCodeVerifier,"GenCodeVerifier"],[c.GenerateCodeChallengeFromVerifier,"GenCodeChallengeFromVerifier"],[c.Sha256Digest,"Sha256Digest"],[c.GetRandomValues,"GetRandomValues"],[c.GenerateHKDF,"genHKDF"],[c.GenerateBaseKey,"genBaseKey"],[c.Base64Decode,"b64Decode"],[c.UrlEncodeArr,"urlEncArr"],[c.Encrypt,"encrypt"],[c.Decrypt,"decrypt"],[c.GenerateEarKey,"genEarKey"],[c.DecryptEarResponse,"decryptEarResp"],[c.SsoCapable,"SsoCapable"]]),ta={NotStarted:0,InProgress:1,Completed:2};var Ui=class{startMeasurement(){}endMeasurement(){}flushMeasurement(){return null}},pt=class{generateId(){return"callback-id"}startMeasurement(e,t){return{end:()=>null,discard:()=>{},add:()=>{},increment:()=>{},event:{eventId:this.generateId(),status:ta.InProgress,authority:"",libraryName:"",libraryVersion:"",clientId:"",name:e,startTimeMs:Date.now(),correlationId:t||""},measurement:new Ui}}startPerformanceMeasurement(){return new Ui}calculateQueuedTime(){return 0}addQueueMeasurement(){}setPreQueueTime(){}endMeasurement(){return null}discardMeasurements(){}removePerformanceCallback(){return!0}addPerformanceCallback(){return""}emitEvents(){}addFields(){}incrementFields(){}cacheEventByCorrelationId(){}};var Di={tokenRenewalOffsetSeconds:dn,preventCorsPreflight:!1},Md={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:U.Info,correlationId:g.EMPTY_STRING},Ud={claimsBasedCachingEnabled:!1},Dd={sendGetRequestAsync(){return d(this,null,function*(){throw f(R)})},sendPostRequestAsync(){return d(this,null,function*(){throw f(R)})}},Ld={sku:g.SKU,version:ro,cpu:g.EMPTY_STRING,os:g.EMPTY_STRING},xd={clientSecret:g.EMPTY_STRING,clientAssertion:void 0},Hd={azureCloudInstance:xt.None,tenant:`${g.DEFAULT_COMMON_TENANT}`},Fd={application:{appName:"",appVersion:""}};function cl({authOptions:n,systemOptions:e,loggerOptions:t,cacheOptions:r,storageInterface:o,networkInterface:i,cryptoInterface:s,clientCredentials:a,libraryInfo:l,telemetry:h,serverTelemetryManager:m,persistencePlugin:p,serializableCache:C}){let T=y(y({},Md),t);return{authOptions:Bd(n),systemOptions:y(y({},Di),e),loggerOptions:T,cacheOptions:y(y({},Ud),r),storageInterface:o||new Vn(n.clientId,Lt,new me(T),new pt),networkInterface:i||Dd,cryptoInterface:s||Lt,clientCredentials:a||xd,libraryInfo:y(y({},Ld),l),telemetry:y(y({},Fd),h),serverTelemetryManager:m||null,persistencePlugin:p||null,serializableCache:C||null}}function Bd(n){return y({clientCapabilities:[],azureCloudOptions:Hd,skipAuthorityMetadataCache:!1,instanceAware:!1,encodeExtraQueryParams:!1},n)}function Li(n){return n.authOptions.authority.options.protocolMode===H.OIDC}var le={HOME_ACCOUNT_ID:"home_account_id",UPN:"UPN"};var F={};ye(F,{addApplicationTelemetry:()=>Wn,addAuthorizationCode:()=>ja,addBrokerParameters:()=>yt,addCcsOid:()=>ft,addCcsUpn:()=>Kt,addClaims:()=>xr,addCliData:()=>Ya,addClientAssertion:()=>Jn,addClientAssertionType:()=>Xn,addClientCapabilitiesToClaims:()=>ll,addClientId:()=>Dr,addClientInfo:()=>Fr,addClientSecret:()=>Yn,addCodeChallengeParams:()=>th,addCodeVerifier:()=>Qa,addCorrelationId:()=>Hr,addDeviceCode:()=>rh,addDomainHint:()=>za,addEARParameters:()=>ah,addExtraQueryParameters:()=>Ct,addGrantType:()=>Zn,addIdTokenHint:()=>qa,addInstanceAware:()=>ei,addLibraryInfo:()=>jn,addLoginHint:()=>so,addLogoutHint:()=>Ja,addNativeBroker:()=>eh,addNonce:()=>Va,addOboAssertion:()=>oh,addPassword:()=>sh,addPopToken:()=>ti,addPostBodyParameters:()=>ch,addPostLogoutRedirectUri:()=>Ga,addPrompt:()=>$a,addRedirectUri:()=>Lr,addRefreshToken:()=>Wa,addRequestTokenUse:()=>nh,addResponseMode:()=>Ka,addResponseType:()=>Zd,addScopes:()=>Ur,addServerTelemetry:()=>oi,addSid:()=>Gi,addSshJwk:()=>ri,addState:()=>Qn,addThrottling:()=>ni,addUsername:()=>ih,instrumentBrokerParams:()=>Mr});var gt={};ye(gt,{ACCESS_TOKEN:()=>qd,BROKER_CLIENT_ID:()=>Le,BROKER_REDIRECT_URI:()=>Ki,CCS_HEADER:()=>Jd,CLAIMS:()=>ia,CLIENT_ASSERTION:()=>ba,CLIENT_ASSERTION_TYPE:()=>Pa,CLIENT_ID:()=>Qe,CLIENT_INFO:()=>Wd,CLIENT_REQUEST_ID:()=>ga,CLIENT_SECRET:()=>_a,CLI_DATA:()=>Ba,CODE:()=>ha,CODE_CHALLENGE:()=>ua,CODE_CHALLENGE_METHOD:()=>ma,CODE_VERIFIER:()=>pa,DEVICE_CODE:()=>Ra,DOMAIN_HINT:()=>xa,EAR_JWE_CRYPTO:()=>Fa,EAR_JWK:()=>Ha,ERROR:()=>Kd,ERROR_DESCRIPTION:()=>Gd,EXPIRES_IN:()=>$d,FOCI:()=>Yd,GRANT_TYPE:()=>na,ID_TOKEN:()=>zd,ID_TOKEN_HINT:()=>ka,INSTANCE_AWARE:()=>io,LOGIN_HINT:()=>La,LOGOUT_HINT:()=>Ua,NATIVE_BROKER:()=>Ma,NONCE:()=>la,OBO_ASSERTION:()=>Oa,ON_BEHALF_OF:()=>Qd,POST_LOGOUT_URI:()=>wa,PROMPT:()=>da,REDIRECT_URI:()=>xi,REFRESH_TOKEN:()=>aa,REFRESH_TOKEN_EXPIRES_IN:()=>Vd,REQUESTED_TOKEN_USE:()=>Na,REQ_CNF:()=>Fi,RESPONSE_MODE:()=>oa,RESPONSE_TYPE:()=>ra,RETURN_SPA_CODE:()=>Bi,SCOPE:()=>sa,SESSION_STATE:()=>jd,SID:()=>Da,STATE:()=>ca,TOKEN_TYPE:()=>Hi,X_APP_NAME:()=>Sa,X_APP_VER:()=>va,X_CLIENT_CPU:()=>Aa,X_CLIENT_CURR_TELEM:()=>Ta,X_CLIENT_EXTRA_SKU:()=>Xd,X_CLIENT_LAST_TELEM:()=>Ea,X_CLIENT_OS:()=>ya,X_CLIENT_SKU:()=>fa,X_CLIENT_VER:()=>Ca,X_MS_LIB_CAPABILITY:()=>Ia});var Qe="client_id",xi="redirect_uri",ra="response_type",oa="response_mode",na="grant_type",ia="claims",sa="scope",Kd="error",Gd="error_description",qd="access_token",zd="id_token",aa="refresh_token",$d="expires_in",Vd="refresh_token_expires_in",ca="state",la="nonce",da="prompt",jd="session_state",Wd="client_info",ha="code",ua="code_challenge",ma="code_challenge_method",pa="code_verifier",ga="client-request-id",fa="x-client-SKU",Ca="x-client-VER",ya="x-client-OS",Aa="x-client-CPU",Ta="x-client-current-telemetry",Ea="x-client-last-telemetry",Ia="x-ms-lib-capability",Sa="x-app-name",va="x-app-ver",wa="post_logout_redirect_uri",ka="id_token_hint",Ra="device_code",_a="client_secret",ba="client_assertion",Pa="client_assertion_type",Hi="token_type",Fi="req_cnf",Oa="assertion",Na="requested_token_use",Qd="on_behalf_of",Yd="foci",Jd="X-AnchorMailbox",Bi="return_spa_code",Ma="nativebroker",Ua="logout_hint",Da="sid",La="login_hint",xa="domain_hint",Xd="x-client-xtra-sku",Le="brk_client_id",Ki="brk_redirect_uri",io="instance_aware",Ha="ear_jwk",Fa="ear_jwe_crypto",Ba="clidata";function Mr(n,e,t){if(!e)return;let r=n.get(Qe);r&&n.has(Le)&&t?.addFields({embeddedClientId:r,embeddedRedirectUri:n.get(xi)},e)}function Zd(n,e){n.set(ra,e)}function Ka(n,e){n.set(oa,e||js.QUERY)}function eh(n){n.set(Ma,"1")}function Ur(n,e,t=!0,r=Ie){t&&!r.includes("openid")&&!e.includes("openid")&&r.push("openid");let o=t?[...e||[],...r]:e||[],i=new z(o);n.set(sa,i.printScopes())}function Dr(n,e){n.set(Qe,e)}
1function Lr(n,e){n.set(xi,e)}function Ga(n,e){n.set(wa,e)}function qa(n,e){n.set(ka,e)}function za(n,e){n.set(xa,e)}function so(n,e){n.set(La,e)}function Kt(n,e){n.set(W.CCS_HEADER,`UPN:${e}`)}function ft(n,e){n.set(W.CCS_HEADER,`Oid:${e.uid}@${e.utid}`)}function Gi(n,e){n.set(Da,e)}function xr(n,e,t){let r=ll(e,t);try{JSON.parse(r)}catch{throw M(Ht)}n.set(ia,r)}function Hr(n,e){n.set(ga,e)}function jn(n,e){n.set(fa,e.sku),n.set(Ca,e.version),e.os&&n.set(ya,e.os),e.cpu&&n.set(Aa,e.cpu)}function Wn(n,e){e?.appName&&n.set(Sa,e.appName),e?.appVersion&&n.set(va,e.appVersion)}function $a(n,e){n.set(da,e)}function Qn(n,e){e&&n.set(ca,e)}function Va(n,e){n.set(la,e)}function th(n,e,t){if(e&&t)n.set(ua,e),n.set(ma,t);else throw M(Rr)}function ja(n,e){n.set(ha,e)}function rh(n,e){n.set(Ra,e)}function Wa(n,e){n.set(aa,e)}function Qa(n,e){n.set(pa,e)}function Yn(n,e){n.set(_a,e)}function Jn(n,e){e&&n.set(ba,e)}function Xn(n,e){e&&n.set(Pa,e)}function oh(n,e){n.set(Oa,e)}function nh(n,e){n.set(Na,e)}function Zn(n,e){n.set(na,e)}function Fr(n){n.set(Jc,"1")}function Ya(n){n.set(Ba,"1")}function ei(n){n.has(io)||n.set(io,"true")}function Ct(n,e){Object.entries(e).forEach(([t,r])=>{!n.has(t)&&r&&n.set(t,r)})}function ll(n,e){let t;if(!n)t={};else try{t=JSON.parse(n)}catch{throw M(Ht)}return e&&e.length>0&&(t.hasOwnProperty(Xr.ACCESS_TOKEN)||(t[Xr.ACCESS_TOKEN]={}),t[Xr.ACCESS_TOKEN][Xr.XMS_CC]={values:e}),JSON.stringify(t)}function ih(n,e){n.set(_i.username,e)}function sh(n,e){n.set(_i.password,e)}function ti(n,e){e&&(n.set(Hi,N.POP),n.set(Fi,e))}function ri(n,e){e&&(n.set(Hi,N.SSH),n.set(Fi,e))}function oi(n,e){n.set(Ta,e.generateCurrentRequestHeaderValue()),n.set(Ea,e.generateLastRequestHeaderValue())}function ni(n){n.set(Ia,at.X_MS_LIB_CAPABILITY_VALUE)}function Ja(n,e){n.set(Ua,e)}function yt(n,e,t){n.has(Le)||n.set(Le,e),n.has(Ki)||n.set(Ki,t)}function ah(n,e){n.set(Ha,encodeURIComponent(e)),n.set(Fa,"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0")}function ch(n,e){Object.entries(e).forEach(([t,r])=>{r&&n.set(t,r)})}var lo={};ye(lo,{createDiscoveredInstance:()=>oc});function dl(n){return n.hasOwnProperty("authorization_endpoint")&&n.hasOwnProperty("token_endpoint")&&n.hasOwnProperty("issuer")&&n.hasOwnProperty("jwks_uri")}function hl(n){return n.hasOwnProperty("tenant_discovery_endpoint")&&n.hasOwnProperty("metadata")}function ul(n){return n.hasOwnProperty("error")&&n.hasOwnProperty("error_description")}var G=(n,e,t,r,o)=>(...i)=>{t.trace(`Executing function ${e}`);let s=r?.startMeasurement(e,o);if(o){let a=e+"CallCount";r?.incrementFields({[a]:1},o)}try{let a=n(...i);return s?.end({success:!0}),t.trace(`Returning result from ${e}`),a}catch(a){t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(a))}catch{t.trace("Unable to print error message.")}throw s?.end({success:!1},a),a}},u=(n,e,t,r,o)=>(...i)=>{t.trace(`Executing function ${e}`);let s=r?.startMeasurement(e,o);if(o){let a=e+"CallCount";r?.incrementFields({[a]:1},o)}return r?.setPreQueueTime(e,o),n(...i).then(a=>(t.trace(`Returning result from ${e}`),s?.end({success:!0}),a)).catch(a=>{t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(a))}catch{t.trace("Unable to print error message.")}throw s?.end({success:!1},a),a})};var ml=(()=>{class n{constructor(t,r,o,i){this.networkInterface=t,this.logger=r,this.performanceClient=o,this.correlationId=i}detectRegion(t,r){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryDetectRegion,this.correlationId);let o=t;if(o)r.region_source=or.ENVIRONMENT_VARIABLE;else{let i=n.IMDS_OPTIONS;try{let s=yield u(this.getRegionFromIMDS.bind(this),c.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(g.IMDS_VERSION,i);
1if(s.status===Me.SUCCESS&&(o=s.body,r.region_source=or.IMDS),s.status===Me.BAD_REQUEST){let a=yield u(this.getCurrentVersion.bind(this),c.RegionDiscoveryGetCurrentVersion,this.logger,this.performanceClient,this.correlationId)(i);if(!a)return r.region_source=or.FAILED_AUTO_DETECTION,null;let l=yield u(this.getRegionFromIMDS.bind(this),c.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(a,i);l.status===Me.SUCCESS&&(o=l.body,r.region_source=or.IMDS)}}catch{return r.region_source=or.FAILED_AUTO_DETECTION,null}}return o||(r.region_source=or.FAILED_AUTO_DETECTION),o||null})}getRegionFromIMDS(t,r){return d(this,null,function*(){return this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryGetRegionFromIMDS,this.correlationId),this.networkInterface.sendGetRequestAsync(`${g.IMDS_ENDPOINT}?api-version=${t}&format=text`,r,g.IMDS_TIMEOUT)})}getCurrentVersion(t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryGetCurrentVersion,this.correlationId);try{let r=yield this.networkInterface.sendGetRequestAsync(`${g.IMDS_ENDPOINT}?format=json`,t);return r.status===Me.BAD_REQUEST&&r.body&&r.body["newest-versions"]&&r.body["newest-versions"].length>0?r.body["newest-versions"][0]:null}catch{return null}})}}return n.IMDS_OPTIONS={headers:{Metadata:"true"}},n})();var $={};ye($,{createAccessTokenEntity:()=>ec,createIdTokenEntity:()=>Za,createRefreshTokenEntity:()=>tc,generateAppMetadataKey:()=>Ch,generateAuthorityMetadataExpiresAt:()=>zi,isAccessTokenEntity:()=>uh,isAppMetadataEntity:()=>yh,isAuthorityMetadataEntity:()=>Ah,isAuthorityMetadataExpired:()=>$i,isCredentialEntity:()=>qi,isIdTokenEntity:()=>mh,isRefreshTokenEntity:()=>ph,isServerTelemetryEntity:()=>gh,isThrottlingEntity:()=>fh,updateAuthorityEndpointMetadata:()=>co,updateCloudDiscoveryMetadata:()=>si});var J={};ye(J,{delay:()=>hh,isCacheExpired:()=>dh,isTokenExpired:()=>ao,nowSeconds:()=>Se,toDateFromSeconds:()=>ii,toSecondsFromDate:()=>lh,wasClockTurnedBack:()=>Xa});function Se(){return Math.round(new Date().getTime()/1e3)}function lh(n){return n.getTime()/1e3}function ii(n){return n?new Date(Number(n)*1e3):new Date}function ao(n,e){let t=Number(n)||0;return Se()+e>t}function dh(n,e){let t=Number(n)+e*24*60*60*1e3;return Date.now()>t}function Xa(n){return Number(n)>Se()}function hh(n,e){return new Promise(t=>setTimeout(()=>t(e),n))}function Za(n,e,t,r,o){return{credentialType:Q.ID_TOKEN,homeAccountId:n,environment:e,clientId:r,secret:t,realm:o,lastUpdatedAt:Date.now().toString()}}function ec(n,e,t,r,o,i,s,a,l,h,m,p,C,T,P){let O={homeAccountId:n,credentialType:Q.ACCESS_TOKEN,secret:t,cachedAt:Se().toString(),expiresOn:s.toString(),extendedExpiresOn:a.toString(),environment:e,clientId:r,realm:o,target:i,tokenType:m||N.BEARER,lastUpdatedAt:Date.now().toString()};if(p&&(O.userAssertionHash=p),h&&(O.refreshOn=h.toString()),T&&(O.requestedClaims=T,O.requestedClaimsHash=P),O.tokenType?.toLowerCase()!==N.BEARER.toLowerCase())switch(O.credentialType=Q.ACCESS_TOKEN_WITH_AUTH_SCHEME,O.tokenType){case N.POP:let ae=mt(t,l);if(!ae?.cnf?.kid)throw f(Cr);O.keyId=ae.cnf.kid;break;case N.SSH:O.keyId=C}return O}function tc(n,e,t,r,o,i,s){let a={credentialType:Q.REFRESH_TOKEN,homeAccountId:n,environment:e,clientId:r,secret:t,lastUpdatedAt:Date.now().toString()};return i&&(a.userAssertionHash=i),o&&(a.familyId=o),s&&(a.expiresOn=s.toString()),a}function qi(n){return n.hasOwnProperty("homeAccountId")&&n.hasOwnProperty("environment")&&n.hasOwnProperty("credentialType")&&n.hasOwnProperty("clientId")&&n.hasOwnProperty("secret")}function uh(n){return n?qi(n)&&n.hasOwnProperty("realm")&&n.hasOwnProperty("target")&&(n.credentialType===Q.ACCESS_TOKEN||n.credentialType===Q.ACCESS_TOKEN_WITH_AUTH_SCHEME):!1}function mh(n){return n?qi(n)&&n.hasOwnProperty("realm")&&n.credentialType===Q.ID_TOKEN:!1}function ph(n){return n?qi(n)&&n.credentialType===Q.REFRESH_TOKEN:!1}function gh(n,e){let t=n.indexOf(te.CACHE_KEY)===0,r=!0;return e&&(r=e.hasOwnProperty("failedRequests")&&e.hasOwnProperty("errors")&&e.hasOwnProperty("cacheHits")),t&&r}function fh(n,e){let t=!1;
1n&&(t=n.indexOf(at.THROTTLING_PREFIX)===0);let r=!0;return e&&(r=e.hasOwnProperty("throttleTime")),t&&r}function Ch({environment:n,clientId:e}){return[ln,n,e].join(st.CACHE_KEY_SEPARATOR).toLowerCase()}function yh(n,e){return e?n.indexOf(ln)===0&&e.hasOwnProperty("clientId")&&e.hasOwnProperty("environment"):!1}function Ah(n,e){return e?n.indexOf(eo.CACHE_KEY)===0&&e.hasOwnProperty("aliases")&&e.hasOwnProperty("preferred_cache")&&e.hasOwnProperty("preferred_network")&&e.hasOwnProperty("canonical_authority")&&e.hasOwnProperty("authorization_endpoint")&&e.hasOwnProperty("token_endpoint")&&e.hasOwnProperty("issuer")&&e.hasOwnProperty("aliasesFromNetwork")&&e.hasOwnProperty("endpointsFromNetwork")&&e.hasOwnProperty("expiresAt")&&e.hasOwnProperty("jwks_uri"):!1}function zi(){return Se()+eo.REFRESH_TIME_SECONDS}function co(n,e,t){n.authorization_endpoint=e.authorization_endpoint,n.token_endpoint=e.token_endpoint,n.end_session_endpoint=e.end_session_endpoint,n.issuer=e.issuer,n.endpointsFromNetwork=t,n.jwks_uri=e.jwks_uri}function si(n,e,t){n.aliases=e.aliases,n.preferred_cache=e.preferred_cache,n.preferred_network=e.preferred_network,n.aliasesFromNetwork=t}function $i(n){return n.expiresAt<=Se()}var xe=class n{constructor(e,t,r,o,i,s,a,l){this.canonicalAuthority=e,this._canonicalAuthority.validateAsUri(),this.networkInterface=t,this.cacheManager=r,this.authorityOptions=o,this.regionDiscoveryMetadata={region_used:void 0,region_source:void 0,region_outcome:void 0},this.logger=i,this.performanceClient=a,this.correlationId=s,this.managedIdentity=l||!1,this.regionDiscovery=new ml(t,this.logger,this.performanceClient,this.correlationId)}getAuthorityType(e){if(e.HostNameAndPort.endsWith(g.CIAM_AUTH_URL))return pe.Ciam;let t=e.PathSegments;if(t.length)switch(t[0].toLowerCase()){case g.ADFS:return pe.Adfs;case g.DSTS:return pe.Dsts}return pe.Default}get authorityType(){return this.getAuthorityType(this.canonicalAuthorityUrlComponents)}get protocolMode(){return this.authorityOptions.protocolMode}get options(){return this.authorityOptions}get canonicalAuthority(){return this._canonicalAuthority.urlString}set canonicalAuthority(e){this._canonicalAuthority=new _(e),this._canonicalAuthority.validateAsUri(),this._canonicalAuthorityUrlComponents=null}get canonicalAuthorityUrlComponents(){return this._canonicalAuthorityUrlComponents||(this._canonicalAuthorityUrlComponents=this._canonicalAuthority.getUrlComponents()),this._canonicalAuthorityUrlComponents}get hostnameAndPort(){return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase()}get tenant(){return this.canonicalAuthorityUrlComponents.PathSegments[0]}get authorizationEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.authorization_endpoint);throw f(ue)}get tokenEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint);throw f(ue)}get deviceCodeEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint.replace("/token","/devicecode"));throw f(ue)}get endSessionEndpoint(){if(this.discoveryComplete()){if(!this.metadata.end_session_endpoint)throw f(Ar);return this.replacePath(this.metadata.end_session_endpoint)}else throw f(ue)}get selfSignedJwtAudience(){if(this.discoveryComplete())return this.replacePath(this.metadata.issuer);throw f(ue)}get jwksUri(){if(this.discoveryComplete())return this.replacePath(this.metadata.jwks_uri);throw f(ue)}canReplaceTenant(e){return e.PathSegments.length===1&&!n.reservedTenantDomains.has(e.PathSegments[0])&&this.getAuthorityType(e)===pe.Default&&this.protocolMode!==H.OIDC}replaceTenant(e){return e.replace(/{tenant}|{tenantid}/g,this.tenant)}replacePath(e){let t=e,o=new _(this.metadata.canonical_authority).getUrlComponents(),i=o.PathSegments;return this.canonicalAuthorityUrlComponents.PathSegments.forEach((a,l)=>{let h=i[l];if(l===0&&this.canReplaceTenant(o)){let m=new _(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];h!==m&&(this.logger.verbose(`Replacing tenant domain name ${h} with id ${m}`),h=m)}a!==h&&(t=t.replace(`/${h}/`,`/${a}/`))}),this.replaceTenant(t)}get defaultOpenIdConfigurationEndpoint(){let e=this.hostnameAndPort;return this.canonicalAuthority.endsWith("v2.0/")||this.authorityType===pe.Adfs||this.protocolMode===H.OIDC&&!this.isAliasOfKnownMicrosoftAuthority(e)?`${this.canonicalAuthority}.well-known/openid-configuration`:`${this.canonicalAuthority}v2.0/.well-known/openid-configuration`}discoveryComplete(){return!!this.metadata}resolveEndpointsAsync(){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityResolveEndpointsAsync,this.correlationId);let e=this.getCurrentMetadataEntity(),t=yield u(this.updateCloudDiscoveryMetadata.bind(this),c.AuthorityUpdateCloudDiscoveryMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.canonicalAuthority=this.canonicalAuthority.replace(this.hostnameAndPort,e.preferred_network);let r=yield u(this.updateEndpointMetadata.bind(this),c.AuthorityUpdateEndpointMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.updateCachedMetadata(e,t,{source:r}),this.performanceClient?.addFields({cloudDiscoverySource:t,authorityEndpointSource:r},this.correlationId)})}getCurrentMetadataEntity(){let e=this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort);return e||(e={aliases:[],preferred_cache:this.hostnameAndPort,preferred_network:this.hostnameAndPort,canonical_authority:this.canonicalAuthority,authorization_endpoint:"",token_endpoint:"",end_session_endpoint:"",issuer:"",aliasesFromNetwork:!1,endpointsFromNetwork:!1,expiresAt:zi(),jwks_uri:""}),e}updateCachedMetadata(e,t,r){t!==he.CACHE&&r?.source!==he.CACHE&&(e.expiresAt=zi(),e.canonical_authority=this.canonicalAuthority);let o=this.cacheManager.generateAuthorityMetadataCacheKey(e.preferred_cache);this.cacheManager.setAuthorityMetadata(o,e),this.metadata=e}updateEndpointMetadata(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateEndpointMetadata,this.correlationId);let t=this.updateEndpointMetadataFromLocalSources(e);if(t){if(t.source===he.HARDCODED_VALUES&&this.authorityOptions.azureRegionConfiguration?.azureRegion&&t.metadata){let o=yield u(this.updateMetadataWithRegionalInformation.bind(this),c.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(t.metadata);co(e,o,!1),e.canonical_authority=this.canonicalAuthority}return t.source}let r=yield u(this.getEndpointMetadataFromNetwork.bind(this),c.AuthorityGetEndpointMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(r)return this.authorityOptions.azureRegionConfiguration?.azureRegion&&(r=yield u(this.updateMetadataWithRegionalInformation.bind(this),c.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(r)),co(e,r,!0),he.NETWORK;throw f(ar,this.defaultOpenIdConfigurationEndpoint)})}updateEndpointMetadataFromLocalSources(e){this.logger.verbose("Attempting to get endpoint metadata from authority configuration");let t=this.getEndpointMetadataFromConfig();if(t)return this.logger.verbose("Found endpoint metadata in authority configuration"),co(e,t,!1),{source:he.CONFIG};if(this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values."),this.authorityOptions.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");else{let o=this.getEndpointMetadataFromHardcodedValues();if(o)return co(e,o,!1),{source:he.HARDCODED_VALUES,metadata:o};this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.")}let r=$i(e);return this.isAuthoritySameType(e)&&e.endpointsFromNetwork&&!r?(this.logger.verbose("Found endpoint metadata in the cache."),{source:he.CACHE}):(r&&this.logger.verbose("The metadata entity is expired."),null)}isAuthoritySameType(e){return new _(e.canonical_authority).getUrlComponents().PathSegments.length===this.canonicalAuthorityUrlComponents.PathSegments.length}getEndpointMetadataFromConfig(){if(this.authorityOptions.authorityMetadata)try{return JSON.parse(this.authorityOptions.authorityMetadata)}catch{throw M(_r)}return null}getEndpointMetadataFromNetwork(){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityGetEndpointMetadataFromNetwork,this.correlationId);let e={},t=this.defaultOpenIdConfigurationEndpoint;this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from ${t}`);try{let r=yield this.networkInterface.sendGetRequestAsync(t,e);return dl(r.body)?r.body:(this.logger.verbose("Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration"),null)}catch(r){return this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${r}`),null}})}getEndpointMetadataFromHardcodedValues(){return this.hostnameAndPort in Js?Js[this.hostnameAndPort]:null}updateMetadataWithRegionalInformation(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateMetadataWithRegionalInformation,this.correlationId);let t=this.authorityOptions.azureRegionConfiguration?.azureRegion;if(t){if(t!==g.AZURE_REGION_AUTO_DISCOVER_FLAG)return this.regionDiscoveryMetadata.region_outcome=bi.CONFIGURED_NO_AUTO_DETECTION,this.regionDiscoveryMetadata.region_used=t,n.replaceWithRegionalInformation(e,t);let r=yield u(this.regionDiscovery.detectRegion.bind(this.regionDiscovery),c.RegionDiscoveryDetectRegion,this.logger,this.performanceClient,this.correlationId)(this.authorityOptions.azureRegionConfiguration?.environmentRegion,this.regionDiscoveryMetadata);if(r)return this.regionDiscoveryMetadata.region_outcome=bi.AUTO_DETECTION_REQUESTED_SUCCESSFUL,this.regionDiscoveryMetadata.region_used=r,n.replaceWithRegionalInformation(e,r);this.regionDiscoveryMetadata.region_outcome=bi.AUTO_DETECTION_REQUESTED_FAILED}return e})}updateCloudDiscoveryMetadata(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateCloudDiscoveryMetadata,this.correlationId);let t=this.updateCloudDiscoveryMetadataFromLocalSources(e);if(t)return t;let r=yield u(this.getCloudDiscoveryMetadataFromNetwork.bind(this),c.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(r)return si(e,r,!0),he.NETWORK;throw M(br)})}updateCloudDiscoveryMetadataFromLocalSources(e){this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration"),this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities||g.NOT_APPLICABLE}`),this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata||g.NOT_APPLICABLE}`),this.logger.verbosePii(`Canonical Authority: ${e.canonical_authority||g.NOT_APPLICABLE}`);let t=this.getCloudDiscoveryMetadataFromConfig();if(t)return this.logger.verbose("Found cloud discovery metadata in authority configuration"),si(e,t,!1),he.CONFIG;if(this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values."),this.options.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");else{let o=al(this.hostnameAndPort);if(o)return this.logger.verbose("Found cloud discovery metadata from hardcoded values."),si(e,o,!1),he.HARDCODED_VALUES;this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.")}let r=$i(e);return this.isAuthoritySameType(e)&&e.aliasesFromNetwork&&!r?(this.logger.verbose("Found cloud discovery metadata in the cache."),he.CACHE):(r&&this.logger.verbose("The metadata entity is expired."),null)}getCloudDiscoveryMetadataFromConfig(){if(this.authorityType===pe.Ciam)return this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host."),n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);if(this.authorityOptions.cloudDiscoveryMetadata){this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.");try{this.logger.verbose("Attempting to parse the cloud discovery metadata.");let e=JSON.parse(this.authorityOptions.cloudDiscoveryMetadata),t=qn(e.metadata,this.hostnameAndPort);if(this.logger.verbose("Parsed the cloud discovery metadata."),t)return this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata."),t;this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.")}catch{throw this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error."),M(Ft)}}return this.isInKnownAuthorities()?(this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host."),n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)):null}getCloudDiscoveryMetadataFromNetwork(){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.correlationId);let e=`${g.AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`,t={},r=null;try{let o=yield this.networkInterface.sendGetRequestAsync(e,t),i,s;if(hl(o.body))i=o.body,s=i.metadata,this.logger.verbosePii(`tenant_discovery_endpoint is: ${i.tenant_discovery_endpoint}`);
