[chunk]-DPWMbdIG.js

js salesentra.web.app collected 2026-10-03 12:35:02 UTC 546,259 bytes, 13,403 lines download raw bytes

1//#region node_modules/@azure/msal-common/dist-browser/utils/Constants.mjs
2/*! @azure/msal-common v16.8.0 2026-06-10 */
3var SKU = "msal.js.common";
4var DEFAULT_AUTHORITY = "https://login.microsoftonline.com/common/";
5var DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
6var DEFAULT_COMMON_TENANT = "common";
7var ADFS = "adfs";
8var DSTS = "dstsv2";
9var AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
10var CIAM_AUTH_URL = ".ciamlogin.com";
11var AAD_TENANT_DOMAIN_SUFFIX = ".onmicrosoft.com";
12var OPENID_SCOPE = "openid";
13var PROFILE_SCOPE = "profile";
14var OFFLINE_ACCESS_SCOPE = "offline_access";
15var EMAIL_SCOPE = "email";
16var S256_CODE_CHALLENGE_METHOD = "S256";
17var URL_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded;charset=utf-8";
18var IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
19var IMDS_VERSION = "2020-06-01";
20var IMDS_TIMEOUT = 2e3;
21var REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
22var KNOWN_PUBLIC_CLOUDS = [
23	"login.microsoftonline.com",
24	"login.windows.net",
25	"login.microsoft.com",
26	"sts.windows.net"
27];
28var HttpMethod = {
29	GET: "GET",
30	POST: "POST"
31};
32var OIDC_DEFAULT_SCOPES = [
33	OPENID_SCOPE,
34	PROFILE_SCOPE,
35	OFFLINE_ACCESS_SCOPE
36];
37var OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
38/**
39* Request header names
40*/
41var HeaderNames = {
42	CONTENT_TYPE: "Content-Type",
43	CONTENT_LENGTH: "Content-Length",
44	RETRY_AFTER: "Retry-After",
45	CCS_HEADER: "X-AnchorMailbox",
46	WWWAuthenticate: "WWW-Authenticate",
47	AuthenticationInfo: "Authentication-Info",
48	X_MS_REQUEST_ID: "x-ms-request-id",
49	X_MS_HTTP_VERSION: "x-ms-httpver"
50};
51/**
52* Persistent cache keys MSAL which stay while user is logged in.
53*/
54var PersistentCacheKeys = { ACTIVE_ACCOUNT_FILTERS: "active-account-filters" };
55/**
56* String constants related to AAD Authority
57*/
58var AADAuthority = {
59	COMMON: "common",
60	ORGANIZATIONS: "organizations",
61	CONSUMERS: "consumers"
62};
63/**
64* Claims request keys
65*/
66var ClaimsRequestKeys = {
67	ACCESS_TOKEN: "access_token",
68	XMS_CC: "xms_cc"
69};
70/**
71* we considered making this "enum" in the request instead of string, however it looks like the allowed list of
72* prompt values kept changing over past couple of years. There are some undocumented prompt values for some
73* internal partners too, hence the choice of generic "string" type instead of the "enum"
74*/
75var PromptValue = {
76	LOGIN: "login",
77	SELECT_ACCOUNT: "select_account",
78	CONSENT: "consent",
79	NONE: "none",
80	CREATE: "create",
81	NO_SESSION: "no_session"
82};
83/**
84* Allowed values for response_type
85*/
86var OAuthResponseType = {
87	CODE: "code",
88	IDTOKEN_TOKEN: "id_token token",
89	IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token"
90};
91/**
92* allowed values for response_mode
93*/
94var ResponseMode = {
95	QUERY: "query",
96	FRAGMENT: "fragment",
97	FORM_POST: "form_post"
98};
99/**
100* allowed grant_type
101*/
102var GrantType = {
103	IMPLICIT_GRANT: "implicit",
104	AUTHORIZATION_CODE_GRANT: "authorization_code",
105	CLIENT_CREDENTIALS_GRANT: "client_credentials",
106	RESOURCE_OWNER_PASSWORD_GRANT: "password",
107	REFRESH_TOKEN_GRANT: "refresh_token",
108	DEVICE_CODE_GRANT: "device_code",
109	JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer"
110};
111/**
112* Account types in Cache
113*/
114var CACHE_ACCOUNT_TYPE_MSSTS = "MSSTS";
115var CACHE_ACCOUNT_TYPE_ADFS = "ADFS";
116var CACHE_ACCOUNT_TYPE_GENERIC = "Generic";
117/**
118* Credential Type stored in the cache
119*/
120var CredentialType = {
121	ID_TOKEN: "IdToken",
122	ACCESS_TOKEN: "AccessToken",
123	ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
124	REFRESH_TOKEN: "RefreshToken"
125};
126/**
127* More Cache related constants
128*/
129var APP_METADATA = "appmetadata";
130var CLIENT_INFO = "client_info";
131var AUTHORITY_METADATA_CACHE_KEY = "authority-metadata";
132var AUTHORITY_METADATA_REFRESH_TIME_SECONDS = 3600 * 24;
133var AuthorityMetadataSource = {
134	CONFIG: "config",
135	CACHE: "cache",
136	NETWORK: "network",
137	HARDCODED_VALUES: "hardcoded_values"
138};
139var SERVER_TELEM_CACHE_KEY = "server-telemetry";
140var SERVER_TELEM_UNKNOWN_ERROR = "unknown_error";
141/**
142* Type of the authentication request
143*/
144var AuthenticationScheme = {
145	BEARER: "Bearer",
146	POP: "pop",
147	SSH: "ssh-cert"
148};
149var DEFAULT_MAX_THROTTLE_TIME_SECONDS = 3600;

150var THROTTLING_PREFIX = "throttling";
151var X_MS_LIB_CAPABILITY_VALUE = "retry-after, h429";
152/**
153* Region Discovery Sources
154*/
155var RegionDiscoverySources = {
156	FAILED_AUTO_DETECTION: "1",
157	INTERNAL_CACHE: "2",
158	ENVIRONMENT_VARIABLE: "3",
159	IMDS: "4"
160};
161/**
162* Region Discovery Outcomes
163*/
164var RegionDiscoveryOutcomes = {
165	CONFIGURED_MATCHES_DETECTED: "1",
166	CONFIGURED_NO_AUTO_DETECTION: "2",
167	CONFIGURED_NOT_DETECTED: "3",
168	AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
169	AUTO_DETECTION_REQUESTED_FAILED: "5"
170};
171/**
172* Specifies the reason for fetching the access token from the identity provider
173*/
174var CacheOutcome = {
175	NOT_APPLICABLE: "0",
176	FORCE_REFRESH_OR_CLAIMS: "1",
177	NO_CACHED_ACCESS_TOKEN: "2",
178	CACHED_ACCESS_TOKEN_EXPIRED: "3",
179	PROACTIVELY_REFRESHED: "4"
180};
181var JsonWebTokenTypes = {
182	Jwt: "JWT",
183	Jwk: "JWK",
184	Pop: "pop"
185};
186//#endregion
187//#region node_modules/@azure/msal-common/dist-browser/constants/AADServerParamKeys.mjs
188/*! @azure/msal-common v16.8.0 2026-06-10 */
189var CLIENT_ID = "client_id";
190var REDIRECT_URI = "redirect_uri";
191var RESPONSE_TYPE = "response_type";
192var RESPONSE_MODE = "response_mode";
193var GRANT_TYPE = "grant_type";
194var CLAIMS = "claims";
195var SCOPE = "scope";
196var REFRESH_TOKEN = "refresh_token";
197var STATE = "state";
198var NONCE = "nonce";
199var PROMPT = "prompt";
200var CODE = "code";
201var CODE_CHALLENGE = "code_challenge";
202var CODE_CHALLENGE_METHOD = "code_challenge_method";
203var CODE_VERIFIER = "code_verifier";
204var CLIENT_REQUEST_ID = "client-request-id";
205var X_CLIENT_SKU = "x-client-SKU";
206var X_CLIENT_VER = "x-client-VER";
207var X_CLIENT_OS = "x-client-OS";
208var X_CLIENT_CPU = "x-client-CPU";
209var X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
210var X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
211var X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
212var X_APP_NAME = "x-app-name";
213var X_APP_VER = "x-app-ver";
214var POST_LOGOUT_URI = "post_logout_redirect_uri";
215var ID_TOKEN_HINT = "id_token_hint";
216var CLIENT_SECRET = "client_secret";
217var CLIENT_ASSERTION = "client_assertion";
218var CLIENT_ASSERTION_TYPE = "client_assertion_type";
219var TOKEN_TYPE = "token_type";
220var REQ_CNF = "req_cnf";
221var RETURN_SPA_CODE = "return_spa_code";
222var NATIVE_BROKER = "nativebroker";
223var LOGOUT_HINT = "logout_hint";
224var LOGIN_HINT = "login_hint";
225var DOMAIN_HINT = "domain_hint";
226var X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
227var BROKER_CLIENT_ID = "brk_client_id";
228var BROKER_REDIRECT_URI = "brk_redirect_uri";
229var INSTANCE_AWARE = "instance_aware";
230var EAR_JWK = "ear_jwk";
231var EAR_JWE_CRYPTO = "ear_jwe_crypto";
232var RESOURCE = "resource";
233var CLI_DATA = "clidata";
234//#endregion
235//#region node_modules/@azure/msal-common/dist-browser/error/AuthError.mjs
236/*! @azure/msal-common v16.8.0 2026-06-10 */
237function getDefaultErrorMessage$1(code) {
238	return `See https://aka.ms/msal.js.errors#${code} for details`;
239}
240/**
241* General error class thrown by the MSAL.js library.
242*/
243var AuthError = class AuthError extends Error {
244	constructor(errorCode, errorMessage, suberror) {
245		const message = errorMessage || (errorCode ? getDefaultErrorMessage$1(errorCode) : "");
246		const errorString = message ? `${errorCode}: ${message}` : errorCode;
247		super(errorString);
248		Object.setPrototypeOf(this, AuthError.prototype);
249		this.errorCode = errorCode || "";
250		this.errorMessage = message || "";
251		this.subError = suberror || "";
252		this.name = "AuthError";
253	}
254	setCorrelationId(correlationId) {
255		this.correlationId = correlationId;
256	}
257};
258function createAuthError(code, additionalMessage) {
259	return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
260}
261//#endregion
262//#region node_modules/@azure/msal-common/dist-browser/error/ClientConfigurationError.mjs
263/*! @azure/msal-common v16.8.0 2026-06-10 */
264/**
265* Error thrown when there is an error in configuration of the MSAL.js library.
266*/
267var ClientConfigurationError = class ClientConfigurationError extends AuthError {
268	constructor(errorCode) {
269		super(errorCode);
270		this.name = "ClientConfigurationError";
271		Object.setPrototypeOf(this, ClientConfigurationError.prototype);
272	}
273};
274function createClientConfigurationError(errorCode) {
275	return new ClientConfigurationError(errorCode);
276}
277//#endregion
278//#region node_modules/@azure/msal-common/dist-browser/utils/StringUtils.mjs
279/*! @azure/msal-common v16.8.0 2026-06-10 */
280/**
281* @hidden
282*/
283var StringUtils = class {
284	/**
285	* Check if stringified object is empty
286	* @param strObj
287	*/
288	static isEmptyObj(strObj) {
289		if (strObj) try {
290			const obj = JSON.parse(strObj);
291			return Object.keys(obj).length === 0;
292		} catch (e) {}
293		return true;
294	}
295	static startsWith(str, search) {
296		return str.indexOf(search) === 0;
297	}
298	static endsWith(str, search) {
299		return str.length >= search.length && str.lastIndexOf(search) === str.length - search.length;
300	}
301	/**
302	* Parses string into an object.
303	*
304	* @param query
305	*/
306	static queryStringToObject(query) {
307		const obj = {};

308		const params = query.split("&");
309		const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
310		params.forEach((pair) => {
311			if (pair.trim()) {
312				const [key, value] = pair.split(/=(.+)/g, 2);
313				if (key && value) obj[decode(key)] = decode(value);
314			}
315		});
316		return obj;
317	}
318	/**
319	* Trims entries in an array.
320	*
321	* @param arr
322	*/
323	static trimArrayEntries(arr) {
324		return arr.map((entry) => entry.trim());
325	}
326	/**
327	* Removes empty strings from array
328	* @param arr
329	*/
330	static removeEmptyStringsFromArray(arr) {
331		return arr.filter((entry) => {
332			return !!entry;
333		});
334	}
335	/**
336	* Attempts to parse a string into JSON
337	* @param str
338	*/
339	static jsonParseHelper(str) {
340		try {
341			return JSON.parse(str);
342		} catch (e) {
343			return null;
344		}
345	}
346};
347//#endregion
348//#region node_modules/@azure/msal-common/dist-browser/error/ClientAuthError.mjs
349/*! @azure/msal-common v16.8.0 2026-06-10 */
350/**
351* ClientAuthErrorMessage class containing string constants used by error codes and messages.
352*/
353/**
354* Error thrown when there is an error in the client code running on the browser.
355*/
356var ClientAuthError = class ClientAuthError extends AuthError {
357	constructor(errorCode, additionalMessage) {
358		super(errorCode, additionalMessage);
359		this.name = "ClientAuthError";
360		Object.setPrototypeOf(this, ClientAuthError.prototype);
361	}
362};
363function createClientAuthError(errorCode, additionalMessage) {
364	return new ClientAuthError(errorCode, additionalMessage);
365}
366//#endregion
367//#region node_modules/@azure/msal-common/dist-browser/error/ClientConfigurationErrorCodes.mjs
368/*! @azure/msal-common v16.8.0 2026-06-10 */
369var redirectUriEmpty = "redirect_uri_empty";
370var authorityUriInsecure = "authority_uri_insecure";
371var urlParseError = "url_parse_error";
372var urlEmptyError = "empty_url_error";
373var emptyInputScopesError = "empty_input_scopes_error";
374var invalidClaims = "invalid_claims";
375var tokenRequestEmpty = "token_request_empty";
376var logoutRequestEmpty = "logout_request_empty";
377var pkceParamsMissing = "pkce_params_missing";
378var invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
379var invalidAuthorityMetadata = "invalid_authority_metadata";
380var untrustedAuthority = "untrusted_authority";
381var missingSshJwk = "missing_ssh_jwk";
382var missingSshKid = "missing_ssh_kid";
383var cannotSetOIDCOptions = "cannot_set_OIDCOptions";
384var cannotAllowPlatformBroker = "cannot_allow_platform_broker";
385var authorityMismatch = "authority_mismatch";

386var invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
387var invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
388var issuerValidationFailed = "issuer_validation_failed";
389//#endregion
390//#region node_modules/@azure/msal-common/dist-browser/error/ClientAuthErrorCodes.mjs
391/*! @azure/msal-common v16.8.0 2026-06-10 */
392var clientInfoDecodingError = "client_info_decoding_error";
393var clientInfoEmptyError = "client_info_empty_error";
394var tokenParsingError = "token_parsing_error";
395var nullOrEmptyToken = "null_or_empty_token";
396var endpointResolutionError = "endpoints_resolution_error";
397var networkError = "network_error";
398var openIdConfigError = "openid_config_error";
399var hashNotDeserialized = "hash_not_deserialized";
400var invalidState = "invalid_state";
401var stateMismatch = "state_mismatch";
402var stateNotFound = "state_not_found";
403var nonceMismatch = "nonce_mismatch";
404var authTimeNotFound = "auth_time_not_found";
405var maxAgeTranspired = "max_age_transpired";
406var multipleMatchingAppMetadata = "multiple_matching_appMetadata";
407var requestCannotBeMade = "request_cannot_be_made";
408var cannotRemoveEmptyScope = "cannot_remove_empty_scope";
409var cannotAppendScopeSet = "cannot_append_scopeset";
410var emptyInputScopeSet = "empty_input_scopeset";
411var noAccountInSilentRequest = "no_account_in_silent_request";
412var invalidCacheRecord = "invalid_cache_record";
413var invalidCacheEnvironment = "invalid_cache_environment";
414var noAccountFound = "no_account_found";
415var noCryptoObject = "no_crypto_object";
416var tokenRefreshRequired = "token_refresh_required";
417var tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
418var authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
419var bindingKeyNotRemoved = "binding_key_not_removed";
420var endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
421var keyIdMissing = "key_id_missing";
422var methodNotImplemented = "method_not_implemented";
423var resourceParameterRequired = "resource_parameter_required";
424var misplacedResourceParam = "misplaced_resource_parameter";
425//#endregion
426//#region node_modules/@azure/msal-common/dist-browser/request/ScopeSet.mjs
427/*! @azure/msal-common v16.8.0 2026-06-10 */
428/**
429* The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
430* the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
431* to ensure uniqueness of strings.
432*/
433var ScopeSet = class ScopeSet {
434	constructor(inputScopes) {
435		const scopeArr = inputScopes ? StringUtils.trimArrayEntries([...inputScopes]) : [];
436		const filteredInput = scopeArr ? StringUtils.removeEmptyStringsFromArray(scopeArr) : [];
437		if (!filteredInput || !filteredInput.length) throw createClientConfigurationError(emptyInputScopesError);
438		this.scopes = /* @__PURE__ */ new Set();
439		filteredInput.forEach((scope) => this.scopes.add(scope));
440	}
441	/**
442	* Factory method to create ScopeSet from space-delimited string
443	* @param inputScopeString
444	* @param appClientId
445	* @param scopesRequired
446	*/
447	static fromString(inputScopeString) {
448		return new ScopeSet((inputScopeString || "").split(" "));
449	}
450	/**
451	* Creates the set of scopes to search for in cache lookups
452	* @param inputScopeString
453	* @returns
454	*/
455	static createSearchScopes(inputScopeString) {
456		const scopeSet = new ScopeSet(inputScopeString && inputScopeString.length > 0 ? inputScopeString : [...OIDC_DEFAULT_SCOPES]);
457		if (!scopeSet.containsOnlyOIDCScopes()) scopeSet.removeOIDCScopes();
458		else scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
459		return scopeSet;
460	}
461	/**
462	* Check if a given scope is present in this set of scopes.
463	* @param scope
464	*/
465	containsScope(scope) {
466		const lowerCaseScopesSet = new ScopeSet(this.printScopesLowerCase().split(" "));
467		return scope ? lowerCaseScopesSet.scopes.has(scope.toLowerCase()) : false;
468	}
469	/**
470	* Check if a set of scopes is present in this set of scopes.
471	* @param scopeSet
472	*/
473	containsScopeSet(scopeSet) {
474		if (!scopeSet || scopeSet.scopes.size <= 0) return false;

475		return this.scopes.size >= scopeSet.scopes.size && scopeSet.asArray().every((scope) => this.containsScope(scope));
476	}
477	/**
478	* Check if set of scopes contains only the defaults
479	*/
480	containsOnlyOIDCScopes() {
481		let defaultScopeCount = 0;
482		OIDC_SCOPES.forEach((defaultScope) => {
483			if (this.containsScope(defaultScope)) defaultScopeCount += 1;
484		});
485		return this.scopes.size === defaultScopeCount;
486	}
487	/**
488	* Appends single scope if passed
489	* @param newScope
490	*/
491	appendScope(newScope) {
492		if (newScope) this.scopes.add(newScope.trim());
493	}
494	/**
495	* Appends multiple scopes if passed
496	* @param newScopes
497	*/
498	appendScopes(newScopes) {
499		try {
500			newScopes.forEach((newScope) => this.appendScope(newScope));
501		} catch (e) {
502			throw createClientAuthError(cannotAppendScopeSet);
503		}
504	}
505	/**
506	* Removes element from set of scopes.
507	* @param scope
508	*/
509	removeScope(scope) {
510		if (!scope) throw createClientAuthError(cannotRemoveEmptyScope);
511		this.scopes.delete(scope.trim());
512	}
513	/**
514	* Removes default scopes from set of scopes
515	* Primarily used to prevent cache misses if the default scopes are not returned from the server
516	*/
517	removeOIDCScopes() {
518		OIDC_SCOPES.forEach((defaultScope) => {
519			this.scopes.delete(defaultScope);
520		});
521	}
522	/**
523	* Combines an array of scopes with the current set of scopes.
524	* @param otherScopes
525	*/
526	unionScopeSets(otherScopes) {
527		if (!otherScopes) throw createClientAuthError(emptyInputScopeSet);
528		const unionScopes = /* @__PURE__ */ new Set();
529		otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
530		this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
531		return unionScopes;
532	}
533	/**
534	* Check if scopes intersect between this set and another.
535	* @param otherScopes
536	*/
537	intersectingScopeSets(otherScopes) {
538		if (!otherScopes) throw createClientAuthError(emptyInputScopeSet);
539		if (!otherScopes.containsOnlyOIDCScopes()) otherScopes.removeOIDCScopes();
540		const unionScopes = this.unionScopeSets(otherScopes);
541		const sizeOtherScopes = otherScopes.getScopeCount();
542		const sizeThisScopes = this.getScopeCount();
543		return unionScopes.size < sizeThisScopes + sizeOtherScopes;
544	}
545	/**
546	* Returns size of set of scopes.
547	*/
548	getScopeCount() {
549		return this.scopes.size;
550	}
551	/**
552	* Returns the scopes as an array of string values
553	*/
554	asArray() {
555		const array = [];
556		this.scopes.forEach((val) => array.push(val));
557		return array;
558	}
559	/**
560	* Prints scopes into a space-delimited string
561	*/
562	printScopes() {
563		if (this.scopes) return this.asArray().join(" ");
564		return "";
565	}
566	/**
567	* Prints scopes into a space-delimited lower-case string (used for caching)
568	*/
569	printScopesLowerCase() {
570		return this.printScopes().toLowerCase();
571	}
572};
573//#endregion
574//#region node_modules/@azure/msal-common/dist-browser/request/RequestParameterBuilder.mjs
575/*! @azure/msal-common v16.8.0 2026-06-10 */
576function instrumentBrokerParams(parameters, correlationId, performanceClient) {
577	if (!correlationId) return;
578	const clientId = parameters.get(CLIENT_ID);
579	if (clientId && parameters.has("brk_client_id")) performanceClient?.addFields({
580		embeddedClientId: clientId,
581		embeddedRedirectUri: parameters.get(REDIRECT_URI)
582	}, correlationId);
583}
584/**
585* Add the given response_type
586* @param parameters
587* @param responseType
588*/
589function addResponseType(parameters, responseType) {
590	parameters.set(RESPONSE_TYPE, responseType);
591}
592/**
593* add response_mode. defaults to query.
594* @param responseMode
595*/
596function addResponseMode(parameters, responseMode) {
597	parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
598}
599/**
600* Add flag to indicate STS should attempt to use WAM if available
601*/
602function addNativeBroker(parameters) {
603	parameters.set(NATIVE_BROKER, "1");
604}
605/**
606* add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
607* @param scopeSet
608* @param addOidcScopes
609*/
610function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
611	if (addOidcScopes && !defaultScopes.includes("openid") && !scopes.includes("openid")) defaultScopes.push("openid");
612	const scopeSet = new ScopeSet(addOidcScopes ? [...scopes || [], ...defaultScopes] : scopes || []);
613	parameters.set(SCOPE, scopeSet.printScopes());
614}
615/**
616* add clientId
617* @param clientId
618*/
619function addClientId(parameters, clientId) {
620	parameters.set(CLIENT_ID, clientId);
621}
622/**
623* add redirect_uri
624* @param redirectUri
625*/
626function addRedirectUri(parameters, redirectUri) {
627	parameters.set(REDIRECT_URI, redirectUri);
628}
629/**
630* add post logout redirectUri
631* @param redirectUri
632*/
633function addPostLogoutRedirectUri(parameters, redirectUri) {
634	parameters.set(POST_LOGOUT_URI, redirectUri);
635}
636/**
637* add id_token_hint to logout request
638* @param idTokenHint
639*/
640function addIdTokenHint(parameters, idTokenHint) {
641	parameters.set(ID_TOKEN_HINT, idTokenHint);
642}
643/**
644* add domain_hint
645* @param domainHint
646*/
647function addDomainHint(parameters, domainHint) {
648	parameters.set(DOMAIN_HINT, domainHint);
649}
650/**
651* add login_hint
652* @param loginHint
653*/
654function addLoginHint(parameters, loginHint) {
655	parameters.set(LOGIN_HINT, loginHint);
656}
657/**
658* Adds the CCS (Cache Credential Service) query parameter for login_hint
659* @param loginHint
660*/
661function addCcsUpn(parameters, loginHint) {
662	parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
663}
664/**
665* Adds the CCS (Cache Credential Service) query parameter for account object
666* @param loginHint
667*/
668function addCcsOid(parameters, clientInfo) {
669	parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
670}
671/**
672* add sid
673* @param sid
674*/
675function addSid(parameters, sid) {
676	parameters.set("sid", sid);
677}
678/**
679* Adds claims to request parameters, conditionally excluding clientCapabilities
680* when skipBrokerClaims is true and a brokered flow is in effect.
681* @param parameters - The request parameters map
682* @param claims - The claims string from the request
683* @param clientCapabilities - The client capabilities from configuration
684* @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
685*/
686function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
687	const configClaims = skipBrokerClaims && parameters.has("brk_client_id") ? void 0 : clientCapabilities;
688	if (!StringUtils.isEmptyObj(claims) || configClaims && configClaims.length > 0) {
689		const mergedClaims = addClientCapabilitiesToClaims$1(claims, configClaims);
690		try {
691			JSON.parse(mergedClaims);
692		} catch (e) {
693			throw createClientConfigurationError(invalidClaims);
694		}
695		parameters.set(CLAIMS, mergedClaims);
696	}
697}
698/**
699* add correlationId
700* @param correlationId
701*/
702function addCorrelationId(parameters, correlationId) {
703	parameters.set(CLIENT_REQUEST_ID, correlationId);
704}
705/**
706* add library info query params

707* @param libraryInfo
708*/
709function addLibraryInfo(parameters, libraryInfo) {
710	parameters.set(X_CLIENT_SKU, libraryInfo.sku);
711	parameters.set(X_CLIENT_VER, libraryInfo.version);
712	if (libraryInfo.os) parameters.set(X_CLIENT_OS, libraryInfo.os);
713	if (libraryInfo.cpu) parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
714}
715/**
716* Add client telemetry parameters
717* @param appTelemetry
718*/
719function addApplicationTelemetry(parameters, appTelemetry) {
720	if (appTelemetry?.appName) parameters.set(X_APP_NAME, appTelemetry.appName);
721	if (appTelemetry?.appVersion) parameters.set(X_APP_VER, appTelemetry.appVersion);
722}
723/**
724* add prompt
725* @param prompt
726*/
727function addPrompt(parameters, prompt) {
728	parameters.set(PROMPT, prompt);
729}
730/**
731* add state
732* @param state
733*/
734function addState(parameters, state) {
735	if (state) parameters.set(STATE, state);
736}
737/**
738* add nonce
739* @param nonce
740*/
741function addNonce(parameters, nonce) {
742	parameters.set(NONCE, nonce);
743}
744/**
745* add code_challenge and code_challenge_method
746* - throw if either of them are not passed
747* @param codeChallenge
748* @param codeChallengeMethod
749*/
750function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
751	if (codeChallenge && codeChallengeMethod) {
752		parameters.set(CODE_CHALLENGE, codeChallenge);
753		parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
754	} else throw createClientConfigurationError(pkceParamsMissing);
755}
756/**
757* add the `authorization_code` passed by the user to exchange for a token
758* @param code
759*/
760function addAuthorizationCode(parameters, code) {
761	parameters.set(CODE, code);
762}
763/**
764* add the `refreshToken` passed by the user
765* @param refreshToken
766*/
767function addRefreshToken(parameters, refreshToken) {
768	parameters.set(REFRESH_TOKEN, refreshToken);
769}
770/**
771* add the `code_verifier` passed by the user to exchange for a token
772* @param codeVerifier
773*/
774function addCodeVerifier(parameters, codeVerifier) {
775	parameters.set(CODE_VERIFIER, codeVerifier);
776}
777/**
778* add client_secret
779* @param clientSecret
780*/
781function addClientSecret(parameters, clientSecret) {
782	parameters.set(CLIENT_SECRET, clientSecret);
783}
784/**
785* add clientAssertion for confidential client flows
786* @param clientAssertion
787*/
788function addClientAssertion(parameters, clientAssertion) {
789	if (clientAssertion) parameters.set(CLIENT_ASSERTION, clientAssertion);
790}
791/**
792* add clientAssertionType for confidential client flows
793* @param clientAssertionType
794*/
795function addClientAssertionType(parameters, clientAssertionType) {
796	if (clientAssertionType) parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
797}
798/**
799* add grant type
800* @param grantType
801*/
802function addGrantType(parameters, grantType) {
803	parameters.set(GRANT_TYPE, grantType);
804}
805/**
806* add client info
807*
808*/
809function addClientInfo(parameters) {
810	parameters.set(CLIENT_INFO, "1");
811}
812/**
813* add clidata=1 to request to indicate client data support
814*/
815function addCliData(parameters) {
816	parameters.set(CLI_DATA, "1");
817}
818function addInstanceAware(parameters) {
819	if (!parameters.has("instance_aware")) parameters.set(INSTANCE_AWARE, "true");
820}
821/**
822* Add extraParameters
823* @param extraParams - String dictionary containing extra parameters to be added.
824*/
825function addExtraParameters(parameters, extraParams) {
826	Object.entries(extraParams).forEach(([key, value]) => {
827		if (!parameters.has(key) && value) parameters.set(key, value);
828	});
829}
830function addClientCapabilitiesToClaims$1(claims, clientCapabilities) {
831	let mergedClaims;
832	if (!claims) mergedClaims = {};
833	else try {
834		mergedClaims = JSON.parse(claims);
835	} catch (e) {
836		throw createClientConfigurationError(invalidClaims);
837	}
838	if (clientCapabilities && clientCapabilities.length > 0) {
839		if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
840		mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = { values: clientCapabilities };
841	}
842	return JSON.stringify(mergedClaims);
843}
844/**
845* add pop_jwk to query params
846* @param cnfString
847*/
848function addPopToken(parameters, cnfString) {
849	if (cnfString) {
850		parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
851		parameters.set(REQ_CNF, cnfString);
852	}
853}
854/**

855* add SSH JWK and key ID to query params
856*/
857function addSshJwk(parameters, sshJwkString) {
858	if (sshJwkString) {
859		parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
860		parameters.set(REQ_CNF, sshJwkString);
861	}
862}
863/**
864* add server telemetry fields
865* @param serverTelemetryManager
866*/
867function addServerTelemetry(parameters, serverTelemetryManager) {
868	const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
869	const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
870	if (currentTelemetryHeader) parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
871	if (lastTelemetryHeader) parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
872}
873/**
874* Adds parameter that indicates to the server that throttling is supported
875*/
876function addThrottling(parameters) {
877	parameters.set(X_MS_LIB_CAPABILITY, X_MS_LIB_CAPABILITY_VALUE);
878}
879/**
880* Adds logout_hint parameter for "silent" logout which prevent server account picker
881*/
882function addLogoutHint(parameters, logoutHint) {
883	parameters.set(LOGOUT_HINT, logoutHint);
884}
885function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
886	if (!parameters.has("brk_client_id")) parameters.set(BROKER_CLIENT_ID, brokerClientId);
887	if (!parameters.has("brk_redirect_uri")) parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
888}
889/**
890* Add EAR (Encrypted Authorize Response) request parameters
891* @param parameters
892* @param jwk
893*/
894function addEARParameters(parameters, jwk) {
895	parameters.set(EAR_JWK, encodeURIComponent(jwk));
896	parameters.set(EAR_JWE_CRYPTO, "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0");
897}
898function addResource(parameters, resource) {
899	if (resource) parameters.set(RESOURCE, resource);
900}
901//#endregion
902//#region node_modules/@azure/msal-common/dist-browser/utils/UrlUtils.mjs
903/*! @azure/msal-common v16.8.0 2026-06-10 */
904/**
905* Parses hash string from given string. Returns empty string if no hash symbol is found.
906* @param hashString
907*/
908function stripLeadingHashOrQuery(responseString) {
909	if (responseString.startsWith("#/")) return responseString.substring(2);
910	else if (responseString.startsWith("#") || responseString.startsWith("?")) return responseString.substring(1);
911	return responseString;
912}
913/**
914* Returns URL hash as server auth code response object.
915*/
916function getDeserializedResponse(responseString) {
917	if (!responseString || responseString.indexOf("=") < 0) return null;
918	try {
919		const normalizedResponse = stripLeadingHashOrQuery(responseString);
920		const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
921		if (deserializedHash.code || deserializedHash.ear_jwe || deserializedHash.error || deserializedHash.error_description || deserializedHash.state) return deserializedHash;
922	} catch (e) {
923		throw createClientAuthError(hashNotDeserialized);
924	}
925	return null;
926}
927/**
928* Utility to create a URL from the params map
929*/
930function mapToQueryString(parameters) {
931	const queryParameterArray = new Array();
932	parameters.forEach((value, key) => {
933		queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
934	});
935	return queryParameterArray.join("&");
936}
937/**
938* Normalizes URLs for comparison per MDN & RFC 3986 standards:
939* - Hash/fragment is removed
940* - Scheme and host are lowercased (case-insensitive per spec)
941* - Path and query parameters preserve original casing (case-sensitive per spec)
942* - Percent-encoding in pathname is normalized (e.g., %27 and ' are treated equivalently)
943* - Ensures pathname ends with /
944* Throws a urlParseError if the provided URL is malformed and cannot be parsed.
945* @param url - URL to normalize
946* @param logger - Optional logger used to log parse failures
947* @param correlationId - Optional correlationId associated with the log entry
948* @returns Normalized URL string for comparison
949*/
950function normalizeUrlForComparison(url, logger, correlationId) {
951	if (!url) return url;
952	const urlWithoutHash = url.split("#")[0];
953	if (!urlWithoutHash) return urlWithoutHash;
954	try {
955		const urlObj = new URL(urlWithoutHash);
956		if (!urlObj.search) urlObj.search = "";
957		let pathname;
958		try {
959			pathname = decodeURIComponent(urlObj.pathname);
960		} catch (e) {
961			pathname = urlObj.pathname;
962		}
963		if (!pathname.endsWith("/")) pathname += "/";
964		urlObj.pathname = pathname;
965		return urlObj.href;
966	} catch (e) {
967		logger?.error("15apdm", correlationId || "");
968		throw createClientConfigurationError(urlParseError);
969	}
970}
971/**
972* Validates that the provided value is a well-formed, parseable absolute URL.
973* Throws a urlParseError if the value cannot be parsed by the URL API (e.g. the
974* literal string "null", an empty string, or any malformed/relative URL). Use this

975* to guard against persisting an invalid value (such as a redirect URL) to the cache.
976* @param url - URL to validate
977* @param logger - Optional logger used to log validation failures
978* @param correlationId - Optional correlationId associated with the log entry
979*/
980function validateUrl(url, logger, correlationId) {
981	try {
982		new URL(url);
983	} catch (e) {
984		logger?.error("1lrjz7", correlationId || "");
985		throw createClientConfigurationError(urlParseError);
986	}
987}
988//#endregion
989//#region node_modules/@azure/msal-common/dist-browser/crypto/ICrypto.mjs
990/*! @azure/msal-common v16.8.0 2026-06-10 */
991var DEFAULT_CRYPTO_IMPLEMENTATION = {
992	createNewGuid: () => {
993		throw createClientAuthError(methodNotImplemented);
994	},
995	base64Decode: () => {
996		throw createClientAuthError(methodNotImplemented);
997	},
998	base64Encode: () => {
999		throw createClientAuthError(methodNotImplemented);
1000	},
1001	base64UrlEncode: () => {
1002		throw createClientAuthError(methodNotImplemented);
1003	},
1004	encodeKid: () => {
1005		throw createClientAuthError(methodNotImplemented);
1006	},
1007	async getPublicKeyThumbprint() {
1008		throw createClientAuthError(methodNotImplemented);
1009	},
1010	async removeTokenBindingKey() {
1011		throw createClientAuthError(methodNotImplemented);
1012	},
1013	async clearKeystore() {
1014		throw createClientAuthError(methodNotImplemented);
1015	},
1016	async signJwt() {
1017		throw createClientAuthError(methodNotImplemented);
1018	},
1019	async hashString() {
1020		throw createClientAuthError(methodNotImplemented);
1021	}
1022};
1023//#endregion
1024//#region node_modules/@azure/msal-common/dist-browser/logger/Logger.mjs
1025/*! @azure/msal-common v16.8.0 2026-06-10 */
1026/**
1027* Log message level.
1028*/
1029var LogLevel;
1030(function(LogLevel) {
1031	LogLevel[LogLevel["Error"] = 0] = "Error";
1032	LogLevel[LogLevel["Warning"] = 1] = "Warning";
1033	LogLevel[LogLevel["Info"] = 2] = "Info";
1034	LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
1035	LogLevel[LogLevel["Trace"] = 4] = "Trace";
1036})(LogLevel || (LogLevel = {}));
1037var CACHE_CAPACITY = 50;
1038var MAX_LOGS_PER_CORRELATION = 500;
1039var correlationCache = /* @__PURE__ */ new Map();
1040/**
1041* Mark correlation ID as recently used by moving it to end of Map
1042* @param correlationId
1043* @param {CorrelationLogData} data
1044*/
1045function markAsRecentlyUsed(correlationId, data) {
1046	correlationCache.delete(correlationId);
1047	correlationCache.set(correlationId, data);
1048}
1049/**
1050* Add log message to cache for specific correlation ID
1051* @param correlationId
1052* @param {LoggedMessage} loggedMessage
1053*/
1054function addLogToCache(correlationId, loggedMessage) {
1055	const currentTime = Date.now();
1056	let data = correlationCache.get(correlationId);
1057	if (data) markAsRecentlyUsed(correlationId, data);
1058	else {
1059		data = {
1060			logs: [],
1061			firstEventTime: currentTime
1062		};
1063		correlationCache.set(correlationId, data);
1064		if (correlationCache.size > CACHE_CAPACITY) {
1065			const firstKey = correlationCache.keys().next().value;
1066			if (firstKey !== void 0) correlationCache.delete(firstKey);
1067		}
1068	}
1069	data.logs.push({
1070		...loggedMessage,
1071		milliseconds: currentTime - data.firstEventTime
1072	});
1073	if (data.logs.length > MAX_LOGS_PER_CORRELATION) data.logs.shift();
1074}
1075/**
1076* Checks if a string is already a hashed logging string (6 alphanumeric characters)
1077*/
1078function isHashedString(str) {
1079	if (str.length !== 6) return false;
1080	for (let i = 0; i < str.length; i++) {
1081		const char = str[i];
1082		if (!(char >= "a" && char <= "z" || char >= "A" && char <= "Z" || char >= "0" && char <= "9")) return false;
1083	}
1084	return true;
1085}
1086/**
1087* Class which facilitates logging of messages to a specific place.
1088*/
1089var Logger = class Logger {
1090	constructor(loggerOptions, packageName, packageVersion) {
1091		this.level = LogLevel.Info;
1092		const defaultLoggerCallback = () => {};
1093		const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
1094		this.localCallback = setLoggerOptions.loggerCallback || defaultLoggerCallback;
1095		this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
1096		this.level = typeof setLoggerOptions.logLevel === "number" ? setLoggerOptions.logLevel : LogLevel.Info;
1097		this.packageName = packageName || "";
1098		this.packageVersion = packageVersion || "";
1099	}
1100	static createDefaultLoggerOptions() {
1101		return {
1102			loggerCallback: () => {},
1103			piiLoggingEnabled: false,
1104			logLevel: LogLevel.Info
1105		};
1106	}
1107	/**
1108	* Create new Logger with existing configurations.
1109	*/
1110	clone(packageName, packageVersion) {
1111		return new Logger({
1112			loggerCallback: this.localCallback,
1113			piiLoggingEnabled: this.piiLoggingEnabled,
1114			logLevel: this.level
1115		}, packageName, packageVersion);
1116	}
1117	/**
1118	* Log message with required options.
1119	*/
1120	logMessage(logMessage, options) {
1121		const correlationId = options.correlationId;
1122		if (isHashedString(logMessage)) addLogToCache(correlationId, {
1123			hash: logMessage,
1124			level: options.logLevel,
1125			containsPii: options.containsPii || false,
1126			milliseconds: 0
1127		});
1128		if (options.logLevel > this.level || !this.piiLoggingEnabled && options.containsPii) return;
1129		const log = `${`[${(/* @__PURE__ */ new Date()).toUTCString()}] : [${correlationId}]`} : ${this.packageName}@${this.packageVersion} : ${LogLevel[options.logLevel]} - ${logMessage}`;
1130		this.executeCallback(options.logLevel, log, options.containsPii || false);
1131	}
1132	/**
1133	* Execute callback with message.
1134	*/
1135	executeCallback(level, message, containsPii) {
1136		if (this.localCallback) this.localCallback(level, message, containsPii);
1137	}
1138	/**
1139	* Logs error messages.
1140	*/
1141	error(message, correlationId) {
1142		this.logMessage(message, {
1143			logLevel: LogLevel.Error,
1144			containsPii: false,
1145			correlationId
1146		});
1147	}
1148	/**
1149	* Logs error messages with PII.
1150	*/
1151	errorPii(message, correlationId) {
1152		this.logMessage(message, {
1153			logLevel: LogLevel.Error,
1154			containsPii: true,
1155			correlationId
1156		});
1157	}
1158	/**

1159	* Logs warning messages.
1160	*/
1161	warning(message, correlationId) {
1162		this.logMessage(message, {
1163			logLevel: LogLevel.Warning,
1164			containsPii: false,
1165			correlationId
1166		});
1167	}
1168	/**
1169	* Logs warning messages with PII.
1170	*/
1171	warningPii(message, correlationId) {
1172		this.logMessage(message, {
1173			logLevel: LogLevel.Warning,
1174			containsPii: true,
1175			correlationId
1176		});
1177	}
1178	/**
1179	* Logs info messages.
1180	*/
1181	info(message, correlationId) {
1182		this.logMessage(message, {
1183			logLevel: LogLevel.Info,
1184			containsPii: false,
1185			correlationId
1186		});
1187	}
1188	/**
1189	* Logs info messages with PII.
1190	*/
1191	infoPii(message, correlationId) {
1192		this.logMessage(message, {
1193			logLevel: LogLevel.Info,
1194			containsPii: true,
1195			correlationId
1196		});
1197	}
1198	/**
1199	* Logs verbose messages.
1200	*/
1201	verbose(message, correlationId) {
1202		this.logMessage(message, {
1203			logLevel: LogLevel.Verbose,
1204			containsPii: false,
1205			correlationId
1206		});
1207	}
1208	/**
1209	* Logs verbose messages with PII.
1210	*/
1211	verbosePii(message, correlationId) {
1212		this.logMessage(message, {
1213			logLevel: LogLevel.Verbose,
1214			containsPii: true,
1215			correlationId
1216		});
1217	}
1218	/**
1219	* Logs trace messages.
1220	*/
1221	trace(message, correlationId) {
1222		this.logMessage(message, {
1223			logLevel: LogLevel.Trace,
1224			containsPii: false,
1225			correlationId
1226		});
1227	}
1228	/**
1229	* Logs trace messages with PII.
1230	*/
1231	tracePii(message, correlationId) {
1232		this.logMessage(message, {
1233			logLevel: LogLevel.Trace,
1234			containsPii: true,
1235			correlationId
1236		});
1237	}
1238	/**
1239	* Returns whether PII Logging is enabled or not.
1240	*/
1241	isPiiLoggingEnabled() {
1242		return this.piiLoggingEnabled || false;
1243	}
1244};
1245//#endregion
1246//#region node_modules/@azure/msal-common/dist-browser/packageMetadata.mjs
1247/*! @azure/msal-common v16.8.0 2026-06-10 */
1248var name$1 = "@azure/msal-common";
1249var version$1 = "16.8.0";
1250//#endregion
1251//#region node_modules/@azure/msal-common/dist-browser/authority/AuthorityOptions.mjs
1252/*! @azure/msal-common v16.8.0 2026-06-10 */
1253var AzureCloudInstance = {
1254	None: "none",
1255	AzurePublic: "https://login.microsoftonline.com",
1256	AzurePpe: "https://login.windows-ppe.net",
1257	AzureChina: "https://login.chinacloudapi.cn",
1258	AzureGermany: "https://login.microsoftonline.de",
1259	AzureUsGovernment: "https://login.microsoftonline.us"
1260};
1261//#endregion
1262//#region node_modules/@azure/msal-common/dist-browser/account/AccountInfo.mjs
1263/*! @azure/msal-common v16.8.0 2026-06-10 */
1264/**
1265* Returns true if tenantId matches the utid portion of homeAccountId
1266* @param tenantId
1267* @param homeAccountId
1268* @returns
1269*/
1270function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
1271	return !!tenantId && !!homeAccountId && tenantId === homeAccountId.split(".")[1];
1272}
1273/**
1274* Build tenant profile
1275* @param homeAccountId - Home account identifier for this account object
1276* @param localAccountId - Local account identifer for this account object
1277* @param tenantId - Full tenant or organizational id that this account belongs to
1278* @param idTokenClaims - Claims from the ID token
1279* @returns
1280*/
1281function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
1282	if (idTokenClaims) {
1283		const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint } = idTokenClaims;
1284		/**
1285		* Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
1286		* tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
1287		* tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
1288		* acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
1289		*/
1290		const tenantId = tid || tfp || acr || "";
1291		return {
1292			tenantId,
1293			localAccountId: oid || sub || "",
1294			name,
1295			username: preferred_username || upn || "",
1296			loginHint: login_hint,
1297			isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
1298			upn
1299		};
1300	} else return {
1301		tenantId,
1302		localAccountId,
1303		username: "",
1304		isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId)
1305	};
1306}
1307/**
1308* Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
1309* @param baseAccountInfo
1310* @param idTokenClaims
1311* @returns
1312*/
1313function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {

1314	let updatedAccountInfo = baseAccountInfo;
1315	if (tenantProfile) {
1316		const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
1317		updatedAccountInfo = {
1318			...baseAccountInfo,
1319			...tenantProfileOverride
1320		};
1321	}
1322	if (idTokenClaims) {
1323		const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
1324		updatedAccountInfo = {
1325			...updatedAccountInfo,
1326			...claimsSourcedTenantProfile,
1327			idTokenClaims,
1328			idToken: idTokenSecret
1329		};
1330		return updatedAccountInfo;
1331	}
1332	return updatedAccountInfo;
1333}
1334//#endregion
1335//#region node_modules/@azure/msal-common/dist-browser/account/AuthToken.mjs
1336/*! @azure/msal-common v16.8.0 2026-06-10 */
1337/**
1338* Extract token by decoding the rawToken
1339*
1340* @param encodedToken
1341*/
1342function extractTokenClaims(encodedToken, base64Decode) {
1343	const jswPayload = getJWSPayload(encodedToken);
1344	try {
1345		const base64Decoded = base64Decode(jswPayload);
1346		return JSON.parse(base64Decoded);
1347	} catch (err) {
1348		throw createClientAuthError(tokenParsingError);
1349	}
1350}
1351/**
1352* Check if the signin_state claim contains "kmsi"
1353* @param idTokenClaims
1354* @returns
1355*/
1356function isKmsi(idTokenClaims) {
1357	if (!idTokenClaims.signin_state) return false;
1358	/**
1359	* Signin_state claim known values:
1360	* dvc_mngd - device is managed
1361	* dvc_dmjd - device is domain joined
1362	* kmsi - user opted to "keep me signed in"
1363	* inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
1364	*/
1365	const kmsiClaims = ["kmsi", "dvc_dmjd"];
1366	return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
1367}
1368/**
1369* decode a JWT
1370*
1371* @param authToken
1372*/
1373function getJWSPayload(authToken) {
1374	if (!authToken) throw createClientAuthError(nullOrEmptyToken);
1375	const matches = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/.exec(authToken);
1376	if (!matches || matches.length < 4) throw createClientAuthError(tokenParsingError);
1377	/**
1378	* const crackedToken = {
1379	*  header: matches[1],
1380	*  JWSPayload: matches[2],
1381	*  JWSSig: matches[3],
1382	* };
1383	*/
1384	return matches[2];
1385}
1386/**
1387* Determine if the token's max_age has transpired
1388*/
1389function checkMaxAge(authTime, maxAge) {
1390	if (maxAge === 0 || Date.now() - 3e5 > authTime + maxAge) throw createClientAuthError(maxAgeTranspired);
1391}
1392//#endregion
1393//#region node_modules/@azure/msal-common/dist-browser/url/UrlString.mjs
1394/*! @azure/msal-common v16.8.0 2026-06-10 */
1395/**
1396* Url object class which can perform various transformations on url strings.
1397*/
1398var UrlString = class UrlString {
1399	get urlString() {
1400		return this._urlString;
1401	}
1402	constructor(url) {
1403		this._urlString = url;
1404		if (!this._urlString) throw createClientConfigurationError(urlEmptyError);
1405		if (!url.includes("#")) this._urlString = UrlString.canonicalizeUri(url);
1406	}
1407	/**
1408	* Ensure urls are lower case and end with a / character.
1409	* @param url
1410	*/
1411	static canonicalizeUri(url) {
1412		if (url) {
1413			let lowerCaseUrl = url.toLowerCase();
1414			if (StringUtils.endsWith(lowerCaseUrl, "?")) lowerCaseUrl = lowerCaseUrl.slice(0, -1);
1415			else if (StringUtils.endsWith(lowerCaseUrl, "?/")) lowerCaseUrl = lowerCaseUrl.slice(0, -2);
1416			if (!StringUtils.endsWith(lowerCaseUrl, "/")) lowerCaseUrl += "/";
1417			return lowerCaseUrl;
1418		}
1419		return url;
1420	}
1421	/**
1422	* Throws if urlString passed is not a valid authority URI string.
1423	*/
1424	validateAsUri() {
1425		let components;
1426		try {
1427			components = this.getUrlComponents();
1428		} catch (e) {
1429			throw createClientConfigurationError(urlParseError);
1430		}
1431		if (!components.HostNameAndPort || !components.PathSegments) throw createClientConfigurationError(urlParseError);
1432		if (!components.Protocol || components.Protocol.toLowerCase() !== "https:") throw createClientConfigurationError(authorityUriInsecure);
1433	}
1434	/**
1435	* Given a url and a query string return the url with provided query string appended
1436	* @param url
1437	* @param queryString
1438	*/
1439	static appendQueryString(url, queryString) {
1440		if (!queryString) return url;
1441		return url.indexOf("?") < 0 ? `${url}?${queryString}` : `${url}&${queryString}`;
1442	}
1443	/**
1444	* Returns a url with the hash removed
1445	* @param url
1446	*/
1447	static removeHashFromUrl(url) {
1448		return UrlString.canonicalizeUri(url.split("#")[0]);
1449	}
1450	/**
1451	* Given a url like https://a:b/common/d?e=f#g, and a tenantId, returns https://a:b/tenantId/d
1452	* @param href The url
1453	* @param tenantId The tenant id to replace
1454	*/
1455	replaceTenantPath(tenantId) {
1456		const urlObject = this.getUrlComponents();
1457		const pathArray = urlObject.PathSegments;
1458		if (tenantId && pathArray.length !== 0 && (pathArray[0] === AADAuthority.COMMON || pathArray[0] === AADAuthority.ORGANIZATIONS)) pathArray[0] = tenantId;
1459		return UrlString.constructAuthorityUriFromObject(urlObject);
1460	}
1461	/**
1462	* Parses out the components from a url string.
1463	* @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
1464	*/
1465	getUrlComponents() {
1466		const regEx = RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
1467		const match = this.urlString.match(regEx);
1468		if (!match) throw createClientConfigurationError(urlParseError);
1469		const urlComponents = {
1470			Protocol: match[1],
1471			HostNameAndPort: match[4],
1472			AbsolutePath: match[5],
1473			QueryString: match[7]
1474		};
1475		let pathSegments = urlComponents.AbsolutePath.split("/");
1476		pathSegments = pathSegments.filter((val) => val && val.length > 0);
1477		urlComponents.PathSegments = pathSegments;
1478		if (urlComponents.QueryString && urlComponents.QueryString.endsWith("/")) urlComponents.QueryString = urlComponents.QueryString.substring(0, urlComponents.QueryString.length - 1);
1479		return urlComponents;
1480	}
1481	static getDomainFromUrl(url) {
1482		const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
1483		const match = url.match(regEx);
1484		if (!match) throw createClientConfigurationError(urlParseError);
1485		return match[2];
1486	}
1487	static getAbsoluteUrl(relativeUrl, baseUrl) {
1488		if (relativeUrl[0] === "/") {
1489			const baseComponents = new UrlString(baseUrl).getUrlComponents();
1490			return baseComponents.Protocol + "//" + baseComponents.HostNameAndPort + relativeUrl;
1491		}
1492		return relativeUrl;
1493	}
1494	static constructAuthorityUriFromObject(urlObject) {
1495		return new UrlString(urlObject.Protocol + "//" + urlObject.HostNameAndPort + "/"

1495+ urlObject.PathSegments.join("/"));
1496	}
1497};
1498//#endregion
1499//#region node_modules/@azure/msal-common/dist-browser/authority/AuthorityMetadata.mjs
1500/*! @azure/msal-common v16.8.0 2026-06-10 */
1501var endpointHosts = [
1502	{ host: "login.microsoftonline.com" },
1503	{
1504		host: "login.chinacloudapi.cn",
1505		issuerHost: "login.partner.microsoftonline.cn"
1506	},
1507	{ host: "login.microsoftonline.us" },
1508	{ host: "login.sovcloud-identity.fr" },
1509	{ host: "login.sovcloud-identity.de" },
1510	{ host: "login.sovcloud-identity.sg" }
1511];
1512function buildOpenIdConfig(host, issuerHost) {
1513	return {
1514		token_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/token`,
1515		jwks_uri: `https://${host}/{tenantid}/discovery/v2.0/keys`,
1516		issuer: `https://${issuerHost}/{tenantid}/v2.0`,
1517		authorization_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/authorize`,
1518		end_session_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/logout`
1519	};
1520}
1521var rawMetdataJSON = {
1522	endpointMetadata: endpointHosts.reduce((acc, { host, issuerHost }) => {
1523		acc[host] = buildOpenIdConfig(host, issuerHost || host);
1524		return acc;
1525	}, {}),
1526	instanceDiscoveryMetadata: { metadata: [
1527		{
1528			preferred_network: "login.microsoftonline.com",
1529			preferred_cache: "login.windows.net",
1530			aliases: [
1531				"login.microsoftonline.com",
1532				"login.windows.net",
1533				"login.microsoft.com",
1534				"sts.windows.net"
1535			]
1536		},
1537		{
1538			preferred_network: "login.partner.microsoftonline.cn",
1539			preferred_cache: "login.partner.microsoftonline.cn",
1540			aliases: ["login.partner.microsoftonline.cn", "login.chinacloudapi.cn"]
1541		},
1542		{
1543			preferred_network: "login.microsoftonline.de",
1544			preferred_cache: "login.microsoftonline.de",
1545			aliases: ["login.microsoftonline.de"]
1546		},
1547		{
1548			preferred_network: "login.microsoftonline.us",
1549			preferred_cache: "login.microsoftonline.us",
1550			aliases: ["login.microsoftonline.us", "login.usgovcloudapi.net"]
1551		},
1552		{
1553			preferred_network: "login-us.microsoftonline.com",
1554			preferred_cache: "login-us.microsoftonline.com",
1555			aliases: ["login-us.microsoftonline.com"]
1556		},
1557		{
1558			preferred_network: "login.sovcloud-identity.fr",
1559			preferred_cache: "login.sovcloud-identity.fr",
1560			aliases: ["login.sovcloud-identity.fr"]
1561		},
1562		{
1563			preferred_network: "login.sovcloud-identity.de",
1564			preferred_cache: "login.sovcloud-identity.de",
1565			aliases: ["login.sovcloud-identity.de"]
1566		},
1567		{
1568			preferred_network: "login.sovcloud-identity.sg",
1569			preferred_cache: "login.sovcloud-identity.sg",
1570			aliases: ["login.sovcloud-identity.sg"]
1571		},
1572		{
1573			preferred_network: "login.windows-ppe.net",
1574			preferred_cache: "login.windows-ppe.net",
1575			aliases: [
1576				"login.windows-ppe.net",
1577				"sts.windows-ppe.net",
1578				"login.microsoft-ppe.com"
1579			]
1580		}
1581	] }
1582};
1583var EndpointMetadata = rawMetdataJSON.endpointMetadata;
1584var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
1585var InstanceDiscoveryMetadataAliases = /* @__PURE__ */ new Set();
1586InstanceDiscoveryMetadata.metadata.forEach((metadataEntry) => {
1587	metadataEntry.aliases.forEach((alias) => {
1588		InstanceDiscoveryMetadataAliases.add(alias);
1589	});
1590});
1591/**
1592* Attempts to get an aliases array from the static authority metadata sources based on the canonical authority host
1593* @param staticAuthorityOptions
1594* @param logger
1595* @returns
1596*/
1597function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlationId) {
1598	let staticAliases;
1599	const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
1600	if (canonicalAuthority) {
1601		const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
1602		staticAliases = getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata) || getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata) || staticAuthorityOptions.knownAuthorities;
1603	}
1604	return staticAliases || [];
1605}
1606/**
1607* Returns aliases for from the raw cloud discovery metadata passed in
1608* @param authorityHost
1609* @param rawCloudDiscoveryMetadata
1610* @returns
1611*/
1612function getAliasesFromMetadata(logger, correlationId, authorityHost, cloudDiscoveryMetadata, source) {
1613	logger.trace("1bmquz", correlationId);
1614	if (authorityHost && cloudDiscoveryMetadata) {
1615		const metadata = getCloudDiscoveryMetadataFromNetworkResponse(cloudDiscoveryMetadata, authorityHost);
1616		if (metadata) {
1617			logger.trace("1fotbt", correlationId);
1618			return metadata.aliases;
1619		} else logger.trace("14avvj", correlationId);
1620	}
1621	return null;
1622}
1623/**
1624* Get cloud discovery metadata for common authorities
1625*/
1626function getCloudDiscoveryMetadataFromHardcodedValues(authorityHost) {
1627	return getCloudDiscoveryMetadataFromNetworkResponse(InstanceDiscoveryMetadata.metadata, authorityHost);
1628}
1629/**
1630* Searches instance discovery network response for the entry that contains the host in the aliases list
1631* @param response
1632* @param authority
1633*/
1634function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
1635	for (let i = 0; i < response.length; i++) {
1636		const metadata = response[i];
1637		if (metadata.aliases.includes(authorityHost)) return metadata;
1638	}
1639	return null;
1640}
1641//#endregion
1642//#region node_modules/@azure/msal-common/dist-browser/error/CacheErrorCodes.mjs
1643/*! @azure/msal-common v16.8.0 2026-06-10 */
1644var cacheQuotaExceeded = "cache_quota_exceeded";
1645var cacheErrorUnknown = "cache_error_unknown";
1646//#endregion
1647//#region node_modules/@azure/msal-common/dist-browser/error/CacheError.mjs
1648/*! @azure/msal-common v16.8.0 2026-06-10 */
1649/**
1650* Error thrown when there is an error with the cache
1651*/

1652var CacheError = class CacheError extends Error {
1653	constructor(errorCode, errorMessage) {
1654		const message = errorMessage || getDefaultErrorMessage$1(errorCode);
1655		super(message);
1656		Object.setPrototypeOf(this, CacheError.prototype);
1657		this.name = "CacheError";
1658		this.errorCode = errorCode;
1659		this.errorMessage = message;
1660	}
1661};
1662/**
1663* Helper function to wrap browser errors in a CacheError object
1664* @param e
1665* @returns
1666*/
1667function createCacheError(e) {
1668	if (!(e instanceof Error)) return new CacheError(cacheErrorUnknown);
1669	if (e.name === "QuotaExceededError" || e.name === "NS_ERROR_DOM_QUOTA_REACHED" || e.message.includes("exceeded the quota")) return new CacheError(cacheQuotaExceeded);
1670	else return new CacheError(e.name, e.message);
1671}
1672//#endregion
1673//#region node_modules/@azure/msal-common/dist-browser/account/ClientInfo.mjs
1674/*! @azure/msal-common v16.8.0 2026-06-10 */
1675/**
1676* Function to build a client info object from server clientInfo string
1677* @param rawClientInfo
1678* @param crypto
1679*/
1680function buildClientInfo(rawClientInfo, base64Decode) {
1681	if (!rawClientInfo) throw createClientAuthError(clientInfoEmptyError);
1682	try {
1683		const decodedClientInfo = base64Decode(rawClientInfo);
1684		return JSON.parse(decodedClientInfo);
1685	} catch (e) {
1686		throw createClientAuthError(clientInfoDecodingError);
1687	}
1688}
1689/**
1690* Function to build a client info object from cached homeAccountId string
1691* @param homeAccountId
1692*/
1693function buildClientInfoFromHomeAccountId(homeAccountId) {
1694	if (!homeAccountId) throw createClientAuthError(clientInfoDecodingError);
1695	const clientInfoParts = homeAccountId.split(".", 2);
1696	return {
1697		uid: clientInfoParts[0],
1698		utid: clientInfoParts.length < 2 ? "" : clientInfoParts[1]
1699	};
1700}
1701//#endregion
1702//#region node_modules/@azure/msal-common/dist-browser/authority/AuthorityType.mjs
1703/*! @azure/msal-common v16.8.0 2026-06-10 */
1704/**
1705* Authority types supported by MSAL.
1706*/
1707var AuthorityType = {
1708	Default: 0,
1709	Adfs: 1,
1710	Dsts: 2,
1711	Ciam: 3
1712};
1713//#endregion
1714//#region node_modules/@azure/msal-common/dist-browser/account/TokenClaims.mjs
1715/*! @azure/msal-common v16.8.0 2026-06-10 */
1716/**
1717* Gets tenantId from available ID token claims to set as credential realm with the following precedence:
1718* 1. tid - if the token is acquired from an Azure AD tenant tid will be present
1719* 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
1720* 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
1721* Downcased to match the realm case-insensitive comparison requirements
1722* @param idTokenClaims
1723* @returns
1724*/
1725function getTenantIdFromIdTokenClaims(idTokenClaims) {
1726	if (idTokenClaims) return idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr || null;
1727	return null;
1728}
1729//#endregion
1730//#region node_modules/@azure/msal-common/dist-browser/authority/ProtocolMode.mjs
1731/*! @azure/msal-common v16.8.0 2026-06-10 */
1732/**
1733* Protocol modes supported by MSAL.
1734*/
1735var ProtocolMode = {
1736	/**
1737	* Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
1738	*/
1739	AAD: "AAD",
1740	/**
1741	* Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
1742	* Support is limited for this mode.
1743	*/
1744	OIDC: "OIDC",
1745	/**
1746	* Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
1747	*/
1748	EAR: "EAR"
1749};
1750//#endregion
1751//#region node_modules/@azure/msal-common/dist-browser/cache/utils/AccountEntityUtils.mjs
1752/*! @azure/msal-common v16.8.0 2026-06-10 */
1753/**
1754* Returns the AccountInfo interface for this account.
1755*/
1756function getAccountInfo(accountEntity) {
1757	const tenantProfiles = accountEntity.tenantProfiles || [];
1758	if (tenantProfiles.length === 0 && accountEntity.realm && accountEntity.localAccountId) tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
1759	return {
1760		homeAccountId: accountEntity.homeAccountId,
1761		environment: accountEntity.environment,
1762		tenantId: accountEntity.realm,
1763		username: accountEntity.username,
1764		localAccountId: accountEntity.localAccountId,
1765		loginHint: accountEntity.loginHint,
1766		name: accountEntity.name,
1767		nativeAccountId: accountEntity.nativeAccountId,
1768		authorityType: accountEntity.authorityType,
1769		tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
1770			return [tenantProfile.tenantId, tenantProfile];
1771		})),
1772		dataBoundary: accountEntity.dataBoundary
1773	};
1774}
1775/**
1776* Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
1777* @param accountDetails
1778*/
1779function createAccountEntity(accountDetails, authority, base64Decode) {
1780	let authorityType;
1781	if (authority.authorityType === AuthorityType.Adfs) authorityType = CACHE_ACCOUNT_TYPE_ADFS;
1782	else if (authority.protocolMode === ProtocolMode.OIDC) authorityType = CACHE_ACCOUNT_TYPE_GENERIC;
1783	else authorityType = CACHE_ACCOUNT_TYPE_MSSTS;
1784	let clientInfo;
1785	let dataBoundary;
1786	if (accountDetails.clientInfo && base64Decode) {
1787		clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
1788		if (clientInfo.xms_tdbr) dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
1789	}
1790	const env = accountDetails.environment || authority && authority.getPreferredCache();

1791	if (!env) throw createClientAuthError(invalidCacheEnvironment);
1792	const preferredUsername = accountDetails.idTokenClaims?.preferred_username || accountDetails.idTokenClaims?.upn;
1793	const email = accountDetails.idTokenClaims?.emails ? accountDetails.idTokenClaims.emails[0] : null;
1794	const username = preferredUsername || email || "";
1795	const loginHint = accountDetails.idTokenClaims?.login_hint;
1796	const realm = clientInfo?.utid || getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) || "";
1797	const localAccountId = clientInfo?.uid || accountDetails.idTokenClaims?.oid || accountDetails.idTokenClaims?.sub || "";
1798	let tenantProfiles;
1799	if (accountDetails.tenantProfiles) tenantProfiles = accountDetails.tenantProfiles;
1800	else tenantProfiles = [buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims)];
1801	return {
1802		homeAccountId: accountDetails.homeAccountId,
1803		environment: env,
1804		realm,
1805		localAccountId,
1806		username,
1807		authorityType,
1808		loginHint,
1809		clientInfo: accountDetails.clientInfo,
1810		name: accountDetails.idTokenClaims?.name || "",
1811		lastModificationTime: void 0,
1812		lastModificationApp: void 0,
1813		cloudGraphHostName: accountDetails.cloudGraphHostName,
1814		msGraphHost: accountDetails.msGraphHost,
1815		nativeAccountId: accountDetails.nativeAccountId,
1816		tenantProfiles,
1817		dataBoundary
1818	};
1819}
1820/**
1821* Creates an AccountEntity object from AccountInfo
1822* @param accountInfo
1823* @param cloudGraphHostName
1824* @param msGraphHost
1825* @returns
1826*/
1827function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
1828	const tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
1829	if (tenantProfiles.length === 0 && accountInfo.tenantId && accountInfo.localAccountId) tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
1830	return {
1831		authorityType: accountInfo.authorityType || "Generic",
1832		homeAccountId: accountInfo.homeAccountId,
1833		localAccountId: accountInfo.localAccountId,
1834		nativeAccountId: accountInfo.nativeAccountId,
1835		realm: accountInfo.tenantId,
1836		environment: accountInfo.environment,
1837		username: accountInfo.username,
1838		loginHint: accountInfo.loginHint,
1839		name: accountInfo.name,
1840		cloudGraphHostName,
1841		msGraphHost,
1842		tenantProfiles,
1843		dataBoundary: accountInfo.dataBoundary
1844	};
1845}
1846/**
1847* Generate HomeAccountId from server response
1848* @param serverClientInfo
1849* @param authType
1850*/
1851function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, correlationId, idTokenClaims) {
1852	if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
1853		if (serverClientInfo) try {
1854			const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
1855			if (clientInfo.uid && clientInfo.utid) return `${clientInfo.uid}.${clientInfo.utid}`;
1856		} catch (e) {}
1857		logger.warning("1ub6wv", correlationId);
1858	}
1859	return idTokenClaims?.sub || "";
1860}
1861/**
1862* Validates an entity: checks for all expected params
1863* @param entity
1864*/
1865function isAccountEntity(entity) {
1866	if (!entity) return false;
1867	return entity.hasOwnProperty("homeAccountId") && entity.hasOwnProperty("environment") && entity.hasOwnProperty("realm") && entity.hasOwnProperty("localAccountId") && entity.hasOwnProperty("username") && entity.hasOwnProperty("authorityType");
1868}
1869//#endregion
1870//#region node_modules/@azure/msal-common/dist-browser/cache/CacheManager.mjs
1871/*! @azure/msal-common v16.8.0 2026-06-10 */
1872/**
1873* Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
1874* @internal
1875*/
1876var CacheManager = class {
1877	constructor(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions) {
1878		this.clientId = clientId;
1879		this.cryptoImpl = cryptoImpl;
1880		this.commonLogger = logger.clone(name$1, version$1);
1881		this.staticAuthorityOptions = staticAuthorityOptions;
1882		this.performanceClient = performanceClient;
1883	}
1884	/**
1885	* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
1886	* @param accountFilter - (Optional) filter to narrow down the accounts returned
1887	* @returns Array of AccountInfo objects in cache
1888	*/
1889	getAllAccounts(accountFilter = {}, correlationId) {
1890		return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter, correlationId), correlationId, accountFilter);
1891	}
1892	/**
1893	* Gets first tenanted AccountInfo object found based on provided filters
1894	*/
1895	getAccountInfoFilteredBy(accountFilter, correlationId) {
1896		if (Object.keys(accountFilter).length === 0 || Object.values(accountFilter).every((value) => value === null || value === void 0 || value === "")) {
1897			this.commonLogger.warning("1skb02", correlationId);
1898			return null;
1899		}
1900		const allAccounts = this.getAllAccounts(accountFilter, correlationId);
1901		if (allAccounts.length > 1) return allAccounts.sort((a, b) => {
1902			const aHasClaims = a.idTokenClaims ? 1 : 0;
1903			return (b.idTokenClaims ? 1 : 0) - aHasClaims;
1904		})[0];
1905		else if (allAccounts.length === 1) return allAccounts[0];
1906		else return null;
1907	}

