1import{p as ns}from"./chunk-MAMFQQB4.js";import{$b as os,R as fn,S as ts,Tb as Oi,U as fo,W as Re,ba as rs,f as Ja,g as Xa,h as Za,j as Te,k as qe,o as bi,x as es,y as Ni}from"./chunk-6O6WDLEP.js";import{a as f,b as S,c as st,d as ve,e as po,f as h}from"./chunk-FO65GQC2.js";var ai={};ve(ai,{blockAPICallsBeforeInitialize:()=>ni,blockAcquireTokenInPopups:()=>qs,blockNonBrowserEnvironment:()=>oi,blockRedirectInIframe:()=>Ks,blockReloadInHiddenIframes:()=>Bs,clearHash:()=>Ga,createGuid:()=>Va,getCurrentUri:()=>le,getHomepage:()=>$a,invoke:()=>ae,invokeAsync:()=>p,isInIframe:()=>sn,isInPopup:()=>Fs,preconnect:()=>ln,preflightCheck:()=>cn,redirectPreflightCheck:()=>ii,replaceHash:()=>za});var u={LIBRARY_NAME:"MSAL.JS",SKU:"msal.js.common",CACHE_PREFIX:"msal",DEFAULT_AUTHORITY:"https://login.microsoftonline.com/common/",DEFAULT_AUTHORITY_HOST:"login.microsoftonline.com",DEFAULT_COMMON_TENANT:"common",ADFS:"adfs",DSTS:"dstsv2",AAD_INSTANCE_DISCOVERY_ENDPT:"https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",CIAM_AUTH_URL:".ciamlogin.com",AAD_TENANT_DOMAIN_SUFFIX:".onmicrosoft.com",RESOURCE_DELIM:"|",NO_ACCOUNT:"NO_ACCOUNT",CLAIMS:"claims",CONSUMER_UTID:"9188040d-6c67-4c5b-b112-36a304b66dad",OPENID_SCOPE:"openid",PROFILE_SCOPE:"profile",OFFLINE_ACCESS_SCOPE:"offline_access",EMAIL_SCOPE:"email",CODE_RESPONSE_TYPE:"code",CODE_GRANT_TYPE:"authorization_code",RT_GRANT_TYPE:"refresh_token",FRAGMENT_RESPONSE_MODE:"fragment",S256_CODE_CHALLENGE_METHOD:"S256",URL_FORM_CONTENT_TYPE:"application/x-www-form-urlencoded;charset=utf-8",AUTHORIZATION_PENDING:"authorization_pending",NOT_DEFINED:"not_defined",EMPTY_STRING:"",NOT_APPLICABLE:"N/A",NOT_AVAILABLE:"Not Available",FORWARD_SLASH:"/",IMDS_ENDPOINT:"http://169.254.169.254/metadata/instance/compute/location",IMDS_VERSION:"2020-06-01",IMDS_TIMEOUT:2e3,AZURE_REGION_AUTO_DISCOVER_FLAG:"TryAutoDetect",REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX:"login.microsoft.com",KNOWN_PUBLIC_CLOUDS:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"],TOKEN_RESPONSE_TYPE:"token",ID_TOKEN_RESPONSE_TYPE:"id_token",SHR_NONCE_VALIDITY:240,INVALID_INSTANCE:"invalid_instance"},yr={SUCCESS:200,SUCCESS_RANGE_START:200,SUCCESS_RANGE_END:299,REDIRECT:302,CLIENT_ERROR:400,CLIENT_ERROR_RANGE_START:400,BAD_REQUEST:400,UNAUTHORIZED:401,NOT_FOUND:404,REQUEST_TIMEOUT:408,TOO_MANY_REQUESTS:429,CLIENT_ERROR_RANGE_END:499,SERVER_ERROR:500,SERVER_ERROR_RANGE_START:500,SERVICE_UNAVAILABLE:503,GATEWAY_TIMEOUT:504,SERVER_ERROR_RANGE_END:599,MULTI_SIDED_ERROR:600},me=[u.OPENID_SCOPE,u.PROFILE_SCOPE,u.OFFLINE_ACCESS_SCOPE],Pi=[...me,u.EMAIL_SCOPE],z={CONTENT_TYPE:"Content-Type",CONTENT_LENGTH:"Content-Length",RETRY_AFTER:"Retry-After",CCS_HEADER:"X-AnchorMailbox",WWWAuthenticate:"WWW-Authenticate",AuthenticationInfo:"Authentication-Info",X_MS_REQUEST_ID:"x-ms-request-id",X_MS_HTTP_VERSION:"x-ms-httpver"},$={ID_TOKEN:"idtoken",CLIENT_INFO:"client.info",ADAL_ID_TOKEN:"adal.idtoken",ERROR:"error",ERROR_DESC:"error.description",ACTIVE_ACCOUNT:"active-account",ACTIVE_ACCOUNT_FILTERS:"active-account-filters"},_e={COMMON:"common",ORGANIZATIONS:"organizations",CONSUMERS:"consumers"},Er={ACCESS_TOKEN:"access_token",XMS_CC:"xms_cc"},F={LOGIN:"login",SELECT_ACCOUNT:"select_account",CONSENT:"consent",NONE:"none",CREATE:"create",NO_SESSION:"no_session"},Cn={PLAIN:"plain",S256:"S256"},we={QUERY:"query",FRAGMENT:"fragment"},Mi=S(f({},we),{FORM_POST:"form_post"}),Co={IMPLICIT_GRANT:"implicit",AUTHORIZATION_CODE_GRANT:"authorization_code",CLIENT_CREDENTIALS_GRANT:"client_credentials",RESOURCE_OWNER_PASSWORD_GRANT:"password",REFRESH_TOKEN_GRANT:"refresh_token",DEVICE_CODE_GRANT:"device_code",JWT_BEARER:"urn:ietf:params:oauth:grant-type:jwt-bearer"},Ir={MSSTS_ACCOUNT_TYPE:"MSSTS",ADFS_ACCOUNT_TYPE:"ADFS",MSAV1_ACCOUNT_TYPE:"MSA",GENERIC_ACCOUNT_TYPE:"Generic"},G={CACHE_KEY_SEPARATOR:"-",CLIENT_INFO_SEPARATOR:"."},I={ID_TOKEN:"IdToken",ACCESS_TOKEN:"AccessToken",ACCESS_TOKEN_WITH_AUTH_SCHEME:"AccessToken_With_AuthScheme",REFRESH_TOKEN:"RefreshToken"};
1var To="appmetadata",is="client_info",ct="1",Sr={CACHE_KEY:"authority-metadata",REFRESH_TIME_SECONDS:3600*24},oe={CONFIG:"config",CACHE:"cache",NETWORK:"network",HARDCODED_VALUES:"hardcoded_values"},Y={SCHEMA_VERSION:5,MAX_CUR_HEADER_BYTES:80,MAX_LAST_HEADER_BYTES:330,MAX_CACHED_ERRORS:50,CACHE_KEY:"server-telemetry",CATEGORY_SEPARATOR:"|",VALUE_SEPARATOR:",",OVERFLOW_TRUE:"1",OVERFLOW_FALSE:"0",UNKNOWN_ERROR:"unknown_error"},N={BEARER:"Bearer",POP:"pop",SSH:"ssh-cert"},Ge={DEFAULT_THROTTLE_TIME_SECONDS:60,DEFAULT_MAX_THROTTLE_TIME_SECONDS:3600,THROTTLING_PREFIX:"throttling",X_MS_LIB_CAPABILITY_VALUE:"retry-after, h429"},Tn={INVALID_GRANT_ERROR:"invalid_grant",CLIENT_MISMATCH_ERROR:"client_mismatch"},An={username:"username",password:"password"},Ao={httpSuccess:200,httpBadRequest:400},Mt={FAILED_AUTO_DETECTION:"1",INTERNAL_CACHE:"2",ENVIRONMENT_VARIABLE:"3",IMDS:"4"},yn={CONFIGURED_MATCHES_DETECTED:"1",CONFIGURED_NO_AUTO_DETECTION:"2",CONFIGURED_NOT_DETECTED:"3",AUTO_DETECTION_REQUESTED_SUCCESSFUL:"4",AUTO_DETECTION_REQUESTED_FAILED:"5"},ke={NOT_APPLICABLE:"0",FORCE_REFRESH_OR_CLAIMS:"1",NO_CACHED_ACCESS_TOKEN:"2",CACHED_ACCESS_TOKEN_EXPIRED:"3",PROACTIVELY_REFRESHED:"4"},En={Jwt:"JWT",Jwk:"JWK",Pop:"pop"};var Ui=300;var Ut={};ve(Ut,{postRequestFailed:()=>Eo,unexpectedError:()=>yo});var yo="unexpected_error",Eo="post_request_failed";var In={[yo]:"Unexpected error in authentication.",[Eo]:"Post request failed from the network, could be a 4xx/5xx or a network unavailability. Please check the exact error code for details."},as={unexpectedError:{code:yo,desc:In[yo]},postRequestFailed:{code:Eo,desc:In[Eo]}},b=class n extends Error{constructor(e,t,r){let o=t?`${e}: ${t}`:e;super(o),Object.setPrototypeOf(this,n.prototype),this.errorCode=e||u.EMPTY_STRING,this.errorMessage=t||u.EMPTY_STRING,this.subError=r||u.EMPTY_STRING,this.name="AuthError"}setCorrelationId(e){this.correlationId=e}};function Io(n,e){return new b(n,e?`${In[n]} ${e}`:In[n])}var W={};ve(W,{authTimeNotFound:()=>ze,authorizationCodeMissingFromServerResponse:()=>Wt,bindingKeyNotRemoved:()=>jt,cannotAppendScopeSet:()=>Vt,cannotRemoveEmptyScope:()=>$t,clientInfoDecodingError:()=>lt,clientInfoEmptyError:()=>Lt,deviceCodeExpired:()=>_o,deviceCodePollingCancelled:()=>Ro,deviceCodeUnknownError:()=>wo,emptyInputScopeSet:()=>ut,endSessionEndpointNotSupported:()=>Jt,endpointResolutionError:()=>ne,hashNotDeserialized:()=>Ft,invalidAssertion:()=>No,invalidCacheEnvironment:()=>Ve,invalidCacheRecord:()=>Qt,invalidClientCredential:()=>Oo,invalidState:()=>be,keyIdMissing:()=>Xt,maxAgeTranspired:()=>qt,methodNotImplemented:()=>_,missingTenantIdError:()=>Lo,multipleMatchingAccounts:()=>vo,multipleMatchingAppMetadata:()=>Gt,multipleMatchingTokens:()=>So,nestedAppAuthBridgeDisabled:()=>Do,networkError:()=>Ht,noAccountFound:()=>ko,noAccountInSilentRequest:()=>$e,noCryptoObject:()=>gt,noNetworkConnectivity:()=>Mo,nonceMismatch:()=>Kt,nullOrEmptyToken:()=>Dt,openIdConfigError:()=>xt,requestCannotBeMade:()=>zt,stateMismatch:()=>Bt,stateNotFound:()=>ht,tokenClaimsCnfRequiredForSignedJwt:()=>Yt,tokenParsingError:()=>dt,tokenRefreshRequired:()=>Oe,unexpectedCredentialType:()=>bo,userCanceled:()=>Uo,userTimeoutReached:()=>Po});var lt="client_info_decoding_error",Lt="client_info_empty_error",dt="token_parsing_error",Dt="null_or_empty_token",ne="endpoints_resolution_error",Ht="network_error",xt="openid_config_error",Ft="hash_not_deserialized",be="invalid_state",Bt="state_mismatch",ht="state_not_found",Kt="nonce_mismatch",ze="auth_time_not_found",qt="max_age_transpired",So="multiple_matching_tokens",vo="multiple_matching_accounts",Gt="multiple_matching_appMetadata",zt="request_cannot_be_made",$t="cannot_remove_empty_scope",Vt="cannot_append_scopeset",ut="empty_input_scopeset",Ro="device_code_polling_cancelled",_o="device_code_expired",wo="device_code_unknown_error",$e="no_account_in_silent_request",Qt="invalid_cache_record",Ve="invalid_cache_environment",ko="no_account_found",gt="no_crypto_object",bo="unexpected_credential_type",No="invalid_assertion",Oo="invalid_client_credential",Oe="token_refresh_required",Po="user_timeout_reached",Yt="token_claims_cnf_required_for_signedjwt",Wt="authorization_code_missing_from_server_response",jt="binding_key_not_removed",Jt="end_session_endpoint_not_supported",Xt="key_id_missing",Mo="no_network_connectivity",Uo="user_canceled",Lo="missing_tenant_id_error",_="method_not_implemented",Do="nested_app_auth_bridge_disabled";var w={[lt]:"The client info could not be parsed/decoded correctly",[Lt]:"The client info was empty",[dt]:"Token cannot be parsed",[Dt]:"The token is null or empty",[ne]:"Endpoints cannot be resolved",[Ht]:"Network request failed",[xt]:"Could not retrieve endpoints. Check your authority and verify the .well-known/openid-configuration endpoint returns the required endpoints.",[Ft]:"The hash parameters could not be deserialized",[be]:"State was not the expected format",[Bt]:"State mismatch error",[ht]:"State not found",[Kt]:"Nonce mismatch error",[ze]:"Max Age was requested and the ID token is missing the auth_time variable. auth_time is an optional claim and is not enabled by default - it must be enabled. See https://aka.ms/msaljs/optional-claims for more information.",[qt]:"Max Age is set to 0, or too much time has elapsed since the last end-user authentication.",[So]:"The cache contains multiple tokens satisfying the requirements. Call AcquireToken again providing more requirements such as authority or account.",[vo]:"The cache contains multiple accounts satisfying the given parameters. Please pass more info to obtain the correct account",[Gt]:"The cache contains multiple appMetadata satisfying the given parameters. Please pass more info to obtain the correct appMetadata",[zt]:"Token request cannot be made without authorization code or refresh token.",[$t]:"Cannot remove null or empty scope from ScopeSet",[Vt]:"Cannot append ScopeSet",[ut]:"Empty input ScopeSet cannot be processed",[Ro]:"Caller has cancelled token endpoint polling during device code flow by setting DeviceCodeRequest.cancel = true.",[_o]:"Device code is expired.",[wo]:"Device code stopped polling for unknown reasons.",[$e]:"Please pass an account object, silent flow is not supported without account information",[Qt]:"Cache record object was null or undefined.",[Ve]:"Invalid environment when attempting to create cache entry",[ko]:"No account found in cache for given key.",[gt]:"No crypto object detected.",[bo]:"Unexpected credential type.",[No]:"Client assertion must meet requirements described
1in https://tools.ietf.org/html/rfc7515",[Oo]:"Client credential (secret, certificate, or assertion) must not be empty when creating a confidential client. An application should at most have one credential",[Oe]:"Cannot return token from cache because it must be refreshed. This may be due to one of the following reasons: forceRefresh parameter is set to true, claims have been requested, there is no cached access token or it is expired.",[Po]:"User defined timeout for device code polling reached",[Yt]:"Cannot generate a POP jwt if the token_claims are not populated",[Wt]:"Server response does not contain an authorization code to proceed",[jt]:"Could not remove the credential's binding key from storage.",[Jt]:"The provided authority does not support logout",[Xt]:"A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key.",[Mo]:"No network connectivity. Check your internet connection.",[Uo]:"User cancelled the flow.",[Lo]:"A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",[_]:"This method has not been implemented",[Do]:"The nested app auth bridge is disabled"},ss={clientInfoDecodingError:{code:lt,desc:w[lt]},clientInfoEmptyError:{code:Lt,desc:w[Lt]},tokenParsingError:{code:dt,desc:w[dt]},nullOrEmptyToken:{code:Dt,desc:w[Dt]},endpointResolutionError:{code:ne,desc:w[ne]},networkError:{code:Ht,desc:w[Ht]},unableToGetOpenidConfigError:{code:xt,desc:w[xt]},hashNotDeserialized:{code:Ft,desc:w[Ft]},invalidStateError:{code:be,desc:w[be]},stateMismatchError:{code:Bt,desc:w[Bt]},stateNotFoundError:{code:ht,desc:w[ht]},nonceMismatchError:{code:Kt,desc:w[Kt]},authTimeNotFoundError:{code:ze,desc:w[ze]},maxAgeTranspired:{code:qt,desc:w[qt]},multipleMatchingTokens:{code:So,desc:w[So]},multipleMatchingAccounts:{code:vo,desc:w[vo]},multipleMatchingAppMetadata:{code:Gt,desc:w[Gt]},tokenRequestCannotBeMade:{code:zt,desc:w[zt]},removeEmptyScopeError:{code:$t,desc:w[$t]},appendScopeSetError:{code:Vt,desc:w[Vt]},emptyInputScopeSetError:{code:ut,desc:w[ut]},DeviceCodePollingCancelled:{code:Ro,desc:w[Ro]},DeviceCodeExpired:{code:_o,desc:w[_o]},DeviceCodeUnknownError:{code:wo,desc:w[wo]},NoAccountInSilentRequest:{code:$e,desc:w[$e]},invalidCacheRecord:{code:Qt,desc:w[Qt]},invalidCacheEnvironment:{code:Ve,desc:w[Ve]},noAccountFound:{code:ko,desc:w[ko]},noCryptoObj:{code:gt,desc:w[gt]},unexpectedCredentialType:{code:bo,desc:w[bo]},invalidAssertion:{code:No,desc:w[No]},invalidClientCredential:{code:Oo,desc:w[Oo]},tokenRefreshRequired:{code:Oe,desc:w[Oe]},userTimeoutReached:{code:Po,desc:w[Po]},tokenClaimsRequired:{code:Yt,desc:w[Yt]},noAuthorizationCodeFromServer:{code:Wt,desc:w[Wt]},bindingKeyNotRemovedError:{code:jt,desc:w[jt]},logoutNotSupported:{code:Jt,desc:w[Jt]},keyIdMissing:{code:Xt,desc:w[Xt]},noNetworkConnectivity:{code:Mo,desc:w[Mo]},userCanceledError:{code:Uo,desc:w[Uo]},missingTenantIdError:{code:Lo,desc:w[Lo]},nestedAppAuthBridgeDisabled:{code:Do,desc:w[Do]}},Zt=class n extends b{constructor(e,t){super(e,t?`${w[e]}: ${t}`:w[e]),this.name="ClientAuthError",Object.setPrototypeOf(this,n.prototype)}};function g(n,e){return new Zt(n,e)}var mt={createNewGuid:()=>{throw g(_)},base64Decode:()=>{throw g(_)},base64Encode:()=>{throw g(_)},base64UrlEncode:()=>{throw g(_)},encodeKid:()=>{throw g(_)},getPublicKeyThumbprint(){return h(this,null,function*(){throw g(_)})},removeTokenBindingKey(){return h(this,null,function*(){throw g(_)})},clearKeystore(){return h(this,null,function*(){throw g(_)})},signJwt(){return h(this,null,function*(){throw g(_)})},hashString(){return h(this,null,function*(){throw g(_)})}};var D=function(n){return n[n.Error=0]="Error",n[n.Warning=1]="Warning",n[n.Info=2]="Info",n[n.Verbose=3]="Verbose",n[n.Trace=4]="Trace",n}(D||{}),de=class n{constructor(e,t,r){this.level=D.Info;let o=()=>{},i=e||n.createDefaultLoggerOptions();this.localCallback=i.loggerCallback||o,this.piiLoggingEnabled=i.piiLoggingEnabled||!1,this.level=typeof i.logLevel=="number"?i.logLevel:D.Info,this.correlationId=i.correlationId||u.EMPTY_STRING,this.packageName=t||u.EMPTY_STRING,this.packageVersion=r||u.EMPTY_STRING}static createDefaultLoggerOptions(){return{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:D.Info}}clone(e,t,r){return new n({loggerCallback:this.localCallback,piiLoggingEnabled:this.piiLoggingEnabled,logLevel:this.level,correlationId:r||this.correlationId},e,t)}logMessage(e,t){if(t.logLevel>this.level||!this.piiLoggingEnabled&&t.containsPii)return;let i=`${`[${new Date().toUTCString()}] : [${t.correlationId||this.correlationId||""}]`} : ${this.packageName}@${this.packageVersion} : ${D[t.logLevel]} - ${e}`;this.executeCallback(t.logLevel,i,t.containsPii||!1)}executeCallback(e,t,r){this.localCallback&&this.localCallback(e,t,r)}error(e,t){this.logMessage(e,{logLevel:D.Error,containsPii:!1,correlationId:t||u.EMPTY_STRING})}errorPii(e,t){this.logMessage(e,{logLevel:D.Error,containsPii:!0,correlationId:t||u.EMPTY_STRING})}warning(e,t){this.logMessage(e,{logLevel:D.Warning,containsPii:!1,correlationId:t||u.EMPTY_STRING})}warningPii(e,t){this.logMessage(e,{logLevel:D.Warning,containsPii:!0,correlationId:t||u.EMPTY_STRING})}info(e,t){this.logMessage(e,{logLevel:D.Info,containsPii:!1,correlationId:t||u.EMPTY_STRING})}infoPii(e,t){this.logMessage(e,{logLevel:D.Info,containsPii:!0,correlationId:t||u.EMPTY_STRING})}verbose(e,t){this.logMessage(e,{logLevel:D.Verbose,containsPii:!1,correlationId:t||u.EMPTY_STRING})}verbosePii(e,t){this.logMessage(e,{logLevel:D.Verbose,containsPii:!0,correlationId:t||u.EMPTY_STRING})}trace(e,t){this.logMessage(e,{logLevel:D.Trace,containsPii:!1,correlationId:t||u.EMPTY_STRING})}tracePii(e,t){this.logMessage(e,{logLevel:D.Trace,containsPii:!0,correlationId:t||u.EMPTY_STRING})}isPiiLoggingEnabled(){return this.piiLoggingEnabled||!1}};var Sn="@azure/msal-common",vr="14.16.0";var pt={None:"none",AzurePublic:"https://login.microsoftonline.com",AzurePpe:"https://login.windows-ppe.net",AzureChina:"https://login.chinacloudapi.cn",AzureGermany:"https://login.microsoftonline.de",AzureUsGovernment:"https://login.microsoftonline.us"};var H={};ve(H,{createAccessTokenEntity:()=>Hi,createIdTokenEntity:()=>Di,createRefreshTokenEntity:()=>xi,generateAppMetadataKey:()=>Oc,generateAuthorityMetadataExpiresAt:()=>Rn,generateCredentialKey:()=>Fo,isAccessTokenEntity:()=>Ec,isAppMetadataEntity:()=>Pc,isAuthorityMetadataEntity:()=>Mc,isAuthorityMetadataExpired:()=>_n,isCredentialEntity:()=>vn,isIdTokenEntity:()=>Ic,isRefreshTokenEntity:()=>Sc,isServerTelemetryEntity:()=>bc,isThrottlingEntity:()=>Nc,updateAuthorityEndpointMetadata:()=>_r,updateCloudDiscoveryMetadata:()=>Bo});var ft={};ve(ft,{checkMaxAge:()=>Ho,extractTokenClaims:()=>Qe,getJWSPayload:()=>cs});function Qe(n,e){let t=cs(n);try{let r=e(t);return JSON.parse(r)}catch{throw g(dt)}}function cs(n){if(!n)throw g(Dt);let t=/^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/.exec(n);if(!t||t.length<4)throw g(dt);return t[2]}function Ho(n,e){if(e===0||Date.now()-3e5>n+e)throw g(qt)}var xo={};ve(xo,{delay:()=>yc,isTokenExpired:()=>Rr,nowSeconds:()=>pe,wasClockTurnedBack:()=>Li});function pe(){return Math.round(new Date().getTime()/1e3)}function Rr(n,e){let t=Number(n)||0;return pe()+e>t}function Li(n){return Number(n)>pe()}function yc(n,e){return new Promise(t=>setTimeout(()=>t(e),n))}function Fo(n){return[vc(n),Rc(n),_c(n),wc(n),kc(n)].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}function Di(n,e,t,r,o){return{credentialType:I.ID_TOKEN,homeAccountId:n,environment:e,clientId:r,secret:t,realm:o}}function Hi(n,e,t,r,o,i,a,s,l,d,m,T,A,R,L){let U={homeAccountId:n,credentialType:I.ACCESS_TOKEN,secret:t,cachedAt:pe().toString(),expiresOn:a.toString(),extendedExpiresOn:s.toString(),environment:e,clientId:r,realm:o,target:i,tokenType:m||N.BEARER};if(T&&(U.userAssertionHash=T),d&&(U.refreshOn=d.toString()),R&&(U.requestedClaims=R,U.requestedClaimsHash=L),U.tokenType?.toLowerCase()!==N.BEARER.toLowerCase())switch(U.