1else if(ul(o.body)){if(this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: ${o.status}`),i=o.body,i.error===g.INVALID_INSTANCE)return this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance."),null;this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is ${i.error}`),this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is ${i.error_description}`),this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network) to []"),s=[]}else return this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse"),null;this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request."),r=qn(s,this.hostnameAndPort)}catch(o){if(o instanceof v)this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata. 2Error: ${o.errorCode} 3Error Description: ${o.errorMessage}`);else{let i=o;this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata. 4Error: ${i.name} 5Error Description: ${i.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request."),this.logger.verbose("Creating custom Authority for custom domain scenario."),r=n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),r})}isInKnownAuthorities(){return this.authorityOptions.knownAuthorities.filter(t=>t&&_.getDomainFromUrl(t).toLowerCase()===this.hostnameAndPort).length>0}static generateAuthority(e,t){let r;if(t&&t.azureCloudInstance!==xt.None){let o=t.tenant?t.tenant:g.DEFAULT_COMMON_TENANT;r=`${t.azureCloudInstance}/${o}/`}return r||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return g.DEFAULT_AUTHORITY_HOST;if(this.discoveryComplete())return this.metadata.preferred_cache;throw f(ue)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return Zs.has(e)}static isPublicCloudAuthority(e){return g.KNOWN_PUBLIC_CLOUDS.indexOf(e)>=0}static buildRegionalAuthorityString(e,t,r){let o=new _(e);o.validateAsUri();let i=o.getUrlComponents(),s=`${t}.${i.HostNameAndPort}`;this.isPublicCloudAuthority(i.HostNameAndPort)&&(s=`${t}.${g.REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`);let a=_.constructAuthorityUriFromObject(S(y({},o.getUrlComponents()),{HostNameAndPort:s})).urlString;return r?`${a}?${r}`:a}static replaceWithRegionalInformation(e,t){let r=y({},e);return r.authorization_endpoint=n.buildRegionalAuthorityString(r.authorization_endpoint,t),r.token_endpoint=n.buildRegionalAuthorityString(r.token_endpoint,t),r.end_session_endpoint&&(r.end_session_endpoint=n.buildRegionalAuthorityString(r.end_session_endpoint,t)),r}static transformCIAMAuthority(e){let t=e,o=new _(e).getUrlComponents();if(o.PathSegments.length===0&&o.HostNameAndPort.endsWith(g.CIAM_AUTH_URL)){let i=o.HostNameAndPort.split(".")[0];t=`${t}${i}${g.AAD_TENANT_DOMAIN_SUFFIX}`}return t}};xe.reservedTenantDomains=new Set(["{tenant}","{tenantid}",Ue.COMMON,Ue.CONSUMERS,Ue.ORGANIZATIONS]);function pl(n){let r=new _(n).getUrlComponents().PathSegments.slice(-1)[0]?.toLowerCase();switch(r){case Ue.COMMON:case Ue.ORGANIZATIONS:case Ue.CONSUMERS:return;default:return r}}function Vi(n){return n.endsWith(g.FORWARD_SLASH)?n:`${n}${g.FORWARD_SLASH}`}function rc(n){let e=n.cloudDiscoveryMetadata,t;if(e)try{t=JSON.parse(e)}catch{throw M(Ft)}return{canonicalAuthority:n.authority?Vi(n.authority):void 0,knownAuthorities:n.knownAuthorities,cloudDiscoveryMetadata:t}}function oc(n,e,t,r,o,i,s){return d(this,null,function*(){s?.addQueueMeasurement(c.AuthorityFactoryCreateDiscoveredInstance,i);let a=xe.transformCIAMAuthority(Vi(n)),l=new xe(a,e,t,r,o,i,s);try{return yield u(l.resolveEndpointsAsync.bind(l),c.AuthorityResolveEndpointsAsync,o,s,i)(),l}catch{throw f(ue)}})}var Ae=class n extends v{constructor(e,t,r,o,i){super(e,t,r),this.name="ServerError",this.errorNo=o,this.status=i,Object.setPrototypeOf(this,n.prototype)}};function At(n,e,t){return{clientId:n,authority:e.authority,scopes:e.scopes,homeAccountIdentifier:t,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid,embeddedClientId:e.embeddedClientId||e.tokenBodyParameters?.clientId}}var Tt=class n{static generateThrottlingStorageKey(e){return`${at.THROTTLING_PREFIX}.${JSON.stringify(e)}`}static preProcess(e,t,r){let o=n.generateThrottlingStorageKey(t),i=e.getThrottlingCache(o);if(i){if(i.throttleTime<Date.now()){e.removeItem(o,r);return}throw new Ae(i.errorCodes?.join(" ")||g.EMPTY_STRING,i.errorMessage,i.subError)}}static postProcess(e,t,r,o){if(n.checkResponseStatus(r)||n.checkResponseForRetryAfter(r)){let i={throttleTime:n.calculateThrottleTime(parseInt(r.headers[W.RETRY_AFTER])),error:r.body.error,errorCodes:r.body.error_codes,errorMessage:r.body.error_description,subError:r.body.suberror};e.setThrottlingCache(n.generateThrottlingStorageKey(t),i,o)}}static checkResponseStatus(e){return e.status===429||e.status>=500&&e.status<600}static checkResponseForRetryAfter(e){return e.headers?e.headers.hasOwnProperty(W.RETRY_AFTER)&&(e.status<200||e.status>=300):!1}static calculateThrottleTime(e){let t=e<=0?0:e,r=Date.now()/1e3;return Math.floor(Math.min(r+(t||at.DEFAULT_THROTTLE_TIME_SECONDS),r+at.DEFAULT_MAX_THROTTLE_TIME_SECONDS)*1e3)}static removeThrottle(e,t,r,o){let i=At(t,r,o),s=this.generateThrottlingStorageKey(i);e.removeItem(s,r.correlationId)}};var ho=class n extends v{constructor(e,t,r){super(e.errorCode,e.errorMessage,e.subError),Object.setPrototypeOf(this,n.prototype),this.name="NetworkError",this.error=e,this.httpStatus=t,this.responseHeaders=r}};function Br(n,e,t,r){return n.errorMessage=`${n.errorMessage}, additionalErrorInfo: error.name:${r?.name}, error.message:${r?.message}`,new ho(n,e,t)}var Gt=class{constructor(e,t){this.config=cl(e),this.logger=new me(this.config.loggerOptions,Ni,ro),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t}createTokenRequestHeaders(e){let t={};if(t[W.CONTENT_TYPE]=g.URL_FORM_CONTENT_TYPE,!this.config.systemOptions.preventCorsPreflight&&e)switch(e.type){case le.HOME_ACCOUNT_ID:try{let r=$e(e.credential);t[W.CCS_HEADER]=`Oid:${r.uid}@${r.utid}`}catch(r){this.logger.verbose("Could not parse home account ID for CCS Header: "+r)}break;case le.UPN:t[W.CCS_HEADER]=`UPN: ${e.credential}`;break}return t}executePostToTokenEndpoint(e,t,r,o,i,s){return d(this,null,function*(){s&&this.performanceClient?.addQueueMeasurement(s,i);let a=yield this.sendPostRequest(o,e,{body:t,headers:r},i);return this.config.serverTelemetryManager&&a.status<500&&a.status!==429&&this.config.serverTelemetryManager.clearTelemetryCache(),a})}sendPostRequest(e,t,r,o){return d(this,null,function*(){Tt.preProcess(this.cacheManager,e,o);let i;try{i=yield u(this.networkClient.sendPostRequestAsync.bind(this.networkClient),c.NetworkClientSendPostRequestAsync,this.logger,this.performanceClient,o)(t,r);let s=i.headers||{};this.performanceClient?.addFields({refreshTokenSize:i.body.refresh_token?.length||0,httpVerToken:s[W.X_MS_HTTP_VERSION]||"",requestId:s[W.X_MS_REQUEST_ID]||""},o)}catch(s){if(s instanceof ho){let a=s.responseHeaders;throw a&&this.performanceClient?.addFields({httpVerToken:a[W.X_MS_HTTP_VERSION]||"",requestId:a[W.X_MS_REQUEST_ID]||"",contentTypeHeader:a[W.CONTENT_TYPE]||void 0,contentLengthHeader:a[W.CONTENT_LENGTH]||void 0,httpStatus:s.httpStatus},o),s.error}throw s instanceof v?s:f(sr)}return Tt.postProcess(this.cacheManager,e,i,o),i})}updateAuthority(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.UpdateTokenEndpointAuthority,t);let r=`https://${e}/${this.authority.tenant}/`,o=yield oc(r,this.networkClient,this.cacheManager,this.authority.options,this.logger,t,this.performanceClient);this.authority=o})}createTokenQueryParameters(e){let t=new Map;return e.embeddedClientId&&yt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenQueryParameters&&Ct(t,e.tokenQueryParameters),Hr(t,e.correlationId),Mr(t,e.correlationId,this.performanceClient),je(t)}};var Ye={};ye(Ye,{badToken:()=>zt,consentRequired:()=>ic,interactionRequired:()=>nc,interruptedUser:()=>uo,loginRequired:()=>sc,nativeAccountUnavailable:()=>ai,noTokensFound:()=>qt,refreshTokenExpired:()=>ci,uxNotAllowed:()=>ji});var qt="no_tokens_found",ai="native_account_unavailable",ci="refresh_token_expired",ji="ux_not_allowed",nc="interaction_required",ic="consent_required",sc="login_required",zt="bad_token",uo="interrupted_user";var gl=[nc,ic,sc,zt,ji,uo],Th=["message_only","additional_action","basic_action","user_password_expired","consent_required","bad_token","interrupted_user"],li={[qt]:"No refresh token found in the cache. Please sign-in.",[ai]:"The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",[ci]:"Refresh token has expired.",[zt]:"Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",[
5ji]:"`canShowUI` flag in Edge was set to false. User interaction required on web page. Please invoke an interactive API to resolve.",[uo]:"The user could not be authenticated due to an interrupted state. Please invoke an interactive API to resolve."},fl={noTokensFoundError:{code:qt,desc:li[qt]},native_account_unavailable:{code:ai,desc:li[ai]},bad_token:{code:zt,desc:li[zt]},interrupted_user:{code:uo,desc:li[uo]}},ne=class n extends v{constructor(e,t,r,o,i,s,a,l){super(e,t,r),Object.setPrototypeOf(this,n.prototype),this.timestamp=o||g.EMPTY_STRING,this.traceId=i||g.EMPTY_STRING,this.correlationId=s||g.EMPTY_STRING,this.claims=a||g.EMPTY_STRING,this.name="InteractionRequiredAuthError",this.errorNo=l}};function Wi(n,e,t){let r=!!n&&gl.indexOf(n)>-1,o=!!t&&Th.indexOf(t)>-1,i=!!e&&gl.some(s=>e.indexOf(s)>-1);return r||i||o}function Kr(n){return new ne(n,li[n])}var He=class n{static setRequestState(e,t,r){let o=n.generateLibraryState(e,r);return t?`${o}${g.RESOURCE_DELIM}${t}`:o}static generateLibraryState(e,t){if(!e)throw f(Dt);let r={id:e.createNewGuid()};t&&(r.meta=t);let o=JSON.stringify(r);return e.base64Encode(o)}static parseRequestState(e,t){if(!e)throw f(Dt);if(!t)throw f(De);try{let r=t.split(g.RESOURCE_DELIM),o=r[0],i=r.length>1?r.slice(1).join(g.RESOURCE_DELIM):g.EMPTY_STRING,s=e.base64Decode(o),a=JSON.parse(s);return{userRequestState:i||g.EMPTY_STRING,libraryState:a}}catch{throw f(De)}}};var Eh={SW:"sw"},Te=class{constructor(e,t){this.cryptoUtils=e,this.performanceClient=t}generateCnf(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.PopTokenGenerateCnf,e.correlationId);let r=yield u(this.generateKid.bind(this),c.PopTokenGenerateCnf,t,this.performanceClient,e.correlationId)(e),o=this.cryptoUtils.base64UrlEncode(JSON.stringify(r));return{kid:r.kid,reqCnfString:o}})}generateKid(e){return d(this,null,function*(){return this.performanceClient?.addQueueMeasurement(c.PopTokenGenerateKid,e.correlationId),{kid:yield this.cryptoUtils.getPublicKeyThumbprint(e),xms_ksl:Eh.SW}})}signPopToken(e,t,r){return d(this,null,function*(){return this.signPayload(e,t,r)})}signPayload(e,t,r,o){return d(this,null,function*(){let{resourceRequestMethod:i,resourceRequestUri:s,shrClaims:a,shrNonce:l,shrOptions:h}=r,p=(s?new _(s):void 0)?.getUrlComponents();return this.cryptoUtils.signJwt(y({at:e,ts:Se(),m:i?.toUpperCase(),u:p?.HostNameAndPort,nonce:l||this.cryptoUtils.createNewGuid(),p:p?.AbsolutePath,q:p?.QueryString?[[],p.QueryString]:void 0,client_claims:a||void 0},o),t,h,r.correlationId)})}};var Qi=class{constructor(e,t){this.cache=e,this.hasChanged=t}get cacheHasChanged(){return this.hasChanged}get tokenCache(){return this.cache}};var Fe=class n{constructor(e,t,r,o,i,s,a){this.clientId=e,this.cacheStorage=t,this.cryptoObj=r,this.logger=o,this.serializableCache=i,this.persistencePlugin=s,this.performanceClient=a}validateTokenResponse(e,t){if(e.error||e.error_description||e.suberror){let r=`Error(s): ${e.error_codes||g.NOT_AVAILABLE} - Timestamp: ${e.timestamp||g.NOT_AVAILABLE} - Description: ${e.error_description||g.NOT_AVAILABLE} - Correlation ID: ${e.correlation_id||g.NOT_AVAILABLE} - Trace ID: ${e.trace_id||g.NOT_AVAILABLE}`,o=e.error_codes?.length?e.error_codes[0]:void 0,i=new Ae(e.error,r,e.suberror,o,e.status);if(t&&e.status&&e.status>=Me.SERVER_ERROR_RANGE_START&&e.status<=Me.SERVER_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed. 6${i}`);return}else if(t&&e.status&&e.status>=Me.CLIENT_ERROR_RANGE_START&&e.status<=Me.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token. 7${i}`);return}throw Wi(e.error,e.error_description,e.suberror)?new ne(e.error,e.error_description,e.suberror,e.timestamp||g.EMPTY_STRING,e.trace_id||g.EMPTY_STRING,e.correlation_id||g.EMPTY_STRING,e.claims||g.EMPTY_STRING,o):i}}handleServerTokenResponse(e,t,r,o,i,s,a,l,h,m){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.HandleServerTokenResponse,e.correlation_id);let p;if(e.id_token){if(p=mt(e.id_token||g.EMPTY_STRING,this.cryptoObj.base64Decode),s&&s.nonce&&p.nonce!==s.nonce)throw f(dr);if(o.maxAge||o.maxAge===0){let O=p.auth_time;if(!O)throw f(ct);Gn(O,o.maxAge)}}this.homeAccountIdentifier=D.generateHomeAccountId(e.client_info||g.EMPTY_STRING,t.authorityType,this.logger,this.cryptoObj,p);let C;s&&s.state&&(C=He.parseRequestState(this.cryptoObj,s.state)),e.key_id=e.key_id||o.sshKid||void 0;let T=this.generateCacheRecord(e,t,r,o,p,a,s),P;try{if(this.persistencePlugin&&this.serializableCache&&(this.logger.verbose("Persistence enabled, calling beforeCacheAccess"),P=new Qi(this.serializableCache,!0),yield this.persistencePlugin.beforeCacheAccess(P)),l&&!h&&T.account&&this.cacheStorage.getAllAccounts({homeAccountId:T.account.homeAccountId,environment:T.account.environment},o.correlationId).length<1)return this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"),this.performanceClient?.addFields({acntLoggedOut:!0},o.correlationId),yield n.generateAuthenticationResult(this.cryptoObj,t,T,!1,o,p,C,void 0,m);yield this.cacheStorage.saveCacheRecord(T,o.correlationId,Qs(p||{}),i,o.storeInCache)}finally{this.persistencePlugin&&this.serializableCache&&P&&(this.logger.verbose("Persistence enabled, calling afterCacheAccess"),yield this.persistencePlugin.afterCacheAccess(P))}return n.generateAuthenticationResult(this.cryptoObj,t,T,!1,o,p,C,e,m)})}generateCacheRecord(e,t,r,o,i,s,a){let l=t.getPreferredCache();if(!l)throw f(dt);let h=Or(i),m,p;e.id_token&&i&&(m=Za(this.homeAccountIdentifier,l,e.id_token,this.clientId,h||""),p=mo(this.cacheStorage,t,this.homeAccountIdentifier,this.cryptoObj.base64Decode,o.
7correlationId,i,e.client_info,l,h,a,void 0,this.logger));let C=null;if(e.access_token){let O=e.scope?z.fromString(e.scope):new z(o.scopes||[]),ae=(typeof e.expires_in=="string"?parseInt(e.expires_in,10):e.expires_in)||0,Ne=(typeof e.ext_expires_in=="string"?parseInt(e.ext_expires_in,10):e.ext_expires_in)||0,q=(typeof e.refresh_in=="string"?parseInt(e.refresh_in,10):e.refresh_in)||void 0,de=r+ae,er=de+Ne,tr=q&&q>0?r+q:void 0;C=ec(this.homeAccountIdentifier,l,e.access_token,this.clientId,h||t.tenant||"",O.printScopes(),de,er,this.cryptoObj.base64Decode,tr,e.token_type,s,e.key_id,o.claims,o.requestedClaimsHash)}let T=null;if(e.refresh_token){let O;if(e.refresh_token_expires_in){let ae=typeof e.refresh_token_expires_in=="string"?parseInt(e.refresh_token_expires_in,10):e.refresh_token_expires_in;O=r+ae,this.performanceClient?.addFields({ntwkRtExpiresOnSeconds:O},o.correlationId)}T=tc(this.homeAccountIdentifier,l,e.refresh_token,this.clientId,e.foci,s,O)}let P=null;return e.foci&&(P={clientId:this.clientId,environment:l,familyId:e.foci}),{account:p,idToken:m,accessToken:C,refreshToken:T,appMetadata:P}}static generateAuthenticationResult(e,t,r,o,i,s,a,l,h){return d(this,null,function*(){let m=g.EMPTY_STRING,p=[],C=null,T,P,O=g.EMPTY_STRING;if(r.accessToken){if(r.accessToken.tokenType===N.POP&&!i.popKid){let de=new Te(e),{secret:er,keyId:tr}=r.accessToken;if(!tr)throw f(Tr);m=yield de.signPopToken(er,tr,i)}else m=r.accessToken.secret;p=z.fromString(r.accessToken.target).asArray(),C=ii(r.accessToken.expiresOn),T=ii(r.accessToken.extendedExpiresOn),r.accessToken.refreshOn&&(P=ii(r.accessToken.refreshOn))}r.appMetadata&&(O=r.appMetadata.familyId===rr?rr:"");let ae=s?.oid||s?.sub||"",Ne=s?.tid||"";l?.spa_accountid&&r.account&&(r.account.nativeAccountId=l?.spa_accountid);let q=r.account?Pr(D.getAccountInfo(r.account),void 0,s,r.idToken?.secret):null;return{authority:t.canonicalAuthority,uniqueId:ae,tenantId:Ne,scopes:p,account:q,idToken:r?.idToken?.secret||"",idTokenClaims:s||{},accessToken:m,fromCache:o,expiresOn:C,extExpiresOn:T,refreshOn:P,correlationId:i.correlationId,requestId:h||g.EMPTY_STRING,familyId:O,tokenType:r.accessToken?.tokenType||g.EMPTY_STRING,state:a?a.userRequestState:g.EMPTY_STRING,cloudGraphHostName:r.account?.cloudGraphHostName||g.EMPTY_STRING,msGraphHost:r.account?.msGraphHost||g.EMPTY_STRING,code:l?.spa_code,fromNativeBroker:!1}})}};function mo(n,e,t,r,o,i,s,a,l,h,m,p){p?.verbose("setCachedAccount called");let T=n.getAccountKeys().find(q=>q.startsWith(t)),P=null;T&&(P=n.getAccount(T,o));let O=P||D.createAccount({homeAccountId:t,idTokenClaims:i,clientInfo:s,environment:a,cloudGraphHostName:h?.cloud_graph_host_name,msGraphHost:h?.msgraph_host,nativeAccountId:m},e,r),ae=O.tenantProfiles||[],Ne=l||O.realm;if(Ne&&!ae.find(q=>q.tenantId===Ne)){let q=Ve(t,O.localAccountId,Ne,i);ae.push(q)}return O.tenantProfiles=ae,O}function Yi(n,e,t){return d(this,null,function*(){return typeof n=="string"?n:n({clientId:e,tokenEndpoint:t})})}var Gr=class extends Gt{constructor(e,t){super(e,t),this.includeRedirectUri=!0,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}acquireToken(e,t,r){return d(this,null,function*(){if(this.performanceClient?.addQueueMeasurement(c.AuthClientAcquireToken,e.correlationId),!e.code)throw f(mr);let o=Se(),i=yield u(this.executeTokenRequest.bind(this),c.AuthClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(this.authority,e),s=i.headers?.[W.X_MS_REQUEST_ID],a=new Fe(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin,this.performanceClient);return a.validateTokenResponse(i.body),u(a.handleServerTokenResponse.bind(a),c.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(i.body,this.authority,o,e,t,r,void 0,void 0,void 0,s)})}getLogoutUri(e){if(!e)throw M(kr);let t=this.createLogoutUrlQueryString(e);return _.appendQueryString(this.authority.endSessionEndpoint,t)}executeTokenRequest(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthClientExecuteTokenRequest,t.correlationId);let r=this.createTokenQueryParameters(t),o=_.appendQueryString(e.tokenEndpoint,r),i=yield u(this.createTokenRequestBody.bind(this),c.AuthClientCreateTokenRequestBody,this.logger,this.performanceClient,t.correlationId)(t),s;if(t.clientInfo)try{let h=oo(t.clientInfo,this.cryptoUtils.base64Decode);s={credential:`${h.uid}${st.CLIENT_INFO_SEPARATOR}${h.utid}`,type:le.HOME_ACCOUNT_ID}}catch(h){this.logger.verbose("Could not parse client info for CCS Header: "+h)}let a=this.createTokenRequestHeaders(s||t.ccsCredential),l=At(this.config.authOptions.clientId,t);return u(this.executePostToTokenEndpoint.bind(this),c.AuthorizationCodeClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,t.correlationId)(o,i,a,l,t.correlationId,c.AuthorizationCodeClientExecutePostToTokenEndpoint)})}createTokenRequestBody(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthClientCreateTokenRequestBody,e.correlationId);let t=new Map;if(Dr(t,e.embeddedClientId||e.tokenBodyParameters?.[Qe]||this.config.authOptions.clientId),this.includeRedirectUri)Lr(t,e.redirectUri);else if(!e.redirectUri)throw M(Er);if(Ur(t,e.scopes,!0,this.oidcDefaultScopes),ja(t,e.code),jn(t,this.config.libraryInfo),Wn(t,this.config.telemetry.application),ni(t),this.serverTelemetryManager&&!Li(this.config)&&oi(t,this.serverTelemetryManager),e.codeVerifier&&Qa(t,e.codeVerifier),this.config.clientCredentials.clientSecret&&Yn(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let i=this.config.clientCredentials.clientAssertion;Jn(t,yield Yi(i.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Xn(t,i.assertionType)}if(Zn(t,cn.AUTHORIZATION_CODE_GRANT),Fr(t),e.authenticationScheme===N.POP){let i=new Te(this.cryptoUtils,this.performanceClient),s;e.popKid?s=this.cryptoUtils.encodeKid(e.popKid):s=(yield u(i.generateCnf.bind(i),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,ti(t,s)}else if(e.authenticationScheme===N.SSH)if(e.sshJwk)ri(t,e.sshJwk);else throw M(ut);let r;if(e.clientInfo)try{let i=oo(e.clientInfo,this.cryptoUtils.base64Decode);r={credential:`${i.uid}${st.CLIENT_INFO_SEPARATOR}${i.utid}`,type:le.HOME_ACCOUNT_ID}}catch(i){this.logger.verbose("Could not parse client info for CCS Header: "+i)}else r=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&r)switch(r.type){case le.HOME_ACCOUNT_ID:try{let i=$e(r.credential);
7ft(t,i)}catch(i){this.logger.verbose("Could not parse home account ID for CCS Header: "+i)}break;case le.UPN:Kt(t,r.credential);break}e.embeddedClientId&&yt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenBodyParameters&&Ct(t,e.tokenBodyParameters),e.enableSpaAuthorizationCode&&(!e.tokenBodyParameters||!e.tokenBodyParameters[Bi])&&Ct(t,{[Bi]:"1"}),Mr(t,e.correlationId,this.performanceClient);let o=e.skipBrokerClaims&&t.has(Le)?void 0:this.config.authOptions.clientCapabilities;return(!L.isEmptyObj(e.claims)||o&&o.length>0)&&xr(t,e.claims,o),je(t)})}createLogoutUrlQueryString(e){let t=new Map;return e.postLogoutRedirectUri&&Ga(t,e.postLogoutRedirectUri),e.correlationId&&Hr(t,e.correlationId),e.idTokenHint&&qa(t,e.idTokenHint),e.state&&Qn(t,e.state),e.logoutHint&&Ja(t,e.logoutHint),e.extraQueryParameters&&Ct(t,e.extraQueryParameters),this.config.authOptions.instanceAware&&ei(t),je(t,this.config.authOptions.encodeExtraQueryParams,e.extraQueryParameters)}};var Ih=300,di=class extends Gt{constructor(e,t){super(e,t)}acquireToken(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireToken,e.correlationId);let r=Se(),o=yield u(this.executeTokenRequest.bind(this),c.RefreshTokenClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(e,this.authority),i=o.headers?.[W.X_MS_REQUEST_ID],s=new Fe(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o.body),u(s.handleServerTokenResponse.bind(s),c.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,r,e,t,void 0,void 0,!0,e.forceCache,i)})}acquireTokenByRefreshToken(e,t){return d(this,null,function*(){if(!e)throw M(wr);if(this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireTokenByRefreshToken,e.correlationId),!e.account)throw f(lt);if(this.cacheManager.isAppMetadataFOCI(e.account.environment))try{return yield u(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!0,t)}catch(o){let i=o instanceof ne&&o.errorCode===qt,s=o instanceof Ae&&o.errorCode===Ri.INVALID_GRANT_ERROR&&o.subError===Ri.CLIENT_MISMATCH_ERROR;if(i||s)return u(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1,t);throw o}return u(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1,t)})}acquireTokenWithCachedRefreshToken(e,t,r){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,e.correlationId);let o=G(this.cacheManager.getRefreshToken.bind(this.cacheManager),c.CacheManagerGetRefreshToken,this.logger,this.performanceClient,e.correlationId)(e.account,t,e.correlationId,void 0,this.performanceClient);if(!o)throw Kr(qt);if(o.expiresOn){let s=e.refreshTokenExpirationOffsetSeconds||Ih;if(this.performanceClient?.addFields({cacheRtExpiresOnSeconds:Number(o.expiresOn),rtOffsetSeconds:s},e.correlationId),ao(o.expiresOn,s))throw Kr(ci)}let i=S(y({},e),{refreshToken:o.secret,authenticationScheme:e.authenticationScheme||N.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:le.HOME_ACCOUNT_ID}});try{return yield u(this.acquireToken.bind(this),c.RefreshTokenClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(i,r)}catch(s){if(s instanceof ne&&s.subError===zt){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");let a=this.cacheManager.generateCredentialKey(o);this.cacheManager.removeRefreshToken(a,e.correlationId)}throw s}})}executeTokenRequest(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientExecuteTokenRequest,e.correlationId);let r=this.createTokenQueryParameters(e),o=_.appendQueryString(t.tokenEndpoint,r),i=yield u(this.createTokenRequestBody.bind(this),c.RefreshTokenClientCreateTokenRequestBody,this.logger,this.performanceClient,e.correlationId)(e),s=this.createTokenRequestHeaders(e.ccsCredential),a=At(this.config.authOptions.clientId,e);return u(this.executePostToTokenEndpoint.bind(this),c.RefreshTokenClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,e.correlationId)(o,i,s,a,e.correlationId,c.RefreshTokenClientExecutePostToTokenEndpoint)})}createTokenRequestBody(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientCreateTokenRequestBody,e.correlationId);let t=new Map;if(Dr(t,e.embeddedClientId||e.tokenBodyParameters?.[Qe]||this.config.authOptions.clientId),e.redirectUri&&Lr(t,e.redirectUri),Ur(t,e.scopes,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),Zn(t,cn.REFRESH_TOKEN_GRANT),Fr(t),jn(t,this.config.libraryInfo),Wn(t,this.config.telemetry.application),ni(t),this.serverTelemetryManager&&!Li(this.config)&&oi(t,this.serverTelemetryManager),Wa(t,e.refreshToken),this.config.clientCredentials.clientSecret&&Yn(t,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;Jn(t,yield Yi(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Xn(t,o.assertionType)}if(e.authenticationScheme===N.POP){let o=new Te(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(yield u(o.generateCnf.bind(o),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,ti(t,i)}else if(e.authenticationScheme===N.SSH)if(e.sshJwk)ri(t,e.sshJwk);else throw M(ut);if(this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case le.HOME_ACCOUNT_ID:try{let o=$e(e.ccsCredential.credential);ft(t,o)}catch(o){this.logger.verbose("Could not parse home account ID for CCS Header: "+o)}break;case le.UPN:Kt(t,e.ccsCredential.credential);break}e.embeddedClientId&&yt(t,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.tokenBodyParameters&&Ct(t,e.tokenBodyParameters),Mr(t,e.correlationId,this.performanceClient);let r=e.skipBrokerClaims&&t.has(Le)?void 0:this.config.authOptions.clientCapabilities;return(!L.isEmptyObj(e.claims)||r&&r.length>0)&&xr(t,e.claims,r),je(t)})}};var hi=class extends Gt{constructor(e,t){super(e,t)}acquireCachedToken(e){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.SilentFlowClientAcquireCachedToken,e.correlationId);let t=qe.NOT_APPLICABLE;if(e.forceRefresh||!this.config.cacheOptions.claimsBasedCachingEnabled&&!L.isEmptyObj(e.claims))throw this.setCacheOutcome(qe.FORCE_REFRESH_OR_CLAIMS,e.correlationId),f(ht);if(!e.account)throw f(lt);let r=e.account.tenantId||pl(e.authority),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,r);if(i){if(Xa(i.cachedAt)||ao(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(qe.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),f(ht);i.refreshOn&&ao(i.refreshOn,0)&&(t=qe.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(qe.NO_CACHED_ACCESS_TOKEN,e.correlationId),f(ht);let s=e.authority||this.authority.getPreferredCache(),a={account:this.cacheManager.getAccount(this.cacheManager.generateAccountKey(e.account),e.correlationId),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,e.correlationId,o,r,this.performanceClient),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCac
7he(s)};return this.setCacheOutcome(t,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[yield u(this.generateResultFromCacheRecord.bind(this),c.SilentFlowClientGenerateResultFromCacheRecord,this.logger,this.performanceClient,e.correlationId)(a,e),t]})}setCacheOutcome(e,t){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},t),e!==qe.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: ${e}`)}generateResultFromCacheRecord(e,t){return d(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.SilentFlowClientGenerateResultFromCacheRecord,t.correlationId);let r;if(e.idToken&&(r=mt(e.idToken.secret,this.config.cryptoInterface.base64Decode)),t.maxAge||t.maxAge===0){let o=r?.auth_time;if(!o)throw f(ct);Gn(o,t.maxAge)}return Fe.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,t,r)})}};var ac={sendGetRequestAsync:()=>Promise.reject(f(R)),sendPostRequestAsync:()=>Promise.reject(f(R))};var _e={};ye(_e,{getAuthorizationCodePayload:()=>wh,getAuthorizeUrl:()=>vh,getStandardAuthorizeRequestParameters:()=>Sh,validateAuthorizationResponse:()=>Cl});function Sh(n,e,t,r){let o=e.correlationId,i=new Map;Dr(i,e.embeddedClientId||e.extraQueryParameters?.[Qe]||n.clientId);let s=[...e.scopes||[],...e.extraScopesToConsent||[]];if(Ur(i,s,!0,n.authority.options.OIDCOptions?.defaultScopes),Lr(i,e.redirectUri),Hr(i,o),Ka(i,e.responseMode),Fr(i),Ya(i),e.prompt&&($a(i,e.prompt),r?.addFields({prompt:e.prompt},o)),e.domainHint&&(za(i,e.domainHint),r?.addFields({domainHintFromRequest:!0},o)),e.prompt!==K.SELECT_ACCOUNT)if(e.sid&&e.prompt===K.NONE)t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request"),Gi(i,e.sid),r?.addFields({sidFromRequest:!0},o);else if(e.account){let l=Rh(e.account),h=_h(e.account);if(h&&e.domainHint&&(t.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint'),h=null),h){t.verbose("createAuthCodeUrlQueryString: login_hint claim present on account"),so(i,h),r?.addFields({loginHintFromClaim:!0},o);try{let m=$e(e.account.homeAccountId);ft(i,m)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(l&&e.prompt===K.NONE){t.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account"),Gi(i,l),r?.addFields({sidFromClaim:!0},o);try{let m=$e(e.account.homeAccountId);ft(i,m)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(e.loginHint)t.verbose("createAuthCodeUrlQueryString: Adding login_hint from request"),so(i,e.loginHint),Kt(i,e.loginHint),r?.addFields({loginHintFromRequest:!0},o);else if(e.account.username){t.verbose("createAuthCodeUrlQueryString: Adding login_hint from account"),so(i,e.account.username),r?.addFields({loginHintFromUpn:!0},o);try{let m=$e(e.account.homeAccountId);ft(i,m)}catch{t.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}}else e.loginHint&&(t.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request"),so(i,e.loginHint),Kt(i,e.loginHint),r?.addFields({loginHintFromRequest:!0},o));else t.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");e.nonce&&Va(i,e.nonce),e.state&&Qn(i,e.state),e.embeddedClientId&&yt(i,n.clientId,n.redirectUri);let a=e.skipBrokerClaims&&i.has(Le)?void 0:n.clientCapabilities;return(e.claims||a&&a.length>0)&&xr(i,e.claims,a),n.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(io))&&ei(i),i}function vh(n,e,t,r){let o=je(e,t,r);return _.appendQueryString(n.authorizationEndpoint,o)}function wh(n,e){if(Cl(n,e),!n.code)throw f(yr);return n}function Cl(n,e){if(!n.state||!e)throw n.state?f(Mt,"Cached State"):f(Mt,"Server State");let t,r;try{t=decodeURIComponent(n.state)}catch{throw f(De,n.state)}try{r=decodeURIComponent(e)}catch{throw f(De,n.state)}if(t!==r)throw f(lr);if(n.error||n.error_description||n.suberror){let o=kh(n);throw Wi(n.error,n.error_description,n.suberror)?new ne(n.error||"",n.error_description,n.suberror,n.timestamp||"",n.trace_id||"",n.correlation_id||"",n.claims||"",o):new Ae(n.error||"",n.error_description,n.suberror,o)}}function kh(n){let e="code=",t=n.error_uri?.lastIndexOf(e);return t&&t>=0?n.error_uri?.substring(t+e.length):void 0}function Rh(n){return n.idTokenClaims?.sid||null}function _h(n){return n.loginHint||n.idTokenClaims?.login_hint||null}var yl=",",Al="|";function bh(n){let{skus:e,libraryName:t,libraryVersion:r,extensionName:o,extensionVersion:i}=n,s=new Map([[0,[t,r]],[2,[o,i]]]),a=[];if(e?.length){if(a=e.split(yl),a.length<4)return e}else a=Array.from({length:4},()=>Al);
7return s.forEach((l,h)=>{l.length===2&&l[0]?.length&&l[1]?.length&&Ph({skuArr:a,index:h,skuName:l[0],skuVersion:l[1]})}),a.join(yl)}function Ph(n){let{skuArr:e,index:t,skuName:r,skuVersion:o}=n;t>=e.length||(e[t]=[r,o].join(Al))}var qr=class n{constructor(e,t){this.cacheOutcome=qe.NOT_APPLICABLE,this.cacheManager=t,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||g.EMPTY_STRING,this.wrapperVer=e.wrapperVer||g.EMPTY_STRING,this.telemetryCacheKey=te.CACHE_KEY+st.CACHE_KEY_SEPARATOR+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${te.VALUE_SEPARATOR}${this.cacheOutcome}`,t=[this.wrapperSKU,this.wrapperVer],r=this.getNativeBrokerErrorCode();r?.length&&t.push(`broker_error=${r}`);let o=t.join(te.VALUE_SEPARATOR),i=this.getRegionDiscoveryFields(),s=[e,i].join(te.VALUE_SEPARATOR);return[te.SCHEMA_VERSION,s,o].join(te.CATEGORY_SEPARATOR)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),t=n.maxErrorsToSend(e),r=e.failedRequests.slice(0,2*t).join(te.VALUE_SEPARATOR),o=e.errors.slice(0,t).join(te.VALUE_SEPARATOR),i=e.errors.length,s=t<i?te.OVERFLOW_TRUE:te.OVERFLOW_FALSE,a=[i,s].join(te.VALUE_SEPARATOR);return[te.SCHEMA_VERSION,e.cacheHits,r,o,a].join(te.CATEGORY_SEPARATOR)}cacheFailedRequest(e){let t=this.getLastRequests();t.errors.length>=te.MAX_CACHED_ERRORS&&(t.failedRequests.shift(),t.failedRequests.shift(),t.errors.shift()),t.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof v?e.subError?t.errors.push(e.subError):e.errorCode?t.errors.push(e.errorCode):t.errors.push(e.toString()):t.errors.push(e.toString()):t.errors.push(te.UNKNOWN_ERROR),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t,this.correlationId)}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey)||e}clearTelemetryCache(){let e=this.getLastRequests(),t=n.maxErrorsToSend(e),r=e.errors.length;if(t===r)this.cacheManager.removeItem(this.telemetryCacheKey,this.correlationId);else{let o={failedRequests:e.failedRequests.slice(t*2),errors:e.errors.slice(t),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o,this.correlationId)}}static maxErrorsToSend(e){let t,r=0,o=0,i=e.errors.length;for(t=0;t<i;t++){let s=e.failedRequests[2*t]||g.EMPTY_STRING,a=e.failedRequests[2*t+1]||g.EMPTY_STRING,l=e.errors[t]||g.EMPTY_STRING;if(o+=s.toString().length+a.toString().length+l.length+3,o<te.MAX_LAST_HEADER_BYTES)r+=1;else break}return r}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||g.EMPTY_STRING),e.push(this.regionSource||g.EMPTY_STRING),e.push(this.regionOutcome||g.EMPTY_STRING),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let t=this.getLastRequests();t.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t,this.correlationId)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId)}static makeExtraSkuString(e){return bh(e)}};var Ji="missing_kid_error",Xi="missing_alg_error";var Oh={[Ji]:"The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",[Xi]:"The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."},cc=class n extends v{constructor(e,t){super(e,t),this.name="JoseHeaderError",Object.setPrototypeOf(this,n.prototype)}};function lc(n){return new cc(n,Oh[n])}var ui=class n{constructor(e){this.typ=e.typ,this.alg=e.alg,this.kid=e.kid}static getShrHeaderString(e){if(!e.kid)throw lc(Ji);if(!e.alg)throw lc(Xi);let t=new n({typ:e.typ||Pi.Pop,kid:e.kid,alg:e.alg});return JSON.stringify(t)}};var zr="pkce_not_created",mi="ear_jwk_empty",Zi="ear_jwe_empty",$r="crypto_nonexistent",Je="empty_navigate_uri",po="hash_empty_error",$t="no_state_in_hash",go="hash_does_not_contain_known_properties",fo="unable_to_parse_state",Co="state_interaction_type_mismatch",yo="interaction_in_progress",Ao="popup_window_error",To="empty_window_error",Be="user_cancelled",es="monitor_popup_timeout",Eo="monitor_window_timeout",Io="redirect_in_iframe",So="block_iframe_reload",vo="block_nested_popups",ts="iframe_closed_prematurely",Xe="silent_logout_unsupported",wo="no_account_error",rs="silent_prompt_value_error",ko="no_token_request_cache_error",Ro="unable_to_parse_token_request_cache_error",os="auth_request_not_set_error",ns="invalid_cache_type",Ze="non_browser_environment",et="database_not_open",Et="no_network_connectivity",_o="post_request_failed",bo="get_request_failed",Vr="failed_to_parse_response",Po="unable_to_load_token",Vt="crypto_key_not_found",Oo="auth_code_required",No="auth_code_or_nativeAccountId_required",Mo="spa_code_and_nativeAccountId_present",jt="database_unavailable",Uo="unable_to_acquire_token_from_native_platform",Do="native_handshake_timeout",Lo="native_extension_not_installed",Wt="native_connection_not_established",tt="uninitialized_public_client_application",xo="native_prompt_not_supported",Ho="invalid_base64_string",Fo="invalid_pop_token_request",is="failed_to_build_headers",ss="failed_to_parse_headers",Bo="failed_to_decrypt_ear_response",jr="timed_out";var It="For more visit: aka.ms/msaljs/browser-errors",k={[zr]:"The PKCE code challenge and verifier could not be generated.",[mi]:"No EAR encryption key provided. This is unexpected.",[Zi]:"Server response does not contain ear_jwe property. This is unexpected.",[$r]:"The crypto object or function is not available.",[Je]:"Navigation URI is empty. Please check stack trace for more info.",[po]:`Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. ${It}`,[$t]:"Hash does not contain state. Please verify that the request originated from msal.",[go]:`Hash does not contain known properites. Please verify that your redirectUri is not changing the hash. ${It}`,[fo]:"Unable to parse state. Please verify that the request originated from msal.",[Co]:"Hash contains state but the interaction type does not match the caller.",[yo]:`Interaction is currently in progress. Please ensure that this interaction has been completed before calling an interactive API. ${It}`,[Ao]:"Error opening popup window. This can happen if you are using IE or if popups are blocked in the browser.",[To]:"window.open returned null or undefined window object.",[Be]:"User cancelled the flow.",[es]:`Token acquisition in popup failed due to timeout. ${It}`,[Eo]:`Token acquisition in iframe failed due to timeout. ${It}