1908	/**
1909	* Returns a single matching
1910	* @param accountFilter
1911	* @returns
1912	*/
1913	getBaseAccountInfo(accountFilter, correlationId) {
1914		const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
1915		if (accountEntities.length > 0) return getAccountInfo(accountEntities[0]);
1916		else return null;
1917	}
1918	/**
1919	* Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
1920	* and builds the account info objects from the matching ID token's claims
1921	* @param cachedAccounts
1922	* @param accountFilter
1923	* @returns Array of AccountInfo objects that match account and tenant profile filters
1924	*/
1925	buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
1926		return cachedAccounts.flatMap((accountEntity) => {
1927			return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
1928		});
1929	}
1930	getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
1931		let tenantedAccountInfo = null;
1932		let idTokenClaims;
1933		if (tenantProfileFilter) {
1934			if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) return null;
1935		}
1936		const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
1937		if (idToken) {
1938			idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
1939			if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) return null;
1940		}
1941		tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
1942		return tenantedAccountInfo;
1943	}
1944	getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
1945		const accountInfo = getAccountInfo(accountEntity);
1946		let searchTenantProfiles = accountInfo.tenantProfiles || /* @__PURE__ */ new Map();
1947		const tokenKeys = this.getTokenKeys();
1948		if (targetTenantId) {
1949			const tenantProfile = searchTenantProfiles.get(targetTenantId);
1950			if (tenantProfile) searchTenantProfiles = new Map([[targetTenantId, tenantProfile]]);
1951			else return [];
1952		}
1953		const matchingTenantProfiles = [];
1954		searchTenantProfiles.forEach((tenantProfile) => {
1955			const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
1956			if (tenantedAccountInfo) matchingTenantProfiles.push(tenantedAccountInfo);
1957		});
1958		return matchingTenantProfiles;
1959	}
1960	tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter) {
1961		if (!!tenantProfileFilter.localAccountId && !this.matchLocalAccountIdFromTenantProfile(tenantProfile, tenantProfileFilter.localAccountId)) return false;
1962		if (!!tenantProfileFilter.name && !(tenantProfile.name === tenantProfileFilter.name)) return false;
1963		if (tenantProfileFilter.isHomeTenant !== void 0 && !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) return false;
1964		if (!!tenantProfileFilter.username && !this.matchUsername(tenantProfile.username, tenantProfileFilter.username) && !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username)) return false;
1965		if (!!tenantProfileFilter.loginHint && !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) return false;
1966		if (!!tenantProfileFilter.upn && !(tenantProfile.upn === tenantProfileFilter.upn)) return false;
1967		return true;
1968	}
1969	idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
1970		if (tenantProfileFilter) {
1971			if (!!tenantProfileFilter.localAccountId && !this.matchLocalAccountIdFromTokenClaims(idTokenClaims, tenantProfileFilter.localAccountId)) return false;
1972			if (!!tenantProfileFilter.loginHint && !this.matchLoginHintFromTokenClaims(idTokenClaims, tenantProfileFilter.loginHint)) return false;
1973			if (!!tenantProfileFilter.username && !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) && !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) return false;
1974			if (!!tenantProfileFilter.name && !this.matchName(idTokenClaims, tenantProfileFilter.name)) return false;

1975			if (!!tenantProfileFilter.sid && !this.matchSid(idTokenClaims, tenantProfileFilter.sid)) return false;
1976		}
1977		return true;
1978	}
1979	/**
1980	* saves a cache record
1981	* @param cacheRecord {CacheRecord}
1982	* @param storeInCache {?StoreInCache}
1983	* @param correlationId {?string} correlation id
1984	*/
1985	async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
1986		if (!cacheRecord) throw createClientAuthError(invalidCacheRecord);
1987		try {
1988			if (!!cacheRecord.account) await this.setAccount(cacheRecord.account, correlationId, kmsi, apiId);
1989			if (!!cacheRecord.idToken && storeInCache?.idToken !== false) await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
1990			if (!!cacheRecord.accessToken && storeInCache?.accessToken !== false) await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
1991			if (!!cacheRecord.refreshToken && storeInCache?.refreshToken !== false) await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
1992			if (!!cacheRecord.appMetadata) this.setAppMetadata(cacheRecord.appMetadata, correlationId);
1993		} catch (e) {
1994			this.commonLogger?.error("0j476p", correlationId);
1995			if (e instanceof AuthError) throw e;
1996			else throw createCacheError(e);
1997		}
1998	}
1999	/**
2000	* saves access token credential
2001	* @param credential
2002	*/
2003	async saveAccessToken(credential, correlationId, kmsi) {
2004		const accessTokenFilter = {
2005			clientId: credential.clientId,
2006			credentialType: credential.credentialType,
2007			environment: credential.environment,
2008			homeAccountId: credential.homeAccountId,
2009			realm: credential.realm,
2010			tokenType: credential.tokenType
2011		};
2012		const tokenKeys = this.getTokenKeys();
2013		const currentScopes = ScopeSet.fromString(credential.target);
2014		tokenKeys.accessToken.forEach((key) => {
2015			if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) return;
2016			const tokenEntity = this.getAccessTokenCredential(key, correlationId);
2017			if (tokenEntity && this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
2018				if (ScopeSet.fromString(tokenEntity.target).intersectingScopeSets(currentScopes)) this.removeAccessToken(key, correlationId);
2019			}
2020		});
2021		await this.setAccessTokenCredential(credential, correlationId, kmsi);
2022	}
2023	/**
2024	* Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
2025	* Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
2026	* @param accountFilter - An object containing Account properties to filter by
2027	*/
2028	getAccountsFilteredBy(accountFilter, correlationId) {
2029		const allAccountKeys = this.getAccountKeys();
2030		const matchingAccounts = [];
2031		allAccountKeys.forEach((cacheKey) => {
2032			const entity = this.getAccount(cacheKey, correlationId);
2033			if (!entity) return;
2034			if (!!accountFilter.homeAccountId && !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) return;
2035			if (!!accountFilter.environment && !this.matchEnvironment(entity, accountFilter.environment, correlationId)) return;
2036			if (!!accountFilter.realm && !this.matchRealm(entity, accountFilter.realm)) return;
2037			if (!!accountFilter.nativeAccountId && !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) return;
2038			if (!!accountFilter.authorityType && !this.matchAuthorityType(entity, accountFilter.authorityType)) return;
2039			const tenantProfileFilter = {
2040				localAccountId: accountFilter?.localAccountId,
2041				name: accountFilter?.name,
2042				username: accountFilter?.username,
2043				loginHint: accountFilter?.loginHint,
2044				upn: accountFilter?.upn
2045			};
2046			const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
2047				return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
2048			});
2049			if (matchingTenantProfiles && matchingTenantProfiles.length === 0) return;
2050			matchingAccounts.push(entity);
2051		});
2052		return matchingAccounts;
2053	}
2054	/**
2055	* Returns whether or not the given credential entity matches the filter
2056	* @param entity
2057	* @param filter
2058	* @param correlationId
2059	* @returns
2060	*/
2061	credentialMatchesFilter(entity, filter, correlationId) {
2062		if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) return false;

2063		if (!!filter.userAssertionHash && !this.matchUserAssertionHash(entity, filter.userAssertionHash)) return false;
2064		if (typeof filter.homeAccountId === "string" && !this.matchHomeAccountId(entity, filter.homeAccountId)) return false;
2065		if (!!filter.environment && !this.matchEnvironment(entity, filter.environment, correlationId)) return false;
2066		if (!!filter.realm && !this.matchRealm(entity, filter.realm)) return false;
2067		if (!!filter.credentialType && !this.matchCredentialType(entity, filter.credentialType)) return false;
2068		if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) return false;
2069		if (!!filter.target && !this.matchTarget(entity, filter.target)) return false;
2070		if (entity.credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
2071			if (!!filter.tokenType && !this.matchTokenType(entity, filter.tokenType)) return false;
2072			if (filter.tokenType === AuthenticationScheme.SSH) {
2073				if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) return false;
2074			}
2075		}
2076		return true;
2077	}
2078	/**
2079	* retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata
2080	* @param filter
2081	* @param correlationId
2082	*/
2083	getAppMetadataFilteredBy(filter, correlationId) {
2084		const allCacheKeys = this.getKeys();
2085		const matchingAppMetadata = {};
2086		allCacheKeys.forEach((cacheKey) => {
2087			if (!this.isAppMetadata(cacheKey)) return;
2088			const entity = this.getAppMetadata(cacheKey, correlationId);
2089			if (!entity) return;
2090			if (!!filter.environment && !this.matchEnvironment(entity, filter.environment, correlationId)) return;
2091			if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) return;
2092			matchingAppMetadata[cacheKey] = entity;
2093		});
2094		return matchingAppMetadata;
2095	}
2096	/**
2097	* retrieve authorityMetadata that contains a matching alias
2098	* @param host
2099	* @param correlationId
2100	*/
2101	getAuthorityMetadataByAlias(host, correlationId) {
2102		const allCacheKeys = this.getAuthorityMetadataKeys();
2103		let matchedEntity = null;
2104		allCacheKeys.forEach((cacheKey) => {
2105			if (!this.isAuthorityMetadata(cacheKey) || cacheKey.indexOf(this.clientId) === -1) return;
2106			const entity = this.getAuthorityMetadata(cacheKey, correlationId);
2107			if (!entity) return;
2108			if (entity.aliases.indexOf(host) === -1) return;
2109			matchedEntity = entity;
2110		});
2111		return matchedEntity;
2112	}
2113	/**
2114	* Removes all accounts and related tokens from cache.
2115	*/
2116	removeAllAccounts(correlationId) {
2117		this.getAllAccounts({}, correlationId).forEach((account) => {
2118			this.removeAccount(account, correlationId);
2119		});
2120	}
2121	/**
2122	* Removes the account and related tokens for a given account key
2123	* @param account
2124	*/
2125	removeAccount(account, correlationId) {
2126		this.removeAccountContext(account, correlationId);
2127		const accountKeys = this.getAccountKeys();
2128		const keyFilter = (key) => {
2129			return key.includes(account.homeAccountId) && key.includes(account.environment);
2130		};
2131		accountKeys.filter(keyFilter).forEach((key) => {
2132			this.removeItem(key, correlationId);
2133			this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
2134		});
2135	}
2136	/**
2137	* Removes credentials associated with the provided account
2138	* @param account
2139	*/
2140	removeAccountContext(account, correlationId) {
2141		const allTokenKeys = this.getTokenKeys();
2142		const keyFilter = (key) => {
2143			return key.includes(account.homeAccountId) && key.includes(account.environment);
2144		};
2145		allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
2146			this.removeIdToken(key, correlationId);
2147		});
2148		allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
2149			this.removeAccessToken(key, correlationId);
2150		});
2151		allTokenKeys.refreshToken.filter(keyFilter).forEach((key) => {
2152			this.removeRefreshToken(key, correlationId);
2153		});
2154	}
2155	/**
2156	* returns a boolean if the given credential is removed
2157	* @param key
2158	* @param correlationId
2159	*/
2160	removeAccessToken(key, correlationId) {
2161		const credential = this.getAccessTokenCredential(key, correlationId);
2162		if (!credential) return;
2163		this.removeItem(key, correlationId);
2164		this.performanceClient.incrementFields({ accessTokensRemoved: 1 }, correlationId);
2165		if (credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
2166			if (credential.tokenType === AuthenticationScheme.POP) {

2167				const kid = credential.keyId;
2168				if (kid) this.cryptoImpl.removeTokenBindingKey(kid, correlationId).catch(() => {
2169					this.commonLogger.error("0cx291", correlationId);
2170					this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
2171				});
2172			}
2173		}
2174	}
2175	/**
2176	* Removes all app metadata objects from cache.
2177	*/
2178	removeAppMetadata(correlationId) {
2179		this.getKeys().forEach((cacheKey) => {
2180			if (this.isAppMetadata(cacheKey)) this.removeItem(cacheKey, correlationId);
2181		});
2182		return true;
2183	}
2184	/**
2185	* Retrieve IdTokenEntity from cache
2186	* @param account {AccountInfo}
2187	* @param tokenKeys {?TokenKeys}
2188	* @param targetRealm {?string}
2189	* @param performanceClient {?IPerformanceClient}
2190	* @param correlationId {?string}
2191	*/
2192	getIdToken(account, correlationId, tokenKeys, targetRealm) {
2193		this.commonLogger.trace("1drz22", correlationId);
2194		const idTokenFilter = {
2195			homeAccountId: account.homeAccountId,
2196			environment: account.environment,
2197			credentialType: CredentialType.ID_TOKEN,
2198			clientId: this.clientId,
2199			realm: targetRealm
2200		};
2201		const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
2202		const numIdTokens = idTokenMap.size;
2203		if (numIdTokens < 1) {
2204			this.commonLogger.info("1atvtd", correlationId);
2205			return null;
2206		} else if (numIdTokens > 1) {
2207			let tokensToBeRemoved = idTokenMap;
2208			if (!targetRealm) {
2209				const homeIdTokenMap = /* @__PURE__ */ new Map();
2210				idTokenMap.forEach((idToken, key) => {
2211					if (idToken.realm === account.tenantId) homeIdTokenMap.set(key, idToken);
2212				});
2213				const numHomeIdTokens = homeIdTokenMap.size;
2214				if (numHomeIdTokens < 1) {
2215					this.commonLogger.info("0ooalx", correlationId);
2216					return idTokenMap.values().next().value ?? null;
2217				} else if (numHomeIdTokens === 1) {
2218					this.commonLogger.info("1eq2vc", correlationId);
2219					return homeIdTokenMap.values().next().value ?? null;
2220				} else tokensToBeRemoved = homeIdTokenMap;
2221			}
2222			this.commonLogger.info("1ws328", correlationId);
2223			tokensToBeRemoved.forEach((idToken, key) => {
2224				this.removeIdToken(key, correlationId);
2225			});
2226			this.performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
2227			return null;
2228		}
2229		this.commonLogger.info("1sm769", correlationId);
2230		return idTokenMap.values().next().value ?? null;
2231	}
2232	/**
2233	* Gets all idTokens matching the given filter
2234	* @param filter
2235	* @returns
2236	*/
2237	getIdTokensByFilter(filter, correlationId, tokenKeys) {
2238		const idTokenKeys = tokenKeys && tokenKeys.idToken || this.getTokenKeys().idToken;
2239		const idTokens = /* @__PURE__ */ new Map();
2240		idTokenKeys.forEach((key) => {
2241			if (!this.idTokenKeyMatchesFilter(key, {
2242				clientId: this.clientId,
2243				...filter
2244			})) return;
2245			const idToken = this.getIdTokenCredential(key, correlationId);
2246			if (idToken && this.credentialMatchesFilter(idToken, filter, correlationId)) idTokens.set(key, idToken);
2247		});
2248		return idTokens;
2249	}
2250	/**
2251	* Validate the cache key against filter before retrieving and parsing cache value
2252	* @param key
2253	* @param filter
2254	* @returns
2255	*/
2256	idTokenKeyMatchesFilter(inputKey, filter) {
2257		const key = inputKey.toLowerCase();
2258		if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) return false;
2259		if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) return false;
2260		return true;
2261	}
2262	/**
2263	* Removes idToken from the cache
2264	* @param key
2265	*/
2266	removeIdToken(key, correlationId) {
2267		this.removeItem(key, correlationId);
2268	}
2269	/**
2270	* Removes refresh token from the cache
2271	* @param key
2272	*/
2273	removeRefreshToken(key, correlationId) {
2274		this.removeItem(key, correlationId);
2275	}
2276	/**
2277	* Retrieve AccessTokenEntity from cache
2278	* @param account {AccountInfo}
2279	* @param request {BaseAuthRequest}
2280	* @param tokenKeys {?TokenKeys}
2281	* @param performanceClient {?IPerformanceClient}
2282	*/
2283	getAccessToken(account, request, tokenKeys, targetRealm) {
2284		const correlationId = request.correlationId;
2285		this.commonLogger.trace("1t7hz1", correlationId);
2286		const scopes = ScopeSet.createSearchScopes(request.scopes);
2287		const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
2288		const credentialType = authScheme && authScheme.toLowerCase() !== AuthenticationScheme.BEARER.toLowerCase() ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
2289		const accessTokenFilter = {
2290			homeAccountId: account.homeAccountId,
2291			environment: account.environment,
2292			credentialType,
2293			clientId: this.clientId,
2294			realm: targetRealm || account.tenantId,
2295			target: scopes,
2296			tokenType: authScheme,
2297			keyId: request.sshKid
2298		};
2299		const accessTokenKeys = tokenKeys && tokenKeys.accessToken || this.getTokenKeys().accessToken;
2300		const accessTokens = [];
2301		accessTokenKeys.forEach((key) => {
2302			if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
2303				const accessToken = this.getAccessTokenCredential(key, correlationId);
2304				if (accessToken && this.credentialMatchesFilter(accessToken, accessTokenFilter, correlationId)) accessTokens.push(accessToken);
2305			}
2306		});
2307		const numAccessTokens = accessTokens.length;
2308		if (numAccessTokens < 1) {
2309			this.commonLogger.info("1nckna", correlationId);
2310			return null;
2311		} else if (numAccessTokens > 1) {
2312			this.commonLogger.info("1wkfwp", correlationId);
2313			accessTokens.forEach((accessToken) => {
2314				this.removeAccessToken(this.generateCredentialKey(accessToken), correlationId);
2315			});
2316			this.performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
2317			return null;
2318		}
2319		this.commonLogger.info("06yt98", correlationId);
2320		return accessTokens[0];
2321	}
2322	/**
2323	* Validate the cache key against filter before retrieving and parsing cache value
2324	* @param key
2325	* @param filter
2326	* @param keyMustContainAllScopes
2327	* @returns
2328	*/
2329	accessTokenKeyMatchesFilter(inputKey, filter, keyMustContainAllScopes) {
2330		const key = inputKey.toLowerCase();
2331		if (filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) return false;

2332		if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) return false;
2333		if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) return false;
2334		if (filter.target) {
2335			const scopes = filter.target.asArray();
2336			for (let i = 0; i < scopes.length; i++) if (keyMustContainAllScopes && !key.includes(scopes[i].toLowerCase())) return false;
2337			else if (!keyMustContainAllScopes && key.includes(scopes[i].toLowerCase())) return true;
2338		}
2339		return true;
2340	}
2341	/**
2342	* Gets all access tokens matching the filter
2343	* @param filter
2344	* @returns
2345	*/
2346	getAccessTokensByFilter(filter, correlationId) {
2347		const tokenKeys = this.getTokenKeys();
2348		const accessTokens = [];
2349		tokenKeys.accessToken.forEach((key) => {
2350			if (!this.accessTokenKeyMatchesFilter(key, filter, true)) return;
2351			const accessToken = this.getAccessTokenCredential(key, correlationId);
2352			if (accessToken && this.credentialMatchesFilter(accessToken, filter, correlationId)) accessTokens.push(accessToken);
2353		});
2354		return accessTokens;
2355	}
2356	/**
2357	* Helper to retrieve the appropriate refresh token from cache
2358	* @param account {AccountInfo}
2359	* @param familyRT {boolean}
2360	* @param tokenKeys {?TokenKeys}
2361	* @param performanceClient {?IPerformanceClient}
2362	* @param correlationId {?string}
2363	*/
2364	getRefreshToken(account, familyRT, correlationId, tokenKeys) {
2365		this.commonLogger.trace("0x53vi", correlationId);
2366		const id = familyRT ? "1" : void 0;
2367		const refreshTokenFilter = {
2368			homeAccountId: account.homeAccountId,
2369			environment: account.environment,
2370			credentialType: CredentialType.REFRESH_TOKEN,
2371			clientId: this.clientId,
2372			familyId: id
2373		};
2374		const refreshTokenKeys = tokenKeys && tokenKeys.refreshToken || this.getTokenKeys().refreshToken;
2375		const refreshTokens = [];
2376		refreshTokenKeys.forEach((key) => {
2377			if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
2378				const refreshToken = this.getRefreshTokenCredential(key, correlationId);
2379				if (refreshToken && this.credentialMatchesFilter(refreshToken, refreshTokenFilter, correlationId)) refreshTokens.push(refreshToken);
2380			}
2381		});
2382		const numRefreshTokens = refreshTokens.length;
2383		if (numRefreshTokens < 1) {
2384			this.commonLogger.info("0dlw11", correlationId);
2385			return null;
2386		}
2387		if (numRefreshTokens > 1) this.performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);
2388		this.commonLogger.info("0wcnep", correlationId);
2389		return refreshTokens[0];
2390	}
2391	/**
2392	* Validate the cache key against filter before retrieving and parsing cache value
2393	* @param key
2394	* @param filter
2395	*/
2396	refreshTokenKeyMatchesFilter(inputKey, filter) {
2397		const key = inputKey.toLowerCase();
2398		if (filter.familyId && key.indexOf(filter.familyId.toLowerCase()) === -1) return false;
2399		if (!filter.familyId && filter.clientId && key.indexOf(filter.clientId.toLowerCase()) === -1) return false;
2400		if (filter.homeAccountId && key.indexOf(filter.homeAccountId.toLowerCase()) === -1) return false;
2401		return true;
2402	}
2403	/**
2404	* Retrieve AppMetadataEntity from cache
2405	*/
2406	readAppMetadataFromCache(environment, correlationId) {
2407		const appMetadataFilter = {
2408			environment,
2409			clientId: this.clientId
2410		};
2411		const appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter, correlationId);
2412		const appMetadataEntries = Object.keys(appMetadata).map((key) => appMetadata[key]);
2413		const numAppMetadata = appMetadataEntries.length;
2414		if (numAppMetadata < 1) return null;
2415		else if (numAppMetadata > 1) throw createClientAuthError(multipleMatchingAppMetadata);
2416		return appMetadataEntries[0];
2417	}
2418	/**
2419	* Return the family_id value associated  with FOCI
2420	* @param environment
2421	* @param clientId
2422	*/
2423	isAppMetadataFOCI(environment, correlationId) {
2424		const appMetadata = this.readAppMetadataFromCache(environment, correlationId);
2425		return !!(appMetadata && appMetadata.familyId === "1");
2426	}
2427	/**
2428	* helper to match account ids
2429	* @param value
2430	* @param homeAccountId
2431	*/
2432	matchHomeAccountId(entity, homeAccountId) {
2433		return !!(typeof entity.homeAccountId === "string" && homeAccountId === entity.homeAccountId);
2434	}
2435	/**
2436	* helper to match account ids
2437	* @param entity
2438	* @param localAccountId
2439	* @returns
2440	*/
2441	matchLocalAccountIdFromTokenClaims(tokenClaims, localAccountId) {
2442		return localAccountId === (tokenClaims.oid || tokenClaims.sub);
2443	}
2444	matchLocalAccountIdFromTenantProfile(tenantProfile, localAccountId) {
2445		return tenantProfile.localAccountId === localAccountId;
2446	}
2447	/**
2448	* helper to match names
2449	* @param entity
2450	* @param name
2451	* @returns true if the downcased name properties are present and match in the filter and the entity
2452	*/
2453	matchName(claims, name) {
2454		return !!(name.toLowerCase() === claims.name?.toLowerCase());
2455	}
2456	/**
2457	* helper to match usernames
2458	* @param entity
2459	* @param username
2460	* @returns
2461	*/

2462	matchUsername(cachedUsername, filterUsername) {
2463		return !!(cachedUsername && typeof cachedUsername === "string" && filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
2464	}
2465	/**
2466	* helper to match loginhints
2467	* @param entity
2468	* @param loginHint
2469	* @returns
2470	*/
2471	matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
2472		return tenantProfile.loginHint === loginHintFilter || tenantProfile.username === loginHintFilter || tenantProfile.upn === loginHintFilter;
2473	}
2474	/**
2475	* helper to match assertion
2476	* @param value
2477	* @param oboAssertion
2478	*/
2479	matchUserAssertionHash(entity, userAssertionHash) {
2480		return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
2481	}
2482	/**
2483	* helper to match environment
2484	* @param value
2485	* @param environment
2486	*/
2487	matchEnvironment(entity, environment, correlationId) {
2488		if (this.staticAuthorityOptions) {
2489			const staticAliases = getAliasesFromStaticSources(this.staticAuthorityOptions, this.commonLogger, correlationId);
2490			if (staticAliases.includes(environment) && staticAliases.includes(entity.environment)) return true;
2491		}
2492		const cloudMetadata = this.getAuthorityMetadataByAlias(environment, correlationId);
2493		if (cloudMetadata && cloudMetadata.aliases.indexOf(entity.environment) > -1) return true;
2494		return false;
2495	}
2496	/**
2497	* helper to match credential type
2498	* @param entity
2499	* @param credentialType
2500	*/
2501	matchCredentialType(entity, credentialType) {
2502		return entity.credentialType && credentialType.toLowerCase() === entity.credentialType.toLowerCase();
2503	}
2504	/**
2505	* helper to match client ids
2506	* @param entity
2507	* @param clientId
2508	*/
2509	matchClientId(entity, clientId) {
2510		return !!(entity.clientId && clientId === entity.clientId);
2511	}
2512	/**
2513	* helper to match family ids
2514	* @param entity
2515	* @param familyId
2516	*/
2517	matchFamilyId(entity, familyId) {
2518		return !!(entity.familyId && familyId === entity.familyId);
2519	}
2520	/**
2521	* helper to match realm
2522	* @param entity
2523	* @param realm

2524	*/
2525	matchRealm(entity, realm) {
2526		return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
2527	}
2528	/**
2529	* helper to match nativeAccountId
2530	* @param entity
2531	* @param nativeAccountId
2532	* @returns boolean indicating the match result
2533	*/
2534	matchNativeAccountId(entity, nativeAccountId) {
2535		return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
2536	}
2537	/**
2538	* helper to match loginHint which can be either:
2539	* 1. login_hint ID token claim
2540	* 2. username in cached account object
2541	* 3. upn in ID token claims
2542	* @param entity
2543	* @param loginHint
2544	* @returns
2545	*/
2546	matchLoginHintFromTokenClaims(tokenClaims, loginHint) {
2547		if (tokenClaims.login_hint === loginHint) return true;
2548		if (tokenClaims.preferred_username === loginHint) return true;
2549		if (tokenClaims.upn === loginHint) return true;
2550		if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) return true;
2551		return false;
2552	}
2553	/**
2554	* Helper to match sid
2555	* @param entity
2556	* @param sid
2557	* @returns true if the sid claim is present and matches the filter
2558	*/
2559	matchSid(idTokenClaims, sid) {
2560		return idTokenClaims.sid === sid;
2561	}
2562	matchAuthorityType(entity, authorityType) {
2563		return !!(entity.authorityType && authorityType.toLowerCase() === entity.authorityType.toLowerCase());
2564	}
2565	/**
2566	* Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
2567	* @param entity
2568	* @param target
2569	*/
2570	matchTarget(entity, target) {
2571		if (entity.credentialType !== CredentialType.ACCESS_TOKEN && entity.credentialType !== CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME || !entity.target) return false;
2572		return ScopeSet.fromString(entity.target).containsScopeSet(target);
2573	}
2574	/**
2575	* Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
2576	* @param entity
2577	* @param tokenType
2578	*/
2579	matchTokenType(entity, tokenType) {
2580		return !!(entity.tokenType && entity.tokenType === tokenType);
2581	}
2582	/**
2583	* Returns true if the credential's keyId matches the one in the request, false otherwise
2584	* @param entity
2585	* @param keyId
2586	*/
2587	matchKeyId(entity, keyId) {
2588		return !!(entity.keyId && entity.keyId === keyId);
2589	}
2590	/**
2591	* returns if a given cache entity is of the type appmetadata
2592	* @param key
2593	*/
2594	isAppMetadata(key) {
2595		return key.indexOf(APP_METADATA) !== -1;
2596	}
2597	/**
2598	* returns if a given cache entity is of the type authoritymetadata
2599	* @param key
2600	*/
2601	isAuthorityMetadata(key) {
2602		return key.indexOf(AUTHORITY_METADATA_CACHE_KEY) !== -1;
2603	}
2604	/**
2605	* returns cache key used for cloud instance metadata
2606	*/
2607	generateAuthorityMetadataCacheKey(authority) {
2608		return `${AUTHORITY_METADATA_CACHE_KEY}-${this.clientId}-${authority}`;
2609	}
2610	/**
2611	* Helper to convert serialized data to object
2612	* @param obj
2613	* @param json
2614	*/
2615	static toObject(obj, json) {
2616		for (const propertyName in json) obj[propertyName] = json[propertyName];
2617		return obj;
2618	}
2619};
2620/** @internal */
2621var DefaultStorageClass = class extends CacheManager {
2622	async setAccount() {
2623		throw createClientAuthError(methodNotImplemented);
2624	}
2625	getAccount() {
2626		throw createClientAuthError(methodNotImplemented);
2627	}
2628	async setIdTokenCredential() {
2629		throw createClientAuthError(methodNotImplemented);
2630	}
2631	getIdTokenCredential() {
2632		throw createClientAuthError(methodNotImplemented);
2633	}
2634	async setAccessTokenCredential() {
2635		throw createClientAuthError(methodNotImplemented);
2636	}
2637	getAccessTokenCredential() {
2638		throw createClientAuthError(methodNotImplemented);
2639	}
2640	async setRefreshTokenCredential() {
2641		throw createClientAuthError(methodNotImplemented);
2642	}
2643	getRefreshTokenCredential() {
2644		throw createClientAuthError(methodNotImplemented);
2645	}
2646	setAppMetadata() {
2647		throw createClientAuthError(methodNotImplemented);
2648	}
2649	getAppMetadata() {
2650		throw createClientAuthError(methodNotImplemented);
2651	}
2652	setServerTelemetry() {
2653		throw createClientAuthError(methodNotImplemented);
2654	}
2655	getServerTelemetry() {
2656		throw createClientAuthError(methodNotImplemented);
2657	}
2658	setAuthorityMetadata() {
2659		throw createClientAuthError(methodNotImplemented);
2660	}
2661	getAuthorityMetadata() {
2662		throw createClientAuthError(methodNotImplemented);
2663	}
2664	getAuthorityMetadataKeys() {
2665		throw createClientAuthError(methodNotImplemented);
2666	}
2667	setThrottlingCache() {
2668		throw createClientAuthError(methodNotImplemented);
2669	}
2670	getThrottlingCache() {
2671		throw createClientAuthError(methodNotImplemented);
2672	}
2673	removeItem() {
2674		throw createClientAuthError(methodNotImplemented);
2675	}
2676	getKeys() {
2677		throw createClientAuthError(methodNotImplemented);
2678	}
2679	getAccountKeys() {
2680		throw createClientAuthError(methodNotImplemented);
2681	}
2682	getTokenKeys() {
2683		throw createClientAuthError(methodNotImplemented);
2684	}
2685	generateCredentialKey() {
2686		throw createClientAuthError(methodNotImplemented);
2687	}
2688	generateAccountKey() {
2689		throw createClientAuthError(methodNotImplemented);
2690	}
2691};
2692//#endregion
2693//#region node_modules/@azure/msal-common/dist-browser/telemetry/performance/PerformanceEvent.mjs
2694/*! @azure/msal-common v16.8.0 2026-06-10 */
2695/**
2696* State of the performance event.
2697*
2698* @export
2699* @enum {number}
2700*/
2701var PerformanceEventStatus = {
2702	NotStarted: 0,
2703	InProgress: 1,
2704	Completed: 2
2705};
2706//#endregion
2707//#region node_modules/@azure/msal-common/dist-browser/telemetry/performance/StubPerformanceClient.mjs
2708/*! @azure/msal-common v16.8.0 2026-06-10 */
2709var StubPerformanceClient = class {
2710	generateId() {
2711		return "callback-id";
2712	}
2713	startMeasurement(measureName, correlationId) {
2714		return {
2715			end: () => null,
2716			discard: () => {},
2717			add: () => {},
2718			increment: () => {},
2719			event: {
2720				eventId: this.generateId(),
2721				status: PerformanceEventStatus.InProgress,
2722				authority: "",
2723				libraryName: "",
2724				libraryVersion: "",
2725				clientId: "",
2726				name: measureName,
2727				startTimeMs: Date.now(),
2728				correlationId: correlationId || ""
2729			}
2730		};
2731	}
2732	endMeasurement() {
2733		return null;
2734	}
2735	discardMeasurements() {}
2736	removePerformanceCallback() {
2737		return true;
2738	}
2739	addPerformanceCallback() {
2740		return "";
2741	}
2742	emitEvents() {}
2743	addFields() {}
2744	incrementFields() {}
2745	cacheEventByCorrelationId() {}
2746};
2747//#endregion
2748//#region node_modules/@azure/msal-common/dist-browser/config/ClientConfiguration.mjs
2749/*! @azure/msal-common v16.8.0 2026-06-10 */
2750var DEFAULT_SYSTEM_OPTIONS = {
2751	tokenRenewalOffsetSeconds: 300,
2752	preventCorsPreflight: false
2753};
2754var DEFAULT_LOGGER_IMPLEMENTATION = {
2755	loggerCallback: () => {},
2756	piiLoggingEnabled: false,
2757	logLevel: LogLevel.Info,
2758	correlationId: ""
2759};
2760var DEFAULT_NETWORK_IMPLEMENTATION = {
2761	async sendGetRequestAsync() {
2762		throw createClientAuthError(methodNotImplemented);
2763	},
2764	async sendPostRequestAsync() {
2765		throw createClientAuthError(methodNotImplemented);
2766	}
2767};
2768var DEFAULT_LIBRARY_INFO = {
2769	sku: SKU,
2770	version: version$1,
2771	cpu: "",
2772	os: ""
2773};
2774var DEFAULT_CLIENT_CREDENTIALS = {
2775	clientSecret: "",
2776	clientAssertion: void 0
2777};
2778var DEFAULT_AZURE_CLOUD_OPTIONS = {
2779	azureCloudInstance: AzureCloudInstance.None,
2780	tenant: `${DEFAULT_COMMON_TENANT}`
2781};
2782var DEFAULT_TELEMETRY_OPTIONS = { application: {
2783	appName: "",
2784	appVersion: ""
2785} };
2786/**
2787* Function that sets the default options when not explicitly configured from app developer
2788*
2789* @param Configuration
2790*
2791* @returns Configuration
2792*/
2793function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials, library

2793Info, telemetry, serverTelemetryManager, persistencePlugin, serializableCache }) {
2794	const loggerOptions = {
2795		...DEFAULT_LOGGER_IMPLEMENTATION,
2796		...userLoggerOption
2797	};
2798	return {
2799		authOptions: buildAuthOptions(userAuthOptions),
2800		systemOptions: {
2801			...DEFAULT_SYSTEM_OPTIONS,
2802			...userSystemOptions
2803		},
2804		loggerOptions,
2805		storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
2806		networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
2807		cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
2808		clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
2809		libraryInfo: {
2810			...DEFAULT_LIBRARY_INFO,
2811			...libraryInfo
2812		},
2813		telemetry: {
2814			...DEFAULT_TELEMETRY_OPTIONS,
2815			...telemetry
2816		},
2817		serverTelemetryManager: serverTelemetryManager || null,
2818		persistencePlugin: persistencePlugin || null,
2819		serializableCache: serializableCache || null
2820	};
2821}
2822/**
2823* Construct authoptions from the client and platform passed values
2824* @param authOptions
2825*/
2826function buildAuthOptions(authOptions) {
2827	return {
2828		clientCapabilities: [],
2829		azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
2830		instanceAware: false,
2831		isMcp: false,
2832		...authOptions
2833	};
2834}
2835/**
2836* Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
2837* @param ClientConfiguration
2838*/
2839function isOidcProtocolMode(config) {
2840	return config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC;
2841}
2842//#endregion
2843//#region node_modules/@azure/msal-common/dist-browser/cache/persistence/TokenCacheContext.mjs
2844/*! @azure/msal-common v16.8.0 2026-06-10 */
2845/**
2846* This class instance helps track the memory changes facilitating
2847* decisions to read from and write to the persistent cache
2848*/ var TokenCacheContext = class {
2849	constructor(tokenCache, hasChanged) {
2850		this.cache = tokenCache;
2851		this.hasChanged = hasChanged;
2852	}
2853	/**
2854	* boolean which indicates the changes in cache
2855	*/
2856	get cacheHasChanged() {
2857		return this.hasChanged;
2858	}
2859	/**
2860	* function to retrieve the token cache
2861	*/
2862	get tokenCache() {
2863		return this.cache;
2864	}
2865};
2866//#endregion
2867//#region node_modules/@azure/msal-common/dist-browser/utils/TimeUtils.mjs
2868/*! @azure/msal-common v16.8.0 2026-06-10 */
2869/**
2870* Utility functions for managing date and time operations.
2871*/
2872/**
2873* return the current time in Unix time (seconds).
2874*/
2875function nowSeconds() {
2876	return Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3);
2877}
2878/**
2879* Converts JS Date object to seconds
2880* @param date Date
2881*/
2882function toSecondsFromDate(date) {
2883	return date.getTime() / 1e3;
2884}
2885/**
2886* Convert seconds to JS Date object. Seconds can be in a number or string format or undefined (will still return a date).
2887* @param seconds
2888*/
2889function toDateFromSeconds(seconds) {
2890	if (seconds) return /* @__PURE__ */ new Date(Number(seconds) * 1e3);
2891	return /* @__PURE__ */ new Date();
2892}
2893/**
2894* check if a token is expired based on given UTC time in seconds.
2895* @param expiresOn
2896*/
2897function isTokenExpired(expiresOn, offset) {
2898	const expirationSec = Number(expiresOn) || 0;
2899	return nowSeconds() + offset > expirationSec;
2900}
2901/**
2902* Checks if a cache entry is expired based on the last updated time and cache retention days.
2903* @param lastUpdatedAt
2904* @param cacheRetentionDays
2905* @returns
2906*/
2907function isCacheExpired(lastUpdatedAt, cacheRetentionDays) {
2908	const cacheExpirationTimestamp = Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1e3;
2909	return Date.now() > cacheExpirationTimestamp;
2910}
2911/**
2912* If the current time is earlier than the time that a token was cached at, we must discard the token
2913* i.e. The system clock was turned back after acquiring the cached token
2914* @param cachedAt
2915* @param offset
2916*/
2917function wasClockTurnedBack(cachedAt) {
2918	return Number(cachedAt) > nowSeconds();
2919}
2920//#endregion
2921//#region node_modules/@azure/msal-common/dist-browser/cache/utils/CacheHelpers.mjs
2922/*! @azure/msal-common v16.8.0 2026-06-10 */
2923/**
2924* Create IdTokenEntity
2925* @param homeAccountId
2926* @param authenticationResult
2927* @param clientId
2928* @param authority
2929*/
2930function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
2931	return {
2932		credentialType: CredentialType.ID_TOKEN,
2933		homeAccountId,
2934		environment,
2935		clientId,
2936		secret: idToken,
2937		realm: tenantId,
2938		lastUpdatedAt: Date.now().toString()
2939	};
2940}
2941/**
2942* Create AccessTokenEntity
2943* @param homeAccountId
2944* @param environment
2945* @param accessToken
2946* @param clientId
2947* @param tenantId
2948* @param scopes
2949* @param expiresOn
2950* @param extExpiresOn
2951*/
2952function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
2953	const atEntity = {
2954		homeAccountId,
2955		credentialType: CredentialType.ACCESS_TOKEN,
2956		secret: accessToken,
2957		cachedAt: nowSeconds().toString(),
2958		expiresOn: expiresOn.toString(),
2959		extendedExpiresOn: extExpiresOn.toString(),
2960		environment,
2961		clientId,
2962		realm: tenantId,
2963		target: scopes,
2964		tokenType: tokenType || AuthenticationScheme.BEARER,
2965		lastUpdatedAt: Date.now().toString()
2966	};
2967	if (userAssertionHash) atEntity.userAssertionHash = userAssertionHash;
2968	if (refreshOn) atEntity.refreshOn = refreshOn.toString();
2969	if (atEntity.tokenType?.toLowerCase() !== AuthenticationScheme.BEARER.toLowerCase()) {
2970		atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
2971		switch (atEntity.tokenType) {
2972			case AuthenticationScheme.POP:
2973				const tokenClaims = extractTokenClaims(accessToken, base64Decode);
2974				if (!tokenClaims?.cnf?.kid) throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
2975				atEntity.keyId = tokenClaims.cnf.kid;
2976				break;
2977			case AuthenticationScheme.SSH: atEntity.keyId = keyId;
2978		}
2979	}
2980	return atEntity;
2981}
2982/**
2983* Create RefreshTokenEntity
2984* @param homeAccountId
2985* @param authenticationResult
2986* @param clientId
2987* @param authority
2988*/
2989function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
2990	const rtEntity = {
2991		credentialType: CredentialType.REFRESH_TOKEN,
2992		homeAccountId,
2993		environment,
2994		clientId,
2995		secret: refreshToken,
2996		lastUpdatedAt: Date.now().toString()
2997	};
2998	if (userAssertionHash) rtEntity.userAssertionHash = userAssertionHash;
2999	if (familyId) rtEntity.familyId = familyId;
3000	if (expiresOn) rtEntity.expiresOn = expiresOn.toString();
3001	return rtEntity;
3002}
3003function isCredentialEntity(entity) {
3004	return entity.hasOwnProperty("homeAccountId") && entity.hasOwnProperty("environment") && entity.hasOwnProperty("credentialType") && entity.hasOwnProperty("clientId") && entity.hasOwnProperty("secret");
3005}
3006/**
3007* Validates an entity: checks for all expected params
3008* @param entity
3009*/
3010function isAccessTokenEntity(entity) {

3011	if (!entity) return false;
3012	return isCredentialEntity(entity) && entity.hasOwnProperty("realm") && entity.hasOwnProperty("target") && (entity["credentialType"] === CredentialType.ACCESS_TOKEN || entity["credentialType"] === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME);
3013}
3014/**
3015* Validates an entity: checks for all expected params
3016* @param entity
3017*/
3018function isIdTokenEntity(entity) {
3019	if (!entity) return false;
3020	return isCredentialEntity(entity) && entity.hasOwnProperty("realm") && entity["credentialType"] === CredentialType.ID_TOKEN;
3021}
3022/**
3023* Validates an entity: checks for all expected params
3024* @param entity
3025*/
3026function isRefreshTokenEntity(entity) {
3027	if (!entity) return false;
3028	return isCredentialEntity(entity) && entity["credentialType"] === CredentialType.REFRESH_TOKEN;
3029}
3030/**
3031* validates if a given cache entry is "Telemetry", parses <key,value>
3032* @param key
3033* @param entity
3034*/
3035function isServerTelemetryEntity(key, entity) {
3036	const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
3037	let validateEntity = true;
3038	if (entity) validateEntity = entity.hasOwnProperty("failedRequests") && entity.hasOwnProperty("errors") && entity.hasOwnProperty("cacheHits");
3039	return validateKey && validateEntity;
3040}
3041/**
3042* validates if a given cache entry is "Throttling", parses <key,value>
3043* @param key
3044* @param entity
3045*/
3046function isThrottlingEntity(key, entity) {
3047	let validateKey = false;
3048	if (key) validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
3049	let validateEntity = true;
3050	if (entity) validateEntity = entity.hasOwnProperty("throttleTime");
3051	return validateKey && validateEntity;
3052}
3053/**
3054* Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
3055*/
3056function generateAppMetadataKey({ environment, clientId }) {
3057	return [
3058		APP_METADATA,
3059		environment,
3060		clientId
3061	].join("-").toLowerCase();
3062}
3063function isAppMetadataEntity(key, entity) {
3064	if (!entity) return false;
3065	return key.indexOf("appmetadata") === 0 && entity.hasOwnProperty("clientId") && entity.hasOwnProperty("environment");
3066}
3067/**
3068* Validates an entity: checks for all expected params
3069* @param entity
3070*/
3071function isAuthorityMetadataEntity(key, entity) {
3072	if (!entity) return false;
3073	return key.indexOf("authority-metadata") === 0 && entity.hasOwnProperty("aliases") && entity.hasOwnProperty("preferred_cache") && entity.hasOwnProperty("preferred_network") && entity.hasOwnProperty("canonical_authority") && entity.hasOwnProperty("authorization_endpoint") && entity.hasOwnProperty("token_endpoint") && entity.hasOwnProperty("issuer") && entity.hasOwnProperty("aliasesFromNetwork") && entity.hasOwnProperty("endpointsFromNetwork") && entity.hasOwnProperty("expiresAt") && entity.hasOwnProperty("jwks_uri");
3074}
3075/**
3076* Reset the exiresAt value
3077*/
3078function generateAuthorityMetadataExpiresAt() {
3079	return nowSeconds() + AUTHORITY_METADATA_REFRESH_TIME_SECONDS;
3080}
3081function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
3082	authorityMetadata.authorization_endpoint = updatedValues.authorization_endpoint;
3083	authorityMetadata.token_endpoint = updatedValues.token_endpoint;
3084	authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
3085	authorityMetadata.issuer = updatedValues.issuer;
3086	authorityMetadata.endpointsFromNetwork = fromNetwork;
3087	authorityMetadata.jwks_uri = updatedValues.jwks_uri;
3088}
3089function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
3090	authorityMetadata.aliases = updatedValues.aliases;
3091	authorityMetadata.preferred_cache = updatedValues.preferred_cache;
3092	authorityMetadata.preferred_network = updatedValues.preferred_network;
3093	authorityMetadata.aliasesFromNetwork = fromNetwork;
3094}
3095/**
3096* Returns whether or not the data needs to be refreshed
3097*/
3098function isAuthorityMetadataExpired(metadata) {
3099	return metadata.expiresAt <= nowSeconds();
3100}
3101//#endregion
3102//#region node_modules/@azure/msal-common/dist-browser/telemetry/performance/PerformanceEvents.mjs
3103/*! @azure/msal-common v16.8.0 2026-06-10 */
3104/**
3105* Time spent sending/waiting for the response of a request to the token endpoint
3106*/
3107var NetworkClientSendPostRequestAsync = "networkClientSendPostRequestAsync";
3108var RefreshTokenClientExecutePostToTokenEndpoint = "refreshTokenClientExecutePostToTokenEndpoint";
3109var AuthorizationCodeClientExecutePostToTokenEndpoint = "authorizationCodeClientExecutePostToTokenEndpoint";
3110/**
3111* Time spent on the network for refresh token acquisition
3112*/
3113var RefreshTokenClientExecuteTokenRequest = "refreshTokenClientExecuteTokenRequest";

3114/**
3115* Time taken for acquiring refresh token , records RT size
3116*/
3117var RefreshTokenClientAcquireToken = "refreshTokenClientAcquireToken";
3118/**
3119* Time taken for acquiring cached refresh token
3120*/
3121var RefreshTokenClientAcquireTokenWithCachedRefreshToken = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
3122/**
3123* Helper function to create token request body in RefreshTokenClient (msal-common).
3124*/
3125var RefreshTokenClientCreateTokenRequestBody = "refreshTokenClientCreateTokenRequestBody";
3126var SilentFlowClientGenerateResultFromCacheRecord = "silentFlowClientGenerateResultFromCacheRecord";
3127/**
3128* getAuthCodeUrl API (msal-browser and msal-node).
3129*/
3130var GetAuthCodeUrl = "getAuthCodeUrl";
3131/**
3132* Functions from InteractionHandler (msal-browser)
3133*/
3134var HandleCodeResponseFromServer = "handleCodeResponseFromServer";
3135/**
3136* APIs in Authorization Code Client (msal-common)
3137*/
3138var AuthClientExecuteTokenRequest = "authClientExecuteTokenRequest";
3139var AuthClientCreateTokenRequestBody = "authClientCreateTokenRequestBody";
3140var UpdateTokenEndpointAuthority = "updateTokenEndpointAuthority";
3141/**
3142* Generate functions in PopTokenGenerator (msal-common)
3143*/
3144var PopTokenGenerateCnf = "popTokenGenerateCnf";
3145/**
3146* handleServerTokenResponse API in ResponseHandler (msal-common)
3147*/
3148var HandleServerTokenResponse = "handleServerTokenResponse";
3149/**
3150* Authority functions
3151*/
3152var AuthorityResolveEndpointsAsync = "authorityResolveEndpointsAsync";
3153var AuthorityGetCloudDiscoveryMetadataFromNetwork = "authorityGetCloudDiscoveryMetadataFromNetwork";
3154var AuthorityUpdateCloudDiscoveryMetadata = "authorityUpdateCloudDiscoveryMetadata";
3155var AuthorityGetEndpointMetadataFromNetwork = "authorityGetEndpointMetadataFromNetwork";
3156var AuthorityUpdateEndpointMetadata = "authorityUpdateEndpointMetadata";
3157var AuthorityUpdateMetadataWithRegionalInformation = "authorityUpdateMetadataWithRegionalInformation";
3158/**
3159* Region Discovery functions
3160*/
3161var RegionDiscoveryDetectRegion = "regionDiscoveryDetectRegion";
3162var RegionDiscoveryGetRegionFromIMDS = "regionDiscoveryGetRegionFromIMDS";
3163var RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
3164/**
3165* Cache operations
3166*/
3167var CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
3168var SetUserData = "setUserData";
3169//#endregion
3170//#region node_modules/@azure/msal-common/dist-browser/utils/FunctionWrappers.mjs
3171/*! @azure/msal-common v16.8.0 2026-06-10 */
3172/**
3173* Wraps a function with a performance measurement.
3174* Usage: invoke(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
3175* @param callback
3176* @param eventName
3177* @param logger
3178* @param telemetryClient
3179* @param correlationId
3180* @returns
3181* @internal
3182*/
3183var invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
3184	return (...args) => {
3185		logger.trace("1plfzx", correlationId);
3186		const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
3187		if (correlationId) telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
3188		try {
3189			const result = callback(...args);
3190			inProgressEvent.end({ success: true });
3191			logger.trace("1g8n6a", correlationId);
3192			return result;
3193		} catch (e) {
3194			logger.trace("0cfd8i", correlationId);
3195			try {
3196				logger.trace(JSON.stringify(e), correlationId);
3197			} catch (e) {
3198				logger.trace("00dty7", correlationId);
3199			}
3200			inProgressEvent.end({ success: false }, e);
3201			throw e;
3202		}
3203	};
3204};
3205/**
3206* Wraps an async function with a performance measurement.
3207* Usage: invokeAsync(functionToCall, performanceClient, "EventName", "correlationId")(...argsToPassToFunction)
3208* @param callback
3209* @param eventName
3210* @param logger
3211* @param telemetryClient
3212* @param correlationId
3213* @returns
3214* @internal
3215*
3216*/
3217var invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
3218	return (...args) => {
3219		logger.trace("1plfzx", correlationId);
3220		const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
3221		if (correlationId) telemetryClient.incrementFields({ [`ext.${eventName}CallCount`]: 1 }, correlationId);
3222		return callback(...args).then((response) => {
3223			logger.trace("1g8n6a", correlationId);
3224			inProgressEvent.end({ success: true });
3225			return response;
3226		}).catch((e) => {
3227			logger.trace("0cfd8i", correlationId);
3228			try {
3229				logger.trace(JSON.stringify(e), correlationId);
3230			} catch (e) {
3231				logger.trace("00dty7", correlationId);
3232			}
3233			inProgressEvent.end({ success: false }, e);
3234			throw e;
3235		});
3236	};
3237};
3238//#endregion
3239//#region node_modules/@azure/msal-common/dist-browser/crypto/PopTokenGenerator.mjs
3240/*! @azure/msal-common v16.8.0 2026-06-10 */
3241var KeyLocation = { SW: "sw" };
3242/** @internal */
3243var PopTokenGenerator = class {
3244	constructor(cryptoUtils, performanceClient) {
3245		this.cryptoUtils = cryptoUtils;
3246		this.performanceClient = performanceClient;
3247	}

3248	/**
3249	* Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
3250	* and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
3251	* @param request
3252	* @returns
3253	*/
3254	async generateCnf(request, logger) {
3255		const reqCnf = await invokeAsync(this.generateKid.bind(this), PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
3256		const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
3257		return {
3258			kid: reqCnf.kid,
3259			reqCnfString
3260		};
3261	}
3262	/**
3263	* Generates key_id for a SHR token request
3264	* @param request
3265	* @returns
3266	*/
3267	async generateKid(request) {
3268		return {
3269			kid: await this.cryptoUtils.getPublicKeyThumbprint(request),
3270			xms_ksl: KeyLocation.SW
3271		};
3272	}
3273	/**
3274	* Signs the POP access_token with the local generated key-pair
3275	* @param accessToken
3276	* @param request
3277	* @returns
3278	*/
3279	async signPopToken(accessToken, keyId, request) {
3280		return this.signPayload(accessToken, keyId, request);
3281	}
3282	/**
3283	* Utility function to generate the signed JWT for an access_token
3284	* @param payload
3285	* @param kid
3286	* @param request
3287	* @param claims
3288	* @returns
3289	*/
3290	async signPayload(payload, keyId, request, claims) {
3291		const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions } = request;
3292		const resourceUrlComponents = (resourceRequestUri ? new UrlString(resourceRequestUri) : void 0)?.getUrlComponents();
3293		return this.cryptoUtils.signJwt({
3294			at: payload,
3295			ts: nowSeconds(),
3296			m: resourceRequestMethod?.toUpperCase(),
3297			u: resourceUrlComponents?.HostNameAndPort,
3298			nonce: shrNonce || this.cryptoUtils.createNewGuid(),
3299			p: resourceUrlComponents?.AbsolutePath,
3300			q: resourceUrlComponents?.QueryString ? [[], resourceUrlComponents.QueryString] : void 0,
3301			client_claims: shrClaims || void 0,
3302			...claims
3303		}, keyId, shrOptions, request.correlationId);
3304	}
3305};
3306//#endregion
3307//#region node_modules/@azure/msal-common/dist-browser/error/InteractionRequiredAuthErrorCodes.mjs
3308/*! @azure/msal-common v16.8.0 2026-06-10 */
3309/**
3310* MSAL-defined interaction required error code indicating no tokens are found in cache.
3311* @public
3312*/
3313var noTokensFound = "no_tokens_found";
3314/**
3315* MSAL-defined error code indicating a native account is unavailable on the platform.
3316* @public
3317*/
3318var nativeAccountUnavailable = "native_account_unavailable";
3319/**
3320* MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
3321* @public
3322*/
3323var refreshTokenExpired = "refresh_token_expired";
3324/**
3325* MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
3326* @public
3327*/
3328var uiNotAllowed = "ui_not_allowed";
3329//#endregion
3330//#region node_modules/@azure/msal-common/dist-browser/error/InteractionRequiredAuthError.mjs
3331/*! @azure/msal-common v16.8.0 2026-06-10 */
3332/**
3333* InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
3334*/
3335var InteractionRequiredServerErrorMessage = [
3336	"interaction_required",
3337	"consent_required",
3338	"login_required",
3339	"bad_token",
3340	uiNotAllowed,
3341	"interrupted_user"
3342];
3343var InteractionRequiredAuthSubErrorMessage = [
3344	"message_only",
3345	"additional_action",
3346	"basic_action",
3347	"user_password_expired",
3348	"consent_required",
3349	"bad_token",
3350	"ui_not_allowed",
3351	"interrupted_user"
3352];
3353/**
3354* Error thrown when user interaction is required.
3355*/
3356var InteractionRequiredAuthError = class InteractionRequiredAuthError extends AuthError {
3357	constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
3358		super(errorCode, errorMessage, subError);
3359		Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
3360		this.timestamp = timestamp || "";
3361		this.traceId = traceId || "";
3362		this.correlationId = correlationId || "";
3363		this.claims = claims || "";
3364		this.name = "InteractionRequiredAuthError";
3365		this.errorNo = errorNo;
3366	}
3367};
3368/**
3369* Helper function used to determine if an error thrown by the server requires interaction to resolve
3370* @param errorCode
3371* @param errorString
3372* @param subError
3373*/
3374function isInteractionRequiredError(errorCode, errorString, subError) {
3375	const isInteractionRequiredErrorCode = !!errorCode && InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
3376	const isInteractionRequiredSubError = !!subError && InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
3377	const isInteractionRequiredErrorDesc = !!errorString && InteractionRequiredServerErrorMessage.some((irErrorCode) => {
3378		return errorString.indexOf(irErrorCode) > -1;
3379	});
3380	return isInteractionRequiredErrorCode || isInteractionRequiredErrorDesc || isInteractionRequiredSubError;
3381}
3382/**
3383* Creates an InteractionRequiredAuthError
3384*/
3385function createInteractionRequiredAuthError(errorCode, errorMessage) {
3386	return new InteractionRequiredAuthError(errorCode, errorMessage);
3387}
3388//#endregion
3389//#region node_modules/@azure/msal-common/dist-browser/error/ServerError.mjs
3390/*! @azure/msal-common v16.8.0 2026-06-10 */
3391/**
3392* Error thrown when there is an error with the server code, for example, unavailability.
3393*/
3394var ServerError = class ServerError extends AuthError {
3395	constructor(errorCode, errorMessage, subError, errorNo, status) {
3396		super(errorCode, errorMessage, subError);
3397		this.name = "ServerError";
3398		this.errorNo = errorNo;
3399		this.status = status;
3400		Object.setPrototypeOf(this, ServerError.prototype);
3401	}
3402};
3403//#endregion
3404//#region node_modules/@azure/msal-common/dist-browser/utils/ProtocolUtils.mjs
3405/*! @azure/msal-common v16.8.0 2026-06-10 */
3406/**
3407* Appends user state with random guid, or returns random guid.
3408* @param cryptoObj
3409* @param userState
3410* @param meta
3411*/
3412function setRequestState(cryptoObj, userState, meta) {
3413	const libraryState = generateLibraryState(cryptoObj, meta);
3414	return userState ? `${libraryState}|${userState}` : libraryState;
3415}
3416/**
3417* Generates the state value used by the common library.
3418* @param cryptoObj
3419* @param meta
3420*/
3421function generateLibraryState(cryptoObj, meta) {
3422	if (!cryptoObj) throw createClientAuthError(noCryptoObject);
3423	const stateObj = { id: cryptoObj.createNewGuid() };
3424	if (meta) stateObj.meta = meta;
3425	const stateString = JSON.stringify(stateObj);
3426	return cryptoObj.base64Encode(stateString);
3427}
3428/**
3429* Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
3430* @param base64Decode
3431* @param state
3432*/
3433function parseRequestState(base64Decode, state) {
3434	if (!base64Decode) throw createClientAuthError(noCryptoObject);
3435	if (!state) throw createClientAuthError(invalidState);
3436	try {
3437		const splitState = state.split("|");

3438		const libraryState = splitState[0];
3439		const userState = splitState.length > 1 ? splitState.slice(1).join("|") : "";
3440		const libraryStateString = base64Decode(libraryState);
3441		const libraryStateObj = JSON.parse(libraryStateString);
3442		return {
3443			userRequestState: userState || "",
3444			libraryState: libraryStateObj
3445		};
3446	} catch (e) {
3447		throw createClientAuthError(invalidState);
3448	}
3449}
3450//#endregion
3451//#region node_modules/@azure/msal-common/dist-browser/response/ResponseHandler.mjs
3452/*! @azure/msal-common v16.8.0 2026-06-10 */
3453/**
3454* Class that handles response parsing.
3455* @internal
3456*/
3457var ResponseHandler = class ResponseHandler {
3458	constructor(clientId, cacheStorage, cryptoObj, logger, performanceClient, serializableCache, persistencePlugin) {
3459		this.clientId = clientId;
3460		this.cacheStorage = cacheStorage;
3461		this.cryptoObj = cryptoObj;
3462		this.logger = logger;
3463		this.performanceClient = performanceClient;
3464		this.serializableCache = serializableCache;
3465		this.persistencePlugin = persistencePlugin;
3466	}
3467	/**
3468	* Function which validates server authorization token response.
3469	* @param serverResponse
3470	* @param correlationId
3471	* @param refreshAccessToken
3472	*/
3473	validateTokenResponse(serverResponse, correlationId, refreshAccessToken) {
3474		if (serverResponse.error || serverResponse.error_description || serverResponse.suberror) {
3475			const errString = `Error(s): ${serverResponse.error_codes || "Not Available"} - Timestamp: ${serverResponse.timestamp || "Not Available"} - Description: ${serverResponse.error_description || "Not Available"} - Correlation ID: ${serverResponse.correlation_id || "Not Available"} - Trace ID: ${serverResponse.trace_id || "Not Available"}`;
3476			const serverErrorNo = serverResponse.error_codes?.length ? serverResponse.error_codes[0] : void 0;
3477			const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
3478			if (refreshAccessToken && serverResponse.status && serverResponse.status >= 500 && serverResponse.status <= 599) {
3479				this.logger.warning("16ks7j", correlationId);
3480				return;
3481			} else if (refreshAccessToken && serverResponse.status && serverResponse.status >= 400 && serverResponse.status <= 499) {
3482				this.logger.warning("0g61x3", correlationId);
3483				return;
3484			}
3485			if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
3486			throw serverError;
3487		}
3488	}
3489	/**
3490	* Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
3491	* @param serverTokenResponse
3492	* @param authority
3493	*/
3494	async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
3495		let idTokenClaims;
3496		if (serverTokenResponse.id_token) {
3497			idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
3498			if (authCodePayload && authCodePayload.nonce) {
3499				if (idTokenClaims.nonce !== authCodePayload.nonce) throw createClientAuthError(nonceMismatch);
3500			}
3501			if (request.maxAge || request.maxAge === 0) {
3502				const authTime = idTokenClaims.auth_time;
3503				if (!authTime) throw createClientAuthError(authTimeNotFound);
3504				checkMaxAge(authTime, request.maxAge);
3505			}
3506		}
3507		this.homeAccountIdentifier = generateHomeAccountId(serverTokenResponse.client_info || "", authority.authorityType, this.logger, this.cryptoObj, request.correlationId, idTokenClaims);
3508		let requestStateObj;
3509		if (!!authCodePayload && !!authCodePayload.state) requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
3510		serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || void 0;
3511		const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
3512		let cacheContext;
3513		try {
3514			if (this.persistencePlugin && this.serializableCache) {
3515				this.logger.verbose("0jbz5k", request.correlationId);
3516				cacheContext = new TokenCacheContext(this.serializableCache, true);
3517				await this.persistencePlugin.beforeCacheAccess(cacheContext);
3518			}
3519			if (handlingRefreshTokenResponse && !forceCacheRefreshTokenResponse && cacheRecord.account) {
3520				if (this.cacheStorage.getAllAccounts({
3521					homeAccountId: cacheRecord.account.homeAccountId,
3522					environment: cacheRecord.account.environment
3523				}, request.correlationId).length < 1) {
3524					this.logger.warning("1gmt66", request.correlationId);
3525					this.performanceClient?.addFields({ acntLoggedOut: true }, request.correlationId);
3526					return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, c

3526acheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, void 0, serverRequestId);
3527				}
3528			}
3529			await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), apiId, request.storeInCache);
3530		} finally {
3531			if (this.persistencePlugin && this.serializableCache && cacheContext) {
3532				this.logger.verbose("1bh17u", request.correlationId);
3533				await this.persistencePlugin.afterCacheAccess(cacheContext);
3534			}
3535		}
3536		return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, this.performanceClient, idTokenClaims, requestStateObj, serverTokenResponse, serverRequestId);
3537	}
3538	/**
3539	* Generates CacheRecord
3540	* @param serverTokenResponse
3541	* @param idTokenObj
3542	* @param authority
3543	*/
3544	generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
3545		const env = authority.getPreferredCache();
3546		if (!env) throw createClientAuthError(invalidCacheEnvironment);
3547		const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
3548		let cachedIdToken;
3549		let cachedAccount;
3550		if (serverTokenResponse.id_token && !!idTokenClaims) {
3551			cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
3552			cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, void 0, this.logger, this.performanceClient);
3553		}
3554		let cachedAccessToken = null;
3555		if (serverTokenResponse.access_token) {
3556			const responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
3557			const expiresIn = (typeof serverTokenResponse.expires_in === "string" ? parseInt(serverTokenResponse.expires_in, 10) : serverTokenResponse.expires_in) || 0;
3558			const extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string" ? parseInt(serverTokenResponse.ext_expires_in, 10) : serverTokenResponse.ext_expires_in) || 0;
3559			const refreshIn = (typeof serverTokenResponse.refresh_in === "string" ? parseInt(serverTokenResponse.refresh_in, 10) : serverTokenResponse.refresh_in) || void 0;
3560			const tokenExpirationSeconds = reqTimestamp + expiresIn;
3561			const extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
3562			const refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : void 0;
3563			cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
3564			const resource = request.resource || null;
3565			if (resource) cachedAccessToken.resource = resource;
3566		}
3567		let cachedRefreshToken = null;
3568		if (serverTokenResponse.refresh_token) {
3569			let rtExpiresOn;
3570			if (serverTokenResponse.refresh_token_expires_in) {
3571				rtExpiresOn = reqTimestamp + (typeof serverTokenResponse.refresh_token_expires_in === "string" ? parseInt(serverTokenResponse.refresh_token_expires_in, 10) : serverTokenResponse.refresh_token_expires_in);
3572				this.performanceClient?.addFields({ ntwkRtExpiresOnSeconds: rtExpiresOn }, request.correlationId);
3573			}
3574			cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
3575		}
3576		let cachedAppMetadata = null;
3577		if (serverTokenResponse.foci) cachedAppMetadata = {
3578			clientId: this.clientId,
3579			environment: env,
3580			familyId: serverTokenResponse.foci
3581		};
3582		return {
3583			account: cachedAccount,
3584			idToken: cachedIdToken,
3585			accessToken: cachedAccessToken,
3586			refreshToken: cachedRefreshToken,
3587			appMetadata: cachedAppMetadata
3588		};
3589	}
3590	/**
3591	* Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
3592	*