1credentialType=I.ACCESS_TOKEN_WITH_AUTH_SCHEME,U.tokenType){case N.POP:let te=Qe(t,l);if(!te?.cnf?.kid)throw g(Yt);U.keyId=te.cnf.kid;break;case N.SSH:U.keyId=A}return U}function xi(n,e,t,r,o,i,a){let s={credentialType:I.REFRESH_TOKEN,homeAccountId:n,environment:e,clientId:r,secret:t};return i&&(s.userAssertionHash=i),o&&(s.familyId=o),a&&(s.expiresOn=a.toString()),s}function vn(n){return n.hasOwnProperty("homeAccountId")&&n.hasOwnProperty("environment")&&n.hasOwnProperty("credentialType")&&n.hasOwnProperty("clientId")&&n.hasOwnProperty("secret")}function Ec(n){return n?vn(n)&&n.hasOwnProperty("realm")&&n.hasOwnProperty("target")&&(n.credentialType===I.ACCESS_TOKEN||n.credentialType===I.ACCESS_TOKEN_WITH_AUTH_SCHEME):!1}function Ic(n){return n?vn(n)&&n.hasOwnProperty("realm")&&n.credentialType===I.ID_TOKEN:!1}function Sc(n){return n?vn(n)&&n.credentialType===I.REFRESH_TOKEN:!1}function vc(n){return[n.homeAccountId,n.environment].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}function Rc(n){let e=n.credentialType===I.REFRESH_TOKEN&&n.familyId||n.clientId;return[n.credentialType,e,n.realm||""].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}function _c(n){return(n.target||"").toLowerCase()}function wc(n){return(n.requestedClaimsHash||"").toLowerCase()}function kc(n){return n.tokenType&&n.tokenType.toLowerCase()!==N.BEARER.toLowerCase()?n.tokenType.toLowerCase():""}function bc(n,e){let t=n.indexOf(Y.CACHE_KEY)===0,r=!0;return e&&(r=e.hasOwnProperty("failedRequests")&&e.hasOwnProperty("errors")&&e.hasOwnProperty("cacheHits")),t&&r}function Nc(n,e){let t=!1;
1n&&(t=n.indexOf(Ge.THROTTLING_PREFIX)===0);let r=!0;return e&&(r=e.hasOwnProperty("throttleTime")),t&&r}function Oc({environment:n,clientId:e}){return[To,n,e].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}function Pc(n,e){return e?n.indexOf(To)===0&&e.hasOwnProperty("clientId")&&e.hasOwnProperty("environment"):!1}function Mc(n,e){return e?n.indexOf(Sr.CACHE_KEY)===0&&e.hasOwnProperty("aliases")&&e.hasOwnProperty("preferred_cache")&&e.hasOwnProperty("preferred_network")&&e.hasOwnProperty("canonical_authority")&&e.hasOwnProperty("authorization_endpoint")&&e.hasOwnProperty("token_endpoint")&&e.hasOwnProperty("issuer")&&e.hasOwnProperty("aliasesFromNetwork")&&e.hasOwnProperty("endpointsFromNetwork")&&e.hasOwnProperty("expiresAt")&&e.hasOwnProperty("jwks_uri"):!1}function Rn(){return pe()+Sr.REFRESH_TIME_SECONDS}function _r(n,e,t){n.authorization_endpoint=e.authorization_endpoint,n.token_endpoint=e.token_endpoint,n.end_session_endpoint=e.end_session_endpoint,n.issuer=e.issuer,n.endpointsFromNetwork=t,n.jwks_uri=e.jwks_uri}function Bo(n,e,t){n.aliases=e.aliases,n.preferred_cache=e.preferred_cache,n.preferred_network=e.preferred_network,n.aliasesFromNetwork=t}function _n(n){return n.expiresAt<=pe()}var Ne={};ve(Ne,{authorityMismatch:()=>Qo,authorityUriInsecure:()=>tr,cannotAllowNativeBroker:()=>Vo,cannotSetOIDCOptions:()=>$o,claimsRequestParsingError:()=>Ko,emptyInputScopesError:()=>or,invalidAuthenticationHeader:()=>zo,invalidAuthorityMetadata:()=>cr,invalidClaims:()=>Ye,invalidCloudDiscoveryMetadata:()=>Ct,invalidCodeChallengeMethod:()=>sr,invalidPromptValue:()=>nr,logoutRequestEmpty:()=>ar,missingNonceAuthenticationHeader:()=>Go,missingSshJwk:()=>je,missingSshKid:()=>qo,pkceParamsMissing:()=>We,redirectUriEmpty:()=>er,tokenRequestEmpty:()=>ir,untrustedAuthority:()=>lr,urlEmptyError:()=>rr,urlParseError:()=>Pe});var er="redirect_uri_empty",Ko="claims_request_parsing_error",tr="authority_uri_insecure",Pe="url_parse_error",rr="empty_url_error",or="empty_input_scopes_error",nr="invalid_prompt_value",Ye="invalid_claims",ir="token_request_empty",ar="logout_request_empty",sr="invalid_code_challenge_method",We="pkce_params_missing",Ct="invalid_cloud_discovery_metadata",cr="invalid_authority_metadata",lr="untrusted_authority",je="missing_ssh_jwk",qo="missing_ssh_kid",Go="missing_nonce_authentication_header",zo="invalid_authentication_header",$o="c
1annot_set_OIDCOptions",Vo="cannot_allow_native_broker",Qo="authority_mismatch";var K={[er]:"A redirect URI is required for all calls, and none has been set.",[Ko]:"Could not parse the given claims request object.",[tr]:"Authority URIs must use https. Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",[Pe]:"URL could not be parsed into appropriate segments.",[rr]:"URL was empty or null.",[or]:"Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",[nr]:"Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",[Ye]:"Given claims parameter must be a stringified JSON object.",[ir]:"Token request was empty and not found in cache.",[ar]:"The logout request was null or undefined.",[sr]:'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',[We]:"Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",[Ct]:"Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",[cr]:"Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",[lr]:"The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",[je]:"Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",[qo]:"Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",[Go]:"Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",[zo]:"Invalid authentication header provided",[$o]:"Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",[Vo]:"Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",[Qo]:"Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."},ls={redirectUriNotSet:{code:er,desc:K[er]},claimsRequestParsingError:{code:Ko,desc:K[Ko]},authorityUriInsecure:{code:tr,desc:K[tr]},urlParseError:{code:Pe,desc:K[Pe]},urlEmptyError:{code:rr,desc:K[rr]},emptyScopesError:{code:or,desc:K[or]},invalidPrompt:{code:nr,desc:K[nr]},invalidClaimsRequest:{code:Ye,desc:K[Ye]},tokenRequestEmptyError:{code:ir,desc:K[ir]},logoutRequestEmptyError:{code:ar,desc:K[ar]},invalidCodeChallengeMethod:{code:sr,desc:K[sr]},invalidCodeChallengeParams:{code:We,desc:K[We]},invalidCloudDiscoveryMetadata:{code:Ct,desc:K[Ct]},invalidAuthorityMetadata:{code:cr,desc:K[cr]},untrustedAuthority:{code:lr,desc:K[lr]},missingSshJwk:{code:je,desc:K[je]},missingSshKid:{code:qo,desc:K[qo]},missingNonceAuthenticationHeader:{code:Go,desc:K[Go]},invalidAuthenticationHeader:{code:zo,desc:K[zo]},cannotSetOIDCOptions:{code:$o,desc:K[$o]},cannotAllowNativeBroker:{code:Vo,desc:K[Vo]},authorityMismatch:{code:Qo,desc:K[Qo]}},Yo=class n extends b{constructor(e){super(e,K[e]),this.name="ClientConfigurationError",Object.setPrototypeOf(this,n.prototype)}};function O(n){return new Yo(n)}var q=class{static isEmptyObj(e){if(e)try{let t=JSON.parse(e);return Object.keys(t).length===0}catch{}return!0}static startsWith(e,t){return e.indexOf(t)===0}static endsWith(e,t){return e.length>=t.length&&e.lastIndexOf(t)===e.length-t.length}static queryStringToObject(e){let t={},r=e.split("&"),o=i=>decodeURIComponent(i.replace(/\+/g," "));return r.forEach(i=>{if(i.trim()){let[a,s]=i.split(/=(.+)/g,2);a&&s&&(t[o(a)]=o(s))}}),t}static trimArrayEntries(e){return e.map(t=>t.trim())}static removeEmptyStringsFromArray(e){return e.filter(t=>!!t)}static jsonParseHelper(e){try{return JSON.parse(e)}catch{return null}}static matchPattern(e,t){return new RegExp(e.replace(/\\/g,"\\\\").replace(/\*/g,"[^ ]*").replace(/\?/g,"\\?")).test(t)}};var B=class n{constructor(e){let t=e?q.trimArrayEntries([...e]):[],r=t?q.removeEmptyStringsFromArray(t):[];this.validateInputScopes(r),this.scopes=new Set,r.forEach(o=>this.scopes.add(o))}static fromString(e){let r=(e||u.EMPTY_STRING).split(" ");return new n(r)}static createSearchScopes(e){let t=new n(e);return t.containsOnlyOIDCScopes()?t.removeScope(u.OFFLINE_ACCESS_SCOPE):t.removeOIDCScopes(),t}
1validateInputScopes(e){if(!e||e.length<1)throw O(or)}containsScope(e){let t=this.printScopesLowerCase().split(" "),r=new n(t);return e?r.scopes.has(e.toLowerCase()):!1}containsScopeSet(e){return!e||e.scopes.size<=0?!1:this.scopes.size>=e.scopes.size&&e.asArray().every(t=>this.containsScope(t))}containsOnlyOIDCScopes(){let e=0;return Pi.forEach(t=>{this.containsScope(t)&&(e+=1)}),this.scopes.size===e}appendScope(e){e&&this.scopes.add(e.trim())}appendScopes(e){try{e.forEach(t=>this.appendScope(t))}catch{throw g(Vt)}}removeScope(e){if(!e)throw g($t);this.scopes.delete(e.trim())}removeOIDCScopes(){Pi.forEach(e=>{this.scopes.delete(e)})}unionScopeSets(e){if(!e)throw g(ut);let t=new Set;return e.scopes.forEach(r=>t.add(r.toLowerCase())),this.scopes.forEach(r=>t.add(r.toLowerCase())),t}intersectingScopeSets(e){if(!e)throw g(ut);e.containsOnlyOIDCScopes()||e.removeOIDCScopes();let t=this.unionScopeSets(e),r=e.getScopeCount(),o=this.getScopeCount();return t.size<o+r}getScopeCount(){return this.scopes.size}asArray(){let e=[];return this.scopes.forEach(t=>e.push(t)),e}printScopes(){return this.scopes?this.asArray().join(" "):u.EMPTY_STRING}printScopesLowerCase(){return this.printScopes().toLowerCase()}};function wr(n,e){if(!n)throw g(Lt);try{let t=e(n);return JSON.parse(t)}catch{throw g(lt)}}function Je(n){if(!n)throw g(lt);let e=n.split(G.CLIENT_INFO_SEPARATOR,2);return{uid:e[0],utid:e.length<2?u.EMPTY_STRING:e[1]}}function kr(n,e){return!!n&&!!e&&n===e.split(".")[1]}function br(n,e,t,r){if(r){let{oid:o,sub:i,tid:a,name:s,tfp:l,acr:d}=r,m=a||l||d||"";return{tenantId:m,localAccountId:o||i||"",name:s,isHomeTenant:kr(m,n)}}else return{tenantId:t,localAccountId:e,isHomeTenant:kr(t,n)}}function dr(n,e,t,r){let o=n;if(e){let i=e,{isHomeTenant:s}=i,l=st(i,["isHomeTenant"]);o=f(f({},n),l)}if(t){let a=br(n.homeAccountId,n.localAccountId,n.tenantId,t),{isHomeTenant:s}=a,l=st(a,["isHomeTenant"]);return o=S(f(f({},o),l),{idTokenClaims:t,idToken:r}),o}return o}var ie={Default:0,Adfs:1,Dsts:2,Ciam:3};function wn(n){return n&&(n.tid||n.tfp||n.acr)||null}var Z={AAD:"AAD",OIDC:"OIDC"};var x=class n{generateAccountId(){return[this.homeAccountId,this.environment].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}generateAccountKey(){return n.generateAccountCacheKey({homeAccountId:this.homeAccountId,environment:this.environment,tenantId:this.realm,username:this.username,localAccountId:this.localAccountId})}getAccountInfo(){return{homeAccountId:this.homeAccountId,environment:this.environment,tenantId:this.realm,username:this.username,localAccountId:this.localAccountId,name:this.name,nativeAccountId:this.nativeAccountId,authorityType:this.authorityType,tenantProfiles:new Map((this.tenantProfiles||[]).map(e=>[e.tenantId,e]))}}isSingleTenant(){return!this.tenantProfiles}static generateAccountCacheKey(e){let t=e.homeAccountId.split(".")[1];return[e.homeAccountId,e.environment||"",t||e.tenantId||""].join(G.CACHE_KEY_SEPARATOR).toLowerCase()}static createAccount(e,t,r){let o=new n;t.authorityType===ie.Adfs?o.authorityType=Ir.ADFS_ACCOUNT_TYPE:t.protocolMode===Z.AAD?o.authorityType=Ir.MSSTS_ACCOUNT_TYPE:o.authorityType=Ir.GENERIC_ACCOUNT_TYPE;let i;e.clientInfo&&r&&(i=wr(e.clientInfo,r)),o.clientInfo=e.clientInfo,o.homeAccountId=e.homeAccountId,o.nativeAccountId=e.nativeAccountId;let a=e.environment||t&&t.getPreferredCache();if(!a)throw g(Ve);o.environment=a,o.realm=i?.utid||wn(e.idTokenClaims)||"",o.localAccountId=i?.uid||e.idTokenClaims?.oid||e.idTokenClaims?.sub||"";let s=e.idTokenClaims?.preferred_username||e.idTokenClaims?.upn,l=e.idTokenClaims?.emails?e.idTokenClaims.emails[0]:null;if(o.username=s||l||"",o.name=e.idTokenClaims?.name||"",o.cloudGraphHostName=e.cloudGraphHostName,o.msGraphHost=e.msGraphHost,e.tenantProfiles)o.tenantProfiles=e.tenantProfiles;else{let d=br(e.homeAccountId,o.localAccountId,o.realm,e.idTokenClaims);o.tenantProfiles=[d]}return o}static createFromAccountInfo(e,t,r){let o=new n;return o.authorityType=e.authorityType||Ir.GENERIC_ACCOUNT_TYPE,o.homeAccountId=e.homeAccountId,o.localAccountId=e.localAccountId,o.nativeAccountId=e.nativeAccountId,o.realm=e.tenantId,o.environment=e.environment,o.username=e.username,o.name=e.name,o.cloudGraphHostName=t,o.msGraphHost=r,o.tenantProfiles=Array.from(e.tenantProfiles?.values()||[]),o}
1static generateHomeAccountId(e,t,r,o,i){if(!(t===ie.Adfs||t===ie.Dsts)){if(e)try{let a=wr(e,o.base64Decode);if(a.uid&&a.utid)return`${a.uid}.${a.utid}`}catch{}r.warning("No client info in response")}return i?.sub||""}static isAccountEntity(e){return e?e.hasOwnProperty("homeAccountId")&&e.hasOwnProperty("environment")&&e.hasOwnProperty("realm")&&e.hasOwnProperty("localAccountId")&&e.hasOwnProperty("username")&&e.hasOwnProperty("authorityType"):!1}static accountInfoIsEqual(e,t,r){if(!e||!t)return!1;let o=!0;if(r){let i=e.idTokenClaims||{},a=t.idTokenClaims||{};o=i.iat===a.iat&&i.nonce===a.nonce}return e.homeAccountId===t.homeAccountId&&e.localAccountId===t.localAccountId&&e.username===t.username&&e.tenantId===t.tenantId&&e.environment===t.environment&&e.nativeAccountId===t.nativeAccountId&&o}};var Tt={};ve(Tt,{getDeserializedResponse:()=>Fi,stripLeadingHashOrQuery:()=>ds});function ds(n){return n.startsWith("#/")?n.substring(2):n.startsWith("#")||n.startsWith("?")?n.substring(1):n}function Fi(n){if(!n||n.indexOf("=")<0)return null;try{let e=ds(n),t=Object.fromEntries(new URLSearchParams(e));if(t.code||t.error||t.error_description||t.state)return t}catch{throw g(Ft)}return null}var k=class n{get urlString(){return this._urlString}constructor(e){if(this._urlString=e,!this._urlString)throw O(rr);e.includes("#")||(this._urlString=n.canonicalizeUri(e))}static canonicalizeUri(e){if(e){let t=e.toLowerCase();return q.endsWith(t,"?")?t=t.slice(0,-1):q.endsWith(t,"?/")&&(t=t.
1slice(0,-2)),q.endsWith(t,"/")||(t+="/"),t}return e}validateAsUri(){let e;try{e=this.getUrlComponents()}catch{throw O(Pe)}if(!e.HostNameAndPort||!e.PathSegments)throw O(Pe);if(!e.Protocol||e.Protocol.toLowerCase()!=="https:")throw O(tr)}static appendQueryString(e,t){return t?e.indexOf("?")<0?`${e}?${t}`:`${e}&${t}`:e}static removeHashFromUrl(e){return n.canonicalizeUri(e.split("#")[0])}replaceTenantPath(e){let t=this.getUrlComponents(),r=t.PathSegments;return e&&r.length!==0&&(r[0]===_e.COMMON||r[0]===_e.ORGANIZATIONS)&&(r[0]=e),n.constructAuthorityUriFromObject(t)}getUrlComponents(){let e=RegExp("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?"),t=this.urlString.match(e);if(!t)throw O(Pe);let r={Protocol:t[1],HostNameAndPort:t[4],AbsolutePath:t[5],QueryString:t[7]},o=r.AbsolutePath.split("/");return o=o.filter(i=>i&&i.length>0),r.PathSegments=o,r.QueryString&&r.QueryString.endsWith("/")&&(r.QueryString=r.QueryString.substring(0,r.QueryString.length-1)),r}static getDomainFromUrl(e){let t=RegExp("^([^:/?#]+://)?([^/?#]*)"),r=e.match(t);if(!r)throw O(Pe);return r[2]}static getAbsoluteUrl(e,t){if(e[0]===u.FORWARD_SLASH){let o=new n(t).getUrlComponents();return o.Protocol+"//"+o.HostNameAndPort+e}return e}static constructAuthorityUriFromObject(e){return new n(e.Protocol+"//"+e.HostNameAndPort+"/"+e.PathSegments.join("/"))}static hashContainsKnownProperties(e){return!!Fi(e)}};var us={endpointMetadata:{"login.microsoftonline.com":{token_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.com/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.com/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/logout"},"login.chinacloudapi.cn":{token_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.chinacloudapi.cn/{tenantid}/discovery/v2.0/keys",issuer:"https://login.partner.microsoftonline.cn/{tenantid}/v2.0",authorization_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/logout"},"login.microsoftonline.us":{token_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/token",jwks_uri:"https://login.microsoftonline.us/{tenantid}/discovery/v2.0/keys",issuer:"https://login.microsoftonline.us/{tenantid}/v2.0",authorization_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/authorize",end_session_endpoint:"https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/logout"}},instanceDiscoveryMetadata:{tenant_discovery_endpoint:"https://{canonicalAuthority}/v2.0/.well-known/openid-configuration",metadata:[{preferred_network:"login.microsoftonline.com",preferred_cache:"login.windows.net",aliases:["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{preferred_network:"login.partner.microsoftonline.cn",preferred_cache:"login.partner.microsoftonline.cn",aliases:["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{preferred_network:"login.microsoftonline.de",preferred_cache:"login.microsoftonline.de",aliases:["login.microsoftonline.de"]},{preferred_network:"login.microsoftonline.us",preferred_cache:"login.microsoftonline.us",aliases:["login.microsoftonline.us","login.usgovcloudapi.net"]},{preferred_network:"login-us.microsoftonline.com",preferred_cache:"login-us.microsoftonline.com",aliases:["login-us.microsoftonline.com"]}]}},Bi=us.endpointMetadata,Ki=us.instanceDiscoveryMetadata,qi=new Set;Ki.metadata.forEach(n=>{n.aliases.forEach(e=>{qi.add(e)})});function gs(n,e){let t,r=n.canonicalAuthority;if(r){let o=new k(r).getUrlComponents().HostNameAndPort;t=hs(o,n.cloudDiscoveryMetadata?.metadata,oe.CONFIG,e)||hs(o,Ki.metadata,oe.HARDCODED_VALUES,e)||n.knownAuthorities}return t||[]}function hs(n,e,t,r){if(r?.trace(`getAliasesFromMetadata called with source: ${t}`),n&&e){let o=Wo(e,n);
1if(o)return r?.trace(`getAliasesFromMetadata: found cloud discovery metadata in ${t}, returning aliases`),o.aliases;r?.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in ${t}`)}return null}function ms(n){return Wo(Ki.metadata,n)}function Wo(n,e){for(let t=0;t<n.length;t++){let r=n[t];if(r.aliases.includes(e))return r}return null}var kn="cache_quota_exceeded",jo="cache_error_unknown";var Gi={[kn]:"Exceeded cache storage capacity.",[jo]:"Unexpected error occurred when using cache storage."},Xe=class n extends Error{constructor(e,t){let r=t||(Gi[e]?Gi[e]:Gi[jo]);super(`${e}: ${r}`),Object.setPrototypeOf(this,n.prototype),this.name="CacheError",this.errorCode=e,this.errorMessage=r}};var Ze=class n{constructor(e,t,r,o){this.clientId=e,this.cryptoImpl=t,this.commonLogger=r.clone(Sn,vr),this.staticAuthorityOptions=o}getAllAccounts(e){return this.buildTenantProfiles(this.getAccountsFilteredBy(e||{}),e)}getAccountInfoFilteredBy(e){let t=this.getAllAccounts(e);return t.length>1?t.sort(o=>o.idTokenClaims?-1:1)[0]:t.length===1?t[0]:null}getBaseAccountInfo(e){let t=this.getAccountsFilteredBy(e);return t.length>0?t[0].getAccountInfo():null}buildTenantProfiles(e,t){return e.flatMap(r=>this.getTenantProfilesFromAccountEntity(r,t?.tenantId,t))}getTenantedAccountInfoByFilter(e,t,r,o){let i=null,a;if(o&&!this.tenantProfileMatchesFilter(r,o))return null;let s=this.getIdToken(e,t,r.tenantId);return s&&(a=Qe(s.secret,this.cryptoImpl.base64Decode),!this.idTokenClaimsMatchTenantProfileFilter(a,o))?null:(i=dr(e,r,a,s?.secret),i)}getTenantProfilesFromAccountEntity(e,t,r){let o=e.getAccountInfo(),i=o.tenantProfiles||new Map,a=this.getTokenKeys();if(t){let l=i.get(t);if(l)i=new Map([[t,l]]);else return[]}let s=[];return i.forEach(l=>{let d=this.getTenantedAccountInfoByFilter(o,a,l,r);d&&s.push(d)}),s}tenantProfileMatchesFilter(e,t){return!(t.localAccountId&&!this.matchLocalAccountIdFromTenantProfile(e,t.localAccountId)||t.name&&e.name!==t.name||t.isHomeTenant!==void 0&&e.isHomeTenant!==t.isHomeTenant)}idTokenClaimsMatchTenantProfileFilter(e,t){return!(t&&(t.localAccountId&&!this.matchLocalAccountIdFromTokenClaims(e,t.localAccountId)||t.loginHint&&!this.matchLoginHintFromTokenClaims(e,t.loginHint)||t.username&&!this.matchUsername(e.preferred_username,t.username)||t.name&&!this.matchName(e,t.name)||t.sid&&!this.matchSid(e,t.sid)))}saveCacheRecord(e,t,r){return h(this,null,function*(){if(!e)throw g(Qt);try{e.account&&this.setAccount(e.account),e.idToken&&t?.idToken!==!1&&this.setIdTokenCredential(e.idToken),e.accessToken&&t?.accessToken!==!1&&(yield this.saveAccessToken(e.accessToken)),e.refreshToken&&t?.refreshToken!==!1&&this.setRefreshTokenCredential(e.refreshToken),e.appMetadata&&this.setAppMetadata(e.appMetadata)}catch(o){throw this.commonLogger?.error("CacheManager.saveCacheRecord: failed"),o instanceof Error?(this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${o.message}`,r),o.name==="QuotaExceededError"||o.name==="NS_ERROR_DOM_QUOTA_REACHED"||o.message.includes("exceeded the quota")?(this.commonLogger?.error("CacheManager.saveCacheRecord: exceeded storage quota",r),new Xe(kn)):new Xe(o.name,o.message)):(this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${o}`,r),new Xe(jo))}})}saveAccessToken(e){return h(this,null,function*(){let t={clientId:e.clientId,credentialType:e.credentialType,environment:e.environment,homeAccountId:e.homeAccountId,realm:e.realm,tokenType:e.tokenType,requestedClaimsHash:e.requestedClaimsHash},r=this.getTokenKeys(),o=B.fromString(e.target),i=[];r.accessToken.forEach(a=>{if(!this.accessTokenKeyMatchesFilter(a,t,!1))return;let s=this.getAccessTokenCredential(a);s&&this.credentialMatchesFilter(s,t)&&B.fromString(s.target).intersectingScopeSets(o)&&i.push(this.removeAccessToken(a))}),yield Promise.all(i),this.setAccessTokenCredential(e)})}getAccountsFilteredBy(e){let t=this.getAccountKeys(),r=[];return t.forEach(o=>{if(!this.isAccountKey(o,e.homeAccountId))return;let i=this.getAccount(o,this.commonLogger);if(!i||e.homeAccountId&&!this.matchHomeAccountId(i,e.homeAccountId)||e.username&&!this.matchUsername(i.username,e.username)||e.environment&&!this.matchEnvironment(i,e.environment)||e.realm&&!this.matchRealm(i,e.realm)||e.nativeAccountId&&!this.matchNativeAccountId(i,e.nativeAccountId)||e.authorityType&&!this.matchAuthorityType(i,e.authorityType))return;let a={localAccountId:e?.localAccountId,name:e?.name},s=i.tenantProfiles?.filter(l=>this.tenantProfileMatchesFilter(l,a));s&&s.length===0||r.push(i)}),r}isAccountKey(e,t,r){return!(e.split(G.CACHE_KEY_SEPARATOR).length<3||t&&!e.toLowerCase().includes(t.toLowerCase())||r&&!e.toLowerCase().includes(r.toLowerCase()))}isCredentialKey(e){if(e.split(G.CACHE_KEY_SEPARATOR).length<6)return!1;let t=e.toLowerCase();if(t.indexOf(I.ID_TOKEN.toLowerCase())===-1&&t.indexOf(I.ACCESS_TOKEN.toLowerCase())===-1&&t.indexOf(I.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())===-1&&t.indexOf(I.REFRESH_TOKEN.toLowerCase())===-1)return!1;if(t.indexOf(I.REFRESH_TOKEN.toLowerCase())>-1){let r=`${I.REFRESH_TOKEN}${G.CACHE_KEY_SEPARATOR}${this.clientId}${G.CACHE_KEY_SEPARATOR}`,o=`${I.REFRESH_TOKEN}${G.CACHE_KEY_SEPARATOR}${ct}${G.CACHE_KEY_SEPARATOR}`;if(t.indexOf(r.toLowerCase())===-1&&t.indexOf(o.toLowerCase())===-1)return!1}else if(t.indexOf(this.clientId.toLowerCase())===-1)return!1;return!0}credentialMatchesFilter(e,t){return!(t.clientId&&!this.matchClientId(e,t.clientId)||t.userAssertionHash&&!this.matchUserAssertionHash(e,t.userAssertionHash)||typeof t.homeAccountId=="string"&&!this.matchHomeAccountId(e,t.homeAccountId)||t.environment&&!this.matchEnvironment(e,t.environment)||t.realm&&!this.matchRealm(e,t.realm)||t.credentialType&&!this.matchCredentialType(e,t.credentialType)||t.familyId&&!this.matchFamilyId(e,t.familyId)||t.target&&!this.matchTarget(e,t.target)||(t.requestedClaimsHash||e.requestedClaimsHash)&&e.requestedClaimsHash!==t.requestedClaimsHash||e.credentialType===I.ACCESS_TOKEN_WITH_AUTH_SCHEME&&(t.tokenType&&!this.matchTokenType(e,t.tokenType)||t.tokenType===N.SSH&&t.keyId&&!this.matchKeyId(e,t.keyId)))}getAppMetadataFilteredBy(e){let t=this.getKeys(),r={};return t.forEach(o=>{if(!this.isAppMetadata(o))return;let i=this.getAppMetadata(o);i&&(e.environment&&!this.matchEnvironment(i,e.environment)||e.clientId&&!this.matchClientId(i,e.clientId)||(r[o]=i))}),r}getAuthorityMetadataByAlias(e){let t=this.getAuthorityMetadataKeys(),r=null;return t.forEach(o=>{if(!this.isAuthorityMetadata(o)||o.indexOf(this.clientId)===-1)return;let i=this.getAuthorityMetadata(o);i&&i.aliases.indexOf(e)!==-1&&(r=i)}),r}removeAllAccounts(){return h(this,null,function*(){let e=this.getAccountKeys(),t=[];e.forEach(r=>{t.push(this.removeAccount(r))}),yield Promise.all(t)})}removeAccount(e){return h(this,null,function*(){let t=this.getAccount(e,this.commonLogger);t&&(yield this.removeAccountContext(t),this.removeItem(e))})}removeAccountContext(e){return h(this,null,function*(){let t=this.getTokenKeys(),r=e.generateAccountId(),o=[];