7`,[Io]:"Redirects are not supported for iframed or brokered applications. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs.",[So]:`Request was blocked inside an iframe because MSAL detected an authentication response. ${It}`,[vo]:"Request was blocked inside a popup because MSAL detected it was running in a popup.",[ts]:"The iframe being monitored was closed prematurely.",[Xe]:"Silent logout not supported. Please call logoutRedirect or logoutPopup instead.",[wo]:"No account object provided to acquireTokenSilent and no active account has been set. Please call setActiveAccount or provide an account on the request.",[rs]:"The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'.",[ko]:"No token request found in cache.",[Ro]:"The cached token request could not be parsed.",[os]:"Auth Request not set. Please ensure initiateAuthRequest was called from the InteractionHandler",[ns]:"Invalid cache type",[Ze]:"Login and token requests are not supported in non-browser environments.",[et]:"Database is not open!",[Et]:"No network connectivity. Check your internet connection.",[_o]:"Network request failed: If the browser threw a CORS error, check that the redirectUri is registered in the Azure App Portal as type 'SPA'",[bo]:"Network request failed. Please check the network trace to determine root cause.",[Vr]:"Failed to parse network response. Check network trace.",[Po]:"Error loading token to cache.",[Vt]:"Cryptographic Key or Keypair not found in browser storage.",[Oo]:"An authorization code must be provided (as the `code` property on the request) to this flow.",[No]:"An authorization code or nativeAccountId must be provided to this flow.",[Mo]:"Request cannot contain both spa code and native account id.",[jt]:"IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts.",[Uo]:`Unable to acquire token from native platform. ${It}`,[Do]:"Timed out while attempting to establish connection to browser extension",[Lo]:"Native extension is not installed. If you think this is a mistake call the initialize function.",[Wt]:`Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). ${It}`,[tt]:`You must call and await the initialize function before attempting to call any other MSAL API. ${It}`,[xo]:"The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",[Ho]:"Invalid base64 encoded string.",[Fo]:"Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",[is]:"Failed to build request headers object.",[ss]:"Failed to parse response headers",[Bo]:"Failed to decrypt ear response",[jr]:"The request timed out."},Cy={pkceNotGenerated:{code:zr,desc:k[zr]},cryptoDoesNotExist:{code:$r,desc:k[$r]},emptyNavigateUriError:{code:Je,desc:k[Je]},hashEmptyError:{code:po,desc:k[po]},hashDoesNotContainStateError:{code:$t,desc:k[$t]},hashDoesNotContainKnownPropertiesError:{code:go,desc:k[go]},unableToParseStateError:{code:fo,desc:k[fo]},stateInteractionTypeMismatchError:{code:Co,desc:k[Co]},interactionInProgress:{code:yo,desc:k[yo]},popupWindowError:{code:Ao,desc:k[Ao]},emptyWindowError:{code:To,desc:k[To]},userCancelledError:{code:Be,desc:k[Be]},monitorPopupTimeoutError:{code:es,desc:k[es]},monitorIframeTimeoutError:{code:Eo,desc:k[Eo]},redirectInIframeError:{code:Io,desc:k[Io]},blockTokenRequestsInHiddenIframeError:{code:So,desc:k[So]},blockAcquireTokenInPopupsError:{code:vo,desc:k[vo]},iframeClosedPrematurelyError:{code:ts,desc:k[ts]},silentLogoutUnsupportedError:{code:Xe,desc:k[Xe]},noAccountError:{code:wo,desc:k[wo]},silentPromptValueError:{code:rs,desc:k[rs]},noTokenRequestCacheError:{code:ko,desc:k[ko]},unableToParseTokenRequestCacheError:{code:Ro,desc:k[Ro]},authRequestNotSet:{code:os,desc:k[os]},invalidCacheType:{code:ns,desc:k[ns]},notInBrowserEnvironment:{code:Ze,desc:k[Ze]},databaseNotOpen:{code:et,desc:k[et]},noNetworkConnectivity:{code:Et,desc:k[Et]},postRequestFailed:{code:_o,desc:k[_o]},getRequestFailed:{code:bo,desc:k[bo]},failedToParseNetworkResponse:{code:Vr,desc:k[Vr]}
7,unableToLoadTokenError:{code:Po,desc:k[Po]},signingKeyNotFoundInStorage:{code:Vt,desc:k[Vt]},authCodeRequired:{code:Oo,desc:k[Oo]},authCodeOrNativeAccountRequired:{code:No,desc:k[No]},spaCodeAndNativeAccountPresent:{code:Mo,desc:k[Mo]},databaseUnavailable:{code:jt,desc:k[jt]},unableToAcquireTokenFromNativePlatform:{code:Uo,desc:k[Uo]},nativeHandshakeTimeout:{code:Do,desc:k[Do]},nativeExtensionNotInstalled:{code:Lo,desc:k[Lo]},nativeConnectionNotEstablished:{code:Wt,desc:k[Wt]},uninitializedPublicClientApplication:{code:tt,desc:k[tt]},nativePromptNotSupported:{code:xo,desc:k[xo]},invalidBase64StringError:{code:Ho,desc:k[Ho]},invalidPopTokenRequest:{code:Fo,desc:k[Fo]}},Wr=class n extends v{constructor(e,t){super(e,k[e],t),Object.setPrototypeOf(this,n.prototype),this.name="BrowserAuthError"}};function A(n,e){return new Wr(n,e)}var V={INVALID_GRANT_ERROR:"invalid_grant",POPUP_WIDTH:483,POPUP_HEIGHT:600,POPUP_NAME_PREFIX:"msal",DEFAULT_POLL_INTERVAL_MS:30,MSAL_SKU:"msal.js.browser"},ge={CHANNEL_ID:"53ee284d-920a-4b59-9d30-a60315b26836",PREFERRED_EXTENSION_ID:"ppnbnpeolgkicgegkbkbjmhlideopiji",MATS_TELEMETRY:"MATS",MICROSOFT_ENTRA_BROKERID:"MicrosoftEntra",DOM_API_NAME:"DOM API",PLATFORM_DOM_APIS:"get-token-and-sign-out",PLATFORM_DOM_PROVIDER:"PlatformAuthDOMHandler",PLATFORM_EXTENSION_PROVIDER:"PlatformAuthExtensionHandler"},Ko={HandshakeRequest:"Handshake",HandshakeResponse:"HandshakeResponse",GetToken:"GetToken",Response:"Response"},B={LocalStorage:"localStorage",SessionStorage:"sessionStorage",MemoryStorage:"memoryStorage"},dc={GET:"GET",POST:"POST"},Ke={SIGNIN:"signin",SIGNOUT:"signout"},j={ORIGIN_URI:"request.origin",URL_HASH:"urlHash",REQUEST_PARAMS:"request.params",VERIFIER:"code.verifier",INTERACTION_STATUS_KEY:"interaction.status",NATIVE_REQUEST:"request.native"},pi={WRAPPER_SKU:"wrapper.sku",WRAPPER_VER:"wrapper.version"},b={acquireTokenRedirect:861,acquireTokenPopup:862,ssoSilent:863,acquireTokenSilent_authCode:864,handleRedirectPromise:865,acquireTokenByCode:866,acquireTokenSilent_silentFlow:61,logout:961,logoutPopup:962,hydrateCache:963,loadExternalTokens:964},Tl={861:"acquireTokenRedirect",862:"acquireTokenPopup",863:"ssoSilent",864:"acquireTokenSilent_authCode",865:"handleRedirectPromise",866:"acquireTokenByCode",61:"acquireTokenSilent_silentFlow",961:"logout",962:"logoutPopup",963:"hydrateCache",964:"loadExternalTokens"},El=n=>typeof n=="number"&&n in Tl?Tl[n]:"unknown",I=function(n){return n.Redirect="redirect",n.Popup="popup",n.Silent="silent",n.None="none",n}(I||{}),X={Startup:"startup",Login:"login",Logout:"logout",AcquireToken:"acquireToken",SsoSilent:"ssoSilent",HandleRedirect:"handleRedirect",None:"none"},hc={scopes:Ie},uc="jwk",mc={React:"@azure/msal-react",Angular:"@azure/msal-angular"},as="msal.db",Il=1,Sl=`${as}.keys`,ie={Default:0,AccessToken:1,AccessTokenAndRefreshToken:2,RefreshToken:3,RefreshTokenAndNetwork:4,Skip:5},vl=[ie.Default,ie.Skip,ie.RefreshTokenAndNetwork];function gi(n){return encodeURIComponent(Qt(n).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"))}function be(n){return wl(n).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Qt(n){return wl(new TextEncoder().encode(n))}function wl(n){let e=Array.from(n,t=>String.fromCodePoint(t)).join("");return btoa(e)}function Z(n){return new TextDecoder().decode(rt(n))}function rt(n){let e=n.replace(/-/g,"+").replace(/_/g,"/");switch(e.length%4){case 0:break;case 2:e+="==";break;case 3:e+="=";break;default:throw A(Ho)}let t=atob(e);return Uint8Array.from(t,r=>r.codePointAt(0)||0)}var Nh="RSASSA-PKCS1-v1_5",Go="AES-GCM",_l="HKDF",gc="SHA-256",Mh=2048,Uh=new Uint8Array([1,0,1]),kl="0123456789abcdef",Rl=new
7Uint32Array(1),fc="raw",bl="encrypt",Cc="decrypt",Dh="deriveKey",Lh="crypto_subtle_undefined",yc={name:Nh,hash:gc,modulusLength:Mh,publicExponent:Uh};function Pl(n){if(!window)throw A(Ze);if(!window.crypto)throw A($r);if(!n&&!window.crypto.subtle)throw A($r,Lh)}function Ac(n,e,t){return d(this,null,function*(){e?.addQueueMeasurement(c.Sha256Digest,t);let o=new TextEncoder().encode(n);return window.crypto.subtle.digest(gc,o)})}function Ol(n){return window.crypto.getRandomValues(n)}function pc(){return window.crypto.getRandomValues(Rl),Rl[0]}function se(){let n=Date.now(),e=pc()*1024+(pc()&1023),t=new Uint8Array(16),r=Math.trunc(e/2**30),o=e&2**30-1,i=pc();t[0]=n/2**40,t[1]=n/2**32,t[2]=n/2**24,t[3]=n/2**16,t[4]=n/2**8,t[5]=n,t[6]=112|r>>>8,t[7]=r,t[8]=128|o>>>24,t[9]=o>>>16,t[10]=o>>>8,t[11]=o,t[12]=i>>>24,t[13]=i>>>16,t[14]=i>>>8,t[15]=i;let s="";for(let a=0;a<t.length;a++)s+=kl.charAt(t[a]>>>4),s+=kl.charAt(t[a]&15),(a===3||a===5||a===7||a===9)&&(s+="-");return s}function Nl(n,e){return d(this,null,function*(){return window.crypto.subtle.generateKey(yc,n,e)})}function cs(n){return d(this,null,function*(){return window.crypto.subtle.exportKey(uc,n)})}function Ml(n,e,t){return d(this,null,function*(){return window.crypto.subtle.importKey(uc,n,yc,e,t)})}function Ul(n,e){return d(this,null,function*(){return window.crypto.subtle.sign(yc,n,e)})}function qo(){return d(this,null,function*(){let n=yield Tc(),t={alg:"dir",kty:"oct",k:be(new Uint8Array(n))};return Qt(JSON.stringify(t))})}function xh(n){return d(this,null,function*(){let e=Z(n),r=JSON.parse(e).k,o=rt(r);return window.crypto.subtle.importKey(fc,o,Go,!1,[Cc])})}function Dl(n,e){return d(this,null,function*(){let t=e.split(".");if(t.length!==5)throw A(Bo,"jwe_length");let r=yield xh(n).catch(()=>{throw A(Bo,"import_key")});try{let o=new TextEncoder().encode(t[0]),i=rt(t[2]),s=rt(t[3]),a=rt(t[4]),l=a.byteLength*8,h=new Uint8Array(s.length+a.length);h.set(s),h.set(a,s.length);let m=yield window.crypto.subtle.decrypt({name:Go,iv:i,tagLength:l,additionalData:o},r,h);return new TextDecoder().decode(m)}catch{throw A(Bo,"decrypt")}})}function Tc(){return d(this,null,function*(){let n=yield window.crypto.subtle.generateKey({name:Go,length:256},!0,[bl,Cc]);return window.crypto.subtle.exportKey(fc,n)})}function Ec(n){return d(this,null,function*(){return window.crypto.subtle.importKey(fc,n,_l,!1,[Dh])})}function Ll(n,e,t){return d(this,null,function*(){return window.crypto.subtle.deriveKey({name:_l,salt:e,hash:gc,info:new TextEncoder().encode(t)},n,{name:Go,length:256},!1,[bl,Cc])})}function xl(n,e,t){return d(this,null,function*(){let r=new TextEncoder().encode(e),o=window.crypto.getRandomValues(new Uint8Array(16)),i=yield Ll(n,o,t),s=yield window.crypto.subtle.encrypt({name:Go,iv:new Uint8Array(12)},i,r);return{data:be(new Uint8Array(s)),nonce:be(o)}})}function Ic(n,e,t,r){return d(this,null,function*(){let o=rt(r),i=yield Ll(n,rt(e),t),s=yield window.crypto.subtle.decrypt({name:Go,iv:new Uint8Array(12)},i,o);return new TextDecoder().decode(s)})}function ls(n){return d(this,null,function*(){let e=yield Ac(n),t=new Uint8Array(e);return be(t)})}var Yt="storage_not_supported",ds="stubbed_public_client_application_called",zo="in_mem_redirect_unavailable";var hs={[Yt]:"Given storage configuration option was not supported.",[ds]:"Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",[zo]:"Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."},Hh={storageNotSupportedError:{code:Yt,desc:hs[Yt]},stubPcaInstanceCalled:{code:ds,desc:hs[ds]},inMemRedirectUnavailable:{code:zo,desc:hs[zo]}},$o=class n extends v{constructor(e,t){super(e,t),this.name="BrowserConfigurationAuthError",Object.setPrototypeOf(this,n.prototype)}};function Vo(n){return new $o(n,hs[n])}function fi(n){n.location.hash="",typeof n.history.replaceState=="function"&&n.history.replaceState(null,"",`${n.location.origin}${n.location.pathname}${n.location.search}`)}function Sc(n){let e=n.split("#");e.shift(),window.location.hash=e.length>0?e.join("#"):""}function Ci(){return window.parent!==window}function Hl(){return typeof window<"u"&&!!window.opener&&window.opener!==window&&typeof window.name=="string"&&window.name.indexOf(`${V.POPUP_NAME_PREFIX}.`)===0}function fe(){return typeof window<"u"&&window.location?window.location.href.split("?")[0].split("#")[0]:""}function vc(){let e=new _(window.location.href).getUrlComponents();return`${e.Protocol}//${e.HostNameAndPort}/`}function Fl(){if(_.hashContainsKnownProperties(window.location.hash)&&Ci())throw A(So)}function Bl(n){if(Ci()&&!n)throw A(Io)}function Kl(){if(Hl())throw A(vo)}function us(){if(typeof window>"u")throw A(Ze)}function ms(n){if(!n)throw A(tt)}function yi(n){us(),Fl(),Kl(),ms(n)}function ps(n,e){if(yi(n),Bl(e.system.allowRedirectInIframe),e.cache.cac
7heLocation===B.MemoryStorage&&!e.cache.storeAuthStateInCookie)throw Vo(zo)}function Ai(n){let e=document.createElement("link");e.rel="preconnect",e.href=new URL(n).origin,e.crossOrigin="anonymous",document.head.appendChild(e),window.setTimeout(()=>{try{document.head.removeChild(e)}catch{}},1e4)}function wc(){return se()}var Fh=F.addClientCapabilitiesToClaims;var Ti=class n{navigateInternal(e,t){return n.defaultNavigateWindow(e,t)}navigateExternal(e,t){return n.defaultNavigateWindow(e,t)}static defaultNavigateWindow(e,t){return t.noHistory?window.location.replace(e):window.location.assign(e),new Promise((r,o)=>{setTimeout(()=>{o(A(jr,"failed_to_redirect"))},t.timeout)})}};var fs=class{sendGetRequestAsync(e,t){return d(this,null,function*(){let r,o={},i=0,s=Gl(t);try{r=yield fetch(e,{method:dc.GET,headers:s})}catch(a){throw Br(A(window.navigator.onLine?bo:Et),void 0,void 0,a)}o=ql(r.headers);try{return i=r.status,{headers:o,body:yield r.json(),status:i}}catch(a){throw Br(A(Vr),i,o,a)}})}sendPostRequestAsync(e,t){return d(this,null,function*(){let r=t&&t.body||"",o=Gl(t),i,s=0,a={};try{i=yield fetch(e,{method:dc.POST,headers:o,body:r})}catch(l){throw Br(A(window.navigator.onLine?_o:Et),void 0,void 0,l)}a=ql(i.headers);try{return s=i.status,{headers:a,body:yield i.json(),status:s}}catch(l){throw Br(A(Vr),s,a,l)}})}};function Gl(n){try{let e=new Headers;if(!(n&&n.headers))return e;let t=n.headers;return Object.entries(t).forEach(([r,o])=>{e.append(r,o)}),e}catch(e){throw Br(A(is),void 0,void 0,e)}}function ql(n){try{let e={};return n.forEach((t,r)=>{e[r]=t}),e}catch{throw A(ss)}}var Bh=6e4,Cs=1e4,Kh=3e4,kc=2e3;function zl({auth:n,cache:e,system:t,telemetry:r},o){let i={clientId:g.EMPTY_STRING,authority:`${g.DEFAULT_AUTHORITY}`,knownAuthorities:[],cloudDiscoveryMetadata:g.EMPTY_STRING,authorityMetadata:g.EMPTY_STRING,redirectUri:typeof window<"u"?fe():"",postLogoutRedirectUri:g.EMPTY_STRING,navigateToLoginRequestUrl:!0,clientCapabilities:[],protocolMode:H.AAD,OIDCOptions:{serverResponseType:Ge.FRAGMENT,defaultScopes:[g.OPENID_SCOPE,g.PROFILE_SCOPE,g.OFFLINE_ACCESS_SCOPE]},azureCloudOptions:{azureCloudInstance:xt.None,tenant:g.EMPTY_STRING},skipAuthorityMetadataCache:!1,supportsNestedAppAuth:!1,instanceAware:!1,encodeExtraQueryParams:!1,verifySSO:!1},s={cacheLocation:B.SessionStorage,cacheRetentionDays:5,temporaryCacheLocation:B.SessionStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!!(e&&e.cacheLocation===B.LocalStorage),claimsBasedCachingEnabled:!1},a={loggerCallback:()=>{},logLevel:U.Info,piiLoggingEnabled:!1},l=S(y({},Di),{loggerOptions:a,networkClient:o?new fs:ac,navigationClient:new Ti,loadFrameTimeout:0,windowHashTimeout:t?.loadFrameTimeout||Bh,iframeHashTimeout:t?.loadFrameTimeout||Cs,navigateFrameWait:0,redirectNavigationTimeout:Kh,asyncPopups:!1,allowRedirectInIframe:!1,allowPlatformBroker:!1,allowPlatformBrokerWithDOM:!1,nativeBrokerHandshakeTimeout:t?.nativeBrokerHandshakeTimeout||kc,pollIntervalMilliseconds:V.DEFAULT_POLL_INTERVAL_MS}),h=S(y(y({},l),t),{loggerOptions:t?.loggerOptions||a}),m={application:{appName:g.EMPTY_STRING,appVersion:g.EMPTY_STRING},client:new pt};if(n?.protocolMode!==H.OIDC&&n?.OIDCOptions&&new me(h.loggerOptions).warning(JSON.stringify(M(ce.cannotSetOIDCOptions))),n?.protocolMode&&n.protocolMode===H.OIDC&&h?.allowPlatformBroker)throw M(ce.cannotAllowPlatformBroker);return{auth:S(y(y({},i),n),{OIDCOptions:y(y({},i.OIDCOptions),n?.OIDCOptions)}),cache:y(y({},s),e),system:h,telemetry:y(y({},m),r)}}var $l="@azure/msal-browser",ve="4.30.0";var oe="msal",Rc="browser",_c="|";var Wl=`${oe}.${Rc}.log.level`,Ql=`${oe}.${Rc}.log.pii`,cA=`${oe}.${Rc}.performance.enabled`,bc=`${oe}.version`,Vl="account.keys",jl="token.keys";function St(n=2){return n<1?`${oe}.${Vl}`:`${oe}.${n}.${Vl}`}function vt(n,e=2){return e<1?`${oe}.${jl}.${n}`:`${oe}.${e}.${jl}.${n}`}var ys=class n{static loggerCallback(e,t){switch(e){case U.Error:console.error(t);return;case U.Info:console.info(t);return;case U.Verbose:console.debug(t);return;case U.Warning:console.warn(t);return;default:console.log(t);return}}constructor(e){this.browserEnvironment=typeof window<"u",this.config=zl(e,this.browserEnvironment);let t;try{t=window[B.SessionStorage]}catch{}let r=t?.getItem(Wl),o=t?.getItem(Ql)?.toLowerCase(),i=o==="true"?!0:o==="false"?!1:void 0,s=y({},this.config.system.loggerOptions),a=r&&Object.keys(U).includes(r)?U[r]:void 0;
7a&&(s.loggerCallback=n.loggerCallback,s.logLevel=a),i!==void 0&&(s.piiLoggingEnabled=i),this.logger=new me(s,$l,ve),this.available=!1}getConfig(){return this.config}getLogger(){return this.logger}isAvailable(){return this.available}isBrowserEnvironment(){return this.browserEnvironment}};var As=(()=>{class n extends ys{getModuleName(){return n.MODULE_NAME}getId(){return n.ID}initialize(){return d(this,null,function*(){return this.available=typeof window<"u",this.available})}}return n.MODULE_NAME="",n.ID="StandardOperatingContext",n})();var Ts=class{constructor(){this.dbName=as,this.version=Il,this.tableName=Sl,this.dbOpen=!1}open(){return d(this,null,function*(){return new Promise((e,t)=>{let r=window.indexedDB.open(this.dbName,this.version);r.addEventListener("upgradeneeded",o=>{o.target.result.createObjectStore(this.tableName)}),r.addEventListener("success",o=>{let i=o;this.db=i.target.result,this.dbOpen=!0,e()}),r.addEventListener("error",()=>t(A(jt)))})})}closeConnection(){let e=this.db;e&&this.dbOpen&&(e.close(),this.dbOpen=!1)}validateDbIsOpen(){return d(this,null,function*(){if(!this.dbOpen)return this.open()})}getItem(e){return d(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(A(et));let s=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).get(e);s.addEventListener("success",a=>{let l=a;this.closeConnection(),t(l.target.result)}),s.addEventListener("error",a=>{this.closeConnection(),r(a)})})})}setItem(e,t){return d(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((r,o)=>{if(!this.db)return o(A(et));let a=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).put(t,e);a.addEventListener("success",()=>{this.closeConnection(),r()}),a.addEventListener("error",l=>{this.closeConnection(),o(l)})})})}removeItem(e){return d(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(A(et));let s=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).delete(e);s.addEventListener("success",()=>{this.closeConnection(),t()}),s.addEventListener("error",a=>{this.closeConnection(),r(a)})})})}getKeys(){return d(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((e,t)=>{if(!this.db)return t(A(et));let i=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).getAllKeys();i.addEventListener("success",s=>{let a=s;this.closeConnection(),e(a.target.result)}),i.addEventListener("error",s=>{this.closeConnection(),t(s)})})})}containsKey(e){return d(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(A(et));let s=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).count(e);s.addEventListener("success",a=>{let l=a;this.closeConnection(),t(l.target.result===1)}),s.addEventListener("error",a=>{this.closeConnection(),r(a)})})})}deleteDatabase(){return d(this,null,function*(){return this.db&&this.dbOpen&&this.closeConnection(),new Promise((e,t)=>{let r=window.indexedDB.deleteDatabase(as),o=setTimeout(()=>t(!1),200);r.addEventListener("success",()=>(clearTimeout(o),e(!0))),r.addEventListener("blocked",()=>(clearTimeout(o),e(!0))),r.addEventListener("error",()=>(clearTimeout(o),t(!1)))})})}};var wt=class{constructor(){this.cache=new Map}initialize(){return d(this,null,function*(){})}getItem(e){return this.cache.get(e)||null}getUserData(e){return this.getItem(e)}setItem(e,t){this.cache.set(e,t)}setUserData(e,t){return d(this,null,function*(){this.setItem(e,t)})}removeItem(e){this.cache.delete(e)}getKeys(){let e=[];return this.cache.forEach((t,r)=>{e.push(r)}),e}containsKey(e){return this.cache.has(e)}clear(){this.cache.clear()}decryptData(){return Promise.resolve(null)}};var Es=class{constructor(e){this.inMemoryCache=new wt,this.indexedDBCache=new Ts,this.logger=e}handleDatabaseAccessError(e){if(e instanceof Wr&&e.errorCode===jt)this.logger.error("Could not access persistent storage. This may be caused by browser privacy features which block persistent storage in third-party contexts.");else throw e}getItem(e){return d(this,null,function*(){let t=this.inMemoryCache.getItem(e);if(!t)try{return this.logger.verbose("Queried item not found in in-memory cache, now querying persistent storage."),yield this.indexedDBCache.getItem(e)}catch(r){this.handleDatabaseAccessError(r)}return t})}setItem(e,t){return d(this,null,function*(){this.inMemoryCache.setItem(e,t);try{yield this.indexedDBCache.setItem(e,t)}catch(r){this.handleDatabaseAccessError(r)}})}removeItem(e){return d(this,null,function*(){this.inMemoryCache.removeItem(e);try{yield this.indexedDBCache.removeItem(e)}catch(t){this.handleDatabaseAccessError(t)}})}getKeys(){return d(this,null,function*(){let e=this.inMemoryCache.getKeys();if(e.length===0)try{return this.logger.verbose("In-memory cache is empty, now querying persistent storage."),yield this.indexedDBCache.getKeys()}catch(t){this.handleDatabaseAccessError(t)}return e})}containsKey(e){return d(this,null,function*(){let t=this.inMemoryCache.containsKey(e);if(!t)try{return this.logger.verbose("Key not found in in-memory cache, now querying persistent storage."),yield this.indexedDBCache.containsKey(e)}catch(r){this.handleDatabaseAccessError(r)}return t})}clearInMemory(){this.logger.verbose("Deleting in-memory keystore"),this.inMemoryCache.clear(),this.logger.verbose("In-memory keystore deleted")}
7clearPersistent(){return d(this,null,function*(){try{this.logger.verbose("Deleting persistent keystore");let e=yield this.indexedDBCache.deleteDatabase();return e&&this.logger.verbose("Persistent keystore deleted"),e}catch(e){return this.handleDatabaseAccessError(e),!1}})}};var jo=(()=>{class n{constructor(t,r,o){this.logger=t,Pl(o??!1),this.cache=new Es(this.logger),this.performanceClient=r}createNewGuid(){return se()}base64Encode(t){return Qt(t)}base64Decode(t){return Z(t)}base64UrlEncode(t){return gi(t)}encodeKid(t){return this.base64UrlEncode(JSON.stringify({kid:t}))}getPublicKeyThumbprint(t){return d(this,null,function*(){let r=this.performanceClient?.startMeasurement(c.CryptoOptsGetPublicKeyThumbprint,t.correlationId),o=yield Nl(n.EXTRACTABLE,n.POP_KEY_USAGES),i=yield cs(o.publicKey),s={e:i.e,kty:i.kty,n:i.n},a=Yl(s),l=yield this.hashString(a),h=yield cs(o.privateKey),m=yield Ml(h,!1,["sign"]);return yield this.cache.setItem(l,{privateKey:m,publicKey:o.publicKey,requestMethod:t.resourceRequestMethod,requestUri:t.resourceRequestUri}),r&&r.end({success:!0}),l})}removeTokenBindingKey(t){return d(this,null,function*(){if(yield this.cache.removeItem(t),yield this.cache.containsKey(t))throw f(re.bindingKeyNotRemoved)})}clearKeystore(){return d(this,null,function*(){this.cache.clearInMemory();try{return yield this.cache.clearPersistent(),!0}catch(t){return t instanceof Error?this.logger.error(`Clearing keystore failed with error: ${t.message}`):this.logger.error("Clearing keystore failed with unknown error"),!1}})}signJwt(t,r,o,i){return d(this,null,function*(){let s=this.performanceClient?.startMeasurement(c.CryptoOptsSignJwt,i),a=yield this.cache.getItem(r);if(!a)throw A(Vt);let l=yield cs(a.publicKey),h=Yl(l),m=gi(JSON.stringify({kid:r})),p=ui.getShrHeaderString(S(y({},o?.header),{alg:l.alg,kid:m})),C=gi(p);t.cnf={jwk:JSON.parse(h)};let T=gi(JSON.stringify(t)),P=`${C}.${T}`,ae=new TextEncoder().encode(P),Ne=yield Ul(a.privateKey,ae),q=be(new Uint8Array(Ne)),de=`${P}.${q}`;return s&&s.end({success:!0}),de})}hashString(t){return d(this,null,function*(){return ls(t)})}}return n.POP_KEY_USAGES=["sign","verify"],n.EXTRACTABLE=!0,n})();function Yl(n){return JSON.stringify(n,Object.keys(n).sort())}var Gh=24*60*60*1e3,Is={Lax:"Lax",None:"None"},Wo=class{initialize(){return Promise.resolve()}getItem(e){let t=`${encodeURIComponent(e)}`,r=document.cookie.split(";");for(let o=0;o<r.length;o++){let i=r[o],[s,...a]=decodeURIComponent(i).trim().split("="),l=a.join("=");if(s===t)return l}return""}getUserData(){throw f(re.methodNotImplemented)}setItem(e,t,r,o=!0,i=Is.Lax){let s=`${encodeURIComponent(e)}=${encodeURIComponent(t)};path=/;SameSite=${i};`;if(r){let a=qh(r);s+=`expires=${a};`}(o||i===Is.None)&&(s+="Secure;"),document.cookie=s}setUserData(){return d(this,null,function*(){return Promise.reject(f(re.methodNotImplemented))})}removeItem(e){this.setItem(e,"",-1)}getKeys(){let e=document.cookie.split(";"),t=[];return e.forEach(r=>{let o=decodeURIComponent(r).trim().split("=");t.push(o[0])}),t}containsKey(e){return this.getKeys().includes(e)}decryptData(){return Promise.resolve(null)}};function qh(n){let e=new Date;return new Date(e.getTime()+n*Gh).toUTCString()}function ot(n,e){let t=n.getItem(St(e));return t?JSON.parse(t):[]}function we(n,e,t){let r=e.getItem(vt(n,t));if(r){let o=JSON.parse(r);if(o&&o.hasOwnProperty("idToken")&&o.hasOwnProperty("accessToken")&&o.hasOwnProperty("refreshToken"))return o}return{idToken:[],accessToken:[],refreshToken:[]}}function Qo(n){return n.hasOwnProperty("id")&&n.hasOwnProperty("nonce")&&n.hasOwnProperty("data")}var Jl="msal.cache.encryption",zh="msal.broadcast.cache",Ss=class{constructor(e,t,r){if(!window.localStorage)throw Vo(Yt);this.memoryStorage=new wt,this.initialized=!1,this.clientId=e,this.logger=t,this.performanceClient=r,this.broadcast=new BroadcastChannel(zh)}initialize(e){return d(this,null,function*(){let t=new Wo,r=t.getItem(Jl),o={key:"",id:""};if(r)try{o=JSON.parse(r)}catch{}if(o.key&&o.id){let i=G(rt,c.Base64Decode,this.logger,this.performanceClient,e)(o.key);this.encryptionCookie={id:o.id,key:yield u(Ec,c.GenerateHKDF,this.logger,this.performanceClient,e)(i)}}else{let i=se(),s=yield u(Tc,c.GenerateBaseKey,this.logger,this.performanceClient,e)(),a=G(be,c.UrlEncodeArr,this.logger,this.performanceClient,e)(new Uint8Array(s));this.encryptionCookie={id:i,key:yield u(Ec,c.GenerateHKDF,this.logger,this.performanceClient,e)(s)};let l={id:i,key:a};t.setItem(Jl,JSON.stringify(l),0,!0,Is.None)}yield u(this.importExistingCache.bind(this),c.ImportExistingCache,this.logger,this.performanceClient,e)(e),this.broadcast.addEventListener("message",this.updateCache.bind(this)),this.initialized=!0})}getItem(e){return window.localStorage.getItem(e)}getUserData(e){if(!this.initialized)throw A(tt);return this.memoryStorage.getItem(e)}decryptData(e,t,r){return d(this,null,function*(){if(!this.initialized||!this.encryptionCookie)throw A(tt);if(t.id!==this.encryptionCookie.id)return this.performanceClient.incrementFields({encryptedCacheExpiredCount:1},r),null;let o=yield u(Ic,c.Decrypt,this.logger,this.performanceClient,r)(this.encryptionCookie.ke