3593	* Optionally takes a state string that is set as-is in the response.
3594	*
3595	* @param cacheRecord
3596	* @param idTokenObj
3597	* @param fromTokenCache
3598	* @param stateString
3599	*/
3600	static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, performanceClient, idTokenClaims, requestState, serverTokenResponse, requestId) {
3601		let accessToken = "";
3602		let responseScopes = [];
3603		let expiresOn = null;
3604		let extExpiresOn;
3605		let refreshOn;
3606		let familyId = "";
3607		if (cacheRecord.accessToken) {
3608			if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP && !request.popKid) {
3609				const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
3610				const { secret, keyId } = cacheRecord.accessToken;
3611				if (!keyId) throw createClientAuthError(keyIdMissing);
3612				accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
3613			} else accessToken = cacheRecord.accessToken.secret;
3614			responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
3615			expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
3616			extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
3617			if (cacheRecord.accessToken.refreshOn) refreshOn = toDateFromSeconds(cacheRecord.accessToken.refreshOn);
3618		}
3619		if (cacheRecord.appMetadata) familyId = cacheRecord.appMetadata.familyId === "1" ? "1" : "";
3620		const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
3621		const tid = idTokenClaims?.tid || "";
3622		if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) cacheRecord.account.nativeAccountId = serverTokenResponse?.spa_accountid;
3623		const accountInfo = cacheRecord.account ? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), void 0, idTokenClaims, cacheRecord.idToken?.secret) : null;
3624		return {
3625			authority: authority.canonicalAuthority,
3626			uniqueId: uid,
3627			tenantId: tid,
3628			scopes: responseScopes,
3629			account: accountInfo,
3630			idToken: cacheRecord?.idToken?.secret || "",
3631			idTokenClaims: idTokenClaims || {},
3632			accessToken,
3633			fromCache: fromTokenCache,
3634			expiresOn,
3635			extExpiresOn,
3636			refreshOn,
3637			correlationId: request.correlationId,
3638			requestId: requestId || "",
3639			familyId,
3640			tokenType: cacheRecord.accessToken?.tokenType || "",
3641			state: requestState ? requestState.userRequestState : "",
3642			cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
3643			msGraphHost: cacheRecord.account?.msGraphHost || "",
3644			code: serverTokenResponse?.spa_code,
3645			fromPlatformBroker: false
3646		};
3647	}
3648};
3649function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
3650	logger?.verbose("09jz0t", correlationId);
3651	const accountEnvironment = environment || authority.getPreferredCache();
3652	const matchedAccounts = cacheStorage.getAccountsFilteredBy({
3653		homeAccountId,
3654		environment: accountEnvironment
3655	}, correlationId);
3656	performanceClient?.addFields({ cacheMatchedAccounts: matchedAccounts.length }, correlationId);
3657	if (matchedAccounts.length > 1) logger?.warning("0x7ad1", correlationId);
3658	const baseAccount = (matchedAccounts.length === 1 ? matchedAccounts[0] : null) || createAccountEntity({
3659		homeAccountId,
3660		idTokenClaims,
3661		clientInfo,
3662		environment,
3663		cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
3664		msGraphHost: authCodePayload?.msgraph_host,
3665		nativeAccountId
3666	}, authority, base64Decode);
3667	const tenantProfiles = baseAccount.tenantProfiles || [];
3668	const tenantId = claimsTenantId || baseAccount.realm;
3669	if (tenantId && !tenantProfiles.find((tenantProfile) => {
3670		return tenantProfile.tenantId === tenantId;
3671	})) {
3672		const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
3673		tenantProfiles.push(newTenantProfile);
3674	}
3675	baseAccount.tenantProfiles = tenantProfiles;
3676	return baseAccount;
3677}
3678//#endregion
3679//#region node_modules/@azure/msal-common/dist-browser/account/CcsCredential.mjs
3680/*! @azure/msal-common v16.8.0 2026-06-10 */
3681var CcsCredentialType = {
3682	HOME_ACCOUNT_ID: "home_account_id",
3683	UPN: "UPN"
3684};
3685//#endregion
3686//#region node_modules/@azure/msal-common/dist-browser/utils/ClientAssertionUtils.mjs
3687/*! @azure/msal-common v16.8.0 2026-06-10 */
3688async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
3689	if (typeof clientAssertion === "string") return clientAssertion;
3690	else return clientAssertion({
3691		clientId,
3692		tokenEndpoint
3693	});
3694}
3695//#endregion
3696//#region node_modules/@azure/msal-common/dist-browser/network/RequestThumbprint.mjs
3697/*! @azure/msal-common v16.8.0 2026-06-10 */
3698function getRequestThumbprint(clientId, request, homeAccountId) {
3699	return {
3700		clientId,
3701		authority: request.authority,
3702		scopes: request.scopes,
3703		homeAccountIdentifier: homeAccountId,
3704		claims: request.claims,
3705		authenticationScheme: request.authenticationScheme,
3706		resourceRequestMethod: request.resourceRequestMethod,
3707		resourceRequestUri: request.resourceRequestUri,
3708		shrClaims: request.shrClaims,
3709		sshKid: request.sshKid,
3710		embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId
3711	};
3712}
3713//#endregion
3714//#region node_modules/@azure/msal-common/dist-browser/network/ThrottlingUtils.mjs
3715/*! @azure/msal-common v16.8.0 2026-06-10 */
3716/** @internal */
3717var ThrottlingUtils = class ThrottlingUtils {
3718	/**
3719	* Prepares a RequestThumbprint to be stored as a key.
3720	* @param thumbprint
3721	*/
3722	static generateThrottlingStorageKey(thumbprint) {

3723		return `${THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
3724	}
3725	/**
3726	* Performs necessary throttling checks before a network request.
3727	* @param cacheManager
3728	* @param thumbprint
3729	*/
3730	static preProcess(cacheManager, thumbprint, correlationId) {
3731		const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
3732		const value = cacheManager.getThrottlingCache(key, correlationId);
3733		if (value) {
3734			if (value.throttleTime < Date.now()) {
3735				cacheManager.removeItem(key, correlationId);
3736				return;
3737			}
3738			throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
3739		}
3740	}
3741	/**
3742	* Performs necessary throttling checks after a network request.
3743	* @param cacheManager
3744	* @param thumbprint
3745	* @param response
3746	*/
3747	static postProcess(cacheManager, thumbprint, response, correlationId) {
3748		if (ThrottlingUtils.checkResponseStatus(response) || ThrottlingUtils.checkResponseForRetryAfter(response)) {
3749			const thumbprintValue = {
3750				throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
3751				error: response.body.error,
3752				errorCodes: response.body.error_codes,
3753				errorMessage: response.body.error_description,
3754				subError: response.body.suberror
3755			};
3756			cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
3757		}
3758	}
3759	/**
3760	* Checks a NetworkResponse object's status codes against 429 or 5xx
3761	* @param response
3762	*/
3763	static checkResponseStatus(response) {
3764		return response.status === 429 || response.status >= 500 && response.status < 600;
3765	}
3766	/**
3767	* Checks a NetworkResponse object's RetryAfter header
3768	* @param response
3769	*/
3770	static checkResponseForRetryAfter(response) {
3771		if (response.headers) return response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) && (response.status < 200 || response.status >= 300);
3772		return false;
3773	}
3774	/**
3775	* Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
3776	* @param throttleTime
3777	*/
3778	static calculateThrottleTime(throttleTime) {
3779		const time = throttleTime <= 0 ? 0 : throttleTime;
3780		const currentSeconds = Date.now() / 1e3;
3781		return Math.floor(Math.min(currentSeconds + (time || 60), currentSeconds + DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1e3);
3782	}
3783	static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
3784		const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
3785		const key = this.generateThrottlingStorageKey(thumbprint);
3786		cacheManager.removeItem(key, request.correlationId);
3787	}
3788};
3789//#endregion
3790//#region node_modules/@azure/msal-common/dist-browser/error/NetworkError.mjs
3791/*! @azure/msal-common v16.8.0 2026-06-10 */
3792/**
3793* Represents network related errors
3794*/
3795var NetworkError = class NetworkError extends AuthError {
3796	constructor(error, httpStatus, responseHeaders) {
3797		super(error.errorCode, error.errorMessage, error.subError);
3798		Object.setPrototypeOf(this, NetworkError.prototype);
3799		this.name = "NetworkError";
3800		this.error = error;
3801		this.httpStatus = httpStatus;
3802		this.responseHeaders = responseHeaders;
3803	}
3804};
3805/**
3806* Creates NetworkError object for a failed network request
3807* @param error - Error to be thrown back to the caller
3808* @param httpStatus - Status code of the network request
3809* @param responseHeaders - Response headers of the network request, when available
3810* @returns NetworkError object
3811*/
3812function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
3813	error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
3814	return new NetworkError(error, httpStatus, responseHeaders);
3815}
3816//#endregion
3817//#region node_modules/@azure/msal-common/dist-browser/protocol/Token.mjs
3818/*! @azure/msal-common v16.8.0 2026-06-10 */
3819/**
3820* Creates default headers for requests to token endpoint
3821*/
3822function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
3823	const headers = {};
3824	headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
3825	if (!preventCorsPreflight && ccsCred) switch (ccsCred.type) {
3826		case CcsCredentialType.HOME_ACCOUNT_ID:
3827			try {
3828				const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
3829				headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
3830			} catch (e) {
3831				logger.verbose("1qhtee", "");
3832			}
3833			break;
3834		case CcsCredentialType.UPN:
3835			headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
3836			break;
3837	}
3838	return headers;
3839}
3840/**
3841* Creates query string for the /token request
3842* @param request
3843*/
3844function createTokenQueryParameters(request, clientId, redirectUri, performanceClient) {
3845	const parameters = /* @__PURE__ */ new Map();
3846	if (request.embeddedClientId) addBrokerParameters(parameters, clientId, redirectUri);
3847	if (request.extraQueryParameters) addExtraParameters(parameters, request.extraQueryParameters);
3848	addCorrelationId(parameters, request.correlationId);
3849	instrumentBrokerParams(parameters, request.correlationId, performanceClient);
3850	return mapToQueryString(parameters);
3851}
3852/**
3853* Http post to token endpoint
3854* @param tokenEndpoint
3855* @param queryString
3856* @param headers
3857* @param thumbprint
3858*/
3859async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
3860	const response = await sendPostRequest(thumbprint, tokenEndpoint, {
3861		body: queryString,
3862		headers
3863	}, correlationId, cacheManager, networkClient, logger, performanceClient);
3864	if (serverTelemetryManager && response.status < 500 && response.status !== 429) serverTelemetryManager.clearTelemetryCache();
3865	return response;
3866}
3867/**
3868* Wraps sendPostRequestAsync with necessary preflight and postflight logic
3869* @param thumbprint - Request thumbprint for throttling
3870* @param tokenEndpoint - Endpoint to make the POST to
3871* @param options - Body and Headers to include on the POST request
3872* @param correlationId - CorrelationId for telemetry
3873* @param cacheManager - Cache manager instance
3874* @param networkClient - Network module instance

3875* @param logger - Logger instance
3876* @param performanceClient - Performance client instance
3877*/
3878async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
3879	ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
3880	let response;
3881	try {
3882		response = await invokeAsync(networkClient.sendPostRequestAsync.bind(networkClient), NetworkClientSendPostRequestAsync, logger, performanceClient, correlationId)(tokenEndpoint, options);
3883		const responseHeaders = response.headers || {};
3884		performanceClient?.addFields({
3885			refreshTokenSize: response.body.refresh_token?.length || 0,
3886			httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
3887			requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || ""
3888		}, correlationId);
3889	} catch (e) {
3890		if (e instanceof NetworkError) {
3891			const responseHeaders = e.responseHeaders;
3892			if (responseHeaders) performanceClient?.addFields({
3893				httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
3894				requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
3895				contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] || void 0,
3896				contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] || void 0,
3897				httpStatus: e.httpStatus
3898			}, correlationId);
3899			throw e.error;
3900		}
3901		if (e instanceof AuthError) throw e;
3902		else throw createClientAuthError(networkError);
3903	}
3904	ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
3905	return response;
3906}
3907//#endregion
3908//#region node_modules/@azure/msal-common/dist-browser/authority/OpenIdConfigResponse.mjs
3909/*! @azure/msal-common v16.8.0 2026-06-10 */
3910function isOpenIdConfigResponse(response) {
3911	return response.hasOwnProperty("authorization_endpoint") && response.hasOwnProperty("token_endpoint") && response.hasOwnProperty("issuer") && response.hasOwnProperty("jwks_uri");
3912}
3913//#endregion
3914//#region node_modules/@azure/msal-common/dist-browser/authority/CloudInstanceDiscoveryResponse.mjs
3915/*! @azure/msal-common v16.8.0 2026-06-10 */
3916function isCloudInstanceDiscoveryResponse(response) {
3917	return response.hasOwnProperty("tenant_discovery_endpoint") && response.hasOwnProperty("metadata");
3918}
3919//#endregion
3920//#region node_modules/@azure/msal-common/dist-browser/authority/CloudInstanceDiscoveryErrorResponse.mjs
3921/*! @azure/msal-common v16.8.0 2026-06-10 */
3922function isCloudInstanceDiscoveryErrorResponse(response) {
3923	return response.hasOwnProperty("error") && response.hasOwnProperty("error_description");
3924}
3925//#endregion
3926//#region node_modules/@azure/msal-common/dist-browser/authority/RegionDiscovery.mjs
3927/*! @azure/msal-common v16.8.0 2026-06-10 */
3928var RegionDiscovery = class RegionDiscovery {
3929	constructor(networkInterface, logger, performanceClient, correlationId) {
3930		this.networkInterface = networkInterface;
3931		this.logger = logger;
3932		this.performanceClient = performanceClient;
3933		this.correlationId = correlationId;
3934	}
3935	/**
3936	* Detect the region from the application's environment.
3937	*
3938	* @returns Promise<string | null>
3939	*/
3940	async detectRegion(environmentRegion, regionDiscoveryMetadata) {
3941		let autodetectedRegionName = environmentRegion;
3942		if (!autodetectedRegionName) {
3943			const options = RegionDiscovery.IMDS_OPTIONS;
3944			try {
3945				const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
3946				if (localIMDSVersionResponse.status === 200) {
3947					autodetectedRegionName = localIMDSVersionResponse.body;
3948					regionDiscoveryMetadata.region_source = RegionDiscoverySources.IMDS;
3949				}
3950				if (localIMDSVersionResponse.status === 400) {
3951					const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
3952					if (!currentIMDSVersion) {
3953						regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
3954						return null;
3955					}
3956					const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
3957					if (currentIMDSVersionResponse.status === 200) {
3958						autodetectedRegionName = currentIMDSVersionResponse.body;
3959						regionDiscoveryMetadata.region_source = RegionDiscoverySources.IMDS;
3960					}
3961				}
3962			} catch (e) {
3963				regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
3964				return null;
3965			}
3966		} else regionDiscoveryMetadata.region_source = RegionDiscoverySources.ENVIRONMENT_VARIABLE;
3967		if (!autodetectedRegionName) regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
3968		return autodetectedRegionName || null;
3969	}

3970	/**
3971	* Make the call to the IMDS endpoint
3972	*
3973	* @param imdsEndpointUrl
3974	* @returns Promise<NetworkResponse<string>>
3975	*/
3976	async getRegionFromIMDS(version, options) {
3977		return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
3978	}
3979	/**
3980	* Get the most recent version of the IMDS endpoint available
3981	*
3982	* @returns Promise<string | null>
3983	*/
3984	async getCurrentVersion(options) {
3985		try {
3986			const response = await this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?format=json`, options);
3987			if (response.status === 400 && response.body && response.body["newest-versions"] && response.body["newest-versions"].length > 0) return response.body["newest-versions"][0];
3988			return null;
3989		} catch (e) {
3990			return null;
3991		}
3992	}
3993};
3994RegionDiscovery.IMDS_OPTIONS = { headers: { Metadata: "true" } };
3995//#endregion
3996//#region node_modules/@azure/msal-common/dist-browser/authority/Authority.mjs
3997/*! @azure/msal-common v16.8.0 2026-06-10 */
3998/**
3999* The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
4000* endpoint. It will store the pertinent config data in this object for use during token calls.
4001* @internal
4002*/
4003var Authority = class Authority {
4004	constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient, managedIdentity) {
4005		this.canonicalAuthority = authority;
4006		this._canonicalAuthority.validateAsUri();
4007		this.networkInterface = networkInterface;
4008		this.cacheManager = cacheManager;
4009		this.authorityOptions = authorityOptions;
4010		this.regionDiscoveryMetadata = {
4011			region_used: void 0,
4012			region_source: void 0,
4013			region_outcome: void 0
4014		};
4015		this.logger = logger;
4016		this.performanceClient = performanceClient;
4017		this.correlationId = correlationId;
4018		this.managedIdentity = managedIdentity || false;
4019		this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
4020	}
4021	/**
4022	* Get {@link AuthorityType}
4023	* @param authorityUri {@link IUri}
4024	* @private
4025	*/
4026	getAuthorityType(authorityUri) {
4027		if (authorityUri.HostNameAndPort.endsWith(".ciamlogin.com")) return AuthorityType.Ciam;
4028		const pathSegments = authorityUri.PathSegments;
4029		if (pathSegments.length) switch (pathSegments[0].toLowerCase()) {
4030			case ADFS: return AuthorityType.Adfs;
4031			case DSTS: return AuthorityType.Dsts;
4032		}
4033		return AuthorityType.Default;
4034	}
4035	get authorityType() {
4036		return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
4037	}
4038	/**
4039	* ProtocolMode enum representing the way endpoints are constructed.
4040	*/
4041	get protocolMode() {
4042		return this.authorityOptions.protocolMode;
4043	}

4044	/**
4045	* Returns authorityOptions which can be used to reinstantiate a new authority instance
4046	*/
4047	get options() {
4048		return this.authorityOptions;
4049	}
4050	/**
4051	* A URL that is the authority set by the developer
4052	*/
4053	get canonicalAuthority() {
4054		return this._canonicalAuthority.urlString;
4055	}
4056	/**
4057	* Sets canonical authority.
4058	*/
4059	set canonicalAuthority(url) {
4060		this._canonicalAuthority = new UrlString(url);
4061		this._canonicalAuthority.validateAsUri();
4062		this._canonicalAuthorityUrlComponents = null;
4063	}
4064	/**
4065	* Get authority components.
4066	*/
4067	get canonicalAuthorityUrlComponents() {
4068		if (!this._canonicalAuthorityUrlComponents) this._canonicalAuthorityUrlComponents = this._canonicalAuthority.getUrlComponents();
4069		return this._canonicalAuthorityUrlComponents;
4070	}
4071	/**
4072	* Get hostname and port i.e. login.microsoftonline.com
4073	*/
4074	get hostnameAndPort() {
4075		return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();
4076	}
4077	/**
4078	* Get tenant for authority.
4079	*/
4080	get tenant() {
4081		return this.canonicalAuthorityUrlComponents.PathSegments[0];
4082	}
4083	/**
4084	* OAuth /authorize endpoint for requests
4085	*/
4086	get authorizationEndpoint() {
4087		if (this.discoveryComplete()) return this.replacePath(this.metadata.authorization_endpoint);
4088		else throw createClientAuthError(endpointResolutionError);
4089	}
4090	/**
4091	* OAuth /token endpoint for requests
4092	*/
4093	get tokenEndpoint() {
4094		if (this.discoveryComplete()) return this.replacePath(this.metadata.token_endpoint);
4095		else throw createClientAuthError(endpointResolutionError);
4096	}
4097	get deviceCodeEndpoint() {
4098		if (this.discoveryComplete()) return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
4099		else throw createClientAuthError(endpointResolutionError);
4100	}
4101	/**
4102	* OAuth logout endpoint for requests
4103	*/
4104	get endSessionEndpoint() {
4105		if (this.discoveryComplete()) {
4106			if (!this.metadata.end_session_endpoint) throw createClientAuthError(endSessionEndpointNotSupported);
4107			return this.replacePath(this.metadata.end_session_endpoint);
4108		} else throw createClientAuthError(endpointResolutionError);
4109	}
4110	/**
4111	* OAuth issuer for requests
4112	*/
4113	get selfSignedJwtAudience() {
4114		if (this.discoveryComplete()) return this.replacePath(this.metadata.issuer);
4115		else throw createClientAuthError(endpointResolutionError);
4116	}
4117	/**
4118	* Jwks_uri for token signing keys
4119	*/
4120	get jwksUri() {
4121		if (this.discoveryComplete()) return this.replacePath(this.metadata.jwks_uri);
4122		else throw createClientAuthError(endpointResolutionError);
4123	}
4124	/**
4125	* Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
4126	* @param authorityUri {@link IUri}
4127	* @private
4128	*/
4129	canReplaceTenant(authorityUri) {
4130		return authorityUri.PathSegments.length === 1 && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) && this.getAuthorityType(authorityUri) === AuthorityType.Default && this.protocolMode !== ProtocolMode.OIDC;
4131	}
4132	/**
4133	* Replaces tenant in url path with current tenant. Defaults to common.
4134	* @param urlString
4135	*/
4136	replaceTenant(urlString) {
4137		return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);
4138	}
4139	/**
4140	* Replaces path such as tenant or policy with the current tenant or policy.
4141	* @param urlString
4142	*/
4143	replacePath(urlString) {
4144		let endpoint = urlString;
4145		const cachedAuthorityUrlComponents = new UrlString(this.metadata.canonical_authority).getUrlComponents();
4146		const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
4147		this.canonicalAuthorityUrlComponents.PathSegments.forEach((currentPart, index) => {
4148			let cachedPart = cachedAuthorityParts[index];
4149			if (index === 0 && this.canReplaceTenant(cachedAuthorityUrlComponents)) {
4150				const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
4151				/**
4152				* Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
4153				* by comparing its first path segment to the corresponding authorization endpoint path segment, which is
4154				* always resolved with tenant id by OIDC.
4155				*/
4156				if (cachedPart !== tenantId) {
4157					this.logger.verbose("1q3g2x", this.correlationId);
4158					cachedPart = tenantId;
4159				}
4160			}
4161			if (currentPart !== cachedPart) endpoint = endpoint.replace(`/${cachedPart}/`, `/${currentPart}/`);
4162		});
4163		return this.replaceTenant(endpoint);
4164	}
4165	/**
4166	* The default open id configuration endpoint for any canonical authority.
4167	*/
4168	get defaultOpenIdConfigurationEndpoint() {
4169		const canonicalAuthorityHost = this.hostnameAndPort;
4170		if (this.canonicalAuthority.endsWith("v2.0/") || this.authorityType === AuthorityType.Adfs || this.protocolMode === ProtocolMode.OIDC && !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost)) return `${this.canonicalAuthority}.well-known/openid-configuration`;
4171		return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
4172	}

4173	/**
4174	* Boolean that returns whether or not tenant discovery has been completed.
4175	*/
4176	discoveryComplete() {
4177		return !!this.metadata;
4178	}
4179	/**
4180	* Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
4181	* and the /authorize, /token and logout endpoints.
4182	*/
4183	async resolveEndpointsAsync() {
4184		const metadataEntity = this.getCurrentMetadataEntity();
4185		const cloudDiscoverySource = await invokeAsync(this.updateCloudDiscoveryMetadata.bind(this), AuthorityUpdateCloudDiscoveryMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
4186		this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
4187		const endpointSource = await invokeAsync(this.updateEndpointMetadata.bind(this), AuthorityUpdateEndpointMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
4188		this.updateCachedMetadata(metadataEntity, cloudDiscoverySource, { source: endpointSource });
4189		this.performanceClient?.addFields({
4190			cloudDiscoverySource,
4191			authorityEndpointSource: endpointSource
4192		}, this.correlationId);
4193	}
4194	/**
4195	* Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
4196	* from the configured canonical authority
4197	* @returns
4198	*/
4199	getCurrentMetadataEntity() {
4200		let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort, this.correlationId);
4201		if (!metadataEntity) metadataEntity = {
4202			aliases: [],
4203			preferred_cache: this.hostnameAndPort,
4204			preferred_network: this.hostnameAndPort,
4205			canonical_authority: this.canonicalAuthority,
4206			authorization_endpoint: "",
4207			token_endpoint: "",
4208			end_session_endpoint: "",
4209			issuer: "",
4210			aliasesFromNetwork: false,
4211			endpointsFromNetwork: false,
4212			expiresAt: generateAuthorityMetadataExpiresAt(),
4213			jwks_uri: ""
4214		};
4215		return metadataEntity;
4216	}
4217	/**
4218	* Updates cached metadata based on metadata source and sets the instance's metadata
4219	* property to the same value
4220	* @param metadataEntity
4221	* @param cloudDiscoverySource
4222	* @param endpointMetadataResult
4223	*/
4224	updateCachedMetadata(metadataEntity, cloudDiscoverySource, endpointMetadataResult) {
4225		if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE && endpointMetadataResult?.source !== AuthorityMetadataSource.CACHE) {
4226			metadataEntity.expiresAt = generateAuthorityMetadataExpiresAt();
4227			metadataEntity.canonical_authority = this.canonicalAuthority;
4228		}
4229		const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache, this.correlationId);
4230		this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity, this.correlationId);
4231		this.metadata = metadataEntity;
4232	}
4233	/**
4234	* Update AuthorityMetadataEntity with new endpoints and return where the information came from
4235	* @param metadataEntity
4236	*/
4237	async updateEndpointMetadata(metadataEntity) {
4238		const localMetadata = this.updateEndpointMetadataFromLocalSources(metadataEntity);
4239		if (localMetadata) {
4240			if (localMetadata.source === AuthorityMetadataSource.HARDCODED_VALUES) {
4241				if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
4242					if (localMetadata.metadata) {
4243						updateAuthorityEndpointMetadata(metadataEntity, await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(localMetadata.metadata), false);
4244						metadataEntity.canonical_authority = this.canonicalAuthority;
4245					}
4246				}
4247			}
4248			return localMetadata.source;
4249		}
4250		let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
4251		if (metadata) {
4252			this.validateIssuer(metadata.issuer);
4253			if (this.authorityOptions.azureRegionConfiguration?.azureRegion) metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
4254			updateAuthorityEndpointMetadata(metadataEntity, metadata, true);
4255			return AuthorityMetadataSource.NETWORK;
4256		} else throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
4257	}
4258	/**
4259	* Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
4260	* response if the source is hardcoded metadata
4261	* @param metadataEntity
4262	* @returns
4263	*/
4264	updateEndpointMetadataFromLocalSources(metadataEntity) {
4265		this.logger.verbose("1fi0kc", this.correlationId);
4266		const configMetadata = this.getEndpointMetadataFromConfig();
4267		if (configMetadata) {
4268			this.logger.verbose("06t0uj", this.correlationId);
4269			updateAuthorityEndpointMetadata(metadataEntity, configMetadata, false);
4270			return { source: AuthorityMetadataSource.CONFIG };
4271		}
4272		this.logger.verbose("151k0p", this.correlationId);
4273		const hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
4274		if (hardcodedMetadata) {
4275			updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
4276			return {
4277				source: AuthorityMetadataSource.HARDCODED_VALUES,
4278				metadata: hardcodedMetadata
4279			};
4280		} else this.logger.verbose("1imop5", this.correlationId);
4281		const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
4282		if (this.isAuthoritySameType(metadataEntity) && metadataEntity.endpointsFromNetwork && !metadataEntityExpired) {
4283			this.logger.verbose("16uq31", "");
4284			return { source: AuthorityMetadataSource.CACHE };
4285		} else if (metadataEntityExpired) this.logger.verbose("0uoibc", "");
4286		return null;
4287	}

4288	/**
4289	* Compares the number of url components after the domain to determine if the cached
4290	* authority metadata can be used for the requested authority. Protects against same domain different
4291	* authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
4292	* @param metadataEntity
4293	*/
4294	isAuthoritySameType(metadataEntity) {
4295		return new UrlString(metadataEntity.canonical_authority).getUrlComponents().PathSegments.length === this.canonicalAuthorityUrlComponents.PathSegments.length;
4296	}
4297	/**
4298	* Parse authorityMetadata config option
4299	*/
4300	getEndpointMetadataFromConfig() {
4301		if (this.authorityOptions.authorityMetadata) try {
4302			return JSON.parse(this.authorityOptions.authorityMetadata);
4303		} catch (e) {
4304			throw createClientConfigurationError(invalidAuthorityMetadata);
4305		}
4306		return null;
4307	}
4308	/**
4309	* Gets OAuth endpoints from the given OpenID configuration endpoint.
4310	*
4311	* @param hasHardcodedMetadata boolean
4312	*/
4313	async getEndpointMetadataFromNetwork() {
4314		const options = {};
4315		const openIdConfigurationEndpoint = this.defaultOpenIdConfigurationEndpoint;
4316		this.logger.verbose("1y65x6", this.correlationId);
4317		try {
4318			const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
4319			if (isOpenIdConfigResponse(response.body)) return response.body;
4320			else {
4321				this.logger.verbose("1koyv8", this.correlationId);
4322				return null;
4323			}
4324		} catch (e) {
4325			this.logger.verbose("0a9wik", this.correlationId);
4326			return null;
4327		}
4328	}
4329	/**
4330	* Get OAuth endpoints for common authorities.
4331	*/
4332	getEndpointMetadataFromHardcodedValues() {
4333		if (this.hostnameAndPort in EndpointMetadata) return EndpointMetadata[this.hostnameAndPort];
4334		return null;
4335	}
4336	/**
4337	* Update the retrieved metadata with regional information.
4338	* User selected Azure region will be used if configured.
4339	*/
4340	async updateMetadataWithRegionalInformation(metadata) {
4341		const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
4342		if (userConfiguredAzureRegion) {
4343			if (userConfiguredAzureRegion !== "TryAutoDetect") {
4344				this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
4345				this.regionDiscoveryMetadata.region_used = userConfiguredAzureRegion;
4346				return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
4347			}
4348			const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration?.environmentRegion, this.regionDiscoveryMetadata);
4349			if (autodetectedRegionName) {
4350				this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
4351				this.regionDiscoveryMetadata.region_used = autodetectedRegionName;
4352				return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
4353			}
4354			this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
4355		}
4356		return metadata;
4357	}
4358	/**
4359	* Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
4360	* and returns where the information was retrieved from
4361	* @param metadataEntity
4362	* @returns AuthorityMetadataSource
4363	*/
4364	async updateCloudDiscoveryMetadata(metadataEntity) {
4365		const localMetadataSource = this.updateCloudDiscoveryMetadataFromLocalSources(metadataEntity);
4366		if (localMetadataSource) return localMetadataSource;
4367		const metadata = await invokeAsync(this.getCloudDiscoveryMetadataFromNetwork.bind(this), AuthorityGetCloudDiscoveryMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
4368		if (metadata) {
4369			updateCloudDiscoveryMetadata(metadataEntity, metadata, true);
4370			return AuthorityMetadataSource.NETWORK;
4371		}
4372		throw createClientConfigurationError(untrustedAuthority);
4373	}
4374	updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
4375		this.logger.verbose("1tpqlr", this.correlationId);
4376		this.logger.verbosePii("1fy7uz", this.correlationId);
4377		this.logger.verbosePii("08zabj", this.correlationId);
4378		this.logger.verbosePii("1o1kv3", this.correlationId);
4379		const metadata = this.getCloudDiscoveryMetadataFromConfig();
4380		if (metadata) {
4381			this.logger.verbose("1nakio", this.correlationId);
4382			updateCloudDiscoveryMetadata(metadataEntity, metadata, false);
4383			return AuthorityMetadataSource.CONFIG;
4384		}
4385		this.logger.verbose("1x74aj", this.correlationId);
4386		const hardcodedMetadata = getCloudDiscoveryMetadataFromHardcodedValues(this.hostnameAndPort);
4387		if (hardcodedMetadata) {
4388			this.logger.verbose("0by47c", this.correlationId);
4389			updateCloudDiscoveryMetadata(metadataEntity, hardcodedMetadata, false);
4390			return AuthorityMetadataSource.HARDCODED_VALUES;
4391		}
4392		this.logger.verbose("0r2fzy", this.correlationId);
4393		const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
4394		if (this.isAuthoritySameType(metadataEntity) && metadataEntity.aliasesFromNetwork && !metadataEntityExpired) {
4395			this.logger.verbose("1uffgh", "");
4396			return AuthorityMetadataSource.CACHE;
4397		} else if (metadataEntityExpired) this.logger.verbose("0uoibc", "");
4398		return null;
4399	}

4400	/**
4401	* Parse cloudDiscoveryMetadata config or check knownAuthorities
4402	*/
4403	getCloudDiscoveryMetadataFromConfig() {
4404		if (this.authorityType === AuthorityType.Ciam) {
4405			this.logger.verbose("04y84h", this.correlationId);
4406			return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
4407		}
4408		if (this.authorityOptions.cloudDiscoveryMetadata) {
4409			this.logger.verbose("0gszr3", this.correlationId);
4410			try {
4411				this.logger.verbose("1iifkx", this.correlationId);
4412				const metadata = getCloudDiscoveryMetadataFromNetworkResponse(JSON.parse(this.authorityOptions.cloudDiscoveryMetadata).metadata, this.hostnameAndPort);
4413				this.logger.verbose("0q67e3", "");
4414				if (metadata) {
4415					this.logger.verbose("0hzfao", this.correlationId);
4416					return metadata;
4417				} else this.logger.verbose("1ajz3u", this.correlationId);
4418			} catch (e) {
4419				this.logger.verbose("1wq5tu", this.correlationId);
4420				throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
4421			}
4422		}
4423		if (this.isInKnownAuthorities(this.hostnameAndPort)) {
4424			this.logger.verbose("0mt9al", this.correlationId);
4425			return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
4426		}
4427		return null;
4428	}
4429	/**
4430	* Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
4431	*
4432	* @param hasHardcodedMetadata boolean
4433	*/
4434	async getCloudDiscoveryMetadataFromNetwork() {
4435		const instanceDiscoveryEndpoint = `${AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`;
4436		const options = {};
4437		let match = null;
4438		try {
4439			const response = await this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options);
4440			let typedResponseBody;
4441			let metadata;
4442			if (isCloudInstanceDiscoveryResponse(response.body)) {
4443				typedResponseBody = response.body;
4444				metadata = typedResponseBody.metadata;
4445				this.logger.verbosePii("1vglyt", this.correlationId);
4446			} else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
4447				this.logger.warning("062uto", this.correlationId);
4448				typedResponseBody = response.body;
4449				if (typedResponseBody.error === "invalid_instance") {
4450					this.logger.error("1x90tm", this.correlationId);
4451					return null;
4452				}
4453				this.logger.warning("0wchdm", this.correlationId);
4454				this.logger.warning("1s5mpv", this.correlationId);
4455				this.logger.warning("1yhqpw", this.correlationId);
4456				metadata = [];
4457			} else {
4458				this.logger.error("0768g0", this.correlationId);
4459				return null;
4460			}
4461			this.logger.verbose("1lrobr", this.correlationId);
4462			match = getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
4463		} catch (error) {
4464			if (error instanceof AuthError) this.logger.error("0vwhc7", this.correlationId);
4465			else this.logger.error("0s2z41", this.correlationId);
4466			return null;
4467		}
4468		if (!match) {
4469			this.logger.warning("0jp28q", this.correlationId);
4470			this.logger.verbose("130sd8", this.correlationId);
4471			match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
4472		}
4473		return match;
4474	}
4475	/**
4476	* Helper function to determine if a host is included in the knownAuthorities config option.
4477	*/
4478	isInKnownAuthorities(host) {
4479		const normalizedHost = host.toLowerCase();
4480		return this.authorityOptions.knownAuthorities.filter((authority) => {
4481			return authority && UrlString.getDomainFromUrl(authority).toLowerCase() === normalizedHost;
4482		}).length > 0;
4483	}
4484	/**
4485	* helper function to populate the authority based on azureCloudOptions
4486	* @param authorityString
4487	* @param azureCloudOptions
4488	*/
4489	static generateAuthority(authorityString, azureCloudOptions) {
4490		let authorityAzureCloudInstance;
4491		if (azureCloudOptions && azureCloudOptions.azureCloudInstance !== AzureCloudInstance.None) {
4492			const tenant = azureCloudOptions.tenant ? azureCloudOptions.tenant : DEFAULT_COMMON_TENANT;
4493			authorityAzureCloudInstance = `${azureCloudOptions.azureCloudInstance}/${tenant}/`;
4494		}
4495		return authorityAzureCloudInstance ? authorityAzureCloudInstance : authorityString;
4496	}
4497	/**
4498	* Creates cloud discovery metadata object from a given host
4499	* @param host
4500	*/
4501	static createCloudDiscoveryMetadataFromHost(host) {
4502		return {
4503			preferred_network: host,
4504			preferred_cache: host,
4505			aliases: [host]
4506		};
4507	}
4508	/**
4509	* helper function to generate environment from authority object
4510	*/
4511	getPreferredCache() {
4512		if (this.managedIdentity) return DEFAULT_AUTHORITY_HOST;
4513		else if (this.discoveryComplete()) return this.metadata.preferred_cache;

4514		else throw createClientAuthError(endpointResolutionError);
4515	}
4516	/**
4517	* Returns whether or not the provided host is an alias of this authority instance
4518	* @param host
4519	*/
4520	isAlias(host) {
4521		return this.metadata.aliases.indexOf(host) > -1;
4522	}
4523	/**
4524	* Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
4525	* @param host
4526	*/
4527	isAliasOfKnownMicrosoftAuthority(host) {
4528		return InstanceDiscoveryMetadataAliases.has(host);
4529	}
4530	/**
4531	* Validates the `issuer` returned by an OIDC discovery document against
4532	* this authority, per
4533	* https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
4534	*
4535	* The issuer is accepted when ANY of the following holds:
4536	*  1. The issuer scheme + host + port match the authority's (path may
4537	*     differ). Applies to all authorities.
4538	*  2. The authority is a Microsoft cloud authority (public, sovereign,
4539	*     or CIAM), the issuer is HTTPS, and the issuer host is in the known
4540	*     Microsoft authority host set.
4541	*  3. Same as (2), but the issuer host is a single-label regional variant
4542	*     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
4543	*  4. Same as (2), but the issuer host matches the CIAM tenant pattern
4544	*     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
4545	*     path.
4546	*  5. The issuer host is HTTPS and is explicitly listed in the
4547	*     developer-configured `knownAuthorities`. This covers scenarios where
4548	*     the OIDC discovery document returns an issuer host that differs from
4549	*     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
4550	*
4551	* @param issuer The `issuer` value returned in the OIDC discovery document.
4552	* @throws ClientConfigurationError("issuer_validation_failed") on failure.
4553	*/
4554	validateIssuer(issuer) {
4555		if (!issuer) throw createClientConfigurationError(issuerValidationFailed);
4556		let issuerUrl;
4557		try {
4558			issuerUrl = new URL(issuer);
4559		} catch {
4560			throw createClientConfigurationError(issuerValidationFailed);
4561		}
4562		const issuerScheme = issuerUrl.protocol;
4563		const issuerHost = issuerUrl.host;
4564		const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
4565		const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
4566		const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
4567		const matchesKnownMicrosoftHost = issuerScheme === "https:" && this.isAliasOfKnownMicrosoftAuthority(issuerHost);
4568		const matchesRegionalMicrosoftHost = issuerScheme === "https:" && this.matchesRegionalMicrosoftHost(issuerHost);
4569		const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
4570		const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
4571		if (matchesAuthorityOrigin || matchesKnownMicrosoftHost || matchesRegionalMicrosoftHost || matchesCiamTenantPattern || matchesKnownAuthority) return;
4572		throw createClientConfigurationError(issuerValidationFailed);
4573	}
4574	/**
4575	* Rule 1: The issuer scheme + host (and port) match the authority's. Path
4576	* may differ. Applies to all authorities.
4577	*/
4578	matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
4579		return issuerScheme === authorityScheme && issuerHost === authorityHost;
4580	}
4581	/**
4582	* Rule 3: The issuer host is a regional variant
4583	* (`{region}.{host}`) of a known Microsoft authority host.
4584	* E.g. `westus2.login.microsoft.com`.
4585	*/
4586	matchesRegionalMicrosoftHost(issuerHost) {
4587		const firstDot = issuerHost.indexOf(".");
4588		if (firstDot > 0 && firstDot < issuerHost.length - 1) {
4589			const hostWithoutRegion = issuerHost.substring(firstDot + 1);
4590			return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
4591		}
4592		return false;
4593	}
4594	/**
4595	* Rule 4: The issuer matches one of the well-known CIAM tenant patterns
4596	* (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
4597	*
4598	* The bare tenant name is extracted from the authority's first path segment
4599	* when available (stripping the `.onmicrosoft.com` suffix that
4600	* `transformCIAMAuthority` adds), or otherwise from the leftmost label of
4601	* the authority host (to support CIAM custom domain scenarios).
4602	*
4603	* Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
4604	* because the OIDC issuer may use either form depending on the authority URL
4605	* that was used to trigger discovery.
4606	*/
4607	matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
4608		const pathSegment = authorityPathSegments[0];
4609		const tenantName = pathSegment ? pathSegment.endsWith(".onmicrosoft.com") ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length) : pathSegment : authorityHost.split(".")[0];
4610		if (!tenantName) return false;

4611		const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
4612		const validCiamPatterns = [
4613			ciamBaseURL,
4614			`${ciamBaseURL}/${tenantName}`,
4615			`${ciamBaseURL}/${tenantName}/v2.0`,
4616			`${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
4617			`${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`
4618		];
4619		const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
4620		const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
4621		return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
4622	}
4623	/**
4624	* Checks whether the provided host is that of a public cloud authority
4625	*
4626	* @param authority string
4627	* @returns bool
4628	*/
4629	static isPublicCloudAuthority(host) {
4630		return KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;
4631	}
4632	/**
4633	* Rebuild the authority string with the region
4634	*
4635	* @param host string
4636	* @param region string
4637	*/
4638	static buildRegionalAuthorityString(host, region, queryString) {
4639		const authorityUrlInstance = new UrlString(host);
4640		authorityUrlInstance.validateAsUri();
4641		const authorityUrlParts = authorityUrlInstance.getUrlComponents();
4642		let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
4643		if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) hostNameAndPort = `${region}.${REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`;
4644		const url = UrlString.constructAuthorityUriFromObject({
4645			...authorityUrlInstance.getUrlComponents(),
4646			HostNameAndPort: hostNameAndPort
4647		}).urlString;
4648		if (queryString) return `${url}?${queryString}`;
4649		return url;
4650	}
4651	/**
4652	* Replace the endpoints in the metadata object with their regional equivalents.
4653	*
4654	* @param metadata OpenIdConfigResponse
4655	* @param azureRegion string
4656	*/
4657	static replaceWithRegionalInformation(metadata, azureRegion) {
4658		const regionalMetadata = { ...metadata };
4659		regionalMetadata.authorization_endpoint = Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
4660		regionalMetadata.token_endpoint = Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
4661		if (regionalMetadata.end_session_endpoint) regionalMetadata.end_session_endpoint = Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
4662		return regionalMetadata;
4663	}
4664	/**
4665	* Transform CIAM_AUTHORIY as per the below rules:
4666	* If no path segments found and it is a CIAM authority (hostname ends with .ciamlogin.com), then transform it
4667	*
4668	* NOTE: The transformation path should go away once STS supports CIAM with the format: `tenantIdorDomain.ciamlogin.com`
4669	* `ciamlogin.com` can also change in the future and we should accommodate the same
4670	*
4671	* @param authority
4672	*/
4673	static transformCIAMAuthority(authority) {
4674		let ciamAuthority = authority;
4675		const authorityUrlComponents = new UrlString(authority).getUrlComponents();
4676		if (authorityUrlComponents.PathSegments.length === 0 && authorityUrlComponents.HostNameAndPort.endsWith(".ciamlogin.com")) {
4677			const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
4678			ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${AAD_TENANT_DOMAIN_SUFFIX}`;
4679		}
4680		return ciamAuthority;
4681	}
4682};
4683Authority.reservedTenantDomains = new Set([
4684	"{tenant}",
4685	"{tenantid}",
4686	AADAuthority.COMMON,
4687	AADAuthority.CONSUMERS,
4688	AADAuthority.ORGANIZATIONS
4689]);
4690/**
4691* Extract tenantId from authority
4692*/
4693function getTenantFromAuthorityString(authority) {
4694	/**
4695	* For credential matching purposes, tenantId is the last path segment of the authority URL:
4696	*  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
4697	*  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
4698	*  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
4699	*
4700	* Note that we may not have any path segments in certain OIDC scenarios.
4701	*/
4702	const tenantId = new UrlString(authority).getUrlComponents().PathSegments.slice(-1)[0]?.toLowerCase();
4703	switch (tenantId) {
4704		case AADAuthority.COMMON:
4705		case AADAuthority.ORGANIZATIONS:
4706		case AADAuthority.CONSUMERS: return;
4707		default: return tenantId;
4708	}
4709}
4710function formatAuthorityUri(authorityUri) {
4711	return authorityUri.endsWith("/") ? authorityUri : `${authorityUri}/`;
4712}
4713function buildStaticAuthorityOptions(authOptions) {
4714	const rawCloudDiscoveryMetadata = authOptions.cloudDiscoveryMetadata;
4715	let cloudDiscoveryMetadata = void 0;
4716	if (rawCloudDiscoveryMetadata) try {
4717		cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
4718	} catch (e) {
4719		throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
4720	}
4721	return {
4722		canonicalAuthority: authOptions.authority ? formatAuthorityUri(authOptions.authority) : void 0,
4723		knownAuthorities: authOptions.knownAuthorities,
4724		cloudDiscoveryMetadata
4725	};
4726}
4727//#endregion
4728//#region node_modules/@azure/msal-common/dist-browser/authority/AuthorityFactory.mjs
4729/*! @azure/msal-common v16.8.0 2026-06-10 */
4730/**
4731* Create an authority object of the correct type based on the url
4732* Performs basic authority validation - checks to see if the authority is of a valid type (i.e. aad, b2c, adfs)
4733*
4734* Also performs endpoint discovery.
4735*
4736* @param authorityUri
4737* @param networkClient
4738* @param cacheManager
4739* @param authorityOptions
4740* @param logger
4741* @param correlationId
4742* @param performanceClient
4743* @internal
4744*/
4745async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
4746	const acquireTokenAuthority = new Authority(Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri)), networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
4747	try {
4748		await invokeAsync(acquireTokenAuthority.resolveEndpointsAsync.bind(acquireTokenAuthority), AuthorityResolveEndpointsAsync, logger, performanceClient, correlationId)();
4749		return acquireTokenAuthority;
4750	} catch (e) {
4751		throw createClientAuthError(endpointResolutionError);
4752	}
4753}
4754//#endregion
4755//#region node_modules/@azure/msal-common/dist-browser/client/AuthorizationCodeClient.mjs
4756/*! @azure/msal-common v16.8.0 2026-06-10 */
4757/**
4758* Oauth2.0 Authorization Code client
4759* @internal
4760*/
4761var AuthorizationCodeClient = class {
4762	constructor(configuration, performanceClient) {
4763		this.includeRedirectUri = true;
4764		this.config = buildClientConfiguration(configuration);
4765		this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
4766		this.cryptoUtils = this.config.cryptoInterface;
4767		this.cacheManager = this.config.storageInterface;
4768		this.networkClient = this.config.networkInterface;
4769		this.serverTelemetryManager = this.config.serverTelemetryManager;
4770		this.authority = this.config.authOptions.authority;
4771		this.performanceClient = performanceClient;
4772		this.oidcDefaultScopes = this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
4773	}
4774	/**
4775	* API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
4776	* authorization_code_grant
4777	* @param request
4778	*/
4779	async acquireToken(request, apiId, authCodePayload) {
4780		if (!request.code) throw createClientAuthError(requestCannotBeMade);
4781		if (authCodePayload && authCodePayload.cloud_instance_host_name) await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
4782		const reqTimestamp = nowSeconds();
4783		const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
4784		const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
4785		const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
4786		responseHandler.validateTokenResponse(response.body, request.correlationId);
4787		return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, void 0, void 0, void 0, requestId);
4788	}
4789	/**
4790	* Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
4791	* Default behaviour is to redirect the user to `window.location.href`.
4792	* @param authorityUri
4793	*/
4794	getLogoutUri(logoutRequest) {
4795		if (!logoutRequest) throw createClientConfigurationError(logoutRequestEmpty);
4796		const queryString = this.createLogoutUrlQueryString(logoutRequest);
4797		return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
4798	}
4799	/**
4800	* Executes POST request to token endpoint
4801	* @param authority
4802	* @param request
4803	*/
4804	async executeTokenRequest(authority, request, serverTelemetryManager) {
4805		const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
4806		const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
4807		const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
4808		let ccsCredential = void 0;
4809		if (request.clientInfo) try {
4810			const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
4811			ccsCredential = {
4812				credential: `${clientInfo.uid}.${clientInfo.utid}`,
4813				type: CcsCredentialType.HOME_ACCOUNT_ID
4814			};
4815		} catch (e) {
4816			this.logger.verbose("0wznt3", request.correlationId);
4817		}
4818		const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
4819		const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
4820		return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
4821	}
4822	/**
4823	* Generates a map for all the params to be sent to the service
4824	* @param request
4825	*/
4826	async createTokenRequestBody(request) {
4827		const parameters = /* @__PURE__ */ new Map();
4828		addClientId(parameters, request.embeddedClientId || request.extraParameters?.["client_id"] || this.config.authOptions.clientId);
4829		if (!this.includeRedirectUri) {
4830			if (!request.redirectUri) throw createClientConfigurationError(redirectUriEmpty);
4831		} else addRedirectUri(parameters, request.redirectUri);
4832		addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
4833		addResource(parameters, request.resource);
4834		addAuthorizationCode(parameters, request.code);
4835		addLibraryInfo(parameters, this.config.libraryInfo);
4836		addApplicationTelemetry(parameters, this.config.telemetry.application);
4837		addThrottling(parameters);
4838		if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) addServerTelemetry(parameters, this.serverTelemetryManager);
4839		if (request.codeVerifier) addCodeVerifier(parameters, request.codeVerifier);
4840		if (this.config.clientCredentials.clientSecret) addClientSecret(parameters, this.config.clientCredentials.clientSecret);
4841		if (this.config.clientCredentials.clientAssertion) {
4842			const clientAssertion = this.config.clientCredentials.clientAssertion;
4843			addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
4844			addClientAssertionType(parameters, clientAssertion.assertionType);
4845		}
4846		addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);

4847		addClientInfo(parameters);
4848		if (request.authenticationScheme === AuthenticationScheme.POP) {
4849			const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
4850			let reqCnfData;
4851			if (!request.popKid) reqCnfData = (await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger)).reqCnfString;
4852			else reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
4853			addPopToken(parameters, reqCnfData);
4854		} else if (request.authenticationScheme === AuthenticationScheme.SSH) if (request.sshJwk) addSshJwk(parameters, request.sshJwk);
4855		else throw createClientConfigurationError(missingSshJwk);
4856		let ccsCred = void 0;
4857		if (request.clientInfo) try {
4858			const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
4859			ccsCred = {
4860				credential: `${clientInfo.uid}.${clientInfo.utid}`,
4861				type: CcsCredentialType.HOME_ACCOUNT_ID
4862			};
4863		} catch (e) {
4864			this.logger.verbose("0wznt3", request.correlationId);
4865		}
4866		else ccsCred = request.ccsCredential;
4867		if (this.config.systemOptions.preventCorsPreflight && ccsCred) switch (ccsCred.type) {
4868			case CcsCredentialType.HOME_ACCOUNT_ID:
4869				try {
4870					addCcsOid(parameters, buildClientInfoFromHomeAccountId(ccsCred.credential));
4871				} catch (e) {
4872					this.logger.verbose("1qhtee", request.correlationId);
4873				}
4874				break;
4875			case CcsCredentialType.UPN:
4876				addCcsUpn(parameters, ccsCred.credential);
4877				break;
4878		}
4879		if (request.embeddedClientId) addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
4880		if (request.extraParameters) addExtraParameters(parameters, request.extraParameters);
4881		if (request.enableSpaAuthorizationCode && (!request.extraParameters || !request.extraParameters["return_spa_code"])) addExtraParameters(parameters, { [RETURN_SPA_CODE]: "1" });
4882		instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
4883		addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
4884		return mapToQueryString(parameters);
4885	}
4886	/**
4887	* This API validates the `EndSessionRequest` and creates a URL
4888	* @param request
4889	*/
4890	createLogoutUrlQueryString(request) {
4891		const parameters = /* @__PURE__ */ new Map();
4892		if (request.postLogoutRedirectUri) addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
4893		if (request.correlationId) addCorrelationId(parameters, request.correlationId);
4894		if (request.idTokenHint) addIdTokenHint(parameters, request.idTokenHint);
4895		if (request.state) addState(parameters, request.state);
4896		if (request.logoutHint) addLogoutHint(parameters, request.logoutHint);
4897		if (request.extraQueryParameters) addExtraParameters(parameters, request.extraQueryParameters);
4898		if (this.config.authOptions.instanceAware) addInstanceAware(parameters);
4899		return mapToQueryString(parameters);
4900	}
4901	/**
4902	* Updates the authority to the cloud instance provided in the authorization response
4903	* @param cloudInstanceHostName - cloud instance host name from authorization code payload
4904	* @param correlationId - request correlation id
4905	*/
4906	async updateTokenEndpointAuthority(cloudInstanceHostName, correlationId) {
4907		const cloudInstanceAuthority = await createDiscoveredInstance(`https://${cloudInstanceHostName}/${this.authority.tenant}/`, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
4908		this.authority = cloudInstanceAuthority;
4909	}
4910};
4911//#endregion
4912//#region node_modules/@azure/msal-common/dist-browser/client/RefreshTokenClient.mjs
4913/*! @azure/msal-common v16.8.0 2026-06-10 */
4914var DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300;
4915/**
4916* OAuth2.0 refresh token client
4917* @internal
4918*/
4919var RefreshTokenClient = class {
4920	constructor(configuration, performanceClient) {
4921		this.config = buildClientConfiguration(configuration);
4922		this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
4923		this.cryptoUtils = this.config.cryptoInterface;
4924		this.cacheManager = this.config.storageInterface;
4925		this.networkClient = this.config.networkInterface;
4926		this.serverTelemetryManager = this.config.serverTelemetryManager;
4927		this.authority = this.config.authOptions.authority;
4928		this.performanceClient = performanceClient;
4929	}
4930	async acquireToken(request, apiId) {
4931		const reqTimestamp = nowSeconds();
4932		const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
4933		const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
4934		const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
4935		responseHandler.validateTokenResponse(response.body, request.correlationId);
4936		return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, void 0, void 0, true, request.forceCache, requestId);
4937	}
4938	/**
4939	* Gets cached refresh token and attaches to request, then calls acquireToken API
4940	* @param request
4941	*/
4942	async acquireTokenByRefreshToken(request, apiId) {
4943		if (!request) throw createClientConfigurationError(tokenRequestEmpty);
4944		if (!request.account) throw createClientAuthError(noAccountInSilentRequest);
4945		if (this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId)) try {
4946			return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
4947		} catch (e) {
4948			const noFamilyRTInCache = e instanceof InteractionRequiredAuthError && e.errorCode === "no_tokens_found";

4949			const clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === "invalid_grant" && e.subError === "client_mismatch";
4950			if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
4951			else throw e;
4952		}
4953		return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
4954	}
4955	/**
4956	* makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
4957	* @param request
4958	*/
4959	async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
4960		const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, void 0);
4961		if (!refreshToken) throw createInteractionRequiredAuthError(noTokensFound);
4962		if (refreshToken.expiresOn) {
4963			const offset = request.refreshTokenExpirationOffsetSeconds || DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
4964			this.performanceClient?.addFields({
4965				cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
4966				rtOffsetSeconds: offset
4967			}, request.correlationId);
4968			if (isTokenExpired(refreshToken.expiresOn, offset)) throw createInteractionRequiredAuthError(refreshTokenExpired);
4969		}
4970		const refreshTokenRequest = {
4971			...request,
4972			refreshToken: refreshToken.secret,
4973			authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,
4974			ccsCredential: {
4975				credential: request.account.homeAccountId,
4976				type: CcsCredentialType.HOME_ACCOUNT_ID
4977			}
4978		};
4979		try {
4980			return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
4981		} catch (e) {
4982			if (e instanceof InteractionRequiredAuthError) {
4983				if (e.subError === "bad_token") {
4984					this.logger.verbose("1pg3ap", request.correlationId);
4985					const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
4986					this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
4987				}
4988			}
4989			throw e;
4990		}
4991	}
4992	/**
4993	* Constructs the network message and makes a NW call to the underlying secure token service
4994	* @param request
4995	* @param authority
4996	*/
4997	async executeTokenRequest(request, authority) {
4998		const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
4999		const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
5000		const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
5001		const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
5002		const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
5003		return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
5004	}
5005	/**
5006	* Helper function to create the token request body
5007	* @param request
5008	*/
5009	async createTokenRequestBody(request) {
5010		const parameters = /* @__PURE__ */ new Map();
5011		addClientId(parameters, request.embeddedClientId || request.extraParameters?.["client_id"] || this.config.authOptions.clientId);
5012		if (request.redirectUri) addRedirectUri(parameters, request.redirectUri);
5013		addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
5014		addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);

5015		addClientInfo(parameters);
5016		addLibraryInfo(parameters, this.config.libraryInfo);
5017		addApplicationTelemetry(parameters, this.config.telemetry.application);
5018		addThrottling(parameters);
5019		if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) addServerTelemetry(parameters, this.serverTelemetryManager);
5020		addRefreshToken(parameters, request.refreshToken);
5021		if (this.config.clientCredentials.clientSecret) addClientSecret(parameters, this.config.clientCredentials.clientSecret);
5022		if (this.config.clientCredentials.clientAssertion) {
5023			const clientAssertion = this.config.clientCredentials.clientAssertion;
5024			addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
5025			addClientAssertionType(parameters, clientAssertion.assertionType);
5026		}
5027		if (request.authenticationScheme === AuthenticationScheme.POP) {
5028			const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
5029			let reqCnfData;
5030			if (!request.popKid) reqCnfData = (await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger)).reqCnfString;
5031			else reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
5032			addPopToken(parameters, reqCnfData);
5033		} else if (request.authenticationScheme === AuthenticationScheme.SSH) if (request.sshJwk) addSshJwk(parameters, request.sshJwk);
5034		else throw createClientConfigurationError(missingSshJwk);
5035		if (this.config.systemOptions.preventCorsPreflight && request.ccsCredential) switch (request.ccsCredential.type) {
5036			case CcsCredentialType.HOME_ACCOUNT_ID:
5037				try {
5038					addCcsOid(parameters, buildClientInfoFromHomeAccountId(request.ccsCredential.credential));
5039				} catch (e) {
5040					this.logger.verbose("1qhtee", request.correlationId);
5041				}
5042				break;
5043			case CcsCredentialType.UPN:
5044				addCcsUpn(parameters, request.ccsCredential.credential);
5045				break;
5046		}
5047		if (request.embeddedClientId) addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
5048		if (request.extraParameters) addExtraParameters(parameters, { ...request.extraParameters });
5049		instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
5050		addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
5051		return mapToQueryString(parameters);
5052	}
5053};
5054//#endregion
5055//#region node_modules/@azure/msal-common/dist-browser/client/SilentFlowClient.mjs
5056/*! @azure/msal-common v16.8.0 2026-06-10 */
5057/** @internal */
5058var SilentFlowClient = class {
5059	constructor(configuration, performanceClient) {
5060		this.config = buildClientConfiguration(configuration);
5061		this.logger = new Logger(this.config.loggerOptions, name$1, version$1);
5062		this.cryptoUtils = this.config.cryptoInterface;
5063		this.cacheManager = this.config.storageInterface;
5064		this.networkClient = this.config.networkInterface;
5065		this.serverTelemetryManager = this.config.serverTelemetryManager;
5066		this.authority = this.config.authOptions.authority;
5067		this.performanceClient = performanceClient;
5068	}
5069	/**
5070	* Retrieves token from cache or throws an error if it must be refreshed.
5071	* @param request
5072	*/
5073	async acquireCachedToken(request) {
5074		let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
5075		if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
5076			this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
5077			throw createClientAuthError(tokenRefreshRequired);
5078		}
5079		if (!request.account) throw createClientAuthError(noAccountInSilentRequest);
5080		const requestTenantId = request.account.tenantId || getTenantFromAuthorityString(request.authority);
5081		const tokenKeys = this.cacheManager.getTokenKeys();
5082		const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
5083		if (!cachedAccessToken) {
5084			this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
5085			throw createClientAuthError(tokenRefreshRequired);
5086		} else if (wasClockTurnedBack(cachedAccessToken.cachedAt) || isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
5087			this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
5088			throw createClientAuthError(tokenRefreshRequired);
5089		} else if (request.resource) {
5090			if (cachedAccessToken.resource !== request.resource) {
5091				this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
5092				throw createClientAuthError(tokenRefreshRequired);
5093			}
5094		} else if (cachedAccessToken.refreshOn && isTokenExpired(cachedAccessToken.refreshOn, 0)) lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
5095		const environment = request.authority || this.authority.getPreferredCache();
5096		const cacheRecord = {
5097			account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
5098			accessToken: cachedAccessToken,
5099			idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId),
5100			refreshToken: null,

5101			appMetadata: this.cacheManager.readAppMetadataFromCache(environment, request.correlationId)
5102		};
5103		this.setCacheOutcome(lastCacheOutcome, request.correlationId);
5104		if (this.config.serverTelemetryManager) this.config.serverTelemetryManager.incrementCacheHits();
5105		return [await invokeAsync(this.generateResultFromCacheRecord.bind(this), SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request), lastCacheOutcome];
5106	}
5107	setCacheOutcome(cacheOutcome, correlationId) {
5108		this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
5109		this.performanceClient?.addFields({ cacheOutcome }, correlationId);
5110		if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) this.logger.info("09ingz", correlationId);
5111	}
5112	/**
5113	* Helper function to build response object from the CacheRecord
5114	* @param cacheRecord
5115	*/
5116	async generateResultFromCacheRecord(cacheRecord, request) {
5117		let idTokenClaims;
5118		if (cacheRecord.idToken) idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
5119		if (request.maxAge || request.maxAge === 0) {
5120			const authTime = idTokenClaims?.auth_time;
5121			if (!authTime) throw createClientAuthError(authTimeNotFound);
5122			checkMaxAge(authTime, request.maxAge);
5123		}
5124		return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, c

5124acheRecord, true, request, this.performanceClient, idTokenClaims);
5125	}
5126};
5127//#endregion
5128//#region node_modules/@azure/msal-common/dist-browser/network/INetworkModule.mjs
5129/*! @azure/msal-common v16.8.0 2026-06-10 */
5130var StubbedNetworkModule = {
5131	sendGetRequestAsync: () => {
5132		return Promise.reject(createClientAuthError(methodNotImplemented));
5133	},
5134	sendPostRequestAsync: () => {
5135		return Promise.reject(createClientAuthError(methodNotImplemented));
5136	}
5137};
5138//#endregion
5139//#region node_modules/@azure/msal-common/dist-browser/protocol/Authorize.mjs
5140/*! @azure/msal-common v16.8.0 2026-06-10 */
5141/**
5142* Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
5143* @param config
5144* @param request
5145* @param logger
5146* @param performanceClient
5147* @returns
5148*/
5149function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
5150	const correlationId = request.correlationId;
5151	const parameters = /* @__PURE__ */ new Map();
5152	addClientId(parameters, request.embeddedClientId || request.extraQueryParameters?.["client_id"] || authOptions.clientId);
5153	addScopes(parameters, [...request.scopes || [], ...request.extraScopesToConsent || []], true, authOptions.authority.options.OIDCOptions?.defaultScopes);
5154	addResource(parameters, request.resource);
5155	addRedirectUri(parameters, request.redirectUri);
5156	addCorrelationId(parameters, correlationId);
5157	addResponseMode(parameters, request.responseMode);
5158	addClientInfo(parameters);
5159	addCliData(parameters);
5160	if (request.prompt) {
5161		addPrompt(parameters, request.prompt);
5162		performanceClient?.addFields({ prompt: request.prompt }, correlationId);
5163	}
5164	if (request.domainHint) {
5165		addDomainHint(parameters, request.domainHint);
5166		performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
5167	}
5168	if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
5169		if (request.sid && request.prompt === PromptValue.NONE) {
5170			logger.verbose("1tvqyx", request.correlationId);
5171			addSid(parameters, request.sid);
5172			performanceClient?.addFields({ sidFromRequest: true }, correlationId);
5173		} else if (request.account) {
5174			const accountSid = extractAccountSid(request.account);
5175			let accountLoginHintClaim = extractLoginHint(request.account);
5176			if (accountLoginHintClaim && request.domainHint) {
5177				logger.warning("0wkg3v", request.correlationId);
5178				accountLoginHintClaim = null;
5179			}

5180			if (accountLoginHintClaim) {
5181				logger.verbose("1eyfsw", request.correlationId);
5182				addLoginHint(parameters, accountLoginHintClaim);
5183				performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
5184				try {
5185					addCcsOid(parameters, buildClientInfoFromHomeAccountId(request.account.homeAccountId));
5186				} catch (e) {
5187					logger.verbose("12ugck", request.correlationId);
5188				}
5189			} else if (accountSid && request.prompt === PromptValue.NONE) {
5190				logger.verbose("1rmd8s", request.correlationId);
5191				addSid(parameters, accountSid);
5192				performanceClient?.addFields({ sidFromClaim: true }, correlationId);
5193				try {
5194					addCcsOid(parameters, buildClientInfoFromHomeAccountId(request.account.homeAccountId));
5195				} catch (e) {
5196					logger.verbose("12ugck", request.correlationId);
5197				}
5198			} else if (request.loginHint) {
5199				logger.verbose("0y3007", request.correlationId);
5200				addLoginHint(parameters, request.loginHint);
5201				addCcsUpn(parameters, request.loginHint);
5202				performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
5203			} else if (request.account.username) {
5204				logger.verbose("02f507", request.correlationId);
5205				addLoginHint(parameters, request.account.username);
5206				performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
5207				try {
5208					addCcsOid(parameters, buildClientInfoFromHomeAccountId(request.account.homeAccountId));
5209				} catch (e) {
5210					logger.verbose("12ugck", request.correlationId);
5211				}
5212			}
5213		} else if (request.loginHint) {
5214			logger.verbose("0g01ey", request.correlationId);
5215			addLoginHint(parameters, request.loginHint);
5216			addCcsUpn(parameters, request.loginHint);
5217			performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
5218		}
5219	} else logger.verbose("169k9v", request.correlationId);
5220	if (request.nonce) addNonce(parameters, request.nonce);
5221	if (request.state) addState(parameters, request.state);
5222	if (request.embeddedClientId) addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
5223	addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
5224	if (authOptions.instanceAware && (!request.extraQueryParameters || !Object.keys(request.extraQueryParameters).includes("instance_aware"))) addInstanceAware(parameters);
5225	return parameters;
5226}
5227/**
5228* Returns authorize endpoint with given request parameters in the query string
5229* @param authority
5230* @param requestParameters
5231* @returns
5232*/
5233function getAuthorizeUrl(authority, requestParameters) {
5234	const queryString = mapToQueryString(requestParameters);
5235	return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
5236}
5237/**
5238* Handles the hash fragment response from public client code request. Returns a code response used by
5239* the client to exchange for a token in acquireToken.
5240* @param serverParams
5241* @param cachedState
5242*/
5243function getAuthorizationCodePayload(serverParams, cachedState) {
5244	validateAuthorizationResponse(serverParams, cachedState);
5245	if (!serverParams.code) throw createClientAuthError(authorizationCodeMissingFromServerResponse);
5246	return serverParams;
5247}
5248/**
5249* Function which validates server authorization code response.
5250* @param serverResponseHash
5251* @param requestState
5252*/
5253function validateAuthorizationResponse(serverResponse, requestState) {
5254	if (!serverResponse.state || !requestState) throw serverResponse.state ? createClientAuthError(stateNotFound, "Cached State") : createClientAuthError(stateNotFound, "Server State");
5255	let decodedServerResponseState;
5256	let decodedRequestState;
5257	try {
5258		decodedServerResponseState = decodeURIComponent(serverResponse.state);
5259	} catch (e) {
5260		throw createClientAuthError(invalidState, serverResponse.state);
5261	}
5262	try {
5263		decodedRequestState = decodeURIComponent(requestState);
5264	} catch (e) {
5265		throw createClientAuthError(invalidState, serverResponse.state);
5266	}
5267	if (decodedServerResponseState !== decodedRequestState) throw createClientAuthError(stateMismatch);
5268	if (serverResponse.error || serverResponse.error_description || serverResponse.suberror) {
5269		const serverErrorNo = parseServerErrorNo(serverResponse);
5270		if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
5271		throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
5272	}
5273}
5274/**
5275* Get server error No from the error_uri
5276* @param serverResponse
5277* @returns
5278*/
5279function parseServerErrorNo(serverResponse) {
5280	const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf("code=");
5281	return errorCodePrefixIndex && errorCodePrefixIndex >= 0 ? serverResponse.error_uri?.substring(errorCodePrefixIndex + 5) : void 0;
5282}
5283/**
5284* Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
5285* @param account
5286*/
5287function extractAccountSid(account) {
5288	return account.idTokenClaims?.sid || null;
5289}
5290function extractLoginHint(account) {
5291	return account.loginHint || account.idTokenClaims?.login_hint || null;
5292}
5293//#endregion
5294//#region node_modules/@azure/msal-common/dist-browser/request/BaseAuthRequest.mjs
5295/*! @azure/msal-common v16.8.0 2026-06-10 */
5296/**
5297* Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
5298* If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
5299* This is used for MCP flows.
5300* @param isMcp - Flag indicating if application is an MCP app, from configuration
5301* @param request - Auth request
5302*/
5303function enforceResourceParameter(isMcp, request) {
5304	if (!isMcp) return;
5305	if (request.resource && (containsResourceParam(request.extraParameters) || containsResourceParam(request.extraQueryParameters))) throw createClientAuthError(misplacedResourceParam);
5306	if (!request.resource) throw createClientAuthError(resourceParameterRequired);
5307}
5308function containsResourceParam(params) {
5309	if (!params) return false;