1t.idToken.forEach(i=>{i.indexOf(r)===0&&this.removeIdToken(i)}),t.accessToken.forEach(i=>{i.indexOf(r)===0&&o.push(this.removeAccessToken(i))}),t.refreshToken.forEach(i=>{i.indexOf(r)===0&&this.removeRefreshToken(i)}),yield Promise.all(o)})}updateOutdatedCachedAccount(e,t,r){if(t&&t.isSingleTenant()){this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");let o=this.getAccountKeys().filter(d=>d.startsWith(t.homeAccountId)),i=[];o.forEach(d=>{let m=this.getCachedAccountEntity(d);m&&i.push(m)});let a=i.find(d=>kr(d.realm,d.homeAccountId))||i[0];a.tenantProfiles=i.map(d=>({tenantId:d.realm,localAccountId:d.localAccountId,name:d.name,isHomeTenant:kr(d.realm,d.homeAccountId)}));let s=n.toObject(new x,f({},a)),l=s.generateAccountKey();return o.forEach(d=>{d!==l&&this.removeOutdatedAccount(e)}),this.setAccount(s),r?.verbose("Updated an outdated account entity in the cache"),s}return t}removeAccessToken(e){return h(this,null,function*(){let t=this.getAccessTokenCredential(e);if(t){if(t.credentialType.toLowerCase()===I.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()&&t.tokenType===N.POP){let o=t.keyId;if(o)try{yield this.cryptoImpl.removeTokenBindingKey(o)}catch{throw g(jt)}}return this.removeItem(e)}})}removeAppMetadata(){return this.getKeys().forEach(t=>{this.isAppMetadata(t)&&this.removeItem(t)}),!0}readAccountFromCache(e){let t=x.generateAccountCacheKey(e);return this.getAccount(t,this.commonLogger)}getIdToken(e,t,r,o,i){this.commonLogger.trace("CacheManager - getIdToken called");let a={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:I.ID_TOKEN,clientId:this.clientId,realm:r},s=this.getIdTokensByFilter(a,t),l=s.size;if(l<1)return this.commonLogger.info("CacheManager:getIdToken - No token found"),null;if(l>1){let d=s;if(!r){let m=new Map;s.forEach((A,R)=>{A.realm===e.tenantId&&m.set(R,A)});let T=m.size;if(T<1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result"),s.values().next().value;if(T===1)return this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile"),m.values().next().value;d=m}return this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them"),d.forEach((m,T)=>{this.removeIdToken(T)}),o&&i&&o.addFields({multiMatchedID:s.size},i),null}return this.commonLogger.info("CacheManager:getIdToken - Returning ID token"),s.values().next().value}getIdTokensByFilter(e,t){let r=t&&t.idToken||this.getTokenKeys().idToken,o=new Map;return r.forEach(i=>{if(!this.idTokenKeyMatchesFilter(i,f({clientId:this.clientId},e)))return;let a=this.getIdTokenCredential(i);a&&this.credentialMatchesFilter(a,e)&&o.set(i,a)}),o}idTokenKeyMatchesFilter(e,t){let r=e.toLowerCase();return!(t.clientId&&r.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&r.indexOf(t.homeAccountId.toLowerCase())===-1)}removeIdToken(e){this.removeItem(e)}removeRefreshToken(e){this.removeItem(e)}getAccessToken(e,t,r,o,i,a){this.commonLogger.trace("CacheManager - getAccessToken called");let s=B.createSearchScopes(t.scopes),l=t.authenticationScheme||N.BEARER,d=l&&l.toLowerCase()!==N.BEARER.toLowerCase()?I.ACCESS_TOKEN_WITH_AUTH_SCHEME:I.ACCESS_TOKEN,m={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:d,clientId:this.clientId,realm:o||e.tenantId,target:s,tokenType:l,keyId:t.sshKid,requestedClaimsHash:t.requestedClaimsHash},T=r&&r.accessToken||this.getTokenKeys().accessToken,A=[];T.forEach(L=>{if(this.accessTokenKeyMatchesFilter(L,m,!0)){let U=this.getAccessTokenCredential(L);U&&this.credentialMatchesFilter(U,m)&&A.push(U)}});let R=A.length;return R<1?(this.commonLogger.info("CacheManager:getAccessToken - No token found"),null):R>1?(this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them"),A.forEach(L=>{this.removeAccessToken(Fo(L))}),i&&a&&i.addFields({multiMatchedAT:A.length},a),null):(this.commonLogger.info("CacheManager:getAccessToken - Returning access token"),A[0])}accessTokenKeyMatchesFilter(e,t,r){let o=e.toLowerCase();if(t.clientId&&o.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&o.indexOf(t.homeAccountId.toLowerCase())===-1||t.realm&&o.indexOf(t.realm.toLowerCase())===-1||t.requestedClaimsHash&&o.indexOf(t.requestedClaimsHash.toLowerCase())===-1)return!1;if(t.target){let i=t.target.asArray();for(let a=0;a<i.length;a++){if(r&&!o.includes(i[a].toLowerCase()))return!1;if(!r&&o.includes(i[a].toLowerCase()))return!0}}return!0}getAccessTokensByFilter(e){let t=this.getTokenKeys(),r=[];
1return t.accessToken.forEach(o=>{if(!this.accessTokenKeyMatchesFilter(o,e,!0))return;let i=this.getAccessTokenCredential(o);i&&this.credentialMatchesFilter(i,e)&&r.push(i)}),r}getRefreshToken(e,t,r,o,i){this.commonLogger.trace("CacheManager - getRefreshToken called");let a=t?ct:void 0,s={homeAccountId:e.homeAccountId,environment:e.environment,credentialType:I.REFRESH_TOKEN,clientId:this.clientId,familyId:a},l=r&&r.refreshToken||this.getTokenKeys().refreshToken,d=[];l.forEach(T=>{if(this.refreshTokenKeyMatchesFilter(T,s)){let A=this.getRefreshTokenCredential(T);A&&this.credentialMatchesFilter(A,s)&&d.push(A)}});let m=d.length;return m<1?(this.commonLogger.info("CacheManager:getRefreshToken - No refresh token found."),null):(m>1&&o&&i&&o.addFields({multiMatchedRT:m},i),this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token"),d[0])}refreshTokenKeyMatchesFilter(e,t){let r=e.toLowerCase();return!(t.familyId&&r.indexOf(t.familyId.toLowerCase())===-1||!t.familyId&&t.clientId&&r.indexOf(t.clientId.toLowerCase())===-1||t.homeAccountId&&r.indexOf(t.homeAccountId.toLowerCase())===-1)}readAppMetadataFromCache(e){let t={environment:e,clientId:this.clientId},r=this.getAppMetadataFilteredBy(t),o=Object.keys(r).map(a=>r[a]),i=o.length;if(i<1)return null;if(i>1)throw g(Gt);return o[0]}isAppMetadataFOCI(e){let t=this.readAppMetadataFromCache(e);return!!(t&&t.familyId===ct)}matchHomeAccountId(e,t){return typeof e.homeAccountId=="string"&&t===e.homeAccountId}matchLocalAccountIdFromTokenClaims(e,t){let r=e.oid||e.sub;return t===r}matchLocalAccountIdFromTenantProfile(e,t){return e.localAccountId===t}matchName(e,t){return t.toLowerCase()===e.name?.toLowerCase()}matchUsername(e,t){return!!(e&&typeof e=="string"&&t?.toLowerCase()===e.toLowerCase())}matchUserAssertionHash(e,t){return!!(e.userAssertionHash&&t===e.userAssertionHash)}matchEnvironment(e,t){if(this.staticAuthorityOptions){let o=gs(this.staticAuthorityOptions,this.commonLogger);if(o.includes(t)&&o.includes(e.environment))return!0}let r=this.getAuthorityMetadataByAlias(t);return!!(r&&r.aliases.indexOf(e.environment)>-1)}matchCredentialType(e,t){return e.credentialType&&t.toLowerCase()===e.credentialType.toLowerCase()}matchClientId(e,t){return!!(e.clientId&&t===e.clientId)}matchFamilyId(e,t){return!!(e.familyId&&t===e.familyId)}matchRealm(e,t){return e.realm?.toLowerCase()===t.toLowerCase()}matchNativeAccountId(e,t){return!!(e.nativeAccountId&&t===e.nativeAccountId)}matchLoginHintFromTokenClaims(e,t){return e.login_hint===t||e.preferred_username===t||e.upn===t}matchSid(e,t){return e.sid===t}matchAuthorityType(e,t){return!!(e.authorityType&&t.toLowerCase()===e.authorityType.toLowerCase())}matchTarget(e,t){return e.credentialType!==I.ACCESS_TOKEN&&e.credentialType!==I.ACCESS_TOKEN_WITH_AUTH_SCHEME||!e.target?!1:B.fromString(e.target).containsScopeSet(t)}matchTokenType(e,t){return!!(e.tokenType&&e.tokenType===t)}matchKeyId(e,t){return!!(e.keyId&&e.keyId===t)}isAppMetadata(e){return e.indexOf(To)!==-1}isAuthorityMetadata(e){return e.indexOf(Sr.CACHE_KEY)!==-1}generateAuthorityMetadataCacheKey(e){return`${Sr.CACHE_KEY}-${this.clientId}-${e}`}static toObject(e,t){for(let r in t)e[r]=t[r];return e}},Jo=class extends Ze{setAccount(){throw g(_)}getAccount(){throw g(_)}getCachedAccountEntity(){throw g(_)}setIdTokenCredential(){throw g(_)}getIdTokenCredential(){throw g(_)}setAccessTokenCredential(){throw g(_)}getAccessTokenCredential(){throw g(_)}setRefreshTokenCredential(){throw g(_)}getRefreshTokenCredential(){throw g(_)}setAppMetadata(){throw g(_)}getAppMetadata(){throw g(_)}setServerTelemetry(){throw g(_)}getServerTelemetry(){throw g(_)}setAuthorityMetadata(){throw g(_)}getAuthorityMetadata(){throw g(_)}getAuthorityMetadataKeys(){throw g(_)}setThrottlingCache(){throw g(_)}getThrottlingCache(){throw g(_)}removeItem(){throw g(_)}getKeys(){throw g(_)}getAccountKeys(){throw g(_)}getTokenKeys(){throw g(_)}updateCredentialCacheKey(){throw g(_)}removeOutdatedAccount(){throw g(_)}};var bn={tokenRenewalOffsetSeconds:Ui,preventCorsPreflight:!1},Uc={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:D.Info,correlationId:u.EMPTY_STRING},Lc={claimsBasedCachingEnabled:!1},Dc={sendGetRequestAsync(){return h(this,null,function*(){throw g(_)})},sendPostRequestAsync(){return h(this,null,function*(){throw g(_)})}},Hc={sku:u.SKU,version:vr,cpu:u.EMPTY_STRING,os:u.EMPTY_STRING},xc={clientSecret:u.EMPTY_STRING,clientAssertion:void 0},Fc={azureCloudInstance:pt.None,tenant:`${u.DEFAULT_COMMON_TENANT}`},Bc={application:{appName:"",appVersion:""}};function ps({authOptions:n,systemOptions:e,loggerOptions:t,cacheOptions:r,storageInterface:o,networkInterface:i,cryptoInterface:a,clientCredentials:s,library
1Info:l,telemetry:d,serverTelemetryManager:m,persistencePlugin:T,serializableCache:A}){let R=f(f({},Uc),t);return{authOptions:Kc(n),systemOptions:f(f({},bn),e),loggerOptions:R,cacheOptions:f(f({},Lc),r),storageInterface:o||new Jo(n.clientId,mt,new de(R)),networkInterface:i||Dc,cryptoInterface:a||mt,clientCredentials:s||xc,libraryInfo:f(f({},Hc),l),telemetry:f(f({},Bc),d),serverTelemetryManager:m||null,persistencePlugin:T||null,serializableCache:A||null}}function Kc(n){return f({clientCapabilities:[],azureCloudOptions:Fc,skipAuthorityMetadataCache:!1,instanceAware:!1},n)}function Xo(n){return n.authOptions.authority.options.protocolMode===Z.OIDC}var j={HOME_ACCOUNT_ID:"home_account_id",UPN:"UPN"};var tt={};ve(tt,{ACCESS_TOKEN:()=>zc,BROKER_CLIENT_ID:()=>Ln,BROKER_REDIRECT_URI:()=>Ra,CCS_HEADER:()=>Xc,CLAIMS:()=>Vi,CLIENT_ASSERTION:()=>fa,CLIENT_ASSERTION_TYPE:()=>Ca,CLIENT_ID:()=>et,CLIENT_INFO:()=>Wc,CLIENT_REQUEST_ID:()=>ra,CLIENT_SECRET:()=>pa,CODE:()=>Xi,CODE_CHALLENGE:()=>Zi,CODE_CHALLENGE_METHOD:()=>ea,CODE_VERIFIER:()=>ta,DEVICE_CODE:()=>ma,DOMAIN_HINT:()=>va,ERROR:()=>qc,ERROR_DESCRIPTION:()=>Gc,EXPIRES_IN:()=>Vc,FOCI:()=>Jc,GRANT_TYPE:()=>$i,ID_TOKEN:()=>$c,ID_TOKEN_HINT:()=>ga,LOGIN_HINT:()=>Sa,LOGOUT_HINT:()=>Ea,NATIVE_BROKER:()=>ya,NONCE:()=>ji,OBO_ASSERTION:()=>Ta,ON_BEHALF_OF:()=>jc,POST_LOGOUT_URI:()=>ua,PROMPT:()=>Ji,REDIRECT_URI:()=>Nn,REFRESH_TOKEN:()=>Yi,REFRESH_TOKEN_EXPIRES_IN:()=>Qc,REQUESTED_TOKEN_USE:()=>Aa,REQ_CNF:()=>Mn,RESPONSE_MODE:()=>zi,RESPONSE_TYPE:()=>On,RETURN_SPA_CODE:()=>Un,SCOPE:()=>Qi,SESSION_STATE:()=>Yc,SID:()=>Ia,STATE:()=>Wi,TOKEN_TYPE:()=>Pn,X_APP_NAME:()=>da,X_APP_VER:()=>ha,X_CLIENT_CPU:()=>aa,X_CLIENT_CURR_TELEM:()=>sa,X_CLIENT_EXTRA_SKU:()=>Zc,X_CLIENT_LAST_TELEM:()=>ca,X_CLIENT_OS:()=>ia,X_CLIENT_SKU:()=>oa,X_CLIENT_VER:()=>na,X_MS_LIB_CAPABILITY:()=>la});var et="client_id",Nn="redirect_uri",On="response_type",zi="response_mode",$i="grant_type",Vi="claims",Qi="scope",qc="error",Gc="error_description",zc="access_token",$c="id_token",Yi="refresh_token",Vc="expires_in",Qc="refresh_token_expires_in",Wi="state",ji="nonce",Ji="prompt",Yc="session_state",Wc="client_info",Xi="code",Zi="code_challenge",ea="code_challenge_method",ta="code_verifier",ra="client-request-id",oa="x-client-SKU",na="x-client-VER",ia="x-client-OS",aa="x-client-CPU",sa="x-client-current-telemetry",ca="x-client-last-telemetry",la="x-ms-lib-capability",da="x-app-name",ha="x-app-ver",ua="post_logout_redirect_uri",ga="id_token_hint",ma="device_code",pa="client_secret",fa="client_assertion",Ca="client_assertion_type",Pn="token_type",Mn="req_cnf",Ta="assertion",Aa="requested_token_use",jc="on_behalf_of",Jc="foci",Xc="X-AnchorMailbox",Un="return_spa_code",ya="nativebroker",Ea="logout_hint",Ia="sid",Sa="login_hint",va="domain_hint",Zc="x-client-xtra-sku",Ln="brk_client_id",Ra="brk_redirect_uri";var Me=class{static validateRedirectUri(e){if(!e)throw O(er)}static validatePrompt(e){let t=[];for(let r in F)t.push(F[r]);if(t.indexOf(e)<0)throw O(nr)}static validateClaims(e){try{JSON.parse(e)}catch{throw O(Ye)}}static validateCodeChallengeParams(e,t){if(!e||!t)throw O(We);this.validateCodeChallengeMethod(t)}static validateCodeChallengeMethod(e){if([Cn.PLAIN,Cn.S256].indexOf(e)<0)throw O(sr)}};function el(n,e,t){if(!e)return;let r=n.get(et);r&&n.has(Ln)&&t?.addFields({embeddedClientId:r,embeddedRedirectUri:n.get(Nn)},e)}var Ue=class{constructor(e,t){this.parameters=new Map,this.performanceClient=t,this.correlationId=e}addResponseTypeCode(){this.parameters.set(On,encodeURIComponent(u.CODE_RESPONSE_TYPE))}addResponseTypeForTokenAndIdToken(){this.parameters.set(On,encodeURIComponent(`${u.TOKEN_RESPONSE_TYPE} ${u.ID_TOKEN_RESPONSE_TYPE}`))}addResponseMode(e){this.parameters.set(zi,encodeURIComponent(e||Mi.QUERY))}addNativeBroker(){this.parameters.set(ya,encodeURIComponent("1"))}addScopes(e,t=!0,r=me){t&&!r.includes("openid")&&!e.includes("openid")&&r.push("openid");let o=t?[...e||[],...r]:e||[],i=new B(o);this.parameters.set(Qi,encodeURIComponent(i.printScopes()))}addClientId(e){this.parameters.set(et,encodeURIComponent(e))}addRedirectUri(e){Me.validateRedirectUri(e),this.parameters.set(Nn,encodeURIComponent(e))}addPostLogoutRedirectUri(e){Me.validateRedirectUri(e),this.parameters.set(ua,encodeURIComponent(e))}addIdTokenHint(e){this.parameters.set(ga,encodeURIComponent(e))}addDomainHint(e){this.parameters.set(va,encodeURIComponent(e))}addLoginHint(e){this.parameters.set(Sa,encodeURIComponent(e))}addCcsUpn(e){this.parameters.set(z.CCS_HEADER,encodeURIComponent(`UPN:${e}`))}addCcsOid(e){this.parameters.set(z.CCS_HEADER,encodeURIComponent(`Oid:${e.uid}@${e.utid}`))}addSid(e){this.parameters.set(Ia,encodeURIComponent(e))}addClaims(e,t){let r=this.addClientCapabilitiesToClaims(e,t);Me.validateClaims(r),this.parameters.set(Vi,encodeURIComponent(r))}addCorrelationId(e){this.parameters.set(ra,encodeURIComponent(e))}addLibraryInfo(e){this.parameters.set(oa,e.sku),this.parameters.set(na,e.ver
1sion),e.os&&this.parameters.set(ia,e.os),e.cpu&&this.parameters.set(aa,e.cpu)}addApplicationTelemetry(e){e?.appName&&this.parameters.set(da,e.appName),e?.appVersion&&this.parameters.set(ha,e.appVersion)}addPrompt(e){Me.validatePrompt(e),this.parameters.set(`${Ji}`,encodeURIComponent(e))}addState(e){e&&this.parameters.set(Wi,encodeURIComponent(e))}addNonce(e){this.parameters.set(ji,encodeURIComponent(e))}addCodeChallengeParams(e,t){if(Me.validateCodeChallengeParams(e,t),e&&t)this.parameters.set(Zi,encodeURIComponent(e)),this.parameters.set(ea,encodeURIComponent(t));else throw O(We)}addAuthorizationCode(e){this.parameters.set(Xi,encodeURIComponent(e))}addDeviceCode(e){this.parameters.set(ma,encodeURIComponent(e))}addRefreshToken(e){this.parameters.set(Yi,encodeURIComponent(e))}addCodeVerifier(e){this.parameters.set(ta,encodeURIComponent(e))}addClientSecret(e){this.parameters.set(pa,encodeURIComponent(e))}addClientAssertion(e){e&&this.parameters.set(fa,encodeURIComponent(e))}addClientAssertionType(e){e&&this.parameters.set(Ca,encodeURIComponent(e))}addOboAssertion(e){this.parameters.set(Ta,encodeURIComponent(e))}addRequestTokenUse(e){this.parameters.set(Aa,encodeURIComponent(e))}addGrantType(e){this.parameters.set($i,encodeURIComponent(e))}addClientInfo(){this.parameters.set(is,"1")}addExtraQueryParameters(e){Object.entries(e).forEach(([t,r])=>{!this.parameters.has(t)&&r&&this.parameters.set(t,r)})}addClientCapabilitiesToClaims(e,t){let r;if(!e)r={};else try{r=JSON.parse(e)}catch{throw O(Ye)}return t&&t.length>0&&(r.hasOwnProperty(Er.ACCESS_TOKEN)||(r[Er.ACCESS_TOKEN]={}),r[Er.ACCESS_TOKEN][Er.XMS_CC]={values:t}),JSON.stringify(r)}addUsername(e){this.parameters.set(An.username,encodeURIComponent(e))}addPassword(e){this.parameters.set(An.password,encodeURIComponent(e))}addPopToken(e){e&&(this.parameters.set(Pn,N.POP),this.parameters.set(Mn,encodeURIComponent(e)))}addSshJwk(e){e&&(this.parameters.set(Pn,N.SSH),this.parameters.set(Mn,encodeURIComponent(e)))}addServerTelemetry(e){this.parameters.set(sa,e.generateCurrentRequestHeaderValue()),this.parameters.set(ca,e.generateLastRequestHeaderValue())}addThrottling(){this.parameters.set(la,Ge.X_MS_LIB_CAPABILITY_VALUE)}addLogoutHint(e){this.parameters.set(Ea,encodeURIComponent(e))}addBrokerParameters(e){let t={};t[Ln]=e.brokerClientId,t[Ra]=e.brokerRedirectUri,this.addExtraQueryParameters(t)}createQueryString(){let e=new Array;return this.parameters.forEach((t,r)=>{e.push(`${r}=${t}`)}),el(this.parameters,this.correlationId,this.performanceClient),e.join("&")}};var Hn={};ve(Hn,{createDiscoveredInstance:()=>ka});function fs(n){return n.hasOwnProperty("authorization_endpoint")&&n.hasOwnProperty("token_endpoint")&&n.hasOwnProperty("issuer")&&n.hasOwnProperty("jwks_uri")}function Cs(n){return n.hasOwnProperty("tenant_discovery_endpoint")&&n.hasOwnProperty("metadata")}function Ts(n){return n.hasOwnProperty("error")&&n.hasOwnProperty("error_description")}var c={AcquireTokenByCode:"acquireTokenByCode",AcquireTokenByRefreshToken:"acquireTokenByRefreshToken",AcquireTokenSilent:"acquireTokenSilent",AcquireTokenSilentAsync:"acquireTokenSilentAsync",AcquireTokenPopup:"acquireTokenPopup",AcquireTokenPreRedirect:"acquireTokenPreRedirect",AcquireTokenRedirect:"acquireTokenRedirect",CryptoOptsGetPublicKeyThumbprint:"cryptoOptsGetPublicKeyThumbprint",CryptoOptsSignJwt:"cryptoOptsSignJwt",SilentCacheClientAcquireToken:"silentCacheClientAcquireToken",SilentIframeClientAcquireToken:"silentIframeClientAcquireToken",AwaitConcurrentIframe:"awaitConcurrentIframe",SilentRefreshClientAcquireToken:"silentRefreshClientAcquireToken",SsoSilent:"ssoSilent",StandardInteractionClientGetDiscoveredAuthority:"standardInteractionClientGetDiscoveredAuthority",FetchAccountIdWithNativeBroker:"fetchAccountIdWithNativeBroker",NativeInteractionClientAcquireToken:"nativeInteractionClientAcquireToken",BaseClientCreateTokenRequestHeaders:"baseClientCreateTokenRequestHeaders",NetworkClientSendPostRequestAsync:"networkClientSendPostRequestAsync",RefreshTokenClientExecutePostToTokenEndpoint:"refreshTokenClientExecutePostToTokenEndpoint",AuthorizationCodeClientExecutePostToTokenEndpoint:"authorizationCodeClientExecutePostToTokenEndpoint",BrokerHandhshake:"brokerHandshake",AcquireTokenByRefreshTokenInBroker:"acquireTokenByRefreshTokenInBroker",AcquireTokenByBroker:"acquireTokenByBroker",RefreshTokenClientExecuteTokenRequest:"refreshTokenClientExecuteTokenRequest",RefreshTokenClientAcquireToken:"refreshTokenClientAcquireToken",RefreshTokenClientAcquireTokenWithCachedRefreshToken:"refreshTokenClientAcquireTokenWithCachedRefreshToken",RefreshTokenClientAcquireTokenByRefreshToken:"refreshTokenClientAcquireTokenByRefreshToken",RefreshTokenClientCreateTokenRequestBody:"refreshTokenClientCreateTokenRequestBody",AcquireTokenFromCache:"acquireTokenFromCache",SilentFlowClientAcquireCachedToken:"silentFlowClientAcquireCachedToken",SilentFlowClientGenerateResultFromCacheRecord:"silentFlowClientGenerateResultFromCacheRecord",AcquireTokenBySilentIframe:"acquireTokenBySilentIframe",InitializeBaseRequest:"initializeBaseRequest",InitializeSilentRequest:"initializeSilentRequest",InitializeClientApplication:"initializeClientApplication",SilentIframeClientTokenHelper:"silentIframeClientTokenHelper",SilentHandlerInitiateAuthRequest:"silentHandlerInitiateAuthRequest",SilentHandlerMonitorIframeForHash:"silentHandlerMonitorIframeForHash",SilentHandlerLoadFrame:"silentHandlerLoadFrame",SilentHandlerLoadFrameSync:"silentHandlerLoadFrameSync",StandardInteractionClientCreateAuthCodeClient:"standardInteractionClientCreateAuthCodeClient",