7y,t.nonce,this.getContext(e),t.data);if(!o)return null;try{return S(y({},JSON.parse(o)),{lastUpdatedAt:t.lastUpdatedAt})}catch{return this.performanceClient.incrementFields({encryptedCacheCorruptionCount:1},r),null}})}setItem(e,t){window.localStorage.setItem(e,t)}setUserData(e,t,r,o,i){return d(this,null,function*(){if(!this.initialized||!this.encryptionCookie)throw A(tt);if(i)this.setItem(e,t);else{let{data:s,nonce:a}=yield u(xl,c.Encrypt,this.logger,this.performanceClient,r)(this.encryptionCookie.key,t,this.getContext(e)),l={id:this.encryptionCookie.id,nonce:a,data:s,lastUpdatedAt:o};this.setItem(e,JSON.stringify(l))}this.memoryStorage.setItem(e,t),this.broadcast.postMessage({key:e,value:t,context:this.getContext(e)})})}removeItem(e){this.memoryStorage.containsKey(e)&&(this.memoryStorage.removeItem(e),this.broadcast.postMessage({key:e,value:null,context:this.getContext(e)})),window.localStorage.removeItem(e)}getKeys(){return Object.keys(window.localStorage)}containsKey(e){return window.localStorage.hasOwnProperty(e)}clear(){this.memoryStorage.clear(),ot(this).forEach(r=>this.removeItem(r));let t=we(this.clientId,this);t.idToken.forEach(r=>this.removeItem(r)),t.accessToken.forEach(r=>this.removeItem(r)),t.refreshToken.forEach(r=>this.removeItem(r)),this.getKeys().forEach(r=>{(r.startsWith(oe)||r.indexOf(this.clientId)!==-1)&&this.removeItem(r)})}importExistingCache(e){return d(this,null,function*(){if(!this.encryptionCookie)return;let t=ot(this);t=yield this.importArray(t,e),t.length?this.setItem(St(),JSON.stringify(t)):this.removeItem(St());let r=we(this.clientId,this);r.idToken=yield this.importArray(r.idToken,e),r.accessToken=yield this.importArray(r.accessToken,e),r.refreshToken=yield this.importArray(r.refreshToken,e),r.idToken.length||r.accessToken.length||r.refreshToken.length?this.setItem(vt(this.clientId),JSON.stringify(r)):this.removeItem(vt(this.clientId))})}getItemFromEncryptedCache(e,t){return d(this,null,function*(){if(!this.encryptionCookie)return null;let r=this.getItem(e);if(!r)return null;let o;try{o=JSON.parse(r)}catch{return null}return Qo(o)?o.id!==this.encryptionCookie.id?(this.performanceClient.incrementFields({encryptedCacheExpiredCount:1},t),null):(this.performanceClient.incrementFields({encryptedCacheCount:1},t),u(Ic,c.Decrypt,this.logger,this.performanceClient,t)(this.encryptionCookie.key,o.nonce,this.getContext(e),o.data)):(this.performanceClient.incrementFields({unencryptedCacheCount:1},t),r)})}importArray(e,t){return d(this,null,function*(){let r=[],o=[];return e.forEach(i=>{let s=this.getItemFromEncryptedCache(i,t).then(a=>{a?(this.memoryStorage.setItem(i,a),r.push(i)):this.removeItem(i)});o.push(s)}),yield Promise.all(o),r})}getContext(e){let t="";return e.includes(this.clientId)&&(t=this.clientId),t}updateCache(e){this.logger.trace("Updating internal cache from broadcast event");let t=this.performanceClient.startMeasurement(c.LocalStorageUpdated);t.add({isBackground:!0});let{key:r,value:o,context:i}=e.data;if(!r){this.logger.error("Broadcast event missing key"),t.end({success:!1,errorCode:"noKey"});return}if(i&&i!==this.clientId){this.logger.trace(`Ignoring broadcast event from clientId: ${i}`),t.end({success:!1,errorCode:"contextMismatch"});return}o?(this.memoryStorage.setItem(r,o),this.logger.verbose("Updated
7item in internal cache")):(this.memoryStorage.removeItem(r),this.logger.verbose("Removed item from internal cache")),t.end({success:!0})}};var vs=class{constructor(){if(!window.sessionStorage)throw Vo(Yt)}initialize(){return d(this,null,function*(){})}getItem(e){return window.sessionStorage.getItem(e)}getUserData(e){return this.getItem(e)}setItem(e,t){window.sessionStorage.setItem(e,t)}setUserData(e,t){return d(this,null,function*(){this.setItem(e,t)})}removeItem(e){window.sessionStorage.removeItem(e)}getKeys(){return Object.keys(window.sessionStorage)}containsKey(e){return window.sessionStorage.hasOwnProperty(e)}decryptData(){return Promise.resolve(null)}};var E={INITIALIZE_START:"msal:initializeStart",INITIALIZE_END:"msal:initializeEnd",ACCOUNT_ADDED:"msal:accountAdded",ACCOUNT_REMOVED:"msal:accountRemoved",ACTIVE_ACCOUNT_CHANGED:"msal:activeAccountChanged",LOGIN_START:"msal:loginStart",LOGIN_SUCCESS:"msal:loginSuccess",LOGIN_FAILURE:"msal:loginFailure",ACQUIRE_TOKEN_START:"msal:acquireTokenStart",ACQUIRE_TOKEN_SUCCESS:"msal:acquireTokenSuccess",ACQUIRE_TOKEN_FAILURE:"msal:acquireTokenFailure",ACQUIRE_TOKEN_NETWORK_START:"msal:acquireTokenFromNetworkStart",SSO_SILENT_START:"msal:ssoSilentStart",SSO_SILENT_SUCCESS:"msal:ssoSilentSuccess",SSO_SILENT_FAILURE:"msal:ssoSilentFailure",ACQUIRE_TOKEN_BY_CODE_START:"msal:acquireTokenByCodeStart",ACQUIRE_TOKEN_BY_CODE_SUCCESS:"msal:acquireTokenByCodeSuccess",ACQUIRE_TOKEN_BY_CODE_FAILURE:"msal:acquireTokenByCodeFailure",HANDLE_REDIRECT_START:"msal:handleRedirectStart",HANDLE_REDIRECT_END:"msal:handleRedirectEnd",POPUP_OPENED:"msal:popupOpened",LOGOUT_START:"msal:logoutStart",LOGOUT_SUCCESS:"msal:logoutSuccess",LOGOUT_FAILURE:"msal:logoutFailure",LOGOUT_END:"msal:logoutEnd",RESTORE_FROM_BFCACHE:"msal:restoreFromBFCache",BROKER_CONNECTION_ESTABLISHED:"msal:brokerConnectionEstablished"};function kt(n,e){let t=n.indexOf(e);t>-1&&n.splice(t,1)}var Yo=class n extends Nr{constructor(e,t,r,o,i,s,a){super(e,r,o,i,a),this.cacheConfig=t,this.logger=o,this.internalStorage=new wt,this.browserStorage=Xl(e,t.cacheLocation,o,i),this.temporaryCacheStorage=Xl(e,t.temporaryCacheLocation,o,i),this.cookieStorage=new Wo,this.eventHandler=s}initialize(e){return d(this,null,function*(){this.performanceClient.addFields({cacheLocation:this.cacheConfig.cacheLocation,cacheRetentionDays:this.cacheConfig.cacheRetentionDays},e),yield this.browserStorage.initialize(e),yield this.migrateExistingCache(e),this.trackVersionChanges(e)})}migrateExistingCache(e){return d(this,null,function*(){let t=ot(this.browserStorage),r=we(this.clientId,this.browserStorage);this.performanceClient.addFields({preMigrateAcntCount:t.length,preMigrateATCount:r.accessToken.length,preMigrateITCount:r.idToken.length,preMigrateRTCount:r.refreshToken.length},e);for(let i=0;i<2;i++){let s=i;yield this.removeStaleAccounts(i,s,e)}for(let i=0;i<2;i++){let s=i;yield this.migrateIdTokens(i,s,e)}let o=this.getKMSIValues();for(let i=0;i<2;i++)yield this.migrateAccessTokens(i,o,e),yield this.migrateRefreshTokens(i,o,e);t=ot(this.browserStorage),r=we(this.clientId,this.browserStorage),this.performanceClient.addFields({postMigrateAcntCount:t.length,postMigrateATCount:r.accessToken.length,postMigrateITCount:r.idToken.length,postMigrateRTCount:r.refreshToken.length},e)})}updateOldEntry(e,t){return d(this,null,function*(){let r=this.browserStorage.getItem(e),o=this.validateAndParseJson(r||"");if(!o)return this.browserStorage.removeItem(e),null;if(!o.lastUpdatedAt)o.lastUpdatedAt=Date.now().toString(),this.setItem(e,JSON.stringify(o),t);else if(J.isCacheExpired(o.lastUpdatedAt,this.cacheConfig.cacheRetentionDays))return this.browserStorage.removeItem(e),this.performanceClient.incrementFields({expiredCacheRemovedCount:1},t),null;let i=Qo(o)?yield this.browserStorage.decryptData(e,o,t):o;return!i||!$.isCredentialEntity(i)?(this.performanceClient.incrementFields({invalidCacheCount:1},t),null):($.isAccessTokenEntity(i)||$.isRefreshTokenEntity(i))&&i.expiresOn&&J.isTokenExpired(i.expiresOn,dn)?(this.browserStorage.removeItem(e),this.performanceClient.incrementFields({expiredCacheRemovedCount:1},t),null):i})}removeStaleAccounts(e,t,r){return d(this,null,function*(){let o=ot(this.browserStorage,e);if(o.length!==0){for(let i of[...o]){this.performanceClient.incrementFields({oldAcntCount:1},r);let s=this.browserStorage.getItem(i),a=this.validateAndParseJson(s||"");if(!a){kt(o,i);continue}if(a.lastUpdatedAt)J.isCacheExpired(a.lastUpdatedAt,this.cacheConfig.cacheRetentionDays)&&(yield this.removeAccountOldSchema(i,a,t,r),kt(o,i));else{a.lastUpdatedAt=Date.now().toString(),this.setItem(i,JSON.stringify(a),r);continue}}this.setAccountKeys(o,r,e)}})}removeAccountOldSchema(e,t,r,o){return d(this,null,function*(){let s=(Qo(t)?yield this.browserStorage.decryptData(e,t,o):t)?.homeAccountId;if(s){let a=this.getTokenKeys(r);[...a.idToken].filter(l=>
7l.includes(s)).forEach(l=>{this.browserStorage.removeItem(l),kt(a.idToken,l)}),[...a.accessToken].filter(l=>l.includes(s)).forEach(l=>{this.browserStorage.removeItem(l),kt(a.accessToken,l)}),[...a.refreshToken].filter(l=>l.includes(s)).forEach(l=>{this.browserStorage.removeItem(l),kt(a.refreshToken,l)}),this.setTokenKeys(a,o,r)}this.performanceClient.incrementFields({expiredAcntRemovedCount:1},o),this.browserStorage.removeItem(e)})}getKMSIValues(){let e={},t=this.getTokenKeys().idToken;for(let r of t){let o=this.browserStorage.getUserData(r);if(o){let i=JSON.parse(o),s=Y.extractTokenClaims(i.secret,Z);s&&(e[i.homeAccountId]=Y.isKmsi(s))}}return e}migrateIdTokens(e,t,r){return d(this,null,function*(){let o=we(this.clientId,this.browserStorage,e);if(o.idToken.length===0)return;let i=we(this.clientId,this.browserStorage,2),s=ot(this.browserStorage),a=ot(this.browserStorage,t);for(let l of[...o.idToken]){this.performanceClient.incrementFields({oldITCount:1},r);let h=yield this.updateOldEntry(l,r);if(!h){kt(o.idToken,l);continue}let m=s.find(q=>q.includes(h.homeAccountId)),p=a.find(q=>q.includes(h.homeAccountId)),C=null;if(m)C=this.getAccount(m,r);else if(p){let q=this.browserStorage.getItem(p),de=this.validateAndParseJson(q||"");C=de&&Qo(de)?yield this.browserStorage.decryptData(p,de,r):de}if(!C){this.performanceClient.incrementFields({skipITMigrateCount:1},r);continue}let T=Y.extractTokenClaims(h.secret,Z),P=this.generateCredentialKey(h),O=this.getIdTokenCredential(P,r),ae=Object.keys(T).includes("signin_state"),Ne=O&&Object.keys(Y.extractTokenClaims(O.secret,Z)||{}).includes("signin_state");if(!O||h.lastUpdatedAt>O.lastUpdatedAt&&(ae||!Ne)){let q=C.tenantProfiles||[],de=Or(T)||C.realm;if(de&&!q.find(Ks=>Ks.tenantId===de)){let Ks=Ve(C.homeAccountId,C.localAccountId,de,T);q.push(Ks)}C.tenantProfiles=q;let er=this.generateAccountKey(D.getAccountInfo(C)),tr=Y.isKmsi(T);yield this.setUserData(er,JSON.stringify(C),r,C.lastUpdatedAt,tr),s.includes(er)||s.push(er),yield this.setUserData(P,JSON.stringify(h),r,h.lastUpdatedAt,tr),this.performanceClient.incrementFields({migratedITCount:1},r),i.idToken.push(P)}}this.setTokenKeys(o,r,e),this.setTokenKeys(i,r),this.setAccountKeys(s,r)})}migrateAccessTokens(e,t,r){return d(this,null,function*(){let o=we(this.clientId,this.browserStorage,e);if(o.accessToken.length===0)return;let i=we(this.clientId,this.browserStorage,2);for(let s of[...o.accessToken]){this.performanceClient.incrementFields({oldATCount:1},r);let a=yield this.updateOldEntry(s,r);if(!a){kt(o.accessToken,s);continue}if(!Object.keys(t).includes(a.homeAccountId)){this.performanceClient.incrementFields({skipATMigrateCount:1},r);continue}let l=this.generateCredentialKey(a),h=t[a.homeAccountId];if(!i.accessToken.includes(l))yield this.setUserData(l,JSON.stringify(a),r,a.lastUpdatedAt,h),this.performanceClient.incrementFields({migratedATCount:1},r),i.accessToken.push(l);else{let m=this.getAccessTokenCredential(l,r);(!m||a.lastUpdatedAt>m.lastUpdatedAt)&&(yield this.setUserData(l,JSON.stringify(a),r,a.lastUpdatedAt,h),this.performanceClient.incrementFields({migratedATCount:1},r))}}this.setTokenKeys(o,r,e),this.setTokenKeys(i,r)})}migrateRefreshTokens(e,t,r){return d(this,null,function*(){let o=we(this.clientId,this.browserStorage,e);if(o.refreshToken.length===0)return;let i=we(this.clientId,this.browserStorage,2);for(let s of[...o.refreshToken]){this.performanceClient.incrementFields({oldRTCount:1},r);let a=yield this.updateOldEntry(s,r);if(!a){kt(o.refreshToken,s);continue}if(!Object.keys(t).includes(a.homeAccountId)){this.performanceClient.incrementFields({skipRTMigrateCount:1},r);continue}let l=this.generateCredentialKey(a),h=t[a.homeAccountId];if(!i.refreshToken.includes(l))yield this.setUserData(l,JSON.stringify(a),r,a.lastUpdatedAt,h),this.performanceClient.incrementFields({migratedRTCount:1},r),i.refreshToken.push(l);else{let m=this.getRefreshTokenCredential(l,r);(!m||a.lastUpdatedAt>m.lastUpdatedAt)&&(yield this.setUserData(l,JSON.stringify(a),r,a.lastUpdatedAt,h),this.performanceClient.incrementFields({migratedRTCount:1},r))}}this.setTokenKeys(o,r,e),this.setTokenKeys(i,r)})}trackVersionChanges(e){let t=this.browserStorage.getItem(bc);t&&(this.logger.info(`MSAL.js was last initialized by version: ${t}`),this.performanceClient.addFields({previousLibraryVersion:t},e)),t!==ve&&this.setItem(bc,ve,e)}validateAndParseJson(e){if(!e)return null;try{let t=JSON.parse(e);return t&&typeof t=="object"?t:null}catch{return null}}setItem(e,t,r){let o=new Array(3).fill(0),i=[],s=20;for(let a=0;a<=s;a++)try{if(this.browserStorage.setItem(e,t),a>0)for(let l=0;l<=2;l++){let h=o.slice(0,l).reduce((p,C)=>
7p+C,0);if(h>=a)break;let m=a>h+o[l]?h+o[l]:a;a>h&&o[l]>0&&this.removeAccessTokenKeys(i.slice(h,m),r,l)}break}catch(l){let h=no(l);if(h.errorCode===$n.cacheQuotaExceeded&&a<s){if(!i.length)for(let m=0;m<=2;m++)if(e===vt(this.clientId,m)){let p=JSON.parse(t).accessToken;i.push(...p),o[m]=p.length}else{let p=this.getTokenKeys(m).accessToken;i.push(...p),o[m]=p.length}if(i.length<=a)throw h;this.removeAccessToken(i[a],r,!1)}else throw h}}setUserData(e,t,r,o,i){return d(this,null,function*(){let s=new Array(3).fill(0),a=[],l=20;for(let h=0;h<=l;h++)try{if(yield u(this.browserStorage.setUserData.bind(this.browserStorage),c.SetUserData,this.logger,this.performanceClient)(e,t,r,o,i),h>0)for(let m=0;m<=2;m++){let p=s.slice(0,m).reduce((T,P)=>T+P,0);if(p>=h)break;let C=h>p+s[m]?p+s[m]:h;h>p&&s[m]>0&&this.removeAccessTokenKeys(a.slice(p,C),r,m)}break}catch(m){let p=no(m);if(p.errorCode===$n.cacheQuotaExceeded&&h<l){if(!a.length)for(let C=0;C<=2;C++){let T=this.getTokenKeys(C).accessToken;a.push(...T),s[C]=T.length}if(a.length<=h)throw p;this.removeAccessToken(a[h],r,!1)}else throw p}})}getAccount(e,t){this.logger.trace("BrowserCacheManager.getAccount called");let r=this.browserStorage.getUserData(e);if(!r)return this.removeAccountKeyFromMap(e,t),null;let o=this.validateAndParseJson(r);return!o||!D.isAccountEntity(o)?null:(this.performanceClient.addFields({accountCachedBy:El(o.cachedByApiId)},t),Nr.toObject(new D,o))}setAccount(e,t,r,o){return d(this,null,function*(){this.logger.trace("BrowserCacheManager.setAccount called");let i=this.generateAccountKey(D.getAccountInfo(e)),s=Date.now().toString();e.lastUpdatedAt=s,e.cachedByApiId=o,yield this.setUserData(i,JSON.stringify(e),t,s,r);let a=this.addAccountKeyToMap(i,t);this.performanceClient.addFields({kmsi:r},t),this.cacheConfig.cacheLocation===B.LocalStorage&&a&&this.eventHandler.emitEvent(E.ACCOUNT_ADDED,void 0,D.getAccountInfo(e))})}getAccountKeys(){return ot(this.browserStorage)}setAccountKeys(e,t,r=2){e.length===0?this.removeItem(St(r)):this.setItem(St(r),JSON.stringify(e),t)}addAccountKeyToMap(e,t){this.logger.trace("BrowserCacheManager.addAccountKeyToMap called"),this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${e}`);let r=this.getAccountKeys();return r.indexOf(e)===-1?(r.push(e),this.setItem(St(),JSON.stringify(r),t),this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added"),!0):(this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map"),!1)}removeAccountKeyFromMap(e,t){this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called"),this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${e}`);let r=this.getAccountKeys(),o=r.indexOf(e);o>-1?(r.splice(o,1),this.setAccountKeys(r,t),this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed")):this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map")}removeAccount(e,t){let r=this.getActiveAccount(t);r?.homeAccountId===e.homeAccountId&&r?.environment===e.environment&&this.setActiveAccount(null,t),super.removeAccount(e,t),this.removeAccountKeyFromMap(this.generateAccountKey(e),t),this.browserStorage.getKeys().forEach(o=>{o.includes(e.homeAccountId)&&o.includes(e.environment)&&this.browserStorage.removeItem(o)}),this.cacheConfig.cacheLocation===B.LocalStorage&&this.eventHandler.emitEvent(E.ACCOUNT_REMOVED,void 0,e)}removeIdToken(e,t){super.removeIdToken(e,t);let r=this.getTokenKeys(),o=r.idToken.indexOf(e);o>-1&&(this.logger.info("idToken removed from tokenKeys map"),r.idToken.splice(o,1),this.setTokenKeys(r,t))}removeAccessToken(e,t,r=!0){super.removeAccessToken(e,t),r&&this.removeAccessTokenKeys([e],t)}removeAccessTokenKeys(e,t,r=2){this.logger.trace("removeAccessTokenKey called");let o=this.getTokenKeys(r),i=0;if(e.forEach(s=>{let a=o.accessToken.indexOf(s);a>-1&&(o.accessToken.splice(a,1),i++)}),i>0){this.logger.info(`removed ${i} accessToken keys from tokenKeys map`),this.setTokenKeys(o,t,r);return}}removeRefreshToken(e,t){super.removeRefreshToken(e,t);let r=this.getTokenKeys(),o=r.refreshToken.indexOf(e);o>-1&&(this.logger.info("refreshToken removed from tokenKeys map"),r.refreshToken.splice(o,1),this.setTokenKeys(r,t))}getTokenKeys(e=2){return we(this.clientId,this.browserStorage,e)}setTokenKeys(e,t,r=2){if(e.idToken.length===0&&e.accessToken.length===0&&e.refreshToken.length===0){this.removeItem(vt(this.clientId,r));return}else this.setItem(vt(this.clientId,r),JSON.stringify(e),t)}getIdTokenCredential(e,t){let r=this.browserStorage.getUserData(e);if(!r)return this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),this.removeIdToken(e,t),null;let o=this.validateAndParseJson(r);return!o||!$.isIdTokenEntity(o)?(this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit"),o)}setIdTokenCredential(e,t,r){return d(this,null,function*(){this.logger.trace("BrowserCacheManager.setIdTokenCredential called");let o=this.generateCredentialKey(e),i=Date.now().toString();e.lastUpdatedAt=i,yield this.setUserData(o,JSON.stringify(e),t,i,r);let s=this.getTokenKeys();s.idToken.indexOf(o)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map"),s.idToken.push(o),this.setTokenKeys(s,t))})}getAccessTokenCredential(e,t){let r=this.browserStorage.getUserData(e);if(!r)return this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),this.removeAccessTokenKeys([e],t),null;let o=this.validateAndParseJson(r);return!o||!$.isAccessTokenEntity(o)?(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit"),o)}setAccessTokenCredential(e,t,r){return d(this,null,function*(){this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");let o=this.generateCredentialKey(e),i=Date.now().toString();e.lastUpdatedAt=i,yield this.setUserData(o,JSON.stringify(e),t,i,r);let s=this.getTokenKeys(),a=s.accessToken.indexOf(o);a!==-1&&s.accessToken.splice(a,1),this.logger.trace(`access token ${a===-1?"added to":"updated in"} map`),s.accessToken.push(o),this.setTokenKeys(s,t)})}getRefreshTokenCredential(e,t){let r=this.browserStorage.getUserData(e);if(!r)return this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),this.removeRefreshToken(e,t),null;let o=this.validateAndParseJson(r);return!o||!$.isRefreshTokenEntity(o)?(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit"),o)}setRefreshTokenCredential(e,t,r){return d(this,null,function*(){this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");let o=this.generateCredentialKey(e),i=Date.now().toString();e.lastUpdatedAt=i,yield this.setUserData(o,JSON.stringify(e),t,i,r);let s=this.getTokenKeys();s.refreshToken.indexOf(o)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map"),s.refreshToken.push(o),this.setTokenKeys(s,t))})}getAppMetadata(e){let t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!$.isAppMetadataEntity(e,r)?(this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit"),r)}setAppMetadata(e,t){this.logger.trace("BrowserCacheManager.setAppMetadata called");let r=$.generateAppMetadataKey(e);this.setItem(r,JSON.stringify(e),t)}getServerTelemetry(e){let t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!$.isServerTelemetryEntity(e,r)?(this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit"),r)}setServerTelemetry(e,t,r){this.logger.trace("BrowserCacheManager.setServerTelemetry called"),this.setItem(e,JSON.stringify(t),r)}getAuthorityMetadata(e){let t=this.internalStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAuthorityMetadata: called, no cache hit"),null;let r=this.validateAndParseJson(t);return r&&$.isAuthorityMetadataEntity(e,r)?(this.logger.trace("BrowserCacheManager.getAuthorityMetadata: cache hit"),r):null}getAuthorityMetadataKeys(){return this.internalStorage.getKeys().filter(t=>this.isAuthorityMetadata(t))}setWrapperMetadata(e,t){this.internalStorage.setItem(pi.WRAPPER_SKU,e),this.internalStorage.setItem(pi.WRAPPER_VER,t)}getWrapperMetadata(){let e=this.internalStorage.getItem(pi.WRAPPER_SKU)||g.EMPTY_STRING,t=this.internalStorage.getItem(pi.WRAPPER_VER)||g.EMPTY_STRING;return[e,t]}setAuthorityMetadata(e,t){this.logger.trace("BrowserCacheManager.setAuthorityMetadata called"),this.internalStorage.setItem(e,JSON.stringify(t))}getActiveAccount(e){let t=this.generateCacheKey(ki.ACTIVE_ACCOUNT_FILTERS),r=this.browserStorage.getItem(t);if(!r)return this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters found"),null;let o=this.validateAndParseJson(r);return o?(this.logger.trace("BrowserCacheManager.getActiveAccount: Active account filters schema found"),this.getAccountInfoFilteredBy({homeAccountId:o.homeAccountId,localAccountId:o.localAccountId,tenantId:o.tenantId},e)):(this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found"),null)}setActiveAccount(e,t){let r=this.generateCacheKey(ki.ACTIVE_ACCOUNT_FILTERS);if(e){this.logger.verbose("setActiveAccount: Active account set");let o={homeAccountId:e.homeAccountId,localAccountId:e.localAccountId,tenantId:e.tenantId,lastUpdatedAt:J.nowSeconds().toString()};this.setItem(r,JSON.stringify(o),t)}else this.logger.verbose("setActiveAccount: No account passed, active account not set"),this.browserStorage.removeItem(r);this.eventHandler.emitEvent(E.ACTIVE_ACCOUNT_CHANGED)}getThrottlingCache(e){let t=this.browserStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!$.isThrottlingEntity(e,r)?(this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit"),r)}setThrottlingCache(e,t,r){this.logger.trace("BrowserCacheManager.setThrottlingCache called"),this.setItem(e,JSON.stringify(t),r)}getTemporaryCache(e,t){let r=t?this.generateCacheKey(e):e;if(this.cacheConfig.storeAuthStateInCookie){let i=this.cookieStorage.getItem(r);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: storeAuthStateInCookies set to true, retrieving from cookies"),i}let o=this.temporaryCacheStorage.getItem(r);if(!o){if(this.cacheConfig.cacheLocation===B.LocalStorage){let i=this.browserStorage.getItem(r);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item found in local storage"),i}return this.logger.trace("BrowserCacheManager.getTemporaryCache: No cache item found in local storage"),null}return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item returned"),o}setTemporaryCache(e,t,r){let o=r?this.generateCacheKey(e):e;this.temporaryCacheStorage.setItem(o,t),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.setTemporaryCache: storeAuthStateInCookie set to true, setting item cookie"),this.cookieStorage.setItem(o,t,void 0,this.cacheConfig.secureCookies))}removeItem(e){this.browserStorage.removeItem(e)}removeTemporaryItem(e){this.temporaryCacheStorage.removeItem(e),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie"),this.cookieStorage.removeItem(e))}getKeys(){return this.browserStorage.getKeys()}clear(e){this.removeAllAccounts(e),this.removeAppMetadata(e),this.temporaryCacheStorage.getKeys().forEac
7h(t=>{(t.indexOf(oe)!==-1||t.indexOf(this.clientId)!==-1)&&this.removeTemporaryItem(t)}),this.browserStorage.getKeys().forEach(t=>{(t.indexOf(oe)!==-1||t.indexOf(this.clientId)!==-1)&&this.browserStorage.removeItem(t)}),this.internalStorage.clear()}clearTokensAndKeysWithClaims(e){this.performanceClient.addQueueMeasurement(c.ClearTokensAndKeysWithClaims,e);let t=this.getTokenKeys(),r=0;t.accessToken.forEach(o=>{let i=this.getAccessTokenCredential(o,e);i?.requestedClaimsHash&&o.includes(i.requestedClaimsHash.toLowerCase())&&(this.removeAccessToken(o,e),r++)}),r>0&&this.logger.warning(`${r} access tokens with claims in the cache keys have been removed from the cache.`)}generateCacheKey(e){return L.startsWith(e,oe)?e:`${oe}.${this.clientId}.${e}`}generateCredentialKey(e){let t=e.credentialType===Q.REFRESH_TOKEN&&e.familyId||e.clientId,r=e.tokenType&&e.tokenType.toLowerCase()!==N.BEARER.toLowerCase()?e.tokenType.toLowerCase():"";return[`${oe}.${2}`,e.homeAccountId,e.environment,e.credentialType,t,e.realm||"",e.target||"",e.requestedClaimsHash||"",r].join(_c).toLowerCase()}generateAccountKey(e){let t=e.homeAccountId.split(".")[1];return[`${oe}.${2}`,e.homeAccountId,e.environment,t||e.tenantId||""].join(_c).toLowerCase()}resetRequestCache(){this.logger.trace("BrowserCacheManager.resetRequestCache called"),this.removeTemporaryItem(this.generateCacheKey(j.REQUEST_PARAMS)),this.removeTemporaryItem(this.generateCacheKey(j.VERIFIER)),this.removeTemporaryItem(this.generateCacheKey(j.ORIGIN_URI)),this.removeTemporaryItem(this.generateCacheKey(j.URL_HASH)),this.removeTemporaryItem(this.generateCacheKey(j.NATIVE_REQUEST)),this.setInteractionInProgress(!1)}cacheAuthorizeRequest(e,t){this.logger.trace("BrowserCacheManager.cacheAuthorizeRequest called");let r=Qt(JSON.stringify(e));if(this.setTemporaryCache(j.REQUEST_PARAMS,r,!0),t){let o=Qt(t);this.setTemporaryCache(j.VERIFIER,o,!0)}}getCachedRequest(){this.logger.trace("BrowserCacheManager.getCachedRequest called");let e=this.getTemporaryCache(j.REQUEST_PARAMS,!0);if(!e)throw A(ko);let t=this.getTemporaryCache(j.VERIFIER,!0),r,o="";try{r=JSON.parse(Z(e)),t&&(o=Z(t))}catch(i){throw this.logger.errorPii(`Attempted to parse: ${e}`),this.logger.error(`Parsing cached token request threw with error: ${i}`),A(Ro)}return[r,o]}getCachedNativeRequest(){this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");let e=this.getTemporaryCache(j.NATIVE_REQUEST,!0);if(!e)return this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found"),null;let t=this.validateAndParseJson(e);return t||(this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request"),null)}isInteractionInProgress(e){let t=this.getInteractionInProgress()?.clientId;return e?t===this.clientId:!!t}getInteractionInProgress(){let e=`${oe}.${j.INTERACTION_STATUS_KEY}`,t=this.getTemporaryCache(e,!1);try{return t?JSON.parse(t):null}catch{return this.logger.error("Cannot parse interaction status. Removing temporary cache items and clearing url hash. Retrying interaction should fix the error"),this.removeTemporaryItem(e),this.resetRequestCache(),fi(window),null}}setInteractionInProgress(e,t=Ke.SIGNIN){let r=`${oe}.${j.INTERACTION_STATUS_KEY}`;if(e){if(this.getInteractionInProgress())throw A(yo);this.setTemporaryCache(r,JSON.stringify({clientId:this.clientId,type:t}),!1)}else!e&&this.getInteractionInProgress()?.clientId===this.clientId&&this.removeTemporaryItem(r)}hydrateCache(e,t){return d(this,null,function*(){let r=$.createIdTokenEntity(e.account.homeAccountId,e.account.environment,e.idToken,this.clientId,e.tenantId),o;t.claims&&(o=yield this.cryptoImpl.hashString(t.claims));let i=$.createAccessTokenEntity(e.account.homeAccountId,e.account.environment,e.accessToken,this.clientId,e.tenantId,e.scopes.join(" "),e.expiresOn?J.toSecondsFromDate(e.expiresOn):0,e.extExpiresOn?J.toSecondsFromDate(e.extExpiresOn):0,Z,void 0,e.tokenType,void 0,t.sshKid,t.claims,o),s={idToken:r,accessToken:i};return this.saveCacheRecord(s,e.correlationId,Y.isKmsi(Y.extractTokenClaims(e.idToken,Z)),b.hydrateCache)})}saveCacheRecord(e,t,r,o,i){return d(this,null,function*(){try{yield Gs(n.prototype,this,"saveCacheRecord").call(this,e,t,r,o,i)}catch(s){if(s instanceof Bt&&this.performanceClient&&t)try{let a=this.getTokenKeys();this.performanceClient.addFields({cacheRtCount:a.refreshToken.length,cacheIdCount:a.idToken.length,cacheAtCount:a.accessToken.length},t)}catch{}throw s}})}};function Xl(n,e,t,r){try{switch(e){case B.LocalStorage:return new Ss(n,t,r);case B.SessionStorage:return new vs;case B.MemoryStorage:default:break}}catch(o){t.error(o)}return new wt}var Zl=(n,e,t,r)=>{let o={cacheLocation:B.MemoryStorage,cacheRetentionDays:5,temporaryCacheLocation:B.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};return new Yo(n,o,Lt,e,t,r)};function ed(n,e,t,r,o){return n.verbose("getAllAccounts called"),t?e.getAllAccounts(o||{},r):[]}function td(n,e,t,r){let o=t.getAccountInfoFilteredBy(n,r);return o?(e.verbose("getAccount: Account matching provided filter found, returning"),o):(e.verbose("getAccount: No matching account found, returning null"),null)}function rd(n,e,t,r){if(e.trace("getAccountByUsername called"),!n)return e.warning("getAccountByUsername: No username provided"),null;let o=t.getAccountInfoFilteredBy({username:n},r);return o?(e.verbose("getAccountByUsername: Account matching username found, returning"),e.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${n}`),o):(e.verbose("getAccountByUsername: No matching account found, returning null"),null)}function od(n,e,t,r){if(e.trace("getAccountByHomeId called"),!n)return e.warning("getAccountByHomeId: No homeAccountId provided"),null;let o=t.getAccountInfoFilteredBy({homeAccountId:n},r);return o?(e.verbose("getAccountByHomeId: Account matching homeAccountId found, returning"),e.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${n}`),o):(e.verbose("getAccountByHomeId: No matching account found, returning null"),null)}