5310	return Object.prototype.hasOwnProperty.call(params, "resource");
5311}
5312//#endregion
5313//#region node_modules/@azure/msal-common/dist-browser/error/AuthErrorCodes.mjs
5314/*! @azure/msal-common v16.8.0 2026-06-10 */
5315/**
5316* AuthErrorMessage class containing string constants used by error codes and messages.
5317*/
5318var unexpectedError = "unexpected_error";
5319//#endregion
5320//#region node_modules/@azure/msal-common/dist-browser/telemetry/server/ServerTelemetryManager.mjs
5321/*! @azure/msal-common v16.8.0 2026-06-10 */
5322var skuGroupSeparator = ",";
5323var skuValueSeparator = "|";
5324function makeExtraSkuString(params) {
5325	const { skus, libraryName, libraryVersion, extensionName, extensionVersion } = params;
5326	const skuMap = new Map([[0, [libraryName, libraryVersion]], [2, [extensionName, extensionVersion]]]);
5327	let skuArr = [];
5328	if (skus?.length) {
5329		skuArr = skus.split(skuGroupSeparator);
5330		if (skuArr.length < 4) return skus;
5331	} else skuArr = Array.from({ length: 4 }, () => skuValueSeparator);
5332	skuMap.forEach((value, key) => {
5333		if (value.length === 2 && value[0]?.length && value[1]?.length) setSku({
5334			skuArr,
5335			index: key,
5336			skuName: value[0],
5337			skuVersion: value[1]
5338		});
5339	});
5340	return skuArr.join(skuGroupSeparator);
5341}
5342function setSku(params) {
5343	const { skuArr, index, skuName, skuVersion } = params;
5344	if (index >= skuArr.length) return;
5345	skuArr[index] = [skuName, skuVersion].join(skuValueSeparator);
5346}
5347/** @internal */
5348var ServerTelemetryManager = class ServerTelemetryManager {
5349	constructor(telemetryRequest, cacheManager) {
5350		this.cacheOutcome = CacheOutcome.NOT_APPLICABLE;
5351		this.cacheManager = cacheManager;
5352		this.apiId = telemetryRequest.apiId;
5353		this.correlationId = telemetryRequest.correlationId;
5354		this.wrapperSKU = telemetryRequest.wrapperSKU || "";
5355		this.wrapperVer = telemetryRequest.wrapperVer || "";
5356		this.telemetryCacheKey = SERVER_TELEM_CACHE_KEY + "-" + telemetryRequest.clientId;
5357	}
5358	/**
5359	* API to add MSER Telemetry to request
5360	*/
5361	generateCurrentRequestHeaderValue() {
5362		const request = `${this.apiId},${this.cacheOutcome}`;
5363		const platformFieldsArr = [this.wrapperSKU, this.wrapperVer];
5364		const nativeBrokerErrorCode = this.getNativeBrokerErrorCode();
5365		if (nativeBrokerErrorCode?.length) platformFieldsArr.push(`broker_error=${nativeBrokerErrorCode}`);
5366		const platformFields = platformFieldsArr.join(",");
5367		return [
5368			5,
5369			[request, this.getRegionDiscoveryFields()].join(","),
5370			platformFields
5371		].join("|");
5372	}
5373	/**
5374	* API to add MSER Telemetry for the last failed request
5375	*/
5376	generateLastRequestHeaderValue() {
5377		const lastRequests = this.getLastRequests();
5378		const maxErrors = ServerTelemetryManager.maxErrorsToSend(lastRequests);
5379		const failedRequests = lastRequests.failedRequests.slice(0, 2 * maxErrors).join(",");
5380		const errors = lastRequests.errors.slice(0, maxErrors).join(",");
5381		const errorCount = lastRequests.errors.length;
5382		const platformFields = [errorCount, maxErrors < errorCount ? "1" : "0"].join(",");
5383		return [
5384			5,
5385			lastRequests.cacheHits,
5386			failedRequests,
5387			errors,
5388			platformFields
5389		].join("|");
5390	}
5391	/**
5392	* API to cache token failures for MSER data capture
5393	* @param error
5394	*/
5395	cacheFailedRequest(error) {
5396		try {
5397			const lastRequests = this.getLastRequests();
5398			if (lastRequests.errors.length >= 50) {
5399				lastRequests.failedRequests.shift();
5400				lastRequests.failedRequests.shift();
5401				lastRequests.errors.shift();
5402			}
5403			lastRequests.failedRequests.push(this.apiId, this.correlationId);
5404			if (error instanceof Error && !!error && error.toString()) if (error instanceof AuthError) if (error.subError) lastRequests.errors.push(error.subError);
5405			else if (error.errorCode) lastRequests.errors.push(error.errorCode);
5406			else lastRequests.errors.push(error.toString());
5407			else lastRequests.errors.push(error.toString());
5408			else lastRequests.errors.push(SERVER_TELEM_UNKNOWN_ERROR);
5409			this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
5410		} catch {}
5411	}
5412	/**
5413	* Update server telemetry cache entry by incrementing cache hit counter
5414	*/
5415	incrementCacheHits() {
5416		const lastRequests = this.getLastRequests();
5417		lastRequests.cacheHits += 1;
5418		this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
5419		return lastRequests.cacheHits;
5420	}
5421	/**
5422	* Get the server telemetry entity from cache or initialize a new one
5423	*/
5424	getLastRequests() {
5425		return this.cacheManager.getServerTelemetry(this.telemetryCacheKey, this.correlationId) || {
5426			failedRequests: [],
5427			errors: [],
5428			cacheHits: 0
5429		};
5430	}
5431	/**

5432	* Remove server telemetry cache entry
5433	*/
5434	clearTelemetryCache() {
5435		const lastRequests = this.getLastRequests();
5436		const numErrorsFlushed = ServerTelemetryManager.maxErrorsToSend(lastRequests);
5437		if (numErrorsFlushed === lastRequests.errors.length) this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
5438		else {
5439			const serverTelemEntity = {
5440				failedRequests: lastRequests.failedRequests.slice(numErrorsFlushed * 2),
5441				errors: lastRequests.errors.slice(numErrorsFlushed),
5442				cacheHits: 0
5443			};
5444			this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
5445		}
5446	}
5447	/**
5448	* Returns the maximum number of errors that can be flushed to the server in the next network request
5449	* @param serverTelemetryEntity
5450	*/
5451	static maxErrorsToSend(serverTelemetryEntity) {
5452		let i;
5453		let maxErrors = 0;
5454		let dataSize = 0;
5455		const errorCount = serverTelemetryEntity.errors.length;
5456		for (i = 0; i < errorCount; i++) {
5457			const apiId = serverTelemetryEntity.failedRequests[2 * i] || "";
5458			const correlationId = serverTelemetryEntity.failedRequests[2 * i + 1] || "";
5459			const errorCode = serverTelemetryEntity.errors[i] || "";
5460			dataSize += apiId.toString().length + correlationId.toString().length + errorCode.length + 3;
5461			if (dataSize < 330) maxErrors += 1;
5462			else break;
5463		}
5464		return maxErrors;
5465	}
5466	/**
5467	* Get the region discovery fields
5468	*
5469	* @returns string
5470	*/
5471	getRegionDiscoveryFields() {
5472		const regionDiscoveryFields = [];
5473		regionDiscoveryFields.push(this.regionUsed || "");
5474		regionDiscoveryFields.push(this.regionSource || "");
5475		regionDiscoveryFields.push(this.regionOutcome || "");
5476		return regionDiscoveryFields.join(",");
5477	}
5478	/**
5479	* Update the region discovery metadata
5480	*
5481	* @param regionDiscoveryMetadata
5482	* @returns void
5483	*/
5484	updateRegionDiscoveryMetadata(regionDiscoveryMetadata) {
5485		this.regionUsed = regionDiscoveryMetadata.region_used;
5486		this.regionSource = regionDiscoveryMetadata.region_source;
5487		this.regionOutcome = regionDiscoveryMetadata.region_outcome;
5488	}
5489	/**
5490	* Set cache outcome
5491	*/
5492	setCacheOutcome(cacheOutcome) {
5493		this.cacheOutcome = cacheOutcome;
5494	}
5495	setNativeBrokerErrorCode(errorCode) {
5496		const lastRequests = this.getLastRequests();
5497		lastRequests.nativeBrokerErrorCode = errorCode;
5498		this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
5499	}
5500	getNativeBrokerErrorCode() {
5501		return this.getLastRequests().nativeBrokerErrorCode;
5502	}
5503	clearNativeBrokerErrorCode() {
5504		const lastRequests = this.getLastRequests();
5505		delete lastRequests.nativeBrokerErrorCode;
5506		this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
5507	}
5508	static makeExtraSkuString(params) {
5509		return makeExtraSkuString(params);
5510	}
5511};
5512/** @internal */
5513var StubServerTelemetryManager = class extends ServerTelemetryManager {
5514	constructor() {
5515		super({
5516			clientId: "",
5517			apiId: 0,
5518			correlationId: "",
5519			forceRefresh: false
5520		}, {});
5521	}
5522	generateCurrentRequestHeaderValue() {
5523		return "";
5524	}
5525	generateLastRequestHeaderValue() {
5526		return "";
5527	}
5528	cacheFailedRequest() {}
5529	incrementCacheHits() {
5530		return 0;
5531	}
5532	clearTelemetryCache() {}
5533	getRegionDiscoveryFields() {
5534		return "";
5535	}
5536	updateRegionDiscoveryMetadata() {}
5537	setCacheOutcome() {}
5538	setNativeBrokerErrorCode() {}
5539	getNativeBrokerErrorCode() {}
5540	clearNativeBrokerErrorCode() {}
5541};
5542//#endregion
5543//#region node_modules/@azure/msal-common/dist-browser/error/JoseHeaderError.mjs
5544/*! @azure/msal-common v16.8.0 2026-06-10 */
5545/**
5546* Error thrown when there is an error in the client code running on the browser.
5547*/
5548var JoseHeaderError = class JoseHeaderError extends AuthError {
5549	constructor(errorCode, errorMessage) {
5550		super(errorCode, errorMessage);
5551		this.name = "JoseHeaderError";
5552		Object.setPrototypeOf(this, JoseHeaderError.prototype);
5553	}
5554};
5555/** Returns JoseHeaderError object */
5556function createJoseHeaderError(code) {
5557	return new JoseHeaderError(code);
5558}
5559//#endregion
5560//#region node_modules/@azure/msal-common/dist-browser/error/JoseHeaderErrorCodes.mjs
5561/*! @azure/msal-common v16.8.0 2026-06-10 */
5562var missingKidError = "missing_kid_error";
5563var missingAlgError = "missing_alg_error";
5564//#endregion
5565//#region node_modules/@azure/msal-common/dist-browser/crypto/JoseHeader.mjs
5566/*! @azure/msal-common v16.8.0 2026-06-10 */
5567/** @internal */
5568var JoseHeader = class JoseHeader {
5569	constructor(options) {
5570		this.typ = options.typ;
5571		this.alg = options.alg;
5572		this.kid = options.kid;
5573	}
5574	/**
5575	* Builds SignedHttpRequest formatted JOSE Header from the
5576	* JOSE Header options provided or previously set on the object and returns
5577	* the stringified header object.
5578	* Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
5579	* @param shrHeaderOptions
5580	* @returns
5581	*/
5582	static getShrHeaderString(shrHeaderOptions) {
5583		if (!shrHeaderOptions.kid) throw createJoseHeaderError(missingKidError);
5584		if (!shrHeaderOptions.alg) throw createJoseHeaderError(missingAlgError);
5585		const shrHeader = new JoseHeader({
5586			typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
5587			kid: shrHeaderOptions.kid,
5588			alg: shrHeaderOptions.alg
5589		});
5590		return JSON.stringify(shrHeader);
5591	}
5592};
5593//#endregion
5594//#region node_modules/@azure/msal-browser/dist/telemetry/BrowserPerformanceEvents.mjs

5595/*! @azure/msal-browser v5.13.0 2026-06-10 */
5596/**
5597* acquireTokenFromCache (msal-browser).
5598* Internal API for acquiring token from cache
5599*/
5600var AcquireTokenFromCache = "acquireTokenFromCache";
5601/**
5602* acquireTokenByRefreshToken API (msal-browser and msal-node).
5603* Used to renew an access token using a refresh token against the token endpoint.
5604*/
5605var AcquireTokenByRefreshToken = "acquireTokenByRefreshToken";
5606/**
5607* acquireTokenSilentAsync (msal-browser).
5608* Internal API for acquireTokenSilent.
5609*/
5610var AcquireTokenSilentAsync = "acquireTokenSilentAsync";
5611/**
5612* getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
5613* Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
5614*/
5615var CryptoOptsGetPublicKeyThumbprint = "cryptoOptsGetPublicKeyThumbprint";
5616/**
5617* signJwt API in CryptoOpts class (msal-browser).
5618* Used to signed a pop token.
5619*/
5620var CryptoOptsSignJwt = "cryptoOptsSignJwt";
5621/**
5622* acquireToken API in the SilentCacheClient class (msal-browser).
5623* Used to read access tokens from the cache.
5624*/
5625var SilentCacheClientAcquireToken = "silentCacheClientAcquireToken";
5626/**
5627* acquireToken API in the SilentIframeClient class (msal-browser).
5628* Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
5629*/
5630var SilentIframeClientAcquireToken = "silentIframeClientAcquireToken";
5631var AwaitConcurrentIframe = "awaitConcurrentIframe";
5632/**
5633* acquireToken API in SilentRereshClient (msal-browser).
5634* Used to acquire a new set of tokens from the token endpoint using a refresh token.
5635*/
5636var SilentRefreshClientAcquireToken = "silentRefreshClientAcquireToken";
5637/**
5638* getDiscoveredAuthority API in StandardInteractionClient class (msal-browser).
5639* Used to load authority metadata for a request.
5640*/
5641var StandardInteractionClientGetDiscoveredAuthority = "standardInteractionClientGetDiscoveredAuthority";
5642/**
5643* acquireToken API in NativeInteractionClient class (msal-browser).
5644* Used to acquire a token from Native component when native brokering is enabled.
5645*/
5646var NativeInteractionClientAcquireToken = "nativeInteractionClientAcquireToken";
5647var NativeInteractionClientAcquireTokenRedirect = "nativeInteractionClientAcquireToken";
5648/**
5649* acquireTokenByRefreshToken API in RefreshTokenClient (msal-common).
5650*/
5651var RefreshTokenClientAcquireTokenByRefreshToken = "refreshTokenClientAcquireTokenByRefreshToken";
5652/**
5653* acquireTokenBySilentIframe (msal-browser).
5654* Internal API for acquiring token by silent Iframe
5655*/
5656var AcquireTokenBySilentIframe = "acquireTokenBySilentIframe";
5657/**
5658* Internal API for initializing base request in BaseInteractionClient (msal-browser)
5659*/
5660var InitializeBaseRequest = "initializeBaseRequest";
5661/**
5662* Internal API for initializing silent request in SilentCacheClient (msal-browser)
5663*/
5664var InitializeSilentRequest = "initializeSilentRequest";
5665var InitializeCache = "initializeCache";
5666/**
5667* Helper function in SilentIframeClient class (msal-browser).
5668*/
5669var SilentIframeClientTokenHelper = "silentIframeClientTokenHelper";
5670/**
5671* SilentHandler
5672*/
5673var SilentHandlerInitiateAuthRequest = "silentHandlerInitiateAuthRequest";
5674var SilentHandlerMonitorIframeForHash = "silentHandlerMonitorIframeForHash";
5675/**
5676* Helper functions in StandardInteractionClient class (msal-browser)
5677*/
5678var StandardInteractionClientCreateAuthCodeClient = "standardInteractionClientCreateAuthCodeClient";
5679var StandardInteractionClientGetClientConfiguration = "standardInteractionClientGetClientConfiguration";
5680var StandardInteractionClientInitializeAuthorizationRequest = "standardInteractionClientInitializeAuthorizationRequest";

5681var SilentFlowClientAcquireCachedToken = "silentFlowClientAcquireCachedToken";
5682var GetStandardParams = "getStandardParams";
5683var HandleCodeResponse = "handleCodeResponse";
5684var HandleResponseEar = "handleResponseEar";
5685var HandleResponsePlatformBroker = "handleResponsePlatformBroker";
5686var HandleResponseCode = "handleResponseCode";
5687var AuthClientAcquireToken = "authClientAcquireToken";
5688var DeserializeResponse = "deserializeResponse";
5689var AuthorityFactoryCreateDiscoveredInstance = "authorityFactoryCreateDiscoveredInstance";
5690var AcquireTokenByCodeAsync = "acquireTokenByCodeAsync";
5691var HandleRedirectPromiseMeasurement = "handleRedirectPromise";
5692var HandleNativeRedirectPromiseMeasurement = "handleNativeRedirectPromise";
5693var NativeMessageHandlerHandshake = "nativeMessageHandlerHandshake";
5694var RemoveHiddenIframe = "removeHiddenIframe";
5695var ImportExistingCache = "importExistingCache";
5696/**
5697* Crypto Operations
5698*/
5699var GeneratePkceCodes = "generatePkceCodes";
5700var GenerateCodeVerifier = "generateCodeVerifier";
5701var GenerateCodeChallengeFromVerifier = "generateCodeChallengeFromVerifier";
5702var Sha256Digest = "sha256Digest";
5703var GetRandomValues = "getRandomValues";
5704var GenerateHKDF = "generateHKDF";
5705var GenerateBaseKey = "generateBaseKey";
5706var Base64Decode = "base64Decode";
5707var UrlEncodeArr = "urlEncodeArr";
5708var Encrypt = "encrypt";
5709var Decrypt = "decrypt";
5710var GenerateEarKey = "generateEarKey";
5711var DecryptEarResponse = "decryptEarResponse";
5712/**
5713* Background telemetry measurement that tracks whether a late bridge response
5714* arrives after the iframe timeout has already fired.
5715*/
5716var WaitForBridgeLateResponse = "waitForBridgeLateResponse";
5717//#endregion
5718//#region node_modules/@azure/msal-browser/dist/error/BrowserAuthError.mjs
5719/*! @azure/msal-browser v5.13.0 2026-06-10 */
5720function getDefaultErrorMessage(code) {
5721	return `See https://aka.ms/msal.js.errors#${code} for details`;
5722}
5723/**
5724* Browser library error class thrown by the MSAL.js library for SPAs
5725*/
5726var BrowserAuthError = class BrowserAuthError extends AuthError {
5727	constructor(errorCode, subError) {
5728		super(errorCode, getDefaultErrorMessage(errorCode), subError);
5729		Object.setPrototypeOf(this, BrowserAuthError.prototype);
5730		this.name = "BrowserAuthError";
5731	}
5732};
5733function createBrowserAuthError(errorCode, subError) {
5734	return new BrowserAuthError(errorCode, subError);
5735}
5736//#endregion
5737//#region node_modules/@azure/msal-browser/dist/error/BrowserAuthErrorCodes.mjs
5738/*! @azure/msal-browser v5.13.0 2026-06-10 */
5739var pkceNotCreated = "pkce_not_created";
5740var earJwkEmpty = "ear_jwk_empty";
5741var earJweEmpty = "ear_jwe_empty";
5742var cryptoNonExistent = "crypto_nonexistent";
5743var emptyNavigateUri = "empty_navigate_uri";
5744var hashEmptyError = "hash_empty_error";
5745var noStateInHash = "no_state_in_hash";
5746var hashDoesNotContainKnownProperties = "hash_does_not_contain_known_properties";
5747var unableToParseState = "unable_to_parse_state";
5748var stateInteractionTypeMismatch = "state_interaction_type_mismatch";
5749var interactionInProgress = "interaction_in_progress";
5750var interactionInProgressCancelled = "interaction_in_progress_cancelled";
5751var popupWindowError = "popup_window_error";
5752var emptyWindowError = "empty_window_error";
5753var userCancelled = "user_cancelled";
5754var redirectBridgeEmptyResponse = "redirect_bridge_empty_response";
5755var redirectInIframe = "redirect_in_iframe";
5756var blockIframeReload = "block_iframe_reload";
5757var blockNestedPopups = "block_nested_popups";
5758var silentLogoutUnsupported = "silent_logout_unsupported";
5759var noAccountError = "no_account_error";
5760var noTokenRequestCacheError = "no_token_request_cache_error";
5761var unableToParseTokenRequestCacheError = "unable_to_parse_token_request_cache_error";
5762var nonBrowserEnvironment = "non_browser_environment";
5763var databaseNotOpen = "database_not_open";
5764var noNetworkConnectivity = "no_network_connectivity";
5765var postRequestFailed = "post_request_failed";
5766var getRequestFailed = "get_request_failed";
5767var failedToParseResponse = "failed_to_parse_response";
5768var cryptoKeyNotFound = "crypto_key_not_found";
5769var authCodeRequired = "auth_code_required";
5770var authCodeOrNativeAccountIdRequired = "auth_code_or_nativeAccountId_required";
5771var spaCodeAndNativeAccountIdPresent = "spa_code_and_nativeAccountId_present";
5772var databaseUnavailable = "database_unavailable";
5773var unableToAcquireTokenFromNativePlatform = "unable_to_acquire_token_from_native_platform";
5774var nativeHandshakeTimeout = "native_handshake_timeout";
5775var nativeExtensionNotInstalled = "native_extension_not_installed";
5776var nativeConnectionNotEstablished = "native_connection_not_established";
5777var uninitializedPublicClientApplication = "uninitialized_public_client_application";
5778var nativePromptNotSupported = "native_prompt_not_supported";

5779var invalidBase64String = "invalid_base64_string";
5780var invalidPopTokenRequest = "invalid_pop_token_request";
5781var failedToBuildHeaders = "failed_to_build_headers";
5782var failedToParseHeaders = "failed_to_parse_headers";
5783var failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
5784var timedOut = "timed_out";
5785var emptyResponse = "empty_response";
5786//#endregion
5787//#region node_modules/@azure/msal-browser/dist/encode/Base64Decode.mjs
5788/*! @azure/msal-browser v5.13.0 2026-06-10 */
5789/**
5790* Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
5791* https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
5792*/
5793/**
5794* Returns a URL-safe plaintext decoded string from b64 encoded input.
5795* @param input
5796*/
5797function base64Decode(input) {
5798	return new TextDecoder().decode(base64DecToArr(input));
5799}
5800/**
5801* Decodes base64 into Uint8Array
5802* @param base64String
5803*/
5804function base64DecToArr(base64String) {
5805	let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
5806	switch (encodedString.length % 4) {
5807		case 0: break;
5808		case 2:
5809			encodedString += "==";
5810			break;
5811		case 3:
5812			encodedString += "=";
5813			break;
5814		default: throw createBrowserAuthError(invalidBase64String);
5815	}
5816	const binString = atob(encodedString);
5817	return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
5818}
5819//#endregion
5820//#region node_modules/@azure/msal-browser/dist/utils/BrowserConstants.mjs
5821/*! @azure/msal-browser v5.13.0 2026-06-10 */
5822/**
5823* Constants
5824*/
5825var BrowserConstants = {
5826	/**
5827	* Invalid grant error code
5828	*/
5829	INVALID_GRANT_ERROR: "invalid_grant",
5830	/**
5831	* Default popup window width
5832	*/
5833	POPUP_WIDTH: 483,
5834	/**
5835	* Default popup window height
5836	*/
5837	POPUP_HEIGHT: 600,
5838	/**
5839	* Name of the popup window starts with
5840	*/
5841	POPUP_NAME_PREFIX: "msal",
5842	/**
5843	* Msal-browser SKU
5844	*/
5845	MSAL_SKU: "msal.js.browser"
5846};
5847var PlatformAuthConstants = {
5848	CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
5849	PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji",
5850	MATS_TELEMETRY: "MATS",
5851	MICROSOFT_ENTRA_BROKERID: "MicrosoftEntra",
5852	DOM_API_NAME: "DOM API",
5853	PLATFORM_DOM_APIS: "get-token-and-sign-out",
5854	PLATFORM_DOM_PROVIDER: "PlatformAuthDOMHandler",
5855	PLATFORM_EXTENSION_PROVIDER: "PlatformAuthExtensionHandler"
5856};
5857var NativeExtensionMethod = {
5858	HandshakeRequest: "Handshake",
5859	HandshakeResponse: "HandshakeResponse",
5860	GetToken: "GetToken",
5861	Response: "Response"
5862};
5863var BrowserCacheLocation = {
5864	LocalStorage: "localStorage",
5865	SessionStorage: "sessionStorage",
5866	MemoryStorage: "memoryStorage"
5867};
5868/**
5869* HTTP Request types supported by MSAL.
5870*/
5871var HTTP_REQUEST_TYPE = {
5872	GET: "GET",
5873	POST: "POST"
5874};
5875var INTERACTION_TYPE = {
5876	SIGNIN: "signin",
5877	SIGNOUT: "signout"
5878};
5879/**
5880* Temporary cache keys for MSAL, deleted after any request.
5881*/
5882var TemporaryCacheKeys = {
5883	ORIGIN_URI: "request.origin",
5884	URL_HASH: "urlHash",
5885	REQUEST_PARAMS: "request.params",
5886	VERIFIER: "code.verifier",
5887	INTERACTION_STATUS_KEY: "interaction.status",
5888	NATIVE_REQUEST: "request.native"
5889};
5890/**
5891* Cache keys stored in-memory
5892*/
5893var InMemoryCacheKeys = {
5894	WRAPPER_SKU: "wrapper.sku",
5895	WRAPPER_VER: "wrapper.version"
5896};
5897/**
5898* API Codes for Telemetry purposes.
5899* Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
5900* 0-99 Silent Flow
5901* 800-899 Auth Code Flow
5902* 900-999 Misc
5903*/
5904var ApiId = {
5905	acquireTokenRedirect: 861,
5906	acquireTokenPopup: 862,
5907	ssoSilent: 863,
5908	acquireTokenSilent_authCode: 864,
5909	handleRedirectPromise: 865,
5910	acquireTokenByCode: 866,
5911	acquireTokenSilent_silentFlow: 61,
5912	logout: 961,
5913	logoutPopup: 962,
5914	hydrateCache: 963,
5915	loadExternalTokens: 964
5916};
5917/**
5918* API Names for Telemetry purposes.
5919*/
5920var ApiName = {
5921	861: "acquireTokenRedirect",
5922	862: "acquireTokenPopup",
5923	863: "ssoSilent",
5924	864: "acquireTokenSilent_authCode",
5925	865: "handleRedirectPromise",
5926	866: "acquireTokenByCode",
5927	61: "acquireTokenSilent_silentFlow",
5928	961: "logout",
5929	962: "logoutPopup",
5930	963: "hydrateCache",
5931	964: "loadExternalTokens"
5932};
5933var apiIdToName = (id) => {
5934	if (typeof id === "number" && id in ApiName) return ApiName[id];
5935	return "unknown";
5936};
5937var InteractionType;
5938(function(InteractionType) {
5939	InteractionType["Redirect"] = "redirect";
5940	InteractionType["Popup"] = "popup";
5941	InteractionType["Silent"] = "silent";
5942	InteractionType["None"] = "none";
5943})(InteractionType || (InteractionType = {}));
5944var DEFAULT_REQUEST = { scopes: OIDC_DEFAULT_SCOPES };
5945var DB_NAME = "msal.db";

5946var DB_TABLE_NAME = `${DB_NAME}.keys`;
5947var CacheLookupPolicy = {
5948	Default: 0,
5949	AccessToken: 1,
5950	AccessTokenAndRefreshToken: 2,
5951	RefreshToken: 3,
5952	RefreshTokenAndNetwork: 4,
5953	Skip: 5
5954};
5955var iFrameRenewalPolicies = [
5956	CacheLookupPolicy.Default,
5957	CacheLookupPolicy.Skip,
5958	CacheLookupPolicy.RefreshTokenAndNetwork
5959];
5960//#endregion
5961//#region node_modules/@azure/msal-browser/dist/encode/Base64Encode.mjs
5962/*! @azure/msal-browser v5.13.0 2026-06-10 */
5963/**
5964* Class which exposes APIs to encode plaintext to base64 encoded string. See here for implementation details:
5965* https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding#Solution_2_%E2%80%93_JavaScript's_UTF-16_%3E_UTF-8_%3E_base64
5966*/
5967/**
5968* Returns URL Safe b64 encoded string from a plaintext string.
5969* @param input
5970*/
5971function urlEncode(input) {
5972	return encodeURIComponent(base64Encode(input).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_"));
5973}
5974/**
5975* Returns URL Safe b64 encoded string from an int8Array.
5976* @param inputArr
5977*/
5978function urlEncodeArr(inputArr) {
5979	return base64EncArr(inputArr).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
5980}
5981/**
5982* Returns b64 encoded string from plaintext string.
5983* @param input
5984*/
5985function base64Encode(input) {
5986	return base64EncArr(new TextEncoder().encode(input));
5987}
5988/**
5989* Base64 encode byte array
5990* @param aBytes
5991*/
5992function base64EncArr(aBytes) {
5993	const binString = Array.from(aBytes, (x) => String.fromCodePoint(x)).join("");
5994	return btoa(binString);
5995}
5996//#endregion
5997//#region node_modules/@azure/msal-browser/dist/crypto/BrowserCrypto.mjs
5998/*! @azure/msal-browser v5.13.0 2026-06-10 */
5999/**
6000* This file defines functions used by the browser library to perform cryptography operations such as
6001* hashing and encoding. It also has helper functions to validate the availability of specific APIs.
6002*/
6003/**
6004* See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
6005*/
6006var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
6007var AES_GCM = "AES-GCM";
6008var HKDF = "HKDF";
6009var S256_HASH_ALG = "SHA-256";
6010var MODULUS_LENGTH = 2048;
6011var PUBLIC_EXPONENT = new Uint8Array([
6012	1,
6013	0,
6014	1
6015]);
6016var UUID_CHARS = "0123456789abcdef";
6017var UINT32_ARR = new Uint32Array(1);
6018var RAW = "raw";
6019var ENCRYPT = "encrypt";
6020var DECRYPT = "decrypt";
6021var DERIVE_KEY = "deriveKey";
6022var SUBTLE_SUBERROR = "crypto_subtle_undefined";
6023var keygenAlgorithmOptions = {
6024	name: PKCS1_V15_KEYGEN_ALG,
6025	hash: S256_HASH_ALG,
6026	modulusLength: MODULUS_LENGTH,
6027	publicExponent: PUBLIC_EXPONENT
6028};
6029/**
6030* Check whether browser crypto is available.
6031*/
6032function validateCryptoAvailable(skipValidateSubtleCrypto) {
6033	if (!window) throw createBrowserAuthError(nonBrowserEnvironment);
6034	if (!window.crypto) throw createBrowserAuthError(cryptoNonExistent);
6035	if (!skipValidateSubtleCrypto && !window.crypto.subtle) throw createBrowserAuthError(cryptoNonExistent, SUBTLE_SUBERROR);
6036}
6037/**
6038* Returns a sha-256 hash of the given dataString as an ArrayBuffer.
6039* @param dataString {string} data string
6040* @param performanceClient {?IPerformanceClient}
6041* @param correlationId {?string} correlation id
6042*/
6043async function sha256Digest(dataString) {
6044	const data = new TextEncoder().encode(dataString);
6045	return window.crypto.subtle.digest(S256_HASH_ALG, data);
6046}
6047/**
6048* Populates buffer with cryptographically random values.
6049* @param dataBuffer
6050*/
6051function getRandomValues(dataBuffer) {
6052	return window.crypto.getRandomValues(dataBuffer);
6053}
6054/**
6055* Returns random Uint32 value.
6056* @returns {number}
6057*/
6058function getRandomUint32() {
6059	window.crypto.getRandomValues(UINT32_ARR);
6060	return UINT32_ARR[0];
6061}
6062/**
6063* Creates a UUID v7 from the current timestamp.
6064* Implementation relies on the system clock to guarantee increasing order of generated identifiers.
6065* @returns {number}
6066*/
6067function createNewGuid() {
6068	const currentTimestamp = Date.now();
6069	const baseRand = getRandomUint32() * 1024 + (getRandomUint32() & 1023);
6070	const bytes = new Uint8Array(16);
6071	const randA = Math.trunc(baseRand / 2 ** 30);
6072	const randBHi = baseRand & 2 ** 30 - 1;
6073	const randBLo = getRandomUint32();
6074	bytes[0] = currentTimestamp / 2 ** 40;
6075	bytes[1] = currentTimestamp / 2 ** 32;
6076	bytes[2] = currentTimestamp / 2 ** 24;
6077	bytes[3] = currentTimestamp / 2 ** 16;
6078	bytes[4] = currentTimestamp / 2 ** 8;
6079	bytes[5] = currentTimestamp;
6080	bytes[6] = 112 | randA >>> 8;
6081	bytes[7] = randA;
6082	bytes[8] = 128 | randBHi >>> 24;
6083	bytes[9] = randBHi >>> 16;
6084	bytes[10] = randBHi >>> 8;
6085	bytes[11] = randBHi;
6086	bytes[12] = randBLo >>> 24;
6087	bytes[13] = randBLo >>> 16;

6088	bytes[14] = randBLo >>> 8;
6089	bytes[15] = randBLo;
6090	let text = "";
6091	for (let i = 0; i < bytes.length; i++) {
6092		text += UUID_CHARS.charAt(bytes[i] >>> 4);
6093		text += UUID_CHARS.charAt(bytes[i] & 15);
6094		if (i === 3 || i === 5 || i === 7 || i === 9) text += "-";
6095	}
6096	return text;
6097}
6098/**
6099* Generates a keypair based on current keygen algorithm config.
6100* @param extractable
6101* @param usages
6102*/
6103async function generateKeyPair(extractable, usages) {
6104	return window.crypto.subtle.generateKey(keygenAlgorithmOptions, extractable, usages);
6105}
6106/**
6107* Export key as Json Web Key (JWK)
6108* @param key
6109*/
6110async function exportJwk(key) {
6111	return window.crypto.subtle.exportKey("jwk", key);
6112}
6113/**
6114* Imports key as Json Web Key (JWK), can set extractable and usages.
6115* @param key
6116* @param extractable
6117* @param usages
6118*/
6119async function importJwk(key, extractable, usages) {
6120	return window.crypto.subtle.importKey("jwk", key, keygenAlgorithmOptions, extractable, usages);
6121}
6122/**
6123* Signs given data with given key
6124* @param key
6125* @param data
6126*/
6127async function sign(key, data) {
6128	return window.crypto.subtle.sign(keygenAlgorithmOptions, key, data);
6129}
6130/**
6131* Generates Base64 encoded jwk used in the Encrypted Authorize Response (EAR) flow
6132*/
6133async function generateEarKey() {
6134	const key = await generateBaseKey();
6135	const jwk = {
6136		alg: "dir",
6137		kty: "oct",
6138		k: urlEncodeArr(new Uint8Array(key))
6139	};
6140	return base64Encode(JSON.stringify(jwk));
6141}
6142/**
6143* Parses earJwk for encryption key and returns CryptoKey object
6144* @param earJwk
6145* @returns
6146*/
6147async function importEarKey(earJwk) {
6148	const b64DecodedJwk = base64Decode(earJwk);
6149	const rawKey = JSON.parse(b64DecodedJwk).k;
6150	const keyBuffer = base64DecToArr(rawKey);
6151	return window.crypto.subtle.importKey(RAW, keyBuffer, AES_GCM, false, [DECRYPT]);
6152}
6153/**
6154* Decrypt ear_jwe response returned in the Encrypted Authorize Response (EAR) flow
6155* @param earJwk
6156* @param earJwe
6157* @returns
6158*/
6159async function decryptEarResponse(earJwk, earJwe) {
6160	const earJweParts = earJwe.split(".");
6161	if (earJweParts.length !== 5) throw createBrowserAuthError(failedToDecryptEarResponse, "jwe_length");
6162	const key = await importEarKey(earJwk).catch(() => {
6163		throw createBrowserAuthError(failedToDecryptEarResponse, "import_key");
6164	});
6165	try {
6166		const header = new TextEncoder().encode(earJweParts[0]);
6167		const iv = base64DecToArr(earJweParts[2]);
6168		const ciphertext = base64DecToArr(earJweParts[3]);
6169		const tag = base64DecToArr(earJweParts[4]);
6170		const tagLengthBits = tag.byteLength * 8;
6171		const encryptedData = new Uint8Array(ciphertext.length + tag.length);
6172		encryptedData.set(ciphertext);
6173		encryptedData.set(tag, ciphertext.length);
6174		const decryptedData = await window.crypto.subtle.decrypt({
6175			name: AES_GCM,
6176			iv,
6177			tagLength: tagLengthBits,
6178			additionalData: header
6179		}, key, encryptedData);
6180		return new TextDecoder().decode(decryptedData);
6181	} catch (e) {
6182		throw createBrowserAuthError(failedToDecryptEarResponse, "decrypt");
6183	}
6184}
6185/**
6186* Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
6187*/
6188async function generateBaseKey() {
6189	const key = await window.crypto.subtle.generateKey({
6190		name: AES_GCM,
6191		length: 256
6192	}, true, [ENCRYPT, DECRYPT]);
6193	return window.crypto.subtle.exportKey(RAW, key);
6194}
6195/**
6196* Returns the raw key to be passed into the key derivation function
6197* @param baseKey
6198* @returns
6199*/
6200async function generateHKDF(baseKey) {
6201	return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [DERIVE_KEY]);
6202}
6203/**
6204* Given a base key and a nonce generates a derived key to be used in encryption and decryption.
6205* Note: every time we encrypt a new key is derived
6206* @param baseKey
6207* @param nonce
6208* @returns
6209*/
6210async function deriveKey(baseKey, nonce, context) {
6211	return window.crypto.subtle.deriveKey({
6212		name: HKDF,
6213		salt: nonce,
6214		hash: S256_HASH_ALG,
6215		info: new TextEncoder().encode(context)
6216	}, baseKey, {
6217		name: AES_GCM,
6218		length: 256
6219	}, false, [ENCRYPT, DECRYPT]);
6220}
6221/**
6222* Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
6223* @param key
6224* @param rawData
6225*/
6226async function encrypt(baseKey, rawData, context) {
6227	const encodedData = new TextEncoder().encode(rawData);
6228	const nonce = window.crypto.getRandomValues(new Uint8Array(16));
6229	const derivedKey = await deriveKey(baseKey, nonce, context);
6230	const encryptedData = await window.crypto.subtle.encrypt({
6231		name: AES_GCM,
6232		iv: new Uint8Array(12)
6233	}, derivedKey, encodedData);
6234	return {
6235		data: urlEncodeArr(new Uint8Array(encryptedData)),
6236		nonce: urlEncodeArr(nonce)
6237	};
6238}
6239/**
6240* Decrypt data with the given key and nonce
6241* @param key
6242* @param nonce
6243* @param encryptedData
6244* @returns
6245*/
6246async function decrypt(baseKey, nonce, context, encryptedData) {
6247	const encodedData = base64DecToArr(encryptedData);
6248	const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
6249	const decryptedData = await window.crypto.subtle.decrypt({
6250		name: AES_GCM,
6251		iv: new Uint8Array(12)
6252	}, derivedKey, encodedData);
6253	return new TextDecoder().decode(decryptedData);
6254}
6255/**
6256* Returns the SHA-256 hash of an input string
6257* @param plainText
6258*/
6259async function hashString(plainText) {
6260	const hashBuffer = await sha256Digest(plainText);
6261	return urlEncodeArr(new Uint8Array(hashBuffer));
6262}
6263//#endregion
6264//#region node_modules/@azure/msal-browser/dist/error/BrowserConfigurationAuthError.mjs

6265/*! @azure/msal-browser v5.13.0 2026-06-10 */
6266/**
6267* Browser library error class thrown by the MSAL.js library for SPAs
6268*/
6269var BrowserConfigurationAuthError = class BrowserConfigurationAuthError extends AuthError {
6270	constructor(errorCode, errorMessage) {
6271		super(errorCode, errorMessage);
6272		this.name = "BrowserConfigurationAuthError";
6273		Object.setPrototypeOf(this, BrowserConfigurationAuthError.prototype);
6274	}
6275};
6276function createBrowserConfigurationAuthError(errorCode) {
6277	return new BrowserConfigurationAuthError(errorCode, getDefaultErrorMessage(errorCode));
6278}
6279//#endregion
6280//#region node_modules/@azure/msal-browser/dist/error/BrowserConfigurationAuthErrorCodes.mjs
6281/*! @azure/msal-browser v5.13.0 2026-06-10 */
6282var storageNotSupported = "storage_not_supported";
6283var inMemRedirectUnavailable = "in_mem_redirect_unavailable";
6284//#endregion
6285//#region node_modules/@azure/msal-browser/dist/utils/BrowserUtils.mjs
6286/*! @azure/msal-browser v5.13.0 2026-06-10 */
6287/**
6288* Extracts and parses the authentication response from URL (hash and/or query string).
6289* This is a shared utility used across multiple components in msal-browser.
6290*
6291* @returns {Object} An object containing the parsed state information and URL parameters.
6292* @returns {URLSearchParams} params - The parsed URL parameters from the payload.
6293* @returns {string} payload - The combined query string and hash content.
6294* @returns {string} urlHash - The original URL hash.
6295* @returns {string} urlQuery - The original URL query string.
6296* @returns {LibraryStateObject} libraryState - The decoded library state from the state parameter.
6297*
6298* @throws {AuthError} If no authentication payload is found in the URL.
6299* @throws {AuthError} If the state parameter is missing.
6300* @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
6301*/
6302function parseAuthResponseFromUrl() {
6303	const urlHash = window.location.hash;
6304	const urlQuery = window.location.search;
6305	let hasResponseInHash = false;
6306	let hasResponseInQuery = false;
6307	let payload = "";
6308	let params = void 0;
6309	if (urlHash && urlHash.length > 1) {
6310		const hashContent = urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash;
6311		const hashParams = new URLSearchParams(hashContent);
6312		if (hashParams.has("state")) {
6313			hasResponseInHash = true;
6314			payload = hashContent;
6315			params = hashParams;
6316		}
6317	}
6318	if (urlQuery && urlQuery.length > 1) {
6319		const queryContent = urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery;
6320		const queryParams = new URLSearchParams(queryContent);
6321		if (queryParams.has("state")) {
6322			hasResponseInQuery = true;
6323			payload = queryContent;
6324			params = queryParams;
6325		}
6326	}
6327	if (hasResponseInHash && hasResponseInQuery) {
6328		payload = `${urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery}${urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash}`;
6329		params = new URLSearchParams(payload);
6330	}
6331	if (!payload || !params) throw createBrowserAuthError(emptyResponse);
6332	const state = params.get("state");
6333	if (!state) throw createBrowserAuthError(noStateInHash);
6334	const { libraryState } = parseRequestState(base64Decode, state);
6335	const { id, meta } = libraryState;
6336	if (!id || !meta) throw createBrowserAuthError(unableToParseState, "missing_library_state");
6337	return {
6338		params,
6339		payload,
6340		urlHash,
6341		urlQuery,
6342		hasResponseInHash,
6343		hasResponseInQuery,
6344		libraryState: {
6345			id,
6346			meta
6347		}
6348	};
6349}
6350/**
6351* Clears hash from window url.
6352*/
6353function clearHash(contentWindow) {
6354	contentWindow.location.hash = "";
6355	if (typeof contentWindow.history.replaceState === "function") contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
6356}
6357/**
6358* Replaces current hash with hash from provided url
6359*/
6360function replaceHash(url) {
6361	const urlParts = url.split("#");
6362	urlParts.shift();
6363	window.location.hash = urlParts.length > 0 ? urlParts.join("#") : "";
6364}
6365/**
6366* Returns boolean of whether the current window is in an iframe or not.
6367*/
6368function isInIframe() {
6369	return window.parent !== window;
6370}
6371/**
6372* Returns boolean of whether or not the current window is a popup opened by msal
6373*/
6374function isInPopup() {
6375	if (isInIframe()) return false;

6376	try {
6377		const { libraryState } = parseAuthResponseFromUrl();
6378		const { meta } = libraryState;
6379		return meta["interactionType"] === InteractionType.Popup;
6380	} catch (e) {
6381		return false;
6382	}
6383}
6384/**
6385* Await a response from a redirect bridge using BroadcastChannel.
6386* This unified function works for both popup and iframe scenarios by listening on a
6387* BroadcastChannel for the server payload.
6388*
6389* @param timeoutMs - Timeout in milliseconds.
6390* @param logger - Logger instance for logging monitoring events.
6391* @param browserCrypto - Browser crypto instance for decoding state.
6392* @param request - The authorization or end session request.
6393* @returns Promise<string> - Resolves with the response string (query or hash) from the window.
6394*/
6395var activeBridgeMonitor = null;
6396/**
6397* Cancels the pending bridge response monitor if one exists.
6398* This is called when overrideInteractionInProgress is used to cancel
6399* any pending popup interaction before starting a new one.
6400*/
6401function cancelPendingBridgeResponse(logger, correlationId) {
6402	if (activeBridgeMonitor) {
6403		logger.verbose("18y01k", correlationId);
6404		clearTimeout(activeBridgeMonitor.timeoutId);
6405		activeBridgeMonitor.channel.close();
6406		activeBridgeMonitor.reject(createBrowserAuthError(interactionInProgressCancelled));
6407		activeBridgeMonitor = null;
6408	}
6409}
6410async function waitForBridgeResponse(timeoutMs, logger, request, performanceClient, experimentalConfig) {
6411	return new Promise((resolve, reject) => {
6412		logger.verbose("1rf6em", request.correlationId);
6413		const correlationId = request.correlationId;
6414		performanceClient.addFields({
6415			redirectBridgeTimeoutMs: timeoutMs,
6416			lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false
6417		}, correlationId);
6418		const { libraryState } = parseRequestState(base64Decode, request.state || "");
6419		const channel = new BroadcastChannel(libraryState.id);
6420		let responseString = void 0;
6421		let timedOut$1 = false;
6422		let lateTimeoutId;
6423		let lateMeasurement;
6424		const timeoutId = window.setTimeout(() => {
6425			activeBridgeMonitor = null;
6426			if (experimentalConfig?.iframeTimeoutTelemetry) {
6427				lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
6428				timedOut$1 = true;
6429				lateTimeoutId = window.setTimeout(() => {
6430					lateMeasurement?.end({ success: false });
6431					clearTimeout(lateTimeoutId);
6432					channel.close();
6433				}, 6e4);
6434			} else channel.close();
6435			reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
6436		}, timeoutMs);
6437		activeBridgeMonitor = {
6438			timeoutId,
6439			channel,
6440			reject
6441		};
6442		channel.onmessage = (event) => {
6443			responseString = event.data.payload;
6444			const messageVersion = event?.data && typeof event.data.v === "number" ? event.data.v : void 0;
6445			if (timedOut$1) {
6446				lateMeasurement?.end({ success: responseString ? true : false });
6447				clearTimeout(lateTimeoutId);
6448				channel.close();
6449				return;
6450			}
6451			performanceClient.addFields({ redirectBridgeMessageVersion: messageVersion }, correlationId);
6452			activeBridgeMonitor = null;
6453			clearTimeout(timeoutId);
6454			channel.close();
6455			if (responseString) resolve(responseString);
6456			else reject(createBrowserAuthError(redirectBridgeEmptyResponse));
6457		};
6458	});
6459}
6460/**
6461* Returns current window URL as redirect uri
6462*/
6463function getCurrentUri() {
6464	return typeof window !== "undefined" && window.location ? window.location.href.split("?")[0].split("#")[0] : "";
6465}
6466/**
6467* Gets the homepage url for the current window location.
6468*/
6469function getHomepage() {
6470	const urlComponents = new UrlString(window.location.href).getUrlComponents();
6471	return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
6472}
6473/**
6474* Throws error if we have completed an auth and are
6475* attempting another auth request inside an iframe.
6476*/
6477function blockReloadInHiddenIframes() {
6478	if (getDeserializedResponse(window.location.hash) && isInIframe()) throw createBrowserAuthError(blockIframeReload);
6479}
6480/**
6481* Block redirect operations in iframes unless explicitly allowed
6482* @param interactionType Interaction type for the request
6483* @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
6484*/
6485function blockRedirectInIframe(allowRedirectInIframe) {
6486	if (isInIframe() && !allowRedirectInIframe) throw createBrowserAuthError(redirectInIframe);
6487}
6488/**
6489* Block redirectUri loaded in popup from calling AcquireToken APIs
6490*/
6491function blockAcquireTokenInPopups() {
6492	if (isInPopup()) throw createBrowserAuthError(blockNestedPopups);
6493}
6494/**
6495* Throws error if token requests are made in non-browser environment
6496* @param isBrowserEnvironment Flag indicating if environment is a browser.
6497*/
6498function blockNonBrowserEnvironment() {
6499	if (typeof window === "undefined") throw createBrowserAuthError(nonBrowserEnvironment);
6500}
6501/**
6502* Throws error if initialize hasn't been called
6503* @param initialized
6504*/
6505function blockAPICallsBeforeInitialize(initialized) {
6506	if (!initialized) throw createBrowserAuthError(uninitializedPublicClientApplication);
6507}
6508/**
6509* Helper to validate app environment before making an auth request
6510* @param initialized
6511*/
6512function preflightCheck$1(initialized) {
6513	blockNonBrowserEnvironment();
6514	blockReloadInHiddenIframes();
6515	blockAcquireTokenInPopups();
6516	blockAPICallsBeforeInitialize(initialized);
6517}
6518/**
6519* Helper to validate app enviornment before making redirect request
6520* @param initialized
6521* @param config
6522*/
6523function redirectPreflightCheck(initialized, config) {
6524	preflightCheck$1(initialized);
6525	blockRedirectInIframe(config.system.allowRedirectInIframe);

6526	if (config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage) throw createBrowserConfigurationAuthError(inMemRedirectUnavailable);
6527}
6528/**
6529* Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
6530* @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
6531* @returns
6532*/
6533function preconnect(authority) {
6534	const link = document.createElement("link");
6535	link.rel = "preconnect";
6536	link.href = new URL(authority).origin;
6537	link.crossOrigin = "anonymous";
6538	document.head.appendChild(link);
6539	window.setTimeout(() => {
6540		try {
6541			document.head.removeChild(link);
6542		} catch {}
6543	}, 1e4);
6544}
6545/**
6546* Wrapper function that creates a UUID v7 from the current timestamp.
6547* @returns {string}
6548*/
6549function createGuid() {
6550	return createNewGuid();
6551}
6552//#endregion
6553//#region node_modules/@azure/msal-browser/dist/cache/DatabaseStorage.mjs
6554/*! @azure/msal-browser v5.13.0 2026-06-10 */
6555/**
6556* Storage wrapper for IndexedDB storage in browsers: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API
6557*/
6558var DatabaseStorage = class {
6559	constructor() {
6560		this.dbName = DB_NAME;
6561		this.version = 1;
6562		this.tableName = DB_TABLE_NAME;
6563		this.dbOpen = false;
6564	}
6565	/**
6566	* Opens IndexedDB instance.
6567	*/
6568	async open() {
6569		return new Promise((resolve, reject) => {
6570			const openDB = window.indexedDB.open(this.dbName, this.version);
6571			openDB.addEventListener("upgradeneeded", (e) => {
6572				e.target.result.createObjectStore(this.tableName);
6573			});
6574			openDB.addEventListener("success", (e) => {
6575				const event = e;
6576				this.db = event.target.result;
6577				this.dbOpen = true;
6578				resolve();
6579			});
6580			openDB.addEventListener("error", () => reject(createBrowserAuthError(databaseUnavailable)));
6581		});
6582	}
6583	/**
6584	* Closes the connection to IndexedDB database when all pending transactions
6585	* complete.
6586	*/
6587	closeConnection() {
6588		const db = this.db;
6589		if (db && this.dbOpen) {
6590			db.close();
6591			this.dbOpen = false;
6592		}
6593	}
6594	/**
6595	* Opens database if it's not already open
6596	*/
6597	async validateDbIsOpen() {
6598		if (!this.dbOpen) return this.open();
6599	}
6600	/**
6601	* Retrieves item from IndexedDB instance.
6602	* @param key
6603	*/
6604	async getItem(key) {
6605		await this.validateDbIsOpen();
6606		return new Promise((resolve, reject) => {
6607			if (!this.db) return reject(createBrowserAuthError(databaseNotOpen));
6608			const dbGet = this.db.transaction([this.tableName], "readonly").objectStore(this.tableName).get(key);
6609			dbGet.addEventListener("success", (e) => {
6610				const event = e;
6611				this.closeConnection();
6612				resolve(event.target.result);
6613			});
6614			dbGet.addEventListener("error", (e) => {
6615				this.closeConnection();
6616				reject(e);
6617			});
6618		});
6619	}
6620	/**
6621	* Adds item to IndexedDB under given key
6622	* @param key
6623	* @param payload
6624	*/
6625	async setItem(key, payload) {
6626		await this.validateDbIsOpen();
6627		return new Promise((resolve, reject) => {
6628			if (!this.db) return reject(createBrowserAuthError(databaseNotOpen));
6629			const dbPut = this.db.transaction([this.tableName], "readwrite").objectStore(this.tableName).put(payload, key);
6630			dbPut.addEventListener("success", () => {
6631				this.closeConnection();
6632				resolve();
6633			});
6634			dbPut.addEventListener("error", (e) => {
6635				this.closeConnection();
6636				reject(e);
6637			});
6638		});
6639	}
6640	/**
6641	* Removes item from IndexedDB under given key
6642	* @param key
6643	*/
6644	async removeItem(key) {
6645		await this.validateDbIsOpen();
6646		return new Promise((resolve, reject) => {
6647			if (!this.db) return reject(createBrowserAuthError(databaseNotOpen));
6648			const dbDelete = this.db.transaction([this.tableName], "readwrite").objectStore(this.tableName).delete(key);
6649			dbDelete.addEventListener("success", () => {
6650				this.closeConnection();
6651				resolve();
6652			});
6653			dbDelete.addEventListener("error", (e) => {
6654				this.closeConnection();
6655				reject(e);
6656			});
6657		});
6658	}
6659	/**
6660	* Get all the keys from the storage object as an iterable array of strings.
6661	*/
6662	async getKeys() {
6663		await this.validateDbIsOpen();
6664		return new Promise((resolve, reject) => {
6665			if (!this.db) return reject(createBrowserAuthError(databaseNotOpen));
6666			const dbGetKeys = this.db.transaction([this.tableName], "readonly").objectStore(this.tableName).getAllKeys();
6667			dbGetKeys.addEventListener("success", (e) => {
6668				const event = e;
6669				this.closeConnection();
6670				resolve(event.target.result);
6671			});
6672			dbGetKeys.addEventListener("error", (e) => {
6673				this.closeConnection();
6674				reject(e);
6675			});
6676		});
6677	}
6678	/**
6679	*
6680	* Checks whether there is an object under the search key in the object store
6681	*/
6682	async containsKey(key) {
6683		await this.validateDbIsOpen();
6684		return new Promise((resolve, reject) => {
6685			if (!this.db) return reject(createBrowserAuthError(databaseNotOpen));
6686			const dbContainsKey = this.db.transaction([this.tableName], "readonly").objectStore(this.tableName).count(key);
6687			dbContainsKey.addEventListener("success", (e) => {
6688				const event = e;
6689				this.closeConnection();
6690				resolve(event.target.result === 1);
6691			});
6692			dbContainsKey.addEventListener("error", (e) => {
6693				this.closeConnection();
6694				reject(e);
6695			});
6696		});
6697	}
6698	/**
6699	* Deletes the MSAL database. The database is deleted rather than cleared to make it possible
6700	* for client applications to downgrade to a previous MSAL version without worrying about forward compatibility issues
6701	* with IndexedDB database versions.
6702	*/
6703	async deleteDatabase() {
6704		if (this.db && this.dbOpen) this.closeConnection();
6705		return new Promise((resolve, reject) => {
6706			const deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
6707			const id = setTimeout(() => reject(false), 200);
6708			deleteDbRequest.addEventListener("success", () => {
6709				clearTimeout(id);
6710				return resolve(true);
6711			});
6712			deleteDbRequest.addEventListener("blocked", () => {
6713				clearTimeout(id);
6714				return resolve(true);
6715			});
6716			deleteDbRequest.addEventListener("error", () => {
6717				clearTimeout(id);
6718				return reject(false);
6719			});
6720		});
6721	}
6722};
6723//#endregion
6724//#region node_modules/@azure/msal-browser/dist/cache/MemoryStorage.mjs

6725/*! @azure/msal-browser v5.13.0 2026-06-10 */
6726var MemoryStorage = class {
6727	constructor() {
6728		this.cache = /* @__PURE__ */ new Map();
6729	}
6730	async initialize() {}
6731	getItem(key) {
6732		return this.cache.get(key) || null;
6733	}
6734	getUserData(key) {
6735		return this.getItem(key);
6736	}
6737	setItem(key, value) {
6738		this.cache.set(key, value);
6739	}
6740	async setUserData(key, value) {
6741		this.setItem(key, value);
6742	}
6743	removeItem(key) {
6744		this.cache.delete(key);
6745	}
6746	getKeys() {
6747		const cacheKeys = [];
6748		this.cache.forEach((value, key) => {
6749			cacheKeys.push(key);
6750		});
6751		return cacheKeys;
6752	}
6753	containsKey(key) {
6754		return this.cache.has(key);
6755	}
6756	clear() {
6757		this.cache.clear();
6758	}
6759	decryptData() {
6760		return Promise.resolve(null);
6761	}
6762};
6763//#endregion
6764//#region node_modules/@azure/msal-browser/dist/cache/AsyncMemoryStorage.mjs
6765/*! @azure/msal-browser v5.13.0 2026-06-10 */
6766/**
6767* This class allows MSAL to store artifacts asynchronously using the DatabaseStorage IndexedDB wrapper,
6768* backed up with the more volatile MemoryStorage object for cases in which IndexedDB may be unavailable.
6769*/
6770var AsyncMemoryStorage = class {
6771	constructor(logger) {
6772		this.inMemoryCache = new MemoryStorage();
6773		this.indexedDBCache = new DatabaseStorage();
6774		this.logger = logger;
6775	}
6776	handleDatabaseAccessError(error, correlationId) {
6777		if (error instanceof BrowserAuthError && error.errorCode === "database_unavailable") this.logger.error("1wx7zz", correlationId);
6778		else throw error;
6779	}
6780	/**
6781	* Get the item matching the given key. Tries in-memory cache first, then in the asynchronous
6782	* storage object if item isn't found in-memory.
6783	* @param key
6784	* @param correlationId
6785	*/
6786	async getItem(key, correlationId) {
6787		const item = this.inMemoryCache.getItem(key);
6788		if (!item) try {
6789			this.logger.verbose("0naxpl", correlationId);
6790			return await this.indexedDBCache.getItem(key);
6791		} catch (e) {
6792			this.handleDatabaseAccessError(e, correlationId);
6793		}
6794		return item;
6795	}
6796	/**
6797	* Sets the item in the in-memory cache and then tries to set it in the asynchronous
6798	* storage object with the given key.
6799	* @param key
6800	* @param value
6801	* @param correlationId
6802	*/
6803	async setItem(key, value, correlationId) {
6804		this.inMemoryCache.setItem(key, value);
6805		try {
6806			await this.indexedDBCache.setItem(key, value);
6807		} catch (e) {
6808			this.handleDatabaseAccessError(e, correlationId);
6809		}
6810	}
6811	/**
6812	* Removes the item matching the key from the in-memory cache, then tries to remove it from the asynchronous storage object.
6813	* @param key
6814	* @param correlationId
6815	*/
6816	async removeItem(key, correlationId) {
6817		this.inMemoryCache.removeItem(key);
6818		try {
6819			await this.indexedDBCache.removeItem(key);
6820		} catch (e) {
6821			this.handleDatabaseAccessError(e, correlationId);
6822		}
6823	}
6824	/**
6825	* Get all the keys from the in-memory cache as an iterable array of strings. If no keys are found, query the keys in the
6826	* asynchronous storage object.
6827	* @param correlationId
6828	*/
6829	async getKeys(correlationId) {
6830		const cacheKeys = this.inMemoryCache.getKeys();
6831		if (cacheKeys.length === 0) try {
6832			this.logger.verbose("1iqrbq", correlationId);
6833			return await this.indexedDBCache.getKeys();
6834		} catch (e) {
6835			this.handleDatabaseAccessError(e, correlationId);
6836		}
6837		return cacheKeys;
6838	}
6839	/**
6840	* Returns true or false if the given key is present in the cache.
6841	* @param key
6842	* @param correlationId
6843	*/
6844	async containsKey(key, correlationId) {
6845		const containsKey = this.inMemoryCache.containsKey(key);
6846		if (!containsKey) try {
6847			this.logger.verbose("03zl2j", correlationId);
6848			return await this.indexedDBCache.containsKey(key);
6849		} catch (e) {
6850			this.handleDatabaseAccessError(e, correlationId);
6851		}
6852		return containsKey;
6853	}
6854	/**
6855	* Clears in-memory Map
6856	* @param correlationId
6857	*/
6858	clearInMemory(correlationId) {
6859		this.logger.verbose("03r21p", correlationId);
6860		this.inMemoryCache.clear();
6861		this.logger.verbose("0uksk1", correlationId);
6862	}
6863	/**
6864	* Tries to delete the IndexedDB database
6865	* @param correlationId
6866	* @returns
6867	*/
6868	async clearPersistent(correlationId) {
6869		try {
6870			this.logger.verbose("0rdqut", correlationId);
6871			const dbDeleted = await this.indexedDBCache.deleteDatabase();
6872			if (dbDeleted) this.logger.verbose("149ouc", correlationId);
6873			return dbDeleted;
6874		} catch (e) {
6875			this.handleDatabaseAccessError(e, correlationId);
6876			return false;

6877		}
6878	}
6879};
6880//#endregion
6881//#region node_modules/@azure/msal-browser/dist/crypto/CryptoOps.mjs
6882/*! @azure/msal-browser v5.13.0 2026-06-10 */
6883/**
6884* This class implements MSAL's crypto interface, which allows it to perform base64 encoding and decoding, generating cryptographically random GUIDs and
6885* implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
6886*/
6887var CryptoOps = class CryptoOps {
6888	constructor(logger, performanceClient, skipValidateSubtleCrypto) {
6889		this.logger = logger;
6890		validateCryptoAvailable(skipValidateSubtleCrypto ?? false);
6891		this.cache = new AsyncMemoryStorage(this.logger);
6892		this.performanceClient = performanceClient;
6893	}
6894	/**
6895	* Creates a new random GUID - used to populate state and nonce.
6896	* @returns string (GUID)
6897	*/
6898	createNewGuid() {
6899		return createNewGuid();
6900	}
6901	/**
6902	* Encodes input string to base64.
6903	* @param input
6904	*/
6905	base64Encode(input) {
6906		return base64Encode(input);
6907	}
6908	/**
6909	* Decodes input string from base64.
6910	* @param input
6911	*/
6912	base64Decode(input) {
6913		return base64Decode(input);
6914	}
6915	/**
6916	* Encodes input string to base64 URL safe string.
6917	* @param input
6918	*/
6919	base64UrlEncode(input) {
6920		return urlEncode(input);
6921	}
6922	/**
6923	* Stringifies and base64Url encodes input public key
6924	* @param inputKid
6925	* @returns Base64Url encoded public key
6926	*/
6927	encodeKid(inputKid) {
6928		return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
6929	}
6930	/**
6931	* Generates a keypair, stores it and returns a thumbprint
6932	* @param request
6933	*/
6934	async getPublicKeyThumbprint(request) {
6935		const publicKeyThumbMeasurement = this.performanceClient?.startMeasurement(CryptoOptsGetPublicKeyThumbprint, request.correlationId);
6936		const keyPair = await generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES);
6937		const publicKeyJwk = await exportJwk(keyPair.publicKey);
6938		const publicJwkString = getSortedObjectString({
6939			e: publicKeyJwk.e,
6940			kty: publicKeyJwk.kty,
6941			n: publicKeyJwk.n
6942		});
6943		const publicJwkHash = await this.hashString(publicJwkString);
6944		const unextractablePrivateKey = await importJwk(await exportJwk(keyPair.privateKey), false, ["sign"]);
6945		await this.cache.setItem(publicJwkHash, {
6946			privateKey: unextractablePrivateKey,
6947			publicKey: keyPair.publicKey,
6948			requestMethod: request.resourceRequestMethod,
6949			requestUri: request.resourceRequestUri
6950		}, request.correlationId);
6951		if (publicKeyThumbMeasurement) publicKeyThumbMeasurement.end({ success: true });
6952		return publicJwkHash;
6953	}
6954	/**
6955	* Removes cryptographic keypair from key store matching the keyId passed in
6956	* @param kid
6957	* @param correlationId
6958	*/
6959	async removeTokenBindingKey(kid, correlationId) {
6960		await this.cache.removeItem(kid, correlationId);
6961		if (await this.cache.containsKey(kid, correlationId)) throw createClientAuthError(bindingKeyNotRemoved);
6962	}
6963	/**
6964	* Removes all cryptographic keys from IndexedDB storage
6965	* @param correlationId
6966	*/
6967	async clearKeystore(correlationId) {
6968		this.cache.clearInMemory(correlationId);
6969		/**
6970		* There is only one database, so calling clearPersistent on asymmetric keystore takes care of
6971		* every persistent keystore
6972		*/
6973		try {
6974			await this.cache.clearPersistent(correlationId);
6975			return true;
6976		} catch (e) {
6977			if (e instanceof Error) this.logger.error("1owpn8", correlationId);
6978			else this.logger.error("0yrmwo", correlationId);
6979			return false;
6980		}
6981	}
6982	/**
6983	* Signs the given object as a jwt payload with private key retrieved by given kid.
6984	* @param payload
6985	* @param kid
6986	*/
6987	async signJwt(payload, kid, shrOptions, correlationId) {
6988		const signJwtMeasurement = this.performanceClient?.startMeasurement(CryptoOptsSignJwt, correlationId);
6989		const cachedKeyPair = await this.cache.getItem(kid, correlationId || "");
6990		if (!cachedKeyPair) throw createBrowserAuthError(cryptoKeyNotFound);
6991		const publicKeyJwk = await exportJwk(cachedKeyPair.publicKey);
6992		const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
6993		const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid }));
6994		const encodedShrHeader = urlEncode(JoseHeader.getShrHeaderString({
6995			...shrOptions?.header,
6996			alg: publicKeyJwk.alg,
6997			kid: encodedKeyIdThumbprint
6998		}));
6999		payload.cnf = { jwk: JSON.parse(publicKeyJwkString) };
7000		const tokenString = `${encodedShrHeader}.${urlEncode(JSON.stringify(payload))}`;
7001		const tokenBuffer = new TextEncoder().encode(tokenString);
7002		const signatureBuffer = await sign(cachedKeyPair.privateKey, tokenBuffer);
7003		const signedJwt = `${tokenString}.${urlEncodeArr(new Uint8Array(signatureBuffer))}`;
7004		if (signJwtMeasurement) signJwtMeasurement.end({ success: true });
7005		return signedJwt;
7006	}