1StandardInteractionClientGetClientConfiguration:"standardInteractionClientGetClientConfiguration",StandardInteractionClientInitializeAuthorizationRequest:"standardInteractionClientInitializeAuthorizationRequest",StandardInteractionClientInitializeAuthorizationCodeRequest:"standardInteractionClientInitializeAuthorizationCodeRequest",GetAuthCodeUrl:"getAuthCodeUrl",HandleCodeResponseFromServer:"handleCodeResponseFromServer",HandleCodeResponse:"handleCodeResponse",UpdateTokenEndpointAuthority:"updateTokenEndpointAuthority",AuthClientAcquireToken:"authClientAcquireToken",AuthClientExecuteTokenRequest:"authClientExecuteTokenRequest",AuthClientCreateTokenRequestBody:"authClientCreateTokenRequestBody",AuthClientCreateQueryString:"authClientCreateQueryString",PopTokenGenerateCnf:"popTokenGenerateCnf",PopTokenGenerateKid:"popTokenGenerateKid",HandleServerTokenResponse:"handleServerTokenResponse",DeserializeResponse:"deserializeResponse",AuthorityFactoryCreateDiscoveredInstance:"authorityFactoryCreateDiscoveredInstance",AuthorityResolveEndpointsAsync:"authorityResolveEndpointsAsync",AuthorityResolveEndpointsFromLocalSources:"authorityResolveEndpointsFromLocalSources",AuthorityGetCloudDiscoveryMetadataFromNetwork:"authorityGetCloudDiscoveryMetadataFromNetwork",AuthorityUpdateCloudDiscoveryMetadata:"authorityUpdateCloudDiscoveryMetadata",AuthorityGetEndpointMetadataFromNetwork:"authorityGetEndpointMetadataFromNetwork",AuthorityUpdateEndpointMetadata:"authorityUpdateEndpointMetadata",AuthorityUpdateMetadataWithRegionalInformation:"authorityUpdateMetadataWithRegionalInformation",RegionDiscoveryDetectRegion:"regionDiscoveryDetectRegion",RegionDiscoveryGetRegionFromIMDS:"regionDiscoveryGetRegionFromIMDS",RegionDiscoveryGetCurrentVersion:"regionDiscoveryGetCurrentVersion",AcquireTokenByCodeAsync:"acquireTokenByCodeAsync",GetEndpointMetadataFromNetwork:"getEndpointMetadataFromNetwork",GetCloudDiscoveryMetadataFromNetworkMeasurement:"getCloudDiscoveryMetadataFromNetworkMeasurement",HandleRedirectPromiseMeasurement:"handleRedirectPromise",HandleNativeRedirectPromiseMeasurement:"handleNativeRedirectPromise",UpdateCloudDiscoveryMetadataMeasurement:"updateCloudDiscoveryMetadataMeasurement",UsernamePasswordClientAcquireToken:"usernamePasswordClientAcquireToken",NativeMessageHandlerHandshake:"nativeMessageHandlerHandshake",NativeGenerateAuthResult:"nativeGenerateAuthResult",RemoveHiddenIframe:"removeHiddenIframe",ClearTokensAndKeysWithClaims:"clearTokensAndKeysWithClaims",CacheManagerGetRefreshToken:"cacheManagerGetRefreshToken",GeneratePkceCodes:"generatePkceCodes",GenerateCodeVerifier:"generateCodeVerifier",GenerateCodeChallengeFromVerifier:"generateCodeChallengeFromVerifier",Sha256Digest:"sha256Digest",GetRandomValues:"getRandomValues"},bh=new Map([[c.AcquireTokenByCode,"ATByCode"],[c.AcquireTokenByRefreshToken,"ATByRT"],[c.AcquireTokenSilent,"ATS"],[c.AcquireTokenSilentAsync,"ATSAsync"],[c.AcquireTokenPopup,"ATPopup"],[c.AcquireTokenRedirect,"ATRedirect"],[c.CryptoOptsGetPublicKeyThumbprint,"CryptoGetPKThumb"],[c.CryptoOptsSignJwt,"CryptoSignJwt"],[c.SilentCacheClientAcquireToken,"SltCacheClientAT"],[c.SilentIframeClientAcquireToken,"SltIframeClientAT"],[c.SilentRefreshClientAcquireToken,"SltRClientAT"],[c.SsoSilent,"SsoSlt"],[c.StandardInteractionClientGetDiscoveredAuthority,"StdIntClientGetDiscAuth"],[c.FetchAccountIdWithNativeBroker,"FetchAccIdWithNtvBroker"],[c.NativeInteractionClientAcquireToken,"NtvIntClientAT"],[c.BaseClientCreateTokenRequestHeaders,"BaseClientCreateTReqHead"],[c.NetworkClientSendPostRequestAsync,"NetClientSendPost"],[c.RefreshTokenClientExecutePostToTokenEndpoint,"RTClientExecPost"],[c.AuthorizationCodeClientExecutePostToTokenEndpoint,"AuthCodeClientExecPost"],[c.BrokerHandhshake,"BrokerHandshake"],[c.AcquireTokenByRefreshTokenInBroker,"ATByRTInBroker"],[c.AcquireTokenByBroker,"ATByBroker"],[c.RefreshTokenClientExecuteTokenRequest,"RTClientExecTReq"],[c.RefreshTokenClientAcquireToken,"RTClientAT"],[c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,"RTClientATWithCachedRT"],[c.RefreshTokenClientAcquireTokenByRefreshToken,"RTClientATByRT"],[c.RefreshTokenClientCreateTokenRequestBody,"RTClientCreateTReqBody"],[c.AcquireTokenFromCache,"ATFromCache"],[c.SilentFlowClientAcquireCachedToken,"SltFlowClientATCached"],[c.SilentFlowClientGenerateResultFromCacheRecord,"SltFlowClientGenResFromCache"],[c.AcquireTokenBySilentIframe,"ATBySltIframe"],[c.InitializeBaseRequest,"InitBaseReq"],[c.InitializeSilentRequest,"InitSltReq"],[c.InitializeClientApplication,"InitClientApplication"],[c.SilentIframeClientTokenHelper,"SIClientTHelper"],[c.SilentHandlerInitiateAuthRequest,"SHandlerInitAuthReq"],[c.SilentHandlerMonitorIframeForHash,"SltHandlerMonitorIframeForHash"],[c.SilentHandlerLoadFrame,"SHandlerLoadFrame"],[c.SilentHandlerLoadFrameSync,"SHandlerLoadFrameSync"],[c.StandardInteractionClientCreateAuthCodeClient,"StdIntClientCreateAuthCodeClient"],[c.StandardInteractionClientGetClientConfiguration,"StdIntClientGetClientConf"],[c.StandardInteractionClientInitializeAuthorizationRequest,"StdIntClientInitAuthReq"],[c.StandardInteractionClientInitializeAuthorizationCodeRequest,"StdIntClientInitAuthCodeReq"],[c.GetAuthCodeUrl,"GetAuthCodeUrl"],[c.HandleCodeResponseFromServer,"HandleCodeResFromServer"],[c.HandleCodeResponse,"HandleCodeResp"],[c.UpdateTokenEndpointAuthority,"UpdTEndpointAuth"],[c.AuthClientAcquireToken,"AuthClientAT"],[c.AuthClientExecuteTokenRequest,"AuthClientExecTReq"],[c.AuthClientCreateTokenRequestBody,"AuthClientCreateTReqBody"],[c.AuthClientCreateQueryString,"AuthClientCreateQueryStr"],[c.PopTokenGenerateCnf,"PopTGenCnf"],[c.PopTokenGenerateKid,"PopTGenKid"],[c.HandleServerTokenResponse,"HandleServerTRes"],[c.DeserializeResponse,"DeserializeRes"],[c.AuthorityFactoryCreateDiscoveredInstance,"AuthFactCreateDiscInst"],[c.AuthorityResolveEndpointsAsync,"AuthResolveEndpointsAsync"],[c.AuthorityResolveEndpointsFromLocalSources,"AuthResolveEndpointsFromLocal"],[c.AuthorityGetCloudDiscoveryMetadataFromNetwork,"AuthGetCDMetaFromNet"],[c.AuthorityUpdateCloudDiscoveryMetadata,"AuthUpdCDMeta"],[c.AuthorityGetEndpointMetadataFromNetwork,"AuthUpdCDMetaFromNet"],[c.AuthorityUpdateEndpointMetadata,"AuthUpdEndpointMeta"],[c.AuthorityUpdateMetadataWithRegionalInformation,"AuthUpdMetaWithRegInfo"],[c.RegionDiscoveryDetectRegion,"RegDiscDetectReg"],[c.RegionDiscoveryGetRegionFromIMDS,"RegDiscGetRegFromIMDS"],[c.RegionDiscoveryGetCurrentVersion,"RegDiscGetCurrentVer"],[c.AcquireTokenByCodeAsync,"ATByCodeAsync"],[c.GetEndpointMetadataFromNetwork,"GetEndpointMetaFromNet"],[c.GetCloudDiscoveryMetadataFromNetworkMeasurement,"GetCDMetaFromNet"],[c.HandleRedirectPromiseMeasurement,"HandleRedirectPromise"],[c.HandleNativeRedirectPromiseMeasurement,"HandleNtvRedirectPromise"],[c.UpdateCloudDiscoveryMetadataMeasurement,"UpdateCDMeta"],[c.UsernamePasswordCl
1ientAcquireToken,"UserPassClientAT"],[c.NativeMessageHandlerHandshake,"NtvMsgHandlerHandshake"],[c.NativeGenerateAuthResult,"NtvGenAuthRes"],[c.RemoveHiddenIframe,"RemoveHiddenIframe"],[c.ClearTokensAndKeysWithClaims,"ClearTAndKeysWithClaims"],[c.CacheManagerGetRefreshToken,"CacheManagerGetRT"],[c.GeneratePkceCodes,"GenPkceCodes"],[c.GenerateCodeVerifier,"GenCodeVerifier"],[c.GenerateCodeChallengeFromVerifier,"GenCodeChallengeFromVerifier"],[c.Sha256Digest,"Sha256Digest"],[c.GetRandomValues,"GetRandomValues"]]),_a={NotStarted:0,InProgress:1,Completed:2};var ae=(n,e,t,r,o)=>(...i)=>{t.trace(`Executing function ${e}`);let a=r?.startMeasurement(e,o);if(o){let s=e+"CallCount";r?.incrementFields({[s]:1},o)}try{let s=n(...i);return a?.end({success:!0}),t.trace(`Returning result from ${e}`),s}catch(s){t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(s))}catch{t.trace("Unable to print error message.")}throw a?.end({success:!1},s),s}},p=(n,e,t,r,o)=>(...i)=>{t.trace(`Executing function ${e}`);let a=r?.startMeasurement(e,o);if(o){let s=e+"CallCount";r?.incrementFields({[s]:1},o)}return r?.setPreQueueTime(e,o),n(...i).then(s=>(t.trace(`Returning result from ${e}`),a?.end({success:!0}),s)).catch(s=>{t.trace(`Error occurred in ${e}`);try{t.trace(JSON.stringify(s))}catch{t.trace("Unable to print error message.")}throw a?.end({success:!1},s),s})};var As=(()=>{class n{constructor(t,r,o,i){this.networkInterface=t,this.logger=r,this.performanceClient=o,this.correlationId=i}detectRegion(t,r){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryDetectRegion,this.correlationId);let o=t;if(o)r.region_source=Mt.ENVIRONMENT_VARIABLE;else{let i=n.IMDS_OPTIONS;try{let a=yield p(this.getRegionFromIMDS.bind(this),c.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(u.IMDS_VERSION,i);if(a.status===Ao.httpSuccess&&(o=a.body,r.region_source=Mt.IMDS),a.status===Ao.httpBadRequest){let s=yield p(this.getCurrentVersion.bind(this),c.RegionDiscoveryGetCurrentVersion,this.logger,this.performanceClient,this.correlationId)(i);if(!s)return r.region_source=Mt.FAILED_AUTO_DETECTION,null;let l=yield p(this.getRegionFromIMDS.bind(this),c.RegionDiscoveryGetRegionFromIMDS,this.logger,this.performanceClient,this.correlationId)(s,i);l.status===Ao.httpSuccess&&(o=l.body,r.region_source=Mt.IMDS)}}catch{return r.region_source=Mt.FAILED_AUTO_DETECTION,null}}return o||(r.region_source=Mt.FAILED_AUTO_DETECTION),o||null})}getRegionFromIMDS(t,r){return h(this,null,function*(){return this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryGetRegionFromIMDS,this.correlationId),this.networkInterface.sendGetRequestAsync(`${u.IMDS_ENDPOINT}?api-version=${t}&format=text`,r,u.IMDS_TIMEOUT)})}getCurrentVersion(t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RegionDiscoveryGetCurrentVersion,this.correlationId);try{let r=yield this.networkInterface.sendGetRequestAsync(`${u.IMDS_ENDPOINT}?format=json`,t);return r.status===Ao.httpBadRequest&&r.body&&r.body["newest-versions"]&&r.body["newest-versions"].length>0?r.body["newest-versions"][0]:null}catch{return null}})}}return n.IMDS_OPTIONS={headers:{Metadata:"true"}},n})();var Ae=class n{constructor(e,t,r,o,i,a,s,l){this.canonicalAuthority=e,this._canonicalAuthority.validateAsUri(),this.networkInterface=t,this.cacheManager=r,this.authorityOptions=o,this.regionDiscoveryMetadata={region_used:void 0,region_source:void 0,region_outcome:void 0},this.logger=i,this.performanceClient=s,this.correlationId=a,this.managedIdentity=l||!1,this.regionDiscovery=new As(t,this.logger,this.performanceClient,this.correlationId)}getAuthorityType(e){if(e.HostNameAndPort.endsWith(u.CIAM_AUTH_URL))return ie.Ciam;let t=e.PathSegments;if(t.length)switch(t[0].toLowerCase()){case u.ADFS:return ie.Adfs;case u.DSTS:return ie.Dsts}return ie.Default}get authorityType(){return this.getAuthorityType(this.canonicalAuthorityUrlComponents)}get protocolMode(){return this.authorityOptions.protocolMode}get options(){return this.authorityOptions}get canonicalAuthority(){return this._canonicalAuthority.urlString}set canonicalAuthority(e){this._canonicalAuthority=new k(e),this._canonicalAuthority.val
1idateAsUri(),this._canonicalAuthorityUrlComponents=null}get canonicalAuthorityUrlComponents(){return this._canonicalAuthorityUrlComponents||(this._canonicalAuthorityUrlComponents=this._canonicalAuthority.getUrlComponents()),this._canonicalAuthorityUrlComponents}get hostnameAndPort(){return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase()}get tenant(){return this.canonicalAuthorityUrlComponents.PathSegments[0]}get authorizationEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.authorization_endpoint);throw g(ne)}get tokenEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint);throw g(ne)}get deviceCodeEndpoint(){if(this.discoveryComplete())return this.replacePath(this.metadata.token_endpoint.replace("/token","/devicecode"));throw g(ne)}get endSessionEndpoint(){if(this.discoveryComplete()){if(!this.metadata.end_session_endpoint)throw g(Jt);return this.replacePath(this.metadata.end_session_endpoint)}else throw g(ne)}get selfSignedJwtAudience(){if(this.discoveryComplete())return this.replacePath(this.metadata.issuer);throw g(ne)}get jwksUri(){if(this.discoveryComplete())return this.replacePath(this.metadata.jwks_uri);throw g(ne)}canReplaceTenant(e){return e.PathSegments.length===1&&!n.reservedTenantDomains.has(e.PathSegments[0])&&this.getAuthorityType(e)===ie.Default&&this.protocolMode===Z.AAD}replaceTenant(e){return e.replace(/{tenant}|{tenantid}/g,this.tenant)}replacePath(e){let t=e,o=new k(this.metadata.canonical_authority).getUrlComponents(),i=o.PathSegments;return this.canonicalAuthorityUrlComponents.PathSegments.forEach((s,l)=>{let d=i[l];if(l===0&&this.canReplaceTenant(o)){let m=new k(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];d!==m&&(this.logger.verbose(`Replacing tenant domain name ${d} with id ${m}`),d=m)}s!==d&&(t=t.replace(`/${d}/`,`/${s}/`))}),this.replaceTenant(t)}get defaultOpenIdConfigurationEndpoint(){let e=this.hostnameAndPort;return this.canonicalAuthority.endsWith("v2.0/")||this.authorityType===ie.Adfs||this.protocolMode!==Z.AAD&&!this.isAliasOfKnownMicrosoftAuthority(e)?`${this.canonicalAuthority}.well-known/openid-configuration`:`${this.canonicalAuthority}v2.0/.well-known/openid-configuration`}discoveryComplete(){return!!this.metadata}resolveEndpointsAsync(){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityResolveEndpointsAsync,this.correlationId);let e=this.getCurrentMetadataEntity(),t=yield p(this.updateCloudDiscoveryMetadata.bind(this),c.AuthorityUpdateCloudDiscoveryMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.canonicalAuthority=this.canonicalAuthority.replace(this.hostnameAndPort,e.preferred_network);let r=yield p(this.updateEndpointMetadata.bind(this),c.AuthorityUpdateEndpointMetadata,this.logger,this.performanceClient,this.correlationId)(e);this.updateCachedMetadata(e,t,{source:r}),this.performanceClient?.addFields({cloudDiscoverySource:t,authorityEndpointSource:r},this.correlationId)})}getCurrentMetadataEntity(){let e=this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort);return e||(e={aliases:[],preferred_cache:this.hostnameAndPort,preferred_network:this.hostnameAndPort,canonical_authority:this.canonicalAuthority,authorization_endpoint:"",token_endpoint:"",end_session_endpoint:"",issuer:"",aliasesFromNetwork:!1,endpointsFromNetwork:!1,expiresAt:Rn(),jwks_uri:""}),e}updateCachedMetadata(e,t,r){t!==oe.CACHE&&r?.source!==oe.CACHE&&(e.expiresAt=Rn(),e.canonical_authority=this.canonicalAuthority);let o=this.cacheManager.generateAuthorityMetadataCacheKey(e.preferred_cache);this.cacheManager.setAuthorityMetadata(o,e),this.metadata=e}updateEndpointMetadata(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateEndpointMetadata,this.correlationId);let t=this.updateEndpointMetadataFromLocalSources(e);if(t){if(t.source===oe.HARDCODED_VALUES&&this.authorityOptions.azureRegionConfiguration?.azureRegion&&t.metadata){let o=yield p(this.updateMetadataWithRegionalInformation.bind(this),c.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(t.metadata);_r(e,o,!1),e.canonical_authority=this.canonicalAuthority}return t.source}let r=yield p(this.getEndpointMetadataFromNetwork.bind(this),c.AuthorityGetEndpointMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(r)return this.authorityOptions.azureRegionConfiguration?.azureRegion&&(r=yield p(this.updateMetadataWithRegionalInformation.bind(this),c.AuthorityUpdateMetadataWithRegionalInformation,this.logger,this.performanceClient,this.correlationId)(r)),_r(e,r,!0),oe.NETWORK;throw g(xt,this.defaultOpenIdConfigurationEndpoint)})}updateEndpointMetadataFromLocalSources(e){this.logger.verbose("Attempting to get endpoint metadata from authority configuration");let t=this.getEndpointMetadataFromConfig();if(t)return this.logger.verbose("Found endpoint metadata in authority configuration"),_r(e,t,!1),{source:oe.CONFIG};if(this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values."),this.authorityOptions.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get endpoint metadata from the network metadata cache.");else{let o=this.getEndpointMetadataFromHardcodedValues();if(o)return _r(e,o,!1),{source:oe.HARDCODED_VALUES,metadata:o};this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.")}let r=_n(e);return this.isAuthoritySameType(e)&&e.endpointsFromNetwork&&!r?(this.logger.verbose("Found endpoint metadata in the cache."),{source:oe.CACHE}):(r&&this.logger.verbose("The metadata entity is expired."),null)}isAuthoritySameType(e){return new k(e.canonical_authority).getUrlComponents().PathSegments.length===this.canonicalAuthorityUrlComponents.PathSegments.length}getEndpointMetadataFromConfig(){if(this.authorityOptions.authorityMetadata)try{return JSON.parse(this.authorityOptions.authorityMetadata)}catch{throw O(cr)}return null}getEndpointMetadataFromNetwork(){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityGetEndpointMetadataFromNetwork,this.correlationId);let e={},t=this.defaultOpenIdConfigurationEndpoint;this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from ${t}`);try{let r=yield this.networkInterface.sendGetRequestAsync(t,e);return fs(r.body)?r.body:(this.logger.verbose("Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration"),null)}catch(r){return this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: ${r}`),null}})}getEndpointMetadataFromHardcodedValues(){return this.hostnameAndPort in Bi?Bi[this.hostnameAndPort]:null}updateMetadataWithRegionalInformation(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateMetadataWithRegionalInformation,this.correlationId);let t=this.authorityOptions.azureRegionConfiguration?.azureRegion;if(t){if(t!==u.AZURE_REGION_AUTO_DISCOVER_FLAG)return this.regionDiscoveryMetadata.region_outcome=yn.CONFIGURED_NO_AUTO_DETECTION,this.regionDiscoveryMetadata.region_used=t,n.replaceWithRegionalInformation(e,t);let r=yield p(this.regionDiscovery.detectRegion.bind(this.regionDiscovery),c.RegionDiscoveryDetectRegion,this.logger,this.performanceClient,this.correlationId)(this.authorityOptions.azureRegionConfiguration?.environmentRegion,this.regionDiscoveryMetadata);if(r)return this.regionDiscoveryMetadata.region_outcome=yn.AUTO_DETECTION_REQUESTED_SUCCESSFUL,this.regionDiscoveryMetadata.region_used=r,n.replaceWithRegionalInformation(e,r);this.regionDiscoveryMetadata.region_outcome=yn.AUTO_DETECTION_REQUESTED_FAILED}return e})}updateCloudDiscoveryMetadata(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityUpdateCloudDiscoveryMetadata,this.correlationId);let t=this.updateCloudDiscoveryMetadataFromLocalSources(e);if(t)return t;let r=yield p(this.getCloudDiscoveryMetadataFromNetwork.bind(this),c.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.logger,this.performanceClient,this.correlationId)();if(r)return Bo(e,r,!0),oe.NETWORK;throw O(lr)})}updateCloudDiscoveryMetadataFromLocalSources(e){this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration"),this.logger.verbosePii(`Known Authorities: ${this.authorityOptions.knownAuthorities||u.NOT_APPLICABLE}`),this.logger.verbosePii(`Authority Metadata: ${this.authorityOptions.authorityMetadata||u.NOT_APPLICABLE}`),this.logger.verbosePii(`Canonical Authority: ${e.canonical_authority||u.NOT_APPLICABLE}`);let t=this.getCloudDiscoveryMetadataFromConfig();if(t)return this.logger.verbose("Found cloud discovery metadata in authority configuration"),Bo(e,t,!1),oe.CONFIG;if(this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values."),this.options.skipAuthorityMetadataCache)this.logger.verbose("Skipping hardcoded cloud discovery metadata cache since skipAuthorityMetadataCache is set to true. Attempting to get cloud discovery metadata from the network metadata cache.");else{let o=ms(this.hostnameAndPort);if(o)return this.logger.verbose("Found cloud discovery metadata from hardcoded values."),Bo(e,o,!1),oe.HARDCODED_VALUES;this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.")}let r=_n(e);return this.isAuthoritySameType(e)&&e.aliasesFromNetwork&&!r?(this.logger.verbose("Found cloud discovery metadata in the cache."),oe.CACHE):(r&&this.logger.verbose("The metadata entity is expired."),null)}getCloudDiscoveryMetadataFromConfig(){if(this.authorityType===ie.Ciam)return this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host."),n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);if(this.authorityOptions.cloudDiscoveryMetadata){this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.");try{this.logger.verbose("Attempting to parse the cloud discovery metadata.");let e=JSON.parse(this.authorityOptions.cloudDiscoveryMetadata),t=Wo(e.metadata,this.hostnameAndPort);if(this.logger.verbose("Parsed the cloud discovery metadata."),t)return this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata."),t;this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.")}catch{throw this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error."),O(Ct)}}return this.isInKnownAuthorities()?(this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host."),n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)):null}getCloudDiscoveryMetadataFromNetwork(){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthorityGetCloudDiscoveryMetadataFromNetwork,this.correlationId);let e=`${u.AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`,t={},r=null;try{let o=yield this.networkInterface.sendGetRequestAsync(e,t),i,a;if(Cs(o.body))i=o.body,a=i.metadata,this.logger.verbosePii(`tenant_discovery_endpoint is: ${i.tenant_discovery_endpoint}`);