7function nd(n,e,t,r){if(e.trace("getAccountByLocalId called"),!n)return e.warning("getAccountByLocalId: No localAccountId provided"),null;let o=t.getAccountInfoFilteredBy({localAccountId:n},r);return o?(e.verbose("getAccountByLocalId: Account matching localAccountId found, returning"),e.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${n}`),o):(e.verbose("getAccountByLocalId: No matching account found, returning null"),null)}function id(n,e,t){e.setActiveAccount(n,t)}function sd(n,e){return n.getActiveAccount(e)}var $h="msal.broadcast.event",ws=class{constructor(e){this.eventCallbacks=new Map,this.logger=e||new me({}),typeof BroadcastChannel<"u"&&(this.broadcastChannel=new BroadcastChannel($h)),this.invokeCrossTabCallbacks=this.invokeCrossTabCallbacks.bind(this)}addEventCallback(e,t,r){if(typeof window<"u"){let o=r||wc();return this.eventCallbacks.has(o)?(this.logger.error(`Event callback with id: ${o} is already registered. Please provide a unique id or remove the existing callback and try again.`),null):(this.eventCallbacks.set(o,[e,t||[]]),this.logger.verbose(`Event callback registered with id: ${o}`),o)}return null}removeEventCallback(e){this.eventCallbacks.delete(e),this.logger.verbose(`Event callback ${e} removed.`)}emitEvent(e,t,r,o){let i={eventType:e,interactionType:t||null,payload:r||null,error:o||null,timestamp:Date.now()};switch(e){case E.ACCOUNT_ADDED:case E.ACCOUNT_REMOVED:case E.ACTIVE_ACCOUNT_CHANGED:this.broadcastChannel?.postMessage(i);break;default:this.invokeCallbacks(i);break}}invokeCallbacks(e){this.eventCallbacks.forEach(([t,r],o)=>{(r.length===0||r.includes(e.eventType))&&(this.logger.verbose(`Emitting event to callback ${o}: ${e.eventType}`),t.apply(null,[e]))})}invokeCrossTabCallbacks(e){let t=e.data;this.invokeCallbacks(t)}subscribeCrossTab(){this.broadcastChannel?.addEventListener("message",this.invokeCrossTabCallbacks)}unsubscribeCrossTab(){this.broadcastChannel?.removeEventListener("message",this.invokeCrossTabCallbacks)}};var Jo=class{constructor(e,t,r,o,i,s,a,l,h){this.config=e,this.browserStorage=t,this.browserCrypto=r,this.networkClient=this.config.system.networkClient,this.eventHandler=i,this.navigationClient=s,this.platformAuthProvider=l,this.correlationId=h||se(),this.logger=o.clone(V.MSAL_SKU,ve,this.correlationId),this.performanceClient=a}clearCacheOnLogout(e,t){return d(this,null,function*(){if(t)try{this.browserStorage.removeAccount(t,e),this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.")}catch{this.logger.error("Account provided in logout request was not found. Local cache unchanged.")}else try{this.logger.verbose("No account provided in logout request, clearing all cache items.",this.correlationId),this.browserStorage.clear(e),yield this.browserCrypto.clearKeystore()}catch{this.logger.error("Attempted to clear all MSAL cache items and failed. Local cache unchanged.")}})}getRedirectUri(e){this.logger.verbose("getRedirectUri called");let t=e||this.config.auth.redirectUri;return _.getAbsoluteUrl(t,fe())}initializeServerTelemetryManager(e,t){this.logger.verbose("initializeServerTelemetryManager called");let r={clientId:this.config.auth.clientId,correlationId:this.correlationId,apiId:e,forceRefresh:t||!1,wrapperSKU:this.browserStorage.getWrapperMetadata()[0],wrapperVer:this.browserStorage.getWrapperMetadata()[1]};return new qr(r,this.browserStorage)}getDiscoveredAuthority(e){return d(this,null,function*(){let{account:t}=e,r=e.requestExtraQueryParameters&&e.requestExtraQueryParameters.hasOwnProperty("instance_aware")?e.requestExtraQueryParameters.instance_aware:void 0;this.performanceClient.addQueueMeasurement(c.StandardInteractionClientGetDiscoveredAuthority,this.correlationId);let o={protocolMode:this.config.auth.protocolMode,OIDCOptions:this.config.auth.OIDCOptions,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},i=e.requestAuthority||this.config.auth.authority,s=r?.length?r==="true":this.config.auth.instanceAware,a=t&&s?this.config.auth.authority.replace(_.getDomainFromUrl(i),t.environment):i,l=xe.generateAuthority(a,e.requestAzureCloudOptions||this.config.auth.azureCloudOptions),h=yield u(lo.createDiscoveredInstance,c.AuthorityFactoryCreateDiscoveredInstance,this.logger,this.performanceClient,this.correlationId)(l,this.config.system.networkClient,this.browserStorage,o,this.logger,this.correlationId,this.performanceClient);if(t&&!h.isAlias(t.environment))throw M(ce.authorityMismatch);return h})}};function Ei(n,e,t,r){return d(this,null,function*(){t.addQueueMeasurement(c.InitializeBaseRequest,n.correlationId);let o=n.authority||e.auth.authority,i=[...n&&n.scopes||[]],s=S(y({}
7,n),{correlationId:n.correlationId,authority:o,scopes:i});if(!s.authenticationScheme)s.authenticationScheme=N.BEARER,r.verbose(`Authentication Scheme wasn't explicitly set in request, defaulting to "Bearer" request`);else{if(s.authenticationScheme===N.SSH){if(!n.sshJwk)throw M(ce.missingSshJwk);if(!n.sshKid)throw M(ce.missingSshKid)}r.verbose(`Authentication Scheme set to "${s.authenticationScheme}" as configured in Auth request`)}return e.cache.claimsBasedCachingEnabled&&n.claims&&!L.isEmptyObj(n.claims)&&(s.requestedClaimsHash=yield ls(n.claims)),s})}function ad(n,e,t,r,o){return d(this,null,function*(){r.addQueueMeasurement(c.InitializeSilentRequest,n.correlationId);let i=yield u(Ei,c.InitializeBaseRequest,o,r,n.correlationId)(n,t,r,o);return S(y(y({},n),i),{account:e,forceRefresh:n.forceRefresh||!1})})}function ks(n,e){let t,r=n.httpMethod;if(e===H.EAR){if(t=r||Re.POST,t!==Re.POST)throw M(ce.invalidRequestMethodForEAR)}else t=r||Re.GET;if(n.authorizePostBodyParameters&&t!==Re.POST)throw M(ce.invalidAuthorizePostBodyParameters);return t}var Ee=class extends Jo{initializeLogoutRequest(e){this.logger.verbose("initializeLogoutRequest called",e?.correlationId);let t=y({correlationId:this.correlationId||se()},e);if(e)if(e.logoutHint)this.logger.verbose("logoutHint has already been set in logoutRequest");else if(e.account){let r=this.getLogoutHintFromIdTokenClaims(e.account);r&&(this.logger.verbose("Setting logoutHint to login_hint ID Token Claim value for the account provided"),t.logoutHint=r)}else this.logger.verbose("logoutHint was not set and account was not passed into logout request, logoutHint will not be set");else this.logger.verbose("logoutHint will not be set since no logout request was configured");return!e||e.postLogoutRedirectUri!==null?e&&e.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to uri set on logout request",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(e.postLogoutRedirectUri,fe())):this.config.auth.postLogoutRedirectUri===null?this.logger.verbose("postLogoutRedirectUri configured as null and no uri set on request, not passing post logout redirect",t.correlationId):this.config.auth.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to configured uri",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri,fe())):(this.logger.verbose("Setting postLogoutRedirectUri to current page",t.correlationId),t.postLogoutRedirectUri=_.getAbsoluteUrl(fe(),fe())):this.logger.verbose("postLogoutRedirectUri passed as null, not setting post logout redirect uri",t.correlationId),t}getLogoutHintFromIdTokenClaims(e){let t=e.idTokenClaims;if(t){if(t.login_hint)return t.login_hint;this.logger.verbose("The ID Token Claims tied to the provided account do not contain a login_hint claim, logoutHint will not be added to logout request")}else this.logger.verbose("The provided account does not contain ID Token Claims, logoutHint will not be added to logout request");return null}createAuthCodeClient(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.StandardInteractionClientCreateAuthCodeClient,this.correlationId);let t=yield u(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)(e);return new Gr(t,this.performanceClient)})}getClientConfiguration(e){return d(this,null,function*(){let{serverTelemetryManager:t,requestAuthority:r,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:s}=e;this.performanceClient.addQueueMeasurement(c.StandardInteractionClientGetClientConfiguration,this.correlationId);let a=e.authority||(yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,this.correlationId)({requestAuthority:r,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:s})),l=this.config.system.loggerOptions;return{authOptions:{clientId:this.config.auth.clientId,authority:a,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:this.config.auth.redirectUri},systemOptions:{tokenRenewalOffsetSeconds:this.config.system.tokenRenewalOffsetSeconds,preventCorsPreflight:!0},loggerOptions:{loggerCallback:l.loggerCallback,piiLoggingEnabled:l.piiLoggingEnabled,logLevel:l.logLevel,correlationId:this.correlationId},cacheOptions:{claimsBasedCachingEnabled:this.config.cache.claimsBasedCachingEnabled},cryptoInterface:this.browserCrypto,networkInterface:this.networkClient,storageInterface:this.browserStorage,serverTelemetryManager:t,libraryInfo:{sku:V.MSAL_SKU,version:ve,cpu:g.EMPTY_STRING,os:g.EMPTY_STRING},telemetry:this.config.telemetry}})}initializeAuthorizationRequest(e,t){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.StandardInteractionClientInitializeAuthorizationRequest,this.correlationId);let r=this.getRedirectUri(e.redirectUri);new URL(r).origin!==new URL(window.location.href).origin&&(this.logger.warning("The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.",this.correlationId),this.performanceClient.addFields({isRedirectUriCrossOrigin:!0},this.correlationId));let o={interactionType:t},i=He.setRequestState(this.browserCrypto,e&&e.state||g.EMPTY_STRING,o),s=yield u(Ei,c.InitializeBaseRequest,this.logger,this.performanceClient,this.correlationId)(S(y({},e),{correlationId:this.correlationId}),this.config,this.performanceClient,this.logger),a=S(y({},s),{redirectUri:r,state:i,nonce:e.nonce||se(),responseMode:this.config.auth.OIDCOptions.serverResponseType}),l=S(y({},a),{httpMethod:ks(a,this.config.auth.protocolMode)});if(e.loginHint||e.sid)return l;let h=e.account||this.browserStorage.getActiveAccount(this.correlationId);return h&&(this.logger.verbose("Setting validated request account",this.correlationId),this.logger.verbosePii(`Setting validated request account: ${h.homeAccountId}`,this.correlationId),l.account=h),l})}};function cd(n,e){if(!e)return null;try{return He.parseRequestState(n,e).libraryState.meta}
7catch{throw f(re.invalidState)}}function Jt(n,e,t){let r=We.getDeserializedResponse(n);if(!r)throw We.stripLeadingHashOrQuery(n)?(t.error(`A ${e} is present in the iframe but it does not contain known properties. It's likely that the ${e} has been replaced by code running on the redirectUri page.`),t.errorPii(`The ${e} detected is: ${n}`),A(go)):(t.error(`The request has returned to the redirectUri but a ${e} is not present. It's likely that the ${e} has been removed or the page has been redirected by code running on the redirectUri page.`),A(po));return r}function ld(n,e,t){if(!n.state)throw A($t);let r=cd(e,n.state);if(!r)throw A(fo);if(r.interactionType!==t)throw A(Co)}var Xo=class{constructor(e,t,r,o,i){this.authModule=e,this.browserStorage=t,this.authCodeRequest=r,this.logger=o,this.performanceClient=i}handleCodeResponse(e,t,r){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.HandleCodeResponse,t.correlationId);let o;try{o=_e.getAuthorizationCodePayload(e,t.state)}catch(i){throw i instanceof Ae&&i.subError===Be?A(Be):i}return u(this.handleCodeResponseFromServer.bind(this),c.HandleCodeResponseFromServer,this.logger,this.performanceClient,t.correlationId)(o,t,r)})}handleCodeResponseFromServer(e,t,r,o=!0){return d(this,null,function*(){if(this.performanceClient.addQueueMeasurement(c.HandleCodeResponseFromServer,t.correlationId),this.logger.trace("InteractionHandler.handleCodeResponseFromServer called"),this.authCodeRequest.code=e.code,e.cloud_instance_host_name&&(yield u(this.authModule.updateAuthority.bind(this.authModule),c.UpdateTokenEndpointAuthority,this.logger,this.performanceClient,t.correlationId)(e.cloud_instance_host_name,t.correlationId)),o&&(e.nonce=t.nonce||void 0),e.state=t.state,e.client_info)this.authCodeRequest.clientInfo=e.client_info;else{let s=this.createCcsCredentials(t);s&&(this.authCodeRequest.ccsCredential=s)}return yield u(this.authModule.acquireToken.bind(this.authModule),c.AuthClientAcquireToken,this.logger,this.performanceClient,t.correlationId)(this.authCodeRequest,r,e)})}createCcsCredentials(e){return e.account?{credential:e.account.homeAccountId,type:le.HOME_ACCOUNT_ID}:e.loginHint?{credential:e.loginHint,type:le.UPN}:null}};var dd="ContentError",hd="PageException",Rs="user_switch";var ud="USER_INTERACTION_REQUIRED",md="USER_CANCEL",pd="NO_NETWORK",gd="DISABLED",fd="ACCOUNT_UNAVAILABLE",Cd="UX_NOT_ALLOWED";var Vh=-2147186943,jh={[Rs]:"User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."},Pe=class n extends v{constructor(e,t,r){super(e,t),Object.setPrototypeOf(this,n.prototype),this.name="NativeAuthError",this.ext=r}};function Xt(n){if(n.ext&&n.ext.status&&n.ext.status===gd||n.ext&&n.ext.error&&n.ext.error===Vh)return!0;switch(n.errorCode){case dd:case hd:return!0;default:return!1}}function Qr(n,e,t){if(t&&t.status)switch(t.status){case fd:return Kr(Ye.nativeAccountUnavailable);case ud:return new ne(n,e);case md:return A(Be);case pd:return A(Et);case Cd:return Kr(Ye.uxNotAllowed)}return new Pe(n,jh[n]||e,t)}var Zo=class extends Ee{acquireToken(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentCacheClientAcquireToken,e.correlationId);let t=this.initializeServerTelemetryManager(b.acquireTokenSilent_silentFlow),r=yield u(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:t,requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,account:e.account}),o=new hi(r,this.performanceClient);this.logger.verbose("Silent auth client created");try{let s=(yield u(o.acquireCachedToken.bind(o),c.SilentFlowClientAcquireCachedToken,this.logger,this.performanceClient,e.correlationId)(e))[0];return this.performanceClient.addFields({fromCache:!0},e.correlationId),s}catch(i){throw i instanceof Wr&&i.errorCode===Vt&&this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."),i}})}logout(e){this.logger.verbose("logoutRedirect called");
7let t=this.initializeLogoutRequest(e);return this.clearCacheOnLogout(t.correlationId,t?.account)}};var Zt=class extends Jo{constructor(e,t,r,o,i,s,a,l,h,m,p,C){super(e,t,r,o,i,s,l,h,C),this.apiId=a,this.accountId=m,this.platformAuthProvider=h,this.nativeStorageManager=p,this.silentCacheClient=new Zo(e,this.nativeStorageManager,r,o,i,s,l,h,C);let T=this.platformAuthProvider.getExtensionName();this.skus=qr.makeExtraSkuString({libraryName:V.MSAL_SKU,libraryVersion:ve,extensionName:T,extensionVersion:this.platformAuthProvider.getExtensionVersion()})}addRequestSKUs(e){e.extraParameters=S(y({},e.extraParameters),{[gt.X_CLIENT_EXTRA_SKU]:this.skus})}acquireToken(e,t){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.NativeInteractionClientAcquireToken,this.correlationId),this.logger.trace("NativeInteractionClient - acquireToken called.");let r=this.performanceClient.startMeasurement(c.NativeInteractionClientAcquireToken,this.correlationId),o=J.nowSeconds(),i=this.initializeServerTelemetryManager(this.apiId);try{let s=yield this.initializeNativeRequest(e);try{let l=yield this.acquireTokensFromCache(this.accountId,s);return r.end({success:!0,isNativeBroker:!1,fromCache:!0}),l}catch(l){if(t===ie.AccessToken)throw this.logger.info("MSAL internal Cache does not contain tokens, return error as per cache policy"),r.end({success:!1,brokerErrorCode:"cache_request_failed"}),l;this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call")}let a=yield this.platformAuthProvider.sendMessage(s);return yield this.handleNativeResponse(a,s,o).then(l=>(r.end({success:!0,isNativeBroker:!0,requestId:l.requestId}),i.clearNativeBrokerErrorCode(),l)).catch(l=>{throw r.end({success:!1,errorCode:l.errorCode,subErrorCode:l.subError}),l})}catch(s){throw s instanceof Pe&&i.setNativeBrokerErrorCode(s.errorCode),r.end({success:!1}),s}})}createSilentCacheRequest(e,t){return{authority:e.authority,correlationId:this.correlationId,scopes:z.fromString(e.scope).asArray(),account:t,forceRefresh:!1}}acquireTokensFromCache(e,t){return d(this,null,function*(){if(!e)throw this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided"),f(re.noAccountFound);let r=this.browserStorage.getBaseAccountInfo({nativeAccountId:e},this.correlationId);if(!r)throw f(re.noAccountFound);try{let o=this.createSilentCacheRequest(t,r),i=yield this.silentCacheClient.acquireToken(o),s=S(y({},r),{idTokenClaims:i?.idTokenClaims,idToken:i?.idToken});return S(y({},i),{account:s})}catch(o){throw o}})}acquireTokenRedirect(e,t){return d(this,null,function*(){this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");let r=nt(e,[]);delete r.onRedirectNavigate;let o=yield this.initializeNativeRequest(r);try{yield this.platformAuthProvider.sendMessage(o)}catch(a){if(a instanceof Pe&&(this.initializeServerTelemetryManager(this.apiId).setNativeBrokerErrorCode(a.errorCode),Xt(a)))throw a}this.browserStorage.setTemporaryCache(j.NATIVE_REQUEST,JSON.stringify(o),!0);let i={apiId:b.acquireTokenRedirect,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},s=this.config.auth.navigateToLoginRequestUrl?window.location.href:this.getRedirectUri(e.redirectUri);t.end({success:!0}),yield this.navigationClient.navigateExternal(s,i)})}handleRedirectPromise(e,t){return d(this,null,function*(){if(this.logger.trace("NativeInteractionClient - handleRedirectPromise called."),!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;let r=this.browserStorage.getCachedNativeRequest();if(!r)return this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null."),e&&t&&e?.addFields({errorCode:"no_cached_request"},t),null;let a=r,{prompt:o}=a,i=nt(a,["prompt"]);o&&this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, removing prompt from cached request to prevent second interaction with native broker window."),this.browserStorage.removeItem(this.browserStorage.generateCacheKey(j.NATIVE_REQUEST));
7let s=J.nowSeconds();try{this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");let l=yield this.platformAuthProvider.sendMessage(i),h=yield this.handleNativeResponse(l,i,s);return this.initializeServerTelemetryManager(this.apiId).clearNativeBrokerErrorCode(),e&&this.correlationId&&this.performanceClient.addFields({isNativeBroker:!0},this.correlationId),h}catch(l){throw l}})}logout(){return this.logger.trace("NativeInteractionClient - logout called."),Promise.reject("Logout not implemented yet")}handleNativeResponse(e,t,r){return d(this,null,function*(){this.logger.trace("NativeInteractionClient - handleNativeResponse called.");let o=Y.extractTokenClaims(e.id_token,Z),i=this.createHomeAccountIdentifier(e,o),s=this.browserStorage.getAccountInfoFilteredBy({nativeAccountId:t.accountId},this.correlationId)?.homeAccountId;if(t.extraParameters?.child_client_id&&e.account.id!==t.accountId)this.logger.info("handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch");else if(i!==s&&e.account.id!==t.accountId)throw Qr(Rs);let a=yield this.getDiscoveredAuthority({requestAuthority:t.authority}),l=mo(this.browserStorage,a,i,Z,this.correlationId,o,e.client_info,void 0,o.tid,void 0,e.account.id,this.logger);e.expires_in=Number(e.expires_in);let h=yield this.generateAuthenticationResult(e,t,o,l,a.canonicalAuthority,r);return yield this.cacheAccount(l,this.correlationId,Y.isKmsi(o)),yield this.cacheNativeTokens(e,t,i,o,e.access_token,h.tenantId,r),h})}createHomeAccountIdentifier(e,t){return D.generateHomeAccountId(e.client_info||g.EMPTY_STRING,pe.Default,this.logger,this.browserCrypto,t)}generateScopes(e,t){return t?z.fromString(t):z.fromString(e)}generatePopAccessToken(e,t){return d(this,null,function*(){if(t.tokenType===N.POP&&t.signPopToken){if(e.shr)return this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer"),e.shr;let r=new Te(this.browserCrypto),o={resourceRequestMethod:t.resourceRequestMethod,resourceRequestUri:t.resourceRequestUri,shrClaims:t.shrClaims,shrNonce:t.shrNonce};if(!t.keyId)throw f(re.keyIdMissing);return r.signPopToken(e.access_token,t.keyId,o)}else return e.access_token})}generateAuthenticationResult(e,t,r,o,i,s){return d(this,null,function*(){let a=this.addTelemetryFromNativeResponse(e.properties.MATS),l=this.generateScopes(t.scope,e.scope),h=e.account.properties||{},m=h.UID||r.oid||r.sub||g.EMPTY_STRING,p=h.TenantId||r.tid||g.EMPTY_STRING,C=Pr(D.getAccountInfo(o),void 0,r,e.id_token);C.nativeAccountId!==e.account.id&&(C.nativeAccountId=e.account.id);let T=yield this.generatePopAccessToken(e,t),P=t.tokenType===N.POP?N.POP:N.BEARER;return{authority:i,uniqueId:m,tenantId:p,scopes:l.asArray(),account:C,idToken:e.id_token,idTokenClaims:r,accessToken:T,fromCache:a?this.isResponseFromCache(a):!1,expiresOn:J.toDateFromSeconds(s+e.expires_in),tokenType:P,correlationId:this.correlationId,state:e.state,fromNativeBroker:!0}})}cacheAccount(e,t,r){return d(this,null,function*(){yield this.browserStorage.setAccount(e,this.correlationId,r,this.apiId),this.browserStorage.removeAccountContext(D.getAccountInfo(e),t)})}cacheNativeTokens(e,t,r,o,i,s,a){let l=$.createIdTokenEntity(r,t.authority,e.id_token||"",t.clientId,o.tid||""),h=t.tokenType===N.POP?g.SHR_NONCE_VALIDITY:(typeof e.expires_in=="str
7ing"?parseInt(e.expires_in,10):e.expires_in)||0,m=a+h,p=this.generateScopes(e.scope,t.scope),C=$.createAccessTokenEntity(r,t.authority,i,t.clientId,o.tid||s,p.printScopes(),m,0,Z,void 0,t.tokenType,void 0,t.keyId),T={idToken:l,accessToken:C};return this.nativeStorageManager.saveCacheRecord(T,this.correlationId,Y.isKmsi(o),this.apiId,t.storeInCache)}getExpiresInValue(e,t){return e===N.POP?g.SHR_NONCE_VALIDITY:(typeof t=="string"?parseInt(t,10):t)||0}addTelemetryFromNativeResponse(e){let t=this.getMATSFromResponse(e);return t?(this.performanceClient.addFields({extensionId:this.platformAuthProvider.getExtensionId(),extensionVersion:this.platformAuthProvider.getExtensionVersion(),matsBrokerVersion:t.broker_version,matsAccountJoinOnStart:t.account_join_on_start,matsAccountJoinOnEnd:t.account_join_on_end,matsDeviceJoin:t.device_join,matsPromptBehavior:t.prompt_behavior,matsApiErrorCode:t.api_error_code,matsUiVisible:t.ui_visible,matsSilentCode:t.silent_code,matsSilentBiSubCode:t.silent_bi_sub_code,matsSilentMessage:t.silent_message,matsSilentStatus:t.silent_status,matsHttpStatus:t.http_status,matsHttpEventCount:t.http_event_count},this.correlationId),t):null}getMATSFromResponse(e){if(e)try{return JSON.parse(e)}catch{this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead")}return null}isResponseFromCache(e){return typeof e.is_cached>"u"?(this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false."),!1):!!e.is_cached}initializeNativeRequest(e){return d(this,null,function*(){this.logger.trace("NativeInteractionClient - initializeNativeRequest called");let t=yield this.getCanonicalAuthority(e),m=e,{scopes:r,claims:o}=m,i=nt(m,["scopes","claims"]),s=new z(r||[]);s.appendScopes(Ie);let a=e.skipBrokerClaims&&e.embeddedClientId?void 0:this.config.auth.clientCapabilities,l=a&&a.length?F.addClientCapabilitiesToClaims(o,a):o,h=S(y({},i),{claims:l,accountId:this.accountId,clientId:this.config.auth.clientId,authority:t.urlString,scope:s.printScopes(),redirectUri:this.getRedirectUri(e.redirectUri),prompt:this.getPrompt(e.prompt),correlationId:this.correlationId,tokenType:e.authenticationScheme,windowTitleSubstring:document.title,extraParameters:y(y({},e.extraQueryParameters),e.tokenQueryParameters),extendedExpiryToken:!1,keyId:e.popKid});if(h.signPopToken&&e.popKid)throw A(Fo);if(this.handleExtraBrokerParams(h),h.extraParameters=h.extraParameters||{},h.extraParameters.telemetry=ge.MATS_TELEMETRY,e.authenticationScheme===N.POP){let p={resourceRequestUri:e.resourceRequestUri,resourceRequestMethod:e.resourceRequestMethod,shrClaims:e.shrClaims,shrNonce:e.shrNonce},C=new Te(this.browserCrypto),T;if(h.keyId)T=this.browserCrypto.base64UrlEncode(JSON.stringify({kid:h.keyId})),h.signPopToken=!1;else{let P=yield u(C.generateCnf.bind(C),c.PopTokenGenerateCnf,this.logger,this.performanceClient,this.correlationId)(p,this.logger);T=P.reqCnfString,h.keyId=P.kid,h.signPopToken=!0}h.reqCnf=T}return this.addRequestSKUs(h),h})}getCanonicalAuthority(e){return d(this,null,function*(){let t=e.authority||this.config.auth.authority;e.account&&(yield this.getDiscoveredAuthority({requestAuthority:t,requestAzureCloudOptions:e.azureCloudOptions,account:e.account}));let r=new _(t);return r.validateAsUri(),r})}getPrompt(e){switch(this.apiId){case b.ssoSilent:case b.acquireTokenSilent_silentFlow:return this.logger.trace("initializeNativeRequest: silent request sets prompt to none"),K.NONE}if(!e){this.logger.trace("initializeNativeRequest: prompt was not provided");return}switch(e){case K.NONE:case K.CONSENT:case K.LOGIN:case K.SELECT_ACCOUNT:return this.logger.trace("initializeNativeRequest: prompt is compatible with native flow"),e;default:throw this.logger.trace(`initializeNativeRequest: prompt = ${e} is not compatible with native flow`),A(xo)}}handleExtraBrokerParams(e){let t=e.extraParameters&&e.extraParameters.hasOwnProperty(gt.BROKER_CLIENT_ID)&&e.extraParameters.hasOwnProperty(gt.BROKER_REDIRECT_URI)&&e.extraParameters.hasOwnProperty(gt.CLIENT_ID);if(!e.embeddedClientId&&!t)return;let r="",o=e.redirectUri;e.embeddedClientId?(e.redirectUri=this.config.auth.redirectUri,r=e.embeddedClientId):e.extraParameters&&(e.redirectUri=e.extraParameters[gt.BROKER_REDIRECT_URI],r=e.extraParameters[gt.CLIENT_ID]),e.extraParameters={child_client_id:r,child_redirect_uri:o},this.performanceClient?.addFields({embeddedClientId:r,embeddedRedirectUri:o},this.correlationId)}};var Wh=new Map([["e","AAD"],["m","MSA"]]);function Qh(n){if(!n)return null;try{let t=decodeURIComponent(n).split("|");return t.length<5?null:{accountType:Wh.get(t[0]?.trim()||"")||"",error:t[1]?.trim()||"",subError:t[2]?.trim()||"",cloudInstance:t[3]?.trim()||"",callerDataBoundary:t[4]?.trim()||""}}catch{return null}}function yd(n,e,t){let r=Qh(n.clientdata);r?.accountType&&t.addFields({accountType:r.accountType},e),r?.error&&t.addFields({serverErrorNo:r.error},e),r?.subError&&t.addFields({serverSubErrorNo:r.subError},e)}function Oc(n,e,t,r,o){return d(this,null,function*(){let i=_e.getStandardAuthorizeRequestParameters(S(y({},n.auth),{authority:e}),t,r,o);if(F.addLibraryInfo(i,{sku:V.MSAL_SKU,version:ve,os:"",cpu:""}),n.auth.protocolMode!==H.OIDC&&F.addApplicationTelemetry(i,n.telemetry.application),t.platformBroker&&(F.addNativeBroker(i),o.addFields({isPlatformAuthorizeRequest:!0},t.correlationId),t.authenticationScheme===N.POP)){let s=new jo(r,o),a=new Te(s),l;t.popKid?l=s.encodeKid(t.popKid):l=(yield u(a.generateCnf.bind(a),c.PopTokenGenerateCnf,r,o,t.correlationId)(t,r)).reqCnfString,F.addPopToken(i,l)}return F.instrumentBrokerParams(i,t.correlationId,o),i})}function Yr(n,e,t,r,o){return d(this,null,function*(){if(!t.codeChallenge)throw M(ce.pkceParamsMissing);let i=yield u(Oc,c.GetStandardParams,r,o,t.correlationId)(n,e,t,r,o);return F.addResponseType(i,an.CODE),F.addCodeChallengeParams(i,t.codeChallenge,g.S256_CODE_CHALLENGE_METHOD),F.addExtraQueryParameters(i,t.extraQueryParameters||{}),_e.getAuthorizeUrl(e,i,n.auth.encodeExtraQueryParams,t.extraQueryParameters)})}function en(n,e,t,r,o,i){return d(this,null,function*(){if(!r.earJwk)throw A(mi);let s=yield Oc(e,t,r,o,i);F.addResponseType(s,an.IDTOKEN_TOKEN_REFRESHTOKEN),F.addEARParameters(s,r.earJwk),F.addCodeChallengeParams(s,r.codeChallenge,g.S256_CODE_CHALLENGE_METHOD);let a=new Map;F.addExtraQueryParameters(a,r.extraQueryParameters||{}),F.addCorrelationId(a,r.correlationId);let l=_e.getAuthorizeUrl(t,a,e.auth.encodeExtraQueryParams,r.extraQueryParameters);return Ad(n,l,s)})}function tn(n,e,t,r,o,i){return d(this,null,function*(){let s=yield Oc(e,t,r,o,i);F.addResponseType(s,an.CODE),F.addCodeChallengeParams(s,r.codeChallenge,r.codeChallengeMethod||g.S256_CODE_CHALLENGE_METHOD),F.addPostBodyParameters(s,r.authorizePostBodyParameters||{});let a=new Map;F.addExtraQueryParameters(a,r.extraQueryParameters||{}),F.addCorrelationId(a,r.correlationId);let l=_e.getAuthorizeUrl(t,a,e.auth.encodeExtraQueryParams,r.extraQueryParameters);return Ad(n,l,s)})}function Ad(n,e,t){let r=n.createElement("form");return r.method="post",r.action=e,t.forEach((o,i)=>{let s=n.createElement("input");s.hidden=!0,s.name=i,s.value=o,r.appendChild(s)}),n.body.appendChild(r),r}function Td(n,e,t,r,o,i,s,a,l,h){return d(this,null,function*(){if(a.verbose("Account id found, calling WAM for token"),!h)throw A(Wt);let m=new jo(a,l),p=new Zt(r,o,m,a,s,r.system.navigationClient,t,l,h,e,i,n.correlationId),{userRequestState:C}=He.parseRequestState(m,n.state);return u(p.acquireToken.bind(p),c.NativeInteractionClientAcquireToken,a,l,n.correlationId)(S(y({},n),{state:C,prompt:void 0}))})}function Rt(n,e,t,r,o,i,s,a,l,h,m,p){return d(this,null,function*(){if(Tt.removeThrottle(s,o.auth.clientId,n),yd(e,n.correlationId,m),e.accountId)return u(Td,c.HandleResponsePlatformBroker,h,m,n.correlationId)(n,e.accountId,r,o,s,a,l,h,m,p);let C=S(y({}
7,n),{code:e.code||"",codeVerifier:t}),T=new Xo(i,s,C,h,m);return yield u(T.handleCodeResponse.bind(T),c.HandleCodeResponse,h,m,n.correlationId)(e,n,r)})}function rn(n,e,t,r,o,i,s,a,l,h,m){return d(this,null,function*(){if(Tt.removeThrottle(i,r.auth.clientId,n),yd(e,n.correlationId,h),_e.validateAuthorizationResponse(e,n.state),!e.ear_jwe)throw A(Zi);if(!n.earJwk)throw A(mi);let p=JSON.parse(yield u(Dl,c.DecryptEarResponse,l,h,n.correlationId)(n.earJwk,e.ear_jwe));if(p.accountId)return u(Td,c.HandleResponsePlatformBroker,l,h,n.correlationId)(n,p.accountId,t,r,i,s,a,l,h,m);let C=new Fe(r.auth.clientId,i,new jo(l,h),l,null,null,h);C.validateTokenResponse(p);let T={code:"",state:n.state,nonce:n.nonce,client_info:p.client_info,cloud_graph_host_name:p.cloud_graph_host_name,cloud_instance_host_name:p.cloud_instance_host_name,cloud_instance_name:p.cloud_instance_name,msgraph_host:p.msgraph_host};return yield u(C.handleServerTokenResponse.bind(C),c.HandleServerTokenResponse,l,h,n.correlationId)(p,o,J.nowSeconds(),n,t,T,void 0,void 0,void 0,void 0)})}var Yh=32;function Oe(n,e,t){return d(this,null,function*(){n.addQueueMeasurement(c.GeneratePkceCodes,t);let r=G(Jh,c.GenerateCodeVerifier,e,n,t)(n,e,t),o=yield u(Xh,c.GenerateCodeChallengeFromVerifier,e,n,t)(r,n,e,t);return{verifier:r,challenge:o}})}function Jh(n,e,t){try{let r=new Uint8Array(Yh);return G(Ol,c.GetRandomValues,e,n,t)(r),be(r)}catch{throw A(zr)}}function Xh(n,e,t,r){return d(this,null,function*(){e.addQueueMeasurement(c.GenerateCodeChallengeFromVerifier,r);try{let o=yield u(Ac,c.Sha256Digest,t,e,r)(n,e,r);return be(new Uint8Array(o))}catch{throw A(zr)}})}var _s=class n{constructor(e,t,r,o){this.logger=e,this.handshakeTimeoutMs=t,this.extensionId=o,this.resolvers=new Map,this.handshakeResolvers=new Map,this.messageChannel=new MessageChannel,this.windowListener=this.onWindowMessage.bind(this),this.performanceClient=r,this.handshakeEvent=r.startMeasurement(c.NativeMessageHandlerHandshake),this.platformAuthType=ge.PLATFORM_EXTENSION_PROVIDER}sendMessage(e){return d(this,null,function*(){this.logger.trace(this.platformAuthType+" - sendMessage called.");let t={method:Ko.GetToken,request:e},r={channel:ge.CHANNEL_ID,extensionId:this.extensionId,responseId:se(),body:t};this.logger.trace(this.platformAuthType+" - Sending request to browser extension"),this.logger.tracePii(this.platformAuthType+` - Sending request to browser extension: ${JSON.stringify(r)}`),this.messageChannel.port1.postMessage(r);let o=yield new Promise((s,a)=>{this.resolvers.set(r.responseId,{resolve:s,reject:a})});return this.validatePlatformBrokerResponse(o)})}static createProvider(e,t,r){return d(this,null,function*(){e.trace("PlatformAuthExtensionHandler - createProvider called.");try{let o=new n(e,t,r,ge.PREFERRED_EXTENSION_ID);return yield o.sendHandshakeRequest(),o}catch{let i=new n(e,t,r);return yield i.sendHandshakeRequest(),i}})}sendHandshakeRequest(){return d(this,null,function*(){this.logger.trace(this.platformAuthType+" - sendHandshakeRequest called."),window.addEventListener("message",this.windowListener,!1);let e={channel:ge.CHANNEL_ID,extensionId:this.extensionId,responseId:se(),body:{method:Ko.HandshakeRequest}};return this.handshakeEvent.add({extensionId:this.extensionId,extensionHandshakeTimeoutMs:this.handshakeTimeoutMs}),this.messageChannel.port1.onmessage=t=>{this.onChannelMessage(t)},window.postMessage(e,window.origin,[this.messageChannel.port2]),new Promise((t,r)=>{this.handshakeResolvers.set(e.responseId,{resolve:t,reject:r}),this.timeoutId=window.setTimeout(()=>{window.removeEventListener("message",this.windowListener,!1),this.messageChannel.port1.close(),this.messageChannel.port2.close(),this.handshakeEvent.end({extensionHandshakeTimedOut:!0,success:!1}),r(A(Do)),this.handshakeResolvers.delete(e.responseId)},this.handshakeTimeoutMs)})})}onWindowMessage(e){if(this.logger.trace(this.platformAuthType+" - onWindowMessage called"),e.source!==window)return;let t=e.data;if(!(!t.channel||t.channel!==ge.CHANNEL_ID)&&!(t.extensionId&&t.extensionId!==this.extensionId)&&t.body.method===Ko.HandshakeRequest){let r=this.handshakeResolvers.get(t.responseId);if(!r){this.logger.trace(this.platformAuthType+`.onWindowMessage - resolver can't be found for request ${t.responseId}`);return}this.logger.verbose(t.extensionId?`Extension with id: ${t.extensionId}