7007	/**
7008	* Returns the SHA-256 hash of an input string
7009	* @param plainText
7010	*/
7011	async hashString(plainText) {
7012		return hashString(plainText);
7013	}
7014};
7015CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
7016CryptoOps.EXTRACTABLE = true;
7017function getSortedObjectString(obj) {
7018	return JSON.stringify(obj, Object.keys(obj).sort());
7019}
7020//#endregion
7021//#region node_modules/@azure/msal-browser/dist/telemetry/BrowserRootPerformanceEvents.mjs
7022/*! @azure/msal-browser v5.13.0 2026-06-10 */
7023/**
7024* acquireTokenSilent API (msal-browser and msal-node).
7025* Used to silently acquire a new access token (from the cache or the network).
7026*/
7027var AcquireTokenSilent = "acquireTokenSilent";
7028/**
7029* acquireTokenByCode API (msal-browser and msal-node).
7030* Used to acquire tokens by trading an authorization code against the token endpoint.
7031*/
7032var AcquireTokenByCode = "acquireTokenByCode";
7033/**
7034* acquireTokenPopup (msal-browser).
7035* Used to acquire a new access token interactively through pop ups
7036*/
7037var AcquireTokenPopup = "acquireTokenPopup";
7038/**
7039* acquireTokenPreRedirect (msal-browser).
7040* First part of the redirect flow.
7041* Used to acquire a new access token interactively through redirects.
7042*/
7043var AcquireTokenPreRedirect = "acquireTokenPreRedirect";
7044/**
7045* acquireTokenRedirect (msal-browser).
7046* Second part of the redirect flow.
7047* Used to acquire a new access token interactively through redirects.
7048*/
7049var AcquireTokenRedirect = "acquireTokenRedirect";
7050/**
7051* ssoSilent API (msal-browser).
7052* Used to silently acquire an authorization code and set of tokens using a hidden iframe.
7053*/
7054var SsoSilent = "ssoSilent";
7055var InitializeClientApplication = "initializeClientApplication";
7056var LocalStorageUpdated = "localStorageUpdated";
7057/**
7058* SSO capability verification call (msal-browser).
7059* Fire-and-forget SSO verification call made after interactive authentication completes.
7060*/
7061var SsoCapable = "ssoCapable";
7062//#endregion
7063//#region node_modules/@azure/msal-browser/dist/cache/CacheKeys.mjs
7064/*! @azure/msal-browser v5.13.0 2026-06-10 */
7065var PREFIX = "msal";
7066var BROWSER_PREFIX = "browser";
7067var LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
7068var LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
7069`${PREFIX}${BROWSER_PREFIX}`;
7070var VERSION_CACHE_KEY = `${PREFIX}.version`;
7071var ACCOUNT_KEYS = "account.keys";
7072var TOKEN_KEYS = "token.keys";
7073var SSO_CAPABLE = `${PREFIX}.${BROWSER_PREFIX}.sso.capable`;
7074function getAccountKeysCacheKey(schema = 3) {
7075	if (schema < 1) return `${PREFIX}.${ACCOUNT_KEYS}`;
7076	return `${PREFIX}.${schema}.${ACCOUNT_KEYS}`;
7077}
7078function getTokenKeysCacheKey(clientId, schema = 3) {
7079	if (schema < 1) return `${PREFIX}.${TOKEN_KEYS}.${clientId}`;
7080	return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
7081}
7082//#endregion
7083//#region node_modules/@azure/msal-browser/dist/cache/CookieStorage.mjs
7084/*! @azure/msal-browser v5.13.0 2026-06-10 */
7085var COOKIE_LIFE_MULTIPLIER = 1440 * 60 * 1e3;
7086var SameSiteOptions = {
7087	Lax: "Lax",
7088	None: "None"
7089};
7090var CookieStorage = class {
7091	initialize() {
7092		return Promise.resolve();
7093	}
7094	getItem(key) {
7095		const name = encodeURIComponent(key);
7096		const cookieList = document.cookie.split(";");
7097		for (let i = 0; i < cookieList.length; i++) {
7098			const cookie = cookieList[i].trim();
7099			const eqIndex = cookie.indexOf("=");
7100			if ((eqIndex === -1 ? cookie : cookie.substring(0, eqIndex)) === name) {
7101				const rawValue = eqIndex === -1 ? "" : cookie.substring(eqIndex + 1);
7102				try {
7103					return decodeURIComponent(rawValue);
7104				} catch {
7105					return rawValue;
7106				}
7107			}
7108		}
7109		return "";
7110	}
7111	getUserData() {
7112		throw createClientAuthError(methodNotImplemented);
7113	}
7114	setItem(key, value, cookieLifeDays, secure = true, sameSite = SameSiteOptions.Lax) {
7115		let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=${sameSite};`;
7116		if (cookieLifeDays) {
7117			const expireTime = getCookieExpirationTime(cookieLifeDays);
7118			cookieStr += `expires=${expireTime};`;
7119		}
7120		if (secure || sameSite === SameSiteOptions.None) cookieStr += "Secure;";
7121		document.cookie = cookieStr;
7122	}
7123	async setUserData() {
7124		return Promise.reject(createClientAuthError(methodNotImplemented));
7125	}
7126	removeItem(key) {
7127		this.setItem(key, "", -1);
7128	}
7129	getKeys() {
7130		const cookieList = document.cookie.split(";");

7131		const keys = [];
7132		cookieList.forEach((cookie) => {
7133			const trimmed = cookie.trim();
7134			const eqIndex = trimmed.indexOf("=");
7135			const rawKey = eqIndex === -1 ? trimmed : trimmed.substring(0, eqIndex);
7136			try {
7137				keys.push(decodeURIComponent(rawKey));
7138			} catch {}
7139		});
7140		return keys;
7141	}
7142	containsKey(key) {
7143		return this.getKeys().includes(key);
7144	}
7145	decryptData() {
7146		return Promise.resolve(null);
7147	}
7148};
7149/**
7150* Get cookie expiration time
7151* @param cookieLifeDays
7152*/
7153function getCookieExpirationTime(cookieLifeDays) {
7154	return new Date((/* @__PURE__ */ new Date()).getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER).toUTCString();
7155}
7156//#endregion
7157//#region node_modules/@azure/msal-browser/dist/cache/CacheHelpers.mjs
7158/*! @azure/msal-browser v5.13.0 2026-06-10 */
7159/**
7160* Returns a list of cache keys for all known accounts
7161* @param storage
7162* @returns
7163*/
7164function getAccountKeys(storage, schemaVersion) {
7165	const accountKeys = storage.getItem(getAccountKeysCacheKey(schemaVersion));
7166	if (accountKeys) return JSON.parse(accountKeys);
7167	return [];
7168}
7169/**
7170* Returns a list of cache keys for all known tokens
7171* @param clientId
7172* @param storage
7173* @returns
7174*/
7175function getTokenKeys(clientId, storage, schemaVersion) {
7176	const item = storage.getItem(getTokenKeysCacheKey(clientId, schemaVersion));
7177	if (item) {
7178		const tokenKeys = JSON.parse(item);
7179		if (tokenKeys && tokenKeys.hasOwnProperty("idToken") && tokenKeys.hasOwnProperty("accessToken") && tokenKeys.hasOwnProperty("refreshToken")) return tokenKeys;
7180	}
7181	return {
7182		idToken: [],
7183		accessToken: [],
7184		refreshToken: []
7185	};
7186}
7187//#endregion
7188//#region node_modules/@azure/msal-browser/dist/cache/EncryptedData.mjs
7189/*! @azure/msal-browser v5.13.0 2026-06-10 */
7190function isEncrypted(data) {
7191	return data.hasOwnProperty("id") && data.hasOwnProperty("nonce") && data.hasOwnProperty("data");
7192}
7193//#endregion
7194//#region node_modules/@azure/msal-browser/dist/cache/LocalStorage.mjs
7195/*! @azure/msal-browser v5.13.0 2026-06-10 */
7196var ENCRYPTION_KEY = "msal.cache.encryption";
7197var BROADCAST_CHANNEL_NAME$1 = "msal.broadcast.cache";
7198var LocalStorage = class {
7199	constructor(clientId, logger, performanceClient) {
7200		if (!window.localStorage) throw createBrowserConfigurationAuthError(storageNotSupported);
7201		this.memoryStorage = new MemoryStorage();
7202		this.initialized = false;
7203		this.clientId = clientId;
7204		this.logger = logger;
7205		this.performanceClient = performanceClient;
7206		this.broadcast = new BroadcastChannel(BROADCAST_CHANNEL_NAME$1);
7207	}
7208	async initialize(correlationId) {
7209		const cookies = new CookieStorage();
7210		const cookieString = cookies.getItem(ENCRYPTION_KEY);
7211		let parsedCookie = {
7212			key: "",
7213			id: ""
7214		};
7215		if (cookieString) try {
7216			parsedCookie = JSON.parse(cookieString);
7217		} catch (e) {}
7218		if (parsedCookie.key && parsedCookie.id) {
7219			const baseKey = invoke(base64DecToArr, Base64Decode, this.logger, this.performanceClient, correlationId)(parsedCookie.key);
7220			this.encryptionCookie = {
7221				id: parsedCookie.id,
7222				key: await invokeAsync(generateHKDF, GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey)
7223			};
7224		} else {
7225			const id = createNewGuid();
7226			const baseKey = await invokeAsync(generateBaseKey, GenerateBaseKey, this.logger, this.performanceClient, correlationId)();
7227			const keyStr = invoke(urlEncodeArr, UrlEncodeArr, this.logger, this.performanceClient, correlationId)(new Uint8Array(baseKey));
7228			this.encryptionCookie = {
7229				id,
7230				key: await invokeAsync(generateHKDF, GenerateHKDF, this.logger, this.performanceClient, correlationId)(baseKey)
7231			};
7232			const cookieData = {
7233				id,
7234				key: keyStr
7235			};
7236			cookies.setItem(ENCRYPTION_KEY, JSON.stringify(cookieData), 0, true, SameSiteOptions.None);
7237		}
7238		await invokeAsync(this.importExistingCache.bind(this), ImportExistingCache, this.logger, this.performanceClient, correlationId)(correlationId);
7239		this.broadcast.addEventListener("message", (event) => {
7240			this.updateCache(event, correlationId);
7241		});
7242		this.initialized = true;
7243	}
7244	getItem(key) {
7245		return window.localStorage.getItem(key);
7246	}
7247	getUserData(key) {
7248		if (!this.initialized) throw createBrowserAuthError(uninitializedPublicClientApplication);
7249		return this.memoryStorage.getItem(key);
7250	}
7251	async decryptData(key, data, correlationId) {
7252		if (!this.initialized || !this.encryptionCookie) throw createBrowserAuthError(uninitializedPublicClientApplication);
7253		if (data.id !== this.encryptionCookie.id) {
7254			this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
7255			return null;
7256		}
7257		const decryptedData = await invokeAsync(decrypt, Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.ke

7257y, data.nonce, this.getContext(key), data.data);
7258		if (!decryptedData) return null;
7259		try {
7260			return {
7261				...JSON.parse(decryptedData),
7262				lastUpdatedAt: data.lastUpdatedAt
7263			};
7264		} catch (e) {
7265			this.performanceClient.incrementFields({ encryptedCacheCorruptionCount: 1 }, correlationId);
7266			return null;
7267		}
7268	}
7269	setItem(key, value) {
7270		window.localStorage.setItem(key, value);
7271	}
7272	async setUserData(key, value, correlationId, timestamp, kmsi) {
7273		if (!this.initialized || !this.encryptionCookie) throw createBrowserAuthError(uninitializedPublicClientApplication);
7274		if (kmsi) this.setItem(key, value);
7275		else {
7276			const { data, nonce } = await invokeAsync(encrypt, Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
7277			const encryptedData = {
7278				id: this.encryptionCookie.id,
7279				nonce,
7280				data,
7281				lastUpdatedAt: timestamp
7282			};
7283			this.setItem(key, JSON.stringify(encryptedData));
7284		}
7285		this.memoryStorage.setItem(key, value);
7286		this.broadcast.postMessage({
7287			key,
7288			value,
7289			context: this.getContext(key)
7290		});
7291	}
7292	removeItem(key) {
7293		if (this.memoryStorage.containsKey(key)) {
7294			this.memoryStorage.removeItem(key);
7295			this.broadcast.postMessage({
7296				key,
7297				value: null,
7298				context: this.getContext(key)
7299			});
7300		}
7301		window.localStorage.removeItem(key);
7302	}
7303	getKeys() {
7304		return Object.keys(window.localStorage);
7305	}
7306	containsKey(key) {
7307		return window.localStorage.hasOwnProperty(key);
7308	}
7309	/**
7310	* Removes all known MSAL keys from the cache
7311	*/
7312	clear() {
7313		this.memoryStorage.clear();
7314		getAccountKeys(this).forEach((key) => this.removeItem(key));
7315		const tokenKeys = getTokenKeys(this.clientId, this);
7316		tokenKeys.idToken.forEach((key) => this.removeItem(key));
7317		tokenKeys.accessToken.forEach((key) => this.removeItem(key));
7318		tokenKeys.refreshToken.forEach((key) => this.removeItem(key));
7319		this.getKeys().forEach((cacheKey) => {
7320			if (cacheKey.startsWith("msal") || cacheKey.indexOf(this.clientId) !== -1) this.removeItem(cacheKey);
7321		});
7322	}
7323	/**
7324	* Helper to decrypt all known MSAL keys in localStorage and save them to inMemory storage
7325	* @returns
7326	*/
7327	async importExistingCache(correlationId) {
7328		if (!this.encryptionCookie) return;
7329		let accountKeys = getAccountKeys(this);
7330		accountKeys = await this.importArray(accountKeys, correlationId);
7331		if (accountKeys.length) this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys));
7332		else this.removeItem(getAccountKeysCacheKey());
7333		const tokenKeys = getTokenKeys(this.clientId, this);
7334		tokenKeys.idToken = await this.importArray(tokenKeys.idToken, correlationId);
7335		tokenKeys.accessToken = await this.importArray(tokenKeys.accessToken, correlationId);
7336		tokenKeys.refreshToken = await this.importArray(tokenKeys.refreshToken, correlationId);
7337		if (tokenKeys.idToken.length || tokenKeys.accessToken.length || tokenKeys.refreshToken.length) this.setItem(getTokenKeysCacheKey(this.clientId), JSON.stringify(tokenKeys));
7338		else this.removeItem(getTokenKeysCacheKey(this.clientId));
7339	}
7340	/**
7341	* Helper to decrypt and save cache entries
7342	* @param key
7343	* @returns
7344	*/
7345	async getItemFromEncryptedCache(key, correlationId) {
7346		if (!this.encryptionCookie) return null;
7347		const rawCache = this.getItem(key);
7348		if (!rawCache) return null;
7349		let encObj;
7350		try {
7351			encObj = JSON.parse(rawCache);
7352		} catch (e) {
7353			return null;
7354		}
7355		if (!isEncrypted(encObj)) {
7356			this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
7357			return rawCache;
7358		}
7359		if (encObj.id !== this.encryptionCookie.id) {
7360			this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
7361			return null;
7362		}
7363		this.performanceClient.incrementFields({ encryptedCacheCount: 1 }, correlationId);
7364		return invokeAsync(decrypt, Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
7365	}
7366	/**
7367	* Helper to decrypt and save an array of cache keys
7368	* @param arr
7369	* @returns Array of keys successfully imported
7370	*/
7371	async importArray(arr, correlationId) {
7372		const importedArr = [];
7373		const promiseArr = [];
7374		arr.forEach((key) => {
7375			const promise = this.getItemFromEncryptedCache(key, correlationId).then((value) => {
7376				if (value) {
7377					this.memoryStorage.setItem(key, value);
7378					importedArr.push(key);
7379				} else this.removeItem(key);
7380			});
7381			promiseArr.push(promise);
7382		});
7383		await Promise.all(promiseArr);
7384		return importedArr;
7385	}

7386	/**
7387	* Gets encryption context for a given cache entry. This is clientId for app specific entries, empty string for shared entries
7388	* @param key
7389	* @returns
7390	*/
7391	getContext(key) {
7392		let context = "";
7393		if (key.includes(this.clientId)) context = this.clientId;
7394		return context;
7395	}
7396	updateCache(event, correlationId) {
7397		this.logger.trace("17cxcm", correlationId);
7398		const perfMeasurement = this.performanceClient.startMeasurement(LocalStorageUpdated);
7399		perfMeasurement.add({ isBackground: true });
7400		const { key, value, context } = event.data;
7401		if (!key) {
7402			this.logger.error("0e10qr", correlationId);
7403			perfMeasurement.end({
7404				success: false,
7405				errorCode: "noKey"
7406			});
7407			return;
7408		}
7409		if (context && context !== this.clientId) {
7410			this.logger.trace("04rtdy", correlationId);
7411			perfMeasurement.end({
7412				success: false,
7413				errorCode: "contextMismatch"
7414			});
7415			return;
7416		}
7417		if (!value) {
7418			this.memoryStorage.removeItem(key);
7419			this.logger.verbose("04ypih", correlationId);
7420		} else {
7421			this.memoryStorage.setItem(key, value);
7422			this.logger.verbose("1vzsgt", correlationId);
7423		}
7424		perfMeasurement.end({ success: true });
7425	}
7426};
7427//#endregion
7428//#region node_modules/@azure/msal-browser/dist/cache/SessionStorage.mjs
7429/*! @azure/msal-browser v5.13.0 2026-06-10 */
7430var SessionStorage = class {
7431	constructor() {
7432		if (!window.sessionStorage) throw createBrowserConfigurationAuthError(storageNotSupported);
7433	}
7434	async initialize() {}
7435	getItem(key) {
7436		return window.sessionStorage.getItem(key);
7437	}
7438	getUserData(key) {
7439		return this.getItem(key);
7440	}
7441	setItem(key, value) {
7442		window.sessionStorage.setItem(key, value);
7443	}
7444	async setUserData(key, value) {
7445		this.setItem(key, value);
7446	}
7447	removeItem(key) {
7448		window.sessionStorage.removeItem(key);
7449	}
7450	getKeys() {
7451		return Object.keys(window.sessionStorage);
7452	}
7453	containsKey(key) {
7454		return window.sessionStorage.hasOwnProperty(key);
7455	}
7456	decryptData() {
7457		return Promise.resolve(null);
7458	}
7459};
7460//#endregion
7461//#region node_modules/@azure/msal-browser/dist/event/EventType.mjs
7462/*! @azure/msal-browser v5.13.0 2026-06-10 */
7463var EventType = {
7464	INITIALIZE_START: "msal:initializeStart",
7465	INITIALIZE_END: "msal:initializeEnd",
7466	ACTIVE_ACCOUNT_CHANGED: "msal:activeAccountChanged",
7467	LOGIN_SUCCESS: "msal:loginSuccess",
7468	ACQUIRE_TOKEN_START: "msal:acquireTokenStart",
7469	BROKERED_REQUEST_START: "msal:brokeredRequestStart",
7470	ACQUIRE_TOKEN_SUCCESS: "msal:acquireTokenSuccess",
7471	BROKERED_REQUEST_SUCCESS: "msal:brokeredRequestSuccess",
7472	ACQUIRE_TOKEN_FAILURE: "msal:acquireTokenFailure",
7473	BROKERED_REQUEST_FAILURE: "msal:brokeredRequestFailure",
7474	ACQUIRE_TOKEN_NETWORK_START: "msal:acquireTokenFromNetworkStart",
7475	HANDLE_REDIRECT_START: "msal:handleRedirectStart",
7476	HANDLE_REDIRECT_END: "msal:handleRedirectEnd",
7477	POPUP_OPENED: "msal:popupOpened",
7478	LOGOUT_START: "msal:logoutStart",
7479	LOGOUT_SUCCESS: "msal:logoutSuccess",
7480	LOGOUT_FAILURE: "msal:logoutFailure",
7481	LOGOUT_END: "msal:logoutEnd",
7482	RESTORE_FROM_BFCACHE: "msal:restoreFromBFCache",
7483	BROKER_CONNECTION_ESTABLISHED: "msal:brokerConnectionEstablished"
7484};
7485//#endregion
7486//#region node_modules/@azure/msal-browser/dist/packageMetadata.mjs
7487/*! @azure/msal-browser v5.13.0 2026-06-10 */
7488var name = "@azure/msal-browser";
7489var version = "5.13.0";
7490//#endregion
7491//#region node_modules/@azure/msal-browser/dist/utils/Helpers.mjs
7492/*! @azure/msal-browser v5.13.0 2026-06-10 */
7493/**
7494* Utility function to remove an element from an array in place.
7495* @param array - The array from which to remove the element.
7496* @param element - The element to remove from the array.
7497*/
7498function removeElementFromArray(array, element) {
7499	const index = array.indexOf(element);
7500	if (index > -1) array.splice(index, 1);
7501}
7502//#endregion
7503//#region node_modules/@azure/msal-browser/dist/cache/BrowserCacheManager.mjs
7504/*! @azure/msal-browser v5.13.0 2026-06-10 */
7505/**
7506* Reason an old-schema cache entry was removed during migration.
7507*/
7508var MigrationRemovalReason = {
7509	Invalid: "invalid",
7510	TtlExpired: "ttlExpired",
7511	DecryptFailed: "decryptFailed",
7512	Expired: "expired"
7513};
7514/**
7515* This class implements the cache storage interface for MSAL through browser local or session storage.
7516*/
7517var BrowserCacheManager = class extends CacheManager {
7518	constructor(clientId, cacheConfig, cryptoImpl, logger, performanceClient, eventHandler, staticAuthorityOptions) {
7519		super(clientId, cryptoImpl, logger, performanceClient, staticAuthorityOptions);
7520		this.cacheConfig = cacheConfig;
7521		this.logger = logger;
7522		this.internalStorage = new MemoryStorage();
7523		this.browserStorage = getStorageImplementation(clientId, cacheConfig.cacheLocation, logger, performanceClient);
7524		this.temporaryCacheStorage = getStorageImplementation(clientId, BrowserCacheLocation.SessionStorage, logger, performanceClient);
7525		this.cookieStorage = new CookieStorage();
7526		this.eventHandler = eventHandler;
7527	}
7528	async initialize(correlationId) {
7529		this.performanceClient.addFields({
7530			cacheLocation: this.cacheConfig.cacheLocation,
7531			cacheRetentionDays: this.cacheConfig.cacheRetentionDays
7532		}, correlationId);
7533		await this.browserStorage.initialize(correlationId);
7534		await this.migrateExistingCache(correlationId);
7535		this.trackVersionChanges(correlationId);
7536	}
7537	/**
7538	* Migrates any existing cache data from previous versions of MSAL.js into the current cache structure.
7539	*/
7540	async migrateExistingCache(correlationId) {
7541		let accountKeys = getAccountKeys(this.browserStorage);
7542		let tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
7543		this.performanceClient.addFields({
7544			preMigrateAcntCount: accountKeys.length,
7545			preMigrateATCount: tokenKeys.accessToken.length,
7546			preMigrateITCount: tokenKeys.idToken.length,
7547			preMigrateRTCount: tokenKeys.refreshToken.length
7548		}, correlationId);
7549		for (let i = 0; i < 3; i++) {
7550			const credentialSchema = i;
7551			await this.removeStaleAccounts(i, credentialSchema, correlationId);
7552		}
7553		for (let i = 0; i < 3; i++) {
7554			const accountSchema = i;
7555			await this.migrateIdTokens(i, accountSchema, correlationId);
7556		}
7557		const kmsiMap = this.getKMSIValues();
7558		for (let i = 0; i < 3; i++) {
7559			await this.migrateAccessTokens(i, kmsiMap, correlationId);
7560			await this.migrateRefreshTokens(i, kmsiMap, correlationId);
7561		}
7562		accountKeys = getAccountKeys(this.browserStorage);
7563		tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
7564		this.performanceClient.addFields({
7565			postMigrateAcntCount: accountKeys.length,
7566			postMigrateATCount: tokenKeys.accessToken.length,
7567			postMigrateITCount: tokenKeys.idToken.length,
7568			postMigrateRTCount: tokenKeys.refreshToken.length
7569		}, correlationId);
7570	}
7571	/**
7572	* Parses entry, adds lastUpdatedAt if it doesn't exist, removes entry if expired or invalid
7573	* @param key
7574	* @param correlationId
7575	* @returns
7576	*/
7577	async updateOldEntry(key, correlationId) {
7578		const rawValue = this.browserStorage.getItem(key);
7579		const parsedValue = this.validateAndParseJson(rawValue || "");
7580		if (!parsedValue) {
7581			this.browserStorage.removeItem(key);
7582			return {
7583				entry: null,
7584				removalReason: MigrationRemovalReason.Invalid
7585			};
7586		}
7587		if (!parsedValue.lastUpdatedAt) {
7588			parsedValue.lastUpdatedAt = Date.now().toString();
7589			this.setItem(key, JSON.stringify(parsedValue), correlationId);
7590		} else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
7591			this.browserStorage.removeItem(key);
7592			return {
7593				entry: null,
7594				removalReason: MigrationRemovalReason.TtlExpired
7595			};
7596		}
7597		const wasEncrypted = isEncrypted(parsedValue);
7598		const decryptedData = wasEncrypted ? await this.browserStorage.decryptData(key, parsedValue, correlationId) : parsedValue;
7599		if (!decryptedData) {
7600			this.browserStorage.removeItem(key);
7601			return {
7602				entry: null,
7603				removalReason: wasEncrypted ? MigrationRemovalReason.DecryptFailed : MigrationRemovalReason.Invalid
7604			};
7605		}
7606		if (!isCredentialEntity(decryptedData)) {
7607			this.browserStorage.removeItem(key);
7608			return {
7609				entry: null,
7610				removalReason: MigrationRemovalReason.Invalid
7611			};
7612		}
7613		if ((isAccessTokenEntity(decryptedData) || isRefreshTokenEntity(decryptedData)) && decryptedData.expiresOn && isTokenExpired(decryptedData.expiresOn, 300)) {
7614			this.browserStorage.removeItem(key);
7615			return {
7616				entry: null,
7617				removalReason: MigrationRemovalReason.Expired
7618			};
7619		}
7620		return { entry: decryptedData };
7621	}
7622	/**
7623	* Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
7624	* @param accountSchema
7625	* @param credentialSchema
7626	* @param correlationId
7627	* @returns
7628	*/
7629	async removeStaleAccounts(accountSchema, credentialSchema, correlationId) {
7630		const accountKeysToCheck = getAccountKeys(this.browserStorage, accountSchema);
7631		if (accountKeysToCheck.length === 0) return;
7632		for (const accountKey of [...accountKeysToCheck]) {
7633			this.performanceClient.incrementFields({ oldAcntCount: 1 }, correlationId);
7634			const rawValue = this.browserStorage.getItem(accountKey);
7635			const parsedValue = this.validateAndParseJson(rawValue || "");
7636			if (!parsedValue) {
7637				this.browserStorage.removeItem(accountKey);
7638				this.performanceClient.incrementFields({ invalidAcntCount: 1 }, correlationId);
7639				removeElementFromArray(accountKeysToCheck, accountKey);
7640				continue;
7641			}
7642			if (!parsedValue.lastUpdatedAt) {
7643				parsedValue.lastUpdatedAt = Date.now().toString();
7644				this.setItem(accountKey, JSON.stringify(parsedValue), correlationId);
7645				continue;
7646			} else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
7647				await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
7648				this.performanceClient.incrementFields({ ttlExpiredAcntCount: 1 }, correlationId);
7649				removeElementFromArray(accountKeysToCheck, accountKey);
7650			} else if (isEncrypted(parsedValue)) {
7651				if (!await this.browserStorage.decryptData(accountKey, parsedValue, correlationId)) {
7652					this.browserStorage.removeItem(accountKey);
7653					this.performanceClient.incrementFields({ decryptFailedAcntCount: 1 }, correlationId);
7654					removeElementFromArray(accountKeysToCheck, accountKey);
7655				}
7656			}
7657		}
7658		this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
7659	}
7660	/**
7661	* Remove the given account and all associated tokens from the cache
7662	* @param accountKey
7663	* @param rawObject
7664	* @param credentialSchema
7665	* @param correlationId
7666	*/
7667	async removeAccountOldSchema(accountKey, rawObject, credentialSchema, correlationId) {
7668		const homeAccountId = (isEncrypted(rawObject) ? await this.browserStorage.decryptData(accountKey, rawObject, correlationId) : rawObject)?.homeAccountId;
7669		if (homeAccountId) {
7670			const tokenKeys = this.getTokenKeys(credentialSchema);
7671			[...tokenKeys.idToken].filter((key) =>

7671 key.includes(homeAccountId)).forEach((key) => {
7672				this.browserStorage.removeItem(key);
7673				removeElementFromArray(tokenKeys.idToken, key);
7674			});
7675			[...tokenKeys.accessToken].filter((key) => key.includes(homeAccountId)).forEach((key) => {
7676				this.browserStorage.removeItem(key);
7677				removeElementFromArray(tokenKeys.accessToken, key);
7678			});
7679			[...tokenKeys.refreshToken].filter((key) => key.includes(homeAccountId)).forEach((key) => {
7680				this.browserStorage.removeItem(key);
7681				removeElementFromArray(tokenKeys.refreshToken, key);
7682			});
7683			this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
7684		}
7685		this.browserStorage.removeItem(accountKey);
7686	}
7687	/**
7688	* Gets key value pair mapping homeAccountId to KMSI value
7689	* @returns
7690	*/
7691	getKMSIValues() {
7692		const kmsiMap = {};
7693		const tokenKeys = this.getTokenKeys().idToken;
7694		for (const key of tokenKeys) {
7695			const rawValue = this.browserStorage.getUserData(key);
7696			if (rawValue) {
7697				const idToken = JSON.parse(rawValue);
7698				const claims = extractTokenClaims(idToken.secret, base64Decode);
7699				if (claims) kmsiMap[idToken.homeAccountId] = isKmsi(claims);
7700			}
7701		}
7702		return kmsiMap;
7703	}
7704	/**
7705	* Migrates id tokens from the old schema to the new schema, also migrates associated account object if it doesn't already exist in the new schema
7706	* @param credentialSchema
7707	* @param accountSchema
7708	* @param correlationId
7709	* @returns
7710	*/
7711	async migrateIdTokens(credentialSchema, accountSchema, correlationId) {
7712		const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
7713		if (credentialKeysToMigrate.idToken.length === 0) return;
7714		const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, 3);
7715		const currentAccountKeys = getAccountKeys(this.browserStorage);
7716		const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
7717		for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
7718			this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
7719			const result = await this.updateOldEntry(idTokenKey, correlationId);
7720			const oldSchemaData = result.entry;
7721			if (!oldSchemaData) {
7722				switch (result.removalReason) {
7723					case MigrationRemovalReason.TtlExpired:
7724						this.performanceClient.incrementFields({ ttlExpiredITCount: 1 }, correlationId);
7725						break;
7726					case MigrationRemovalReason.DecryptFailed:
7727						this.performanceClient.incrementFields({ decryptFailedITCount: 1 }, correlationId);
7728						break;
7729					case MigrationRemovalReason.Invalid:
7730						this.performanceClient.incrementFields({ invalidITCount: 1 }, correlationId);
7731						break;
7732				}
7733				removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
7734				continue;
7735			}
7736			const currentAccountKey = currentAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
7737			const previousAccountKey = previousAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
7738			let account = null;
7739			if (currentAccountKey) account = this.getAccount(currentAccountKey, correlationId);
7740			else if (previousAccountKey) {
7741				const rawValue = this.browserStorage.getItem(previousAccountKey);
7742				const parsedValue = this.validateAndParseJson(rawValue || "");
7743				account = parsedValue && isEncrypted(parsedValue) ? await this.browserStorage.decryptData(previousAccountKey, parsedValue, correlationId) : parsedValue;
7744			}
7745			if (!account) {
7746				this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
7747				continue;
7748			}
7749			const claims = extractTokenClaims(oldSchemaData.secret, base64Decode);
7750			const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
7751			const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
7752			const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
7753			const currentTokenHasSignInState = currentIdToken && Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
7754			/**
7755			* Only migrate if:
7756			* 1. Token doesn't yet exist in current schema
7757			* 2. Old schema token has been updated more recently than the current one AND migrating it won't result in loss of KMSI state
7758			*/
7759			if (!currentIdToken || oldSchemaData.lastUpdatedAt > currentIdToken.lastUpdatedAt && (oldTokenHasSignInState || !currentTokenHasSignInState)) {
7760				const tenantProfiles = account.tenantProfiles || [];
7761				const tenantId = getTenantIdFromIdTokenClaims(claims) || account.realm;
7762				if (tenantId && !tenantProfiles.find((tenantProfile) => {
7763					return tenantProfile.tenantId === tenantId;
7764				})) {
7765					const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
7766					tenantProfiles.push(newTenantProfile);
7767				}
7768				account.tenantProfiles = tenantProfiles;
7769				const newAccountKey = this.generateAccountKey(getAccountInfo(account));

7770				const kmsi = isKmsi(claims);
7771				await this.setUserData(newAccountKey, JSON.stringify(account), correlationId, account.lastUpdatedAt, kmsi);
7772				if (!currentAccountKeys.includes(newAccountKey)) currentAccountKeys.push(newAccountKey);
7773				await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
7774				this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
7775				if (!currentCredentialKeys.idToken.includes(newIdTokenKey)) currentCredentialKeys.idToken.push(newIdTokenKey);
7776			}
7777		}
7778		this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
7779		this.setTokenKeys(currentCredentialKeys, correlationId);
7780		this.setAccountKeys(currentAccountKeys, correlationId);
7781	}
7782	/**
7783	* Migrates access tokens from old cache schema to current schema
7784	* @param credentialSchema
7785	* @param kmsiMap
7786	* @param correlationId
7787	* @returns
7788	*/
7789	async migrateAccessTokens(credentialSchema, kmsiMap, correlationId) {
7790		const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
7791		if (credentialKeysToMigrate.accessToken.length === 0) return;
7792		const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, 3);
7793		for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
7794			this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
7795			const result = await this.updateOldEntry(accessTokenKey, correlationId);
7796			const oldSchemaData = result.entry;
7797			if (!oldSchemaData) {
7798				switch (result.removalReason) {
7799					case MigrationRemovalReason.TtlExpired:
7800						this.performanceClient.incrementFields({ ttlExpiredATCount: 1 }, correlationId);
7801						break;
7802					case MigrationRemovalReason.DecryptFailed:
7803						this.performanceClient.incrementFields({ decryptFailedATCount: 1 }, correlationId);
7804						break;
7805					case MigrationRemovalReason.Expired:
7806						this.performanceClient.incrementFields({ expiredATCount: 1 }, correlationId);
7807						break;
7808					case MigrationRemovalReason.Invalid:
7809						this.performanceClient.incrementFields({ invalidATCount: 1 }, correlationId);
7810						break;
7811				}
7812				removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
7813				continue;
7814			}
7815			if (!(oldSchemaData.homeAccountId in kmsiMap)) {
7816				this.performanceClient.incrementFields({ skipATMigrateCount: 1 }, correlationId);
7817				continue;
7818			}
7819			const newKey = this.generateCredentialKey(oldSchemaData);
7820			const kmsi = kmsiMap[oldSchemaData.homeAccountId];
7821			if (!currentCredentialKeys.accessToken.includes(newKey)) {
7822				await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
7823				this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
7824				currentCredentialKeys.accessToken.push(newKey);
7825			} else {
7826				const currentToken = this.getAccessTokenCredential(newKey, correlationId);
7827				if (!currentToken || oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
7828					await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
7829					this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
7830				}
7831			}
7832		}
7833		this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
7834		this.setTokenKeys(currentCredentialKeys, correlationId);
7835	}
7836	/**
7837	* Migrates refresh tokens from old cache schema to current schema
7838	* @param credentialSchema
7839	* @param kmsiMap
7840	* @param correlationId
7841	* @returns
7842	*/
7843	async migrateRefreshTokens(credentialSchema, kmsiMap, correlationId) {
7844		const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
7845		if (credentialKeysToMigrate.refreshToken.length === 0) return;
7846		const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, 3);
7847		for (const refreshTokenKey of [...credentialKeysToMigrate.refreshToken]) {
7848			this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
7849			const result = await this.updateOldEntry(refreshTokenKey, correlationId);
7850			const oldSchemaData = result.entry;
7851			if (!oldSchemaData) {
7852				switch (result.removalReason) {
7853					case MigrationRemovalReason.TtlExpired:
7854						this.performanceClient.incrementFields({ ttlExpiredRTCount: 1 }, correlationId);
7855						break;
7856					case MigrationRemovalReason.DecryptFailed:
7857						this.performanceClient.incrementFields({ decryptFailedRTCount: 1 }, correlationId);
7858						break;
7859					case MigrationRemovalReason.Expired:
7860						this.performanceClient.incrementFields({ expiredRTCount: 1 }, correlationId);
7861						break;
7862					case MigrationRemovalReason.Invalid:
7863						this.performanceClient.incrementFields({ invalidRTCount: 1 }, correlationId);
7864						break;
7865				}
7866				removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
7867				continue;
7868			}
7869			if (!(oldSchemaData.homeAccountId in kmsiMap)) {
7870				this.performanceClient.incrementFields({ skipRTMigrateCount: 1 }, correlationId);
7871				continue;
7872			}
7873			const newKey = this.generateCredentialKey(oldSchemaData);

7874			const kmsi = kmsiMap[oldSchemaData.homeAccountId];
7875			if (!currentCredentialKeys.refreshToken.includes(newKey)) {
7876				await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
7877				this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
7878				currentCredentialKeys.refreshToken.push(newKey);
7879			} else {
7880				const currentToken = this.getRefreshTokenCredential(newKey, correlationId);
7881				if (!currentToken || oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
7882					await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
7883					this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
7884				}
7885			}
7886		}
7887		this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
7888		this.setTokenKeys(currentCredentialKeys, correlationId);
7889	}
7890	/**
7891	* Tracks upgrades and downgrades for telemetry and debugging purposes
7892	*/
7893	trackVersionChanges(correlationId) {
7894		const previousVersion = this.browserStorage.getItem(VERSION_CACHE_KEY);
7895		if (previousVersion) {
7896			this.logger.info("1wuc87", correlationId);
7897			this.performanceClient.addFields({ previousLibraryVersion: previousVersion }, correlationId);
7898		}
7899		if (previousVersion !== "5.13.0") this.setItem(VERSION_CACHE_KEY, version, correlationId);
7900	}
7901	/**
7902	* Parses passed value as JSON object, JSON.parse() will throw an error.
7903	* @param input
7904	*/
7905	validateAndParseJson(jsonValue) {
7906		if (!jsonValue) return null;
7907		try {
7908			const parsedJson = JSON.parse(jsonValue);
7909			/**
7910			* There are edge cases in which JSON.parse will successfully parse a non-valid JSON object
7911			* (e.g. JSON.parse will parse an escaped string into an unescaped string), so adding a type check
7912			* of the parsed value is necessary in order to be certain that the string represents a valid JSON object.
7913			*
7914			*/
7915			return parsedJson && typeof parsedJson === "object" ? parsedJson : null;
7916		} catch (error) {
7917			return null;
7918		}
7919	}
7920	/**
7921	* Helper to setItem in browser storage, with cleanup in case of quota errors
7922	* @param key
7923	* @param value
7924	*/
7925	setItem(key, value, correlationId) {
7926		const tokenKeysCount = new Array(4).fill(0);
7927		const accessTokenKeys = [];
7928		const maxRetries = 20;
7929		for (let i = 0; i <= maxRetries; i++) try {
7930			this.browserStorage.setItem(key, value);
7931			if (i > 0) for (let schemaVersion = 0; schemaVersion <= 3; schemaVersion++) {
7932				const startIndex = tokenKeysCount.slice(0, schemaVersion).reduce((sum, count) => sum + count, 0);
7933				if (startIndex >= i) break;
7934				const endIndex = i > startIndex + tokenKeysCount[schemaVersion] ? startIndex + tokenKeysCount[schemaVersion] : i;
7935				if (i > startIndex && tokenKeysCount[schemaVersion] > 0) this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
7936			}
7937			break;
7938		} catch (e) {
7939			const cacheError = createCacheError(e);
7940			if (cacheError.errorCode === "cache_quota_exceeded" && i < maxRetries) {
7941				if (!accessTokenKeys.length) for (let i = 0; i <= 3; i++) if (key === getTokenKeysCacheKey(this.clientId, i)) {
7942					const tokenKeys = JSON.parse(value).accessToken;
7943					accessTokenKeys.push(...tokenKeys);
7944					tokenKeysCount[i] = tokenKeys.length;
7945				} else {
7946					const tokenKeys = this.getTokenKeys(i).accessToken;
7947					accessTokenKeys.push(...tokenKeys);
7948					tokenKeysCount[i] = tokenKeys.length;
7949				}
7950				if (accessTokenKeys.length <= i) throw cacheError;
7951				this.removeAccessToken(accessTokenKeys[i], correlationId, false);
7952			} else throw cacheError;
7953		}
7954	}
7955	/**
7956	* Helper to setUserData in browser storage, with cleanup in case of quota errors
7957	* @param key
7958	* @param value
7959	* @param correlationId
7960	*/
7961	async setUserData(key, value, correlationId, timestamp, kmsi) {
7962		const tokenKeysCount = new Array(4).fill(0);
7963		const accessTokenKeys = [];
7964		const maxRetries = 20;
7965		for (let i = 0; i <= maxRetries; i++) try {
7966			await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), SetUserData, this.logger, this.performanceClient, correlationId)(key, value, correlationId, timestamp, kmsi);
7967			if (i > 0) for (let schemaVersion = 0; schemaVersion <= 3; schemaVersion++) {
7968				const startIndex = tokenKeysCount.slice(0, schemaVersion).reduce((sum, count) => sum + count, 0);
7969				if (startIndex >= i) break;
7970				const endIndex = i > startIndex + tokenKeysCount[schemaVersion] ? startIndex + tokenKeysCount[schemaVersion] : i;
7971				if (i > startIndex && tokenKeysCount[schemaVersion] > 0) this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
7972			}
7973			break;
7974		} catch (e) {
7975			const cacheError = createCacheError(e);
7976			if (cacheError.errorCode === "cache_quota_exceeded" && i < maxRetries) {
7977				if (!accessTokenKeys.length) for (let i = 0; i <= 3; i++) {
7978					const tokenKeys = this.getTokenKeys(i).accessToken;
7979					accessTokenKeys.push(...tokenKeys);
7980					tokenKeysCount[i] = tokenKeys.length;
7981				}
7982				if (accessTokenKeys.length <= i) throw cacheError;
7983				this.removeAccessToken(accessTokenKeys[i], correlationId, false);
7984			} else throw cacheError;
7985		}
7986	}
7987	/**
7988	* Reads account from cache, deserializes it into an account entity and returns it.
7989	* If account is not found from the key, returns null and removes key from map.
7990	* @param accountKey
7991	* @returns
7992	*/
7993	getAccount(accountKey, correlationId) {
7994		this.logger.trace("1lfvm6", correlationId);
7995		const serializedAccount = this.browserStorage.getUserData(accountKey);
7996		if (!serializedAccount) {
7997			this.removeAccountKeyFromMap(accountKey, correlationId);
7998			return null;
7999		}
8000		const parsedAccount = this.validateAndParseJson(serializedAccount);
8001		if (!parsedAccount || !isAccountEntity(parsedAccount)) return null;
8002		const account = CacheManager.toObject({}, parsedAccount);
8003		this.performanceClient.addFields({ accountCachedBy: apiIdToName(account.cachedByApiId) }, correlationId);
8004		return account;
8005	}

8006	/**
8007	* set account entity in the platform cache
8008	* @param account
8009	*/
8010	async setAccount(account, correlationId, kmsi, apiId) {
8011		this.logger.trace("1bz3wr", correlationId);
8012		const key = this.generateAccountKey(getAccountInfo(account));
8013		const timestamp = Date.now().toString();
8014		account.lastUpdatedAt = timestamp;
8015		account.cachedByApiId = apiId;
8016		await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
8017		this.addAccountKeyToMap(key, correlationId);
8018		this.performanceClient.addFields({ kmsi }, correlationId);
8019	}
8020	setAccountKeys(accountKeys, correlationId, schemaVersion = 3) {
8021		if (accountKeys.length === 0) this.removeItem(getAccountKeysCacheKey(schemaVersion));
8022		else this.setItem(getAccountKeysCacheKey(schemaVersion), JSON.stringify(accountKeys), correlationId);
8023	}
8024	/**
8025	* Returns the array of account keys currently cached
8026	* @returns
8027	*/
8028	getAccountKeys() {
8029		return getAccountKeys(this.browserStorage);
8030	}
8031	/**
8032	* Add a new account to the key map
8033	* @param key
8034	*/
8035	addAccountKeyToMap(key, correlationId) {
8036		this.logger.trace("0rb85k", correlationId);
8037		this.logger.tracePii("1l9bdo", correlationId);
8038		const accountKeys = this.getAccountKeys();
8039		if (accountKeys.indexOf(key) === -1) {
8040			accountKeys.push(key);
8041			this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
8042			this.logger.verbose("0xia39", correlationId);
8043			return true;
8044		} else {
8045			this.logger.verbose("0161kk", correlationId);
8046			return false;
8047		}
8048	}
8049	/**
8050	* Remove an account from the key map
8051	* @param key
8052	*/
8053	removeAccountKeyFromMap(key, correlationId) {
8054		this.logger.trace("1jpigu", correlationId);
8055		this.logger.tracePii("1xzspl", correlationId);
8056		const accountKeys = this.getAccountKeys();
8057		const removalIndex = accountKeys.indexOf(key);
8058		if (removalIndex > -1) {
8059			accountKeys.splice(removalIndex, 1);
8060			this.setAccountKeys(accountKeys, correlationId);
8061		} else this.logger.trace("1dytu2", correlationId);
8062	}
8063	/**
8064	* Extends inherited removeAccount function to include removal of the account key from the map
8065	* @param key
8066	*/
8067	removeAccount(account, correlationId) {
8068		const activeAccount = this.getActiveAccount(correlationId);
8069		if (activeAccount?.homeAccountId === account.homeAccountId && activeAccount?.environment === account.environment) this.setActiveAccount(null, correlationId);
8070		super.removeAccount(account, correlationId);
8071		this.removeAccountKeyFromMap(this.generateAccountKey(account), correlationId);
8072		this.browserStorage.getKeys().forEach((key) => {
8073			if (key.includes(account.homeAccountId) && key.includes(account.environment)) this.browserStorage.removeItem(key);
8074		});
8075	}
8076	/**
8077	* Removes given idToken from the cache and from the key map
8078	* @param key
8079	*/
8080	removeIdToken(key, correlationId) {
8081		super.removeIdToken(key, correlationId);
8082		const tokenKeys = this.getTokenKeys();
8083		const idRemoval = tokenKeys.idToken.indexOf(key);
8084		if (idRemoval > -1) {
8085			this.logger.info("05udv9", correlationId);
8086			tokenKeys.idToken.splice(idRemoval, 1);
8087			this.setTokenKeys(tokenKeys, correlationId);
8088		}
8089	}
8090	/**
8091	* Removes given accessToken from the cache and from the key map
8092	* @param key
8093	*/
8094	removeAccessToken(key, correlationId, updateTokenKeys = true) {
8095		super.removeAccessToken(key, correlationId);
8096		updateTokenKeys && this.removeAccessTokenKeys([key], correlationId);
8097	}
8098	/**
8099	* Remove access token key from the key map
8100	* @param key
8101	* @param correlationId
8102	* @param tokenKeys
8103	*/
8104	removeAccessTokenKeys(keys, correlationId, schemaVersion = 3) {
8105		this.logger.trace("17o18n", correlationId);
8106		const tokenKeys = this.getTokenKeys(schemaVersion);
8107		let keysRemoved = 0;
8108		keys.forEach((key) => {
8109			const accessRemoval = tokenKeys.accessToken.indexOf(key);
8110			if (accessRemoval > -1) {
8111				tokenKeys.accessToken.splice(accessRemoval, 1);
8112				keysRemoved++;
8113			}
8114		});
8115		if (keysRemoved > 0) {
8116			this.logger.info("15i5d5", correlationId);
8117			this.setTokenKeys(tokenKeys, correlationId, schemaVersion);
8118			return;
8119		}
8120	}
8121	/**
8122	* Removes given refreshToken from the cache and from the key map
8123	* @param key
8124	*/
8125	removeRefreshToken(key, correlationId) {
8126		super.removeRefreshToken(key, correlationId);
8127		const tokenKeys = this.getTokenKeys();
8128		const refreshRemoval = tokenKeys.refreshToken.indexOf(key);
8129		if (refreshRemoval > -1) {
8130			this.logger.info("1f4fq3", correlationId);
8131			tokenKeys.refreshToken.splice(refreshRemoval, 1);
8132			this.setTokenKeys(tokenKeys, correlationId);
8133		}
8134	}
8135	/**
8136	* Gets the keys for the cached tokens associated with this clientId
8137	* @returns
8138	*/
8139	getTokenKeys(schemaVersion = 3) {
8140		return getTokenKeys(this.clientId, this.browserStorage, schemaVersion);
8141	}
8142	/**
8143	* Sets the token keys in the cache
8144	* @param tokenKeys
8145	* @param correlationId
8146	* @returns
8147	*/
8148	setTokenKeys(tokenKeys, correlationId, schemaVersion = 3) {
8149		if (tokenKeys.idToken.length === 0 && tokenKeys.accessToken.length === 0 && tokenKeys.refreshToken.length === 0) {
8150			this.removeItem(getTokenKeysCacheKey(this.clientId, schemaVersion));
8151			return;
8152		} else this.setItem(getTokenKeysCacheKey(this.clientId, schemaVersion), JSON.stringify(tokenKeys), correlationId);
8153	}
8154	/**
8155	* generates idToken entity from a string
8156	* @param idTokenKey
8157	*/
8158	getIdTokenCredential(idTokenKey, correlationId) {
8159		const value = this.browserStorage.getUserData(idTokenKey);
8160		if (!value) {
8161			this.logger.trace("1jukz6", correlationId);
8162			this.removeIdToken(idTokenKey, correlationId);
8163			return null;
8164		}
8165		const parsedIdToken = this.validateAndParseJson(value);
8166		if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
8167			this.logger.trace("1jukz6", correlationId);
8168			return null;
8169		}
8170		this.logger.trace("01ju66", correlationId);
8171		return parsedIdToken;
8172	}
8173	/**
8174	* set IdToken credential to the platform cache
8175	* @param idToken
8176	*/
8177	async setIdTokenCredential(idToken, correlationId, kmsi) {
8178		this.logger.trace("13hjll", correlationId);
8179		const idTokenKey = this.generateCredentialKey(idToken);
8180		const timestamp = Date.now().toString();
8181		idToken.lastUpdatedAt = timestamp;
8182		await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp, kmsi);
8183		const tokenKeys = this.getTokenKeys();
8184		if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
8185			this.logger.info("07jy92", correlationId);
8186			tokenKeys.idToken.push(idTokenKey);
8187			this.setTokenKeys(tokenKeys, correlationId);
8188		}
8189	}
8190	/**
8191	* generates accessToken entity from a string
8192	* @param key
8193	*/
8194	getAccessTokenCredential(accessTokenKey, correlationId) {
8195		const value = this.browserStorage.getUserData(accessTokenKey);
8196		if (!value) {
8197			this.logger.trace("0bqvx8", correlationId);
8198			this.removeAccessTokenKeys([accessTokenKey], correlationId);
8199			return null;
8200		}
8201		const parsedAccessToken = this.validateAndParseJson(value);
8202		if (!parsedAccessToken || !isAccessTokenEntity(parsedAccessToken)) {
8203			this.logger.trace("0bqvx8", correlationId);
8204			return null;
8205		}
8206		this.logger.trace("1o81rl", correlationId);
8207		return parsedAccessToken;
8208	}
8209	/**
8210	* set accessToken credential to the platform cache
8211	* @param accessToken
8212	*/
8213	async setAccessTokenCredential(accessToken, correlationId, kmsi) {
8214		this.logger.trace("1pondb", correlationId);
8215		const accessTokenKey = this.generateCredentialKey(accessToken);
8216		const timestamp = Date.now().toString();
8217		accessToken.lastUpdatedAt = timestamp;
8218		await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
8219		const tokenKeys = this.getTokenKeys();
8220		const index = tokenKeys.accessToken.indexOf(accessTokenKey);
8221		if (index !== -1) tokenKeys.accessToken.splice(index, 1);
8222		this.logger.trace("1onhey", correlationId);
8223		tokenKeys.accessToken.push(accessTokenKey);
8224		this.setTokenKeys(tokenKeys, correlationId);
8225	}
8226	/**
8227	* generates refreshToken entity from a string
8228	* @param refreshTokenKey
8229	*/
8230	getRefreshTokenCredential(refreshTokenKey, correlationId) {
8231		const value = this.browserStorage.getUserData(refreshTokenKey);
8232		if (!value) {
8233			this.logger.trace("0jlizt", correlationId);
8234			this.removeRefreshToken(refreshTokenKey, correlationId);
8235			return null;
8236		}
8237		const parsedRefreshToken = this.validateAndParseJson(value);
8238		if (!parsedRefreshToken || !isRefreshTokenEntity(parsedRefreshToken)) {
8239			this.logger.trace("0jlizt", correlationId);
8240			return null;
8241		}
8242		this.logger.trace("0nokxi", correlationId);
8243		return parsedRefreshToken;
8244	}
8245	/**
8246	* set refreshToken credential to the platform cache
8247	* @param refreshToken
8248	*/
8249	async setRefreshTokenCredential(refreshToken, correlationId, kmsi) {
8250		this.logger.trace("0tcg8d", correlationId);
8251		const refreshTokenKey = this.generateCredentialKey(refreshToken);
8252		const timestamp = Date.now().toString();
8253		refreshToken.lastUpdatedAt = timestamp;
8254		await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp, kmsi);
8255		const tokenKeys = this.getTokenKeys();
8256		if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
8257			this.logger.info("0eckjs", correlationId);
8258			tokenKeys.refreshToken.push(refreshTokenKey);
8259			this.setTokenKeys(tokenKeys, correlationId);
8260		}
8261	}
8262	/**
8263	* fetch appMetadata entity from the platform cache
8264	* @param appMetadataKey
8265	* @param correlationId
8266	*/
8267	getAppMetadata(appMetadataKey, correlationId) {
8268		const value = this.browserStorage.getItem(appMetadataKey);
8269		if (!value) {
8270			this.logger.trace("1q101h", correlationId);
8271			return null;
8272		}
8273		const parsedMetadata = this.validateAndParseJson(value);
8274		if (!parsedMetadata || !isAppMetadataEntity(appMetadataKey, parsedMetadata)) {
8275			this.logger.trace("1q101h", correlationId);
8276			return null;
8277		}
8278		this.logger.trace("19pvg2", correlationId);
8279		return parsedMetadata;
8280	}
8281	/**
8282	* set appMetadata entity to the platform cache
8283	* @param appMetadata
8284	* @param correlationId
8285	*/
8286	setAppMetadata(appMetadata, correlationId) {
8287		this.logger.trace("0cyma6", correlationId);
8288		const appMetadataKey = generateAppMetadataKey(appMetadata);
8289		this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
8290	}
8291	/**
8292	* fetch server telemetry entity from the platform cache
8293	* @param serverTelemetryKey
8294	* @param correlationId
8295	*/
8296	getServerTelemetry(serverTelemetryKey, correlationId) {
8297		const value = this.browserStorage.getItem(serverTelemetryKey);
8298		if (!value) {
8299			this.logger.trace("0jk19c", correlationId);
8300			return null;
8301		}
8302		const parsedEntity = this.validateAndParseJson(value);
8303		if (!parsedEntity || !isServerTelemetryEntity(serverTelemetryKey, parsedEntity)) {
8304			this.logger.trace("0jk19c", correlationId);
8305			return null;
8306		}
8307		this.logger.trace("12jguk", correlationId);
8308		return parsedEntity;
8309	}
8310	/**
8311	* set server telemetry entity to the platform cache
8312	* @param serverTelemetryKey
8313	* @param serverTelemetry
8314	*/
8315	setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
8316		this.logger.trace("1poh61", correlationId);
8317		this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
8318	}
8319	/**
8320	*
8321	*/
8322	getAuthorityMetadata(key, correlationId) {
8323		const value = this.internalStorage.getItem(key);
8324		if (!value) {
8325			this.logger.trace("1r39oe", correlationId);
8326			return null;
8327		}
8328		const parsedMetadata = this.validateAndParseJson(value);
8329		if (parsedMetadata && isAuthorityMetadataEntity(key, parsedMetadata)) {
8330			this.logger.trace("1ohvk3", correlationId);
8331			return parsedMetadata;
8332		}
8333		return null;
8334	}

8335	/**
8336	*
8337	*/
8338	getAuthorityMetadataKeys() {
8339		return this.internalStorage.getKeys().filter((key) => {
8340			return this.isAuthorityMetadata(key);
8341		});
8342	}
8343	/**
8344	* Sets wrapper metadata in memory
8345	* @param wrapperSKU
8346	* @param wrapperVersion
8347	*/
8348	setWrapperMetadata(wrapperSKU, wrapperVersion) {
8349		this.internalStorage.setItem(InMemoryCacheKeys.WRAPPER_SKU, wrapperSKU);
8350		this.internalStorage.setItem(InMemoryCacheKeys.WRAPPER_VER, wrapperVersion);
8351	}
8352	/**
8353	* Returns wrapper metadata from in-memory storage
8354	*/
8355	getWrapperMetadata() {
8356		return [this.internalStorage.getItem(InMemoryCacheKeys.WRAPPER_SKU) || "", this.internalStorage.getItem(InMemoryCacheKeys.WRAPPER_VER) || ""];
8357	}
8358	/**
8359	*
8360	* @param key
8361	* @param entity
8362	* @param correlationId
8363	*/
8364	setAuthorityMetadata(key, entity, correlationId) {
8365		this.logger.trace("07w8n2", correlationId);
8366		this.internalStorage.setItem(key, JSON.stringify(entity));
8367	}
8368	/**
8369	* Gets the active account
8370	*/
8371	getActiveAccount(correlationId) {
8372		const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
8373		const activeAccountValueFilters = this.browserStorage.getItem(activeAccountKeyFilters);
8374		if (!activeAccountValueFilters) {
8375			this.logger.trace("08gw0e", correlationId);
8376			return null;
8377		}
8378		const activeAccountValueObj = this.validateAndParseJson(activeAccountValueFilters);
8379		if (activeAccountValueObj) {
8380			this.logger.trace("1t3ch7", correlationId);
8381			return this.getAccountInfoFilteredBy({
8382				homeAccountId: activeAccountValueObj.homeAccountId,
8383				localAccountId: activeAccountValueObj.localAccountId,
8384				tenantId: activeAccountValueObj.tenantId
8385			}, correlationId);
8386		}
8387		this.logger.trace("0me1up", correlationId);
8388		return null;
8389	}
8390	/**
8391	* Sets the active account's localAccountId in cache
8392	* @param account
8393	*/
8394	setActiveAccount(account, correlationId) {
8395		const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
8396		if (account) {
8397			this.logger.verbose("0rsj80", correlationId);
8398			const activeAccountValue = {
8399				homeAccountId: account.homeAccountId,
8400				localAccountId: account.localAccountId,
8401				tenantId: account.tenantId
8402			};
8403			this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
8404		} else {
8405			this.logger.verbose("1bp5z5", correlationId);
8406			this.browserStorage.removeItem(activeAccountKey);
8407		}
8408		this.eventHandler.emitEvent(EventType.ACTIVE_ACCOUNT_CHANGED, correlationId);
8409	}
8410	/**
8411	* fetch throttling entity from the platform cache
8412	* @param throttlingCacheKey
8413	* @param correlationId
8414	*/
8415	getThrottlingCache(throttlingCacheKey, correlationId) {
8416		const value = this.browserStorage.getItem(throttlingCacheKey);
8417		if (!value) {
8418			this.logger.trace("1h4wa6", correlationId);
8419			return null;
8420		}
8421		const parsedThrottlingCache = this.validateAndParseJson(value);
8422		if (!parsedThrottlingCache || !isThrottlingEntity(throttlingCacheKey, parsedThrottlingCache)) {
8423			this.logger.trace("1h4wa6", correlationId);
8424			return null;
8425		}
8426		this.logger.trace("0of6n8", correlationId);
8427		return parsedThrottlingCache;
8428	}
8429	/**
8430	* set throttling entity to the platform cache
8431	* @param throttlingCacheKey
8432	* @param throttlingCache
8433	*/
8434	setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
8435		this.logger.trace("0wfgh6", correlationId);
8436		this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
8437	}
8438	/**
8439	* Gets cache item with given key.
8440	* @param cacheKey
8441	* @param correlationId
8442	* @param generateKey
8443	*/
8444	getTemporaryCache(cacheKey, correlationId, generateKey) {
8445		this.logger.trace("1ordf8", correlationId);
8446		const key = generateKey ? this.generateCacheKey(cacheKey) : cacheKey;
8447		return this.temporaryCacheStorage.getItem(key);
8448	}
8449	/**
8450	* Sets the cache item with the key and value given.
8451	* @param key
8452	* @param value
8453	*/
8454	setTemporaryCache(cacheKey, value, generateKey) {
8455		const key = generateKey ? this.generateCacheKey(cacheKey) : cacheKey;
8456		this.temporaryCacheStorage.setItem(key, value);
8457	}
8458	/**
8459	* Removes the cache item with the given key.
8460	* @param key
8461	*/
8462	removeItem(key) {
8463		this.browserStorage.removeItem(key);
8464	}
8465	/**
8466	* Removes the temporary cache item with the given key.
8467	* @param key
8468	*/
8469	removeTemporaryItem(key) {
8470		this.temporaryCacheStorage.removeItem(key);
8471	}
8472	/**
8473	* Gets all keys in window.
8474	*/
8475	getKeys() {
8476		return this.browserStorage.getKeys();
8477	}
8478	/**
8479	* Clears all cache entries created by MSAL.
8480	*/
8481	clear(correlationId) {
8482		this.removeAllAccounts(correlationId);
8483		this.removeAppMetadata(correlationId);

8484		this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
8485			if (cacheKey.indexOf("msal") !== -1 || cacheKey.indexOf(this.clientId) !== -1) this.removeTemporaryItem(cacheKey);
8486		});
8487		this.browserStorage.getKeys().forEach((cacheKey) => {
8488			if (cacheKey.indexOf("msal") !== -1 || cacheKey.indexOf(this.clientId) !== -1) this.browserStorage.removeItem(cacheKey);
8489		});
8490		this.internalStorage.clear();
8491	}
8492	/**
8493	* Prepend msal.<client-id> to each key
8494	* @param key
8495	* @param addInstanceId
8496	*/
8497	generateCacheKey(key) {
8498		if (StringUtils.startsWith(key, "msal")) return key;
8499		return `${PREFIX}.${this.clientId}.${key}`;
8500	}
8501	/**
8502	* Generate Credential Key. All changes to the key REQUIRE a schema version update.
8503	* Cache Key: msal.<schema_version>|<home_account_id>|<environment>|<credential_type>|<client_id or familyId>|<realm>|<scopes>|<scheme>
8504	* @param credentialEntity
8505	* @returns
8506	*/
8507	generateCredentialKey(credential) {
8508		const familyId = credential.credentialType === CredentialType.REFRESH_TOKEN && credential.familyId || credential.clientId;
8509		const scheme = credential.tokenType && credential.tokenType.toLowerCase() !== AuthenticationScheme.BEARER.toLowerCase() ? credential.tokenType.toLowerCase() : "";
8510		return [
8511			`${PREFIX}.3`,
8512			credential.homeAccountId,
8513			credential.environment,
8514			credential.credentialType,
8515			familyId,
8516			credential.realm || "",
8517			credential.target || "",
8518			scheme
8519		].join("|").toLowerCase();
8520	}
8521	/**

8522	* Cache Key: msal.<schema_version>.<home_account_id>.<environment>.<tenant_id>
8523	* @param account
8524	* @returns
8525	*/
8526	generateAccountKey(account) {
8527		const homeTenantId = account.homeAccountId.split(".")[1];
8528		return [
8529			`${PREFIX}.3`,
8530			account.homeAccountId,
8531			account.environment,
8532			homeTenantId || account.tenantId || ""
8533		].join("|").toLowerCase();
8534	}
8535	/**
8536	* Reset all temporary cache items
8537	* @param correlationId
8538	*/
8539	resetRequestCache(correlationId) {
8540		this.logger.trace("0h0ynu", correlationId);
8541		this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
8542		this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.VERIFIER));
8543		this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
8544		this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.URL_HASH));
8545		this.removeTemporaryItem(this.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
8546		this.setInteractionInProgress(false, void 0);
8547	}
8548	cacheAuthorizeRequest(authCodeRequest, correlationId, codeVerifier) {
8549		this.logger.trace("1tzef5", correlationId);
8550		const encodedValue = base64Encode(JSON.stringify(authCodeRequest));
8551		this.setTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, encodedValue, true);
8552		if (codeVerifier) {
8553			const encodedVerifier = base64Encode(codeVerifier);
8554			this.setTemporaryCache(TemporaryCacheKeys.VERIFIER, encodedVerifier, true);
8555		}
8556	}
8557	/**
8558	* Gets the token exchange parameters from the cache. Throws an error if nothing is found.
8559	* @param correlationId
8560	*/
8561	getCachedRequest(correlationId) {
8562		this.logger.trace("0uen20", correlationId);
8563		const encodedTokenRequest = this.getTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, correlationId, true);
8564		if (!encodedTokenRequest) throw createBrowserAuthError(noTokenRequestCacheError);
8565		const encodedVerifier = this.getTemporaryCache(TemporaryCacheKeys.VERIFIER, correlationId, true);
8566		let parsedRequest;
8567		let verifier = "";
8568		try {
8569			parsedRequest = JSON.parse(base64Decode(encodedTokenRequest));
8570			if (encodedVerifier) verifier = base64Decode(encodedVerifier);
8571		} catch (e) {
8572			this.logger.errorPii("0ewsey", correlationId);
8573			this.logger.error("0tvdic", correlationId);
8574			throw createBrowserAuthError(unableToParseTokenRequestCacheError);
8575		}
8576		return [parsedRequest, verifier];
8577	}
8578	/**
8579	* Gets cached native request for redirect flows
8580	* @param correlationId
8581	*/
8582	getCachedNativeRequest() {
8583		this.logger.trace("1yxcdm", "");
8584		const cachedRequest = this.getTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, "", true);
8585		if (!cachedRequest) {
8586			this.logger.trace("0mnxd4", "");
8587			return null;
8588		}
8589		const parsedRequest = this.validateAndParseJson(cachedRequest);
8590		if (!parsedRequest) {
8591			this.logger.error("0rrkip", "");
8592			return null;
8593		}
8594		return parsedRequest;
8595	}
8596	isInteractionInProgress(matchClientId) {
8597		const clientId = this.getInteractionInProgress()?.clientId;
8598		if (matchClientId) return clientId === this.clientId;
8599		else return !!clientId;
8600	}
8601	getInteractionInProgress() {
8602		const key = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
8603		const value = this.getTemporaryCache(key, "", false);
8604		try {
8605			return value ? JSON.parse(value) : null;
8606		} catch (e) {
8607			this.logger.error("0jjyys", "");
8608			this.removeTemporaryItem(key);
8609			this.resetRequestCache("");
8610			clearHash(window);
8611			return null;
8612		}
8613	}
8614	setInteractionInProgress(inProgress, type = INTERACTION_TYPE.SIGNIN, allowOverride = false, correlationId = "") {
8615		const key = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
8616		if (inProgress) {
8617			if (this.getInteractionInProgress()) if (allowOverride) {
8618				this.logger.warning("1pmscr", correlationId);
8619				cancelPendingBridgeResponse(this.logger, correlationId);
8620				this.removeTemporaryItem(key);
8621			} else throw createBrowserAuthError(interactionInProgress);
8622			this.setTemporaryCache(key, JSON.stringify({
8623				clientId: this.clientId,
8624				type
8625			}), false);
8626		} else if (!inProgress && this.getInteractionInProgress()?.clientId === this.clientId) this.removeTemporaryItem(key);
8627	}
8628	/**
8629	* Builds credential entities from AuthenticationResult object and saves the resulting credentials to the cache
8630	* @param result
8631	* @param request
8632	*/
8633	async hydrateCache(result, request) {
8634		const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.clientId, result.tenantId);
8635		/**
8636		* meta data for cache stores time in seconds from epoch
8637		* AuthenticationResult returns expiresOn and extExpiresOn in milliseconds (as a Date object which is in ms)
8638		* We need to map these for the cache when building tokens from AuthenticationResult
8639		*
8640		* The next MSAL VFuture should map these both to same value if possible
8641		*/
8642		const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? toSecondsFromDate(result.expiresOn) : 0, result.extExpiresOn ? toSecondsFromDate(result.extExpiresOn) : 0, base64Decode, void 0, result.tokenType, void 0, request.sshKid);
8643		if (request.resource) accessTokenEntity.resource = request.resource;
8644		const cacheRecord = {
8645			idToken: idTokenEntity,
8646			accessToken: accessTokenEntity
8647		};