1else if(Ts(o.body)){if(this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: ${o.status}`),i=o.body,i.error===u.INVALID_INSTANCE)return this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance."),null;this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is ${i.error}`),this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is ${i.error_description}`),this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network) to []"),a=[]}else return this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse"),null;this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request."),r=Wo(a,this.hostnameAndPort)}catch(o){if(o instanceof b)this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata. 2Error: ${o.errorCode} 3Error Description: ${o.errorMessage}`);else{let i=o;this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata. 4Error: ${i.name} 5Error Description: ${i.message}`)}return null}return r||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request."),this.logger.verbose("Creating custom Authority for custom domain scenario."),r=n.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),r})}isInKnownAuthorities(){return this.authorityOptions.knownAuthorities.filter(t=>t&&k.getDomainFromUrl(t).toLowerCase()===this.hostnameAndPort).length>0}static generateAuthority(e,t){let r;if(t&&t.azureCloudInstance!==pt.None){let o=t.tenant?t.tenant:u.DEFAULT_COMMON_TENANT;r=`${t.azureCloudInstance}/${o}/`}return r||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return u.DEFAULT_AUTHORITY_HOST;if(this.discoveryComplete())return this.metadata.preferred_cache;throw g(ne)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return qi.has(e)}static isPublicCloudAuthority(e){return u.KNOWN_PUBLIC_CLOUDS.indexOf(e)>=0}static buildRegionalAuthorityString(e,t,r){let o=new k(e);o.validateAsUri();let i=o.getUrlComponents(),a=`${t}.${i.HostNameAndPort}`;this.isPublicCloudAuthority(i.HostNameAndPort)&&(a=`${t}.${u.REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`);let s=k.constructAuthorityUriFromObject(S(f({},o.getUrlComponents()),{HostNameAndPort:a})).urlString;return r?`${s}?${r}`:s}static replaceWithRegionalInformation(e,t){let r=f({},e);return r.authorization_endpoint=n.buildRegionalAuthorityString(r.authorization_endpoint,t),r.token_endpoint=n.buildRegionalAuthorityString(r.token_endpoint,t),r.end_session_endpoint&&(r.end_session_endpoint=n.buildRegionalAuthorityString(r.end_session_endpoint,t)),r}static transformCIAMAuthority(e){let t=e,o=new k(e).getUrlComponents();if(o.PathSegments.length===0&&o.HostNameAndPort.endsWith(u.CIAM_AUTH_URL)){let i=o.HostNameAndPort.split(".")[0];t=`${t}${i}${u.AAD_TENANT_DOMAIN_SUFFIX}`}return t}};Ae.reservedTenantDomains=new Set(["{tenant}","{tenantid}",_e.COMMON,_e.CONSUMERS,_e.ORGANIZATIONS]);function ys(n){let r=new k(n).getUrlComponents().PathSegments.slice(-1)[0]?.toLowerCase();switch(r){case _e.COMMON:case _e.ORGANIZATIONS:case _e.CONSUMERS:return;default:return r}}function Dn(n){return n.endsWith(u.FORWARD_SLASH)?n:`${n}${u.FORWARD_SLASH}`}function wa(n){let e=n.cloudDiscoveryMetadata,t;if(e)try{t=JSON.parse(e)}catch{throw O(Ct)}return{canonicalAuthority:n.authority?Dn(n.authority):void 0,knownAuthorities:n.knownAuthorities,cloudDiscoveryMetadata:t}}function ka(n,e,t,r,o,i,a){return h(this,null,function*(){a?.addQueueMeasurement(c.AuthorityFactoryCreateDiscoveredInstance,i);let s=Ae.transformCIAMAuthority(Dn(n)),l=new Ae(s,e,t,r,o,i,a);try{return yield p(l.resolveEndpointsAsync.bind(l),c.AuthorityResolveEndpointsAsync,o,a,i)(),l}catch{throw g(ne)}})}var se=class n extends b{constructor(e,t,r,o,i){super(e,t,r),this.name="ServerError",this.errorNo=o,this.status=i,Object.setPrototypeOf(this,n.prototype)}};var Le=class n{static generateThrottlingStorageKey(e){return`${Ge.THROTTLING_PREFIX}.${JSON.stringify(e)}`}static preProcess(e,t){let r=n.generateThrottlingStorageKey(t),o=e.getThrottlingCache(r);if(o){if(o.throttleTime<Date.now()){e.removeItem(r);return}throw new se(o.errorCodes?.join(" ")||u.EMPTY_STRING,o.errorMessage,o.subError)}}static postProcess(e,t,r){if(n.checkResponseStatus(r)||n.checkResponseForRetryAfter(r)){let o={throttleTime:n.calculateThrottleTime(parseInt(r.headers[z.RETRY_AFTER])),error:r.body.error,errorCodes:r.body.error_codes,errorMessage:r.body.error_description,subError:r.body.suberror};e.setThrottlingCache(n.generateThrottlingStorageKey(t),o)}}static checkResponseStatus(e){return e.status===429||e.status>=500&&e.status<600}static checkResponseForRetryAfter(e){return e.headers?e.headers.hasOwnProperty(z.RETRY_AFTER)&&(e.status<200||e.status>=300):!1}static calculateThrottleTime(e){let t=e<=0?0:e,r=Date.now()/1e3;return Math.floor(Math.min(r+(t||Ge.DEFAULT_THROTTLE_TIME_SECONDS),r+Ge.DEFAULT_MAX_THROTTLE_TIME_SECONDS)*1e3)}static removeThrottle(e,t,r,o){let i={clientId:t,authority:r.authority,scopes:r.scopes,homeAccountIdentifier:o,claims:r.claims,authenticationScheme:r.authenticationScheme,resourceRequestMethod:r.resourceRequestMethod,resourceRequestUri:r.resourceRequestUri,shrClaims:r.shrClaims,sshKid:r.sshKid},a=this.generateThrottlingStorageKey(i);e.removeItem(a)}};var Nr=class n extends b{constructor(e,t,r){super(e.errorCode,e.errorMessage,e.subError),Object.setPrototypeOf(this,n.prototype),this.name="NetworkError",this.error=e,this.httpStatus=t,this.responseHeaders=r}};function xn(n,e,t){return new Nr(n,e,t)}var At=class{constructor(e,t){this.config=ps(e),this.logger=new de(this.config.loggerOptions,Sn,vr),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=t}createTokenRequestHeaders(e){let t={};if(t[z.CONTENT_TYPE]=u.URL_FORM_CONTENT_TYPE,!this.config.systemOptions.preventCorsPreflight&&e)switch(e.type){case j.HOME_ACCOUNT_ID:try{let r=Je(e.credential);t[z.CCS_HEADER]=`Oid:${r.uid}@${r.utid}`}catch(r){this.logger.verbose("Could not parse home account ID for CCS Header: "+r)}break;case j.UPN:t[z.CCS_HEADER]=`UPN: ${e.credential}`;break}return t}executePostToTokenEndpoint(e,t,r,o,i,a){return h(this,null,function*(){a&&this.performanceClient?.addQueueMeasurement(a,i);let s=yield this.sendPostRequest(o,e,{body:t,headers:r},i);return this.config.serverTelemetryManager&&s.status<500&&s.status!==429&&this.config.serverTelemetryManager.clearTelemetryCache(),s})}sendPostRequest(e,t,r,o){return h(this,null,function*(){Le.preProcess(this.cacheManager,e);let i;try{i=yield p(this.networkClient.sendPostRequestAsync.bind(this.networkClient),c.NetworkClientSendPostRequestAsync,this.logger,this.performanceClient,o)(t,r);let a=i.headers||{};this.performanceClient?.addFields({refreshTokenSize:i.body.refresh_token?.length||0,httpVerToken:a[z.X_MS_HTTP_VERSION]||"",requestId:a[z.X_MS_REQUEST_ID]||""},o)}catch(a){if(a instanceof Nr){let s=a.responseHeaders;throw s&&this.performanceClient?.addFields({httpVerToken:s[z.X_MS_HTTP_VERSION]||"",requestId:s[z.X_MS_REQUEST_ID]||"",contentTypeHeader:s[z.CONTENT_TYPE]||void 0,contentLengthHeader:s[z.CONTENT_LENGTH]||void 0,httpStatus:a.httpStatus},o),a.error}throw a instanceof b?a:g(Ht)}return Le.postProcess(this.cacheManager,e,i),i})}updateAuthority(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.UpdateTokenEndpointAuthority,t);let r=`https://${e}/${this.authority.tenant}/`,o=yield ka(r,this.networkClient,this.cacheManager,this.authority.options,this.logger,t,this.performanceClient);this.authority=o})}createTokenQueryParameters(e){let t=new Ue(e.correlationId,this.performanceClient);return e.embeddedClientId&&t.addBrokerParameters({brokerClientId:this.config.authOptions.clientId,brokerRedirectUri:this.config.authOptions.redirectUri}),e.tokenQueryParameters&&t.addExtraQueryParameters(e.tokenQueryParameters),t.addCorrelationId(e.correlationId),t.createQueryString()}};var rt={};ve(rt,{badToken:()=>Et,consentRequired:()=>Na,interactionRequired:()=>ba,loginRequired:()=>Oa,nativeAccountUnavailable:()=>Zo,noTokensFound:()=>yt,refreshTokenExpired:()=>en});var yt="no_tokens_found",Zo="native_account_unavailable",en="refresh_token_expired",ba="interaction_required",Na="consent_required",Oa="login_required",Et="bad_token";var Es=[ba,Na,Oa,Et],tl=["message_only","additional_action","basic_action","user_password_expired","consent_required","bad_token"],Fn={[yt]:"No refresh token found in the cache. Please sign-in.",[Zo]:"The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",[en]:"Refresh token has expired.",[Et]:"Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve."},Is={noTokensFoundError:{code:yt,desc:Fn[yt]},native_account_unavailable:{code:Zo,desc:Fn[Zo]},bad_token:{code:Et,desc:Fn[Et]}},ee=class n extends b{constructor(e,t,r,o,i,a,s,l){super(e,t,r),Object.setPrototypeOf(this,n.prototype),this.timestamp=o||u.EMPTY_STRING,this.traceId=i||u.EMPTY_STRING,this.correlationId=a||u.EMPTY_STRING,this.claims=s||u.EMPTY_STRING,this.name="InteractionRequiredAuthError",this.errorNo=l}};function Pa(n,e,t){let r=!!n&&Es.indexOf(n)>-1,o=!!t&&tl.indexOf(t)>-1,i=!!e&&Es.some(a=>e.indexOf(a)>-1);return r||i||o}function Or(n){return new ee(n,Fn[n])}var J=class n{static setRequestState(e,t,r){let o=n.generateLibraryState(e,r);return t?`${o}${u.RESOURCE_DELIM}${t}`:o}static generateLibraryState(e,t){if(!e)throw g(gt);let r={id:e.createNewGuid()};t&&(r.meta=t);let o=JSON.stringify(r);return e.base64Encode(o)}static parseRequestState(e,t){if(!e)throw g(gt);if(!t)throw g(be);try{let r=t.split(u.RESOURCE_DELIM),o=r[0],i=r.length>1?r.slice(1).join(u.RESOURCE_DELIM):u.EMPTY_STRING,a=e.base64Decode(o),s=JSON.parse(a);return{userRequestState:i||u.EMPTY_STRING,libraryState:s}}catch{throw g(be)}}};var rl={SW:"sw",UHW:"uhw"},fe=class{constructor(e,t){this.cryptoUtils=e,this.performanceClient=t}generateCnf(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.PopTokenGenerateCnf,e.correlationId);let r=yield p(this.generateKid.bind(this),c.PopTokenGenerateCnf,t,this.performanceClient,e.correlationId)(e),o=this.cryptoUtils.base64UrlEncode(JSON.stringify(r));return{kid:r.kid,reqCnfString:o}})}generateKid(e){return h(this,null,function*(){return this.performanceClient?.addQueueMeasurement(c.PopTokenGenerateKid,e.correlationId),{kid:yield this.cryptoUtils.getPublicKeyThumbprint(e),xms_ksl:rl.SW}})}signPopToken(e,t,r){return h(this,null,function*(){return this.signPayload(e,t,r)})}signPayload(e,t,r,o){return h(this,null,function*(){let{resourceRequestMethod:i,resourceRequestUri:a,shrClaims:s,shrNonce:l,shrOptions:d}=r,T=(a?new k(a):void 0)?.getUrlComponents();return this.cryptoUtils.signJwt(f({at:e,ts:pe(),m:i?.toUpperCase(),u:T?.HostNameAndPort,nonce:l||this.cryptoUtils.createNewGuid(),p:T?.AbsolutePath,q:T?.QueryString?[[],T.QueryString]:void 0,client_claims:s||void 0},o),t,d,r.correlationId)})}};var Bn=class{constructor(e,t){this.cache=e,this.hasChanged=t}get cacheHasChanged(){return this.hasChanged}get tokenCache(){return this.cache}};function ol(n){let e="code=",t=n.error_uri?.lastIndexOf(e);return t&&t>=0?n.error_uri?.substring(t+e.length):void 0}var De=class n{constructor(e,t,r,o,i,a,s){this.clientId=e,this.cacheStorage=t,this.cryptoObj=r,this.logger=o,this.serializableCache=i,this.persistencePlugin=a,this.performanceClient=s}validateServerAuthorizationCodeResponse(e,t){if(!e.state||!t)throw e.state?g(ht,"Cached State"):g(ht,"Server State");let r,o;try{r=decodeURIComponent(e.state)}catch{throw g(be,e.state)}try{o=decodeURIComponent(t)}catch{throw g(be,e.state)}if(r!==o)throw g(Bt);if(e.error||e.error_description||e.suberror){let i=ol(e);throw Pa(e.error,e.error_description,e.suberror)?new ee(e.error||"",e.error_description,e.suberror,e.timestamp||"",e.trace_id||"",e.correlation_id||"",e.claims||"",i):new se(e.error||"",e.error_description,e.suberror,i)}}validateTokenResponse(e,t){if(e.error||e.error_description||e.suberror){let r=`Error(s): ${e.error_codes||u.NOT_AVAILABLE} - Timestamp: ${e.timestamp||u.NOT_AVAILABLE} - Description: ${e.error_description||u.NOT_AVAILABLE} - Correlation ID: ${e.correlation_id||u.NOT_AVAILABLE} - Trace ID: ${e.trace_id||u.NOT_AVAILABLE}`,o=e.error_codes?.length?e.error_codes[0]:void 0,i=new se(e.error,r,e.suberror,o,e.status);if(t&&e.status&&e.status>=yr.SERVER_ERROR_RANGE_START&&e.status<=yr.SERVER_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed. 6${i}`);return}else if(t&&e.status&&e.status>=yr.CLIENT_ERROR_RANGE_START&&e.status<=yr.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token. 7${i}`);return}throw Pa(e.error,e.error_description,e.suberror)?new ee(e.error,e.error_description,e.suberror,e.timestamp||u.EMPTY_STRING,e.trace_id||u.EMPTY_STRING,e.correlation_id||u.EMPTY_STRING,e.claims||u.EMPTY_STRING,o):i}}handleServerTokenResponse(e,t,r,o,i,a,s,l,d){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.HandleServerTokenResponse,e.correlation_id);let m;if(e.id_token){if(m=Qe(e.id_token||u.EMPTY_STRING,this.cryptoObj.base64Decode),i&&i.nonce&&m.nonce!==i.nonce)throw g(Kt);if(o.maxAge||o.maxAge===0){let L=m.auth_time;if(!L)throw g(ze);Ho(L,o.maxAge)}}this.homeAccountIdentifier=x.generateHomeAccountId(e.client_info||u.EMPTY_STRING,t.authorityType,this.logger,this.cryptoObj,m);let T;i&&i.state&&(T=J.parseRequestState(this.cryptoObj,i.state)),e.key_id=e.key_id||o.sshKid||void 0;let A=this.generateCacheRecord(e,t,r,o,m,a,i),R;try{if(this.persistencePlugin&&this.serializableCache&&(this.logger.verbose("Persistence enabled, calling beforeCacheAccess"),R=new Bn(this.serializableCache,!0),yield this.persistencePlugin.beforeCacheAccess(R)),s&&!l&&A.account){let L=A.account.generateAccountKey();if(!this.cacheStorage.getAccount(L,this.logger))return this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"),yield n.generateAuthenticationResult(this.cryptoObj,t,A,!1,o,m,T,void 0,d)}
7yield this.cacheStorage.saveCacheRecord(A,o.storeInCache,o.correlationId)}finally{this.persistencePlugin&&this.serializableCache&&R&&(this.logger.verbose("Persistence enabled, calling afterCacheAccess"),yield this.persistencePlugin.afterCacheAccess(R))}return n.generateAuthenticationResult(this.cryptoObj,t,A,!1,o,m,T,e,d)})}generateCacheRecord(e,t,r,o,i,a,s){let l=t.getPreferredCache();if(!l)throw g(Ve);let d=wn(i),m,T;e.id_token&&i&&(m=Di(this.homeAccountIdentifier,l,e.id_token,this.clientId,d||""),T=Pr(this.cacheStorage,t,this.homeAccountIdentifier,this.cryptoObj.base64Decode,i,e.client_info,l,d,s,void 0,this.logger));let A=null;if(e.access_token){let U=e.scope?B.fromString(e.scope):new B(o.scopes||[]),te=(typeof e.expires_in=="string"?parseInt(e.expires_in,10):e.expires_in)||0,Se=(typeof e.ext_expires_in=="string"?parseInt(e.ext_expires_in,10):e.ext_expires_in)||0,Pt=(typeof e.refresh_in=="string"?parseInt(e.refresh_in,10):e.refresh_in)||void 0,Ar=r+te,ki=Ar+Se,pn=Pt&&Pt>0?r+Pt:void 0;A=Hi(this.homeAccountIdentifier,l,e.access_token,this.clientId,d||t.tenant||"",U.printScopes(),Ar,ki,this.cryptoObj.base64Decode,pn,e.token_type,a,e.key_id,o.claims,o.requestedClaimsHash)}let R=null;if(e.refresh_token){let U;if(e.refresh_token_expires_in){let te=typeof e.refresh_token_expires_in=="str
7ing"?parseInt(e.refresh_token_expires_in,10):e.refresh_token_expires_in;U=r+te}R=xi(this.homeAccountIdentifier,l,e.refresh_token,this.clientId,e.foci,a,U)}let L=null;return e.foci&&(L={clientId:this.clientId,environment:l,familyId:e.foci}),{account:T,idToken:m,accessToken:A,refreshToken:R,appMetadata:L}}static generateAuthenticationResult(e,t,r,o,i,a,s,l,d){return h(this,null,function*(){let m=u.EMPTY_STRING,T=[],A=null,R,L,U=u.EMPTY_STRING;if(r.accessToken){if(r.accessToken.tokenType===N.POP&&!i.popKid){let Ar=new fe(e),{secret:ki,keyId:pn}=r.accessToken;if(!pn)throw g(Xt);m=yield Ar.signPopToken(ki,pn,i)}else m=r.accessToken.secret;T=B.fromString(r.accessToken.target).asArray(),A=new Date(Number(r.accessToken.expiresOn)*1e3),R=new Date(Number(r.accessToken.extendedExpiresOn)*1e3),r.accessToken.refreshOn&&(L=new Date(Number(r.accessToken.refreshOn)*1e3))}r.appMetadata&&(U=r.appMetadata.familyId===ct?ct:"");let te=a?.oid||a?.sub||"",Se=a?.tid||"";l?.spa_accountid&&r.account&&(r.account.nativeAccountId=l?.spa_accountid);let Pt=r.account?dr(r.account.getAccountInfo(),void 0,a,r.idToken?.secret):null;return{authority:t.canonicalAuthority,uniqueId:te,tenantId:Se,scopes:T,account:Pt,idToken:r?.idToken?.secret||"",idTokenClaims:a||{},accessToken:m,fromCache:o,expiresOn:A,extExpiresOn:R,refreshOn:L,correlationId:i.correlationId,requestId:d||u.EMPTY_STRING,familyId:U,tokenType:r.accessToken?.tokenType||u.EMPTY_STRING,state:s?s.userRequestState:u.EMPTY_STRING,cloudGraphHostName:r.account?.cloudGraphHostName||u.EMPTY_STRING,msGraphHost:r.account?.msGraphHost||u.EMPTY_STRING,code:l?.spa_code,fromNativeBroker:!1}})}};function Pr(n,e,t,r,o,i,a,s,l,d,m){m?.verbose("setCachedAccount called");let A=n.getAccountKeys().find(Se=>Se.startsWith(t)),R=null;A&&(R=n.getAccount(A,m));let L=R||x.createAccount({homeAccountId:t,idTokenClaims:o,clientInfo:i,environment:a,cloudGraphHostName:l?.cloud_graph_host_name,msGraphHost:l?.msgraph_host,nativeAccountId:d},e,r),U=L.tenantProfiles||[],te=s||L.realm;if(te&&!U.find(Se=>Se.tenantId===te)){let Se=br(t,L.localAccountId,te,o);U.push(Se)}return L.tenantProfiles=U,L}function Kn(n,e,t){return h(this,null,function*(){return typeof n=="string"?n:n({clientId:e,tokenEndpoint:t})})}var hr=class extends At{constructor(e,t){super(e,t),this.includeRedirectUri=!0,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}getAuthCodeUrl(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.GetAuthCodeUrl,e.correlationId);let t=yield p(this.createAuthCodeUrlQueryString.bind(this),c.AuthClientCreateQueryString,this.logger,this.performanceClient,e.correlationId)(e);return k.appendQueryString(this.authority.authorizationEndpoint,t)})}acquireToken(e,t){return h(this,null,function*(){if(this.performanceClient?.addQueueMeasurement(c.AuthClientAcquireToken,e.correlationId),!e.code)throw g(zt);let r=pe(),o=yield p(this.executeTokenRequest.bind(this),c.AuthClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(this.authority,e),i=o.headers?.[z.X_MS_REQUEST_ID],a=new De(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin,this.performanceClient);return a.validateTokenResponse(o.body),p(a.handleServerTokenResponse.bind(a),c.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,r,e,t,void 0,void 0,void 0,i)})}handleFragmentResponse(e,t){if(new De(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,null,null).validateServerAuthorizationCodeResponse(e,t),!e.code)throw g(Wt);return e}getLogoutUri(e){if(!e)throw O(ar);let t=this.createLogoutUrlQueryString(e);return k.appendQueryString(this.authority.endSessionEndpoint,t)}executeTokenRequest(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthClientExecuteTokenRequest,t.correlationId);let r=this.createTokenQueryParameters(t),o=k.appendQueryString(e.tokenEndpoint,r),i=yield p(this.createTokenRequestBody.bind(this),c.AuthClientCreateTokenRequestBody,this.logger,this.performanceClient,t.correlationId)(t),a;if(t.clientInfo)try{let d=wr(t.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${d.uid}${G.CLIENT_INFO_SEPARATOR}${d.utid}`,type:j.HOME_ACCOUNT_ID}}catch(d){this.logger.verbose("Could not parse client info for CCS Header: "+d)}let s=this.createTokenRequestHeaders(a||t.ccsCredential),l={clientId:t.tokenBodyParameters?.clientId||this.config.authOptions.clientId,authority:e.canonicalAuthority,scopes:t.scopes,claims:t.claims,authenticationScheme:t.authenticationScheme,resourceRequestMethod:t.resourceRequestMethod,resourceRequestUri:t.resourceRequestUri,shrClaims:t.shrClaims,sshKid:t.sshKid};return p(this.executePostToTokenEndpoint.bind(this),c.AuthorizationCodeClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,t.correlationId)(o,i,s,l,t.correlationId,c.AuthorizationCodeClientExecutePostToTokenEndpoint)})}createTokenRequestBody(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.AuthClientCreateTokenRequestBody,e.correlationId);let t=new Ue(e.correlationId,this.performanceClient);if(t.addClientId(e.embeddedClientId||e.tokenBodyParameters?.[et]||this.config.authOptions.clientId),this.includeRedirectUri?t.addRedirectUri(e.redirectUri):Me.validateRedirectUri(e.redirectUri),t.addScopes(e.scopes,!0,this.oidcDefaultScopes),t.addAuthorizationCode(e.code),t.addLibraryInfo(this.config.libraryInfo),t.addApplicationTelemetry(this.config.telemetry.application),t.addThrottling(),this.serverTelemetryManager&&!Xo(this.config)&&t.addServerTelemetry(this.serverTelemetryManager),e.codeVerifier&&t.addCodeVerifier(e.codeVerifier),this.config.clientCredentials.clientSecret&&t.addClientSecret(this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;t.addClientAssertion(yield Kn(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),t.addClientAssertionType(o.assertionType)}if(t.addGrantType(Co.AUTHORIZATION_CODE_GRANT),t.addClientInfo(),e.authenticationScheme===N.POP){let o=new fe(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(yield p(o.generateCnf.bind(o),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,t.addPopToken(i)}else if(e.authenticationScheme===N.SSH)if(e.sshJwk)t.addSshJwk(e.sshJwk);else throw O(je);(!q.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&t.addClaims(e.claims,this.config.authOptions.clientCapabilities);let r;if(e.clientInfo)try{let o=wr(e.clientInfo,this.cryptoUtils.base64Decode);r={credential:`${o.uid}${G.CLIENT_INFO_SEPARATOR}${o.utid}`,type:j.HOME_ACCOUNT_ID}}catch(o){this.logger.verbose("Could not parse client info for CCS Header: "+o)}else r=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&r)switch(r.type){case j.HOME_ACCOUNT_ID:try{let o=Je(r.credential);t.addCcsOid(o)}catch(o){this.logger.verbose("Could not parse home account ID for CCS Header: "+o)}break;case j.UPN:t.addCcsUpn(r.credential);break}return e.embeddedClientId&&t.addBrokerParameters({brokerClientId:this.config.authOptions.clientId,brokerRedirectUri:this.config.authOptions.redirectUri}),e.tokenBodyParameters&&t.addExtraQueryParameters(e.tokenBodyParameters),e.enableSpaAuthorizationCode&&(!e.tokenBodyParameters||!e.tokenBodyParameters[Un])&&t.addExtraQueryParameters({[Un]:"1"}),t.createQueryString()})}createAuthCodeUrlQueryString(e){return h(this,null,function*(){let t=e.correlationId||this.config.cryptoInterface.createNewGuid();this.performanceClient?.addQueueMeasurement(c.AuthClientCreateQueryString,t);let r=new Ue(t,this.performanceClient);r.addClientId(e.embeddedClientId||e.extraQueryParameters?.[et]||this.config.authOptions.clientId);let o=[...e.scopes||[],...e.extraScopesToConsent||[]];if(r.addScopes(o,!0,this.oidcDefaultScopes),r.addRedirectUri(e.redirectUri),r.addCorrelationId(t),r.addResponseMode(e.responseMode),r.addResponseTypeCode(),r.addLibraryInfo(this.config.libraryInfo),Xo(this.config)||r.addApplicationTelemetry(this.config.telemetry.application),r.addClientInfo(),e.codeChallenge&&e.codeChallengeMethod&&r.addCodeChallengeParams(e.codeChallenge,e.codeChallengeMethod),e.prompt&&r.addPrompt(e.prompt),e.domainHint&&r.addDomainHint(e.domainHint),e.prompt!==F.SELECT_ACCOUNT)if(e.sid&&e.prompt===F.NONE)this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request"),r.addSid(e.sid);else if(e.account){let i=this.extractAccountSid(e.account),a=this.extractLoginHint(e.account);if(a&&e.domainHint&&(this.logger.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint'),a=null),a){this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account"),r.addLoginHint(a);try{let s=Je(e.account.homeAccountId);r.addCcsOid(s)}catch{this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(i&&e.prompt===F.NONE){this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account"),r.addSid(i);try{let s=Je(e.account.homeAccountId);r.addCcsOid(s)}catch{this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}else if(e.loginHint)this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request"),r.addLoginHint(e.loginHint),r.addCcsUpn(e.loginHint);else if(e.account.username){this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account"),r.addLoginHint(e.account.username);try{let s=Je(e.account.homeAccountId);r.addCcsOid(s)}catch{this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header")}}}else e.loginHint&&(this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request"),r.addLoginHint(e.loginHint),r.addCcsUpn(e.loginHint));else this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");if(e.nonce&&r.addNonce(e.nonce),e.state&&r.addState(e.state),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&r.addClaims(e.claims,this.config.authOptions.clientCapabilities),e.embeddedClientId&&r.addBrokerParameters({brokerClientId:this.config.authOptions.clientId,brokerRedirectUri:this.config.authOptions.redirectUri}),this.addExtraQueryParams(e,r),e.nativeBroker&&(r.addNativeBroker(),e.authenticationScheme===N.POP)){let i=new fe(this.cryptoUtils),a;e.popKid?a=this.cryptoUtils.encodeKid(e.popKid):a=(yield p(i.generateCnf.bind(i),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,r.addPopToken(a)}return r.createQueryString()})}createLogoutUrlQueryString(e){let t=new Ue(e.correlationId,this.performanceClient);return e.postLogoutRedirectUri&&t.addPostLogoutRedirectUri(e.postLogoutRedirectUri),e.correlationId&&t.addCorrelationId(e.correlationId),e.idTokenHint&&t.addIdTokenHint(e.idTokenHint),e.state&&t.addState(e.state),e.logoutHint&&t.addLogoutHint(e.logoutHint),this.addExtraQueryParams(e,t),t.createQueryString()}addExtraQueryParams(e,t){!(e.extraQueryParameters&&e.extraQueryParameters.hasOwnProperty("instance_aware"))&&this.config.authOptions.instanceAware&&(e.extraQueryParameters=e.extraQueryParameters||{},e.extraQueryParameters.instance_aware="true"),e.extraQueryParameters&&t.addExtraQueryParameters(e.extraQueryParameters)}extractAccountSid(e){return e.idTokenClaims?.sid||null}extractLoginHint(e){return e.idTokenClaims?.login_hint||null}};var nl=300,It=class extends At{constructor(e,t){super(e,t)}acquireToken(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireToken,e.correlationId);