7 not installed`:"No extension installed"),clearTimeout(this.timeoutId),this.messageChannel.port1.close(),this.messageChannel.port2.close(),window.removeEventListener("message",this.windowListener,!1),this.handshakeEvent.end({success:!1,extensionInstalled:!1}),r.reject(A(Lo))}}onChannelMessage(e){this.logger.trace(this.platformAuthType+" - onChannelMessage called.");let t=e.data,r=this.resolvers.get(t.responseId),o=this.handshakeResolvers.get(t.responseId);try{let i=t.body.method;if(i===Ko.Response){if(!r)return;let s=t.body.response;if(this.logger.trace(this.platformAuthType+" - Received response from browser extension"),this.logger.tracePii(this.platformAuthType+` - Received response from browser extension: ${JSON.stringify(s)}`),s.status!=="Success")r.reject(Qr(s.code,s.description,s.ext));else if(s.result)s.result.code&&s.result.description?r.reject(Qr(s.result.code,s.result.description,s.result.ext)):r.resolve(s.result);else throw to(Pt.unexpectedError,"Event does not contain result.");this.resolvers.delete(t.responseId)}else if(i===Ko.HandshakeResponse){if(!o){this.logger.trace(this.platformAuthType+`.onChannelMessage - resolver can't be found for request ${t.responseId}`);return}clearTimeout(this.timeoutId),window.removeEventListener("message",this.windowListener,!1),this.extensionId=t.extensionId,this.extensionVersion=t.body.version,this.logger.verbose(this.platformAuthType+` - Received HandshakeResponse from extension: ${this.extensionId}`),this.handshakeEvent.end({extensionInstalled:!0,success:!0}),o.resolve(),this.handshakeResolvers.delete(t.responseId)}}catch(i){this.logger.error("Error parsing response from WAM Extension"),this.logger.errorPii(`Error parsing response from WAM Extension: ${i}`),this.logger.errorPii(`Unable to parse ${e}`),r?r.reject(i):o&&o.reject(i)}}validatePlatformBrokerResponse(e){if(e.hasOwnProperty("access_token")&&e.hasOwnProperty("id_token")&&e.hasOwnProperty("client_info")&&e.hasOwnProperty("account")&&e.hasOwnProperty("scope")&&e.hasOwnProperty("expires_in"))return e;throw to(Pt.unexpectedError,"Response missing expected properties.")}getExtensionId(){return this.extensionId}getExtensionVersion(){return this.extensionVersion}getExtensionName(){return this.getExtensionId()===ge.PREFERRED_EXTENSION_ID?"chrome":this.getExtensionId()?.length?"unknown":void 0}};var bs=class n{constructor(e,t,r){this.logger=e,this.performanceClient=t,this.correlationId=r,this.platformAuthType=ge.PLATFORM_DOM_PROVIDER}static createProvider(e,t,r){return d(this,null,function*(){if(e.trace("PlatformAuthDOMHandler: createProvider called"),window.navigator?.platformAuthentication&&(yield window.navigator.platformAuthentication.getSupportedContracts(ge.MICROSOFT_ENTRA_BROKERID))?.includes(ge.PLATFORM_DOM_APIS))return e.trace("Platform auth api available in DOM"),new n(e,t,r)})}getExtensionId(){return ge.MICROSOFT_ENTRA_BROKERID}getExtensionVersion(){return""}getExtensionName(){return ge.DOM_API_NAME}sendMessage(e){return d(this,null,function*(){this.logger.trace(this.platformAuthType+" - Sending request to browser DOM API");try{let t=this.initializePlatformDOMRequest(e),r=yield window.navigator.platformAuthentication.executeGetToken(t);return this.validatePlatformBrokerResponse(r)}catch(t){throw this.logger.error(this.platformAuthType+" - executeGetToken DOM API error"),t}})}initializePlatformDOMRequest(e){this.logger.trace(this.platformAuthType+" - initializeNativeDOMRequest called");let O=e,{accountId:t,clientId:r,authority:o,scope:i,redirectUri:s,correlationId:a,state:l,storeInCache:h,embeddedClientId:m,extraParameters:p}=O,C=nt(O,["accountId","clientId","authority","scope","redirectUri","correlationId","state","storeInCache","embeddedClientId","extraParameters"]),T=this.getDOMExtraParams(C);return{accountId:t,brokerId:this.getExtensionId(),authority:o,clientId:r,correlationId:a||this.correlationId,extraParameters:y(y({},p),T),isSecurityTokenService:!1,redirectUri:s,scope:i,state:l,storeInCache:h,embeddedClientId:m}}validatePlatformBrokerResponse(e){if(e.hasOwnProperty("isSuccess")){if(e.hasOwnProperty("accessToken")&&e.hasOwnProperty("idToken")&&e.hasOwnProperty("clientInfo")&&e.hasOwnProperty("account")&&e.hasOwnProperty("scopes")&&e.hasOwnProperty("expiresIn"))return this.logger.trace(this.platformAuthType+" - platform broker returned successful and valid response"),this.convertToPlatformBrokerResponse(e);if(e.hasOwnProperty("error")){let t=e;if(t.isSuccess===!1&&t.error&&t.error.code)throw this.logger.trace(this.platformAuthType+" - platform broker returned error response"),Qr(t.error.code,t.error.description,{error:parseInt(t.error.errorCode),protocol_error:t.error.protocolError,status:t.error.status,properties:t.error.properties})}}throw to(Pt.unexpectedError,"Response missing expected properties.")}convertToPlatformBrokerResponse(e){return this.logger.trace(this.platformAuthType+" - convertToNativeResponse called"),{access_token:e.accessToken,id_token:e.idToken,client_info:e.clientInfo,account:e.account,expires_in:e.expires
7In,scope:e.scopes,state:e.state||"",properties:e.properties||{},extendedLifetimeToken:e.extendedLifetimeToken??!1,shr:e.proofOfPossessionPayload}}getDOMExtraParams(e){try{let t={};for(let[r,o]of Object.entries(e))o&&(typeof o=="object"?t[r]=JSON.stringify(o):t[r]=String(o));return t}catch(t){return this.logger.error(this.platformAuthType+" - Error stringifying extra parameters"),this.logger.errorPii(this.platformAuthType+" - Error stringifying extra parameters: "+t),{}}}};function Ed(n,e,t,r,o){return d(this,null,function*(){n.trace("getPlatformAuthProvider called",t),n.trace("Has client allowed platform auth via DOM API: "+o);let i;try{o&&(i=yield bs.createProvider(n,e,t)),i||(n.trace("Platform auth via DOM API not available, checking for extension"),i=yield _s.createProvider(n,r||kc,e))}catch(s){n.trace("Platform auth not available",s)}return i})}function _t(n,e,t,r){if(e.trace("isPlatformAuthAllowed called"),!n.system.allowPlatformBroker&&n.system.allowPlatformBrokerWithDOM)throw M(ce.invalidPlatformBrokerConfiguration);if(!n.system.allowPlatformBroker)return e.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false"),!1;if(!t)return e.trace("isPlatformAuthAllowed: Platform auth provider is not initialized, returning false"),!1;if(r)switch(r){case N.BEARER:case N.POP:return e.trace("isPlatformAuthAllowed: authenticationScheme is supported, returning true"),!0;default:return e.trace("isPlatformAuthAllowed: authenticationScheme is not supported, returning false"),!1}return!0}var Ps=class extends Ee{constructor(e,t,r,o,i,s,a,l,h,m){super(e,t,r,o,i,s,a,h,m),this.unloadWindow=this.unloadWindow.bind(this),this.nativeStorage=l,this.eventHandler=i}acquireToken(e,t){let r;try{if(r={popupName:this.generatePopupName(e.scopes||Ie,e.authority||this.config.auth.authority),popupWindowAttributes:e.popupWindowAttributes||{},popupWindowParent:e.popupWindowParent??window},this.performanceClient.addFields({isAsyncPopup:this.config.system.asyncPopups},this.correlationId),this.config.system.asyncPopups)return this.logger.verbose("asyncPopups set to true, acquiring token"),this.acquireTokenPopupAsync(e,r,t);{let i=S(y({},e),{httpMethod:ks(e,this.config.auth.protocolMode)});return this.logger.verbose("asyncPopup set to false, opening popup before acquiring token"),r.popup=this.openSizedPopup("about:blank",r),this.acquireTokenPopupAsync(i,r,t)}}catch(o){return Promise.reject(o)}}logout(e){try{this.logger.verbose("logoutPopup called");let t=this.initializeLogoutRequest(e),r={popupName:this.generateLogoutPopupName(t),popupWindowAttributes:e?.popupWindowAttributes||{},popupWindowParent:e?.popupWindowParent??window},o=e&&e.authority,i=e&&e.mainWindowRedirectUri;return this.config.system.asyncPopups?(this.logger.verbose("asyncPopups set to true"),this.logoutPopupAsync(t,r,o,i)):(this.logger.verbose("asyncPopup set to false, opening popup"),r.popup=this.openSizedPopup("about:blank",r),this.logoutPopupAsync(t,r,o,i))}catch(t){return Promise.reject(t)}}acquireTokenPopupAsync(e,t,r){return d(this,null,function*(){this.logger.verbose("acquireTokenPopupAsync called");let o=yield u(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,I.Popup);t.popup&&Ai(o.authority);let i=_t(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme);return o.platformBroker=i,this.config.auth.protocolMode===H.EAR?this.executeEarFlow(o,t,r):this.executeCodeFlow(o,t,r)})}executeCodeFlow(e,t,r){return d(this,null,function*(){let o=e.correlationId,i=this.initializeServerTelemetryManager(b.acquireTokenPopup),s=r||(yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,o)(this.performanceClient,this.logger,o)),a=S(y({},e),{codeChallenge:s.challenge});try{let l=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,o)({serverTelemetryManager:i,requestAuthority:a.authority,requestAzureCloudOptions:a.azureCloudOptions,requestExtraQueryParameters:a.extraQueryParameters,account:a.account});if(a.httpMethod===Re.POST)return yield this.executeCodeFlowWithPost(a,t,l,s.verifier);{let h=yield u(Yr,c.GetAuthCodeUrl,this.logger,this.performanceClient,o)(this.config,l.authority,a,this.logger,this.performanceClient),m=this.initiateAuthRequest(h,t);this.eventHandler.emitEvent(E.POPUP_OPENED,I.Popup,{popupWindow:m},null);let p=yield this.monitorPopupForHash(m,t.popupWindowParent),C=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(p,this.config.auth.OIDCOptions.serverResponseType,this.logger);return yield u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,o)(e,C,s.verifier,b.acquireTokenPopup,this.config,l,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}}catch(l){throw t.popup?.close(),l instanceof v&&(l.setCorrelationId(this.correlationId),i.cacheFailedRequest(l)),l}})}executeEarFlow(e,t,r){return d(this,null,function*(){let o=e.correlationId,i=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,o)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),s=yield u(qo,c.GenerateEarKey,this.logger,this.performanceClient,o)(),a=r||(yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,o)(this.performanceClient,this.logger,o)),l=S(y({},e),{earJwk:s,codeChallenge:a.challenge}),h=t.popup||this.openPopup("about:blank",t);(yield en(h.document,this.config,i,l,this.logger,this.performanceClient)).submit();let p=yield u(this.monitorPopupForHash.bind(this),c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,o)(h,t.popupWindowParent),C=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(p,this.config.auth.OIDCOptions.serverResponseType,this.logger);if(!C.ear_jwe&&C.code){let T=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,o)({serverTelemetryManager:this.initializeServerTelemetryManager(b.acquireTokenPopup),requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account,authority:i});return u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,o)(l,C,a.verifier,b.acquireTokenPopup,this.config,T,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}else return u(rn,c.HandleResponseEar,this.logger,this.performanceClient,o)(l,C,b.acquireTokenPopup,this.config,i,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)})}executeCodeFlowWithPost(e,t,r,o){return d(this,null,function*(){let i=e.correlationId,s=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,i)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),a=t.popup||this.openPopup("about:blank",t);(yield tn(a.document,this.config,s,e,this.logger,this.performanceClient)).submit();let h=yield u(this.monitorPopupForHash.bind(this),c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,i)(a,t.popupWindowParent),m=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(h,this.config.auth.OIDCOptions.serverResponseType,this.logger);return u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,i)(e,m,o,b.acquireTokenPopup,this.config,r,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)})}logoutPopupAsync(e,t,r,o){return d(this,null,function*(){this.logger.verbose("logoutPopupAsync called"),this.eventHandler.emitEvent(E.LOGOUT_START,I.Popup,e);let i=this.initializeServerTelemetryManager(b.logoutPopup);try{yield this.clearCacheOnLogout(this.correlationId,e.account);let s=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:i,requestAuthority:r,account:e.account||void 0});try{s.authority.endSessionEndpoint}catch{if(e.account?.homeAccountId&&e.postLogoutRedirectUri&&s.authority.protocolMode===H.OIDC){if(this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,I.Popup,e),o){let h={apiId:b.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},m=_.getAbsoluteUrl(o,fe());yield this.navigationClient.navigateInternal(m,h)}t.popup?.close();return}}let a=s.getLogoutUri(e);this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,I.Popup,e);let l=this.openPopup(a,t);
7if(this.eventHandler.emitEvent(E.POPUP_OPENED,I.Popup,{popupWindow:l},null),yield this.monitorPopupForHash(l,t.popupWindowParent).catch(()=>{}),o){let h={apiId:b.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},m=_.getAbsoluteUrl(o,fe());this.logger.verbose("Redirecting main window to url specified in the request"),this.logger.verbosePii(`Redirecting main window to: ${m}`),yield this.navigationClient.navigateInternal(m,h)}else this.logger.verbose("No main window navigation requested")}catch(s){throw t.popup?.close(),s instanceof v&&(s.setCorrelationId(this.correlationId),i.cacheFailedRequest(s)),this.eventHandler.emitEvent(E.LOGOUT_FAILURE,I.Popup,null,s),this.eventHandler.emitEvent(E.LOGOUT_END,I.Popup),s}this.eventHandler.emitEvent(E.LOGOUT_END,I.Popup)})}initiateAuthRequest(e,t){if(e)return this.logger.infoPii(`Navigate to: ${e}`),this.openPopup(e,t);throw this.logger.error("Navigate url is empty"),A(Je)}monitorPopupForHash(e,t){return new Promise((r,o)=>{this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");let i=setInterval(()=>{if(e.closed){this.logger.error("PopupHandler.monitorPopupForHash - window closed"),clearInterval(i),o(A(Be));return}let s="";try{s=e.location.href}catch{}if(!s||s==="about:blank")return;clearInterval(i);let a="",l=this.config.auth.OIDCOptions.serverResponseType;e&&(l===Ge.QUERY?a=e.location.search:a=e.location.hash),this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller"),r(a)},this.config.system.pollIntervalMilliseconds)}).finally(()=>{this.cleanPopup(e,t)})}openPopup(e,t){try{let r;if(t.popup?(r=t.popup,this.logger.verbosePii(`Navigating popup window to: ${e}`),r.location.assign(e)):typeof t.popup>"u"&&(this.logger.verbosePii(`Opening popup window to: ${e}`),r=this.openSizedPopup(e,t)),!r)throw A(To);return r.focus&&r.focus(),this.currentWindow=r,t.popupWindowParent.addEventListener("beforeunload",this.unloadWindow),r}catch(r){throw this.logger.error("error opening popup "+r.message),A(Ao)}}openSizedPopup(e,{popupName:t,popupWindowAttributes:r,popupWindowParent:o}){let i=o.screenLeft?o.screenLeft:o.screenX,s=o.screenTop?o.screenTop:o.screenY,a=o.innerWidth||document.documentElement.clientWidth||document.body.clientWidth,l=o.innerHeight||document.documentElement.clientHeight||document.body.clientHeight,h=r.popupSize?.width,m=r.popupSize?.height,p=r.popupPosition?.top,C=r.popupPosition?.left;return(!h||h<0||h>a)&&(this.logger.verbose("Default popup window width used. Window width not configured or invalid."),h=V.POPUP_WIDTH),(!m||m<0||m>l)&&(this.logger.verbose("Default popup window height used. Window height not configured or invalid."),m=V.POPUP_HEIGHT),(!p||p<0||p>l)&&(this.logger.verbose("Default popup window top position used. Window top not configured or invalid."),p=Math.max(0,l/2-V.POPUP_HEIGHT/2+s)),(!C||C<0||C>a)&&(this.logger.verbose("Default popup window left position used. Window left not configured or invalid."),C=Math.max(0,a/2-V.POPUP_WIDTH/2+i)),o.open(e,t,`width=${h}, height=${m}, top=${p}, left=${C}, scrollbars=yes`)}unloadWindow(e){this.currentWindow&&this.currentWindow.close(),e.preventDefault()}cleanPopup(e,t){e.close(),t.removeEventListener("beforeunload",this.unloadWindow)}generatePopupName(e,t){return`${V.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${e.join("-")}.${t}.${this.correlationId}`}generateLogoutPopupName(e){let t=e.account&&e.account.homeAccountId;return`${V.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${t}.${this.correlationId}`}};function Zh(){if(typeof window>"u"||typeof window.performance>"u"||typeof window.performance.getEntriesByType!="function")return;let n=window.performance.getEntriesByType("navigation");return(n.length?n[0]:void 0)?.type}var Os=class extends Ee{constructor(e,t,r,o,i,s,a,l,h,m){super(e,t,r,o,i,s,a,h,m),this.nativeStorage=l}acquireToken(e){return d(this,null,function*(){let t=yield u(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,I.Redirect);t.platformBroker=_t(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme);let r=i=>{i.persisted&&(this.logger.verbose("Page was restored from back/forward cache. Clearing temporary cache."),this.browserStorage.resetRequestCache(),this.eventHandler.emitEvent(E.RESTORE_FROM_BFCACHE,I.Redirect))},o=this.getRedirectStartPage(e.redirectStartPage);this.logger.verbosePii(`Redirect start page: ${o}`),this.browserStorage.setTemporaryCache(j.ORIGIN_URI,o,!0),window.addEventListener("pageshow",r);try{this.config.auth.protocolMode===H.EAR?yield this.executeEarFlow(t):yield this.executeCodeFlow(t,e.onRedirectNavigate)}catch(i){throw i instanceof v&&i.setCorrelationId(this.correlationId),window.removeEventListener("pageshow",r),i}})}executeCodeFlow(e,t){return d(this,null,function*(){let r=e.correlationId,o=this.initializeServerTelemetryManager(b.acquireTokenRedirect),i=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,r)(this.performanceClient,this.logger,r),s=S(y({},e),{codeChallenge:i.challenge});this.browserStorage.cacheAuthorizeRequest(s,i.verifier);try{if(s.httpMethod===Re.POST)return yield this.executeCodeFlowWithPost(s);{let a=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:o,requestAuthority:s.authority,requestAzureCloudOptions:s.azureCloudOptions,requestExtraQueryParameters:s.extraQueryParameters,account:s.account}),l=yield u(Yr,c.GetAuthCodeUrl,this.logger,this.performanceClient,e.correlationId)(this.config,a.authority,s,this.logger,this.performanceClient);return yield this.initiateAuthRequest(l,t)}}catch(a){throw a instanceof v&&(a.setCorrelationId(this.correlationId),o.cacheFailedRequest(a)),a}})}executeEarFlow(e){return d(this,null,function*(){let t=e.correlationId,r=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),o=yield u(qo,c.GenerateEarKey,this.logger,this.performanceClient,t)(),i=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,t)(this.performanceClient,this.logger,t),s=S(y({},e),{earJwk:o,codeChallenge:i.challenge});return this.browserStorage.cacheAuthorizeRequest(s,i.verifier),(yield en(document,this.config,r,s,this.logger,this.performanceClient)).submit(),new Promise((l,h)=>{setTimeout(()=>{h(A(jr,"failed_to_redirect"))},this.config.system.redirectNavigationTimeout)})})}executeCodeFlowWithPost(e){return d(this,null,function*(){let t=e.correlationId,r=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account});return this.browserStorage.cacheAuthorizeRequest(e),(yield tn(document,this.config,r,e,this.logger,this.performanceClient)).submit(),new Promise((i,s)=>{setTimeout(()=>{s(A(jr,"failed_to_redirect"))},this.config.system.redirectNavigationTimeout)})})}handleRedirectPromise(e="",t,r,o){return d(this,null,function*(){let i=this.initializeServerTelemetryManager(b.handleRedirectPromise);try{let[s,a]=this.getRedirectResponse(e||"");if(!s)return this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."),this.browserStorage.resetRequestCache(),Zh()!=="back_forward"?o.event.errorCode="no_server_response":this.logger.verbose("Back navigation event detected. Muting no_server_response error"),null;let l=this.browserStorage.getTemporaryCache(j.ORIGIN_URI,!0)||g.EMPTY_STRING,h=We.normalizeUrlForComparison(l),m=We.normalizeUrlForComparison(window.location.href);if(h===m&&this.config.auth.navigateToLoginRequestUrl)return this.logger.verbose("Current page is loginRequestUrl, handling response"),l.indexOf("#")>-1&&Sc(l),yield this.handleResponse(s,t,r,i);if(this.config.auth.navigateToLoginRequestUrl){if(!Ci()||this.config.system.allowRedirectInIframe){this.browserStorage.setTemporaryCache(j.URL_HASH,a,!0);let p={apiId:b.handleRedirectPromise,timeout:this.config.system.redirectNavigationTimeout,noHistory:!0},C=!0;if(!l||l==="null"){let T=vc();this.browserStorage.setTemporaryCache(j.ORIGIN_URI,T,!0),this.logger.warning("Unable to get valid login request url from cache, redirecting to home page"),C=yield this.navigationClient.navigateInternal(T,p)}else this.logger.verbose(`Navigating to loginRequestUrl: ${l}`),C=yield this.navigationClient.navigateInternal(l,p);if(!C)return yield this.handleResponse(s,t,r,i)}}else return this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response"),yield this.handleResponse(s,t,r,i);return null}catch(s){throw s instanceof v&&(s.setCorrelationId(this.correlationId),i.cacheFailedRequest(s)),s}})}getRedirectResponse(e){this.logger.verbose("getRedirectResponseHash called");let t=e;t||(this.config.auth.OIDCOptions.serverResponseType===Ge.QUERY?t=window.location.search:t=window.location.hash);let r=We.getDeserializedResponse(t);if(r){try{ld(r,this.browserCrypto,I.Redirect)}catch(i){return i instanceof v&&this.logger.error(`Interaction type validation failed due to ${i.errorCode}: ${i.errorMessage}`),[null,""]}return fi(window),this.logger.verbose("Hash contains known properties, returning response hash"),[r,t]}let o=this.browserStorage.getTemporaryCache(j.URL_HASH,!0);return this.browserStorage.removeItem(this.browserStorage.generateCacheKey(j.URL_HASH)),o&&(r=We.getDeserializedResponse(o),r)?(this.logger.verbose("Hash does not contain known properties, returning c
7ached hash"),[r,o]):[null,""]}handleResponse(e,t,r,o){return d(this,null,function*(){if(!e.state)throw A($t);if(e.ear_jwe){let a=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t.correlationId)({requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account});return u(rn,c.HandleResponseEar,this.logger,this.performanceClient,t.correlationId)(t,e,b.acquireTokenRedirect,this.config,a,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}let s=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:o,requestAuthority:t.authority});return u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,t.correlationId)(t,e,r,b.acquireTokenRedirect,this.config,s,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)})}initiateAuthRequest(e,t){return d(this,null,function*(){if(this.logger.verbose("RedirectHandler.initiateAuthRequest called"),e){this.logger.infoPii(`RedirectHandler.initiateAuthRequest: Navigate to: ${e}`);let r={apiId:b.acquireTokenRedirect,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},o=t||this.config.auth.onRedirectNavigate;if(typeof o=="function")if(this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback"),o(e)!==!1){this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating"),yield this.navigationClient.navigateExternal(e,r);return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url"),yield this.navigationClient.navigateExternal(e,r);return}}else throw this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty"),A(Je)})}logout(e){return d(this,null,function*(){this.logger.verbose("logoutRedirect called");let t=this.initializeLogoutRequest(e),r=this.initializeServerTelemetryManager(b.logout);try{this.eventHandler.emitEvent(E.LOGOUT_START,I.Redirect,e),yield this.clearCacheOnLogout(this.correlationId,t.account);let o={apiId:b.logout,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},i=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:r,requestAuthority:e&&e.authority,requestExtraQueryParameters:e?.extraQueryParameters,account:e&&e.account||void 0});if(i.authority.protocolMode===H.OIDC)try{i.authority.endSessionEndpoint}catch{if(t.account?.homeAccountId){this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,I.Redirect,t);return}}let s=i.getLogoutUri(t);if(this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,I.Redirect,t),e&&typeof e.onRedirectNavigate=="function")if(e.onRedirectNavigate(s)!==!1){this.logger.verbose("Logout onRedirectNavigate did not return false, navigating"),this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0,Ke.SIGNOUT),yield this.navigationClient.navigateExternal(s,o);return}else this.browserStorage.setInteractionInProgress(!1),this.logger.verbose("Logout onRedirectNavigate returned false, stopping navigation");else{this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0,Ke.SIGNOUT),yield this.navigationClient.navigateExternal(s,o);return}}catch(o){throw o instanceof v&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),this.eventHandler.emitEvent(E.LOGOUT_FAILURE,I.Redirect,null,o),this.eventHandler.emitEvent(E.LOGOUT_END,I.Redirect),o}this.eventHandler.emitEvent(E.LOGOUT_END,I.Redirect)})}getRedirectStartPage(e){let t=e||window.location.href;return _.getAbsoluteUrl(t,fe())}};function Nc(n,e,t,r,o){return d(this,null,function*(){if(e.addQueueMeasurement(c.SilentHandlerInitiateAuthRequest,r),!n)throw t.info("Navigate url is empty"),A(Je);return o?u(eu,c.SilentHandlerLoadFrame,t,e,r)(n,o,e,r):G(tu,c.SilentHandlerLoadFrameSync,t,e,r)(n)})}function Id(n,e,t,r,o){return d(this,null,function*(){let i=Ms();if(!i.contentDocument)throw"No document associated with iframe!";return(yield tn(i.contentDocument,n,e,t,r,o)).submit(),i})}function Sd(n,e,t,r,o){return d(this,null,function*(){let i=Ms();if(!i.contentDocument)throw"No document associated with iframe!";return(yield en(i.contentDocument,n,e,t,r,o)).submit(),i})}function Ns(n,e,t,r,o,i,s){return d(this,null,function*(){r.addQueueMeasurement(c.SilentHandlerMonitorIframeForHash,i),r.addFields({iframePollIntervalMs:t,iframeTimeoutMs:e},i);let a=0,l=0;return new Promise((h,m)=>{e<Cs&&o.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${e}ms) than the default (${Cs}ms). This may result in timeouts.`);let p=window.setTimeout(()=>{window.clearInterval(C),m(A(Eo))},e),C=window.setInterval(()=>{a++;let T="",P=n.contentWindow;try{T=P?P.location.href:""}catch{l++}if(!T||T==="about:blank")return;let O="";P&&(s===Ge.QUERY?O=P.location.search:O=P.location.hash),window.clearTimeout(p),window.clearInterval(C),h(O)}