8648		return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)), ApiId.hydrateCache);
8649	}
8650	/**
8651	* saves a cache record
8652	* @param cacheRecord {CacheRecord}
8653	* @param storeInCache {?StoreInCache}
8654	* @param correlationId {?string} correlation id
8655	*/
8656	async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
8657		try {
8658			await super.saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache);
8659		} catch (e) {
8660			if (e instanceof CacheError && this.performanceClient && correlationId) try {
8661				const tokenKeys = this.getTokenKeys();
8662				this.performanceClient.addFields({
8663					cacheRtCount: tokenKeys.refreshToken.length,
8664					cacheIdCount: tokenKeys.idToken.length,
8665					cacheAtCount: tokenKeys.accessToken.length
8666				}, correlationId);
8667			} catch (e) {}
8668			throw e;
8669		}
8670	}
8671};
8672/**
8673* Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured cacheLocation.
8674* @param cacheLocation
8675*/
8676function getStorageImplementation(clientId, cacheLocation, logger, performanceClient) {
8677	try {
8678		switch (cacheLocation) {
8679			case BrowserCacheLocation.LocalStorage: return new LocalStorage(clientId, logger, performanceClient);
8680			case BrowserCacheLocation.SessionStorage: return new SessionStorage();
8681			case BrowserCacheLocation.MemoryStorage:
8682			default: break;
8683		}
8684	} catch (e) {
8685		logger.error(e, "");
8686	}
8687	return new MemoryStorage();
8688}
8689var DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger, performanceClient, eventHandler) => {
8690	return new BrowserCacheManager(clientId, {
8691		cacheLocation: BrowserCacheLocation.MemoryStorage,
8692		cacheRetentionDays: 5
8693	}, DEFAULT_CRYPTO_IMPLEMENTATION, logger, performanceClient, eventHandler);
8694};
8695//#endregion
8696//#region node_modules/@azure/msal-browser/dist/cache/AccountManager.mjs
8697/*! @azure/msal-browser v5.13.0 2026-06-10 */
8698/**
8699* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
8700* @param accountFilter - (Optional) filter to narrow down the accounts returned
8701* @returns Array of AccountInfo objects in cache
8702*/
8703function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
8704	logger.verbose("1yd030", correlationId);
8705	return isInBrowser ? browserStorage.getAllAccounts(accountFilter, correlationId) : [];
8706}
8707/**
8708* Returns the first account found in the cache that matches the account filter passed in.
8709* @param accountFilter
8710* @returns The first account found in the cache matching the provided filter or null if no account could be found.
8711*/
8712function getAccount(accountFilter, logger, browserStorage, correlationId) {
8713	logger.trace("0u7b90", correlationId);
8714	const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
8715	if (account) {
8716		logger.verbose("0btgll", correlationId);
8717		return account;
8718	} else {
8719		logger.verbose("0ltaj5", correlationId);
8720		return null;
8721	}
8722}
8723/**
8724* Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
8725* @param account
8726*/
8727function setActiveAccount(account, browserStorage, correlationId) {
8728	browserStorage.setActiveAccount(account, correlationId);
8729}
8730/**
8731* Gets the currently active account
8732*/
8733function getActiveAccount(browserStorage, correlationId) {
8734	return browserStorage.getActiveAccount(correlationId);
8735}
8736//#endregion
8737//#region node_modules/@azure/msal-browser/dist/event/EventHandler.mjs
8738/*! @azure/msal-browser v5.13.0 2026-06-10 */
8739var BROADCAST_CHANNEL_NAME = "msal.broadcast.event";
8740var EventHandler = class {
8741	constructor(logger) {
8742		this.eventCallbacks = /* @__PURE__ */ new Map();
8743		this.logger = logger || new Logger({});
8744		if (typeof BroadcastChannel !== "undefined") this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
8745		this.invokeCrossTabCallbacks = this.invokeCrossTabCallbacks.bind(this);
8746	}
8747	/**
8748	* Adds event callbacks to array
8749	* @param callback - callback to be invoked when an event is raised
8750	* @param eventTypes - list of events that this callback will be invoked for, if not provided callback will be invoked for all events
8751	* @param callbackId - Identifier for the callback, used to locate and remove the callback when no longer required
8752	*/
8753	addEventCallback(callback, eventTypes, callbackId) {
8754		if (typeof window !== "undefined") {
8755			const id = callbackId || createGuid();
8756			if (this.eventCallbacks.has(id)) {
8757				this.logger.error("1578i0", "");
8758				return null;
8759			}
8760			this.eventCallbacks.set(id, [callback, eventTypes || []]);
8761			this.logger.verbose("1cnec4", "");
8762			return id;
8763		}
8764		return null;
8765	}

8766	/**
8767	* Removes callback with provided id from callback array
8768	* @param callbackId
8769	*/
8770	removeEventCallback(callbackId) {
8771		this.eventCallbacks.delete(callbackId);
8772		this.logger.verbose("12zotd", "");
8773	}
8774	/**
8775	* Emits events by calling callback with event message
8776	* @param eventType
8777	* @param interactionType
8778	* @param payload
8779	* @param error
8780	*/
8781	emitEvent(eventType, correlationId, interactionType, payload, error) {
8782		const message = {
8783			eventType,
8784			interactionType: interactionType || null,
8785			payload: payload || null,
8786			error: error || null,
8787			correlationId,
8788			timestamp: Date.now()
8789		};
8790		switch (eventType) {
8791			case EventType.LOGIN_SUCCESS:
8792			case EventType.LOGOUT_SUCCESS:
8793			case EventType.ACTIVE_ACCOUNT_CHANGED: this.broadcastChannel?.postMessage(message);
8794		}
8795		this.invokeCallbacks(message);
8796	}
8797	/**
8798	* Invoke registered callbacks
8799	* @param message
8800	*/
8801	invokeCallbacks(message) {
8802		this.eventCallbacks.forEach(([callback, eventTypes], callbackId) => {
8803			if (eventTypes.length === 0 || eventTypes.includes(message.eventType)) {
8804				this.logger.verbose("15jpwk", "");
8805				callback.apply(null, [message]);
8806			}
8807		});
8808	}
8809	/**
8810	* Wrapper around invokeCallbacks to handle broadcast events received from other tabs/instances
8811	* @param event
8812	*/
8813	invokeCrossTabCallbacks(event) {
8814		const message = event.data;
8815		this.invokeCallbacks(message);
8816	}
8817	/**
8818	* Listen for events broadcasted from other tabs/instances
8819	*/
8820	subscribeCrossTab() {
8821		this.broadcastChannel?.addEventListener("message", this.invokeCrossTabCallbacks);
8822	}
8823	/**
8824	* Unsubscribe from broadcast events
8825	*/
8826	unsubscribeCrossTab() {
8827		this.broadcastChannel?.removeEventListener("message", this.invokeCrossTabCallbacks);
8828	}
8829};
8830//#endregion
8831//#region node_modules/@azure/msal-browser/dist/interaction_client/BaseInteractionClient.mjs
8832/*! @azure/msal-browser v5.13.0 2026-06-10 */
8833var BaseInteractionClient = class {
8834	constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider) {
8835		this.config = config;
8836		this.browserStorage = storageImpl;
8837		this.browserCrypto = browserCrypto;
8838		this.networkClient = this.config.system.networkClient;
8839		this.eventHandler = eventHandler;
8840		this.navigationClient = navigationClient;
8841		this.platformAuthProvider = platformAuthProvider;
8842		this.correlationId = correlationId;
8843		this.logger = logger.clone(BrowserConstants.MSAL_SKU, version);
8844		this.performanceClient = performanceClient;
8845	}
8846};
8847/**
8848* Use to get the redirect URI configured in MSAL or construct one from the current page.
8849* @param requestRedirectUri - Redirect URI from the request or undefined if not configured
8850* @param clientConfigRedirectUri - Redirect URI from the client configuration or undefined if not configured
8851* @param logger - Logger instance from the calling client
8852* @param correlationId
8853* @returns Absolute redirect URL constructed from the provided URI, config, or current page
8854*/
8855function getRedirectUri(requestRedirectUri, clientConfigRedirectUri, logger, correlationId) {
8856	logger.verbose("0bd1la", correlationId);
8857	const redirectUri = requestRedirectUri || clientConfigRedirectUri || "";
8858	return UrlString.getAbsoluteUrl(redirectUri, getCurrentUri());
8859}
8860/**
8861* Initializes and returns a ServerTelemetryManager with the provided telemetry configuration.
8862* @param apiId - The API identifier for telemetry tracking
8863* @param clientId - The client application identifier
8864* @param correlationId - Unique identifier for correlating requests
8865* @param browserStorage - Browser cache manager instance for storing telemetry data
8866* @param logger - Optional logger instance for verbose logging
8867* @param forceRefresh - Optional flag to force refresh of telemetry data
8868* @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
8869* @returns Configured ServerTelemetryManager instance
8870*/
8871function initializeServerTelemetryManager(apiId, clientId, correlationId, browserStorage, logger, forceRefresh, enabled = true) {
8872	logger.verbose("1p12tq", correlationId);

8873	if (!enabled) {
8874		logger.verbose("0tajnr", correlationId);
8875		return new StubServerTelemetryManager();
8876	}
8877	return new ServerTelemetryManager({
8878		clientId,
8879		correlationId,
8880		apiId,
8881		forceRefresh: forceRefresh || false,
8882		wrapperSKU: browserStorage.getWrapperMetadata()[0],
8883		wrapperVer: browserStorage.getWrapperMetadata()[1]
8884	}, browserStorage);
8885}
8886/**
8887* Used to get a discovered version of the default authority.
8888* @param params - Configuration object containing authority and cloud options
8889* @param params.requestAuthority - Optional specific authority URL to use
8890* @param params.requestAzureCloudOptions - Optional Azure cloud configuration options
8891* @param params.requestExtraQueryParameters - Optional additional query parameters
8892* @param params.account - Optional account info for instance-aware scenarios
8893* @param config - Browser configuration containing auth settings
8894* @param correlationId - Unique identifier for correlating requests
8895* @param performanceClient - Performance monitoring client instance
8896* @param browserStorage - Browser cache manager instance
8897* @param logger - Logger instance for tracking operations
8898* @returns Promise that resolves to a discovered Authority instance
8899*/
8900async function getDiscoveredAuthority(config, correlationId, performanceClient, browserStorage, logger, requestAuthority, requestAzureCloudOptions, requestExtraQueryParameters, account) {
8901	const instanceAwareEQ = requestExtraQueryParameters && requestExtraQueryParameters.hasOwnProperty("instance_aware") ? requestExtraQueryParameters["instance_aware"] : void 0;
8902	const authorityOptions = {
8903		protocolMode: config.system.protocolMode,
8904		OIDCOptions: config.auth.OIDCOptions,
8905		knownAuthorities: config.auth.knownAuthorities,
8906		cloudDiscoveryMetadata: config.auth.cloudDiscoveryMetadata,
8907		authorityMetadata: config.auth.authorityMetadata
8908	};
8909	const resolvedAuthority = requestAuthority || config.auth.authority;
8910	const resolvedInstanceAware = instanceAwareEQ?.length ? instanceAwareEQ === "true" : config.auth.instanceAware;
8911	const userAuthority = account && resolvedInstanceAware ? config.auth.authority.replace(UrlString.getDomainFromUrl(resolvedAuthority), account.environment) : resolvedAuthority;
8912	const builtAuthority = Authority.generateAuthority(userAuthority, requestAzureCloudOptions || config.auth.azureCloudOptions);
8913	const discoveredAuthority = await invokeAsync(createDiscoveredInstance, AuthorityFactoryCreateDiscoveredInstance, logger, performanceClient, correlationId)(builtAuthority, config.system.networkClient, browserStorage, authorityOptions, logger, correlationId, performanceClient);
8914	if (account && !discoveredAuthority.isAlias(account.environment)) throw createClientConfigurationError(authorityMismatch);
8915	return discoveredAuthority;
8916}
8917/**
8918* Clears cache and account information during logout.
8919*
8920* If an account is provided, removes the account from cache and, if it is the active account, sets the active account to null.
8921* If no account is provided, clears all accounts and tokens from cache.
8922*
8923* @param browserStorage - The browser cache manager instance used to manage cache.
8924* @param browserCrypto - The crypto interface for cache operations.
8925* @param logger - Logger instance for logging operations.
8926* @param correlationId - Correlation ID for the logout operation.
8927* @param account - (Optional) The account to clear from cache. If not provided, all accounts are cleared.
8928* @returns A promise that resolves when the cache has been cleared.
8929*/
8930async function clearCacheOnLogout(browserStorage, browserCrypto, logger, correlationId, account) {
8931	if (account) try {
8932		browserStorage.removeAccount(account, correlationId);
8933		logger.verbose("0s4z6h", correlationId);
8934	} catch (error) {
8935		logger.error("0mgg1d", correlationId);
8936	}
8937	else try {
8938		logger.verbose("0zj631", correlationId);
8939		browserStorage.clear(correlationId);
8940		await browserCrypto.clearKeystore(correlationId);
8941	} catch (e) {
8942		logger.error("12ih0c", correlationId);
8943	}
8944}
8945//#endregion
8946//#region node_modules/@azure/msal-browser/dist/request/RequestHelpers.mjs
8947/*! @azure/msal-browser v5.13.0 2026-06-10 */
8948/**
8949* Initializer function for all request APIs
8950* @param request
8951* @param config
8952* @param performanceClient
8953* @param logger
8954* @param correlationId
8955*/

8956async function initializeBaseRequest(request, config, performanceClient, logger, correlationId) {
8957	const authority = request.authority || config.auth.authority;
8958	const scopes = [...request && request.scopes || []];
8959	const validatedRequest = {
8960		...request,
8961		correlationId: request.correlationId,
8962		authority,
8963		scopes
8964	};
8965	if (!validatedRequest.authenticationScheme) {
8966		validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
8967		logger.verbose("1l4fwv", correlationId);
8968	} else {
8969		if (validatedRequest.authenticationScheme === AuthenticationScheme.SSH) {
8970			if (!request.sshJwk) throw createClientConfigurationError(missingSshJwk);
8971			if (!request.sshKid) throw createClientConfigurationError(missingSshKid);
8972		}
8973		logger.verbose("1ecmns", correlationId);
8974	}
8975	return validatedRequest;
8976}
8977async function initializeSilentRequest(request, account, config, performanceClient, logger) {
8978	const baseRequest = await invokeAsync(initializeBaseRequest, InitializeBaseRequest, logger, performanceClient, request.correlationId)(request, config, performanceClient, logger, request.correlationId);
8979	return {
8980		...request,
8981		...baseRequest,
8982		account,
8983		forceRefresh: request.forceRefresh || false
8984	};
8985}
8986/**
8987* Validates that the combination of request method, protocol mode and authorize body parameters is correct.
8988* Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
8989* @param interactionRequest
8990* @param protocolMode
8991* @returns
8992*/
8993function validateRequestMethod(interactionRequest, protocolMode) {
8994	let httpMethod;
8995	const requestMethod = interactionRequest.httpMethod;
8996	if (protocolMode === ProtocolMode.EAR) if (requestMethod && requestMethod !== HttpMethod.POST) throw createClientConfigurationError(invalidRequestMethodForEAR);
8997	else httpMethod = HttpMethod.POST;
8998	else httpMethod = requestMethod || HttpMethod.GET;
8999	return httpMethod;
9000}
9001//#endregion
9002//#region node_modules/@azure/msal-browser/dist/interaction_client/StandardInteractionClient.mjs
9003/*! @azure/msal-browser v5.13.0 2026-06-10 */
9004/**
9005* Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
9006*/
9007var StandardInteractionClient = class extends BaseInteractionClient {
9008	/**
9009	* Initializer for the logout request.
9010	* @param logoutRequest
9011	*/
9012	initializeLogoutRequest(logoutRequest) {
9013		this.logger.verbose("0546u4", this.correlationId);
9014		const validLogoutRequest = {
9015			correlationId: this.correlationId,
9016			...logoutRequest
9017		};
9018		/**
9019		* Set logout_hint to be login_hint from ID Token Claims if present
9020		* and logoutHint attribute wasn't manually set in logout request
9021		*/
9022		if (logoutRequest) if (!logoutRequest.logoutHint) if (logoutRequest.account) {
9023			const logoutHint = logoutRequest.account.loginHint || this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
9024			if (logoutHint) {
9025				this.logger.verbose("0d7s8p", this.correlationId);
9026				validLogoutRequest.logoutHint = logoutHint;
9027			}
9028		} else this.logger.verbose("0pdtc3", this.correlationId);
9029		else this.logger.verbose("12k4l4", this.correlationId);
9030		else this.logger.verbose("07ndze", this.correlationId);
9031		if (!logoutRequest || logoutRequest.postLogoutRedirectUri !== null) if (logoutRequest && logoutRequest.postLogoutRedirectUri) {
9032			this.logger.verbose("1vamm6", validLogoutRequest.correlationId);
9033			validLogoutRequest.postLogoutRedirectUri = UrlString.getAbsoluteUrl(logoutRequest.postLogoutRedirectUri, getCurrentUri());
9034		} else if (this.config.auth.postLogoutRedirectUri === null) this.logger.verbose("15m5g7", validLogoutRequest.correlationId);
9035		else if (this.config.auth.postLogoutRedirectUri) {
9036			this.logger.verbose("1f4xlz", validLogoutRequest.correlationId);
9037			validLogoutRequest.postLogoutRedirectUri = UrlString.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri, getCurrentUri());
9038		} else {
9039			this.logger.verbose("17s5rf", validLogoutRequest.correlationId);
9040			validLogoutRequest.postLogoutRedirectUri = UrlString.getAbsoluteUrl(getCurrentUri(), getCurrentUri());
9041		}
9042		else this.logger.verbose("0ljv63", validLogoutRequest.correlationId);
9043		return validLogoutRequest;
9044	}

9045	/**
9046	* Parses login_hint ID Token Claim out of AccountInfo object to be used as
9047	* logout_hint in end session request.
9048	* @param account
9049	*/
9050	getLogoutHintFromIdTokenClaims(account) {
9051		const idTokenClaims = account.idTokenClaims;
9052		if (idTokenClaims) if (idTokenClaims.login_hint) {
9053			this.logger.verbose("0u5bmc", this.correlationId);
9054			return idTokenClaims.login_hint;
9055		} else this.logger.verbose("0mvp54", this.correlationId);
9056		else this.logger.verbose("1e7bdp", this.correlationId);
9057		return null;
9058	}
9059	/**
9060	* Creates an Authorization Code Client with the given authority, or the default authority.
9061	* @param params {
9062	*         serverTelemetryManager: ServerTelemetryManager;
9063	*         authorityUrl?: string;
9064	*         requestAzureCloudOptions?: AzureCloudOptions;
9065	*         requestExtraQueryParameters?: StringDict;
9066	*         account?: AccountInfo;
9067	*        }
9068	*/
9069	async createAuthCodeClient(params) {
9070		return new AuthorizationCodeClient(await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)(params), this.performanceClient);
9071	}
9072	/**
9073	* Creates a Client Configuration object with the given request authority, or the default authority.
9074	* @param params {
9075	*         serverTelemetryManager: ServerTelemetryManager;
9076	*         requestAuthority?: string;
9077	*         requestAzureCloudOptions?: AzureCloudOptions;
9078	*         requestExtraQueryParameters?: boolean;
9079	*         account?: AccountInfo;
9080	*        }
9081	*/
9082	async getClientConfiguration(params) {
9083		const { serverTelemetryManager, requestAuthority, requestAzureCloudOptions, requestExtraQueryParameters, account } = params;
9084		const discoveredAuthority = params.authority || await invokeAsync(getDiscoveredAuthority, "standardInteractionClientGetDiscoveredAuthority", this.logger, this.performanceClient, this.correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, requestAuthority, requestAzureCloudOptions, requestExtraQueryParameters, account);
9085		const logger = this.config.system.loggerOptions;
9086		return {
9087			authOptions: {
9088				clientId: this.config.auth.clientId,
9089				authority: discoveredAuthority,
9090				clientCapabilities: this.config.auth.clientCapabilities,
9091				redirectUri: this.config.auth.redirectUri,
9092				isMcp: this.config.auth.isMcp
9093			},
9094			systemOptions: {
9095				tokenRenewalOffsetSeconds: this.config.system.tokenRenewalOffsetSeconds,
9096				preventCorsPreflight: true
9097			},
9098			loggerOptions: {
9099				loggerCallback: logger.loggerCallback,
9100				piiLoggingEnabled: logger.piiLoggingEnabled,
9101				logLevel: logger.logLevel,
9102				correlationId: this.correlationId
9103			},
9104			cryptoInterface: this.browserCrypto,
9105			networkInterface: this.networkClient,
9106			storageInterface: this.browserStorage,
9107			serverTelemetryManager,
9108			libraryInfo: {
9109				sku: BrowserConstants.MSAL_SKU,
9110				version,
9111				cpu: "",
9112				os: ""
9113			},
9114			telemetry: this.config.telemetry
9115		};
9116	}
9117};
9118/**
9119* Helper to initialize required request parameters for interactive APIs and ssoSilent().
9120*
9121* @param request - The authentication request object (RedirectRequest, PopupRequest, or SsoSilentRequest).
9122* @param interactionType - The type of interaction (e.g., redirect, popup, silent).
9123* @param config - The browser configuration object.
9124* @param browserCrypto - The cryptographic interface for browser operations.
9125* @param browserStorage - The browser storage manager instance.
9126* @param logger - The logger instance for logging messages.
9127* @param performanceClient - The performance client for telemetry.
9128* @param correlationId - The correlation ID for the request.
9129* @returns A promise that resolves to a CommonAuthorizationUrlRequest object with initialized parameters.
9130*/
9131async function initializeAuthorizationRequest(request, interactionType, config, browserCrypto, browserStorage, logger, performanceClient, correlationId) {
9132	const redirectUri = getRedirectUri(request.redirectUri, config.auth.redirectUri, logger, correlationId);
9133	if (new URL(redirectUri).origin !== new URL(window.location.href).origin) {
9134		logger.warning("08qbvw", correlationId);
9135		performanceClient.addFields({ isRedirectUriCrossOrigin: true }, correlationId);
9136	}
9137	const browserState = { interactionType };
9138	const state = setRequestState(browserCrypto, request && request.state || "", browserState);
9139	const interactionRequest = {
9140		...await invokeAsync(initializeBaseRequest, InitializeBaseRequest, logger, performanceClient, correlationId)({
9141			...request,
9142			correlationId
9143		}, config, performanceClient, logger, correlationId),
9144		redirectUri,
9145		state,
9146		nonce: request.nonce || createNewGuid(),
9147		responseMode: config.auth.OIDCOptions.responseMode
9148	};
9149	const validatedRequest = {
9150		...interactionRequest,
9151		httpMethod: validateRequestMethod(interactionRequest, config.system.protocolMode)
9152	};
9153	if (request.loginHint || request.sid) return validatedRequest;
9154	const account = request.account || browserStorage.getActiveAccount(correlationId);
9155	if (account) {
9156		logger.verbose("1eqlb3", correlationId);
9157		logger.verbosePii("0tf99t", correlationId);
9158		validatedRequest.account = account;
9159	}
9160	return validatedRequest;
9161}
9162//#endregion
9163//#region node_modules/@azure/msal-browser/dist/utils/BrowserProtocolUtils.mjs

9164/*! @azure/msal-browser v5.13.0 2026-06-10 */
9165/**
9166* Extracts the BrowserStateObject from the state string.
9167* @param browserCrypto
9168* @param state
9169*/
9170function extractBrowserRequestState(browserCrypto, state) {
9171	if (!state) return null;
9172	try {
9173		return parseRequestState(browserCrypto.base64Decode, state).libraryState.meta;
9174	} catch (e) {
9175		throw createClientAuthError(invalidState);
9176	}
9177}
9178//#endregion
9179//#region node_modules/@azure/msal-browser/dist/response/ResponseHandler.mjs
9180/*! @azure/msal-browser v5.13.0 2026-06-10 */
9181function deserializeResponse(responseString, responseLocation, logger, correlationId) {
9182	const serverParams = getDeserializedResponse(responseString);
9183	if (!serverParams) if (!stripLeadingHashOrQuery(responseString)) {
9184		logger.error("18h0l1", correlationId);
9185		throw createBrowserAuthError(hashEmptyError);
9186	} else {
9187		logger.error("13pl0s", correlationId);
9188		logger.errorPii("1097vx", correlationId);
9189		throw createBrowserAuthError(hashDoesNotContainKnownProperties);
9190	}
9191	return serverParams;
9192}
9193/**
9194* Returns the interaction type that the response object belongs to
9195*/
9196function validateInteractionType(response, browserCrypto, interactionType) {
9197	if (!response.state) throw createBrowserAuthError(noStateInHash);
9198	const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
9199	if (!platformStateObj) throw createBrowserAuthError(unableToParseState);
9200	if (platformStateObj.interactionType !== interactionType) throw createBrowserAuthError(stateInteractionTypeMismatch);
9201}
9202//#endregion
9203//#region node_modules/@azure/msal-browser/dist/interaction_handler/InteractionHandler.mjs
9204/*! @azure/msal-browser v5.13.0 2026-06-10 */
9205/**
9206* Abstract class which defines operations for a browser interaction handling class.
9207*/
9208var InteractionHandler = class {
9209	constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
9210		this.authModule = authCodeModule;
9211		this.browserStorage = storageImpl;
9212		this.authCodeRequest = authCodeRequest;
9213		this.logger = logger;
9214		this.performanceClient = performanceClient;
9215	}
9216	/**
9217	* Function to handle response parameters from hash.
9218	* @param locationHash
9219	*/
9220	async handleCodeResponse(response, request, apiId) {
9221		let authCodeResponse;
9222		try {
9223			authCodeResponse = getAuthorizationCodePayload(response, request.state);
9224		} catch (e) {
9225			if (e instanceof ServerError && e.subError === "user_cancelled") throw createBrowserAuthError(userCancelled);
9226			else throw e;
9227		}
9228		return invokeAsync(this.handleCodeResponseFromServer.bind(this), HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request, apiId);
9229	}
9230	/**
9231	* Process auth code response from AAD
9232	* @param authCodeResponse
9233	* @param request
9234	* @param validateNonce
9235	* @returns
9236	*/
9237	async handleCodeResponseFromServer(authCodeResponse, request, apiId, validateNonce = true) {
9238		this.logger.trace("0mf2hb", request.correlationId);
9239		this.authCodeRequest.code = authCodeResponse.code;
9240		if (validateNonce) authCodeResponse.nonce = request.nonce || void 0;
9241		authCodeResponse.state = request.state;
9242		if (authCodeResponse.client_info) this.authCodeRequest.clientInfo = authCodeResponse.client_info;
9243		else {
9244			const ccsCred = this.createCcsCredentials(request);
9245			if (ccsCred) this.authCodeRequest.ccsCredential = ccsCred;
9246		}
9247		return await invokeAsync(this.authModule.acquireToken.bind(this.authModule), AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, apiId, authCodeResponse);
9248	}
9249	/**
9250	* Build ccs creds if available
9251	*/
9252	createCcsCredentials(request) {
9253		if (request.account) return {
9254			credential: request.account.homeAccountId,
9255			type: CcsCredentialType.HOME_ACCOUNT_ID
9256		};
9257		else if (request.loginHint) return {
9258			credential: request.loginHint,
9259			type: CcsCredentialType.UPN
9260		};
9261		return null;
9262	}
9263};
9264//#endregion
9265//#region node_modules/@azure/msal-browser/dist/error/NativeAuthErrorCodes.mjs
9266/*! @azure/msal-browser v5.13.0 2026-06-10 */
9267var contentError = "ContentError";
9268var pageException = "PageException";
9269var userSwitch = "user_switch";
9270//#endregion
9271//#region node_modules/@azure/msal-browser/dist/broker/nativeBroker/NativeStatusCodes.mjs

9272/*! @azure/msal-browser v5.13.0 2026-06-10 */
9273var USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED";
9274var USER_CANCEL = "USER_CANCEL";
9275var NO_NETWORK = "NO_NETWORK";
9276var ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE";
9277var UI_NOT_ALLOWED = "UI_NOT_ALLOWED";
9278//#endregion
9279//#region node_modules/@azure/msal-browser/dist/error/NativeAuthError.mjs
9280/*! @azure/msal-browser v5.13.0 2026-06-10 */
9281var INVALID_METHOD_ERROR = -2147186943;
9282var NativeAuthError = class NativeAuthError extends AuthError {
9283	constructor(errorCode, description, ext) {
9284		super(errorCode, description || getDefaultErrorMessage(errorCode));
9285		Object.setPrototypeOf(this, NativeAuthError.prototype);
9286		this.name = "NativeAuthError";
9287		this.ext = ext;
9288	}
9289};
9290/**
9291* These errors should result in a fallback to the 'standard' browser based auth flow.
9292*/
9293function isFatalNativeAuthError(error) {
9294	if (error.ext && error.ext.status && error.ext.status === "DISABLED") return true;
9295	if (error.ext && error.ext.error && error.ext.error === INVALID_METHOD_ERROR) return true;
9296	switch (error.errorCode) {
9297		case contentError:
9298		case pageException: return true;
9299		default: return false;
9300	}
9301}
9302/**
9303* Create the appropriate error object based on the WAM status code.
9304* @param code
9305* @param description
9306* @param ext
9307* @returns
9308*/
9309function createNativeAuthError(code, description, ext) {
9310	if (ext && ext.status) switch (ext.status) {
9311		case ACCOUNT_UNAVAILABLE: return createInteractionRequiredAuthError(nativeAccountUnavailable, getDefaultErrorMessage(code));
9312		case USER_INTERACTION_REQUIRED: return new InteractionRequiredAuthError(code, description);
9313		case USER_CANCEL: return createBrowserAuthError(userCancelled);
9314		case NO_NETWORK: return createBrowserAuthError(noNetworkConnectivity);
9315		case UI_NOT_ALLOWED: return createInteractionRequiredAuthError(uiNotAllowed);
9316	}
9317	return new NativeAuthError(code, description, ext);
9318}
9319//#endregion
9320//#region node_modules/@azure/msal-browser/dist/interaction_client/SilentCacheClient.mjs
9321/*! @azure/msal-browser v5.13.0 2026-06-10 */
9322var SilentCacheClient = class extends StandardInteractionClient {
9323	/**
9324	* Returns unexpired tokens from the cache, if available
9325	* @param silentRequest
9326	*/
9327	async acquireToken(silentRequest) {
9328		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
9329		const silentAuthClient = new SilentFlowClient(await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
9330			serverTelemetryManager,
9331			requestAuthority: silentRequest.authority,
9332			requestAzureCloudOptions: silentRequest.azureCloudOptions,
9333			account: silentRequest.account
9334		}), this.performanceClient);
9335		this.logger.verbose("0wa871", this.correlationId);
9336		try {
9337			const authResponse = (await invokeAsync(silentAuthClient.acquireCachedToken.bind(silentAuthClient), SilentFlowClientAcquireCachedToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest))[0];
9338			this.performanceClient.addFields({ fromCache: true }, silentRequest.correlationId);
9339			return authResponse;
9340		} catch (error) {
9341			if (error instanceof BrowserAuthError && error.errorCode === "crypto_key_not_found") this.logger.verbose("06wena", this.correlationId);
9342			throw error;
9343		}
9344	}
9345	/**
9346	* API to silenty clear the browser cache.
9347	* @param logoutRequest
9348	*/
9349	logout(logoutRequest) {
9350		this.logger.verbose("1rkurh", this.correlationId);
9351		const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
9352		return clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validLogoutRequest.account);
9353	}
9354};
9355//#endregion
9356//#region node_modules/@azure/msal-browser/dist/interaction_client/PlatformAuthInteractionClient.mjs
9357/*! @azure/msal-browser v5.13.0 2026-06-10 */
9358var PlatformAuthInteractionClient = class extends BaseInteractionClient {
9359	constructor(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, provider, accountId, nativeStorageImpl, correlationId) {
9360		super(config, browserStorage, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, provider);
9361		this.apiId = apiId;
9362		this.accountId = accountId;
9363		this.platformAuthProvider = provider;
9364		this.nativeStorageManager = nativeStorageImpl;
9365		this.silentCacheClient = new SilentCacheClient(config, this.nativeStorageManager, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, provider);

9366		const extensionName = this.platformAuthProvider.getExtensionName();
9367		this.skus = ServerTelemetryManager.makeExtraSkuString({
9368			libraryName: BrowserConstants.MSAL_SKU,
9369			libraryVersion: version,
9370			extensionName,
9371			extensionVersion: this.platformAuthProvider.getExtensionVersion()
9372		});
9373	}
9374	/**
9375	* Adds SKUs to request extra query parameters
9376	* @param request {PlatformAuthRequest}
9377	* @private
9378	*/
9379	addRequestSKUs(request) {
9380		request.extraParameters = {
9381			...request.extraParameters,
9382			[X_CLIENT_EXTRA_SKU]: this.skus
9383		};
9384	}
9385	/**
9386	* Acquire token from native platform via browser extension
9387	* @param request
9388	*/
9389	async acquireToken(request, cacheLookupPolicy) {
9390		this.logger.trace("03qeos", this.correlationId);
9391		const nativeATMeasurement = this.performanceClient.startMeasurement(NativeInteractionClientAcquireToken, this.correlationId);
9392		const reqTimestamp = nowSeconds();
9393		const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
9394		try {
9395			const nativeRequest = await this.initializePlatformRequest(request);
9396			try {
9397				const result = await this.acquireTokensFromCache(this.accountId, nativeRequest);
9398				nativeATMeasurement.end({
9399					success: true,
9400					isNativeBroker: false,
9401					fromCache: true
9402				});
9403				return result;
9404			} catch (e) {
9405				if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
9406					this.logger.info("0eitbc", this.correlationId);
9407					nativeATMeasurement.end({
9408						success: false,
9409						brokerErrorCode: "cache_request_failed"
9410					});
9411					throw e;
9412				}
9413				this.logger.info("0957j1", this.correlationId);
9414			}
9415			const validatedResponse = await this.platformAuthProvider.sendMessage(nativeRequest);
9416			return await this.handleNativeResponse(validatedResponse, nativeRequest, reqTimestamp).then((result) => {
9417				nativeATMeasurement.end({
9418					success: true,
9419					isNativeBroker: true,
9420					requestId: result.requestId
9421				});
9422				serverTelemetryManager.clearNativeBrokerErrorCode();
9423				return result;
9424			}).catch((error) => {
9425				nativeATMeasurement.end({
9426					success: false,
9427					errorCode: error.errorCode,
9428					subErrorCode: error.subError
9429				});
9430				throw error;
9431			});
9432		} catch (e) {
9433			if (e instanceof NativeAuthError) serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
9434			nativeATMeasurement.end({ success: false });
9435			throw e;
9436		}
9437	}
9438	/**
9439	* Creates silent flow request
9440	* @param request
9441	* @param cachedAccount
9442	* @returns CommonSilentFlowRequest
9443	*/
9444	createSilentCacheRequest(request, cachedAccount) {
9445		return {
9446			authority: request.authority,
9447			correlationId: this.correlationId,
9448			scopes: ScopeSet.fromString(request.scope).asArray(),
9449			account: cachedAccount,
9450			forceRefresh: false
9451		};
9452	}
9453	/**
9454	* Fetches the tokens from the cache if un-expired
9455	* @param nativeAccountId
9456	* @param request
9457	* @returns authenticationResult
9458	*/
9459	async acquireTokensFromCache(nativeAccountId, request) {
9460		if (!nativeAccountId) {
9461			this.logger.warning("1ndf3e", this.correlationId);
9462			throw createClientAuthError(noAccountFound);
9463		}
9464		const account = this.browserStorage.getBaseAccountInfo({ nativeAccountId }, this.correlationId);
9465		if (!account) throw createClientAuthError(noAccountFound);
9466		try {
9467			const silentRequest = this.createSilentCacheRequest(request, account);
9468			const result = await this.silentCacheClient.acquireToken(silentRequest);
9469			const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
9470			const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
9471			const fullAccount = updateAccountTenantProfileData(account, void 0, idTokenClaims, idToken?.secret);
9472			return {
9473				...result,
9474				idToken: idToken?.secret || "",
9475				idTokenClaims,
9476				account: fullAccount
9477			};
9478		} catch (e) {
9479			throw e;
9480		}
9481	}
9482	/**
9483	* Acquires a token from native platform then redirects to the redirectUri instead of returning the response
9484	* @param {RedirectRequest} request
9485	* @param {InProgressPerformanceEvent} rootMeasurement
9486	* @param {HandleRedirectPromiseOptions} options
9487	*/
9488	async acquireTokenRedirect(request, rootMeasurement, options) {
9489		this.logger.trace("0luikq", this.correlationId);
9490		const nativeRequest = await this.initializePlatformRequest(request);
9491		const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
9492		try {
9493			await this.platformAuthProvider.sendMessage(nativeRequest);
9494		} catch (e) {
9495			if (e instanceof NativeAuthError) {
9496				initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled).setNativeBrokerErrorCode(e.errorCode);
9497				if (isFatalNativeAuthError(e)) throw e;
9498			}
9499		}
9500		this.browserStorage.setTemporaryCache(TemporaryCacheKeys.NATIVE_REQUEST, JSON.stringify(nativeRequest), true);
9501		const navigationOptions = {
9502			apiId: ApiId.acquireTokenRedirect,
9503			timeout: this.config.system.redirectNavigationTimeout,
9504			noHistory: false
9505		};
9506		const redirectUri = navigateToLoginRequestUrl ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri()) : getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
9507		rootMeasurement.end({ success: true });
9508		await this.navigationClient.navigateExternal(redirectUri, navigationOptions);
9509	}
9510	/**
9511	* If the previous page called native platform for a token using redirect APIs, send the same request again and return the response
9512	* @param performanceClient {IPerformanceClient?}
9513	* @param correlationId {string?} correlation identifier
9514	*/
9515	async handleRedirectPromise() {
9516		this.logger.trace("1c5lhw", this.correlationId);
9517		if (!this.browserStorage.isInteractionInProgress(true)) {
9518			this.logger.info("0le6uv", this.correlationId);
9519			return null;
9520		}
9521		const cachedRequest = this.browserStorage.getCachedNativeRequest();
9522		if (!cachedRequest) {
9523			this.logger.verbose("0a6zjb", this.correlationId);

9524			this.performanceClient?.addFields({ errorCode: "no_cached_request" }, this.correlationId);
9525			return null;
9526		}
9527		const { prompt, ...request } = cachedRequest;
9528		if (prompt) this.logger.verbose("0ac34v", this.correlationId);
9529		this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST));
9530		const reqTimestamp = nowSeconds();
9531		try {
9532			this.logger.verbose("003x5a", this.correlationId);
9533			const response = await this.platformAuthProvider.sendMessage(request);
9534			const authResult = await this.handleNativeResponse(response, request, reqTimestamp);
9535			initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled).clearNativeBrokerErrorCode();
9536			this.performanceClient?.addFields({ isNativeBroker: true }, this.correlationId);
9537			return authResult;
9538		} catch (e) {
9539			throw e;
9540		}
9541	}
9542	/**
9543	* Logout from native platform via browser extension
9544	* @param request
9545	*/
9546	logout() {
9547		this.logger.trace("0u2sjm", this.correlationId);
9548		return Promise.reject("Logout not implemented yet");
9549	}
9550	/**
9551	* Transform response from native platform into AuthenticationResult object which will be returned to the end user
9552	* @param response
9553	* @param request
9554	* @param reqTimestamp
9555	*/
9556	async handleNativeResponse(response, request, reqTimestamp) {
9557		this.logger.trace("1bojln", this.correlationId);
9558		const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
9559		const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
9560		const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({ nativeAccountId: request.accountId }, this.correlationId)?.homeAccountId;
9561		if (request.extraParameters?.child_client_id && response.account.id !== request.accountId) this.logger.info("1ub1in", this.correlationId);
9562		else if (homeAccountIdentifier !== cachedhomeAccountId && response.account.id !== request.accountId) throw createNativeAuthError(userSwitch);
9563		const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
9564		const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, authority.getPreferredCache(), idTokenClaims.tid, void 0, response.account.id, this.logger, this.performanceClient);
9565		response.expires_in = Number(response.expires_in);
9566		const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
9567		await this.cacheAccount(baseAccount, isKmsi(idTokenClaims));
9568		await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.tenantId, reqTimestamp, authority.getPreferredCache());
9569		return result;
9570	}
9571	/**
9572	* creates an homeAccountIdentifier for the account
9573	* @param response
9574	* @param idTokenObj
9575	* @returns
9576	*/
9577	createHomeAccountIdentifier(response, idTokenClaims) {
9578		return generateHomeAccountId(response.client_info || "", AuthorityType.Default, this.logger, this.browserCrypto, this.correlationId, idTokenClaims);
9579	}
9580	/**
9581	* Helper to generate scopes
9582	* @param response
9583	* @param request
9584	* @returns
9585	*/
9586	generateScopes(requestScopes, responseScopes) {
9587		return responseScopes ? ScopeSet.fromString(responseScopes) : ScopeSet.fromString(requestScopes);
9588	}
9589	/**
9590	* If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
9591	* @param request
9592	* @param response
9593	*/
9594	async generatePopAccessToken(response, request) {
9595		if (request.tokenType === AuthenticationScheme.POP && request.signPopToken) {
9596			/**
9597			* This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
9598			* is still received, SHR is calculated locally
9599			*/
9600			if (response.shr) {
9601				this.logger.trace("0coqhu", this.correlationId);
9602				return response.shr;
9603			}
9604			const popTokenGenerator = new PopTokenGenerator(this.browserCrypto, this.performanceClient);
9605			const shrParameters = {
9606				resourceRequestMethod: request.resourceRequestMethod,
9607				resourceRequestUri: request.resourceRequestUri,
9608				shrClaims: request.shrClaims,
9609				shrNonce: request.shrNonce,
9610				correlationId: this.correlationId
9611			};
9612			/**
9613			* KeyID must be present in the native request from when the PoP key was generated in order for
9614			* PopTokenGenerator to query the full key for signing
9615			*/
9616			if (!request.keyId) throw createClientAuthError(keyIdMissing);
9617			return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
9618		} else return response.access_token;
9619	}
9620	/**
9621	* Generates authentication result
9622	* @param response
9623	* @param request
9624	* @param idTokenObj
9625	* @param accountEntity
9626	* @param authority
9627	* @param reqTimestamp
9628	* @returns
9629	*/
9630	async generateAuthenticationResult(response, request, idTokenClaims, accountEntity, authority, reqTimestamp) {
9631		const mats = this.addTelemetryFromNativeResponse(response.properties.MATS);
9632		const responseScopes = this.generateScopes(request.scope, response.scope);

9633		const accountProperties = response.account.properties || {};
9634		const uid = accountProperties["UID"] || idTokenClaims.oid || idTokenClaims.sub || "";
9635		const tid = accountProperties["TenantId"] || idTokenClaims.tid || "";
9636		const accountInfo = updateAccountTenantProfileData(getAccountInfo(accountEntity), void 0, idTokenClaims, response.id_token);
9637		/**
9638		* In pairwise broker flows, this check prevents the broker's native account id
9639		* from being returned over the embedded app's account id.
9640		*/
9641		if (accountInfo.nativeAccountId !== response.account.id) accountInfo.nativeAccountId = response.account.id;
9642		const responseAccessToken = await this.generatePopAccessToken(response, request);
9643		const tokenType = request.tokenType === AuthenticationScheme.POP ? AuthenticationScheme.POP : AuthenticationScheme.BEARER;
9644		return {
9645			authority,
9646			uniqueId: uid,
9647			tenantId: tid,
9648			scopes: responseScopes.asArray(),
9649			account: accountInfo,
9650			idToken: response.id_token,
9651			idTokenClaims,
9652			accessToken: responseAccessToken,
9653			fromCache: mats ? this.isResponseFromCache(mats) : false,
9654			expiresOn: toDateFromSeconds(reqTimestamp + response.expires_in),
9655			tokenType,
9656			correlationId: this.correlationId,
9657			state: response.state,
9658			fromPlatformBroker: true,
9659			...request.resource && { resource: request.resource }
9660		};
9661	}
9662	/**
9663	* cache the account entity in browser storage
9664	* @param accountEntity
9665	*/
9666	async cacheAccount(accountEntity, kmsi) {
9667		await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi, this.apiId);
9668		this.browserStorage.removeAccountContext(getAccountInfo(accountEntity), this.correlationId);
9669	}
9670	/**
9671	* Stores the access_token and id_token in inmemory storage
9672	* @param response
9673	* @param request
9674	* @param homeAccountIdentifier
9675	* @param idTokenObj
9676	* @param responseAccessToken
9677	* @param tenantId
9678	* @param reqTimestamp
9679	*/
9680	async cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, tenantId, reqTimestamp, environment) {
9681		const cachedIdToken = createIdTokenEntity(homeAccountIdentifier, environment, response.id_token || "", request.clientId, idTokenClaims.tid || "");
9682		const tokenExpirationSeconds = reqTimestamp + (request.tokenType === AuthenticationScheme.POP ? 240 : (typeof response.expires_in === "string" ? parseInt(response.expires_in, 10) : response.expires_in) || 0);
9683		const responseScopes = this.generateScopes(response.scope, request.scope);
9684		const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, void 0, request.tokenType, void 0, request.keyId);
9685		if (!!cachedIdToken && request.storeInCache?.idToken !== false) await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
9686		const nativeCacheRecord = { accessToken: cachedAccessToken };
9687		return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), this.apiId, request.storeInCache);
9688	}
9689	getExpiresInValue(tokenType, expiresIn) {
9690		return tokenType === AuthenticationScheme.POP ? 240 : (typeof expiresIn === "string" ? parseInt(expiresIn, 10) : expiresIn) || 0;
9691	}
9692	addTelemetryFromNativeResponse(matsResponse) {
9693		const mats = this.getMATSFromResponse(matsResponse);
9694		if (!mats) return null;
9695		this.performanceClient.addFields({
9696			extensionId: this.platformAuthProvider.getExtensionId(),
9697			extensionVersion: this.platformAuthProvider.getExtensionVersion(),
9698			matsBrokerVersion: mats.broker_version,
9699			matsAccountJoinOnStart: mats.account_join_on_start,
9700			matsAccountJoinOnEnd: mats.account_join_on_end,
9701			matsDeviceJoin: mats.device_join,
9702			matsPromptBehavior: mats.prompt_behavior,
9703			matsApiErrorCode: mats.api_error_code,
9704			matsUiVisible: mats.ui_visible,
9705			matsSilentCode: mats.silent_code,
9706			matsSilentBiSubCode: mats.silent_bi_sub_code,
9707			matsSilentMessage: mats.silent_message,
9708			matsSilentStatus: mats.silent_status,
9709			matsHttpStatus: mats.http_status,

9710			matsHttpEventCount: mats.http_event_count
9711		}, this.correlationId);
9712		return mats;
9713	}
9714	/**
9715	* Gets MATS telemetry from native response
9716	* @param response
9717	* @returns
9718	*/
9719	getMATSFromResponse(matsResponse) {
9720		if (matsResponse) try {
9721			return JSON.parse(matsResponse);
9722		} catch (e) {
9723			this.logger.error("0b3l57", this.correlationId);
9724		}
9725		return null;
9726	}
9727	/**
9728	* Returns whether or not response came from native cache
9729	* @param response
9730	* @returns
9731	*/
9732	isResponseFromCache(mats) {
9733		if (typeof mats.is_cached === "undefined") {
9734			this.logger.verbose("1okqev", this.correlationId);
9735			return false;
9736		}
9737		return !!mats.is_cached;
9738	}
9739	/**
9740	* Translates developer provided request object into NativeRequest object
9741	* @param request
9742	*/
9743	async initializePlatformRequest(request) {
9744		this.logger.trace("1xdm2a", this.correlationId);
9745		const canonicalAuthority = await this.getCanonicalAuthority(request);
9746		const configClaims = request.skipBrokerClaims && !!request.embeddedClientId ? void 0 : this.config.auth.clientCapabilities;
9747		const { scopes, claims, ...remainingProperties } = request;
9748		const scopeSet = new ScopeSet(scopes || []);
9749		scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
9750		const mergedClaims = configClaims && configClaims.length ? addClientCapabilitiesToClaims$1(claims, configClaims) : claims;
9751		const validatedRequest = {
9752			...remainingProperties,
9753			claims: mergedClaims,
9754			accountId: this.accountId,
9755			clientId: this.config.auth.clientId,
9756			authority: canonicalAuthority.urlString,
9757			scope: scopeSet.printScopes(),
9758			redirectUri: getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId),
9759			prompt: this.getPrompt(request.prompt),
9760			correlationId: this.correlationId,
9761			tokenType: request.authenticationScheme,
9762			windowTitleSubstring: document.title,
9763			extraParameters: { ...request.extraParameters },
9764			extendedExpiryToken: false,
9765			keyId: request.popKid
9766		};
9767		if (validatedRequest.signPopToken && !!request.popKid) throw createBrowserAuthError(invalidPopTokenRequest);
9768		this.handleExtraBrokerParams(validatedRequest);
9769		validatedRequest.extraParameters = validatedRequest.extraParameters || {};
9770		validatedRequest.extraParameters.telemetry = PlatformAuthConstants.MATS_TELEMETRY;
9771		if (request.authenticationScheme === AuthenticationScheme.POP) {
9772			const shrParameters = {
9773				resourceRequestUri: request.resourceRequestUri,
9774				resourceRequestMethod: request.resourceRequestMethod,
9775				shrClaims: request.shrClaims,
9776				shrNonce: request.shrNonce,
9777				correlationId: this.correlationId
9778			};
9779			const popTokenGenerator = new PopTokenGenerator(this.browserCrypto, this.performanceClient);
9780			let reqCnfData;
9781			if (!validatedRequest.keyId) {
9782				const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
9783				reqCnfData = generatedReqCnfData.reqCnfString;
9784				validatedRequest.keyId = generatedReqCnfData.kid;
9785				validatedRequest.signPopToken = true;
9786			} else {
9787				reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
9788				validatedRequest.signPopToken = false;
9789			}
9790			validatedRequest.reqCnf = reqCnfData;
9791		}
9792		this.addRequestSKUs(validatedRequest);
9793		return validatedRequest;
9794	}
9795	async getCanonicalAuthority(request) {
9796		const requestAuthority = request.authority || this.config.auth.authority;
9797		const { azureCloudOptions, account } = request;
9798		if (account) await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, requestAuthority, azureCloudOptions, void 0, account);
9799		const canonicalAuthority = new UrlString(requestAuthority);
9800		canonicalAuthority.validateAsUri();
9801		return canonicalAuthority;
9802	}
9803	getPrompt(prompt) {
9804		switch (this.apiId) {
9805			case ApiId.ssoSilent:
9806			case ApiId.acquireTokenSilent_silentFlow:
9807				this.logger.trace("12n1y2", this.correlationId);
9808				return PromptValue.NONE;
9809		}
9810		if (!prompt) {
9811			this.logger.trace("0uid1p", this.correlationId);
9812			return;
9813		}
9814		switch (prompt) {
9815			case PromptValue.NONE:
9816			case PromptValue.CONSENT:
9817			case PromptValue.LOGIN:
9818				this.logger.trace("0i0hco", this.correlationId);
9819				return prompt;
9820			default:
9821				this.logger.trace("0w3tpw", this.correlationId);
9822				throw createBrowserAuthError(nativePromptNotSupported);
9823		}
9824	}
9825	/**
9826	* Handles extra broker request parameters
9827	* @param request {PlatformAuthRequest}
9828	* @private
9829	*/
9830	handleExtraBrokerParams(request) {
9831		const hasExtraBrokerParams = request.extraParameters && request.extraParameters.hasOwnProperty("brk_client_id") && request.extraParameters.hasOwnProperty("brk_redirect_uri") && request.extraParameters.hasOwnProperty("client_id");
9832		if (!request.embeddedClientId && !hasExtraBrokerParams) return;
9833		let child_client_id = "";
9834		const child_redirect_uri = request.redirectUri;
9835		if (request.embeddedClientId) {
9836			request.redirectUri = this.config.auth.redirectUri;
9837			child_client_id = request.embeddedClientId;
9838		} else if (request.extraParameters) {
9839			request.redirectUri = request.extraParameters[BROKER_REDIRECT_URI];
9840			child_client_id = request.extraParameters[CLIENT_ID];
9841		}
9842		request.extraParameters = {
9843			child_client_id,
9844			child_redirect_uri
9845		};
9846		this.performanceClient?.addFields({
9847			embeddedClientId: child_client_id,
9848			embeddedRedirectUri: child_redirect_uri
9849		}, this.correlationId);
9850	}
9851};
9852//#endregion
9853//#region node_modules/@azure/msal-browser/dist/protocol/Authorize.mjs

9854/*! @azure/msal-browser v5.13.0 2026-06-10 */
9855var clientDataAccountTypeMapping = new Map([["e", "AAD"], ["m", "MSA"]]);
9856/**
9857* Parses the clientdata response parameter from the /authorize endpoint.
9858*
9859* Logically, the clientdata value is URL-encoded and pipe-delimited:
9860*   urlencoded(account_type | error | sub_error | cloud_instance | caller_data_boundary)
9861*
9862* In normal browser flows, this value may already have been URL-decoded
9863* (e.g. by URLSearchParams). This function will only apply decodeURIComponent
9864* when the string appears to contain percent-encoded sequences to avoid
9865* double-decoding.
9866*
9867* @param clientdata - The raw clientdata string from the authorize response
9868* @returns Parsed ClientData object, or null if the input is empty/invalid
9869*/
9870function parseClientData(clientdata) {
9871	if (!clientdata) return null;
9872	try {
9873		const parts = (/%(?:[0-9A-Fa-f]{2})/.test(clientdata) ? decodeURIComponent(clientdata) : clientdata).split("|");
9874		if (parts.length < 5) return null;
9875		return {
9876			accountType: clientDataAccountTypeMapping.get(parts[0]?.trim() || "") || "",
9877			error: parts[1]?.trim() || "",
9878			subError: parts[2]?.trim() || "",
9879			cloudInstance: parts[3]?.trim() || "",
9880			callerDataBoundary: parts[4]?.trim() || ""
9881		};
9882	} catch {
9883		return null;
9884	}
9885}
9886/**
9887* Instruments account type, error, and suberror from clientdata
9888*/
9889function instrumentClientData(response, correlationId, performanceClient) {
9890	const parsed = parseClientData(response.clientdata);
9891	parsed?.accountType && performanceClient.addFields({ accountType: parsed.accountType }, correlationId);
9892	parsed?.error && performanceClient.addFields({ serverErrorNo: parsed.error }, correlationId);
9893	parsed?.subError && performanceClient.addFields({ serverSubErrorNo: parsed.subError }, correlationId);
9894}
9895/**
9896* Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
9897* @param config
9898* @param authority
9899* @param request
9900* @param logger
9901* @param performanceClient
9902* @returns
9903*/
9904async function getStandardParameters(config, authority, request, logger, performanceClient) {
9905	const parameters = getStandardAuthorizeRequestParameters({
9906		...config.auth,
9907		authority
9908	}, request, logger, performanceClient);
9909	addLibraryInfo(parameters, {
9910		sku: BrowserConstants.MSAL_SKU,
9911		version,
9912		os: "",
9913		cpu: ""
9914	});
9915	if (config.system.protocolMode !== ProtocolMode.OIDC) addApplicationTelemetry(parameters, config.telemetry.application);
9916	if (request.platformBroker) {
9917		addNativeBroker(parameters);
9918		performanceClient.addFields({ isPlatformAuthorizeRequest: true }, request.correlationId);
9919		if (request.authenticationScheme === AuthenticationScheme.POP) {
9920			const cryptoOps = new CryptoOps(logger, performanceClient);
9921			const popTokenGenerator = new PopTokenGenerator(cryptoOps, performanceClient);
9922			let reqCnfData;
9923			if (!request.popKid) reqCnfData = (await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, logger, performanceClient, request.correlationId)(request, logger)).reqCnfString;
9924			else reqCnfData = cryptoOps.encodeKid(request.popKid);
9925			addPopToken(parameters, reqCnfData);
9926		}
9927	}
9928	instrumentBrokerParams(parameters, request.correlationId, performanceClient);
9929	return parameters;
9930}
9931/**
9932* Gets the full /authorize URL with request parameters when using Auth Code + PKCE
9933* @param config
9934* @param authority
9935* @param request
9936* @param logger
9937* @param performanceClient
9938* @returns
9939*/
9940async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
9941	if (!request.codeChallenge) throw createClientConfigurationError(pkceParamsMissing);
9942	const parameters = await invokeAsync(getStandardParameters, GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
9943	addResponseType(parameters, OAuthResponseType.CODE);
9944	addCodeChallengeParams(parameters, request.codeChallenge, S256_CODE_CHALLENGE_METHOD);
9945	addExtraParameters(parameters, {
9946		...request.extraQueryParameters,
9947		...request.extraParameters
9948	});
9949	return getAuthorizeUrl(authority, parameters);
9950}
9951/**
9952* Gets the form that will be posted to /authorize with request parameters when using EAR
9953*/
9954async function getEARForm(frame, config, authority, request, logger, performanceClient) {
9955	if (!request.earJwk) throw createBrowserAuthError(earJwkEmpty);
9956	const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
9957	addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
9958	addEARParameters(parameters, request.earJwk);
9959	addCodeChallengeParams(parameters, request.codeChallenge, S256_CODE_CHALLENGE_METHOD);
9960	addExtraParameters(parameters, { ...request.extraParameters });
9961	const queryParams = /* @__PURE__ */ new Map();
9962	addExtraParameters(queryParams, request.extraQueryParameters || {});
9963	addCorrelationId(queryParams, request.correlationId);
9964	return createForm(frame, getAuthorizeUrl(authority, queryParams), parameters);
9965}
9966/**
9967* Gets the form that will be posted to /authorize with request parameters when using POST method
9968*/
9969async function getCodeForm(frame, config, authority, request, logger, performanceClient) {
9970	const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
9971	addResponseType(parameters, OAuthResponseType.CODE);
9972	addCodeChallengeParams(parameters, request.codeChallenge, request.codeChallengeMethod || "S256");
9973	addExtraParameters(parameters, { ...request.extraParameters });
9974	const queryParams = /* @__PURE__ */ new Map();
9975	addExtraParameters(queryParams, request.extraQueryParameters || {});
9976	addCorrelationId(queryParams, request.correlationId);
9977	return createForm(frame, getAuthorizeUrl(authority, queryParams), parameters);
9978}
9979/**
9980* Creates form element in the provided document with auth parameters in the post body
9981* @param frame
9982* @param authorizeUrl
9983* @param parameters
9984* @returns
9985*/
9986function createForm(frame, authorizeUrl, parameters) {
9987	const form = frame.createElement("form");
9988	form.method = "post";
9989	form.action = authorizeUrl;

9990	parameters.forEach((value, key) => {
9991		const param = frame.createElement("input");
9992		param.hidden = true;
9993		param.name = key;
9994		param.value = value;
9995		form.appendChild(param);
9996	});
9997	frame.body.appendChild(form);
9998	return form;
9999}
10000/**
10001* Response handler when server returns accountId on the /authorize request
10002* @param request
10003* @param accountId
10004* @param apiId
10005* @param config
10006* @param browserStorage
10007* @param nativeStorage
10008* @param eventHandler
10009* @param logger
10010* @param performanceClient
10011* @param nativeMessageHandler
10012* @returns
10013*/
10014async function handleResponsePlatformBroker(request, accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
10015	logger.verbose("11qcow", request.correlationId);
10016	if (!platformAuthProvider) throw createBrowserAuthError(nativeConnectionNotEstablished);
10017	const browserCrypto = new CryptoOps(logger, performanceClient);
10018	const nativeInteractionClient = new PlatformAuthInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, config.system.navigationClient, apiId, performanceClient, platformAuthProvider, accountId, nativeStorage, request.correlationId);
10019	const { userRequestState } = parseRequestState(browserCrypto.base64Decode, request.state);
10020	return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), NativeInteractionClientAcquireToken, logger, performanceClient, request.correlationId)({
10021		...request,
10022		state: userRequestState,
10023		prompt: void 0
10024	});
10025}
10026/**
10027* Response handler when server returns code on the /authorize request
10028* @param request
10029* @param response
10030* @param codeVerifier
10031* @param authClient
10032* @param browserStorage
10033* @param logger
10034* @param performanceClient
10035* @returns
10036*/
10037async function handleResponseCode(request, response, codeVerifier, apiId, config, authClient, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
10038	ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
10039	instrumentClientData(response, request.correlationId, performanceClient);
10040	if (response.accountId) return invokeAsync(handleResponsePlatformBroker, HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, response.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider);
10041	const interactionHandler = new InteractionHandler(authClient, browserStorage, {
10042		...request,
10043		code: response.code || "",
10044		codeVerifier
10045	}, logger, performanceClient);
10046	return await invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), HandleCodeResponse, logger, performanceClient, request.correlationId)(response, request, apiId);
10047}
10048/**
10049* Response handler when server returns ear_jwe on the /authorize request
10050* @param request
10051* @param response
10052* @param apiId
10053* @param config
10054* @param authority
10055* @param browserStorage
10056* @param nativeStorage
10057* @param eventHandler
10058* @param logger
10059* @param performanceClient
10060* @param nativeMessageHandler
10061* @returns
10062*/
10063async function handleResponseEAR(request, response, apiId, config, authority, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
10064	ThrottlingUtils.removeThrottle(browserStorage, config.auth.clientId, request);
10065	instrumentClientData(response, request.correlationId, performanceClient);
10066	validateAuthorizationResponse(response, request.state);
10067	if (!response.ear_jwe) throw createBrowserAuthError(earJweEmpty);
10068	if (!request.earJwk) throw createBrowserAuthError(earJwkEmpty);
10069	const decryptedData = JSON.parse(await invokeAsync(decryptEarResponse, DecryptEarResponse, logger, performanceClient, request.correlationId)(request.earJwk, response.ear_jwe));
10070	if (decryptedData.accountId) return invokeAsync(handleResponsePlatformBroker, HandleResponsePlatformBroker, logger, performanceClient, request.correlationId)(request, decryptedData.accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider);
10071	const responseHandler = new ResponseHandler(config.auth.clientId, browserStorage, new CryptoOps(logger, performanceClient), logger, performanceClient, null, null);
10072	responseHandler.validateTokenResponse(decryptedData, request.correlationId);
10073	const additionalData = {
10074		code: "",
10075		state: request.state,
10076		nonce: request.nonce,
10077		client_info: decryptedData.client_info,
10078		cloud_graph_host_name: decryptedData.cloud_graph_host_name,
10079		cloud_instance_host_name: decryptedData.cloud_instance_host_name,
10080		cloud_instance_name: decryptedData.cloud_instance_name,
10081		msgraph_host: decryptedData.msgraph_host
10082	};
10083	return await invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, logger, performanceClient, request.correlationId)(decryptedData, authority, nowSeconds(), request, apiId, additionalData, void 0, void 0, void 0, void 0);
10084}
10085//#endregion
10086//#region node_modules/@azure/msal-browser/dist/crypto/PkceGenerator.mjs

10087/*! @azure/msal-browser v5.13.0 2026-06-10 */
10088var RANDOM_BYTE_ARR_LENGTH = 32;
10089/**
10090* This file defines APIs to generate PKCE codes and code verifiers.
10091*/
10092/**
10093* Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
10094*/
10095async function generatePkceCodes(performanceClient, logger, correlationId) {
10096	const codeVerifier = invoke(generateCodeVerifier, GenerateCodeVerifier, logger, performanceClient, correlationId)(performanceClient, logger, correlationId);
10097	return {
10098		verifier: codeVerifier,
10099		challenge: await invokeAsync(generateCodeChallengeFromVerifier, GenerateCodeChallengeFromVerifier, logger, performanceClient, correlationId)(codeVerifier, performanceClient, logger, correlationId)
10100	};
10101}
10102/**
10103* Generates a random 32 byte buffer and returns the base64
10104* encoded string to be used as a PKCE Code Verifier
10105*/
10106function generateCodeVerifier(performanceClient, logger, correlationId) {
10107	try {
10108		const buffer = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
10109		invoke(getRandomValues, GetRandomValues, logger, performanceClient, correlationId)(buffer);
10110		return urlEncodeArr(buffer);
10111	} catch (e) {
10112		throw createBrowserAuthError(pkceNotCreated);
10113	}
10114}
10115/**
10116* Creates a base64 encoded PKCE Code Challenge string from the
10117* hash created from the PKCE Code Verifier supplied
10118*/
10119async function generateCodeChallengeFromVerifier(pkceCodeVerifier, performanceClient, logger, correlationId) {
10120	try {
10121		const pkceHashedCodeVerifier = await invokeAsync(sha256Digest, Sha256Digest, logger, performanceClient, correlationId)(pkceCodeVerifier);
10122		return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
10123	} catch (e) {
10124		throw createBrowserAuthError(pkceNotCreated);
10125	}
10126}
10127//#endregion
10128//#region node_modules/@azure/msal-browser/dist/navigation/NavigationClient.mjs
10129/*! @azure/msal-browser v5.13.0 2026-06-10 */
10130var NavigationClient = class NavigationClient {
10131	/**
10132	* Navigates to other pages within the same web application
10133	* @param url
10134	* @param options
10135	*/
10136	navigateInternal(url, options) {
10137		return NavigationClient.defaultNavigateWindow(url, options);
10138	}
10139	/**
10140	* Navigates to other pages outside the web application i.e. the Identity Provider
10141	* @param url
10142	* @param options
10143	*/
10144	navigateExternal(url, options) {
10145		return NavigationClient.defaultNavigateWindow(url, options);
10146	}
10147	/**
10148	* Default navigation implementation invoked by the internal and external functions
10149	* @param url
10150	* @param options
10151	*/
10152	static defaultNavigateWindow(url, options) {
10153		if (options.noHistory) window.location.replace(url);
10154		else window.location.assign(url);
10155		return new Promise((resolve, reject) => {
10156			setTimeout(() => {
10157				reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
10158			}, options.timeout);
10159		});
10160	}
10161};
10162//#endregion
10163//#region node_modules/@azure/msal-browser/dist/network/FetchClient.mjs
10164/*! @azure/msal-browser v5.13.0 2026-06-10 */
10165/**
10166* This class implements the Fetch API for GET and POST requests. See more here: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
10167*/
10168var FetchClient = class {
10169	/**
10170	* Fetch Client for REST endpoints - Get request
10171	* @param url
10172	* @param headers
10173	* @param body
10174	*/
10175	async sendGetRequestAsync(url, options) {
10176		let response;
10177		let responseHeaders = {};
10178		let responseStatus = 0;
10179		const reqHeaders = getFetchHeaders(options);
10180		try {
10181			response = await fetch(url, {
10182				method: HTTP_REQUEST_TYPE.GET,
10183				headers: reqHeaders
10184			});
10185		} catch (e) {
10186			throw createNetworkError(createBrowserAuthError(window.navigator.onLine ? getRequestFailed : noNetworkConnectivity), void 0, void 0, e);
10187		}
10188		responseHeaders = getHeaderDict(response.headers);
10189		try {
10190			responseStatus = response.status;
10191			return {
10192				headers: responseHeaders,
10193				body: await response.json(),
10194				status: responseStatus
10195			};
10196		} catch (e) {
10197			throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders, e);
10198		}
10199	}
10200	/**
10201	* Fetch Client for REST endpoints - Post request
10202	* @param url
10203	* @param headers
10204	* @param body
10205	*/
10206	async sendPostRequestAsync(url, options) {
10207		const reqBody = options && options.body || "";
10208		const reqHeaders = getFetchHeaders(options);
10209		let response;
10210		let responseStatus = 0;
10211		let responseHeaders = {};
10212		try {
10213			response = await fetch(url, {
10214				method: HTTP_REQUEST_TYPE.POST,
10215				headers: reqHeaders,
10216				body: reqBody
10217			});
10218		} catch (e) {
10219			throw createNetworkError(createBrowserAuthError(window.navigator.onLine ? postRequestFailed : noNetworkConnectivity), void 0, void 0, e);
10220		}
10221		responseHeaders = getHeaderDict(response.headers);
10222		try {
10223			responseStatus = response.status;
10224			return {
10225				headers: responseHeaders,
10226				body: await response.json(),
10227				status: responseStatus
10228			};
10229		} catch (e) {
10230			throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders, e);
10231		}
10232	}
10233};
10234/**
10235* Get Fetch API Headers object from string map
10236* @param inputHeaders
10237*/
10238function getFetchHeaders(options) {
10239	try {
10240		const headers = new Headers();
10241		if (!(options && options.headers)) return headers;
10242		const optionsHeaders = options.headers;