7let t=pe(),r=yield p(this.executeTokenRequest.bind(this),c.RefreshTokenClientExecuteTokenRequest,this.logger,this.performanceClient,e.correlationId)(e,this.authority),o=r.headers?.[z.X_MS_REQUEST_ID],i=new De(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(r.body),p(i.handleServerTokenResponse.bind(i),c.HandleServerTokenResponse,this.logger,this.performanceClient,e.correlationId)(r.body,this.authority,t,e,void 0,void 0,!0,e.forceCache,o)})}acquireTokenByRefreshToken(e){return h(this,null,function*(){if(!e)throw O(ir);if(this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireTokenByRefreshToken,e.correlationId),!e.account)throw g($e);if(this.cacheManager.isAppMetadataFOCI(e.account.environment))try{return yield p(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!0)}catch(r){let o=r instanceof ee&&r.errorCode===yt,i=r instanceof se&&r.errorCode===Tn.INVALID_GRANT_ERROR&&r.subError===Tn.CLIENT_MISMATCH_ERROR;if(o||i)return p(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1);throw r}return p(this.acquireTokenWithCachedRefreshToken.bind(this),c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,!1)})}acquireTokenWithCachedRefreshToken(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientAcquireTokenWithCachedRefreshToken,e.correlationId);let r=ae(this.cacheManager.getRefreshToken.bind(this.cacheManager),c.CacheManagerGetRefreshToken,this.logger,this.performanceClient,e.correlationId)(e.account,t,void 0,this.performanceClient,e.correlationId);if(!r)throw Or(yt);if(r.expiresOn&&Rr(r.expiresOn,e.refreshTokenExpirationOffsetSeconds||nl))throw Or(en);let o=S(f({},e),{refreshToken:r.secret,authenticationScheme:e.authenticationScheme||N.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:j.HOME_ACCOUNT_ID}});try{return yield p(this.acquireToken.bind(this),c.RefreshTokenClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(o)}catch(i){if(i instanceof ee&&i.subError===Et){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");let a=Fo(r);this.cacheManager.removeRefreshToken(a)}throw i}})}executeTokenRequest(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientExecuteTokenRequest,e.correlationId);let r=this.createTokenQueryParameters(e),o=k.appendQueryString(t.tokenEndpoint,r),i=yield p(this.createTokenRequestBody.bind(this),c.RefreshTokenClientCreateTokenRequestBody,this.logger,this.performanceClient,e.correlationId)(e),a=this.createTokenRequestHeaders(e.ccsCredential),s={clientId:e.tokenBodyParameters?.clientId||this.config.authOptions.clientId,authority:t.canonicalAuthority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};return p(this.executePostToTokenEndpoint.bind(this),c.RefreshTokenClientExecutePostToTokenEndpoint,this.logger,this.performanceClient,e.correlationId)(o,i,a,s,e.correlationId,c.RefreshTokenClientExecutePostToTokenEndpoint)})}createTokenRequestBody(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.RefreshTokenClientCreateTokenRequestBody,e.correlationId);let t=e.correlationId,r=new Ue(t,this.performanceClient);if(r.addClientId(e.embeddedClientId||e.tokenBodyParameters?.[et]||this.config.authOptions.clientId),e.redirectUri&&r.addRedirectUri(e.redirectUri),r.addScopes(e.scopes,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),r.addGrantType(Co.REFRESH_TOKEN_GRANT),r.addClientInfo(),r.addLibraryInfo(this.config.libraryInfo),r.addApplicationTelemetry(this.config.telemetry.application),r.addThrottling(),this.serverTelemetryManager&&!Xo(this.config)&&r.addServerTelemetry(this.serverTelemetryManager),r.addRefreshToken(e.refreshToken),this.config.clientCredentials.clientSecret&&r.addClientSecret(this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;r.addClientAssertion(yield Kn(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),r.addClientAssertionType(o.assertionType)}if(e.authenticationScheme===N.POP){let o=new fe(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(yield p(o.generateCnf.bind(o),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,r.addPopToken(i)}else if(e.authenticationScheme===N.SSH)if(e.sshJwk)r.addSshJwk(e.sshJwk);else throw O(je);if((!q.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&r.addClaims(e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case j.HOME_ACCOUNT_ID:try{let o=Je(e.ccsCredential.credential);r.addCcsOid(o)}catch(o){this.logger.verbose("Could not parse home account ID for CCS Header: "+o)}break;case j.UPN:r.addCcsUpn(e.ccsCredential.credential);break}return e.embeddedClientId&&r.addBrokerParameters({brokerClientId:this.config.authOptions.clientId,brokerRedirectUri:this.config.authOptions.redirectUri}),e.tokenBodyParameters&&r.addExtraQueryParameters(e.tokenBodyParameters),r.createQueryString()})}};var tn=class extends At{constructor(e,t){super(e,t)}acquireToken(e){return h(this,null,function*(){try{let[t,r]=yield this.acquireCachedToken(S(f({},e),{scopes:e.scopes?.length?e.scopes:[...me]}));return r===ke.PROACTIVELY_REFRESHED&&(this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed."),new It(this.config,this.performanceClient).acquireTokenByRefreshToken(e).catch(()=>{})),t}catch(t){if(t instanceof Zt&&t.errorCode===Oe)return new It(this.config,this.performanceClient).acquireTokenByRefreshToken(e);throw t}})}acquireCachedToken(e){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.SilentFlowClientAcquireCachedToken,e.correlationId);let t=ke.NOT_APPLICABLE;if(e.forceRefresh||!this.config.cacheOptions.claimsBasedCachingEnabled&&!q.isEmptyObj(e.claims))throw this.setCacheOutcome(ke.FORCE_REFRESH_OR_CLAIMS,e.correlationId),g(Oe);if(!e.account)throw g($e);let r=e.account.tenantId||ys(e.authority),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,r,this.performanceClient,e.correlationId);if(i){if(Li(i.cachedAt)||Rr(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(ke.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),g(Oe);i.refreshOn&&Rr(i.refreshOn,0)&&(t=ke.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(ke.NO_CACHED_ACCESS_TOKEN,e.correlationId),g(Oe);let a=e.authority||this.authority.getPreferredCache(),s={account:this.cacheManager.readAccountFromCache(e.account),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,o,r,this.performanceClient,e.correlationId),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCac
7he(a)};return this.setCacheOutcome(t,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[yield p(this.generateResultFromCacheRecord.bind(this),c.SilentFlowClientGenerateResultFromCacheRecord,this.logger,this.performanceClient,e.correlationId)(s,e),t]})}setCacheOutcome(e,t){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},t),e!==ke.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: ${e}`)}generateResultFromCacheRecord(e,t){return h(this,null,function*(){this.performanceClient?.addQueueMeasurement(c.SilentFlowClientGenerateResultFromCacheRecord,t.correlationId);let r;if(e.idToken&&(r=Qe(e.idToken.secret,this.config.cryptoInterface.base64Decode)),t.maxAge||t.maxAge===0){let o=r?.auth_time;if(!o)throw g(ze);Ho(o,t.maxAge)}return De.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,t,r)})}};var Ma={sendGetRequestAsync:()=>Promise.reject(g(_)),sendPostRequestAsync:()=>Promise.reject(g(_))};var Ss=",",vs="|";function il(n){let{skus:e,libraryName:t,libraryVersion:r,extensionName:o,extensionVersion:i}=n,a=new Map([[0,[t,r]],[2,[o,i]]]),s=[];if(e?.length){if(s=e.split(Ss),s.length<4)return e}else s=Array.from({length:4},()=>vs);return a.forEach((l,d)=>{l.length===2&&l[0]?.length&&l[1]?.length&&al({skuArr:s,index:d,skuName:l[0],skuVersion:l[1]})}),s.join(Ss)}function al(n){let{skuArr:e,index:t,skuName:r,skuVersion:o}=n;t>=e.length||(e[t]=[r,o].join(vs))}var ur=class n{constructor(e,t){this.cacheOutcome=ke.NOT_APPLICABLE,this.cacheManager=t,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||u.EMPTY_STRING,this.wrapperVer=e.wrapperVer||u.EMPTY_STRING,this.telemetryCacheKey=Y.CACHE_KEY+G.CACHE_KEY_SEPARATOR+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${Y.VALUE_SEPARATOR}${this.cacheOutcome}`,t=[this.wrapperSKU,this.wrapperVer],r=this.getNativeBrokerErrorCode();r?.length&&t.push(`broker_error=${r}`);let o=t.join(Y.VALUE_SEPARATOR),i=this.getRegionDiscoveryFields(),a=[e,i].join(Y.VALUE_SEPARATOR);return[Y.SCHEMA_VERSION,a,o].join(Y.CATEGORY_SEPARATOR)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),t=n.maxErrorsToSend(e),r=e.failedRequests.slice(0,2*t).join(Y.VALUE_SEPARATOR),o=e.errors.slice(0,t).join(Y.VALUE_SEPARATOR),i=e.errors.length,a=t<i?Y.OVERFLOW_TRUE:Y.OVERFLOW_FALSE,s=[i,a].join(Y.VALUE_SEPARATOR);return[Y.SCHEMA_VERSION,e.cacheHits,r,o,s].join(Y.CATEGORY_SEPARATOR)}cacheFailedRequest(e){let t=this.getLastRequests();t.errors.length>=Y.MAX_CACHED_ERRORS&&(t.failedRequests.shift(),t.failedRequests.shift(),t.errors.shift()),t.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof b?e.subError?t.errors.push(e.subError):e.errorCode?t.errors.push(e.errorCode):t.errors.push(e.toString()):t.errors.push(e.toString()):t.errors.push(Y.UNKNOWN_ERROR),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t)}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey)||e}clearTelemetryCache(){let e=this.getLastRequests(),t=n.maxErrorsToSend(e),r=e.errors.length;if(t===r)this.cacheManager.removeItem(this.telemetryCacheKey);else{let o={failedRequests:e.failedRequests.slice(t*2),errors:e.errors.slice(t),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o)}}static maxErrorsToSend(e){let t,r=0,o=0,i=e.errors.length;for(t=0;t<i;t++){let a=e.failedRequests[2*t]||u.EMPTY_STRING,s=e.failedRequests[2*t+1]||u.EMPTY_STRING,l=e.errors[t]||u.EMPTY_STRING;if(o+=a.toString().length+s.toString().length+l.length+3,o<Y.MAX_LAST_HEADER_BYTES)r+=1;else break}return r}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||u.EMPTY_STRING),e.push(this.regionSource||u.EMPTY_STRING),e.push(this.regionOutcome||u.EMPTY_STRING),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let t=this.getLastRequests();t.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,t)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e)}static makeExtraSkuString(e){return il(e)}};var qn="missing_kid_error",Gn="missing_alg_error";var sl={[qn]:"The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",[Gn]:"The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."},Ua=class n extends b{constructor(e,t){super(e,t),this.name="JoseHeaderError",Object.setPrototypeOf(this,n.prototype)}};function La(n){return new Ua(n,sl[n])}var rn=class n{constructor(e){this.typ=e.typ,this.alg=e.alg,this.kid=e.kid}static getShrHeaderString(e){if(!e.kid)throw La(qn);if(!e.alg)throw La(Gn);let t=new n({typ:e.typ||En.Pop,kid:e.kid,alg:e.alg});return JSON.stringify(t)}};var zn=class{startMeasurement(){}endMeasurement(){}flushMeasurement(){return null}},Mr=class{generateId(){return"callback-id"}startMeasurement(e,t){return{end:()=>null,discard:()=>{},add:()=>{},increment:()=>{},event:{eventId:this.generateId(),status:_a.InProgress,authority:"",libraryName:"",libraryVersion:"",clientId:"",name:e,startTimeMs:Date.now(),correlationId:t||""},measurement:new zn}}startPerformanceMeasurement(){return new zn}calculateQueuedTime(){return 0}addQueueMeasurement(){}setPreQueueTime(){}endMeasurement(){return null}discardMeasurements(){}removePerformanceCallback(){return!0}addPerformanceCallback(){return""}emitEvents(){}addFields(){}incrementFields(){}cacheEventByCorrelationId(){}};var gr="pkce_not_created",mr="crypto_nonexistent",He="empty_navigate_uri",Ur="hash_empty_error",St="no_state_in_hash",Lr="hash_does_not_contain_known_properties",Dr="unable_to_parse_state",Hr="state_interaction_type_mismatch",xr="interaction_in_progress",Fr="popup_window_error",Br="empty_window_error",he="user_cancelled",$n="monitor_popup_timeout",Kr="monitor_window_timeout",qr
7="redirect_in_iframe",Gr="block_iframe_reload",zr="block_nested_popups",Vn="iframe_closed_prematurely",xe="silent_logout_unsupported",$r="no_account_error",Qn="silent_prompt_value_error",Vr="no_token_request_cache_error",Qr="unable_to_parse_token_request_cache_error",vt="no_cached_authority_error",Yn="auth_request_not_set_error",Wn="invalid_cache_type",Fe="non_browser_environment",Be="database_not_open",ot="no_network_connectivity",Yr="post_request_failed",Wr="get_request_failed",pr="failed_to_parse_response",jr="unable_to_load_token",Rt="crypto_key_not_found",Jr="auth_code_required",Xr="auth_code_or_nativeAccountId_required",Zr="spa_code_and_nativeAccountId_present",_t="database_unavailable",eo="unable_to_acquire_token_from_native_platform",to="native_handshake_timeout",ro="native_extension_not_installed",ye="native_connection_not_established",oo="uninitialized_public_client_application",no="native_prompt_not_supported",io="invalid_base64_string",ao="invalid_pop_token_request",jn="failed_to_build_headers",Jn="failed_to_parse_headers";var nt="For more visit: aka.ms/msaljs/browser-errors",v={[gr]:"The PKCE code challenge and verifier could not be generated.",[mr]:"The crypto object or function is not available.",[He]:"Navigation URI is empty. Please check stack trace for more info.",[Ur]:`Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. ${nt}`,[St]:"Hash does not contain state. Please verify that the request originated from msal.",[Lr]:`Hash does not contain known properites. Please verify that your redirectUri is not changing the hash. ${nt}`,[Dr]:"Unable to parse state. Please verify that the request originated from msal.",[Hr]:"Hash contains state but the interaction type does not match the caller.",[xr]:`Interaction is currently in progress. Please ensure that this interaction has been completed before calling an interactive API. ${nt}`,[Fr]:"Error opening popup window. This can happen if you are using IE or if popups are blocked in the browser.",[Br]:"window.open returned null or undefined window object.",[he]:"User cancelled the flow.",[$n]:`Token acquisition in popup failed due to timeout. ${nt}`,[Kr]:`Token acquisition in iframe failed due to timeout. ${nt}`,[qr]:"Redirects are not supported for iframed or brokered applications. Please ensure you are using MSAL.js in a top frame of the window if using the redirect APIs, or use the popup APIs.",[Gr]:`Request was blocked inside an iframe because MSAL detected an authentication response. ${nt}`,[zr]:"Request was blocked inside a popup because MSAL detected it was running in a popup.",[Vn]:"The iframe being monitored was closed prematurely.",[xe]:"Silent logout not supported. Please call logoutRedirect or logoutPopup instead.",[$r]:"No account object provided to acquireTokenSilent and no active account has been set. Please call setActiveAccount or provide an account on the request.",[Qn]:"The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'.",[Vr]:"No token request found in cache.",[Qr]:"The cached token request could not be parsed.",[vt]:"No cached authority found.",[Yn]:"Auth Request not set. Please ensure initiateAuthRequest was called from the InteractionHandler",[Wn]:"Invalid cache type",[Fe]:"Login and token requests are not supported in non-browser environments.",[Be]:"Database is not open!",[ot]:"No network connectivity. Check your internet connection.",[Yr]:"Network request failed: If the browser threw a CORS error, check that the redirectUri is registered in the Azure App Portal as type 'SPA'",[Wr]:"Network request failed. Please check the network trace to determine root cause.",[pr]:"Failed to parse network response. Check network trace.",[jr]:"Error loading token to cache.",[Rt]:"Cryptographic Key or Keypair not found in browser storage.",[Jr]:"An authorization code must be provided (as the `code` property on the request) to this flow.",[Xr]:"An authorization code or nativeAccountId must be provided to this flow.",[Zr]:"Request cannot contain both spa code and native account id.",[_t]:"IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts.",[eo]:`Unable to acquire token from native platform. ${nt}`,[to]:"Timed out while attempting to establish connection to browser extension",[ro]:"Native extension is not installed. If you think this is a mistake call the initialize function.",[ye]:`Connection to native platform has not been established. Please install a compatible browser extension and run initialize(). ${nt}`,[oo]:`You must call and await the initialize function before attempting to call any other MSAL API. ${nt}`,[no]:"The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",[io]:"Invalid base64 encoded string.",[ao]:"Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",[jn]:"Failed to build request headers object.",[Jn]:"Failed to parse response headers"},vp={pkceNotGenerated:{code:gr,desc:v[gr]},cryptoDoesNotExist:{code:mr,desc:v[mr]},emptyNavigateUriError:{code:He,desc:v[He]},hashEmptyError:{code:Ur,desc:v[Ur]},hashDoesNotContainStateError:{code:St,desc:v[St]},hashDoesNotContainKnownPropertiesError:{code:Lr,desc:v[Lr]},unableToParseStateError:{code:Dr,desc:v[Dr]},stateInteractionTypeMismatchError:{code:Hr,desc:v[Hr]},interactionInProgress:{code:xr,desc:v[xr]},popupWindowError:{code:Fr,desc:v[Fr]},emptyWindowError:{code:Br,desc:v[Br]},userCancelledError:{code:he,desc:v[he]},monitorPopupTimeoutError:{code:$n,desc:v[$n]},monitorIframeTimeoutError:{code:Kr,desc:v[Kr]},redirectInIframeError:{code:qr,desc:v[qr]},blockTokenRequestsInHiddenIframeError:{code:Gr,desc:v[Gr]},blockAcquireTokenInPopupsError:{code:zr,desc:v[zr]},iframeClosedPrematurelyError:{code:Vn,desc:v[Vn]},silentLogoutUnsupportedError:{code:xe,desc:v[xe]},noAccountError:{code:$r,desc:v[$r]},silentPromptValueError:{code:Qn,desc:v[Qn]},noTokenRequestCacheError:{code:Vr,desc:v[Vr]},unableToParseTokenRequestCacheError:{code:Qr,desc:v[Qr]},noCachedAuthorityError:{code:vt,desc:v[vt]},authRequestNotSet:{code:Yn,desc:v[Yn]},invalidCacheType:{code:Wn,desc:v[Wn]},notInBrowserEnvironment:{code:Fe,desc:v[Fe]},databaseNotOpen:{code:Be,desc:v[Be]},noNetworkConnectivity:{code:ot,desc:v[ot]},postRequestFailed:{code:Yr,desc:v[Yr]},getRequestFailed:{code:Wr,desc:v[Wr]},failedToParseNetworkResponse:{code:pr,desc:v[pr]},unableToLoadTokenError:{code:jr,desc:v[jr]},signingKeyNotFoundInStorage:{code:Rt,desc:v[Rt]},authCodeRequired:{code:Jr,desc:v[Jr]},authCodeOrNativeAccountRequired:{code:Xr,desc:v[Xr]},spaCodeAndNativeAccountPresent:{code:Zr,desc:v[Zr]},databaseUnavailable:{code:_t,desc:v[_t]},unableToAcquireTokenFromNativePlatform:{code:eo,desc:v[eo]},nativeHandshakeTimeout:{code:to,desc:v[to]},nativeExtensionNotInstalled:{code:ro,desc:v[ro]},nativeConnectionNotEstablished:{code:ye,desc:v[ye]},uninitializedPublicClientApplication:{code:oo,desc:v[oo]},nativePromptNotSupported:{code:no,desc:v[no]},invalidBase64StringError:{code:io,desc:v[io]},invalidPopTokenRequest:{code:ao,desc:v[ao]}},fr=class n extends b{constructor(e,t){super(e,v[e],t),Object.setPrototypeOf(this,n.prototype),this.name="BrowserAuthError"}};function C(n,e){return new fr(n,e)}var V={INTERACTION_IN_PROGRESS_VALUE:"interaction_in_progress",INVALID_GRANT_ERROR:"invalid_grant",POPUP_WIDTH:483,POPUP_HEIGHT:600,POPUP_NAME_PREFIX:"msal",DEFAULT_POLL_INTERVAL_MS:30,MSAL_SKU:"msal.js.browser"},wt={CHANNEL_ID:"53ee284d-920a-4b59-9d30-a60315b26836",PREFERRED_EXTENSION_ID:"ppnbnpeolgkicgegkbkbjmhlideopiji",MATS_TELEMETRY:"MATS"},it={HandshakeRequest:"Handshake",HandshakeResponse:"HandshakeResponse",GetToken:"GetToken",Response:"Response"}