7,t)}).finally(()=>{r.addFields({iframeTickCount:a,crossOriginTickCount:l},i),G(ru,c.RemoveHiddenIframe,o,r,i)(n)})})}function eu(n,e,t,r){return t.addQueueMeasurement(c.SilentHandlerLoadFrame,r),new Promise((o,i)=>{let s=Ms();window.setTimeout(()=>{if(!s){i("Unable to load iframe");return}s.src=n,o(s)},e)})}function tu(n){let e=Ms();return e.src=n,e}function Ms(){let n=document.createElement("iframe");return n.className="msalSilentIframe",n.style.visibility="hidden",n.style.position="absolute",n.style.width=n.style.height="0",n.style.border="0",n.setAttribute("sandbox","allow-scripts allow-same-origin allow-forms"),n.setAttribute("allow","local-network-access *"),document.body.appendChild(n),n}function ru(n){document.body===n.parentNode&&document.body.removeChild(n)}var Us=class extends Ee{constructor(e,t,r,o,i,s,a,l,h,m,p){super(e,t,r,o,i,s,l,m,p),this.apiId=a,this.nativeStorage=h}acquireToken(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentIframeClientAcquireToken,e.correlationId),!e.loginHint&&!e.sid&&(!e.account||!e.account.username)&&this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");let t=y({},e);t.prompt?t.prompt!==K.NONE&&t.prompt!==K.NO_SESSION&&(this.logger.warning(`SilentIframeClient. Replacing invalid prompt ${t.prompt} with ${K.NONE}`),t.prompt=K.NONE):t.prompt=K.NONE;let r=yield u(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(t,I.Silent);return r.platformBroker=_t(this.config,this.logger,this.platformAuthProvider,r.authenticationScheme),Ai(r.authority),this.config.auth.protocolMode===H.EAR?this.executeEarFlow(r):this.executeCodeFlow(r)})}executeCodeFlow(e){return d(this,null,function*(){let t,r=this.initializeServerTelemetryManager(this.apiId);try{return t=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:r,requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),yield u(this.silentTokenHelper.bind(this),c.SilentIframeClientTokenHelper,this.logger,this.performanceClient,e.correlationId)(t,e)}catch(o){if(o instanceof v&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),!t||!(o instanceof v)||o.errorCode!==V.INVALID_GRANT_ERROR)throw o;return this.performanceClient.addFields({retryError:o.errorCode},this.correlationId),yield u(this.silentTokenHelper.bind(this),c.SilentIframeClientTokenHelper,this.logger,this.performanceClient,this.correlationId)(t,e)}})}executeEarFlow(e){return d(this,null,function*(){let t=e.correlationId,r=yield u(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,t)({requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account}),o=yield u(qo,c.GenerateEarKey,this.logger,this.performanceClient,t)(),i=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,t)(this.performanceClient,this.logger,t),s=S(y({},e),{earJwk:o,codeChallenge:i.challenge}),a=yield u(Sd,c.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,t)(this.config,r,s,this.logger,this.performanceClient),l=this.config.auth.OIDCOptions.serverResponseType,h=yield u(Ns,c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,t)(a,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,t,l),m=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,t)(h,l,this.logger);if(!m.ear_jwe&&m.code){let p=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,t)({serverTelemetryManager:this.initializeServerTelemetryManager(this.apiId),requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account,authority:r});return u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,t)(s,m,i.verifier,this.apiId,this.config,p,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)}else return u(rn,c.HandleResponseEar,this.logger,this.performanceClient,t)(s,m,this.apiId,this.config,r,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)})}verifySso(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentIframeClientAcquireToken,e.correlationId);let t=y({},e);t.prompt||(t.prompt=K.NONE);let r=yield u(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(t,I.Silent),o=yield u(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:this.initializeServerTelemetryManager(this.apiId),requestAuthority:r.authority,requestAzureCloudOptions:r.azureCloudOptions,requestExtraQueryParameters:r.extraQueryParameters,account:r.account}),i=r.correlationId,s=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,i)(this.performanceClient,this.logger,i),a=S(y({},r),{codeChallenge:s.challenge}),l=yield u(Yr,c.GetAuthCodeUrl,this.logger,this.performanceClient,i)(this.config,o.authority,a,this.logger,this.performanceClient),h=yield u(Nc,c.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,i)(l,this.performanceClient,this.logger,i,this.config.system.navigateFrameWait),m=this.config.auth.OIDCOptions.serverResponseType,p=yield u(Ns,c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,i)(h,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,i,m),C=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,i)(p,m,this.logger);return _e.validateAuthorizationResponse(C,r.state),C.code?(this.logger.verbose("SSO verification completed successfully with valid authorization code - skipped token exchange",i
7),!0):(this.logger.warning("SSO verification response did not contain an authorization code",i),!1)})}logout(){return Promise.reject(A(Xe))}silentTokenHelper(e,t){return d(this,null,function*(){let r=t.correlationId;this.performanceClient.addQueueMeasurement(c.SilentIframeClientTokenHelper,r);let o=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,r)(this.performanceClient,this.logger,r),i=S(y({},t),{codeChallenge:o.challenge}),s;if(t.httpMethod===Re.POST)s=yield u(Id,c.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,r)(this.config,e.authority,i,this.logger,this.performanceClient);else{let m=yield u(Yr,c.GetAuthCodeUrl,this.logger,this.performanceClient,r)(this.config,e.authority,i,this.logger,this.performanceClient);s=yield u(Nc,c.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,r)(m,this.performanceClient,this.logger,r,this.config.system.navigateFrameWait)}let a=this.config.auth.OIDCOptions.serverResponseType,l=yield u(Ns,c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,r)(s,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,r,a),h=G(Jt,c.DeserializeResponse,this.logger,this.performanceClient,r)(l,a,this.logger);return u(Rt,c.HandleResponseCode,this.logger,this.performanceClient,r)(t,h,o.verifier,this.apiId,this.config,e,this.browserStorage,this.nativeStorage,this.eventHandler,this.logger,this.performanceClient,this.platformAuthProvider)})}};var Ds=class extends Ee{acquireToken(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentRefreshClientAcquireToken,e.correlationId);let t=yield u(Ei,c.InitializeBaseRequest,this.logger,this.performanceClient,e.correlationId)(e,this.config,this.performanceClient,this.logger),r=y(y({},e),t);e.redirectUri&&(r.redirectUri=this.getRedirectUri(e.redirectUri));let o=this.initializeServerTelemetryManager(b.acquireTokenSilent_silentFlow),i=yield this.createRefreshTokenClient({serverTelemetryManager:o,authorityUrl:r.authority,azureCloudOptions:r.azureCloudOptions,account:r.account});return u(i.acquireTokenByRefreshToken.bind(i),c.RefreshTokenClientAcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(r,b.acquireTokenSilent_silentFlow).catch(s=>{throw s.setCorrelationId(this.correlationId),o.cacheFailedRequest(s),s})})}logout(){return Promise.reject(A(Xe))}createRefreshTokenClient(e){return d(this,null,function*(){let t=yield u(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:e.serverTelemetryManager,requestAuthority:e.authorityUrl,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account});return new di(t,this.performanceClient)})}};var Ls=class{constructor(e,t,r,o,i){this.isBrowserEnvironment=typeof window<"u",this.config=e,this.storage=t,this.logger=r,this.cryptoObj=o,this.performanceClient=i}loadExternalTokens(e,t,r){return d(this,null,function*(){if(!this.isBrowserEnvironment)throw A(Ze);let o=e.correlationId||se(),i=this.performanceClient.startMeasurement(c.LoadExternalTokens,o);try{let s=t.id_token?Y.extractTokenClaims(t.id_token,Z):void 0,a=Y.isKmsi(s||{}),l={protocolMode:this.config.auth.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},h=e.authority||this.config.auth.authority,m=yield lo.createDiscoveredInstance(xe.generateAuthority(h,e.azureCloudOptions),this.config.system.networkClient,this.storage,l,this.logger,o,this.performanceClient),p=yield u(this.loadAccount.bind(this),c.LoadAccount,this.logger,this.performanceClient,o)(e,r.clientInfo||t.client_info||"",o,m,s),C=yield u(this.loadIdToken.bind(this),c.LoadIdToken,this.logger,this.performanceClient,o)(t,p.homeAccountId,p.environment,p.realm,o,a),T=yield u(this.loadAccessToken.bind(this),c.LoadAccessToken,this.logger,this.performanceClient,o)(e,t,p.homeAccountId,p.environment,p.realm,r,o,a),P=yield u(this.loadRefreshToken.bind(this),c.LoadRefreshToken,this.logger,this.performanceClient,o)(t,p.homeAccountId,p.environment,o,a);return i.end({success:!0},void 0,D.getAccountInfo(p)),this.generateAuthenticationResult(e,{account:p,idToken:C,accessToken:T,refreshToken:P},m,s)}catch(s){throw i.end({success:!1},s),s}})}loadAccount(e,t,r,o,i){return d(this,null,function*(){if(this.logger.verbose("TokenCache - loading account"),e.account){let h=D.createFromAccountInfo(e.account);return yield this.storage.setAccount(h,r,Y.isKmsi(i||{}),b.loadExternalTokens),h}else if(!t&&!i)throw this.logger.error("TokenCache - if an account is not provided on the request, clientInfo or idToken must be provided instead."),A(Po);let s=D.generateHomeAccountId(t,o.authorityType,this.logger,this.cryptoObj,i),a=i?.tid,l=mo(this.storage,o,s,Z,r,i,t,o.getPreferredCache(),a,void 0,void 0,this.logger);return yield this.storage.setAccount(l,r,Y.isKmsi(i||{}),b.loadExternalTokens),l})}loadIdToken(e,t,r,o,i,s){return d(this,null,function*(){if(!e.id_token)return this.logger.verbose("TokenCache - no id token found in response"),null;this.logger.verbose("TokenCache - loading id token");let a=$.createIdTokenEntity(t,r,e.id_token,this.config.auth.clientId,o);return yield this.storage.setIdTokenCredential(a,i,s),a})}loadAccessToken(e,t,r,o,i,s,a,l){return d(this,null,function*(){if(t.access_token)if(t.expires_in){if(!t.scope&&(!e.scopes||!e.scopes.length))return this.logger.error("TokenCache - scopes not specified in the request or response. Cannot add token to the cache."),null}else return this.logger.error("TokenCache - no expiration set on the access token. Cannot add it to the cache."),null;else return this.logger.verbose("TokenCache - no access token found in response"),null;this.logger.verbose("TokenCache - loading access token");let h=t.scope?z.fromString(t.scope):new z(e.scopes),m=s.expiresOn||t.expires_in+J.n
7owSeconds(),p=s.extendedExpiresOn||(t.ext_expires_in||t.expires_in)+J.nowSeconds(),C=$.createAccessTokenEntity(r,o,t.access_token,this.config.auth.clientId,i,h.printScopes(),m,p,Z);return yield this.storage.setAccessTokenCredential(C,a,l),C})}loadRefreshToken(e,t,r,o,i){return d(this,null,function*(){if(!e.refresh_token)return this.logger.verbose("TokenCache - no refresh token found in response"),null;let s=e.refresh_token_expires_in?e.refresh_token_expires_in+J.nowSeconds():void 0;this.performanceClient.addFields({extRtExpiresOnSeconds:s},o),this.logger.verbose("TokenCache - loading refresh token");let a=$.createRefreshTokenEntity(t,r,e.refresh_token,this.config.auth.clientId,e.foci,void 0,s);return yield this.storage.setRefreshTokenCredential(a,o,i),a})}generateAuthenticationResult(e,t,r,o){let i="",s=[],a=null,l;t?.accessToken&&(i=t.accessToken.secret,s=z.fromString(t.accessToken.target).asArray(),a=J.toDateFromSeconds(t.accessToken.expiresOn),l=J.toDateFromSeconds(t.accessToken.extendedExpiresOn));let h=t.account;return{authority:r?r.canonicalAuthority:"",uniqueId:t.account.localAccountId,tenantId:t.account.realm,scopes:s,account:D.getAccountInfo(h),idToken:t.idToken?.secret||"",idTokenClaims:o||{},accessToken:i,fromCache:!0,expiresOn:a,correlationId:e.correlationId||"",requestId:"",extExpiresOn:l,familyId:t.refreshToken?.familyId||"",tokenType:t?.accessToken?.tokenType||"",state:e.state||"",cloudGraphHostName:h.cloudGraphHostName||"",msGraphHost:h.msGraphHost||"",fromNativeBroker:!1}}};var xs=class extends Gr{constructor(e){super(e),this.includeRedirectUri=!1}};var Hs=class extends Ee{constructor(e,t,r,o,i,s,a,l,h,m){super(e,t,r,o,i,s,l,h,m),this.apiId=a}acquireToken(e){return d(this,null,function*(){if(!e.code)throw A(Oo);let t=yield u(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(e,I.Silent),r=this.initializeServerTelemetryManager(this.apiId);try{let o=S(y({},t),{code:e.code}),i=yield u(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:r,requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account}),s=new xs(i);this.logger.verbose("Auth code client created");let a=new Xo(s,this.browserStorage,o,this.logger,this.performanceClient);return yield u(a.handleCodeResponseFromServer.bind(a),c.HandleCodeResponseFromServer,this.logger,this.performanceClient,e.correlationId)({code:e.code,msgraph_host:e.msGraphHost,cloud_graph_host_name:e.cloudGraphHostName,cloud_instance_host_name:e.cloudInstanceHostName},t,this.apiId,!1)}catch(o){throw o instanceof v&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),o}})}logout(){return Promise.reject(A(Xe))}};function vd(n,e,t){let r=window.msal?.clientIds||[],o=r.length,i=r.filter(s=>s===n).length;i>1&&t.warning("There is already an instance of MSAL.js in the window with the same client id."),e.add({msalInstanceCount:o,sameClientIdInstanceCount:i})}function Fs(n,e,t){try{yi(n)}catch(r){throw e.end({success:!1},r,t),r}}var on=class n{constructor(e){this.operatingContext=e,this.isBrowserEnvironment=this.operatingContext.isBrowserEnvironment(),this.config=e.getConfig(),this.initialized=!1,this.logger=this.operatingContext.getLogger(),this.networkClient=this.config.system.networkClient,this.navigationClient=this.config.system.navigationClient,this.redirectResponse=new Map,this.hybridAuthCodeResponses=new Map,this.performanceClient=this.config.telemetry.client,this.browserCrypto=this.isBrowserEnvironment?new jo(this.logger,this.performanceClient):Lt,this.eventHandler=new ws(this.logger),this.browserStorage=this.isBrowserEnvironment?new Yo(this.config.auth.clientId,this.config.cache,this.browserCrypto,this.logger,this.performanceClient,this.eventHandler,rc(this.config.auth)):Zl(this.config.auth.clientId,this.logger,this.performanceClient,this.eventHandler);let t={cacheLocation:B.MemoryStorage,cacheRetentionDays:5,temporaryCacheLocation:B.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};this.nativeInternalStorage=new Yo(this.config.auth.clientId,t,this.browserCrypto,this.logger,this.performanceClient,this.eventHandler),this.tokenCache=new Ls(this.config,this.browserStorage,this.logger,this.browserCrypto,this.performanceClient),this.activeSilentTokenRequests=new Map,this.trackStateChangeWithMeasurement=this.trackStateChangeWithMeasurement.bind(this)}static createController(e,t){return d(this,null,function*(){let r=new n(e);return yield r.initialize(t),r})}trackStateChange(e,t){e&&(t.type==="visibilitychange"?(this.logger.info("Perf: Visibility change detected"),this.performanceClient.incrementFields({visibilityChangeCount:1},e)):t.type==="online"?(this.logger.info("Perf: Online status change detected"),this.performanceClient.incrementFields({onlineStatusChangeCount:1},e)):t.type==="offline"&&(this.logger.info("Perf: Offline status change detected"),this.performanceClient.incrementFields({onlineStatusChangeCount:1},e)))}initialize(e,t){return d(this,null,function*(){if(this.logger.trace("initialize called"),this.initialized){this.logger.info("initialize has already been called, exiting early.");return}if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, exiting early."),this.initialized=!0,this.eventHandler.emitEvent(E.INITIALIZE_END);return}let r=e?.correlationId||this.getRequestCorrelationId(),o=this.config.system.allowPlatformBroker,i=this.performanceClient.startMeasurement(c.InitializeClientApplication,r);if(this.eventHandler.emitEvent(E.INITIALIZE_START),!t)try{this.logMultipleInstances(i)}catch{}if(yield u(this.browserStorage.initialize.bind(this.browserStorage),c.InitializeCache,this.logger,this.performanceClient,r)(r),o)try{this.platformAuthProvider=yield Ed(this.logger,this.performanceClient,r,this.config.system.nativeBrokerHandshakeTimeout,this.config.system.allowPlatformBrokerWithDOM)}catch(s){this.logger.verbose(s)}this.config.cache.claimsBasedCachingEnabled||(this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims"),G(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage),c.ClearTokensAndKeysWithClaims,this.logger,this.performanceClient,r)(r)),this.config.system.asyncPopups&&(yield this.preGeneratePkceCodes(r)),this.initialized=!0,this.eventHandler.emitEvent(E.INITIALIZE_END),i.end({allowPlatformBroker:o,success:!0})})}handleRedirectPromise(e){return d(this,null,function*(){if(this.logger.verbose("handleRedirectPromise called"),ms(this.initialized),this.isBrowserEnvironment){let t=e||"",r=this.redirectResponse.get(t);return typeof r>"u"?(r=this.handleRedirectPromiseInternal(e),this.redirectResponse.set(t,r),this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise")):this.logger.verbose("handleRedirectPromise has been called previously, returning the result from the first call"),r}return this.logger.verbose("handleRedirectPromise returns null, not browser environment"),null})}handleRedirectPromiseInternal(e){return d(this,null,function*(){if(!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;if(this.browserStorage.getInteractionInProgress()?.type===Ke.SIGNOUT)return this.logger.verbose("handleRedirectPromise remov
7ing interaction_in_progress flag and returning null after sign-out"),this.browserStorage.setInteractionInProgress(!1),Promise.resolve(null);let r=this.getAllAccounts(),o=this.browserStorage.getCachedNativeRequest(),i=o&&this.platformAuthProvider&&!e,s;this.eventHandler.emitEvent(E.HANDLE_REDIRECT_START,I.Redirect);let a;try{if(i&&this.platformAuthProvider){s=this.performanceClient.startMeasurement(c.AcquireTokenRedirect,o?.correlationId||""),this.logger.trace("handleRedirectPromise - acquiring token from native platform"),s.add({isPlatformBrokerRequest:!0});let l=new Zt(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,b.handleRedirectPromise,this.performanceClient,this.platformAuthProvider,o.accountId,this.nativeInternalStorage,o.correlationId);a=u(l.handleRedirectPromise.bind(l),c.HandleNativeRedirectPromiseMeasurement,this.logger,this.performanceClient,s.event.correlationId)(this.performanceClient,s.event.correlationId)}else{let[l,h]=this.browserStorage.getCachedRequest(),m=l.correlationId;s=this.performanceClient.startMeasurement(c.AcquireTokenRedirect,m),this.logger.trace("handleRedirectPromise - acquiring token from web flow");let p=this.createRedirectClient(m);a=u(p.handleRedirectPromise.bind(p),c.HandleRedirectPromiseMeasurement,this.logger,this.performanceClient,s.event.correlationId)(e,l,h,s)}}catch(l){throw this.browserStorage.resetRequestCache(),l}return a.then(l=>(l?(this.browserStorage.resetRequestCache(),r.length<this.getAllAccounts().length?(this.eventHandler.emitEvent(E.LOGIN_SUCCESS,I.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, login success")):(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,I.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, acquire token success")),s.end({success:!0},void 0,l.account),this.verifySsoCapability(l.account,I.Redirect)):s.event.errorCode?s.end({success:!1},void 0):s.discard(),this.eventHandler.emitEvent(E.HANDLE_REDIRECT_END,I.Redirect),l)).catch(l=>{this.browserStorage.resetRequestCache();let h=l;throw r.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,I.Redirect,null,h):this.eventHandler.emitEvent(E.LOGIN_FAILURE,I.Redirect,null,h),this.eventHandler.emitEvent(E.HANDLE_REDIRECT_END,I.Redirect),s.end({success:!1},h),l})})}acquireTokenRedirect(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e);this.logger.verbose("acquireTokenRedirect called",t);let r=this.performanceClient.startMeasurement(c.AcquireTokenPreRedirect,t);r.add({scenarioId:e.scenarioId});let o=e.onRedirectNavigate;if(o)e.onRedirectNavigate=s=>{let a=typeof o=="function"?o(s):void 0;return r.add({navigateCallbackResult:a!==!1}),r.event=r.end({success:!0},void 0,e.account)||r.event,a};else{let s=this.config.auth.onRedirectNavigate;this.config.auth.onRedirectNavigate=a=>{let l=typeof s=="function"?s(a):void 0;return r.add({navigateCallbackResult:l!==!1}),r.event=r.end({success:!0},void 0,e.account)||r.event,l}}let i=this.getAllAccounts().length>0;try{ps(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0,Ke.SIGNIN),i?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,I.Redirect,e):this.eventHandler.emitEvent(E.LOGIN_START,I.Redirect,e);let s;return this.platformAuthProvider&&this.canUsePlatformBroker(e)?s=new Zt(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,b.acquireTokenRedirect,this.performanceClient,this.platformAuthProvider,this.getNativeAccountId(e),this.nativeInternalStorage,t).acquireTokenRedirect(e,r).catch(l=>{if(r.add({brokerErrorName:l.name,brokerErrorCode:l.errorCode}),l instanceof Pe&&Xt(l))return this.platformAuthProvider=void 0,this.createRedirectClient(t).acquireToken(e);if(l instanceof ne)return this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createRedirectClient(t).acquireToken(e);throw l}):s=this.createRedirectClient(t).acquireToken(e),yield s}catch(s){throw this.browserStorage.resetRequestCache(),r.event.status===2?this.performanceClient.startMeasurement(c.AcquireTokenRedirect,t).end({success:!1},s,e.account):r.end({success:!1},s,e.account),i?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,I.Redirect,null,s):this.eventHandler.emitEvent(E.LOGIN_FAILURE,I.Redirect,null,s),s}})}acquireTokenPopup(e){let t=this.getRequestCorrelationId(e),r=this.performanceClient.startMeasurement(c.AcquireTokenPopup,t);r.add({scenarioId:e.scenarioId});try{this.logger.verbose("acquireTokenPopup called",t),Fs(this.initialized,r,e.account),this.browserStorage.setInteractionInProgress(!0,Ke.SIGNIN)}catch(a){return Promise.reject(a)}let o=this.getAllAccounts();o.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,I.Popup,e):this.eventHandler.emitEvent(E.LOGIN_START,I.Popup,e);let i,s=this.getPreGeneratedPkceCodes(t);return this.canUsePlatformBroker(e)?(r.add({isPlatformBrokerRequest:!0}),i=this.acquireTokenNative(S(y({},e),{correlationId:t}),b.acquireTokenPopup).then(a=>(r.end({success:!0},void 0,a.account),a)).catch(a=>{if(r.add({brokerErrorName:a.name,brokerErrorCode:a.errorCode}),a instanceof Pe&&Xt(a))return this.platformAuthProvider=void 0,this.createPopupClient(t).acquireToken(e,s
7);if(a instanceof ne)return this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createPopupClient(t).acquireToken(e,s);throw a})):i=this.createPopupClient(t).acquireToken(e,s),i.then(a=>(o.length<this.getAllAccounts().length?this.eventHandler.emitEvent(E.LOGIN_SUCCESS,I.Popup,a):this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,I.Popup,a),r.end({success:!0,accessTokenSize:a.accessToken.length,idTokenSize:a.idToken.length},void 0,a.account),this.verifySsoCapability(a.account,I.Popup),a)).catch(a=>(o.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,I.Popup,null,a):this.eventHandler.emitEvent(E.LOGIN_FAILURE,I.Popup,null,a),r.end({success:!1},a,e.account),Promise.reject(a))).finally(()=>d(this,null,function*(){this.browserStorage.setInteractionInProgress(!1),this.config.system.asyncPopups&&(yield this.preGeneratePkceCodes(t))}))}trackStateChangeWithMeasurement(e){let t=this.ssoSilentMeasurement||this.acquireTokenByCodeAsyncMeasurement;t&&(e.type==="visibilitychange"?(this.logger.info("Perf: Visibility change detected in ",t.event.name),t.increment({visibilityChangeCount:1})):e.type==="online"?(this.logger.info("Perf: Online status change detected in ",t.event.name),t.increment({onlineStatusChangeCount:1})):e.type==="offline"&&(this.logger.info("Perf: Offline status change detected in ",t.event.name),t.increment({onlineStatusChangeCount:1})))}addStateChangeListeners(e){document.addEventListener("visibilitychange",e),window.addEventListener("online",e),window.addEventListener("offline",e)}removeStateChangeListeners(e){document.removeEventListener("visibilitychange",e),window.removeEventListener("online",e),window.removeEventListener("offline",e)}verifySsoCapability(e,t){if(!this.config.auth.verifySSO)return;let r=this.browserCrypto.createNewGuid(),o=this.performanceClient.startMeasurement(c.SsoCapable,r);o.add({parentApi:t}),this.logger.verbose(`SSO capability verification initiated after ${t}`,r),setTimeout(()=>{let i={account:e,correlationId:r};this.createSilentIframeClient(r).verifySso(i).then(a=>{this.logger.verbose(`SSO capability verification completed after ${t}, success: ${a}`,r),o.end({fromCache:!1,success:a},void 0,e)}).catch(a=>{this.logger.warning(`SSO capability verification failed after ${t}: ${a.message}`,r),o.end({fromCache:!1,success:!1},a,e)})},0)}ssoSilent(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e),r=S(y({},e),{prompt:e.prompt,correlationId:t});this.ssoSilentMeasurement=this.performanceClient.startMeasurement(c.SsoSilent,t),this.ssoSilentMeasurement?.add({scenarioId:e.scenarioId}),Fs(this.initialized,this.ssoSilentMeasurement,e.account),this.ssoSilentMeasurement?.increment({visibilityChangeCount:0,onlineStatusChangeCount:0}),this.addStateChangeListeners(this.trackStateChangeWithMeasurement),this.logger.verbose("ssoSilent called",t),this.eventHandler.emitEvent(E.SSO_SILENT_START,I.Silent,r);let o;return this.canUsePlatformBroker(r)?(this.ssoSilentMeasurement?.add({isPlatformBrokerRequest:!0}),o=this.acquireTokenNative(r,b.ssoSilent).catch(i=>{if(this.ssoSilentMeasurement?.add({brokerErrorName:i.name,brokerErrorCode:i.errorCode}),i instanceof Pe&&Xt(i))return this.platformAuthProvider=void 0,this.createSilentIframeClient(r.correlationId).acquireToken(r);throw i})):o=this.createSilentIframeClient(r.correlationId).acquireToken(r),o.then(i=>(this.eventHandler.emitEvent(E.SSO_SILENT_SUCCESS,I.Silent,i),this.ssoSilentMeasurement?.end({success:!0,accessTokenSize:i.accessToken.length,idTokenSize:i.idToken.length},void 0,i.account),i)).catch(i=>{throw this.eventHandler.emitEvent(E.SSO_SILENT_FAILURE,I.Silent,null,i),this.ssoSilentMeasurement?.end({success:!1},i,e.account),i}).finally(()=>{this.removeStateChangeListeners(this.trackStateChangeWithMeasurement)})})}acquireTokenByCode(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e);this.logger.trace("acquireTokenByCode called",t);let r=this.performanceClient.startMeasurement(c.AcquireTokenByCode,t);Fs(this.initialized,r),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_START,I.Silent,e),r.add({scenarioId:e.scenarioId});try{if(e.code&&e.nativeAccountId)throw A(Mo);if(e.code){let o=e.code,i=this.hybridAuthCodeResponses.get(o);return i?(this.logger.verbose("Existing acquireTokenByCode request found",t),r.discard()):(this.logger.verbose("Initiating new acquireTokenByCode request",t),i=this.acquireTokenByCodeAsync(S(y({},e),{correlationId:t})).then(s=>(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_SUCCESS,I.Silent,s),this.hybridAuthCodeResponses.delete(o),r.end({success:!0,accessTokenSize:s.accessToken.length,idTokenSize:s.idToken.length},void 0,s.account),s)).catch(s=>{throw this.hybridAuthCodeResponses.delete(o),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_FAILURE,I.Silent,null,s),r.end({success:!1},s),s}),this.hybridAuthCodeResponses.set(o,i)),yield i}else if(e.nativeAccountId)if(this.canUsePlatformBroker(e,e.nativeAccountId)){r.add({isPlatformBrokerRequest:!0});let o=yield this.acquireTokenNative(S(y({},e),{correlationId:t}),b.acquireTokenByCode,e.nativeAccountId).catch(i=>{throw i instanceof Pe&&Xt(i)&&(this.platformAuthProvider=void 0),r.add({brokerErrorName:i.name,brokerErrorCode:i.errorCode}),i});return r.end({success:!0},void 0,o.account),o}else throw A(Uo);else throw A(No)}catch(o){throw this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_FAILURE,I.Silent,null,o),r.end({success:!1},o),o}})}acquireTokenByCodeAsync(e){return d(this,null,function*(){return this.logger.trace("acquireTokenByCodeAsync called",e.correlationId),this.acquireTokenByCodeAsyncMeasurement=this.performanceClient.startMeasurement(c.AcquireTokenByCodeAsync,e.correlationId),this.acquireTokenByCodeAsyncMeasurement?.increment({visibilityChangeCount:0,onlineStatusChangeCount:0}),this.addStateChangeListeners(this.trackStateChangeWithMeasurement),yield this.createSilentAuthCodeClient(e.correlationId).acquireToken(e).then(o=>(this.acquireTokenByCodeAsyncMeasurement?.end({success:!0,fromCache:o.fromCache}),o)).catch(o=>{throw this.acquireTokenByCodeAsyncMeasurement?.end({success:!1},o),o}).finally(()=>{this.removeStateChangeListeners(this.trackStateChangeWithMeasurement)})})}acquireTokenFromCache(e,t){return d(this,null,function*(){switch(this.performanceClient.addQueueMeasurement(c.AcquireTokenFromCache,e.correlationId),t){case ie.Default:case ie.AccessToken:case ie.AccessTokenAndRefreshToken:let r=this.createSilentCacheClient(e.correlationId);return u(r.acquireToken.bind(r),c.SilentCacheClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw f(re.tokenRefreshRequired)}})}acquireTokenByRefreshToken(e,t){return d(this,null,function*(){switch(this.performanceClient.addQueueMeasurement(c.AcquireTokenByRefreshToken,e.correlationId),t){case ie.Default:case ie.AccessTokenAndRefreshToken:case ie.RefreshToken:case ie.RefreshTokenAndNetwork:let r=this.createSilentRefreshClient(e.correlationId);return u(r.acquireToken.bind(r),c.SilentRefreshClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw f(re.tokenRefreshRequired)}})}acquireTokenBySilentIframe(e){return d(this,null,function*(){this.performanceClient.addQueueMeasurement(c.AcquireTokenBySilentIframe,e.correlationId);let t=this.createSilentIframeClient(e.correlationId);return u(t.acquireToken.bind(t),c.SilentIframeClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e)})}logout(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e);return this.logger.warning("logout API is deprecated and will be removed in msal-browser v3.0.0. Use logoutRedirect instead.",t),this.logoutRedirect(y({correlationId:t},e))})}logoutRedirect(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e);return ps(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0,Ke.SIGNOUT),this.createRedirectClient(t).logout(e)})}logoutPopup(e){try{let t=this.getRequestCorrelationId(e);return yi(this.initialized),this.browserStorage.setInteractionInProgress(!0,Ke.SIGNOUT),this.createPopupClient(t).logout(e).finally(()=>{this.browserStorage.setInteractionInProgress(!1)})}catch(t){return Promise.reject(t)}}clearCache(e){return d(this,null,function*(){if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, returning early.");return}let t=this.getRequestCorrelationId(e);return this.createSilentCacheClient(t).logout(e)})}getAllAccounts(e){let t=this.getRequestCorrelationId();return ed(this.logger,this.browserStorage,this.isBrowserEnvironment,t,e)}getAccount(e){let t=this.getRequestCorrelationId();return td(e,this.logger,this.browserStorage,t)}getAccountByUsername(e){let t=this.getRequestCorrelationId();return rd(e,this.logger,this.browserStorage,t)}getAccountByHomeId(e){let t=this.getRequestCorrelationId();return od(e,this.logger,this.browserStorage,t)}getAccountByLocalId(e){let t=this.getRequestCorrelationId();return nd(e,this.logger,this.browserStorage,t)}setActiveAccount(e){let t=this.getRequestCorrelationId();id(e,this.browserStorage,t)}getActiveAccount(){let e=this.getRequestCorrelationId();return sd(this.browserStorage,e)}hydrateCache(e,t){return d(this,null,function*(){this.logger.verbose("hydrateCache called");let r=D.createFromAccountInfo(e.account,e.cloudGraphHostName,e.msGraphHost);return yield this.browserStorage.setAccount(r,e.correlationId,Y.isKmsi(e.idTokenClaims),b.hydrateCache),e.fromNativeBroker?(this.logger.verbose("Response was from native broker, storing in-memory"),this.nativeInternalStorage.hydrateCache(e,t)):this.browserStorage.hydrateCache(e,t)})}acquireTokenNative(e,t,r,o){return d(this,null,function*(){if(this.logger.trace("acquireTokenNative called"),!this.platformAuthProvider)throw A(Wt);return new Zt(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,t,this.performanceClient,this.platformAuthProvider,r||this.getNativeAccountId(e),this.nativeInternalStorage,e.correlationId).acquireToken(e,o)})}canUsePlatformBroker(e,t){if(this.logger.trace("canUsePlatformBroker called"),!this.platformAuthProvider)return this.logger.trace("canUsePlatformBroker: platform broker unavilable, returning false"),!1;if(!_t(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme))return this.logger.trace("canUsePlatformBroker: isBrokerAvailable returned false, returning false"),!1;if(e.prompt)switch(e.prompt){case K.NONE:case K.CONSENT:case K.LOGIN:case K.SELECT_ACCOUNT:this.logger.trace("canUsePlatformBroker: prompt is compatible with platform broker flow");break;default:return this.logger.trace(`canUsePlatformBroker: prompt = ${e.prompt} is not compatible with platform broker flow, returning false`),!1}return!t&&!this.getNativeAccountId(e)?(this.logger.trace("canUsePlatformBroker: nativeAccountId is not available, returning false"),!1):!0}