10243		Object.entries(optionsHeaders).forEach(([key, value]) => {
10244			headers.append(key, value);
10245		});
10246		return headers;
10247	} catch (e) {
10248		throw createNetworkError(createBrowserAuthError(failedToBuildHeaders), void 0, void 0, e);
10249	}
10250}
10251/**
10252* Returns object representing response headers
10253* @param headers
10254* @returns
10255*/
10256function getHeaderDict(headers) {
10257	try {
10258		const headerDict = {};
10259		headers.forEach((value, key) => {
10260			headerDict[key] = value;
10261		});
10262		return headerDict;
10263	} catch (e) {
10264		throw createBrowserAuthError(failedToParseHeaders);
10265	}
10266}
10267/*! @azure/msal-browser v5.13.0 2026-06-10 */
10268var DEFAULT_REDIRECT_TIMEOUT_MS = 3e4;
10269/**
10270* MSAL function that sets the default options when not explicitly configured from app developer
10271*
10272* @param auth
10273* @param cache
10274* @param system
10275*
10276* @returns Configuration object
10277*/
10278function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system: userInputSystem, experimental: userInputExperimental, telemetry: userInputTelemetry }, isBrowserEnvironment) {
10279	const DEFAULT_AUTH_OPTIONS = {
10280		clientId: "",
10281		authority: `${DEFAULT_AUTHORITY}`,
10282		knownAuthorities: [],
10283		cloudDiscoveryMetadata: "",
10284		authorityMetadata: "",
10285		redirectUri: typeof window !== "undefined" && window.location ? window.location.href.split("?")[0].split("#")[0] : "",
10286		postLogoutRedirectUri: "",
10287		clientCapabilities: [],
10288		OIDCOptions: {
10289			responseMode: ResponseMode.FRAGMENT,
10290			defaultScopes: [
10291				OPENID_SCOPE,
10292				PROFILE_SCOPE,
10293				OFFLINE_ACCESS_SCOPE
10294			]
10295		},
10296		azureCloudOptions: {
10297			azureCloudInstance: AzureCloudInstance.None,
10298			tenant: ""
10299		},
10300		instanceAware: false,
10301		isMcp: false,
10302		verifySSO: false
10303	};
10304	const DEFAULT_CACHE_OPTIONS = {
10305		cacheLocation: BrowserCacheLocation.SessionStorage,
10306		cacheRetentionDays: 5
10307	};
10308	const DEFAULT_LOGGER_OPTIONS = {
10309		loggerCallback: () => {},
10310		logLevel: LogLevel.Info,
10311		piiLoggingEnabled: false
10312	};
10313	const providedSystemOptions = {
10314		...DEFAULT_SYSTEM_OPTIONS,
10315		loggerOptions: DEFAULT_LOGGER_OPTIONS,
10316		networkClient: isBrowserEnvironment ? new FetchClient() : StubbedNetworkModule,
10317		navigationClient: new NavigationClient(),
10318		popupBridgeTimeout: userInputSystem?.popupBridgeTimeout || 6e4,
10319		iframeBridgeTimeout: userInputSystem?.iframeBridgeTimeout || 1e4,
10320		redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
10321		allowRedirectInIframe: false,
10322		navigatePopups: true,
10323		allowPlatformBroker: false,
10324		nativeBrokerHandshakeTimeout: userInputSystem?.nativeBrokerHandshakeTimeout || 2e3,
10325		protocolMode: ProtocolMode.AAD,
10326		serverTelemetryEnabled: false,
10327		...userInputSystem,
10328		loggerOptions: userInputSystem?.loggerOptions || DEFAULT_LOGGER_OPTIONS
10329	};
10330	const DEFAULT_TELEMETRY_OPTIONS = {
10331		application: {
10332			appName: "",
10333			appVersion: ""
10334		},
10335		client: new StubPerformanceClient()
10336	};
10337	const DEFAULT_EXPERIMENTAL_OPTIONS = {
10338		iframeTimeoutTelemetry: false,
10339		allowPlatformBrokerWithDOM: false
10340	};
10341	if (userInputSystem?.protocolMode !== ProtocolMode.OIDC && userInputAuth?.OIDCOptions) new Logger(providedSystemOptions.loggerOptions).warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions)), "");
10342	if (userInputSystem?.protocolMode && userInputSystem.protocolMode === ProtocolMode.OIDC && providedSystemOptions?.allowPlatformBroker) throw createClientConfigurationError(cannotAllowPlatformBroker);
10343	return {
10344		auth: {
10345			...DEFAULT_AUTH_OPTIONS,
10346			...userInputAuth,
10347			OIDCOptions: {
10348				...DEFAULT_AUTH_OPTIONS.OIDCOptions,
10349				...userInputAuth?.OIDCOptions
10350			}
10351		},
10352		cache: {
10353			...DEFAULT_CACHE_OPTIONS,
10354			...userInputCache
10355		},
10356		system: providedSystemOptions,
10357		experimental: {
10358			...DEFAULT_EXPERIMENTAL_OPTIONS,
10359			...userInputExperimental
10360		},
10361		telemetry: {
10362			...DEFAULT_TELEMETRY_OPTIONS,
10363			...userInputTelemetry
10364		}
10365	};
10366}
10367//#endregion
10368//#region node_modules/@azure/msal-browser/dist/broker/nativeBroker/PlatformAuthExtensionHandler.mjs
10369/*! @azure/msal-browser v5.13.0 2026-06-10 */
10370var PlatformAuthExtensionHandler = class PlatformAuthExtensionHandler {
10371	constructor(logger, handshakeTimeoutMs, performanceClient, extensionId) {
10372		this.logger = logger;
10373		this.handshakeTimeoutMs = handshakeTimeoutMs;
10374		this.extensionId = extensionId;
10375		this.resolvers = /* @__PURE__ */ new Map();
10376		this.handshakeResolvers = /* @__PURE__ */ new Map();
10377		this.messageChannel = new MessageChannel();
10378		this.windowListener = this.onWindowMessage.bind(this);
10379		this.performanceClient = performanceClient;
10380		this.handshakeEvent = this.performanceClient.startMeasurement(NativeMessageHandlerHandshake);
10381		this.platformAuthType = PlatformAuthConstants.PLATFORM_EXTENSION_PROVIDER;
10382	}
10383	/**
10384	* Sends a given message to the extension and resolves with the extension response
10385	* @param request
10386	*/
10387	async sendMessage(request) {
10388		this.logger.trace("0on4p2", request.correlationId);
10389		const messageBody = {
10390			method: NativeExtensionMethod.GetToken,
10391			request
10392		};
10393		const req = {

10394			channel: PlatformAuthConstants.CHANNEL_ID,
10395			extensionId: this.extensionId,
10396			responseId: createNewGuid(),
10397			body: messageBody
10398		};
10399		this.logger.trace("1qadfi", request.correlationId);
10400		this.logger.tracePii("1xm533", request.correlationId);
10401		this.messageChannel.port1.postMessage(req);
10402		const response = await new Promise((resolve, reject) => {
10403			this.resolvers.set(req.responseId, {
10404				resolve,
10405				reject
10406			});
10407		});
10408		return this.validatePlatformBrokerResponse(response);
10409	}
10410	/**
10411	* Returns an instance of the MessageHandler that has successfully established a connection with an extension
10412	* @param {Logger} logger
10413	* @param {number} handshakeTimeoutMs
10414	* @param {IPerformanceClient} performanceClient
10415	* @param {ICrypto} crypto
10416	*/
10417	static async createProvider(logger, handshakeTimeoutMs, performanceClient, correlationId) {
10418		logger.trace("15zfnw", correlationId);
10419		try {
10420			const preferredProvider = new PlatformAuthExtensionHandler(logger, handshakeTimeoutMs, performanceClient, PlatformAuthConstants.PREFERRED_EXTENSION_ID);
10421			await preferredProvider.sendHandshakeRequest(correlationId);
10422			return preferredProvider;
10423		} catch (e) {
10424			const backupProvider = new PlatformAuthExtensionHandler(logger, handshakeTimeoutMs, performanceClient);
10425			await backupProvider.sendHandshakeRequest(correlationId);
10426			return backupProvider;
10427		}
10428	}
10429	/**
10430	* Send handshake request helper.
10431	*/
10432	async sendHandshakeRequest(correlationId) {
10433		this.logger.trace("1dpg9o", correlationId);
10434		window.addEventListener("message", this.windowListener, false);
10435		const req = {
10436			channel: PlatformAuthConstants.CHANNEL_ID,
10437			extensionId: this.extensionId,
10438			responseId: createNewGuid(),
10439			body: { method: NativeExtensionMethod.HandshakeRequest }
10440		};
10441		this.handshakeEvent.add({
10442			extensionId: this.extensionId,
10443			extensionHandshakeTimeoutMs: this.handshakeTimeoutMs
10444		});
10445		this.messageChannel.port1.onmessage = (event) => {
10446			this.onChannelMessage(event);
10447		};
10448		window.postMessage(req, window.origin, [this.messageChannel.port2]);
10449		return new Promise((resolve, reject) => {
10450			this.handshakeResolvers.set(req.responseId, {
10451				resolve,
10452				reject
10453			});
10454			this.timeoutId = window.setTimeout(() => {
10455				window.removeEventListener("message", this.windowListener, false);
10456				this.messageChannel.port1.close();
10457				this.messageChannel.port2.close();
10458				this.handshakeEvent.end({
10459					extensionHandshakeTimedOut: true,
10460					success: false
10461				});
10462				reject(createBrowserAuthError(nativeHandshakeTimeout));
10463				this.handshakeResolvers.delete(req.responseId);
10464			}, this.handshakeTimeoutMs);
10465		});
10466	}
10467	/**
10468	* Invoked when a message is posted to the window. If a handshake request is received it means the extension is not installed.
10469	* @param event
10470	*/
10471	onWindowMessage(event) {
10472		const correlationId = createGuid();
10473		this.logger.trace("0jpn5u", correlationId);
10474		if (event.source !== window) return;
10475		const request = event.data;
10476		if (!request.channel || request.channel !== PlatformAuthConstants.CHANNEL_ID) return;
10477		if (request.extensionId && request.extensionId !== this.extensionId) return;
10478		if (request.body.method === NativeExtensionMethod.HandshakeRequest) {
10479			const handshakeResolver = this.handshakeResolvers.get(request.responseId);
10480			if (!handshakeResolver) {
10481				this.logger.trace("07buhm", correlationId);
10482				return;
10483			}
10484			this.logger.verbose(request.extensionId ? "0xrkug" : "No extension installed", correlationId);
10485			clearTimeout(this.timeoutId);
10486			this.messageChannel.port1.close();
10487			this.messageChannel.port2.close();
10488			window.removeEventListener("message", this.windowListener, false);
10489			this.handshakeEvent.end({
10490				success: false,
10491				extensionInstalled: false
10492			});
10493			handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
10494		}
10495	}
10496	/**
10497	* Invoked when a message is received from the extension on the MessageChannel port
10498	* @param event
10499	*/
10500	onChannelMessage(event) {
10501		const correlationId = createGuid();
10502		this.logger.trace("1py8yf", correlationId);
10503		const request = event.data;
10504		const resolver = this.resolvers.get(request.responseId);
10505		const handshakeResolver = this.handshakeResolvers.get(request.responseId);
10506		try {
10507			const method = request.body.method;
10508			if (method === NativeExtensionMethod.Response) {
10509				if (!resolver) return;
10510				const response = request.body.response;
10511				this.logger.trace("19hpgm", correlationId);
10512				this.logger.tracePii("179a24", correlationId);
10513				if (response.status !== "Success") resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
10514				else if (response.result) if (response.result["code"] && response.result["description"]) resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
10515				else resolver.resolve(response.result);
10516				else throw createAuthError(unexpectedError, "Event does not contain result.");
10517				this.resolvers.delete(request.responseId);
10518			} else if (method === NativeExtensionMethod.HandshakeResponse) {
10519				if (!handshakeResolver) {
10520					this.logger.trace("082qnt", correlationId);
10521					return;
10522				}
10523				clearTimeout(this.timeoutId);
10524				window.removeEventListener("message", this.windowListener, false);
10525				this.extensionId = request.extensionId;
10526				this.extensionVersion = request.body.version;
10527				this.logger.verbose("0yf5ib", correlationId);
10528				this.handshakeEvent.end({
10529					extensionInstalled: true,
10530					success: true
10531				});
10532				handshakeResolver.resolve();
10533				this.handshakeResolvers.delete(request.responseId);
10534			}
10535		} catch (err) {
10536			this.logger.error("0xf978", correlationId);
10537			this.logger.errorPii("04i99o", correlationId);
10538			this.logger.errorPii("0xdvsy", correlationId);
10539			if (resolver) resolver.reject(err);
10540			else if (handshakeResolver) handshakeResolver.reject(err);
10541		}
10542	}
10543	/**
10544	* Validates native platform response before processing
10545	* @param response
10546	*/
10547	validatePlatformBrokerResponse(response) {
10548		if (response.hasOwnProperty("access_token") && response.hasOwnProperty("id_token") && response.hasOwnProperty("client_info") && response.hasOwnProperty("account") && response.hasOwnProperty("scope") && response.hasOwnProperty("expires_in")) return response;
10549		else throw createAuthError(unexpectedError, "Response missing expected properties.");
10550	}
10551	/**
10552	* Returns the Id for the browser extension this handler is communicating with
10553	* @returns
10554	*/
10555	getExtensionId() {
10556		return this.extensionId;
10557	}
10558	/**
10559	* Returns the version for the browser extension this handler is communicating with
10560	* @returns
10561	*/
10562	getExtensionVersion() {
10563		return this.extensionVersion;
10564	}
10565	getExtensionName() {
10566		return this.getExtensionId() === PlatformAuthConstants.PREFERRED_EXTENSION_ID ? "chrome" : this.getExtensionId()?.length ? "unknown" : void 0;
10567	}
10568};
10569//#endregion
10570//#region node_modules/@azure/msal-browser/dist/broker/nativeBroker/PlatformAuthDOMHandler.mjs

10571/*! @azure/msal-browser v5.13.0 2026-06-10 */
10572var PlatformAuthDOMHandler = class PlatformAuthDOMHandler {
10573	constructor(logger, performanceClient, correlationId) {
10574		this.logger = logger;
10575		this.performanceClient = performanceClient;
10576		this.correlationId = correlationId;
10577		this.platformAuthType = PlatformAuthConstants.PLATFORM_DOM_PROVIDER;
10578	}
10579	static async createProvider(logger, performanceClient, correlationId) {
10580		logger.trace("12mj4a", correlationId);
10581		if (window.navigator?.platformAuthentication) {
10582			if ((await window.navigator.platformAuthentication.getSupportedContracts(PlatformAuthConstants.MICROSOFT_ENTRA_BROKERID))?.includes(PlatformAuthConstants.PLATFORM_DOM_APIS)) {
10583				logger.trace("1h5q1r", correlationId);
10584				return new PlatformAuthDOMHandler(logger, performanceClient, correlationId);
10585			}
10586		}
10587	}
10588	/**
10589	* Returns the Id for the broker extension this handler is communicating with
10590	* @returns
10591	*/
10592	getExtensionId() {
10593		return PlatformAuthConstants.MICROSOFT_ENTRA_BROKERID;
10594	}
10595	getExtensionVersion() {
10596		return "";
10597	}
10598	getExtensionName() {
10599		return PlatformAuthConstants.DOM_API_NAME;
10600	}
10601	/**
10602	* Send token request to platform broker via browser DOM API
10603	* @param request
10604	* @returns
10605	*/
10606	async sendMessage(request) {
10607		this.logger.trace("02bcil", request.correlationId);
10608		try {
10609			const platformDOMRequest = this.initializePlatformDOMRequest(request);
10610			const response = await window.navigator.platformAuthentication.executeGetToken(platformDOMRequest);
10611			return this.validatePlatformBrokerResponse(response, request.correlationId);
10612		} catch (e) {
10613			this.logger.error("11im7g", request.correlationId);
10614			throw e;
10615		}
10616	}
10617	initializePlatformDOMRequest(request) {
10618		this.logger.trace("15d6yv", request.correlationId);
10619		const { accountId, clientId, authority, scope, redirectUri, correlationId, state, storeInCache, embeddedClientId, extraParameters, ...remainingProperties } = request;
10620		const validExtraParameters = this.getDOMExtraParams(remainingProperties, correlationId);
10621		return {
10622			accountId,
10623			brokerId: this.getExtensionId(),
10624			authority,
10625			clientId,
10626			correlationId: correlationId || this.correlationId,
10627			extraParameters: {
10628				...extraParameters,
10629				...validExtraParameters
10630			},
10631			isSecurityTokenService: false,
10632			redirectUri,
10633			scope,
10634			state,
10635			storeInCache,
10636			embeddedClientId
10637		};
10638	}
10639	validatePlatformBrokerResponse(response, correlationId) {
10640		if (response.hasOwnProperty("isSuccess")) {
10641			if (response.hasOwnProperty("accessToken") && response.hasOwnProperty("idToken") && response.hasOwnProperty("clientInfo") && response.hasOwnProperty("account") && response.hasOwnProperty("scopes") && response.hasOwnProperty("expiresIn")) {
10642				this.logger.trace("0h4vei", correlationId);
10643				return this.convertToPlatformBrokerResponse(response, correlationId);
10644			} else if (response.hasOwnProperty("error")) {
10645				const errorResponse = response;
10646				if (errorResponse.isSuccess === false && errorResponse.error && errorResponse.error.code) {
10647					this.logger.trace("0g92vm", correlationId);
10648					throw createNativeAuthError(errorResponse.error.code, errorResponse.error.description, {
10649						error: parseInt(errorResponse.error.errorCode),
10650						protocol_error: errorResponse.error.protocolError,
10651						status: errorResponse.error.status,
10652						properties: errorResponse.error.properties
10653					});
10654				}
10655			}
10656		}
10657		throw createAuthError(unexpectedError, "Response missing expected properties.");
10658	}
10659	convertToPlatformBrokerResponse(response, correlationId) {
10660		this.logger.trace("14913t", correlationId);
10661		return {
10662			access_token: response.accessToken,
10663			id_token: response.idToken,
10664			client_info: response.clientInfo,
10665			account: response.account,
10666			expires_in: response.expiresIn,
10667			scope: response.scopes,
10668			state: response.state || "",
10669			properties: response.properties || {},
10670			extendedLifetimeToken: response.extendedLifetimeToken ?? false,
10671			shr: response.proofOfPossessionPayload
10672		};
10673	}
10674	getDOMExtraParams(extraParameters, correlationId) {
10675		try {
10676			const stringifiedProperties = {};
10677			for (const [key, value] of Object.entries(extraParameters)) {
10678				if (!value) continue;
10679				if (typeof value === "object") stringifiedProperties[key] = JSON.stringify(value);
10680				else stringifiedProperties[key] = String(value);
10681			}
10682			return stringifiedProperties;
10683		} catch (e) {
10684			this.logger.error("0eu9o3", correlationId);
10685			this.logger.errorPii("17rpl5", correlationId);
10686			return {};
10687		}
10688	}
10689};
10690//#endregion
10691//#region node_modules/@azure/msal-browser/dist/broker/nativeBroker/PlatformAuthProvider.mjs

10692/*! @azure/msal-browser v5.13.0 2026-06-10 */
10693async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
10694	logger.trace("134j0v", correlationId);
10695	logger.trace("04c81g", correlationId);
10696	let platformAuthProvider;
10697	try {
10698		if (enablePlatformBrokerDOMSupport) platformAuthProvider = await PlatformAuthDOMHandler.createProvider(logger, performanceClient, correlationId);
10699		if (!platformAuthProvider) {
10700			logger.trace("0l3na8", correlationId);
10701			platformAuthProvider = await PlatformAuthExtensionHandler.createProvider(logger, nativeBrokerHandshakeTimeout || 2e3, performanceClient, correlationId);
10702		}
10703	} catch (e) {
10704		logger.trace("0icbd7", e);
10705	}
10706	return platformAuthProvider;
10707}
10708/**
10709* Returns boolean indicating whether or not the request should attempt to use platform broker
10710* @param logger
10711* @param config
10712* @param correlationId
10713* @param platformAuthProvider
10714* @param authenticationScheme
10715*/
10716function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvider, authenticationScheme) {
10717	logger.trace("0uko3r", correlationId);
10718	if (!config.system.allowPlatformBroker && config.experimental.allowPlatformBrokerWithDOM) throw createClientConfigurationError(invalidPlatformBrokerConfiguration);
10719	if (!config.system.allowPlatformBroker) {
10720		logger.trace("04hozs", correlationId);
10721		return false;
10722	}
10723	if (!platformAuthProvider) {
10724		logger.trace("0kvv1r", correlationId);
10725		return false;
10726	}
10727	if (authenticationScheme) switch (authenticationScheme) {
10728		case AuthenticationScheme.BEARER:
10729		case AuthenticationScheme.POP:
10730			logger.trace("18tev1", correlationId);
10731			return true;
10732		default:
10733			logger.trace("1dd2nh", correlationId);
10734			return false;
10735	}
10736	return true;
10737}
10738//#endregion
10739//#region node_modules/@azure/msal-browser/dist/interaction_client/PopupClient.mjs
10740/*! @azure/msal-browser v5.13.0 2026-06-10 */
10741var PopupClient = class extends StandardInteractionClient {
10742	constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler, waitForPopupResponseHook) {
10743		super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthHandler);
10744		this.nativeStorage = nativeStorageImpl;
10745		this.eventHandler = eventHandler;
10746		this.waitForPopupResponseHook = waitForPopupResponseHook;
10747	}
10748	/**
10749	* Acquires tokens by opening a popup window to the /authorize endpoint of the authority
10750	* @param request
10751	* @param pkceCodes
10752	*/
10753	acquireToken(request, pkceCodes) {
10754		let popupParams = void 0;
10755		try {
10756			popupParams = {
10757				popupName: this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority),
10758				popupWindowAttributes: request.popupWindowAttributes || {},
10759				popupWindowParent: request.popupWindowParent ?? window
10760			};
10761			this.performanceClient.addFields({ isAsyncPopup: !this.config.system.navigatePopups }, this.correlationId);
10762			if (!this.config.system.navigatePopups) {
10763				this.logger.verbose("162h4u", this.correlationId);
10764				return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
10765			} else {
10766				const validatedRequest = {
10767					...request,
10768					httpMethod: validateRequestMethod(request, this.config.system.protocolMode)
10769				};
10770				this.logger.verbose("1f9ok3", this.correlationId);
10771				popupParams.popup = this.openSizedPopup("about:blank", popupParams);
10772				return this.acquireTokenPopupAsync(validatedRequest, popupParams, pkceCodes);
10773			}
10774		} catch (e) {
10775			return Promise.reject(e);
10776		}
10777	}
10778	/**
10779	* Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
10780	* @param logoutRequest
10781	*/
10782	logout(logoutRequest) {
10783		try {
10784			this.logger.verbose("068rup", this.correlationId);
10785			const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
10786			const popupParams = {
10787				popupName: this.generateLogoutPopupName(validLogoutRequest),
10788				popupWindowAttributes: logoutRequest?.popupWindowAttributes || {},
10789				popupWindowParent: logoutRequest?.popupWindowParent ?? window
10790			};
10791			const authority = logoutRequest && logoutRequest.authority;
10792			const mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
10793			if (!this.config.system.navigatePopups) {
10794				this.logger.verbose("1phd8u", this.correlationId);
10795				return this.logoutPopupAsync(validLogoutRequest, popupParams, authority, mainWindowRedirectUri);
10796			} else {
10797				this.logger.verbose("1a28da", this.correlationId);
10798				popupParams.popup = this.openSizedPopup("about:blank", popupParams);
10799				return this.logoutPopupAsync(validLogoutRequest, popupParams, authority, mainWindowRedirectUri);
10800			}
10801		} catch (e) {
10802			return Promise.reject(e);
10803		}
10804	}
10805	/**
10806	* Helper which obtains an access_token for your API via opening a popup window in the user's browser
10807	* @param request
10808	* @param popupParams
10809	* @param pkceCodes
10810	*
10811	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
10812	*/
10813	async acquireTokenPopupAsync(request, popupParams, pkceCodes) {
10814		this.logger.verbose("1g77pg", this.correlationId);
10815		const validRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, InteractionType.Popup, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
10816		if (popupParams.popup) preconnect(validRequest.authority);
10817		validRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, request.authenticationScheme);
10818		if (this.config.system.protocolMode === ProtocolMode.EAR) return this.executeEarFlow(validRequest, popupParams, pkceCodes);
10819		else return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
10820	}
10821	/**
10822	* Executes auth code + PKCE flow
10823	* @param request
10824	* @param popupParams
10825	* @param pkceCodes
10826	* @returns
10827	*/
10828	async executeCodeFlow(request, popupParams, pkceCodes) {
10829		const correlationId = request.correlationId;
10830		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
10831		const pkce = pkceCodes || await invokeAsync(generatePkceCodes, "generatePkceCodes", this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
10832		const popupRequest = {
10833			...request,
10834			codeChallenge: pkce.challenge
10835		};
10836		try {
10837			const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
10838				serverTelemetryManager,
10839				requestAuthority: popupRequest.authority,
10840				requestAzureCloudOptions: popupRequest.azureCloudOptions,
10841				requestExtraQueryParameters: popupRequest.extraQueryParameters,
10842				account: popupRequest.account
10843			});
10844			if (popupRequest.httpMethod === HttpMethod.POST) return await this.executeCodeFlowWithPost(popupRequest, popupParams, authClient, pkce.verifier);
10845			else {
10846				const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
10847				const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
10848				this.eventHandler.emitEvent(EventType.POPUP_OPENED, correlationId, InteractionType.Popup, { popupWindow }, null);
10849				const responseString = await this.waitForPopupResponse(request, popupWindow, popupParams.popupWindowParent);
10850				const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
10851				return await invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
10852			}
10853		} catch (e) {
10854			popupParams.popup?.close();
10855			if (e instanceof AuthError) {
10856				e.setCorrelationId(this.correlationId);
10857				serverTelemetryManager.cacheFailedRequest(e);
10858			}
10859			throw e;
10860		}
10861	}
10862	/**
10863	* Executes EAR flow
10864	* @param request
10865	*/
10866	async executeEarFlow(request, popupParams, pkceCodes) {
10867		const { correlationId, authority, azureCloudOptions, extraQueryParameters, account } = request;
10868		const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, authority, azureCloudOptions, extraQueryParameters, account);
10869		const earJwk = await invokeAsync(generateEarKey, GenerateEarKey, this.logger, this.performanceClient, correlationId)();
10870		const pkce = pkceCodes || await invokeAsync(generatePkceCodes, "generatePkceCodes", this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
10871		const popupRequest = {
10872			...request,
10873			earJwk,

10874			codeChallenge: pkce.challenge
10875		};
10876		const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
10877		(await getEARForm(popupWindow.document, this.config, discoveredAuthority, popupRequest, this.logger, this.performanceClient)).submit();
10878		const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupRequest, popupWindow, popupParams.popupWindowParent);
10879		const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
10880		if (!serverParams.ear_jwe && serverParams.code) {
10881			const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
10882				serverTelemetryManager: initializeServerTelemetryManager(ApiId.acquireTokenPopup, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled),
10883				requestAuthority: request.authority,
10884				requestAzureCloudOptions: request.azureCloudOptions,
10885				requestExtraQueryParameters: request.extraQueryParameters,
10886				account: request.account,
10887				authority: discoveredAuthority
10888			});
10889			return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
10890		} else return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
10891	}
10892	async executeCodeFlowWithPost(request, popupParams, authClient, pkceVerifier) {
10893		const correlationId = request.correlationId;
10894		const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger);
10895		const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
10896		(await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient)).submit();
10897		const responseString = await invokeAsync(this.waitForPopupResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(request, popupWindow, popupParams.popupWindowParent);
10898		const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.responseMode, this.logger, this.correlationId);
10899		return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
10900	}
10901	/**
10902	*
10903	* @param validRequest
10904	* @param popupName
10905	* @param requestAuthority
10906	* @param popup
10907	* @param mainWindowRedirectUri
10908	* @param popupWindowAttributes
10909	*/
10910	async logoutPopupAsync(validRequest, popupParams, requestAuthority, mainWindowRedirectUri) {
10911		this.logger.verbose("0b7yrk", this.correlationId);
10912		this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Popup, validRequest);
10913		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logoutPopup, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
10914		try {
10915			await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validRequest.account);
10916			const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
10917				serverTelemetryManager,
10918				requestAuthority,
10919				account: validRequest.account || void 0
10920			});
10921			try {
10922				authClient.authority.endSessionEndpoint;
10923			} catch {
10924				if (validRequest.account?.homeAccountId && validRequest.postLogoutRedirectUri && authClient.authority.protocolMode === ProtocolMode.OIDC) {
10925					this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, InteractionType.Popup, val

10925idRequest);
10926					if (mainWindowRedirectUri) {
10927						const navigationOptions = {
10928							apiId: ApiId.logoutPopup,
10929							timeout: this.config.system.redirectNavigationTimeout,
10930							noHistory: false
10931						};
10932						const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri());
10933						await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
10934					}
10935					popupParams.popup?.close();
10936					return;
10937				}
10938			}
10939			validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", { interactionType: InteractionType.Popup });
10940			const logoutUri = authClient.getLogoutUri(validRequest);
10941			this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, InteractionType.Popup, validRequest);
10942			const popupWindow = this.openPopup(logoutUri, popupParams);
10943			this.eventHandler.emitEvent(EventType.POPUP_OPENED, validRequest.correlationId, InteractionType.Popup, { popupWindow }, null);
10944			await this.waitForPopupResponse(validRequest, popupWindow, popupParams.popupWindowParent).catch(() => {});
10945			if (mainWindowRedirectUri) {
10946				const navigationOptions = {
10947					apiId: ApiId.logoutPopup,
10948					timeout: this.config.system.redirectNavigationTimeout,
10949					noHistory: false
10950				};
10951				const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri());
10952				this.logger.verbose("0qcur2", this.correlationId);
10953				this.logger.verbosePii("0oj7lk", this.correlationId);
10954				await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
10955			} else this.logger.verbose("03zgcf", this.correlationId);
10956		} catch (e) {
10957			popupParams.popup?.close();
10958			if (e instanceof AuthError) {
10959				e.setCorrelationId(this.correlationId);
10960				serverTelemetryManager.cacheFailedRequest(e);
10961			}
10962			this.eventHandler.emitEvent(EventType.LOGOUT_FAILURE, this.correlationId, InteractionType.Popup, null, e);
10963			this.eventHandler.emitEvent(EventType.LOGOUT_END, this.correlationId, InteractionType.Popup);
10964			throw e;
10965		}
10966		this.eventHandler.emitEvent(EventType.LOGOUT_END, this.correlationId, InteractionType.Popup);
10967	}
10968	/**
10969	* Opens a popup window with given request Url.
10970	* @param requestUrl
10971	*/
10972	initiateAuthRequest(requestUrl, params) {
10973		if (requestUrl) {
10974			this.logger.infoPii("1kcr9k", this.correlationId);
10975			return this.openPopup(requestUrl, params);
10976		} else {
10977			this.logger.error("1l7hyp", this.correlationId);
10978			throw createBrowserAuthError(emptyNavigateUri);
10979		}
10980	}
10981	/**
10982	* @hidden
10983	*
10984	* Configures popup window for login.
10985	*
10986	* @param urlNavigate
10987	* @param title
10988	* @param popUpWidth
10989	* @param popUpHeight
10990	* @param popupWindowAttributes
10991	* @ignore
10992	* @hidden
10993	*/
10994	openPopup(urlNavigate, popupParams) {
10995		try {
10996			let popupWindow;
10997			if (popupParams.popup) {
10998				popupWindow = popupParams.popup;
10999				this.logger.verbosePii("0cgeo7", this.correlationId);
11000				popupWindow.location.assign(urlNavigate);
11001			} else if (typeof popupParams.popup === "undefined") {
11002				this.logger.verbosePii("0c2awd", this.correlationId);
11003				popupWindow = this.openSizedPopup(urlNavigate, popupParams);
11004			}
11005			if (!popupWindow) throw createBrowserAuthError(emptyWindowError);
11006			try {
11007				popupWindow.document.title = "Microsoft Authentication";
11008			} catch (e) {
11009				if (typeof DOMException !== "undefined" && e instanceof DOMException && e.name === "SecurityError") {} else this.logger.verbose("1s1yfs", this.correlationId);
11010			}
11011			if (popupWindow.focus) popupWindow.focus();
11012			this.currentWindow = popupWindow;
11013			return popupWindow;
11014		} catch (e) {
11015			this.logger.error("0dxfb9", this.correlationId);
11016			throw createBrowserAuthError(popupWindowError);
11017		}
11018	}
11019	/**
11020	* Helper function to set popup window dimensions and position
11021	* @param urlNavigate
11022	* @param popupName
11023	* @param popupWindowAttributes
11024	* @returns
11025	*/
11026	openSizedPopup(urlNavigate, { popupName, popupWindowAttributes, popupWindowParent }) {
11027		/**
11028		* adding winLeft and winTop to account for dual monitor
11029		* using screenLeft and screenTop for IE8 and earlier
11030		*/
11031		const winLeft = popupWindowParent.screenLeft ? popupWindowParent.screenLeft : popupWindowParent.screenX;

11032		const winTop = popupWindowParent.screenTop ? popupWindowParent.screenTop : popupWindowParent.screenY;
11033		/**
11034		* window.innerWidth displays browser window"s height and width excluding toolbars
11035		* using document.documentElement.clientWidth for IE8 and earlier
11036		*/
11037		const winWidth = popupWindowParent.innerWidth || document.documentElement.clientWidth || document.body.clientWidth;
11038		const winHeight = popupWindowParent.innerHeight || document.documentElement.clientHeight || document.body.clientHeight;
11039		let width = popupWindowAttributes.popupSize?.width;
11040		let height = popupWindowAttributes.popupSize?.height;
11041		let top = popupWindowAttributes.popupPosition?.top;
11042		let left = popupWindowAttributes.popupPosition?.left;
11043		if (!width || width < 0 || width > winWidth) {
11044			this.logger.verbose("08vfmo", this.correlationId);
11045			width = BrowserConstants.POPUP_WIDTH;
11046		}
11047		if (!height || height < 0 || height > winHeight) {
11048			this.logger.verbose("09cxa0", this.correlationId);
11049			height = BrowserConstants.POPUP_HEIGHT;
11050		}
11051		if (!top || top < 0 || top > winHeight) {
11052			this.logger.verbose("1qh4wo", this.correlationId);
11053			top = Math.max(0, winHeight / 2 - BrowserConstants.POPUP_HEIGHT / 2 + winTop);
11054		}
11055		if (!left || left < 0 || left > winWidth) {
11056			this.logger.verbose("1sz3en", this.correlationId);
11057			left = Math.max(0, winWidth / 2 - BrowserConstants.POPUP_WIDTH / 2 + winLeft);
11058		}
11059		return popupWindowParent.open(urlNavigate, popupName, `width=${width}, height=${height}, top=${top}, left=${left}, scrollbars=yes`);
11060	}
11061	/**
11062	* Generates the name for the popup based on the client id and request
11063	* @param clientId
11064	* @param request
11065	*/
11066	generatePopupName(scopes, authority) {
11067		return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${scopes.join("-")}.${authority}.${this.correlationId}`;
11068	}
11069	/**
11070	* Generates the name for the popup based on the client id and request for logouts
11071	* @param clientId
11072	* @param request
11073	*/
11074	generateLogoutPopupName(request) {
11075		const homeAccountId = request.account && request.account.homeAccountId;
11076		return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
11077	}
11078	async waitForPopupResponse(request, popupWindow, popupWindowParent) {
11079		if (this.waitForPopupResponseHook) return this.waitForPopupResponseHook(request, popupWindow, popupWindowParent);
11080		return waitForBridgeResponse(this.config.system.popupBridgeTimeout, this.logger, request, this.performanceClient);
11081	}
11082};
11083//#endregion
11084//#region node_modules/@azure/msal-browser/dist/interaction_client/RedirectClient.mjs
11085/*! @azure/msal-browser v5.13.0 2026-06-10 */
11086function getNavigationType() {
11087	if (typeof window === "undefined" || typeof window.performance === "undefined" || typeof window.performance.getEntriesByType !== "function") return;
11088	const navigationEntries = window.performance.getEntriesByType("navigation");
11089	return (navigationEntries.length ? navigationEntries[0] : void 0)?.type;
11090}
11091var RedirectClient = class extends StandardInteractionClient {
11092	constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeStorageImpl, correlationId, platformAuthHandler) {
11093		super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthHandler);
11094		this.nativeStorage = nativeStorageImpl;
11095	}
11096	/**
11097	* Redirects the page to the /authorize endpoint of the IDP
11098	* @param request
11099	*/
11100	async acquireToken(request) {
11101		const validRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, InteractionType.Redirect, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
11102		validRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, request.authenticationScheme);
11103		const handleBackButton = (event) => {
11104			if (event.persisted) {
11105				this.logger.verbose("0udvtt", this.correlationId);
11106				this.browserStorage.resetRequestCache(this.correlationId);
11107				this.eventHandler.emitEvent(EventType.RESTORE_FROM_BFCACHE, this.correlationId, InteractionType.Redirect);
11108			}
11109		};
11110		const redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
11111		this.logger.verbosePii("0zao0a", this.correlationId);
11112		this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, redirectStartPage, true);
11113		window.addEventListener("pageshow", handleBackButton);
11114		try {
11115			if (this.config.system.protocolMode === ProtocolMode.EAR) await this.executeEarFlow(validRequest);
11116			else await this.executeCodeFlow(validRequest);
11117		} catch (e) {
11118			if (e instanceof AuthError) e.setCorrelationId(this.correlationId);
11119			window.removeEventListener("pageshow", handleBackButton);
11120			throw e;
11121		}
11122	}
11123	/**
11124	* Executes auth code + PKCE flow
11125	* @param request
11126	* @returns
11127	*/
11128	async executeCodeFlow(request) {
11129		const correlationId = request.correlationId;
11130		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenRedirect, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11131		const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
11132		const redirectRequest = {
11133			...request,
11134			codeChallenge: pkceCodes.challenge
11135		};
11136		this.browserStorage.cacheAuthorizeRequest(redirectRequest, this.correlationId, pkceCodes.verifier);
11137		try {
11138			if (redirectRequest.httpMethod === HttpMethod.POST) return await this.executeCodeFlowWithPost(redirectRequest);
11139			else {
11140				const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
11141					serverTelemetryManager,
11142					requestAuthority: redirectRequest.authority,
11143					requestAzureCloudOptions: redirectRequest.azureCloudOptions,
11144					requestExtraQueryParameters: redirectRequest.extraQueryParameters,
11145					account: redirectRequest.account
11146				});
11147				const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
11148				return await this.initiateAuthRequest(navigateUrl);
11149			}
11150		} catch (e) {
11151			if (e instanceof AuthError) {
11152				e.setCorrelationId(this.correlationId);
11153				serverTelemetryManager.cacheFailedRequest(e);
11154			}
11155			throw e;
11156		}
11157	}
11158	/**
11159	* Executes EAR flow
11160	* @param request
11161	*/
11162	async executeEarFlow(request) {
11163		const { correlationId, authority, azureCloudOptions, extraQueryParameters, account } = request;
11164		const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, authority, azureCloudOptions, extraQueryParameters, account);
11165		const earJwk = await invokeAsync(generateEarKey, GenerateEarKey, this.logger, this.performanceClient, correlationId)();
11166		const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
11167		const redirectRequest = {
11168			...request,
11169			earJwk,

11170			codeChallenge: pkceCodes.challenge
11171		};
11172		this.browserStorage.cacheAuthorizeRequest(redirectRequest, this.correlationId, pkceCodes.verifier);
11173		(await getEARForm(document, this.config, discoveredAuthority, redirectRequest, this.logger, this.performanceClient)).submit();
11174		return new Promise((resolve, reject) => {
11175			setTimeout(() => {
11176				reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
11177			}, this.config.system.redirectNavigationTimeout);
11178		});
11179	}
11180	/**
11181	* Executes classic Authorization Code flow with a POST request.
11182	* @param request
11183	*/
11184	async executeCodeFlowWithPost(request) {
11185		const correlationId = request.correlationId;
11186		const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger);
11187		this.browserStorage.cacheAuthorizeRequest(request, this.correlationId);
11188		(await getCodeForm(document, this.config, discoveredAuthority, request, this.logger, this.performanceClient)).submit();
11189		return new Promise((resolve, reject) => {
11190			setTimeout(() => {
11191				reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
11192			}, this.config.system.redirectNavigationTimeout);
11193		});
11194	}
11195	/**
11196	* Checks if navigateToLoginRequestUrl is set, and:
11197	* - if true, performs logic to cache and navigate
11198	* - if false, handles hash string and parses response
11199	* @param hash {string} url hash
11200	* @param parentMeasurement {InProgressPerformanceEvent} parent measurement
11201	* @param request {CommonAuthorizationUrlRequest} request object
11202	* @param pkceVerifier {string} PKCE verifier
11203	* @param options {HandleRedirectPromiseOptions} options for handling redirect promise
11204	*/
11205	async handleRedirectPromise(request, pkceVerifier, parentMeasurement, options) {
11206		const originalTitle = document.title;
11207		document.title = "Microsoft Authentication";
11208		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.handleRedirectPromise, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11209		const navigateToLoginRequestUrl = options?.navigateToLoginRequestUrl ?? true;
11210		try {
11211			const [serverParams, responseString] = this.getRedirectResponse(options?.hash || "");
11212			if (!serverParams) {
11213				this.logger.info("1qmv0q", this.correlationId);
11214				this.browserStorage.resetRequestCache(this.correlationId);
11215				if (getNavigationType() !== "back_forward") parentMeasurement.event.errorCode = "no_server_response";
11216				else this.logger.verbose("1eqegq", this.correlationId);
11217				return null;
11218			}
11219			const loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, this.correlationId, true) || "";
11220			if (normalizeUrlForComparison(loginRequestUrl, this.logger, this.correlationId) === normalizeUrlForComparison(window.location.href, this.logger, this.correlationId) && navigateToLoginRequestUrl) {
11221				this.logger.verbose("11yred", this.correlationId);
11222				if (loginRequestUrl.indexOf("#") > -1) replaceHash(loginRequestUrl);
11223				return await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
11224			} else if (!navigateToLoginRequestUrl) {
11225				this.logger.verbose("0v4sdv", this.correlationId);
11226				return await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
11227			} else if (!isInIframe() || this.config.system.allowRedirectInIframe) {
11228				this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseString, true);
11229				const navigationOptions = {
11230					apiId: ApiId.handleRedirectPromise,
11231					timeout: this.config.system.redirectNavigationTimeout,
11232					noHistory: true
11233				};
11234				/**
11235				* Default behavior is to redirect to the start page and not process the hash now.
11236				* The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
11237				*/
11238				let processHashOnRedirect = true;
11239				if (!loginRequestUrl) {
11240					const homepage = getHomepage();
11241					this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
11242					this.logger.warning("1dutq1", this.correlationId);
11243					processHashOnRedirect = await this.navigationClient.navigateInternal(homepage, navigationOptions);
11244				} else {
11245					this.logger.verbose("08jpy1", this.correlationId);
11246					processHashOnRedirect = await this.navigationClient.navigateInternal(loginRequestUrl, navigationOptions);
11247				}
11248				if (!processHashOnRedirect) return await this.handleResponse(serverParams, request, pkceVerifier, serverTelemetryManager);
11249			}
11250			return null;
11251		} catch (e) {
11252			if (e instanceof AuthError) {
11253				e.setCorrelationId(this.correlationId);
11254				serverTelemetryManager.cacheFailedRequest(e);
11255			}
11256			throw e;
11257		} finally {
11258			document.title = originalTitle;
11259		}
11260	}
11261	/**
11262	* Gets the response hash for a redirect request
11263	* Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
11264	* @param hash
11265	*/
11266	getRedirectResponse(userProvidedResponse) {
11267		this.logger.verbose("1c5i8m", this.correlationId);
11268		let responseString = userProvidedResponse;
11269		if (!responseString) if (this.config.auth.OIDCOptions.responseMode === ResponseMode.QUERY) responseString = window.location.search;
11270		else responseString = window.location.hash;
11271		let response = getDeserializedResponse(responseString);
11272		if (response) {
11273			try {
11274				validateInteractionType(response, this.browserCrypto, InteractionType.Redirect);
11275			} catch (e) {
11276				if (e instanceof AuthError) this.logger.error("0bkq6p", this.correlationId);
11277				return [null, ""];
11278			}
11279			clearHash(window);
11280			this.logger.verbose("00uvho", this.correlationId);
11281			return [response, responseString];
11282		}
11283		const cachedHash = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.URL_HASH, this.correlationId, true);
11284		this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH));
11285		if (cachedHash) {
11286			response = getDeserializedResponse(cachedHash);
11287			if (response) {
11288				this.logger.verbose("001671", this.correlationId);
11289				return [response, cachedHash];
11290			}
11291		}
11292		return [null, ""];
11293	}
11294	/**
11295	* Checks if hash exists and handles in window.
11296	* @param hash
11297	* @param state
11298	*/
11299	async handleResponse(serverParams, request, codeVerifier, serverTelemetryManager) {
11300		if (!serverParams.state) throw createBrowserAuthError(noStateInHash);
11301		const { authority, azureCloudOptions, extraQueryParameters, account } = request;
11302		if (serverParams.ear_jwe) {
11303			const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, request.correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, authority, azureCloudOptions, extraQueryParameters, account);
11304			return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, request.correlationId)(request, serverParams, ApiId.acquireTokenRedirect, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
11305		}
11306		const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
11307			serverTelemetryManager,
11308			requestAuthority: request.authority
11309		});
11310		return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, codeVerifier, ApiId.acquireTokenRedirect, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
11311	}
11312	/**
11313	* Redirects window to given URL.
11314	* @param urlNavigate
11315	* @param onRedirectNavigateRequest - onRedirectNavigate callback provided on the request
11316	*/
11317	async initiateAuthRequest(requestUrl) {
11318		this.logger.verbose("0yaw2e", this.correlationId);
11319		if (requestUrl) {
11320			this.logger.infoPii("1luf83", this.correlationId);
11321			const navigationOptions = {
11322				apiId: ApiId.acquireTokenRedirect,
11323				timeout: this.config.system.redirectNavigationTimeout,
11324				noHistory: false
11325			};
11326			const onRedirectNavigate = this.config.auth.onRedirectNavigate;
11327			if (typeof onRedirectNavigate === "function") {
11328				this.logger.verbose("1nehvl", this.correlationId);
11329				if (onRedirectNavigate(requestUrl) !== false) {
11330					this.logger.verbose("1a0jxh", this.correlationId);
11331					await this.navigationClient.navigateExternal(requestUrl, navigationOptions);
11332					return;
11333				} else {
11334					this.logger.verbose("09k5h5", this.correlationId);
11335					return;
11336				}
11337			} else {
11338				this.logger.verbose("0klwf7", this.correlationId);
11339				await this.navigationClient.navigateExternal(requestUrl, navigationOptions);
11340				return;
11341			}
11342		} else {
11343			this.logger.info("0rlh4e", this.correlationId);
11344			throw createBrowserAuthError(emptyNavigateUri);
11345		}
11346	}
11347	/**
11348	* Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
11349	* Default behaviour is to redirect the user to `window.location.href`.
11350	* @param logoutRequest
11351	*/
11352	async logout(logoutRequest) {
11353		this.logger.verbose("1rkurh", this.correlationId);

11354		const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
11355		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.logout, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11356		try {
11357			this.eventHandler.emitEvent(EventType.LOGOUT_START, this.correlationId, InteractionType.Redirect, logoutRequest);
11358			await clearCacheOnLogout(this.browserStorage, this.browserCrypto, this.logger, this.correlationId, validLogoutRequest.account);
11359			const navigationOptions = {
11360				apiId: ApiId.logout,
11361				timeout: this.config.system.redirectNavigationTimeout,
11362				noHistory: false
11363			};
11364			const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
11365				serverTelemetryManager,
11366				requestAuthority: logoutRequest && logoutRequest.authority,
11367				requestExtraQueryParameters: logoutRequest?.extraQueryParameters,
11368				account: logoutRequest && logoutRequest.account || void 0
11369			});
11370			if (authClient.authority.protocolMode === ProtocolMode.OIDC) try {
11371				authClient.authority.endSessionEndpoint;
11372			} catch {
11373				if (validLogoutRequest.account?.homeAccountId) {
11374					this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, this.correlationId, InteractionType.Redirect, validLogoutRequest);
11375					return;
11376				}
11377			}
11378			validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", { interactionType: InteractionType.Redirect });
11379			const logoutUri = authClient.getLogoutUri(validLogoutRequest);
11380			if (validLogoutRequest.account?.homeAccountId) this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, this.correlationId, InteractionType.Redirect, validLogoutRequest);
11381			const onRedirectNavigate = this.config.auth.onRedirectNavigate;
11382			if (typeof onRedirectNavigate === "function") if (onRedirectNavigate(logoutUri) !== false) {
11383				this.logger.verbose("06v57e", this.correlationId);
11384				if (!this.browserStorage.getInteractionInProgress()) this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNOUT);
11385				await this.navigationClient.navigateExternal(logoutUri, navigationOptions);
11386				return;
11387			} else {
11388				this.browserStorage.setInteractionInProgress(false);
11389				this.logger.verbose("0xqes1", this.correlationId);
11390			}
11391			else {
11392				if (!this.browserStorage.getInteractionInProgress()) this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNOUT);
11393				await this.navigationClient.navigateExternal(logoutUri, navigationOptions);
11394				return;
11395			}
11396		} catch (e) {
11397			if (e instanceof AuthError) {
11398				e.setCorrelationId(this.correlationId);
11399				serverTelemetryManager.cacheFailedRequest(e);
11400			}
11401			this.eventHandler.emitEvent(EventType.LOGOUT_FAILURE, this.correlationId, InteractionType.Redirect, null, e);
11402			this.eventHandler.emitEvent(EventType.LOGOUT_END, this.correlationId, InteractionType.Redirect);
11403			throw e;
11404		}
11405		this.eventHandler.emitEvent(EventType.LOGOUT_END, this.correlationId, InteractionType.Redirect);
11406	}
11407	/**
11408	* Use to get the redirectStartPage either from request or use current window
11409	* @param requestStartPage
11410	*/
11411	getRedirectStartPage(requestStartPage) {
11412		const redirectStartPage = requestStartPage || window.location.href;
11413		const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
11414		validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
11415		return absoluteRedirectStartPage;
11416	}
11417};
11418//#endregion
11419//#region node_modules/@azure/msal-browser/dist/interaction_handler/SilentHandler.mjs
11420/*! @azure/msal-browser v5.13.0 2026-06-10 */
11421/**
11422* Navigates the given hidden iframe to the provided URL.
11423* @param frame
11424* @param requestUrl
11425*/
11426async function initiateCodeRequest(frame, requestUrl, logger, correlationId) {
11427	if (!requestUrl) {
11428		logger.info("1l7hyp", correlationId);
11429		throw createBrowserAuthError(emptyNavigateUri);
11430	}
11431	frame.src = requestUrl;
11432	return frame;
11433}
11434async function initiateCodeFlowWithPost(frame, config, authority, request, logger, performanceClient) {
11435	if (!frame.contentDocument) throw "No document associated with iframe!";
11436	(await getCodeForm(frame.contentDocument, config, authority, request, logger, performanceClient)).submit();
11437	return frame;
11438}
11439async function initiateEarRequest(frame, config, authority, request, logger, performanceClient) {
11440	if (!frame.contentDocument) throw "No document associated with iframe!";
11441	(await getEARForm(frame.contentDocument, config, authority, request, logger, performanceClient)).submit();
11442	return frame;
11443}
11444/**
11445* @hidden
11446* Creates a new hidden iframe for silent token renewal. Callers navigate it
11447* (set `src` or submit a form) after registering the response listener.
11448* @ignore
11449*/
11450function createHiddenIframe() {
11451	const authFrame = document.createElement("iframe");
11452	authFrame.className = "msalSilentIframe";
11453	authFrame.title = "Microsoft Authentication";
11454	authFrame.style.visibility = "hidden";
11455	authFrame.style.position = "absolute";
11456	authFrame.style.width = authFrame.style.height = "0";
11457	authFrame.style.border = "0";
11458	authFrame.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
11459	authFrame.setAttribute("allow", "local-network-access *");
11460	document.body.appendChild(authFrame);
11461	return authFrame;
11462}
11463/**
11464* @hidden
11465* Removes a hidden iframe from `document.body` if it is a direct child.
11466* @param iframe - The iframe element to remove.
11467*/
11468function removeHiddenIframe(iframe) {
11469	if (document.body === iframe.parentNode) document.body.removeChild(iframe);
11470}
11471//#endregion
11472//#region node_modules/@azure/msal-browser/dist/interaction_client/SilentIframeClient.mjs

11473/*! @azure/msal-browser v5.13.0 2026-06-10 */
11474var SilentIframeClient = class extends StandardInteractionClient {
11475	constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, nativeStorageImpl, correlationId, platformAuthProvider, waitForIframeResponseHook) {
11476		super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider);
11477		this.apiId = apiId;
11478		this.nativeStorage = nativeStorageImpl;
11479		this.waitForIframeResponseHook = waitForIframeResponseHook;
11480	}
11481	/**
11482	* Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
11483	* @param request
11484	*/
11485	async acquireToken(request) {
11486		if (!request.loginHint && !request.sid && (!request.account || !request.account.username)) this.logger.warning("1kl318", this.correlationId);
11487		const inputRequest = { ...request };
11488		if (inputRequest.prompt) {
11489			if (inputRequest.prompt !== PromptValue.NONE && inputRequest.prompt !== PromptValue.NO_SESSION) {
11490				this.logger.warning("0bmctg", this.correlationId);
11491				inputRequest.prompt = PromptValue.NONE;
11492			}
11493		} else inputRequest.prompt = PromptValue.NONE;
11494		const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
11495		silentRequest.platformBroker = isPlatformAuthAllowed(this.config, this.logger, this.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme);
11496		preconnect(silentRequest.authority);
11497		if (this.config.system.protocolMode === ProtocolMode.EAR) return this.executeEarFlow(silentRequest);
11498		else return this.executeCodeFlow(silentRequest);
11499	}
11500	/**
11501	* Executes auth code + PKCE flow
11502	* @param request
11503	* @returns
11504	*/
11505	async executeCodeFlow(request) {
11506		let authClient;
11507		const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11508		try {
11509			authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, request.correlationId)({
11510				serverTelemetryManager,
11511				requestAuthority: request.authority,
11512				requestAzureCloudOptions: request.azureCloudOptions,
11513				requestExtraQueryParameters: request.extraQueryParameters,
11514				account: request.account
11515			});
11516			return await invokeAsync(this.silentTokenHelper.bind(this), SilentIframeClientTokenHelper, this.logger, this.performanceClient, request.correlationId)(authClient, request);
11517		} catch (e) {
11518			if (e instanceof AuthError) {
11519				e.setCorrelationId(this.correlationId);
11520				serverTelemetryManager.cacheFailedRequest(e);
11521			}
11522			if (!authClient || !(e instanceof AuthError) || e.errorCode !== BrowserConstants.INVALID_GRANT_ERROR) throw e;
11523			this.performanceClient.addFields({ retryError: e.errorCode }, this.correlationId);
11524			return await invokeAsync(this.silentTokenHelper.bind(this), SilentIframeClientTokenHelper, this.logger, this.performanceClient, this.correlationId)(authClient, request);
11525		}
11526	}
11527	/**
11528	* Executes EAR flow
11529	* @param request
11530	*/
11531	async executeEarFlow(request) {
11532		const { correlationId, authority, azureCloudOptions, extraQueryParameters, account } = request;
11533		const discoveredAuthority = await invokeAsync(getDiscoveredAuthority, StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, authority, azureCloudOptions, extraQueryParameters, account);
11534		const earJwk = await invokeAsync(generateEarKey, GenerateEarKey, this.logger, this.performanceClient, correlationId)();
11535		const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
11536		const silentRequest = {
11537			...request,
11538			earJwk,

11539			codeChallenge: pkceCodes.challenge
11540		};
11541		const iframe = createHiddenIframe();
11542		const responseType = this.config.auth.OIDCOptions.responseMode;
11543		let responseString;
11544		try {
11545			const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
11546			responsePromise.catch(() => {});
11547			await invokeAsync(initiateEarRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, discoveredAuthority, silentRequest, this.logger, this.performanceClient);
11548			responseString = await responsePromise;
11549		} finally {
11550			invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
11551		}
11552		const serverParams = invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId);
11553		if (!serverParams.ear_jwe && serverParams.code) {
11554			const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, correlationId)({
11555				serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled),
11556				requestAuthority: request.authority,
11557				requestAzureCloudOptions: request.azureCloudOptions,
11558				requestExtraQueryParameters: request.extraQueryParameters,
11559				account: request.account,
11560				authority: discoveredAuthority
11561			});
11562			return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
11563		} else return invokeAsync(handleResponseEAR, HandleResponseEar, this.logger, this.performanceClient, correlationId)(silentRequest, serverParams, this.apiId, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
11564	}
11565	/**
11566	* Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
11567	* This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
11568	* @param request - The SSO silent request
11569	* @returns true if SSO verification was successful with a valid authorization code, false otherwise
11570	*/
11571	async verifySso(request) {
11572		const inputRequest = { ...request };
11573		if (!inputRequest.prompt) inputRequest.prompt = PromptValue.NONE;
11574		const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(inputRequest, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
11575		const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
11576			serverTelemetryManager: initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled),
11577			requestAuthority: silentRequest.authority,
11578			requestAzureCloudOptions: silentRequest.azureCloudOptions,
11579			requestExtraQueryParameters: silentRequest.extraQueryParameters,
11580			account: silentRequest.account
11581		});
11582		const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
11583		const correlationId = silentRequest.correlationId;
11584		validateAuthorizationResponse(serverParams, silentRequest.state);
11585		if (!serverParams.code) {
11586			this.logger.warning("0y34ti", correlationId);
11587			return false;
11588		}
11589		this.logger.verbose("0kkkcj", correlationId);
11590		return true;
11591	}

11592	/**
11593	* Currently Unsupported
11594	*/
11595	logout() {
11596		return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
11597	}
11598	/**
11599	* Helper which acquires an authorization code silently using a hidden iframe from given url
11600	* using the scopes requested as part of the id, and exchanges the code for a set of OAuth tokens.
11601	* @param navigateUrl
11602	* @param userRequestScopes
11603	*/
11604	async silentTokenHelper(authClient, request) {
11605		const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(authClient, request);
11606		return invokeAsync(handleResponseCode, HandleResponseCode, this.logger, this.performanceClient, request.correlationId)(request, serverParams, pkceCodes.verifier, this.apiId, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
11607	}
11608	/**
11609	* Shared helper that generates PKCE codes, builds the /authorize URL,
11610	* loads it in a hidden iframe, waits for the redirect-bridge response,
11611	* and returns the deserialized server parameters along with the PKCE codes
11612	* and the request that was sent.
11613	*/
11614	async silentAuthorizeHelper(authClient, request) {
11615		const correlationId = request.correlationId;
11616		const pkceCodes = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
11617		const silentRequest = {
11618			...request,
11619			codeChallenge: pkceCodes.challenge
11620		};
11621		const iframe = createHiddenIframe();
11622		const responseType = this.config.auth.OIDCOptions.responseMode;
11623		let responseString;
11624		try {
11625			const responsePromise = invokeAsync(this.waitForIframeResponse.bind(this), SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(iframe, request);
11626			responsePromise.catch(() => {});
11627			if (request.httpMethod === HttpMethod.POST) await invokeAsync(initiateCodeFlowWithPost, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
11628			else {
11629				const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
11630				await invokeAsync(initiateCodeRequest, SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(iframe, navigateUrl, this.logger, correlationId);
11631			}
11632			responseString = await responsePromise;
11633		} finally {
11634			invoke(removeHiddenIframe, RemoveHiddenIframe, this.logger, this.performanceClient, correlationId)(iframe);
11635		}
11636		return {
11637			serverParams: invoke(deserializeResponse, DeserializeResponse, this.logger, this.performanceClient, correlationId)(responseString, responseType, this.logger, this.correlationId),
11638			pkceCodes,
11639			silentRequest
11640		};
11641	}
11642	async waitForIframeResponse(iframe, request) {
11643		if (this.waitForIframeResponseHook) return this.waitForIframeResponseHook(iframe, request);
11644		return waitForBridgeResponse(this.config.system.iframeBridgeTimeout, this.logger, request, this.performanceClient, this.config.experimental);
11645	}
11646};
11647//#endregion
11648//#region node_modules/@azure/msal-browser/dist/interaction_client/SilentRefreshClient.mjs
11649/*! @azure/msal-browser v5.13.0 2026-06-10 */
11650var SilentRefreshClient = class extends StandardInteractionClient {
11651	/**
11652	* Exchanges the refresh token for new tokens
11653	* @param request
11654	*/
11655	async acquireToken(request) {
11656		const baseRequest = await invokeAsync(initializeBaseRequest, InitializeBaseRequest, this.logger, this.performanceClient, request.correlationId)(request, this.config, this.performanceClient, this.logger, this.correlationId);
11657		const silentRequest = {
11658			...request,
11659			...baseRequest
11660		};
11661		if (request.redirectUri) silentRequest.redirectUri = getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
11662		const serverTelemetryManager = initializeServerTelemetryManager(ApiId.acquireTokenSilent_silentFlow, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11663		const refreshTokenClient = await this.createRefreshTokenClient({
11664			serverTelemetryManager,
11665			authorityUrl: silentRequest.authority,
11666			azureCloudOptions: silentRequest.azureCloudOptions,
11667			account: silentRequest.account
11668		});
11669		return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch((e) => {
11670			e.setCorrelationId(this.correlationId);
11671			serverTelemetryManager.cacheFailedRequest(e);
11672			throw e;
11673		});
11674	}
11675	/**
11676	* Currently Unsupported
11677	*/
11678	logout() {
11679		return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
11680	}
11681	/**
11682	* Creates a Refresh Client with the given authority, or the default authority.
11683	* @param params {
11684	*         serverTelemetryManager: ServerTelemetryManager;
11685	*         authorityUrl?: string;
11686	*         azureCloudOptions?: AzureCloudOptions;
11687	*         extraQueryParams?: StringDict;
11688	*         account?: AccountInfo;
11689	*        }
11690	*/
11691	async createRefreshTokenClient(params) {
11692		return new RefreshTokenClient(await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
11693			serverTelemetryManager: params.serverTelemetryManager,
11694			requestAuthority: params.authorityUrl,
11695			requestAzureCloudOptions: params.azureCloudOptions,
11696			requestExtraQueryParameters: params.extraQueryParameters,
11697			account: params.account
11698		}), this.performanceClient);
11699	}
11700};
11701//#endregion
11702//#region node_modules/@azure/msal-browser/dist/interaction_client/HybridSpaAuthorizationCodeClient.mjs

11703/*! @azure/msal-browser v5.13.0 2026-06-10 */
11704var HybridSpaAuthorizationCodeClient = class extends AuthorizationCodeClient {
11705	constructor(config, performanceClient) {
11706		super(config, performanceClient);
11707		this.includeRedirectUri = false;
11708	}
11709};
11710//#endregion
11711//#region node_modules/@azure/msal-browser/dist/interaction_client/SilentAuthCodeClient.mjs
11712/*! @azure/msal-browser v5.13.0 2026-06-10 */
11713var SilentAuthCodeClient = class extends StandardInteractionClient {
11714	constructor(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, performanceClient, correlationId, platformAuthProvider) {
11715		super(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, correlationId, platformAuthProvider);
11716		this.apiId = apiId;
11717	}
11718	/**
11719	* Acquires a token silently by redeeming an authorization code against the /token endpoint
11720	* @param request
11721	*/
11722	async acquireToken(request) {
11723		if (!request.code) throw createBrowserAuthError(authCodeRequired);
11724		const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, this.correlationId);
11725		const serverTelemetryManager = initializeServerTelemetryManager(this.apiId, this.config.auth.clientId, this.correlationId, this.browserStorage, this.logger, void 0, this.config.system.serverTelemetryEnabled);
11726		try {
11727			const authCodeRequest = {
11728				...silentRequest,
11729				code: request.code
11730			};
11731			const authClient = new HybridSpaAuthorizationCodeClient(await invokeAsync(this.getClientConfiguration.bind(this), StandardInteractionClientGetClientConfiguration, this.logger, this.performanceClient, this.correlationId)({
11732				serverTelemetryManager,
11733				requestAuthority: silentRequest.authority,
11734				requestAzureCloudOptions: silentRequest.azureCloudOptions,
11735				requestExtraQueryParameters: silentRequest.extraQueryParameters,
11736				account: silentRequest.account
11737			}), this.performanceClient);
11738			this.logger.verbose("1uic5e", this.correlationId);
11739			const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
11740			return await invokeAsync(interactionHandler.handleCodeResponseFromServer.bind(interactionHandler), HandleCodeResponseFromServer, this.logger, this.performanceClient, this.correlationId)({
11741				code: request.code,
11742				msgraph_host: request.msGraphHost,
11743				cloud_graph_host_name: request.cloudGraphHostName,
11744				cloud_instance_host_name: request.cloudInstanceHostName
11745			}, silentRequest, this.apiId, false);
11746		} catch (e) {
11747			if (e instanceof AuthError) {
11748				e.setCorrelationId(this.correlationId);
11749				serverTelemetryManager.cacheFailedRequest(e);
11750			}
11751			throw e;
11752		}
11753	}
11754	/**
11755	* Currently Unsupported
11756	*/
11757	logout() {
11758		return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
11759	}
11760};
11761//#endregion
11762//#region node_modules/@azure/msal-browser/dist/utils/MsalFrameStatsUtils.mjs
11763/*! @azure/msal-browser v5.13.0 2026-06-10 */
11764function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
11765	const frameInstances = window.msal?.clientIds || [];
11766	const msalInstanceCount = frameInstances.length;
11767	const sameClientIdInstanceCount = frameInstances.filter((i) => i === currentClientId).length;
11768	if (sameClientIdInstanceCount > 1) logger.warning("1e88vg", correlationId);
11769	performanceEvent.add({
11770		msalInstanceCount,
11771		sameClientIdInstanceCount
11772	});
11773}
11774//#endregion
11775//#region node_modules/@azure/msal-browser/dist/controllers/StandardController.mjs
11776/*! @azure/msal-browser v5.13.0 2026-06-10 */
11777function preflightCheck(initialized, performanceEvent, config, request) {
11778	try {
11779		preflightCheck$1(initialized);
11780		enforceResourceParameter(config.auth.isMcp, request);
11781	} catch (e) {
11782		performanceEvent.end({ success: false }, e, request.account);
11783		throw e;
11784	}
11785}
11786var StandardController = class StandardController {
11787	/**
11788	* @constructor
11789	* Constructor for the PublicClientApplication used to instantiate the PublicClientApplication object
11790	*
11791	* Important attributes in the Configuration object for auth are:
11792	* - clientID: the application ID of your application. You can obtain one by registering your application with our Application registration portal : https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredAppsPreview
11793	* - authority: the authority URL for your application.
11794	* - redirect_uri: the uri of your application registered in the portal.
11795	*
11796	* In Azure AD, authority is a URL indicating the Azure active directory that MSAL uses to obtain tokens.
11797	* It is of the form https://login.microsoftonline.com/{Enter_the_Tenant_Info_Here}
11798	* If your application supports Accounts in one organizational directory, replace "Enter_the_Tenant_Info_Here" value with the Tenant Id or Tenant name (for example, contoso.microsoft.com).