7,Q={LocalStorage:"localStorage",SessionStorage:"sessionStorage",MemoryStorage:"memoryStorage"},Da={GET:"GET",POST:"POST"},P={AUTHORITY:"authority",ACQUIRE_TOKEN_ACCOUNT:"acquireToken.account",SESSION_STATE:"session.state",REQUEST_STATE:"request.state",NONCE_IDTOKEN:"nonce.id_token",ORIGIN_URI:"request.origin",RENEW_STATUS:"token.renew.status",URL_HASH:"urlHash",REQUEST_PARAMS:"request.params",SCOPES:"scopes",INTERACTION_STATUS_KEY:"interaction.status",CCS_CREDENTIAL:"ccs.credential",CORRELATION_ID:"request.correlationId",NATIVE_REQUEST:"request.native",REDIRECT_CONTEXT:"request.redirect.context"},at={ACCOUNT_KEYS:"msal.account.keys",TOKEN_KEYS:"msal.token.keys"},on={WRAPPER_SKU:"wrapper.sku",WRAPPER_VER:"wrapper.version"},M={acquireTokenRedirect:861,acquireTokenPopup:862,ssoSilent:863,acquireTokenSilent_authCode:864,handleRedirectPromise:865,acquireTokenByCode:866,acquireTokenSilent_silentFlow:61,logout:961,logoutPopup:962},y=function(n){return n.Redirect="redirect",n.Popup="popup",n.Silent="silent",n.None="none",n}(y||{}),X={Startup:"startup",Login:"login",Logout:"logout",AcquireToken:"acquireToken",SsoSilent:"ssoSilent",HandleRedirect:"handleRedirect",None:"none"},Ha={scopes:me},xa="jwk",Fa={React:"@azure/msal-react",Angular:"@azure/msal-angular"},Xn="msal.db",Rs=1,_s=`${Xn}.keys`,ce={Default:0,AccessToken:1,AccessTokenAndRefreshToken:2,RefreshToken:3,RefreshTokenAndNetwork:4,Skip:5},ws=[ce.Default,ce.Skip,ce.RefreshTokenAndNetwork],ks="msal.browser.log.level",bs="msal.browser.log.pii";function nn(n){return encodeURIComponent(an(n).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"))}function Cr(n){return Ns(n).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function an(n){return Ns(new TextEncoder().encode(n))}function Ns(n){let e=Array.from(n,t=>String.fromCodePoint(t)).join("");return btoa(e)}var cl="RSASSA-PKCS1-v1_5",Ms="SHA-256",ll=2048,dl=new Uint8Array([1,0,1]),Os="0123456789abcdef",Ps=new Uint32Array(1),hl="crypto_subtle_undefined",Ka={name:cl,hash:Ms,modulusLength:ll,publicExponent:dl};function Us(n){if(!window)throw C(Fe);if(!window.crypto)throw C(mr);if(!n&&!window.crypto.subtle)throw C(mr,hl)}function qa(n,e,t){return h(this,null,function*(){e?.addQueueMeasurement(c.Sha256Digest,t);let o=new TextEncoder().encode(n);return window.crypto.subtle.digest(Ms,o)})}function Ls(n){return window.crypto.getRandomValues(n)}function Ba(){return window.crypto.getRandomValues(Ps),Ps[0]}function re(){let n=Date.now(),e=Ba()*1024+(Ba()&1023),t=new Uint8Array(16),r=Math.trunc(e/2**30),o=e&2**30-1,i=Ba();t[0]=n/2**40,t[1]=n/2**32,t[2]=n/2**24,t[3]=n/2**16,t[4]=n/2**8,t[5]=n,t[6]=112|r>>>8,t[7]=r,t[8]=128|o>>>24,t[9]=o>>>16,t[10]=o>>>8,t[11]=o,t[12]=i>>>24,t[13]=i>>>16,t[14]=i>>>8,t[15]=i;let a="";for(let s=0;s<t.length;s++)a+=Os.charAt(t[s]>>>4),a+=Os.charAt(t[s]&15),(s===3||s===5||s===7||s===9)&&(a+="-");return a}function Ds(n,e){return h(this,null,function*(){return window.crypto.subtle.generateKey(Ka,n,e)})}function Zn(n){return h(this,null,function*(){return window.crypto.subtle.exportKey(xa,n)})}function Hs(n,e,t){return h(this,null,function*(){return window.crypto.subtle.importKey(xa,n,Ka,e,t)})}function xs(n,e){return h(this,null,function*(){return window.crypto.subtle.sign(Ka,n,e)})}function ei(n){return h(this,null,function*(){let e=yield qa(n),t=new Uint8Array(e);return Cr(t)})}var kt="storage_not_supported",ti="stubbed_public_client_application_called",so="in_mem_redirect_unavailable";var ri={[kt]:"Given storage configuration option was not supported.",[ti]:"Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",[so]:"Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."},ul={storageNotSupportedError:{code:kt,desc:ri[kt]},stubPcaInstanceCalled:{code:ti,desc:ri[ti]},inMemRedirectUnavailable:{code:so,desc:ri[so]}},co=class n extends b{constructor(e,t){super(e,t),this.name="BrowserConfigurationAuthError",Object.setPrototypeOf(this,n.prototype)}};function lo(n){return new co(n,ri[n])}function Ga(n){n.location.hash="",typeof n.history.replaceState=="function"&&n.history.replaceState(null,"",`${n.location.origin}${n.location.pathname}${n.location.search}`)}function za(n){let e=n.split("#");e.shift(),window.location.hash=e.length>0?e.join("#"):""}function sn(){return window.parent!==window}function Fs(){return typeof window<"u"&&!!window.opener&&window.opener!==window&&typeof window.name=="string"&&window.name.indexOf(`${V.POPUP_NAME_PREFIX}.`)===0}function le(){return typeof window<"u"&&window.location?window.location.href.split("?")[0].split("#")[0]:""}function $a(){let e=new k(window.location.href).getUrlComponents();return`${e.Protocol}//${e.HostNameAndPort}/`}function Bs(){if(k.hashContainsKnownProperties(window.location.hash)&&sn())throw C(Gr)}function Ks(n){if(sn()&&!n)throw C(qr)}function qs(){if(Fs())throw C(zr)}function oi(){if(typeof window>"u")throw C(Fe)}function ni(n){if(!n)throw C(oo)}function cn(n){oi(),Bs(),qs(),ni(n)}function ii(n,e){if(cn(n),Ks(e.system.allowRedirectInIframe),e.cache.cac
7heLocation===Q.MemoryStorage&&!e.cache.storeAuthStateInCookie)throw lo(so)}function ln(n){let e=document.createElement("link");e.rel="preconnect",e.href=new URL(n).origin,e.crossOrigin="anonymous",document.head.appendChild(e),window.setTimeout(()=>{try{document.head.removeChild(e)}catch{}},1e4)}function Va(){return re()}var dn=class n{navigateInternal(e,t){return n.defaultNavigateWindow(e,t)}navigateExternal(e,t){return n.defaultNavigateWindow(e,t)}static defaultNavigateWindow(e,t){return t.noHistory?window.location.replace(e):window.location.assign(e),new Promise(r=>{setTimeout(()=>{r(!0)},t.timeout)})}};var si=class{sendGetRequestAsync(e,t){return h(this,null,function*(){let r,o={},i=0,a=Gs(t);try{r=yield fetch(e,{method:Da.GET,headers:a})}catch{throw C(window.navigator.onLine?Wr:ot)}o=zs(r.headers);try{return i=r.status,{headers:o,body:yield r.json(),status:i}}catch{throw xn(C(pr),i,o)}})}sendPostRequestAsync(e,t){return h(this,null,function*(){let r=t&&t.body||"",o=Gs(t),i,a=0,s={};try{i=yield fetch(e,{method:Da.POST,headers:o,body:r})}catch{throw C(window.navigator.onLine?Yr:ot)}s=zs(i.headers);try{return a=i.status,{headers:s,body:yield i.json(),status:a}}catch{throw xn(C(pr),a,s)}})}};function Gs(n){try{let e=new Headers;if(!(n&&n.headers))return e;let t=n.headers;return Object.entries(t).forEach(([r,o])=>{e.append(r,o)}),e}catch{throw C(jn)}}function zs(n){try{let e={};return n.forEach((t,r)=>{e[r]=t}),e}catch{throw C(Jn)}}var gl=6e4,ci=1e4,ml=3e4,pl=2e3;function $s({auth:n,cache:e,system:t,telemetry:r},o){let i={clientId:u.EMPTY_STRING,authority:`${u.DEFAULT_AUTHORITY}`,knownAuthorities:[],cloudDiscoveryMetadata:u.EMPTY_STRING,authorityMetadata:u.EMPTY_STRING,redirectUri:typeof window<"u"?le():"",postLogoutRedirectUri:u.EMPTY_STRING,navigateToLoginRequestUrl:!0,clientCapabilities:[],protocolMode:Z.AAD,OIDCOptions:{serverResponseType:we.FRAGMENT,defaultScopes:[u.OPENID_SCOPE,u.PROFILE_SCOPE,u.OFFLINE_ACCESS_SCOPE]},azureCloudOptions:{azureCloudInstance:pt.None,tenant:u.EMPTY_STRING},skipAuthorityMetadataCache:!1,supportsNestedAppAuth:!1,instanceAware:!1},a={cacheLocation:Q.SessionStorage,temporaryCacheLocation:Q.SessionStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!!(e&&e.cacheLocation===Q.LocalStorage),claimsBasedCachingEnabled:!1},s={loggerCallback:()=>{},logLevel:D.Info,piiLoggingEnabled:!1},l=S(f({},bn),{loggerOptions:s,networkClient:o?new si:Ma,navigationClient:new dn,loadFrameTimeout:0,windowHashTimeout:t?.loadFrameTimeout||gl,iframeHashTimeout:t?.loadFrameTimeout||ci,navigateFrameWait:0,redirectNavigationTimeout:ml,asyncPopups:!1,allowRedirectInIframe:!1,allowNativeBroker:!1,nativeBrokerHandshakeTimeout:t?.nativeBrokerHandshakeTimeout||pl,pollIntervalMilliseconds:V.DEFAULT_POLL_INTERVAL_MS}),d=S(f(f({},l),t),{loggerOptions:t?.loggerOptions||s}),m={application:{appName:u.EMPTY_STRING,appVersion:u.EMPTY_STRING},client:new Mr};if(n?.protocolMode!==Z.OIDC&&n?.OIDCOptions&&new de(d.loggerOptions).warning(JSON.stringify(O(Ne.cannotSetOIDCOptions))),n?.protocolMode&&n.protocolMode!==Z.AAD&&d?.allowNativeBroker)throw O(Ne.cannotAllowNativeBroker);return{auth:S(f(f({},i),n),{OIDCOptions:f(f({},i.OIDCOptions),n?.OIDCOptions)}),cache:f(f({},a),e),system:d,telemetry:f(f({},m),r)}}var Vs="@azure/msal-browser",bt="3.28.1";var li=class n{static loggerCallback(e,t){switch(e){case D.Error:console.error(t);return;case D.Info:console.info(t);return;case D.Verbose:console.debug(t);return;case D.Warning:console.warn(t);return;default:console.log(t);return}}constructor(e){this.browserEnvironment=typeof window<"u",this.config=$s(e,this.browserEnvironment);let t;try{t=window[Q.SessionStorage]}catch{}let r=t?.getItem(ks),o=t?.getItem(bs)?.toLowerCase(),i=o==="true"?!0:o==="false"?!1:void 0,a=f({},this.config.system.loggerOptions),s=r&&Object.keys(D).includes(r)?D[r]:void 0;s&&(a.loggerCallback=n.loggerCallback,a.logLevel=s),i!==void 0&&(a.piiLoggingEnabled=i),this.logger=new de(a,Vs,bt),this.available=!1}getConfig(){return this.config}getLogger(){return this.logger}isAvailable(){return this.available}isBrowserEnvironment(){return this.browserEnvironment}};var di=(()=>{class n extends li{getModuleName(){return n.MODULE_NAME}getId(){return n.ID}initialize(){return h(this,null,function*(){return this.available=typeof window<"u",this.available})}}return n.MODULE_NAME="",n.ID="StandardOperatingContext",n})();function ue(n){return new TextDecoder().decode(fl(n))}function fl(n){let e=n.replace(/-/g,"+").replace(/_/g,"/");switch(e.length%4){case 0:break;case 2:e+="==";break;case 3:e+="=";break;default:throw C(io)}let t=atob(e);return Uint8Array.from(t,r=>r.codePointAt(0)||0)}var hi=class{constructor(){this.dbName=Xn,this.version=Rs,this.tableName=_s,this.dbOpen=!1}open(){return h(this,null,function*(){return new Promise((e,t)=>
7{let r=window.indexedDB.open(this.dbName,this.version);r.addEventListener("upgradeneeded",o=>{o.target.result.createObjectStore(this.tableName)}),r.addEventListener("success",o=>{let i=o;this.db=i.target.result,this.dbOpen=!0,e()}),r.addEventListener("error",()=>t(C(_t)))})})}closeConnection(){let e=this.db;e&&this.dbOpen&&(e.close(),this.dbOpen=!1)}validateDbIsOpen(){return h(this,null,function*(){if(!this.dbOpen)return this.open()})}getItem(e){return h(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(C(Be));let a=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).get(e);a.addEventListener("success",s=>{let l=s;this.closeConnection(),t(l.target.result)}),a.addEventListener("error",s=>{this.closeConnection(),r(s)})})})}setItem(e,t){return h(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((r,o)=>{if(!this.db)return o(C(Be));let s=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).put(t,e);s.addEventListener("success",()=>{this.closeConnection(),r()}),s.addEventListener("error",l=>{this.closeConnection(),o(l)})})})}removeItem(e){return h(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(C(Be));let a=this.db.transaction([this.tableName],"readwrite").objectStore(this.tableName).delete(e);a.addEventListener("success",()=>{this.closeConnection(),t()}),a.addEventListener("error",s=>{this.closeConnection(),r(s)})})})}getKeys(){return h(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((e,t)=>{if(!this.db)return t(C(Be));let i=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).getAllKeys();i.addEventListener("success",a=>{let s=a;this.closeConnection(),e(s.target.result)}),i.addEventListener("error",a=>{this.closeConnection(),t(a)})})})}containsKey(e){return h(this,null,function*(){return yield this.validateDbIsOpen(),new Promise((t,r)=>{if(!this.db)return r(C(Be));let a=this.db.transaction([this.tableName],"readonly").objectStore(this.tableName).count(e);a.addEventListener("success",s=>{let l=s;this.closeConnection(),t(l.target.result===1)}),a.addEventListener("error",s=>{this.closeConnection(),r(s)})})})}deleteDatabase(){return h(this,null,function*(){return this.db&&this.dbOpen&&this.closeConnection(),new Promise((e,t)=>{let r=window.indexedDB.deleteDatabase(Xn),o=setTimeout(()=>t(!1),200);r.addEventListener("success",()=>(clearTimeout(o),e(!0))),r.addEventListener("blocked",()=>(clearTimeout(o),e(!0))),r.addEventListener("error",()=>(clearTimeout(o),t(!1)))})})}};var Tr=class{constructor(){this.cache=new Map}getItem(e){return this.cache.get(e)||null}setItem(e,t){this.cache.set(e,t)}removeItem(e){this.cache.delete(e)}getKeys(){let e=[];return this.cache.forEach((t,r)=>{e.push(r)}),e}containsKey(e){return this.cache.has(e)}clear(){this.cache.clear()}};var ui=class{constructor(e){this.inMemoryCache=new Tr,this.indexedDBCache=new hi,this.logger=e}handleDatabaseAccessError(e){if(e instanceof fr&&e.errorCode===_t)this.logger.error("Could not access persistent storage. This may be caused by browser privacy features which block persistent storage in third-party contexts.");else throw e}getItem(e){return h(this,null,function*(){let t=this.inMemoryCache.getItem(e);if(!t)try{return this.logger.verbose("Queried item not found in in-memory cache, now querying persistent storage."),yield this.indexedDBCache.getItem(e)}catch(r){this.handleDatabaseAccessError(r)}return t})}setItem(e,t){return h(this,null,function*(){this.inMemoryCache.setItem(e,t);try{yield this.indexedDBCache.setItem(e,t)}catch(r){this.handleDatabaseAccessError(r)}})}removeItem(e){return h(this,null,function*(){this.inMemoryCache.removeItem(e);try{yield this.indexedDBCache.removeItem(e)}catch(t){this.handleDatabaseAccessError(t)}})}getKeys(){return h(this,null,function*(){let e=this.inMemoryCache.getKeys();if(e.length===0)try{return this.logger.verbose("In-memory cache is empty, now querying persistent storage."),yield this.indexedDBCache.getKeys()}catch(t){this.handleDatabaseAccessError(t)}return e})}containsKey(e){return h(this,null,function*(){let t=this.inMemoryCache.containsKey(e);if(!t)try{return this.logger.verbose("Key not found in in-memory cache, now querying persistent storage."),yield this.indexedDBCache.containsKey(e)}catch(r){this.handleDatabaseAccessError(r)}return t})}clearInMemory(){this.logger.verbose("Deleting in-memory keystore"),this.inMemoryCache.clear(),this.logger.verbose("In-memory keystore deleted")}
7clearPersistent(){return h(this,null,function*(){try{this.logger.verbose("Deleting persistent keystore");let e=yield this.indexedDBCache.deleteDatabase();return e&&this.logger.verbose("Persistent keystore deleted"),e}catch(e){return this.handleDatabaseAccessError(e),!1}})}};var Ys=(()=>{class n{constructor(t,r,o){this.logger=t,Us(o??!1),this.cache=new ui(this.logger),this.performanceClient=r}createNewGuid(){return re()}base64Encode(t){return an(t)}base64Decode(t){return ue(t)}base64UrlEncode(t){return nn(t)}encodeKid(t){return this.base64UrlEncode(JSON.stringify({kid:t}))}getPublicKeyThumbprint(t){return h(this,null,function*(){let r=this.performanceClient?.startMeasurement(c.CryptoOptsGetPublicKeyThumbprint,t.correlationId),o=yield Ds(n.EXTRACTABLE,n.POP_KEY_USAGES),i=yield Zn(o.publicKey),a={e:i.e,kty:i.kty,n:i.n},s=Qs(a),l=yield this.hashString(s),d=yield Zn(o.privateKey),m=yield Hs(d,!1,["sign"]);return yield this.cache.setItem(l,{privateKey:m,publicKey:o.publicKey,requestMethod:t.resourceRequestMethod,requestUri:t.resourceRequestUri}),r&&r.end({success:!0}),l})}removeTokenBindingKey(t){return h(this,null,function*(){return yield this.cache.removeItem(t),!(yield this.cache.containsKey(t))})}clearKeystore(){return h(this,null,function*(){this.cache.clearInMemory();try{return yield this.cache.clearPersistent(),!0}catch(t){return t instanceof Error?this.logger.error(`Clearing keystore failed with error: ${t.message}`):this.logger.error("Clearing keystore failed with unknown error"),!1}})}signJwt(t,r,o,i){return h(this,null,function*(){let a=this.performanceClient?.startMeasurement(c.CryptoOptsSignJwt,i),s=yield this.cache.getItem(r);if(!s)throw C(Rt);let l=yield Zn(s.publicKey),d=Qs(l),m=nn(JSON.stringify({kid:r})),T=rn.getShrHeaderString(S(f({},o?.header),{alg:l.alg,kid:m})),A=nn(T);t.cnf={jwk:JSON.parse(d)};let R=nn(JSON.stringify(t)),L=`${A}.${R}`,te=new TextEncoder().encode(L),Se=yield xs(s.privateKey,te),Pt=Cr(new Uint8Array(Se)),Ar=`${L}.${Pt}`;return a&&a.end({success:!0}),Ar})}hashString(t){return h(this,null,function*(){return ei(t)})}}return n.POP_KEY_USAGES=["sign","verify"],n.EXTRACTABLE=!0,n})();function Qs(n){return JSON.stringify(n,Object.keys(n).sort())}var gi=class{constructor(){if(!window.localStorage)throw lo(kt)}getItem(e){return window.localStorage.getItem(e)}setItem(e,t){window.localStorage.setItem(e,t)}removeItem(e){window.localStorage.removeItem(e)}getKeys(){return Object.keys(window.localStorage)}containsKey(e){return window.localStorage.hasOwnProperty(e)}};var mi=class{constructor(){if(!window.sessionStorage)throw lo(kt)}getItem(e){return window.sessionStorage.getItem(e)}setItem(e,t){window.sessionStorage.setItem(e,t)}removeItem(e){window.sessionStorage.removeItem(e)}getKeys(){return Object.keys(window.sessionStorage)}containsKey(e){return window.sessionStorage.hasOwnProperty(e)}};function pi(n,e){if(!e)return null;try{return J.parseRequestState(n,e).libraryState.meta}catch{throw g(W.invalidState)}}var fi=class{getItem(e){let t=`${encodeURIComponent(e)}`,r=document.cookie.split(";");for(let o=0;o<r.length;o++){let i=r[o],[a,...s]=decodeURIComponent(i).trim().split("="),l=s.join("=");if(a===t)return l}return""}setItem(e,t,r,o=!0){let i=`${encodeURIComponent(e)}=${encodeURIComponent(t)};path=/;SameSite=Lax;`;if(r){let a=Cl(r);i+=`expires=${a};`}o&&(i+="Secure;"),document.cookie=i}removeItem(e){this.setItem(e,"",-1)}getKeys(){let e=document.cookie.split(";"),t=[];return e.forEach(r=>{let o=decodeURIComponent(r).trim().split("=");t.push(o[0])}),t}containsKey(e){return this.getKeys().includes(e)}};function Cl(n){let e=new Date;return new Date(e.getTime()+n*864e5).toUTCString()}var ho=class n extends Ze{constructor(e,t,r,o,i,a){super(e,r,o,i),this.cacheConfig=t,this.logger=o,this.internalStorage=new Tr,this.browserStorage=this.setupBrowserStorage(this.cacheConfig.cacheLocation),this.temporaryCacheStorage=this.setupBrowserStorage(this.cacheConfig.temporaryCacheLocation),this.cookieStorage=new fi,t.cacheMigrationEnabled&&(this.migrateCacheEntries(),this.createKeyMaps()),this.performanceClient=a}setupBrowserStorage(e){try{switch(e){case Q.LocalStorage:return new gi;case Q.SessionStorage:return new mi;case Q.MemoryStorage:default:break}}catch(t){this.logger.error(t)}return this.cacheConfig.cacheLocation=Q.MemoryStorage,new Tr}migrateCacheEntries(){let e=`${u.CACHE_PREFIX}.${$.ID_TOKEN}`,t=`${u.CACHE_PREFIX}.${$.CLIENT_INFO}`,r=`${u.CACHE_PREFIX}.${$.ERROR}`,o=`${u.CACHE_PREFIX}.${$.ERROR_DESC}`,i=this.browserStorage.getItem(e),a=this.browserStorage.getItem(t),s=this.browserStorage.getItem(r),l=this.browserStorage.getItem(o),d=[i,a,s,l];
7[$.ID_TOKEN,$.CLIENT_INFO,$.ERROR,$.ERROR_DESC].forEach((T,A)=>{let R=d[A];R&&this.setTemporaryCache(T,R,!0)})}createKeyMaps(){this.logger.trace("BrowserCacheManager - createKeyMaps called.");let e=this.getItem(at.ACCOUNT_KEYS),t=this.getItem(`${at.TOKEN_KEYS}.${this.clientId}`);if(e&&t){this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");return}this.browserStorage.getKeys().forEach(o=>{if(this.isCredentialKey(o)){let i=this.getItem(o);if(i){let a=this.validateAndParseJson(i);if(a&&a.hasOwnProperty("credentialType"))switch(a.credentialType){case I.ID_TOKEN:if(H.isIdTokenEntity(a)){this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map"),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - idToken with key: ${o} found, saving key to token key map`);let s=a,l=this.updateCredentialCacheKey(o,s);this.addTokenKey(l,I.ID_TOKEN);return}else this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping."),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed idToken validation on key: ${o}`);break;case I.ACCESS_TOKEN:case I.ACCESS_TOKEN_WITH_AUTH_SCHEME:if(H.isAccessTokenEntity(a)){this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map"),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - accessToken with key: ${o} found, saving key to token key map`);let s=a,l=this.updateCredentialCacheKey(o,s);this.addTokenKey(l,I.ACCESS_TOKEN);return}else this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping."),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed accessToken validation on key: ${o}`);break;case I.REFRESH_TOKEN:if(H.isRefreshTokenEntity(a)){this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map"),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - refreshToken with key: ${o} found, saving key to token key map`);let s=a,l=this.updateCredentialCacheKey(o,s);this.addTokenKey(l,I.REFRESH_TOKEN);return}else this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping."),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: ${o}`);break}}}if(this.isAccountKey(o)){let i=this.getItem(o);if(i){let a=this.validateAndParseJson(i);a&&x.isAccountEntity(a)&&(this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map"),this.logger.tracePii(`BrowserCacheManager:createKeyMaps - account with key: ${o} found, saving key to account key map`),this.addAccountKeyToMap(o))}}})}validateAndParseJson(e){try{let t=JSON.parse(e);return t&&typeof t=="object"?t:null}catch{return null}}getItem(e){return this.browserStorage.getItem(e)}setItem(e,t){this.browserStorage.setItem(e,t)}getAccount(e,t){this.logger.trace("BrowserCacheManager.getAccount called");let r=this.getCachedAccountEntity(e);return this.updateOutdatedCachedAccount(e,r,t)}getCachedAccountEntity(e){let t=this.getItem(e);if(!t)return this.removeAccountKeyFromMap(e),null;let r=this.validateAndParseJson(t);return!r||!x.isAccountEntity(r)?(this.removeAccountKeyFromMap(e),null):Ze.toObject(new x,r)}setAccount(e){this.logger.trace("BrowserCacheManager.setAccount called");let t=e.generateAccountKey();this.setItem(t,JSON.stringify(e)),this.addAccountKeyToMap(t)}getAccountKeys(){this.logger.trace("BrowserCacheManager.getAccountKeys called");let e=this.getItem(at.ACCOUNT_KEYS);return e?JSON.parse(e):(this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found"),[])}addAccountKeyToMap(e){this.logger.trace("BrowserCacheManager.addAccountKeyToMap called"),this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${e}`);let t=this.getAccountKeys();t.indexOf(e)===-1?(t.push(e),this.setItem(at.ACCOUNT_KEYS,JSON.stringify(t)),this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added")):this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map")}removeAccountKeyFromMap(e){this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called"),this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${e}`);let t=this.getAccountKeys(),r=t.indexOf(e);r>-1?(t.splice(r,1),this.setItem(at.ACCOUNT_KEYS,JSON.stringify(t)),this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed")):this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap ke