7getNativeAccountId(e){let t=e.account||this.getAccount({loginHint:e.loginHint,sid:e.sid})||this.getActiveAccount();return t&&t.nativeAccountId||""}createPopupClient(e){return new Ps(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createRedirectClient(e){return new Os(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createSilentIframeClient(e){return new Us(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,b.ssoSilent,this.performanceClient,this.nativeInternalStorage,this.platformAuthProvider,e)}createSilentCacheClient(e){return new Zo(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.platformAuthProvider,e)}createSilentRefreshClient(e){return new Ds(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.platformAuthProvider,e)}createSilentAuthCodeClient(e){return new Hs(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,b.acquireTokenByCode,this.performanceClient,this.platformAuthProvider,e)}addEventCallback(e,t){return this.eventHandler.addEventCallback(e,t)}removeEventCallback(e){this.eventHandler.removeEventCallback(e)}addPerformanceCallback(e){return us(),this.performanceClient.addPerformanceCallback(e)}removePerformanceCallback(e){return this.performanceClient.removePerformanceCallback(e)}enableAccountStorageEvents(){if(this.config.cache.cacheLocation!==B.LocalStorage){this.logger.info("Account storage events are only available when cacheLocation is set to localStorage");return}this.eventHandler.subscribeCrossTab()}disableAccountStorageEvents(){if(this.config.cache.cacheLocation!==B.LocalStorage){this.logger.info("Account storage events are only available when cacheLocation is set to localStorage");return}this.eventHandler.unsubscribeCrossTab()}getTokenCache(){return this.tokenCache}getLogger(){return this.logger}setLogger(e){this.logger=e}initializeWrapperLibrary(e,t){this.browserStorage.setWrapperMetadata(e,t)}setNavigationClient(e){this.navigationClient=e}getConfiguration(){return this.config}getPerformanceClient(){return this.performanceClient}isBrowserEnv(){return this.isBrowserEnvironment}getRequestCorrelationId(e){return e?.correlationId?e.correlationId:this.isBrowserEnvironment?se():g.EMPTY_STRING}loginRedirect(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e);return this.logger.verbose("loginRedirect called",t),this.acquireTokenRedirect(y({correlationId:t},e||hc))})}loginPopup(e){let t=this.getRequestCorrelationId(e);return this.logger.verbose("loginPopup called",t),this.acquireTokenPopup(y({correlationId:t},e||hc))}acquireTokenSilent(e){return d(this,null,function*(){let t=this.getRequestCorrelationId(e),r=this.performanceClient.startMeasurement(c.AcquireTokenSilent,t);r.add({cacheLookupPolicy:e.cacheLookupPolicy,scenarioId:e.scenarioId}),Fs(this.initialized,r,e.account),this.logger.verbose("acquireTokenSilent called",t);let o=e.account||this.getActiveAccount();if(!o)throw A(wo);return this.acquireTokenSilentDeduped(e,o,t).then(i=>(r.end({success:!0,fromCache:i.fromCache,accessTokenSize:i.accessToken.length,idTokenSize:i.idToken.length},void 0,i.account),S(y({},i),{state:e.state,correlationId:t}))).catch(i=>{throw i instanceof v&&i.setCorrelationId(t),r.end({success:!1},i,o),i})})}acquireTokenSilentDeduped(e,t,r){return d(this,null,function*(){let o=At(this.config.auth.clientId,S(y({},e),{authority:e.authority||this.config.auth.authority,correlationId:r}),t.homeAccountId),i=JSON.stringify(o),s=this.activeSilentTokenRequests.get(i);if(typeof s>"u"){this.logger.verbose("acquireTokenSilent called for the first time, storing active request",r),this.performanceClient.addFields({deduped:!1},r);let a=u(this.acquireTokenSilentAsync.bind(this),c.AcquireTokenSilentAsync,this.logger,this.performanceClient,r)(S(y({},e),{correlationId:r}),t);return this.activeSilentTokenRequests.set(i,a),a.finally(()=>{this.activeSilentTokenRequests.delete(i)})}else return this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call",r),this.performanceClient.addFields({deduped:!0},r),s})}acquireTokenSilentAsync(e,t){return d(this,null,function*(){let r=a=>this.trackStateChange(e.correlationId,a);this.performanceClient.addQueueMeasurement(c.AcquireTokenSilentAsync,e.correlationId),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,I.Silent,e),e.correlationId&&this.performanceClient.incrementFields({visibilityChangeCount:0,onlineStatusChangeCount:0},e.correlationId),this.addStateChangeListeners(r);let o=yield u(ad,c.InitializeSilentRequest,this.logger,this.performanceClient,e.correlationId)(e,t,this.config,this.performanceClient,this.logger),i=e.cacheLookupPolicy||ie.Default;return this.acquireTokenSilentNoIframe(o,i).catch(a=>
7d(this,null,function*(){if(ou(a,i)){let h=`${a.errorCode}${a.subError?`|${a.subError}`:""}`;if(this.performanceClient.addFields({silentRefreshReason:h},o.correlationId),this.activeIframeRequest)if(i!==ie.Skip){let[m,p]=this.activeIframeRequest;this.logger.verbose(`Iframe request is already in progress, awaiting resolution for request with correlationId: ${p}`,o.correlationId);let C=this.performanceClient.startMeasurement(c.AwaitConcurrentIframe,o.correlationId);C.add({awaitIframeCorrelationId:p});let T=yield m;if(C.end({success:T}),T)return this.logger.verbose(`Parallel iframe request with correlationId: ${p} succeeded. Retrying cache and/or RT redemption`,o.correlationId),this.acquireTokenSilentNoIframe(o,i);throw this.logger.info(`Iframe request with correlationId: ${p} failed. Interaction is required.`),a}else return this.logger.warning("Another iframe request is currently in progress and CacheLookupPolicy is set to Skip. This may result in degraded performance and/or reliability for both calls. Please consider changing the CacheLookupPolicy to take advantage of request queuing and token cache.",o.correlationId),u(this.acquireTokenBySilentIframe.bind(this),c.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o);else{let m;return this.activeIframeRequest=[new Promise(p=>{m=p}),o.correlationId],this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",o.correlationId),u(this.acquireTokenBySilentIframe.bind(this),c.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o).then(p=>(m(!0),p)).catch(p=>{throw m(!1),p}).finally(()=>{this.activeIframeRequest=void 0})}}else throw a})).then(a=>(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,I.Silent,a),this.performanceClient.addFields({fromCache:a.fromCache},e.correlationId),a)).catch(a=>{throw this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,I.Silent,null,a),a}).finally(()=>{this.removeStateChangeListeners(r)})})}acquireTokenSilentNoIframe(e,t){return d(this,null,function*(){return _t(this.config,this.logger,this.platformAuthProvider,e.authenticationScheme)&&e.account.nativeAccountId?(this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform"),this.performanceClient.addFields({isPlatformBrokerRequest:!0},e.correlationId),this.acquireTokenNative(e,b.acquireTokenSilent_silentFlow,e.account.nativeAccountId,t).catch(r=>d(this,null,function*(){throw this.performanceClient.addFields({brokerErrorName:r.name,brokerErrorCode:r.errorCode},e.correlationId),r instanceof Pe&&Xt(r)?(this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow"),this.platformAuthProvider=void 0,f(re.tokenRefreshRequired)):r}))):(this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow"),t===ie.AccessToken&&this.logger.verbose("acquireTokenSilent - cache lookup policy set to AccessToken, attempting to acquire token from local cache"),u(this.acquireTokenFromCache.bind(this),c.AcquireTokenFromCache,this.logger,this.performanceClient,e.correlationId)(e,t).catch(r=>{if(t===ie.AccessToken)throw r;return this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_NETWORK_START,I.Silent,e),u(this.acquireTokenByRefreshToken.bind(this),c.AcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,t)}))})}preGeneratePkceCodes(e){return d(this,null,function*(){return this.logger.verbose("Generating new PKCE codes"),this.pkceCode=yield u(Oe,c.GeneratePkceCodes,this.logger,this.performanceClient,e)(this.performanceClient,this.logger,e),Promise.resolve()})}getPreGeneratedPkceCodes(e){this.logger.verbose("Attempting to pick up pre-generated PKCE codes");let t=this.pkceCode?y({},this.pkceCode):void 0;return this.pkceCode=void 0,this.logger.verbose(`${t?"Found":"Did not find"} pre-generated PKCE codes`),this.performanceClient.addFields({usePreGeneratedPkce:!!t},e),t}logMultipleInstances(e){let t=this.config.auth.clientId;if(!window)return;window.msal=window.msal||{},window.msal.clientIds=window.msal.clientIds||[],window.msal.clientIds.length>0&&this.logger.verbose("There is already an instance of MSAL.js in the window."),window.msal.clientIds.push(t),vd(t,e,this.logger)}};
7function ou(n,e){let t=!(n instanceof ne&&n.subError!==Ye.badToken),r=n.errorCode===V.INVALID_GRANT_ERROR||n.errorCode===re.tokenRefreshRequired,o=t&&r||n.errorCode===Ye.noTokensFound||n.errorCode===Ye.refreshTokenExpired,i=vl.includes(e);return o&&i}function wd(n,e){return d(this,null,function*(){let t=new As(n);return yield t.initialize(),on.createController(t,e)})}var Mc=class n{static createPublicClientApplication(e){return d(this,null,function*(){let t=yield wd(e);return new n(e,t)})}constructor(e,t){this.isBroker=!1,this.controller=t||new on(new As(e))}initialize(e){return d(this,null,function*(){return this.controller.initialize(e,this.isBroker)})}acquireTokenPopup(e){return d(this,null,function*(){return this.controller.acquireTokenPopup(e)})}acquireTokenRedirect(e){return this.controller.acquireTokenRedirect(e)}acquireTokenSilent(e){return this.controller.acquireTokenSilent(e)}acquireTokenByCode(e){return this.controller.acquireTokenByCode(e)}addEventCallback(e,t){return this.controller.addEventCallback(e,t)}removeEventCallback(e){return this.controller.removeEventCallback(e)}addPerformanceCallback(e){return this.controller.addPerformanceCallback(e)}removePerformanceCallback(e){return this.controller.removePerformanceCallback(e)}enableAccountStorageEvents(){this.controller.enableAccountStorageEvents()}disableAccountStorageEvents(){this.controller.disableAccountStorageEvents()}getAccount(e){return this.controller.getAccount(e)}getAccountByHomeId(e){return this.controller.getAccountByHomeId(e)}getAccountByLocalId(e){return this.controller.getAccountByLocalId(e)}getAccountByUsername(e){return this.controller.getAccountByUsername(e)}getAllAccounts(e){return this.controller.getAllAccounts(e)}handleRedirectPromise(e){return this.controller.handleRedirectPromise(e)}loginPopup(e){return this.controller.loginPopup(e)}loginRedirect(e){return this.controller.loginRedirect(e)}logout(e){return this.controller.logout(e)}logoutRedirect(e){return this.controller.logoutRedirect(e)}logoutPopup(e){return this.controller.logoutPopup(e)}ssoSilent(e){return this.controller.ssoSilent(e)}getTokenCache(){return this.controller.getTokenCache()}getLogger(){return this.controller.getLogger()}setLogger(e){this.controller.setLogger(e)}setActiveAccount(e){this.controller.setActiveAccount(e)}getActiveAccount(){return this.controller.getActiveAccount()}initializeWrapperLibrary(e,t){return this.controller.initializeWrapperLibrary(e,t)}setNavigationClient(e){this.controller.setNavigationClient(e)}getConfiguration(){return this.controller.getConfiguration()}hydrateCache(e,t){return d(this,null,function*(){return this.controller.hydrateCache(e,t)})}clearCache(e){return this.controller.clearCache(e)}};var Ii=class{static getInteractionStatusFromEvent(e,t){switch(e.eventType){case E.LOGIN_START:return X.Login;case E.SSO_SILENT_START:return X.SsoSilent;case E.ACQUIRE_TOKEN_START:if(e.interactionType===I.Redirect||e.interactionType===I.Popup)return X.AcquireToken;break;case E.HANDLE_REDIRECT_START:return X.HandleRedirect;case E.LOGOUT_START:return X.Logout;case E.SSO_SILENT_SUCCESS:case E.SSO_SILENT_FAILURE:if(t&&t!==X.SsoSilent)break;return X.None;case E.LOGOUT_END:if(t&&t!==X.Logout)break;return X.None;case E.HANDLE_REDIRECT_END:if(t&&t!==X.HandleRedirect)break;return X.None;case E.LOGIN_SUCCESS:case E.LOGIN_FAILURE:case E.ACQUIRE_TOKEN_SUCCESS:case E.ACQUIRE_TOKEN_FAILURE:case E.RESTORE_FROM_BFCACHE:if(e.interactionType===I.Redirect||e.interactionType===I.Popup){if(t&&t!==X.Login&&t!==X.AcquireToken)break;return X.None}break}return null}};var nu=window.navigator.userAgent.indexOf("MSIE ")>-1||window.navigator.userAgent.indexOf("Trident/")>-1,kd={auth:{clientId:"a3aad765-6329-4eaa-b455-85fc81886e97",authority:"https://login.microsoftonline.com/organizations",redirectUri:"/auth",postLogoutRedirectUri:"cannolaiadmin/login",clientCapabilities:["CP1"]},cache:{cacheLocation:B.LocalStorage,storeAuthStateInCookie:nu},system:{allowRedirectInIframe:!0,loggerOptions:{loggerCallback(n,e){},logLevel:U.Verbose,piiLoggingEnabled:!1}}};var Vv={scopes:[]};var Rd=n=>{for(let e in sessionStorage)e.startsWith(`acs.${kd.auth.clientId}.${n}`)&&sessionStorage.removeItem(e)};var Bs="@azure/msal-angular",Si="4.1.1",Uc=new sn("MSAL_INSTANCE"),Pd=new sn("MSAL_GUARD_CONFIG"),iu=new sn("MSAL_INTERCEPTOR_CONFIG"),su=new sn("MSAL_BROADCAST_CONFIG"),Dc=(()=>{class n{constructor(t,r){this.msalInstance=t,this.msalBroadcastConfig=r,this.msalBroadcastConfig&&this.msalBroadcastConfig.eventsToReplay>0?(this.msalInstance.getLogger().clone(Bs,Si).verbose(`BroadcastService - eventsToReplay set on BroadcastConfig, replaying the last ${this.msalBroadcastConfig.eventsToReplay}
7 events`),this._msalSubject=new xc(this.msalBroadcastConfig.eventsToReplay)):this._msalSubject=new nn,this.msalSubject$=this._msalSubject.asObservable(),this._inProgress=new Lc(X.Startup),this.inProgress$=this._inProgress.asObservable(),this.msalInstance.addEventCallback(o=>{this._msalSubject.next(o);let i=Ii.getInteractionStatusFromEvent(o,this._inProgress.value);i!==null&&(this.msalInstance.getLogger().clone(Bs,Si).verbose(`BroadcastService - ${o.eventType} results in setting inProgress from ${this._inProgress.value} to ${i}`),this._inProgress.next(i))})}resetInProgressEvent(){this._inProgress.value===X.Startup&&this._inProgress.next(X.None)}}return n.\u0275fac=function(t){return new(t||n)(ee(Uc),ee(su,8))},n.\u0275prov=bt({token:n,factory:n.\u0275fac}),n})(),vi=(()=>{class n{constructor(t,r,o){this.instance=t,this.location=r,this.injector=o;let i=this.location.path(!0).split("#").pop();i&&(this.redirectHash=`#${i}`),this.instance.initializeWrapperLibrary(mc.Angular,Si)}initialize(){return ke(this.instance.initialize())}acquireTokenPopup(t){return ke(this.instance.acquireTokenPopup(t))}acquireTokenRedirect(t){return ke(this.instance.acquireTokenRedirect(t))}acquireTokenSilent(t){return ke(this.instance.acquireTokenSilent(t))}handleRedirectObservable(t){return ke(this.instance.initialize().then(()=>this.instance.handleRedirectPromise(t||this.redirectHash)).finally(()=>{this.injector.get(Dc).resetInProgressEvent()}))}loginPopup(t){return ke(this.instance.loginPopup(t))}loginRedirect(t){return ke(this.instance.loginRedirect(t))}logout(t){return ke(this.instance.logout(t))}logoutRedirect(t){return ke(this.instance.logoutRedirect(t))}logoutPopup(t){return ke(this.instance.logoutPopup(t))}ssoSilent(t){return ke(this.instance.ssoSilent(t))}getLogger(){return this.logger||(this.logger=this.instance.getLogger().clone(Bs,Si)),this.logger}setLogger(t){this.logger=t.clone(Bs,Si),this.instance.setLogger(t)}}return n.\u0275fac=function(t){return new(t||n)(ee(Uc),ee($s),ee(zc))},n.\u0275prov=bt({token:n,factory:n.\u0275fac}),n})(),au=(()=>{class n{constructor(t,r,o,i,s){this.msalGuardConfig=t,this.msalBroadcastService=r,this.authService=o,this.location=i,this.router=s,this.msalBroadcastService.inProgress$.subscribe()}parseUrl(t){return this.router.parseUrl(t)}getDestinationUrl(t){this.authService.getLogger().verbose("Guard - getting destination url");let r=document.getElementsByTagName("base"),o=this.location.normalize(r.length?r[0].href:window.location.origin),i=this.location.prepareExternalUrl(t);return i.startsWith("#")?(this.authService.getLogger().verbose("Guard - destination by hash routing"),`${o}/${i}`):`${o}${t}`}loginInteractively(t){let r=typeof this.msalGuardConfig.authRequest=="function"?this.msalGuardConfig.authRequest(this.authService,t):y({},this.msalGuardConfig.authRequest);if(this.msalGuardConfig.interactionType===I.Popup)return this.authService.getLogger().verbose("Guard - logging in by popup"),this.authService.loginPopup(r).pipe(qs(i=>(this.authService.getLogger().verbose("Guard - login by popup successful, can activate, setting active account"),this.authService.instance.setActiveAccount(i.account),!0)));this.authService.getLogger().verbose("Guard - logging in by redirect");let o=this.getDestinationUrl(t.url);return this.authService.loginRedirect(y({redirectStartPage:o},r)).pipe(qs(()=>!1))}activateHelper(t){if(this.msalGuardConfig.interactionType!==I.Popup&&this.msalGuardConfig.interactionType!==I.Redirect)throw new $o("invalid_interaction_type","Invalid interaction type provided to MSAL Guard. InteractionType.Popup or InteractionType.Redirect must be provided in the MsalGuardConfiguration");if(this.authService.getLogger().verbose("MSAL Guard activated"),typeof window<"u"){if(_.hashContainsKnownProperties(window.location.hash)&&gs.isInIframe()&&!this.authService.instance.getConfiguration().system.allowRedirectInIframe)return this.authService.getLogger().warning("Guard - redirectUri set to page with MSAL Guard. It is recommended to not set redirectUri to a page that requires authentication."),it(!1)}else return this.authService.getLogger().info("Guard - window is undefined, MSAL does not support server-side token acquisition"),it(!0);this.msalGuardConfig.loginFailedRoute&&(this.loginFailedRoute=this.parseUrl(this.msalGuardConfig.loginFailedRoute));let r=this.location.path(!0);return this.authService.initialize().pipe(zs(()=>this.authService.handleRedirectObservable()),zs(()=>
7{if(!this.authService.instance.getAllAccounts().length)return t?(this.authService.getLogger().verbose("Guard - no accounts retrieved, log in required to activate"),this.loginInteractively(t)):(this.authService.getLogger().verbose("Guard - no accounts retrieved, no state, cannot load"),it(!1));if(this.authService.getLogger().verbose("Guard - at least 1 account exists, can activate or load"),t){let o=this.includesCode(t.url),i=!!t.root&&!!t.root.fragment&&this.includesCode(`#${t.root.fragment}`),s=this.location.prepareExternalUrl(t.url).indexOf("#")===0;if(o&&(i||s))return this.authService.getLogger().info("Guard - Hash contains known code response, stopping navigation."),r.indexOf("#")>-1?it(this.parseUrl(this.location.path())):it(this.parseUrl(""))}return it(!0)}),Hc(o=>(this.authService.getLogger().error("Guard - error while logging in, unable to activate"),this.authService.getLogger().errorPii(`Guard - error: ${o.message}`),this.loginFailedRoute&&t?(this.authService.getLogger().verbose("Guard - loginFailedRoute set, redirecting"),it(this.loginFailedRoute)):it(!1))))}includesCode(t){return t.lastIndexOf("/code")>-1&&t.lastIndexOf("/code")===t.length-5||t.indexOf("#code=")>-1||t.indexOf("&code=")>-1}canActivate(t,r){return this.authService.getLogger().verbose("Guard - canActivate"),this.activateHelper(r)}canActivateChild(t,r){return this.authService.getLogger().verbose("Guard - canActivateChild"),this.activateHelper(r)}canMatch(){return this.authService.getLogger().verbose("Guard - canLoad"),this.activateHelper()}}return n.\u0275fac=function(t){return new(t||n)(ee(Pd),ee(Dc),ee(vi),ee($s),ee(Jr))},n.\u0275prov=bt({token:n,factory:n.\u0275fac}),n})();var uw=(()=>{class n{constructor(t){this.authService=t}ngOnInit(){this.authService.getLogger().verbose("MsalRedirectComponent activated"),this.authService.handleRedirectObservable().subscribe()}}return n.\u0275fac=function(t){return new(t||n)($c(vi))},n.\u0275cmp=Gc({type:n,selectors:[["app-redirect"]],decls:0,vars:0,template:function(t,r){},encapsulation:2}),n})(),mw=(()=>{class n{static forRoot(t,r,o){return{ngModule:n,providers:[{provide:Uc,useValue:t},{provide:Pd,useValue:r},{provide:iu,useValue:o},vi]}}}return n.\u0275fac=function(t){return new(t||n)},n.\u0275mod=qc({type:n}),n.\u0275inj=Kc({providers:[au,Dc],imports:[Vc]}),n})();var Od=(()=>{class n{constructor(t){this.router=t}determineModule(){switch(window.location.hostname.split(".")[0]){case"admin":return"cannolaiadmin";case"admin-uat":return"cannolaiadmin";case"client":return"client";default:return window.location.pathname.startsWith("/admin")?"client":window.location.pathname.startsWith("/cannolaiadmin")?"cannolaiadmin":"member"}}navigateBasedOnDomain(){switch(this.determineModule()){case"cannolaiadmin":this.router.navigate(["/cannolaiadmin"]);break;case"client":this.router.navigate(["/admin"]);break;default:this.router.navigate(["/"]);break}}getLogoutRedirectUrl(){switch(this.determineModule()){case"cannolaiadmin":return"/cannolaiadmin/login";case"client":return"/admin/login";default:return"/login"}}navigateToLogin(t){let r=this.getLogoutRedirectUrl();t?this.router.navigate([r],{queryParams:{returnUrl:t}}):this.router.navigate([r])}getDomainLoginUrl(t){let r=window.location.hostname,o=window.location.protocol,i=window.location.port;switch(r.split(".")[0]){case"admin":case"admin-uat":return t?`${o}//${r}${i?":"+i:""}/cannolaiadmin/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/cannolaiadmin/login`;case"client":return t?`${o}//${r}${i?":"+i:""}/admin/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/admin/login`;default:return r==="localhost"&&i==="4200"?t?`${o}//${r}${i?":"+i:""}/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/login`:window.location.pathname.startsWith("/admin")?t?`${o}//${r}${i?":"+i:""}/admin/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/admin/login`:window.location.pathname.startsWith("/client")?t?`${o}//${r}${i?":"+i:""}/admin/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/admin/login`:window.location.pathname.startsWith("/cannolaiadmin")?t?`${o}//${r}${i?":"+i:""}/cannolaiadmin/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/cannolaiadmin/login`:t?`${o}//${r}${i?":"+i:""}/login?redirecturl=${t}`:`${o}//${r}${i?":"+i:""}/login`}}static{this.\u0275fac=function(r){return new(r||n)(ee(Jr))}}static{this.\u0275prov=bt({token:n,factory:n.\u0275fac,providedIn:"root"})}}return n})();var Sw=(()=>{class n extends Wc{constructor(t,r,o,i,s){super(t,o),this.router=r,this.msalService=i,this.domainRouterService=s,this.unsubscriber=new nn,this.onSignInOut=new nn}isAuthenticated(t=!1){let r=this.webStorageService.getCurrentUserToken();if(r){if(r.isSSOEnabled)return!0;let o=new Date;return!(new Date(r.expires)<o)}else return!1}isMemberAuthenticated(t=!1){let r=this.webStorageService.getCurrentmemberToken();if(r){if(r.isSSOEnabled)return!0;let o=new Date;return!(new Date(r.expires)<o)}else return!1}getCurrentUserToken(){return this.webStorageService.getCurrentUserToken()}getCurrentmemberToken(){return this.webStorageService.getCurrentmemberToken()}signIn(t){return this.get("Authentication/SignIn?emailAddress="+t.userName+"&password="+encodeURIComponent(t.password))}clientSignIn(t){return this.get("TenantAuthentication/ClientSignIn?emailAddress="+t.userName+"&password="+encodeURIComponent(t.password))}signInRequest(t){return this.post("authentication/SignIn",t)}clientSignInRequest(t){return this.post("TenantAuthentication/ClientSignIn",t)}MemberSignIn(t){return this.postAsync("MemberAuthentication/MemberSignIn",t)}MemberSignUp(t){return this.post("MemberAuthentication/MemberSignUp",t)}changePassword(t){return this.post("UserInfo/ChangePassword",t)}ValidateResetLink(t){return this.get("UserInfo/ValidateResetLink?utm_till="+t)}
7createPassword(t){return this.post("UserInfo/createPassword",t)}createMemberPassword(t){return this.post("MemberAuthentication/CreatePassword",t)}memberForgotPassword(t){return this.post("MemberAuthentication/ForgotPassword/"+t,null)}memberChangePassword(t){return this.post("MemberAuthentication/ChangePassword",t)}memberValidateResetLink(t){return this.get("MemberAuthentication/ValidateResetLink?utm_till="+t)}ValidateCurrentPassword(t,r){let o=new Qc;return o.contactId=t,o.password=r,this.post("MemberAuthentication/ValidateCurrentPassword",o)}GetMemberPortalSetting(){return this.get("MemberAuthentication/GetMemberPortalSetting")}clientChangePassword(t){return this.post("StaffUser/ChangePassword",t)}clientValidateResetLink(t){return this.get("StaffUser/ValidateResetLink?utm_till="+t)}clientCreatePassword(t){return this.post("StaffUser/CreatePassword",t)}forgotPassword(t){return this.post("UserInfo/ForgotPassword/"+t,null)}clientForgotPassword(t){return this.post("StaffUser/ForgotPassword/"+t,null)}getTokenParameter(t,r){return this.get("Authentication/GetTokenParameter")}getClientTokenParameter(t,r){return this.get("TenantAuthentication/GetTokenParameter")}getGetTokenParameterAPIURL(){return this.getAPIurl("Authentication/GetTokenParameter")}getClinetDetails(t){return this.get("authentication/config?url="+t+"&rid="+Math.random().toString(),new wi({"Content-Type":"application/json",clientUrl:t}))}getClinetDetailsCustom(t){return this.webStorageService.getClientConfig()?this.get("authentication/configcustom?url="+t+"&rid="+Math.random().toString(),new wi({"Content-Type":"application/json",clientId:this.webStorageService.getClientConfig().clientId,forceRefresh:"true"})):this.get("authentication/configcustom?url="+t+"&rid="+Math.random().toString(),new wi({"Content-Type":"application/json",clientUrl:t,forceRefresh:"true"}))}logout(){let r=this.webStorageService.getClientConfig().isProductOwner;switch(this.domainRouterService.determineModule()){case"cannolaiadmin":r=!0;break;case"client":r=!1;break;default:r=!1;break}let i=this.webStorageService.getCurrentUserToken();return r?this.get("UserInfo/Logout/"+i.userId):this.get("StaffUser/Logout/"+i.userId)}signOut(t=null){let r=this.webStorageService.getCurrentUserToken();if(r&&r.isSSOEnabled){let o=this.msalService.instance.getActiveAccount()||this.msalService.instance.getAllAccounts()[0];o&&Rd(o.homeAccountId),this.webStorageService.clear(),this.webStorageService.deleteCurrentUserToken(),this.webStorageService.deleteIsSession(),this.webStorageService.deletePermissions(),this.webStorageService.deleteUserPermissions(),this.webStorageService.deleteUserMenuPermissions(),this.msalService.instance.getActiveAccount()?this.msalService.logoutRedirect({account:o}):this.domainBasedLogout("")}else r?this.logout().pipe(Bc(this.unsubscriber),Fc(()=>this.loading=!1)).subscribe(o=>{o&&o.isSuccess&&(this.webStorageService.clear(),this.webStorageService.deleteCurrentUserToken(),this.webStorageService.deleteIsSession(),this.webStorageService.deletePermissions(),this.webStorageService.deleteUserPermissions(),this.webStorageService.deleteUserMenuPermissions(),t?this.domainBasedLogout(t):this.domainBasedLogout(""))},o=>{this.webStorageService.clear(),this.webStorageService.deleteCurrentUserToken(),this.webStorageService.deleteIsSession(),this.webStorageService.deletePermissions(),this.webStorageService.deleteUserPermissions(),this.webStorageService.deleteUserMenuPermissions(),this.domainBasedLogout("")}):t?this.domainBasedLogout(t):this.domainBasedLogout("")}domainBasedLogout(t){switch(this.domainRouterService.determineModule()){case"cannolaiadmin":window.location.href=this.domainRouterService.getDomainLoginUrl(t);break;case"client":window.location.href=this.domainRouterService.getDomainLoginUrl(t);break;default:window.location.href=this.domainRouterService.getDomainLoginUrl(t);break}}getdomainModule(){return this.domainRouterService.determineModule()}logoutWithRouter(t){this.domainRouterService.navigateToLogin(t)}memberSignOut(){this.webStorageService.deleteCurrentmemberToken(),this.router.navigate(["/login"])}notAuthorized(){let t=this.getdomainModule(),r="";switch(t){case"cannolaiadmin":r="cannolaiadmin/404";break;case"client":r="admin/404";break;default:r="/404";break}this.router.navigate([r])}getRedirectUrlAfterSignIn(t,r,o){let i="";switch(this.getdomainModule()){case"cannolaiadmin":i="cannolaiadmin/admin/clients";break;case"client":i="admin/client/contacts";break;default:i="member/home";break}return t?o!=""&&o!=null&&o!=null?o:i:this.domainRouterService.getDomainLoginUrl("")}getRedirectUrlAfterMemebrSignIn(t,r,o){let i=this.webStorageService.getClientConfig(),s=!0;return i&&(s=i.isProductOwner),t?s?"/"+r:o||"/member/home":"/login"}GetComapnyDetailsByEmail(t){return this.get("MemberAuthentication/GetComapnyDetailsByEmail/"+t)}saveAccountSignupFormSection(t){return this.postAsync("MemberAuthentication/SaveAccountSignupFormSection",t)}GetAccountSignupFormSections(t){return this.get("MemberAuthentication/GetAccountSignupFormSections",null,t)}RemoveAccountSignupFormSection(t){return this.getAsync("MemberAuthentication/RemoveAccountSignupFormSection/"+t)}GetAccountSignupFormFieldModel(t){return this.getAsync("MemberAuthentication/GetAccountSignupFormFieldModel/"+t)}UpdateAccountSignupFormSectionhPriorityOrder(t){return this.post("MemberAuthentication/UpdateAccountSignupFormSectionhPriorityOrder",t)}GetDefaultEmailtypeForContactProfileEmail(){return this.getAsync("MemberAuthentication/GetDefaultEmailtypeForContactProfileEmail")}GetDefaultPhoneType(){return this.getAsync("MemberAuthentication/GetDefaultPhoneType")}SaveSignupInformation(t){return this.postAsync("MemberAuthentication/SaveSignupInformation",t)}static{this.\u0275fac=function(r){return new(r||n)(ee(jc),ee(Jr),ee(Yc),ee(vi),ee(Od))}}static{this.\u0275prov=bt({token:n,factory:n.\u0275fac,providedIn:"root"})}}return n})();export{U as a,B as b,I as c,X as d,E as e,Mc as f,Vv as g,Rd as h,Uc as i,Pd as
7j,iu as k,Dc as l,vi as m,au as n,uw as o,mw as p,Od as q,Sw as r};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.