11799	* If your application supports Accounts in any organizational directory, replace "Enter_the_Tenant_Info_Here" value with organizations.
11800	* If your application supports Accounts in any organizational directory and personal Microsoft accounts, replace "Enter_the_Tenant_Info_Here" value with common.
11801	* To restrict support to Personal Microsoft accounts only, replace "Enter_the_Tenant_Info_Here" value with consumers.
11802	*
11803	* In Azure B2C, authority is of the form https://{instance}/tfp/{tenant}/{policyName}/
11804	* Full B2C functionality will be available in this library in future versions.
11805	*
11806	* @param configuration Object for the MSAL PublicClientApplication instance
11807	*/
11808	constructor(operatingContext) {
11809		this.operatingContext = operatingContext;
11810		this.isBrowserEnvironment = this.operatingContext.isBrowserEnvironment();
11811		this.config = operatingContext.getConfig();
11812		this.initialized = false;
11813		this.logger = this.operatingContext.getLogger();
11814		this.networkClient = this.config.system.networkClient;
11815		this.navigationClient = this.config.system.navigationClient;
11816		this.redirectResponse = /* @__PURE__ */ new Map();
11817		this.hybridAuthCodeResponses = /* @__PURE__ */ new Map();
11818		this.performanceClient = this.config.telemetry.client;
11819		this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient) : DEFAULT_CRYPTO_IMPLEMENTATION;
11820		this.eventHandler = new EventHandler(this.logger);
11821		this.browserStorage = this.isBrowserEnvironment ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler, buildStaticAuthorityOptions(this.config.auth)) : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger, this.performanceClient, this.eventHandler);
11822		const nativeCacheOptions = {
11823			cacheLocation: BrowserCacheLocation.MemoryStorage,
11824			cacheRetentionDays: 5
11825		};
11826		this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
11827		this.activeSilentTokenRequests = /* @__PURE__ */ new Map();
11828		this.trackStateChange = this.trackStateChange.bind(this);
11829		this.trackStateChangeWithMeasurement = this.trackStateChangeWithMeasurement.bind(this);
11830	}
11831	static async createController(operatingContext, request) {
11832		const controller = new StandardController(operatingContext);
11833		await controller.initialize(request);
11834		return controller;
11835	}
11836	trackStateChange(correlationId, event) {
11837		if (!correlationId) return;
11838		if (event.type === "visibilitychange") {
11839			this.logger.info("16v6hv", correlationId);
11840			this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
11841		} else if (event.type === "online") {
11842			this.logger.info("0zirfd", correlationId);
11843			this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
11844		} else if (event.type === "offline") {
11845			this.logger.info("1xk9ef", correlationId);
11846			this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
11847		}
11848	}
11849	/**
11850	* Initializer function to perform async startup tasks such as connecting to WAM extension
11851	* @param request {?InitializeApplicationRequest} correlation id
11852	*/
11853	async initialize(request) {
11854		const correlationId = this.getRequestCorrelationId(request);
11855		this.logger.trace("1f7joy", correlationId);
11856		if (this.initialized) {
11857			this.logger.info("061m5x", correlationId);
11858			return;
11859		}
11860		if (!this.isBrowserEnvironment) {
11861			this.logger.info("19fvpi", correlationId);
11862			this.initialized = true;
11863			this.eventHandler.emitEvent(EventType.INITIALIZE_END, correlationId);
11864			return;
11865		}
11866		const allowPlatformBroker = this.config.system.allowPlatformBroker;
11867		const initMeasurement = this.performanceClient.startMeasurement(InitializeClientApplication, correlationId);
11868		this.eventHandler.emitEvent(EventType.INITIALIZE_START, correlationId);
11869		this.logMultipleInstances(initMeasurement, correlationId);
11870		initMeasurement.add({ isMcp: this.config.auth.isMcp });
11871		await invokeAsync(this.browserStorage.initialize.bind(this.browserStorage), InitializeCache, this.logger, this.performanceClient, correlationId)(correlationId);
11872		if (allowPlatformBroker) try {
11873			this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, correlationId, this.config.system.nativeBrokerHandshakeTimeout, this.config.experimental.allowPlatformBrokerWithDOM);
11874		} catch (e) {
11875			this.logger.verbose(e, correlationId);
11876		}

11877		if (this.config.cache.cacheLocation === BrowserCacheLocation.LocalStorage) this.eventHandler.subscribeCrossTab();
11878		!this.config.system.navigatePopups && await this.preGeneratePkceCodes(correlationId);
11879		this.initialized = true;
11880		this.eventHandler.emitEvent(EventType.INITIALIZE_END, correlationId);
11881		initMeasurement.end({
11882			allowPlatformBroker,
11883			success: true
11884		});
11885	}
11886	/**
11887	* Event handler function which allows users to fire events after the PublicClientApplication object
11888	* has loaded during redirect flows. This should be invoked on all page loads involved in redirect
11889	* auth flows.
11890	* @param hash Hash to process. Defaults to the current value of window.location.hash. Only needs to be provided explicitly if the response to be handled is not contained in the current value.
11891	* @param options Object containing optional configuration for redirect promise handling.
11892	* @returns Token response or null. If the return value is null, then no auth redirect was detected.
11893	*/
11894	async handleRedirectPromise(options) {
11895		this.logger.verbose("02l8bm", "");
11896		blockAPICallsBeforeInitialize(this.initialized);
11897		if (this.isBrowserEnvironment) {
11898			/**
11899			* Store the promise on the PublicClientApplication instance if this is the first invocation of handleRedirectPromise,
11900			* otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
11901			* several times concurrently.
11902			*/
11903			const redirectResponseKey = options?.hash || "";
11904			let response = this.redirectResponse.get(redirectResponseKey);
11905			if (typeof response === "undefined") {
11906				response = this.handleRedirectPromiseInternal(options);
11907				this.redirectResponse.set(redirectResponseKey, response);
11908				this.logger.verbose("1wn9kp", "");
11909			} else this.logger.verbose("0w0gm3", "");
11910			return response;
11911		}
11912		this.logger.verbose("12xi63", "");
11913		return null;
11914	}
11915	/**
11916	* The internal details of handleRedirectPromise. This is separated out to a helper to allow handleRedirectPromise to memoize requests
11917	* @param hash
11918	* @returns
11919	*/
11920	async handleRedirectPromiseInternal(options) {
11921		if (!this.browserStorage.isInteractionInProgress(true)) {
11922			this.logger.info("0le6uv", "");
11923			return null;
11924		}
11925		if (this.browserStorage.getInteractionInProgress()?.type === INTERACTION_TYPE.SIGNOUT) {
11926			this.logger.verbose("1ywcv2", "");
11927			this.browserStorage.setInteractionInProgress(false);
11928			return Promise.resolve(null);
11929		}
11930		const loggedInAccounts = this.getAllAccounts();
11931		const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
11932		const useNative = platformBrokerRequest && !options?.hash;
11933		let rootMeasurement;
11934		let redirectResponse;
11935		let cachedRedirectRequest;
11936		try {
11937			if (useNative && this.platformAuthProvider) {
11938				const correlationId = platformBrokerRequest?.correlationId || "";
11939				this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
11940				rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
11941				this.logger.trace("12v7is", correlationId);
11942				rootMeasurement.add({ isPlatformBrokerRequest: true });
11943				const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
11944				redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
11945			} else {
11946				const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
11947				cachedRedirectRequest = standardRequest;
11948				const correlationId = standardRequest.correlationId;
11949				this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
11950				rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
11951				this.logger.trace("0znzs5", correlationId);
11952				const redirectClient = this.createRedirectClient(correlationId);
11953				redirectResponse = invokeAsync(redirectClient.handleRedirectPromise.bind(redirectClient), HandleRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(standardRequest, codeVerifier, rootMeasurement, options);
11954			}
11955		} catch (e) {
11956			this.browserStorage.resetRequestCache("");
11957			throw e;
11958		}
11959		return redirectResponse.then((result) => {
11960			if (result) {
11961				this.browserStorage.resetRequestCache(result.correlationId);
11962				this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, result.correlationId, InteractionType.Redirect, result);
11963				this.logger.verbose("0ui8f5", result.correlationId);
11964				if (loggedInAccounts.length < this.getAllAccounts().length) {
11965					this.eventHandler.emitEvent(EventType.LOGIN_SUCCESS, result.correlationId, InteractionType.Redirect, result.account);
11966					this.logger.verbose("16im3l", result.correlationId);
11967				}
11968				rootMeasurement.end({ success: true }, void 0, result.account);
11969				this.verifySsoCapability(cachedRedirectRequest, InteractionType.Redirect);
11970			} else if (rootMeasurement.event.errorCode) rootMeasurement.end({ success: false }, void 0);
11971			else rootMeasurement.discard();
11972			this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, rootMeasurement.event.correlationId, InteractionType.Redirect);
11973			return result;
11974		}).catch((e) => {
11975			this.browserStorage.resetRequestCache(rootMeasurement.event.correlationId);
11976			const eventError = e;
11977			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, rootMeasurement.event.correlationId, InteractionType.Redirect, null, eventError);
11978			this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, rootMeasurement.event.correlationId, InteractionType.Redirect);
11979			rootMeasurement.end({ success: false }, eventError);
11980			throw e;
11981		});
11982	}
11983	/**
11984	* Use when you want to obtain an access_token for your API by redirecting the user's browser window to the authorization endpoint. This function redirects
11985	* the page, so any code that follows this function will not execute.
11986	*
11987	* IMPORTANT: It is NOT recommended to have code that is dependent on the resolution of the Promise. This function will navigate away from the current
11988	* browser window. It currently returns a Promise in order to reflect the asynchronous nature of the code running in this function.
11989	*
11990	* @param request
11991	*/
11992	async acquireTokenRedirect(request) {
11993		const correlationId = this.getRequestCorrelationId(request);
11994		this.logger.verbose("0os66p", correlationId);
11995		redirectPreflightCheck(this.initialized, this.config);
11996		this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN);
11997		const atrMeasurement = this.performanceClient.startMeasurement(AcquireTokenPreRedirect, correlationId);
11998		atrMeasurement.add({ scenarioId: request.scenarioId });
11999		const configOnRedirectNavigateCb = this.config.auth.onRedirectNavigate;
12000		this.config.auth.onRedirectNavigate = (url) => {
12001			const navigate = typeof configOnRedirectNavigateCb === "function" ? configOnRedirectNavigateCb

12001(url) : void 0;
12002			atrMeasurement.add({ navigateCallbackResult: navigate !== false });
12003			atrMeasurement.event = atrMeasurement.end({ success: true }, void 0, request.account) || atrMeasurement.event;
12004			return navigate;
12005		};
12006		try {
12007			enforceResourceParameter(this.config.auth.isMcp, request);
12008			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Redirect, request);
12009			let result;
12010			if (this.platformAuthProvider && this.canUsePlatformBroker(request)) {
12011				const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
12012				result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
12013					atrMeasurement.add({
12014						brokerErrorName: e.name,
12015						brokerErrorCode: e.errorCode
12016					});
12017					if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
12018						this.platformAuthProvider = void 0;
12019						return this.createRedirectClient(correlationId).acquireToken(request);
12020					} else if (e instanceof InteractionRequiredAuthError) {
12021						this.logger.verbose("1ipyz4", correlationId);
12022						return this.createRedirectClient(correlationId).acquireToken(request);
12023					}
12024					throw e;
12025				});
12026			} else result = this.createRedirectClient(correlationId).acquireToken(request);
12027			return await result;
12028		} catch (e) {
12029			this.browserStorage.resetRequestCache(correlationId);
12030			if (atrMeasurement.event.status === 2) this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId).end({ success: false }, e, request.account);
12031			else atrMeasurement.end({ success: false }, e, request.account);
12032			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, correlationId, InteractionType.Redirect, null, e);
12033			throw e;
12034		}
12035	}
12036	/**
12037	* Use when you want to obtain an access_token for your API via opening a popup window in the user's browser
12038	*
12039	* @param request
12040	*
12041	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
12042	*/
12043	acquireTokenPopup(request) {
12044		const correlationId = this.getRequestCorrelationId(request);
12045		const atPopupMeasurement = this.performanceClient.startMeasurement(AcquireTokenPopup, correlationId);
12046		atPopupMeasurement.add({ scenarioId: request.scenarioId });
12047		try {
12048			this.logger.verbose("0ch87b", correlationId);
12049			preflightCheck(this.initialized, atPopupMeasurement, this.config, request);
12050			this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNIN, request.overrideInteractionInProgress, correlationId);
12051		} catch (e) {
12052			return Promise.reject(e);
12053		}
12054		const loggedInAccounts = this.getAllAccounts();
12055		this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Popup, request);
12056		let result;
12057		const pkce = this.getPreGeneratedPkceCodes(correlationId);
12058		if (this.canUsePlatformBroker(request)) {
12059			atPopupMeasurement.add({ isPlatformBrokerRequest: true });
12060			result = this.acquireTokenNative({
12061				...request,
12062				correlationId
12063			}, ApiId.acquireTokenPopup).then((response) => {
12064				atPopupMeasurement.end({
12065					success: true,
12066					isNativeBroker: true
12067				}, void 0, response.account);
12068				return response;
12069			}).catch((e) => {
12070				atPopupMeasurement.add({
12071					brokerErrorName: e.name,
12072					brokerErrorCode: e.errorCode
12073				});
12074				if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
12075					this.platformAuthProvider = void 0;
12076					return this.createPopupClient(correlationId).acquireToken(request, pkce);
12077				} else if (e instanceof InteractionRequiredAuthError) {
12078					this.logger.verbose("0yy5fw", correlationId);
12079					return this.createPopupClient(correlationId).acquireToken(request, pkce);
12080				}
12081				throw e;
12082			});
12083		} else result = this.createPopupClient(correlationId).acquireToken(request, pkce);
12084		return result.then((result) => {
12085			const isLoggingIn = loggedInAccounts.length < this.getAllAccounts().length;
12086			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, correlationId, InteractionType.Popup, result);
12087			if (isLoggingIn) this.eventHandler.emitEvent(EventType.LOGIN_SUCCESS, correlationId, InteractionType.Popup, result.account);
12088			atPopupMeasurement.end({
12089				success: true,
12090				accessTokenSize: result.accessToken.length,
12091				idTokenSize: result.idToken.length
12092			}, void 0, result.account);
12093			this.verifySsoCapability(request, InteractionType.Popup);
12094			return result;
12095		}).catch((e) => {
12096			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, correlationId, InteractionType.Popup, null, e);
12097			atPopupMeasurement.end({ success: false }, e, request.account);
12098			return Promise.reject(e);
12099		}).finally(async () => {
12100			this.browserStorage.setInteractionInProgress(false);
12101			if (!this.config.system.navigatePopups) await this.preGeneratePkceCodes(correlationId);
12102		});
12103	}
12104	trackStateChangeWithMeasurement(event) {
12105		const measurement = this.ssoSilentMeasurement || this.acquireTokenByCodeAsyncMeasurement;
12106		if (!measurement) return;
12107		if (event.type === "visibilitychange") {
12108			this.logger.info("0yzimq", measurement.event.correlationId);
12109			measurement.increment({ visibilityChangeCount: 1 });
12110		} else if (event.type === "online") {
12111			this.logger.info("1caf53", measurement.event.correlationId);
12112			measurement.increment({ onlineStatusChangeCount: 1 });
12113		} else if (event.type === "offline") {
12114			this.logger.info("0fdyk7", measurement.event.correlationId);
12115			measurement.increment({ onlineStatusChangeCount: 1 });
12116		}
12117	}
12118	addStateChangeListeners(listener) {
12119		document.addEventListener("visibilitychange", listener);
12120		window.addEventListener("online", listener);
12121		window.addEventListener("offline", listener);
12122	}
12123	removeStateChangeListeners(listener) {
12124		document.removeEventListener("visibilitychange", listener);
12125		window.removeEventListener("online", listener);
12126		window.removeEventListener("offline", listener);
12127	}
12128	/**
12129	* Reads the cached ssoCapable value from localStorage.
12130	* @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
12131	*/
12132	getCachedSsoCapable() {
12133		try {
12134			const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
12135			if (cachedValue) {
12136				const parsed = JSON.parse(cachedValue);
12137				if (parsed && typeof parsed.ssoCapable === "boolean" && parsed.expiresOn && Date.now() < parsed.expiresOn) return parsed.ssoCapable;
12138			}
12139		} catch {}
12140	}
12141	/**
12142	* SSO capability verification in the background.
12143	* This method makes an iframe request to /authorize to verify SSO capability without calling /token.
12144	* This method does not block the caller and tracks telemetry for success/failure.
12145	* This method only executes if verifySSO is set to true in the auth configuration.
12146	* The result is cached in localStorage with a 24-hour TTL; the SSO verification call
12147	* is only attempted when the cached value is absent or expired.
12148	* @param request - The original request used for the authentication flow
12149	* @param interactionType - The interactionType of the AT operation for logging purposes
12150	*/
12151	verifySsoCapability(request, interactionType) {
12152		if (!this.config.auth.verifySSO) return;
12153		const ssoCacheKey = SSO_CAPABLE;
12154		const SSO_CAPABLE_TTL_MS = 1440 * 60 * 1e3;
12155		if (this.getCachedSsoCapable() !== void 0) {
12156			this.logger.verbose("13poou", "");
12157			return;
12158		}
12159		const correlationId = createNewGuid();
12160		const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
12161		ssoCapableMeasurement.add({ "ext.interactionType": interactionType });
12162		this.logger.verbose("0pbr0i", correlationId);
12163		setTimeout(() => {
12164			const ssoVerificationRequest = {
12165				...request,
12166				correlationId
12167			};
12168			this.createSilentIframeClient(correlationId).verifySso(ssoVerificationRequest).then((result) => {
12169				this.logger.verbose("1gd1iv", correlationId);

12170				try {
12171					const cacheEntry = JSON.stringify({
12172						ssoCapable: result,
12173						expiresOn: Date.now() + SSO_CAPABLE_TTL_MS
12174					});
12175					window.localStorage.setItem(ssoCacheKey, cacheEntry);
12176				} catch {
12177					this.logger.warning("18lmoj", correlationId);
12178				}
12179				ssoCapableMeasurement.end({
12180					fromCache: false,
12181					success: result
12182				}, void 0);
12183			}).catch((error) => {
12184				this.logger.warning("05g83w", correlationId);
12185				try {
12186					window.localStorage.removeItem(ssoCacheKey);
12187				} catch {
12188					this.logger.warning("0nlf9q", correlationId);
12189				}
12190				ssoCapableMeasurement.end({
12191					fromCache: false,
12192					success: false
12193				}, error);
12194			});
12195		}, 0);
12196	}
12197	/**
12198	* This function uses a hidden iframe to fetch an authorization code from the eSTS. There are cases where this may not work:
12199	* - Any browser using a form of Intelligent Tracking Prevention
12200	* - If there is not an established session with the service
12201	*
12202	* In these cases, the request must be done inside a popup or full frame redirect.
12203	*
12204	* For the cases where interaction is required, you cannot send a request with prompt=none.
12205	*
12206	* If your refresh token has expired, you can use this function to fetch a new set of tokens silently as long as
12207	* you session on the server still exists.
12208	* @param request {@link SsoSilentRequest}
12209	*
12210	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
12211	*/
12212	async ssoSilent(request) {
12213		const correlationId = this.getRequestCorrelationId(request);
12214		const validRequest = {
12215			...request,
12216			correlationId
12217		};
12218		this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
12219		this.ssoSilentMeasurement?.add({
12220			scenarioId: request.scenarioId,
12221			ssoCapable: this.getCachedSsoCapable()
12222		});
12223		preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
12224		this.ssoSilentMeasurement?.increment({
12225			visibilityChangeCount: 0,
12226			onlineStatusChangeCount: 0
12227		});
12228		this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
12229		const loggedInAccounts = this.getAllAccounts();
12230		this.logger.verbose("0w1b45", correlationId);
12231		this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, validRequest);
12232		let result;
12233		if (this.canUsePlatformBroker(validRequest)) {
12234			this.ssoSilentMeasurement?.add({ isPlatformBrokerRequest: true });
12235			result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
12236				this.ssoSilentMeasurement?.add({
12237					brokerErrorName: e.name,
12238					brokerErrorCode: e.errorCode
12239				});
12240				if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
12241					this.platformAuthProvider = void 0;
12242					return this.createSilentIframeClient(validRequest.correlationId).acquireToken(validRequest);
12243				}
12244				throw e;
12245			});
12246		} else result = this.createSilentIframeClient(validRequest.correlationId).acquireToken(validRequest);
12247		return result.then((response) => {
12248			const isLoggingIn = loggedInAccounts.length < this.getAllAccounts().length;
12249			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, correlationId, InteractionType.Silent, response);
12250			if (isLoggingIn) this.eventHandler.emitEvent(EventType.LOGIN_SUCCESS, correlationId, InteractionType.Silent, response.account);
12251			this.ssoSilentMeasurement?.end({
12252				success: true,
12253				isNativeBroker: response.fromPlatformBroker,
12254				accessTokenSize: response.accessToken.length,
12255				idTokenSize: response.idToken.length
12256			}, void 0, response.account);
12257			return response;
12258		}).catch((e) => {
12259			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, correlationId, InteractionType.Silent, null, e);
12260			this.ssoSilentMeasurement?.end({ success: false }, e, request.account);
12261			throw e;
12262		}).finally(() => {
12263			this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
12264		});
12265	}
12266	/**
12267	* This function redeems an authorization code (passed as code) from the eSTS token endpoint.
12268	* This authorization code should be acquired server-side using a confidential client to acquire a spa_code.
12269	* This API is not indended for normal authorization code acquisition and redemption.
12270	*
12271	* Redemption of this authorization code will not require PKCE, as it was acquired by a confidential client.
12272	*
12273	* @param request {@link AuthorizationCodeRequest}
12274	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
12275	*/
12276	async acquireTokenByCode(request) {
12277		const correlationId = this.getRequestCorrelationId(request);
12278		this.logger.trace("0ch6ga", correlationId);
12279		const atbcMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCode, correlationId);
12280		preflightCheck(this.initialized, atbcMeasurement, this.config, request);
12281		this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, request);
12282		atbcMeasurement.add({ scenarioId: request.scenarioId });
12283		try {
12284			if (request.code && request.nativeAccountId) throw createBrowserAuthError(spaCodeAndNativeAccountIdPresent);
12285			else if (request.code) {
12286				const hybridAuthCode = request.code;
12287				let response = this.hybridAuthCodeResponses.get(hybridAuthCode);
12288				if (!response) {
12289					this.logger.verbose("06eh73", correlationId);
12290					response = this.acquireTokenByCodeAsync({
12291						...request,
12292						correlationId
12293					}).then((result) => {
12294						this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, correlationId, InteractionType.Silent, result);
12295						this.hybridAuthCodeResponses.delete(hybridAuthCode);
12296						atbcMeasurement.end({
12297							success: true,
12298							accessTokenSize: result.accessToken.length,
12299							idTokenSize: result.idToken.length
12300						}, void 0, result.account);
12301						return result;
12302					}).catch((error) => {
12303						this.hybridAuthCodeResponses.delete(hybridAuthCode);
12304						this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, correlationId, InteractionType.Silent, null, error);
12305						atbcMeasurement.end({ success: false }, error);
12306						throw error;
12307					});
12308					this.hybridAuthCodeResponses.set(hybridAuthCode, response);
12309				} else {
12310					this.logger.verbose("0qgp28", correlationId);
12311					atbcMeasurement.discard();
12312				}
12313				return await response;
12314			} else if (request.nativeAccountId) if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
12315				atbcMeasurement.add({ isPlatformBrokerRequest: true });
12316				const result = await this.acquireTokenNative({
12317					...request,
12318					correlationId
12319				}, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
12320					atbcMeasurement.add({
12321						brokerErrorName: e.name,
12322						brokerErrorCode: e.errorCode
12323					});

12324					if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) this.platformAuthProvider = void 0;
12325					throw e;
12326				});
12327				atbcMeasurement.end({ success: true }, void 0, result.account);
12328				return result;
12329			} else throw createBrowserAuthError(unableToAcquireTokenFromNativePlatform);
12330			else throw createBrowserAuthError(authCodeOrNativeAccountIdRequired);
12331		} catch (e) {
12332			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, correlationId, InteractionType.Silent, null, e);
12333			atbcMeasurement.end({ success: false }, e);
12334			throw e;
12335		}
12336	}
12337	/**
12338	* Creates a SilentAuthCodeClient to redeem an authorization code.
12339	* @param request
12340	* @returns Result of the operation to redeem the authorization code
12341	*/
12342	async acquireTokenByCodeAsync(request) {
12343		const correlationId = this.getRequestCorrelationId(request);
12344		this.logger.trace("10d9hy", correlationId);
12345		this.acquireTokenByCodeAsyncMeasurement = this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
12346		this.acquireTokenByCodeAsyncMeasurement?.increment({
12347			visibilityChangeCount: 0,
12348			onlineStatusChangeCount: 0
12349		});
12350		this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
12351		return await this.createSilentAuthCodeClient(correlationId).acquireToken(request).then((response) => {
12352			this.acquireTokenByCodeAsyncMeasurement?.end({
12353				success: true,
12354				fromCache: response.fromCache
12355			});
12356			return response;
12357		}).catch((tokenRenewalError) => {
12358			this.acquireTokenByCodeAsyncMeasurement?.end({ success: false }, tokenRenewalError);
12359			throw tokenRenewalError;
12360		}).finally(() => {
12361			this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
12362		});
12363	}
12364	/**
12365	* Attempt to acquire an access token from the cache
12366	* @param silentCacheClient SilentCacheClient
12367	* @param commonRequest CommonSilentFlowRequest
12368	* @param silentRequest SilentRequest
12369	* @returns A promise that, when resolved, returns the access token
12370	*/
12371	async acquireTokenFromCache(commonRequest, cacheLookupPolicy) {
12372		switch (cacheLookupPolicy) {
12373			case CacheLookupPolicy.Default:
12374			case CacheLookupPolicy.AccessToken:
12375			case CacheLookupPolicy.AccessTokenAndRefreshToken:
12376				const silentCacheClient = this.createSilentCacheClient(commonRequest.correlationId);
12377				return invokeAsync(silentCacheClient.acquireToken.bind(silentCacheClient), SilentCacheClientAcquireToken, this.logger, this.performanceClient, commonRequest.correlationId)(commonRequest);
12378			default: throw createClientAuthError(tokenRefreshRequired);
12379		}
12380	}
12381	/**
12382	* Attempt to acquire an access token via a refresh token
12383	* @param commonRequest CommonSilentFlowRequest
12384	* @param cacheLookupPolicy CacheLookupPolicy
12385	* @returns A promise that, when resolved, returns the access token
12386	*/
12387	async acquireTokenByRefreshToken(commonRequest, cacheLookupPolicy) {
12388		switch (cacheLookupPolicy) {
12389			case CacheLookupPolicy.Default:
12390			case CacheLookupPolicy.AccessTokenAndRefreshToken:
12391			case CacheLookupPolicy.RefreshToken:
12392			case CacheLookupPolicy.RefreshTokenAndNetwork:
12393				const silentRefreshClient = this.createSilentRefreshClient(commonRequest.correlationId);
12394				return invokeAsync(silentRefreshClient.acquireToken.bind(silentRefreshClient), SilentRefreshClientAcquireToken, this.logger, this.performanceClient, commonRequest.correlationId)(commonRequest);
12395			default: throw createClientAuthError(tokenRefreshRequired);
12396		}
12397	}
12398	/**
12399	* Attempt to acquire an access token via an iframe
12400	* @param request CommonSilentFlowRequest
12401	* @returns A promise that, when resolved, returns the access token
12402	*/
12403	async acquireTokenBySilentIframe(request) {
12404		const silentIframeClient = this.createSilentIframeClient(request.correlationId);
12405		return invokeAsync(silentIframeClient.acquireToken.bind(silentIframeClient), SilentIframeClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(request);
12406	}
12407	/**
12408	* Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
12409	* Default behaviour is to redirect the user to `window.location.href`.
12410	* @param logoutRequest
12411	*/
12412	async logoutRedirect(logoutRequest) {
12413		const correlationId = this.getRequestCorrelationId(logoutRequest);
12414		redirectPreflightCheck(this.initialized, this.config);
12415		this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNOUT);
12416		return this.createRedirectClient(correlationId).logout(logoutRequest);
12417	}
12418	/**
12419	* Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
12420	* @param logoutRequest
12421	*/
12422	logoutPopup(logoutRequest) {
12423		try {
12424			const correlationId = this.getRequestCorrelationId(logoutRequest);
12425			preflightCheck$1(this.initialized);
12426			this.browserStorage.setInteractionInProgress(true, INTERACTION_TYPE.SIGNOUT);
12427			return this.createPopupClient(correlationId).logout(logoutRequest).finally(() => {
12428				this.browserStorage.setInteractionInProgress(false);
12429			});
12430		} catch (e) {
12431			return Promise.reject(e);
12432		}
12433	}
12434	/**
12435	* Creates a cache interaction client to clear broswer cache.
12436	* @param logoutRequest
12437	*/
12438	async clearCache(logoutRequest) {
12439		if (!this.isBrowserEnvironment) return;
12440		const correlationId = this.getRequestCorrelationId(logoutRequest);
12441		return this.createSilentCacheClient(correlationId).logout(logoutRequest);
12442	}
12443	/**
12444	* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
12445	* @param accountFilter - (Optional) filter to narrow down the accounts returned
12446	* @returns Array of AccountInfo objects in cache
12447	*/
12448	getAllAccounts(accountFilter) {
12449		return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, this.getRequestCorrelationId(), accountFilter);
12450	}
12451	/**
12452	* Returns the first account found in the cache that matches the account filter passed in.
12453	* @param accountFilter
12454	* @returns The first account found in the cache matching the provided filter or null if no account could be found.
12455	*/
12456	getAccount(accountFilter) {
12457		return getAccount(accountFilter, this.logger, this.browserStorage, this.getRequestCorrelationId());
12458	}
12459	/**
12460	* Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
12461	* @param account
12462	*/
12463	setActiveAccount(account) {
12464		setActiveAccount(account, this.browserStorage, this.getRequestCorrelationId());
12465	}
12466	/**
12467	* Gets the currently active account
12468	*/
12469	getActiveAccount() {
12470		return getActiveAccount(this.browserStorage, this.getRequestCorrelationId());
12471	}
12472	/**
12473	* Hydrates the cache with the tokens from an AuthenticationResult
12474	* @param result
12475	* @param request
12476	* @returns
12477	*/
12478	async hydrateCache(result, request) {
12479		this.logger.verbose("16jycr", result.correlationId);
12480		const accountEntity = createAccountEntityFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
12481		await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims), ApiId.hydrateCache);
12482		if (result.fromPlatformBroker) {
12483			this.logger.verbose("1i5atf", result.correlationId);
12484			const idTokenEntity = createIdTokenEntity(result.account.homeAccountId, result.account.environment, result.idToken, this.config.auth.clientId, result.tenantId);
12485			const accessTokenEntity = createAccessTokenEntity(result.account.homeAccountId, result.account.environment, result.accessToken, this.config.auth.clientId, result.tenantId, result.scopes.join(" "), result.expiresOn ? toSecondsFromDate(result.expiresOn) : 0, result.extExpiresOn ? toSecondsFromDate(result.extExpiresOn) : 0, base64Decode, void 0, result.tokenType, void 0, request.sshKid);
12486			if (request.resource) accessTokenEntity.resource = request.resource;

12487			const kmsi = isKmsi(result.idTokenClaims);
12488			await this.browserStorage.setIdTokenCredential(idTokenEntity, result.correlationId, kmsi);
12489			await this.nativeInternalStorage.setAccessTokenCredential(accessTokenEntity, result.correlationId, kmsi);
12490		} else return this.browserStorage.hydrateCache(result, request);
12491	}
12492	/**
12493	* Acquire a token from native device (e.g. WAM)
12494	* @param request
12495	*/
12496	async acquireTokenNative(request, apiId, accountId, cacheLookupPolicy) {
12497		const correlationId = this.getRequestCorrelationId(request);
12498		this.logger.trace("0b9y3p", correlationId);
12499		if (!this.platformAuthProvider) throw createBrowserAuthError(nativeConnectionNotEstablished);
12500		const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
12501		return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
12502	}
12503	/**
12504	* Returns boolean indicating if this request can use the platform broker
12505	* @param request
12506	*/
12507	canUsePlatformBroker(request, accountId) {
12508		const correlationId = this.getRequestCorrelationId(request);
12509		this.logger.trace("1n9lbl", correlationId);
12510		if (!this.platformAuthProvider) {
12511			this.logger.trace("0vnu11", correlationId);
12512			return false;
12513		}
12514		if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
12515			this.logger.trace("0yoy1g", correlationId);
12516			return false;
12517		}
12518		if (request.prompt) switch (request.prompt) {
12519			case PromptValue.NONE:
12520			case PromptValue.CONSENT:
12521			case PromptValue.LOGIN:
12522				this.logger.trace("0vdv8e", correlationId);
12523				break;
12524			default:
12525				this.logger.trace("0pdzw6", correlationId);
12526				return false;
12527		}
12528		if (!accountId && !this.getNativeAccountId(request)) {
12529			this.logger.trace("16lbtk", correlationId);
12530			return false;
12531		}
12532		return true;
12533	}
12534	/**
12535	* Get the native accountId from the account
12536	* @param request
12537	* @returns
12538	*/
12539	getNativeAccountId(request) {
12540		const account = request.account || this.getAccount({
12541			loginHint: request.loginHint,
12542			sid: request.sid
12543		}) || (!request.loginHint && !request.sid ? this.getActiveAccount() : null);
12544		return account && account.nativeAccountId || "";
12545	}
12546	/**
12547	* Returns new instance of the Popup Interaction Client
12548	* @param correlationId
12549	*/
12550	createPopupClient(correlationId) {
12551		return new PopupClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForPopupResponse);
12552	}
12553	/**
12554	* Returns new instance of the Redirect Interaction Client
12555	* @param correlationId
12556	*/
12557	createRedirectClient(correlationId) {
12558		return new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider);
12559	}
12560	/**
12561	* Returns new instance of the Silent Iframe Interaction Client
12562	* @param correlationId
12563	*/
12564	createSilentIframeClient(correlationId) {
12565		return new SilentIframeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.ssoSilent, this.performanceClient, this.nativeInternalStorage, correlationId, this.platformAuthProvider, this.operatingContext.getResponseHandlers()?.waitForIframeResponse);
12566	}
12567	/**
12568	* Returns new instance of the Silent Cache Interaction Client
12569	*/
12570	createSilentCacheClient(correlationId) {
12571		return new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId, this.platformAuthProvider);
12572	}
12573	/**
12574	* Returns new instance of the Silent Refresh Interaction Client
12575	*/
12576	createSilentRefreshClient(correlationId) {
12577		return new SilentRefreshClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, correlationId, this.platformAuthProvider);
12578	}
12579	/**
12580	* Returns new instance of the Silent AuthCode Interaction Client
12581	*/
12582	createSilentAuthCodeClient(correlationId) {
12583		return new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenByCode, this.performanceClient, correlationId, this.platformAuthProvider);
12584	}
12585	/**
12586	* Adds event callbacks to array
12587	* @param callback
12588	*/
12589	addEventCallback(callback, eventTypes) {
12590		return this.eventHandler.addEventCallback(callback, eventTypes);
12591	}
12592	/**
12593	* Removes callback with provided id from callback array
12594	* @param callbackId
12595	*/
12596	removeEventCallback(callbackId) {
12597		this.eventHandler.removeEventCallback(callbackId);
12598	}
12599	/**
12600	* Registers a callback to receive performance events.
12601	*
12602	* @param {PerformanceCallbackFunction} callback
12603	* @returns {string}
12604	*/
12605	addPerformanceCallback(callback) {
12606		blockNonBrowserEnvironment();
12607		return this.performanceClient.addPerformanceCallback(callback);
12608	}
12609	/**
12610	* Removes a callback registered with addPerformanceCallback.
12611	*
12612	* @param {string} callbackId
12613	* @returns {boolean}
12614	*/
12615	removePerformanceCallback(callbackId) {
12616		return this.performanceClient.removePerformanceCallback(callbackId);
12617	}
12618	/**
12619	* Returns the logger instance
12620	*/
12621	getLogger() {
12622		return this.logger;
12623	}

12624	/**
12625	* Replaces the default logger set in configurations with new Logger with new configurations
12626	* @param logger Logger instance
12627	*/
12628	setLogger(logger) {
12629		this.logger = logger;
12630	}
12631	/**
12632	* Called by wrapper libraries (Angular & React) to set SKU and Version passed down to telemetry, logger, etc.
12633	* @param sku
12634	* @param version
12635	*/
12636	initializeWrapperLibrary(sku, version) {
12637		this.browserStorage.setWrapperMetadata(sku, version);
12638	}
12639	/**
12640	* Sets navigation client
12641	* @param navigationClient
12642	*/
12643	setNavigationClient(navigationClient) {
12644		this.navigationClient = navigationClient;
12645	}
12646	/**
12647	* Returns the configuration object
12648	*/
12649	getConfiguration() {
12650		return this.config;
12651	}
12652	/**
12653	* Returns the performance client
12654	*/
12655	getPerformanceClient() {
12656		return this.performanceClient;
12657	}
12658	/**
12659	* Returns the browser env indicator
12660	*/
12661	isBrowserEnv() {
12662		return this.isBrowserEnvironment;
12663	}
12664	/**
12665	* Generates a correlation id for a request if none is provided.
12666	*
12667	* @protected
12668	* @param {?Partial<BaseAuthRequest>} [request]
12669	* @returns {string}
12670	*/
12671	getRequestCorrelationId(request) {
12672		if (request?.correlationId) return request.correlationId;
12673		if (this.isBrowserEnvironment) return createNewGuid();
12674		return "";
12675	}
12676	/**
12677	* Use when initiating the login process by redirecting the user's browser to the authorization endpoint. This function redirects the page, so
12678	* any code that follows this function will not execute.
12679	*
12680	* IMPORTANT: It is NOT recommended to have code that is dependent on the resolution of the Promise. This function will navigate away from the current
12681	* browser window. It currently returns a Promise in order to reflect the asynchronous nature of the code running in this function.
12682	*
12683	* @param request
12684	*/
12685	async loginRedirect(request) {
12686		const correlationId = this.getRequestCorrelationId(request);
12687		this.logger.verbose("0lz9hf", correlationId);
12688		return this.acquireTokenRedirect({
12689			correlationId,
12690			...request || DEFAULT_REQUEST
12691		});
12692	}
12693	/**
12694	* Use when initiating the login process via opening a popup window in the user's browser
12695	*
12696	* @param request
12697	*
12698	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
12699	*/
12700	loginPopup(request) {
12701		const correlationId = this.getRequestCorrelationId(request);
12702		this.logger.verbose("0qw7v5", correlationId);
12703		return this.acquireTokenPopup({
12704			correlationId,
12705			...request || DEFAULT_REQUEST
12706		});
12707	}
12708	/**
12709	* Silently acquire an access token for a given set of scopes. Returns currently processing promise if parallel requests are made.
12710	*
12711	* @param {@link (SilentRequest:type)}
12712	* @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse} object
12713	*/
12714	async acquireTokenSilent(request) {
12715		const correlationId = this.getRequestCorrelationId(request);
12716		const atsMeasurement = this.performanceClient.startMeasurement(AcquireTokenSilent, correlationId);
12717		atsMeasurement.add({
12718			cacheLookupPolicy: request.cacheLookupPolicy,
12719			scenarioId: request.scenarioId,
12720			ssoCapable: this.getCachedSsoCapable()
12721		});
12722		preflightCheck(this.initialized, atsMeasurement, this.config, request);
12723		this.logger.verbose("0x1c4s", correlationId);
12724		const account = request.account || this.getActiveAccount();
12725		if (!account) throw createBrowserAuthError(noAccountError);
12726		return this.acquireTokenSilentDeduped(request, account, correlationId).then((result) => {
12727			atsMeasurement.end({
12728				success: true,
12729				fromCache: result.fromCache,
12730				accessTokenSize: result.accessToken.length,
12731				idTokenSize: result.idToken.length
12732			}, void 0, result.account);
12733			return {
12734				...result,
12735				state: request.state,
12736				correlationId
12737			};
12738		}).catch((error) => {
12739			if (error instanceof AuthError) error.setCorrelationId(correlationId);
12740			atsMeasurement.end({ success: false }, error, account);
12741			throw error;
12742		});
12743	}
12744	/**
12745	* Checks if identical request is already in flight and returns reference to the existing promise or fires off a new one if this is the first
12746	* @param request
12747	* @param account
12748	* @param correlationId
12749	* @returns
12750	*/
12751	async acquireTokenSilentDeduped(request, account, correlationId) {
12752		const thumbprint = getRequestThumbprint(this.config.auth.clientId, {
12753			...request,
12754			authority: request.authority || this.config.auth.authority,
12755			correlationId
12756		}, account.homeAccountId);

12757		const silentRequestKey = JSON.stringify(thumbprint);
12758		const inProgressRequest = this.activeSilentTokenRequests.get(silentRequestKey);
12759		if (typeof inProgressRequest === "undefined") {
12760			this.logger.verbose("0fcjbk", correlationId);
12761			this.performanceClient.addFields({ deduped: false }, correlationId);
12762			const activeRequest = invokeAsync(this.acquireTokenSilentAsync.bind(this), AcquireTokenSilentAsync, this.logger, this.performanceClient, correlationId)({
12763				...request,
12764				correlationId
12765			}, account);
12766			this.activeSilentTokenRequests.set(silentRequestKey, activeRequest);
12767			return activeRequest.finally(() => {
12768				this.activeSilentTokenRequests.delete(silentRequestKey);
12769			});
12770		} else {
12771			this.logger.verbose("1yq7nb", correlationId);
12772			this.performanceClient.addFields({ deduped: true }, correlationId);
12773			return inProgressRequest;
12774		}
12775	}
12776	/**
12777	* Silently acquire an access token for a given set of scopes. Will use cached token if available, otherwise will attempt to acquire a new token from the network via refresh token.
12778	* @param {@link (SilentRequest:type)}
12779	* @param {@link (AccountInfo:type)}
12780	* @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
12781	*/
12782	async acquireTokenSilentAsync(request, account) {
12783		const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
12784		this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, InteractionType.Silent, request);
12785		if (request.correlationId) this.performanceClient.incrementFields({
12786			visibilityChangeCount: 0,
12787			onlineStatusChangeCount: 0
12788		}, request.correlationId);
12789		this.addStateChangeListeners(trackStateChange);
12790		const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
12791		const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
12792		return this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
12793			if (checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy)) {
12794				const silentRefreshReason = `${refreshTokenError.errorCode}${refreshTokenError.subError ? `|${refreshTokenError.subError}` : ""}`;
12795				this.performanceClient.addFields({ silentRefreshReason }, request.correlationId);
12796				if (!this.activeIframeRequest) {
12797					let _resolve;
12798					this.activeIframeRequest = [new Promise((resolve) => {
12799						_resolve = resolve;
12800					}), silentRequest.correlationId];
12801					this.logger.verbose("0rh08z", silentRequest.correlationId);
12802					return invokeAsync(this.acquireTokenBySilentIframe.bind(this), AcquireTokenBySilentIframe, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest).then((iframeResult) => {
12803						_resolve(true);
12804						return iframeResult;
12805					}).catch((e) => {
12806						_resolve(false);
12807						throw e;
12808					}).finally(() => {
12809						this.activeIframeRequest = void 0;
12810					});
12811				} else if (cacheLookupPolicy !== CacheLookupPolicy.Skip) {
12812					const [activePromise, activeCorrelationId] = this.activeIframeRequest;
12813					this.logger.verbose("1w8fso", silentRequest.correlationId);
12814					const awaitConcurrentIframeMeasure = this.performanceClient.startMeasurement(AwaitConcurrentIframe, silentRequest.correlationId);
12815					awaitConcurrentIframeMeasure.add({ awaitIframeCorrelationId: activeCorrelationId });
12816					const activePromiseResult = await activePromise;
12817					awaitConcurrentIframeMeasure.end({ success: activePromiseResult });
12818					if (activePromiseResult) {
12819						this.logger.verbose("0ywzzi", silentRequest.correlationId);
12820						return this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy);
12821					} else {
12822						this.logger.info("17y14q", silentRequest.correlationId);
12823						throw refreshTokenError;
12824					}
12825				} else {
12826					this.logger.warning("1bd4p8", silentRequest.correlationId);
12827					return invokeAsync(this.acquireTokenBySilentIframe.bind(this), AcquireTokenBySilentIframe, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
12828				}
12829			} else throw refreshTokenError;
12830		}).then((response) => {
12831			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, request.correlationId, InteractionType.Silent, response);
12832			if (request.correlationId) this.performanceClient.addFields({
12833				fromCache: response.fromCache,
12834				isNativeBroker: response.fromPlatformBroker
12835			}, request.correlationId);
12836			return response;
12837		}).catch((tokenRenewalError) => {
12838			this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, request.correlationId, InteractionType.Silent, null, token

12838RenewalError);
12839			throw tokenRenewalError;
12840		}).finally(() => {
12841			this.removeStateChangeListeners(trackStateChange);
12842		});
12843	}
12844	/**
12845	* AcquireTokenSilent without the iframe fallback. This is used to enable the correct fallbacks in cases where there's a potential for multiple silent requests to be made in parallel and prevent those requests from making concurrent iframe requests.
12846	* @param silentRequest
12847	* @param cacheLookupPolicy
12848	* @returns
12849	*/
12850	async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
12851		if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) && silentRequest.account.nativeAccountId) {
12852			this.logger.verbose("0sczo4", silentRequest.correlationId);
12853			this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
12854			return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
12855				this.performanceClient.addFields({
12856					brokerErrorName: e.name,
12857					brokerErrorCode: e.errorCode
12858				}, silentRequest.correlationId);
12859				if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
12860					this.logger.verbose("07rkmb", silentRequest.correlationId);
12861					this.platformAuthProvider = void 0;
12862					throw createClientAuthError(tokenRefreshRequired);
12863				}
12864				throw e;
12865			});
12866		} else {
12867			this.logger.verbose("0ox81t", silentRequest.correlationId);
12868			if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) this.logger.verbose("0fvwxe", silentRequest.correlationId);
12869			return invokeAsync(this.acquireTokenFromCache.bind(this), AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
12870				if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) throw cacheError;
12871				this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_NETWORK_START, silentRequest.correlationId, InteractionType.Silent, silentRequest);
12872				return invokeAsync(this.acquireTokenByRefreshToken.bind(this), AcquireTokenByRefreshToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy);
12873			});
12874		}
12875	}
12876	/**
12877	* Pre-generates PKCE codes and stores it in local variable
12878	* @param correlationId
12879	*/
12880	async preGeneratePkceCodes(correlationId) {
12881		this.logger.verbose("1x6uj6", correlationId);
12882		this.pkceCode = await invokeAsync(generatePkceCodes, GeneratePkceCodes, this.logger, this.performanceClient, correlationId)(this.performanceClient, this.logger, correlationId);
12883		return Promise.resolve();
12884	}
12885	/**
12886	* Provides pre-generated PKCE codes, if any
12887	* @param correlationId
12888	*/
12889	getPreGeneratedPkceCodes(correlationId) {
12890		const res = this.pkceCode ? { ...this.pkceCode } : void 0;
12891		this.pkceCode = void 0;
12892		if (res) this.logger.verbose("12js1o", correlationId);
12893		else this.logger.verbose("1oe9ci", correlationId);
12894		this.performanceClient.addFields({ usePreGeneratedPkce: !!res }, correlationId);
12895		return res;
12896	}
12897	logMultipleInstances(performanceEvent, correlationId) {
12898		const clientId = this.config.auth.clientId;
12899		if (!window) return;
12900		window.msal = window.msal || {};
12901		window.msal.clientIds = window.msal.clientIds || [];
12902		if (window.msal.clientIds.length > 0) this.logger.verbose("1qtz3l", correlationId);
12903		window.msal.clientIds.push(clientId);
12904		collectInstanceStats(clientId, performanceEvent, this.logger, correlationId);
12905	}
12906};
12907/**
12908* Determines whether an error thrown by the refresh token endpoint can be resolved without interaction
12909* @param refreshTokenError
12910* @param silentRequest
12911* @param cacheLookupPolicy
12912* @returns
12913*/
12914function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy) {
12915	const noInteractionRequired = !(refreshTokenError instanceof InteractionRequiredAuthError && refreshTokenError.subError !== "bad_token");
12916	const refreshTokenRefreshRequired = refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR || refreshTokenError.errorCode === "token_refresh_required";
12917	const isSilentlyResolvable = noInteractionRequired && refreshTokenRefreshRequired || refreshTokenError.errorCode === "no_tokens_found" || refreshTokenError.errorCode === "refresh_token_expired";
12918	const tryIframeRenewal = iFrameRenewalPolicies.includes(cacheLookupPolicy);
12919	return isSilentlyResolvable && tryIframeRenewal;
12920}
12921//#endregion
12922//#region node_modules/@azure/msal-browser/dist/operatingcontext/BaseOperatingContext.mjs

12923/*! @azure/msal-browser v5.13.0 2026-06-10 */
12924/**
12925* Base class for operating context
12926* Operating contexts are contexts in which MSAL.js is being run
12927* More than one operating context may be available at a time
12928* It's important from a logging and telemetry point of view for us to be able to identify the operating context.
12929* For example: Some operating contexts will pre-cache tokens impacting performance telemetry
12930*/
12931var BaseOperatingContext = class BaseOperatingContext {
12932	static loggerCallback(level, message) {
12933		switch (level) {
12934			case LogLevel.Error:
12935				console.error(message);
12936				return;
12937			case LogLevel.Info:
12938				console.info(message);
12939				return;
12940			case LogLevel.Verbose:
12941				console.debug(message);
12942				return;
12943			case LogLevel.Warning:
12944				console.warn(message);
12945				return;
12946			default:
12947				console.log(message);
12948				return;
12949		}
12950	}
12951	constructor(config, responseHandlers) {
12952		this.browserEnvironment = typeof window !== "undefined";
12953		this.config = buildConfiguration(config, this.browserEnvironment);
12954		this.responseHandlers = responseHandlers;
12955		let sessionStorage;
12956		try {
12957			sessionStorage = window[BrowserCacheLocation.SessionStorage];
12958		} catch (e) {}
12959		const logLevelKey = sessionStorage?.getItem(LOG_LEVEL_CACHE_KEY);
12960		const piiLoggingKey = sessionStorage?.getItem(LOG_PII_CACHE_KEY)?.toLowerCase();
12961		const piiLoggingEnabled = piiLoggingKey === "true" ? true : piiLoggingKey === "false" ? false : void 0;
12962		const loggerOptions = { ...this.config.system.loggerOptions };
12963		const logLevel = logLevelKey && Object.keys(LogLevel).includes(logLevelKey) ? LogLevel[logLevelKey] : void 0;
12964		if (logLevel) {
12965			loggerOptions.loggerCallback = BaseOperatingContext.loggerCallback;
12966			loggerOptions.logLevel = logLevel;
12967		}
12968		if (piiLoggingEnabled !== void 0) loggerOptions.piiLoggingEnabled = piiLoggingEnabled;
12969		this.logger = new Logger(loggerOptions, name, version);
12970		this.available = false;
12971	}
12972	/**
12973	* Return the MSAL config
12974	* @returns BrowserConfiguration
12975	*/
12976	getConfig() {
12977		return this.config;
12978	}
12979	/**
12980	* Returns the internal response handlers supplied by PublicClientApplication, if any.
12981	* @returns AuthResponseHandlers | undefined
12982	*/
12983	getResponseHandlers() {
12984		return this.responseHandlers;
12985	}
12986	/**
12987	* Returns the MSAL Logger
12988	* @returns Logger
12989	*/
12990	getLogger() {
12991		return this.logger;
12992	}
12993	isAvailable() {
12994		return this.available;
12995	}
12996	isBrowserEnvironment() {
12997		return this.browserEnvironment;
12998	}
12999};
13000//#endregion
13001//#region node_modules/@azure/msal-browser/dist/operatingcontext/StandardOperatingContext.mjs
13002/*! @azure/msal-browser v5.13.0 2026-06-10 */
13003var StandardOperatingContext = class StandardOperatingContext extends BaseOperatingContext {
13004	/**
13005	* Return the module name.  Intended for use with import() to enable dynamic import
13006	* of the implementation associated with this operating context
13007	* @returns
13008	*/
13009	getModuleName() {
13010		return StandardOperatingContext.MODULE_NAME;
13011	}
13012	/**
13013	* Returns the unique identifier for this operating context
13014	* @returns string
13015	*/
13016	getId() {
13017		return StandardOperatingContext.ID;
13018	}
13019	/**
13020	* Checks whether the operating context is available.
13021	* Confirms that the code is running a browser rather.  This is required.
13022	* @returns Promise<boolean> indicating whether this operating context is currently available.
13023	*/
13024	async initialize(correlationId) {
13025		this.available = typeof window !== "undefined";
13026		return this.available;
13027	}
13028};
13029StandardOperatingContext.MODULE_NAME = "";
13030/**
13031* Unique identifier for the operating context
13032*/
13033StandardOperatingContext.ID = "StandardOperatingContext";
13034//#endregion
13035//#region node_modules/@azure/msal-browser/dist/app/PublicClientApplication.mjs
13036/*! @azure/msal-browser v5.13.0 2026-06-10 */
13037/**
13038* The PublicClientApplication class is the object exposed by the library to perform authentication and authorization functions in Single Page Applications
13039* to obtain JWT tokens as described in the OAuth 2.0 Authorization Code Flow with PKCE specification.
13040*/
13041var PublicClientApplication = class {
13042	/**
13043	* @constructor
13044	* Constructor for the PublicClientApplication used to instantiate the PublicClientApplication object
13045	*
13046	* Important attributes in the Configuration object for auth are:
13047	* - clientID: the application ID of your application. You can obtain one by registering your application with our Application registration portal : https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredAppsPreview
13048	* - authority: the authority URL for your application.
13049	* - redirect_uri: the uri of your application registered in the portal.
13050	*
13051	* In Azure AD, authority is a URL indicating the Azure active directory that MSAL uses to obtain tokens.
13052	* It is of the form https://login.microsoftonline.com/{Enter_the_Tenant_Info_Here}
13053	* If your application supports Accounts in one organizational directory, replace "Enter_the_Tenant_Info_Here" value with the Tenant Id or Tenant name (for example, contoso.microsoft.com).

13054	* If your application supports Accounts in any organizational directory, replace "Enter_the_Tenant_Info_Here" value with organizations.
13055	* If your application supports Accounts in any organizational directory and personal Microsoft accounts, replace "Enter_the_Tenant_Info_Here" value with common.
13056	* To restrict support to Personal Microsoft accounts only, replace "Enter_the_Tenant_Info_Here" value with consumers.
13057	*
13058	* In Azure B2C, authority is of the form https://{instance}/tfp/{tenant}/{policyName}/
13059	* Full B2C functionality will be available in this library in future versions.
13060	*
13061	* @param configuration Object for the MSAL PublicClientApplication instance
13062	* @param IController Optional parameter to explictly set the controller. (Will be removed when we remove public constructor)
13063	*/
13064	constructor(configuration, controller) {
13065		this.controller = controller || new StandardController(new StandardOperatingContext(configuration, {
13066			waitForPopupResponse: this.waitForPopupResponse.bind(this),
13067			waitForIframeResponse: this.waitForIframeResponse.bind(this)
13068		}));
13069	}
13070	/**
13071	* Waits for the auth response from a popup window opened by MSAL.
13072	*
13073	* The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
13074	* Subclasses must return the raw response string (hash/query/fragment), or reject
13075	* with an `AuthError` on failure.
13076	*
13077	* @internal
13078	* @param request The in-flight authorization or end-session request.
13079	* @param popupWindow The popup window opened by MSAL.
13080	* @param popupWindowParent The parent window that opened the popup.
13081	*/
13082	async waitForPopupResponse(request, popupWindow, popupWindowParent) {
13083		const controller = this.controller;
13084		return waitForBridgeResponse(controller.getConfiguration().system.popupBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient());
13085	}
13086	/**
13087	* Waits for the auth response from a hidden iframe used by MSAL silent flows.
13088	*
13089	* The default implementation delegates to MSAL's `BroadcastChannel`-based bridge.
13090	* Subclasses must return the raw response string (hash/query/fragment), or reject
13091	* with an `AuthError` on failure.
13092	*
13093	* @internal
13094	* @param iframe The hidden iframe MSAL attached to the document.
13095	* @param request The in-flight authorization request.
13096	*/
13097	async waitForIframeResponse(iframe, request) {
13098		const controller = this.controller;
13099		const config = controller.getConfiguration();
13100		return waitForBridgeResponse(config.system.iframeBridgeTimeout, controller.getLogger(), request, controller.getPerformanceClient(), config.experimental);
13101	}
13102	/**
13103	* Initializer function to perform async startup tasks such as connecting to WAM extension
13104	* @param request {?InitializeApplicationRequest}
13105	*/
13106	async initialize(request) {
13107		return this.controller.initialize(request);
13108	}
13109	/**
13110	* Use when you want to obtain an access_token for your API via opening a popup window in the user's browser
13111	*
13112	* @param request
13113	*
13114	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
13115	*/
13116	async acquireTokenPopup(request) {
13117		return this.controller.acquireTokenPopup(request);
13118	}
13119	/**
13120	* Use when you want to obtain an access_token for your API by redirecting the user's browser window to the authorization endpoint. This function redirects
13121	* the page, so any code that follows this function will not execute.
13122	*
13123	* IMPORTANT: It is NOT recommended to have code that is dependent on the resolution of the Promise. This function will navigate away from the current
13124	* browser window. It currently returns a Promise in order to reflect the asynchronous nature of the code running in this function.
13125	*
13126	* @param request
13127	*/
13128	acquireTokenRedirect(request) {
13129		return this.controller.acquireTokenRedirect(request);
13130	}
13131	/**
13132	* Silently acquire an access token for a given set of scopes. Returns currently processing promise if parallel requests are made.
13133	*
13134	* @param {@link (SilentRequest:type)}
13135	* @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthenticationResult} object
13136	*/
13137	acquireTokenSilent(silentRequest) {
13138		return this.controller.acquireTokenSilent(silentRequest);
13139	}
13140	/**
13141	* This function redeems an authorization code (passed as code) from the eSTS token endpoint.
13142	* This authorization code should be acquired server-side using a confidential client to acquire a spa_code.
13143	* This API is not indended for normal authorization code acquisition and redemption.
13144	*
13145	* Redemption of this authorization code will not require PKCE, as it was acquired by a confidential client.
13146	*
13147	* @param request {@link AuthorizationCodeRequest}
13148	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
13149	*/
13150	acquireTokenByCode(request) {
13151		return this.controller.acquireTokenByCode(request);
13152	}
13153	/**
13154	* Adds event callbacks to array
13155	* @param callback
13156	* @param eventTypes
13157	*/
13158	addEventCallback(callback, eventTypes) {
13159		return this.controller.addEventCallback(callback, eventTypes);
13160	}
13161	/**
13162	* Removes callback with provided id from callback array
13163	* @param callbackId
13164	*/
13165	removeEventCallback(callbackId) {
13166		return this.controller.removeEventCallback(callbackId);
13167	}
13168	/**
13169	* Registers a callback to receive performance events.
13170	*
13171	* @param {PerformanceCallbackFunction} callback
13172	* @returns {string}
13173	*/
13174	addPerformanceCallback(callback) {
13175		return this.controller.addPerformanceCallback(callback);
13176	}
13177	/**
13178	* Removes a callback registered with addPerformanceCallback.
13179	*
13180	* @param {string} callbackId
13181	* @returns {boolean}
13182	*/
13183	removePerformanceCallback(callbackId) {
13184		return this.controller.removePerformanceCallback(callbackId);
13185	}
13186	/**
13187	* Returns the first account found in the cache that matches the account filter passed in.
13188	* @param accountFilter
13189	* @returns The first account found in the cache matching the provided filter or null if no account could be found.
13190	*/
13191	getAccount(accountFilter) {
13192		return this.controller.getAccount(accountFilter);
13193	}
13194	/**
13195	* Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
13196	* @param accountFilter - (Optional) filter to narrow down the accounts returned
13197	* @returns Array of AccountInfo objects in cache
13198	*/
13199	getAllAccounts(accountFilter) {
13200		return this.controller.getAllAccounts(accountFilter);
13201	}
13202	/**
13203	* Event handler function which allows users to fire events after the PublicClientApplication object
13204	* has loaded during redirect flows. This should be invoked on all page loads involved in redirect
13205	* auth flows.
13206	* @param hash Hash to process. Defaults to the current value of window.location.hash. Only needs to be provided explicitly if the response to be handled is not contained in the current value.
13207	* @param options Object containing optional configuration for redirect promise handling.
13208	* @returns Token response or null. If the return value is null, then no auth redirect was detected.
13209	*/
13210	handleRedirectPromise(options) {
13211		return this.controller.handleRedirectPromise(options);
13212	}
13213	/**
13214	* Use when initiating the login process via opening a popup window in the user's browser
13215	*
13216	* @param request
13217	*
13218	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
13219	*/
13220	loginPopup(request) {
13221		return this.controller.loginPopup(request);
13222	}
13223	/**
13224	* Use when initiating the login process by redirecting the user's browser to the authorization endpoint. This function redirects the page, so
13225	* any code that follows this function will not execute.
13226	*
13227	* IMPORTANT: It is NOT recommended to have code that is dependent on the resolution of the Promise. This function will navigate away from the current
13228	* browser window. It currently returns a Promise in order to reflect the asynchronous nature of the code running in this function.
13229	*
13230	* @param request
13231	*/
13232	loginRedirect(request) {
13233		return this.controller.loginRedirect(request);
13234	}
13235	/**
13236	* Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
13237	* Default behaviour is to redirect the user to `window.location.href`.
13238	* @param logoutRequest
13239	*/
13240	logoutRedirect(logoutRequest) {
13241		return this.controller.logoutRedirect(logoutRequest);
13242	}
13243	/**
13244	* Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
13245	* @param logoutRequest
13246	*/
13247	logoutPopup(logoutRequest) {
13248		return this.controller.logoutPopup(logoutRequest);
13249	}
13250	/**
13251	* This function uses a hidden iframe to fetch an authorization code from the eSTS. There are cases where this may not work:
13252	* - Any browser using a form of Intelligent Tracking Prevention
13253	* - If there is not an established session with the service
13254	*
13255	* In these cases, the request must be done inside a popup or full frame redirect.
13256	*
13257	* For the cases where interaction is required, you cannot send a request with prompt=none.
13258	*
13259	* If your refresh token has expired, you can use this function to fetch a new set of tokens silently as long as
13260	* you session on the server still exists.
13261	* @param request {@link SsoSilentRequest}
13262	*
13263	* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
13264	*/
13265	ssoSilent(request) {
13266		return this.controller.ssoSilent(request);
13267	}
13268	/**
13269	* Returns the logger instance
13270	*/
13271	getLogger() {
13272		return this.controller.getLogger();
13273	}
13274	/**

13275	* Replaces the default logger set in configurations with new Logger with new configurations
13276	* @param logger Logger instance
13277	*/
13278	setLogger(logger) {
13279		this.controller.setLogger(logger);
13280	}
13281	/**
13282	* Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
13283	* @param account
13284	*/
13285	setActiveAccount(account) {
13286		this.controller.setActiveAccount(account);
13287	}
13288	/**
13289	* Gets the currently active account
13290	*/
13291	getActiveAccount() {
13292		return this.controller.getActiveAccount();
13293	}
13294	/**
13295	* Called by wrapper libraries (Angular & React) to set SKU and Version passed down to telemetry, logger, etc.
13296	* @param sku
13297	* @param version
13298	*/
13299	initializeWrapperLibrary(sku, version) {
13300		return this.controller.initializeWrapperLibrary(sku, version);
13301	}
13302	/**
13303	* Sets navigation client
13304	* @param navigationClient
13305	*/
13306	setNavigationClient(navigationClient) {
13307		this.controller.setNavigationClient(navigationClient);
13308	}
13309	/**
13310	* Returns the configuration object
13311	* @internal
13312	*/
13313	getConfiguration() {
13314		return this.controller.getConfiguration();
13315	}
13316	/**
13317	* Hydrates cache with the tokens and account in the AuthenticationResult object
13318	* @param result
13319	* @param request - The request object that was used to obtain the AuthenticationResult
13320	* @returns
13321	*/
13322	async hydrateCache(result, request) {
13323		return this.controller.hydrateCache(result, request);
13324	}
13325	/**
13326	* Clears tokens and account from the browser cache.
13327	* @param logoutRequest
13328	*/
13329	clearCache(logoutRequest) {
13330		return this.controller.clearCache(logoutRequest);
13331	}
13332};
13333//#endregion
13334//#region public/js/auth-microsoft.js
13335var MSAL_CONFIG = {
13336	auth: {
13337		clientId: "4841aa3e-f781-4692-93a5-7ef84c65bd1c",
13338		authority: "https://login.microsoftonline.com/fd636d47-0838-4f67-a503-a7b54f8e37a1",
13339		redirectUri: window.location.origin + "/msal-redirect.html",
13340		postLogoutRedirectUri: window.location.origin
13341	},
13342	cache: {
13343		cacheLocation: "localStorage",
13344		storeAuthStateInCookie: false
13345	}
13346};
13347var LOGIN_SCOPES = [
13348	"openid",
13349	"profile",
13350	"email",
13351	"offline_access",
13352	"User.Read",
13353	"Mail.Read",
13354	"Mail.Send",
13355	"Calendars.ReadWrite"
13356];
13357var _instance = null;
13358var _initPromise = null;
13359async function initMSALEarly() {
13360	if (_initPromise) return _initPromise;
13361	_initPromise = (async () => {
13362		_instance = new PublicClientApplication(MSAL_CONFIG);
13363		await _instance.initialize();
13364		const result = await _instance.handleRedirectPromise();
13365		window._msalInstance = _instance;
13366		return {
13367			instance: _instance,
13368			redirectResult: result
13369		};
13370	})();
13371	return _initPromise;
13372}
13373async function getInstance() {
13374	if (_instance) return _instance;
13375	const { instance } = await initMSALEarly();
13376	return instance;
13377}
13378async function signInWithMicrosoft() {
13379	await (await getInstance()).loginRedirect({
13380		scopes: LOGIN_SCOPES,
13381		prompt: "consent"
13382	});
13383}
13384async function getMSToken(account) {
13385	const instance = await getInstance();
13386	const acc = account || instance.getAllAccounts()[0];
13387	if (!acc) throw new Error("No Microsoft account signed in");
13388	try {
13389		return (await instance.acquireTokenSilent({
13390			scopes: LOGIN_SCOPES,
13391			account: acc,
13392			forceRefresh: true
13393		})).accessToken;
13394	} catch (e) {
13395		if (e instanceof InteractionRequiredAuthError) await instance.acquireTokenRedirect({
13396			scopes: LOGIN_SCOPES,
13397			account: acc
13398		});
13399		throw e;
13400	}
13401}
13402//#endregion
13403export { initMSALEarly as n, signInWithMicrosoft as r, getMSToken as t };

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.