7y not found in existing map")}removeAccount(e){return h(this,null,function*(){po(n.prototype,this,"removeAccount").call(this,e),this.removeAccountKeyFromMap(e)})}removeOutdatedAccount(e){this.removeItem(e),this.removeAccountKeyFromMap(e)}removeIdToken(e){super.removeIdToken(e),this.removeTokenKey(e,I.ID_TOKEN)}removeAccessToken(e){return h(this,null,function*(){po(n.prototype,this,"removeAccessToken").call(this,e),this.removeTokenKey(e,I.ACCESS_TOKEN)})}removeRefreshToken(e){super.removeRefreshToken(e),this.removeTokenKey(e,I.REFRESH_TOKEN)}getTokenKeys(){this.logger.trace("BrowserCacheManager.getTokenKeys called");let e=this.getItem(`${at.TOKEN_KEYS}.${this.clientId}`);if(e){let t=this.validateAndParseJson(e);if(t&&t.hasOwnProperty("idToken")&&t.hasOwnProperty("accessToken")&&t.hasOwnProperty("refreshToken"))return t;this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.")}else this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");return{idToken:[],accessToken:[],refreshToken:[]}}addTokenKey(e,t){this.logger.trace("BrowserCacheManager addTokenKey called");let r=this.getTokenKeys();switch(t){case I.ID_TOKEN:r.idToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map"),r.idToken.push(e));break;case I.ACCESS_TOKEN:r.accessToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map"),r.accessToken.push(e));break;case I.REFRESH_TOKEN:r.refreshToken.indexOf(e)===-1&&(this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map"),r.refreshToken.push(e));break;default:throw this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${t}`),g(W.unexpectedCredentialType)}this.setItem(`${at.TOKEN_KEYS}.${this.clientId}`,JSON.stringify(r))}removeTokenKey(e,t){this.logger.trace("BrowserCacheManager removeTokenKey called");let r=this.getTokenKeys();switch(t){case I.ID_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${e} from map`);let o=r.idToken.indexOf(e);o>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map"),r.idToken.splice(o,1)):this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");break;case I.ACCESS_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: ${e} from map`);let i=r.accessToken.indexOf(e);i>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map"),r.accessToken.splice(i,1)):this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");break;case I.REFRESH_TOKEN:this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: ${e} from map`);let a=r.refreshToken.indexOf(e);a>-1?(this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map"),r.refreshToken.splice(a,1)):this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");break;default:throw this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${t}`),g(W.unexpectedCredentialType)}this.setItem(`${at.TOKEN_KEYS}.${this.clientId}`,JSON.stringify(r))}getIdTokenCredential(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ID_TOKEN),null;let r=this.validateAndParseJson(t);return!r||!H.isIdTokenEntity(r)?(this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ID_TOKEN),null):(this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit"),r)}setIdTokenCredential(e){this.logger.trace("BrowserCacheManager.setIdTokenCredential called");let t=H.generateCredentialKey(e);this.setItem(t,JSON.stringify(e)),this.addTokenKey(t,I.ID_TOKEN)}getAccessTokenCredential(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ACCESS_TOKEN),null;let r=this.validateAndParseJson(t);return!r||!H.isAccessTokenEntity(r)?(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.ACCESS_TOKEN),null):(this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit"),r)}setAccessTokenCredential(e){this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");let t=H.generateCredentialKey(e);this.setItem(t,JSON.stringify(e)),this.addTokenKey(t,I.ACCESS_TOKEN)}getRefreshTokenCredential(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.REFRESH_TOKEN),null;let r=this.validateAndParseJson(t);return!r||!H.isRefreshTokenEntity(r)?(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit"),this.removeTokenKey(e,I.REFRESH_TOKEN),null):(this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit"),r)}setRefreshTokenCredential(e){this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");let t=H.generateCredentialKey(e);this.setItem(t,JSON.stringify(e)),this.addTokenKey(t,I.REFRESH_TOKEN)}getAppMetadata(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!H.isAppMetadataEntity(e,r)?(this.logger.trace("BrowserCacheManager.getAppMetadata: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit"),r)}setAppMetadata(e){this.logger.trace("BrowserCacheManager.setAppMetadata called");let t=H.generateAppMetadataKey(e);this.setItem(t,JSON.stringify(e))}getServerTelemetry(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!H.isServerTelemetryEntity(e,r)?(this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit"),r)}setServerTelemetry(e,t){this.logger.trace("BrowserCacheManager.setServerTelemetry called"),this.setItem(e,JSON.stringify(t))}getAuthorityMetadata(e){let t=this.internalStorage.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getAuthorityMetadata: called, no cache hit"),null;let r=this.validateAndParseJson(t);return r&&H.isAuthorityMetadataEntity(e,r)?(this.logger.trace("BrowserCacheManager.getAuthorityMetadata: cache hit"),r):null}getAuthorityMetadataKeys(){return this.internalStorage.getKeys().filter(t=>this.isAuthorityMetadata(t))}setWrapperMetadata(e,t){this.internalStorage.setItem(on.WRAPPER_SKU,e),this.internalStorage.setItem(on.WRAPPER_VER,t)}getWrapperMetadata(){let e=this.internalStorage.getItem(on.WRAPPER_SKU)||u.EMPTY_STRING,t=this.internalStorage.getItem(on.WRAPPER_VER)||u.EMPTY_STRING;return[e,t]}setAuthorityMetadata(e,t){this.logger.trace("BrowserCacheManager.setAuthorityMetadata called"),this.internalStorage.setItem(e,JSON.stringify(t))}getActiveAccount(){let e=this.generateCacheKey($.ACTIVE_ACCOUNT_FILTERS),t=this.getItem(e);if(!t){this.logger.trace("BrowserCacheManager.getActiveAccount: No active account filters cache schema found, looking for legacy schema");let o=this.generateCacheKey($.ACTIVE_ACCOUNT),i=this.getItem(o);if(!i)return this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found"),null;let a=this.getAccountInfoFilteredBy({localAccountId:i});return a?(this.logger.trace("BrowserCacheManager.getActiveAccount: Legacy active account cache schema found"),this.logger.trace("BrowserCacheManager.getActiveAccount: Adding active account filters cache schema"),this.setActiveAccount(a),a):null}let r=this.validateAndParseJson(t);return r?(this.logger.trace("BrowserCacheManager.getActiveAccount: Active account filters schema found"),this.getAccountInfoFilteredBy({homeAccountId:r.homeAccountId,localAccountId:r.localAccountId,tenantId:r.tenantId})):(this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found"),null)}setActiveAccount(e){let t=this.generateCacheKey($.ACTIVE_ACCOUNT_FILTERS),r=this.generateCacheKey($.ACTIVE_ACCOUNT);if(e){this.logger.verbose("setActiveAccount: Active account set");let o={homeAccountId:e.homeAccountId,localAccountId:e.localAccountId,tenantId:e.tenantId};this.browserStorage.setItem(t,JSON.stringify(o)),this.browserStorage.setItem(r,e.localAccountId)}else this.logger.verbose("setActiveAccount: No account passed, active account not set"),this.browserStorage.removeItem(t),this.browserStorage.removeItem(r)}getThrottlingCache(e){let t=this.getItem(e);if(!t)return this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null;let r=this.validateAndParseJson(t);return!r||!H.isThrottlingEntity(e,r)?(this.logger.trace("BrowserCacheManager.getThrottlingCache: called, no cache hit"),null):(this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit"),r)}setThrottlingCache(e,t){this.logger.trace("BrowserCacheManager.setThrottlingCache called"),this.setItem(e,JSON.stringify(t))}getTemporaryCache(e,t){let r=t?this.generateCacheKey(e):e;if(this.cacheConfig.storeAuthStateInCookie){let i=this.cookieStorage.getItem(r);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: storeAuthStateInCookies set to true, retrieving from cookies"),i}let o=this.temporaryCacheStorage.getItem(r);if(!o){if(this.cacheConfig.cacheLocation===Q.LocalStorage){let i=this.browserStorage.getItem(r);if(i)return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item found in local storage"),i}return this.logger.trace("BrowserCacheManager.getTemporaryCache: No cache item found in local storage"),null}return this.logger.trace("BrowserCacheManager.getTemporaryCache: Temporary cache item returned"),o}setTemporaryCache(e,t,r){let o=r?this.generateCacheKey(e):e;this.temporaryCacheStorage.setItem(o,t),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.setTemporaryCache: storeAuthStateInCookie set to true, setting item cookie"),this.cookieStorage.setItem(o,t,void 0,this.cacheConfig.secureCookies))}removeItem(e){this.browserStorage.removeItem(e)}removeTemporaryItem(e){this.temporaryCacheStorage.removeItem(e),this.cacheConfig.storeAuthStateInCookie&&(this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie"),this.cookieStorage.removeItem(e))}getKeys(){return this.browserStorage.getKeys()}clear(){return h(this,null,function*(){yield this.removeAllAccounts(),this.removeAppMetadata(),this.temporaryCacheStorage.getKeys().forEac
7h(e=>{(e.indexOf(u.CACHE_PREFIX)!==-1||e.indexOf(this.clientId)!==-1)&&this.removeTemporaryItem(e)}),this.browserStorage.getKeys().forEach(e=>{(e.indexOf(u.CACHE_PREFIX)!==-1||e.indexOf(this.clientId)!==-1)&&this.browserStorage.removeItem(e)}),this.internalStorage.clear()})}clearTokensAndKeysWithClaims(e,t){return h(this,null,function*(){e.addQueueMeasurement(c.ClearTokensAndKeysWithClaims,t);let r=this.getTokenKeys(),o=[];r.accessToken.forEach(i=>{let a=this.getAccessTokenCredential(i);a?.requestedClaimsHash&&i.includes(a.requestedClaimsHash.toLowerCase())&&o.push(this.removeAccessToken(i))}),yield Promise.all(o),o.length>0&&this.logger.warning(`${o.length} access tokens with claims in the cache keys have been removed from the cache.`)})}generateCacheKey(e){return this.validateAndParseJson(e)?JSON.stringify(e):q.startsWith(e,u.CACHE_PREFIX)||q.startsWith(e,$.ADAL_ID_TOKEN)?e:`${u.CACHE_PREFIX}.${this.clientId}.${e}`}generateAuthorityKey(e){let{libraryState:{id:t}}=J.parseRequestState(this.cryptoImpl,e);return this.generateCacheKey(`${P.AUTHORITY}.${t}`)}generateNonceKey(e){let{libraryState:{id:t}}=J.parseRequestState(this.cryptoImpl,e);return this.generateCacheKey(`${P.NONCE_IDTOKEN}.${t}`)}generateStateKey(e){let{libraryState:{id:t}}=J.parseRequestState(this.cryptoImpl,e);return this.generateCacheKey(`${P.REQUEST_STATE}.${t}`)}getCachedAuthority(e){let t=this.generateStateKey(e),r=this.getTemporaryCache(t);if(!r)return null;let o=this.generateAuthorityKey(r);return this.getTemporaryCache(o)}updateCacheEntries(e,t,r,o,i){this.logger.trace("BrowserCacheManager.updateCacheEntries called");let a=this.generateStateKey(e);this.setTemporaryCache(a,e,!1);let s=this.generateNonceKey(e);this.setTemporaryCache(s,t,!1);let l=this.generateAuthorityKey(e);if(this.setTemporaryCache(l,r,!1),i){let d={credential:i.homeAccountId,type:j.HOME_ACCOUNT_ID};this.setTemporaryCache(P.CCS_CREDENTIAL,JSON.stringify(d),!0)}else if(o){let d={credential:o,type:j.UPN};this.setTemporaryCache(P.CCS_CREDENTIAL,JSON.stringify(d),!0)}}resetRequestCache(e){this.logger.trace("BrowserCacheManager.resetRequestCache called"),e&&(this.temporaryCacheStorage.getKeys().forEach(t=>{t.indexOf(e)!==-1&&this.removeTemporaryItem(t)}),this.removeTemporaryItem(this.generateStateKey(e)),this.removeTemporaryItem(this.generateNonceKey(e)),this.removeTemporaryItem(this.generateAuthorityKey(e))),this.removeTemporaryItem(this.generateCacheKey(P.REQUEST_PARAMS)),this.removeTemporaryItem(this.generateCacheKey(P.ORIGIN_URI)),this.removeTemporaryItem(this.generateCacheKey(P.URL_HASH)),this.removeTemporaryItem(this.generateCacheKey(P.CORRELATION_ID)),this.removeTemporaryItem(this.generateCacheKey(P.CCS_CREDENTIAL)),this.removeTemporaryItem(this.generateCacheKey(P.NATIVE_REQUEST)),this.setInteractionInProgress(!1)}cleanRequestByState(e){if(this.logger.trace("BrowserCacheManager.cleanRequestByState called"),e){let t=this.generateStateKey(e),r=this.temporaryCacheStorage.getItem(t);this.logger.infoPii(`BrowserCacheManager.cleanRequestByState: Removing temporary cache items for state: ${r}`),this.resetRequestCache(r||u.EMPTY_STRING)}}cleanRequestByInteractionType(e){this.logger.trace("BrowserCacheManager.cleanRequestByInteractionType called"),this.temporaryCacheStorage.getKeys().forEach(t=>{if(t.indexOf(P.REQUEST_STATE)===-1)return;let r=this.temporaryCacheStorage.getItem(t);if(!r)return;let o=pi(this.cryptoImpl,r);o&&o.interactionType===e&&(this.logger.infoPii(`BrowserCacheManager.cleanRequestByInteractionType: Removing temporary cache items for state: ${r}`),this.resetRequestCache(r))}),this.setInteractionInProgress(!1)}cacheCodeRequest(e){this.logger.trace("BrowserCacheManager.cacheCodeRequest called");let t=an(JSON.stringify(e));this.setTemporaryCache(P.REQUEST_PARAMS,t,!0)}getCachedRequest(e){this.logger.trace("BrowserCacheManager.getCachedRequest called");let t=this.getTemporaryCache(P.REQUEST_PARAMS,!0);if(!t)throw C(Vr);let r;try{r=JSON.parse(ue(t))}catch(o){throw this.logger.errorPii(`Attempted to parse: ${t}`),this.logger.error(`Parsing cached token request threw with error: ${o}`),C(Qr)}if(this.removeTemporaryItem(this.generateCacheKey(P.REQUEST_PARAMS)),!r.authority){let o=this.generateAuthorityKey(e),i=this.getTemporaryCache(o);if(!i)throw C(vt);r.authority=i}return r}getCachedNativeRequest(){this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");let e=this.getTemporaryCache(P.NATIVE_REQUEST,!0);if(!e)return this.logger.trace("BrowserCacheManager.getCachedNativeRequest: No cached native request found"),null;let t=this.validateAndParseJson(e);return t||(this.logger.error("BrowserCacheManager.getCachedNativeRequest: Unable to parse native request"),null)}isInteractionInProgress(e){let t=this.getInteractionInProgress();return e?t===this.clientId:!!t}getInteractionInProgress(){let e=`${u.CACHE_PREFIX}.${P.INTERACTION_STATUS_KEY}`;return this.getTemporaryCache(e,!1)}setInteractionInProgress(e){let t=`${u.CACHE_PREFIX}.${P.INTERACTION_STATUS_KEY}`;if(e){if(this.getInteractionInProgress())throw C(xr);this.setTemporaryCache(t,this.clientId,!1)}else!e&&this.getInteractionInProgress()===this.clientId&&this.removeTemporaryItem(t)}getLegacyLoginHint(){let e=this.getTemporaryCache($.ADAL_ID_TOKEN);
7e&&(this.browserStorage.removeItem($.ADAL_ID_TOKEN),this.logger.verbose("Cached ADAL id token retrieved."));let t=this.getTemporaryCache($.ID_TOKEN,!0);t&&(this.browserStorage.removeItem(this.generateCacheKey($.ID_TOKEN)),this.logger.verbose("Cached MSAL.js v1 id token retrieved"));let r=t||e;if(r){let o=ft.extractTokenClaims(r,ue);if(o.preferred_username)return this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 preferred_username as loginHint"),o.preferred_username;if(o.upn)return this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, setting ADAL/MSAL v1 upn as loginHint"),o.upn;this.logger.verbose("No SSO params used and ADAL/MSAL v1 token retrieved, however, no account hint claim found. Enable preferred_username or upn id token claim to get SSO.")}return null}updateCredentialCacheKey(e,t){let r=H.generateCredentialKey(t);if(e!==r){let o=this.getItem(e);if(o)return this.browserStorage.removeItem(e),this.setItem(r,o),this.logger.verbose(`Updated an outdated ${t.credentialType} cache key`),r;this.logger.error(`Attempted to update an outdated ${t.credentialType} cache key but no item matching the outdated key was found in storage`)}return e}hydrateCache(e,t){return h(this,null,function*(){let r=H.createIdTokenEntity(e.account?.homeAccountId,e.account?.environment,e.idToken,this.clientId,e.tenantId),o;t.claims&&(o=yield this.cryptoImpl.hashString(t.claims));let i=H.createAccessTokenEntity(e.account?.homeAccountId,e.account.environment,e.accessToken,this.clientId,e.tenantId,e.scopes.join(" "),e.expiresOn?e.expiresOn.getTime()/1e3:0,e.extExpiresOn?e.extExpiresOn.getTime()/1e3:0,ue,void 0,e.tokenType,void 0,t.sshKid,t.claims,o),a={idToken:r,accessToken:i};return this.saveCacheRecord(a)})}saveCacheRecord(e,t,r){return h(this,null,function*(){try{yield po(n.prototype,this,"saveCacheRecord").call(this,e,t,r)}catch(o){if(o instanceof Xe&&this.performanceClient&&r)try{let i=this.getTokenKeys();this.performanceClient.addFields({cacheRtCount:i.refreshToken.length,cacheIdCount:i.idToken.length,cacheAtCount:i.accessToken.length},r)}catch{}throw o}})}},Ws=(n,e)=>{let t={cacheLocation:Q.MemoryStorage,temporaryCacheLocation:Q.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};return new ho(n,t,mt,e)};function js(n,e,t,r){return n.verbose("getAllAccounts called"),t?e.getAllAccounts(r):[]}function Js(n,e,t){if(e.trace("getAccount called"),Object.keys(n).length===0)return e.warning("getAccount: No accountFilter provided"),null;let r=t.getAccountInfoFilteredBy(n);return r?(e.verbose("getAccount: Account matching provided filter found, returning"),r):(e.verbose("getAccount: No matching account found, returning null"),null)}function Xs(n,e,t){if(e.trace("getAccountByUsername called"),!n)return e.warning("getAccountByUsername: No username provided"),null;let r=t.getAccountInfoFilteredBy({username:n});return r?(e.verbose("getAccountByUsername: Account matching username found, returning"),e.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${n}`),r):(e.verbose("getAccountByUsername: No matching account found, returning null"),null)}function Zs(n,e,t){if(e.trace("getAccountByHomeId called"),!n)return e.warning("getAccountByHomeId: No homeAccountId provided"),null;let r=t.getAccountInfoFilteredBy({homeAccountId:n});return r?(e.verbose("getAccountByHomeId: Account matching homeAccountId found, returning"),e.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${n}`),r):(e.verbose("getAccountByHomeId: No matching account found, returning null"),null)}function ec(n,e,t){if(e.trace("getAccountByLocalId called"),!n)return e.warning("getAccountByLocalId: No localAccountId provided"),null;let r=t.getAccountInfoFilteredBy({localAccountId:n});return r?(e.verbose("getAccountByLocalId: Account matching localAccountId found, returning"),e.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${n}`),r):(e.verbose("getAccountByLocalId: No matching account found, returning null"),null)}function tc(n,e){e.setActiveAccount(n)}function rc(n){return n.getActiveAccount()}var E={INITIALIZE_START:"msal:initializeStart",INITIALIZE_END:"msal:initializeEnd",ACCOUNT_ADDED:"msal:accountAdded",ACCOUNT_REMOVED:"msal:accountRemoved",ACTIVE_ACCOUNT_CHANGED:"msal:activeAccountChanged",LOGIN_START:"msal:loginStart",LOGIN_SUCCESS:"msal:loginSuccess",
7LOGIN_FAILURE:"msal:loginFailure",ACQUIRE_TOKEN_START:"msal:acquireTokenStart",ACQUIRE_TOKEN_SUCCESS:"msal:acquireTokenSuccess",ACQUIRE_TOKEN_FAILURE:"msal:acquireTokenFailure",ACQUIRE_TOKEN_NETWORK_START:"msal:acquireTokenFromNetworkStart",SSO_SILENT_START:"msal:ssoSilentStart",SSO_SILENT_SUCCESS:"msal:ssoSilentSuccess",SSO_SILENT_FAILURE:"msal:ssoSilentFailure",ACQUIRE_TOKEN_BY_CODE_START:"msal:acquireTokenByCodeStart",ACQUIRE_TOKEN_BY_CODE_SUCCESS:"msal:acquireTokenByCodeSuccess",ACQUIRE_TOKEN_BY_CODE_FAILURE:"msal:acquireTokenByCodeFailure",HANDLE_REDIRECT_START:"msal:handleRedirectStart",HANDLE_REDIRECT_END:"msal:handleRedirectEnd",POPUP_OPENED:"msal:popupOpened",LOGOUT_START:"msal:logoutStart",LOGOUT_SUCCESS:"msal:logoutSuccess",LOGOUT_FAILURE:"msal:logoutFailure",LOGOUT_END:"msal:logoutEnd",RESTORE_FROM_BFCACHE:"msal:restoreFromBFCache"};var Ci=class{constructor(e){this.eventCallbacks=new Map,this.logger=e||new de({})}addEventCallback(e,t,r){if(typeof window<"u"){let o=r||Va();return this.eventCallbacks.has(o)?(this.logger.error(`Event callback with id: ${o} is already registered. Please provide a unique id or remove the existing callback and try again.`),null):(this.eventCallbacks.set(o,[e,t||[]]),this.logger.verbose(`Event callback registered with id: ${o}`),o)}return null}removeEventCallback(e){this.eventCallbacks.delete(e),this.logger.verbose(`Event callback ${e} removed.`)}emitEvent(e,t,r,o){if(typeof window<"u"){let i={eventType:e,interactionType:t||null,payload:r||null,error:o||null,timestamp:Date.now()};this.eventCallbacks.forEach(([a,s],l)=>{(s.length===0||s.includes(e))&&(this.logger.verbose(`Emitting event to callback ${l}: ${e}`),a.apply(null,[i]))})}}};var uo=class{constructor(e,t,r,o,i,a,s,l,d){this.config=e,this.browserStorage=t,this.browserCrypto=r,this.networkClient=this.config.system.networkClient,this.eventHandler=i,this.navigationClient=a,this.nativeMessageHandler=l,this.correlationId=d||re(),this.logger=o.clone(V.MSAL_SKU,bt,this.correlationId),this.performanceClient=s}clearCacheOnLogout(e){return h(this,null,function*(){if(e){x.accountInfoIsEqual(e,this.browserStorage.getActiveAccount(),!1)&&(this.logger.verbose("Setting active account to null"),this.browserStorage.setActiveAccount(null));try{yield this.browserStorage.removeAccount(x.generateAccountCacheKey(e)),this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.")}catch{this.logger.error("Account provided in logout request was not found. Local cache unchanged.")}}else try{this.logger.verbose("No account provided in logout request, clearing all cache items.",this.correlationId),yield this.browserStorage.clear(),yield this.browserCrypto.clearKeystore()}catch{this.logger.error("Attempted to clear all MSAL cache items and failed. Local cache unchanged.")}})}getRedirectUri(e){this.logger.verbose("getRedirectUri called");let t=e||this.config.auth.redirectUri;return k.getAbsoluteUrl(t,le())}initializeServerTelemetryManager(e,t){this.logger.verbose("initializeServerTelemetryManager called");let r={clientId:this.config.auth.clientId,correlationId:this.correlationId,apiId:e,forceRefresh:t||!1,wrapperSKU:this.browserStorage.getWrapperMetadata()[0],wrapperVer:this.browserStorage.getWrapperMetadata()[1]};return new ur(r,this.browserStorage)}getDiscoveredAuthority(e){return h(this,null,function*(){let{account:t}=e,r=e.requestExtraQueryParameters&&e.requestExtraQueryParameters.hasOwnProperty("instance_aware")?e.requestExtraQueryParameters.instance_aware:void 0;this.performanceClient.addQueueMeasurement(c.StandardInteractionClientGetDiscoveredAuthority,this.correlationId);let o={protocolMode:this.config.auth.protocolMode,OIDCOptions:this.config.auth.OIDCOptions,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},i=e.requestAuthority||this.config.auth.authority,a=r?.length?r==="true":this.config.auth.instanceAware,s=t&&a?this.config.auth.authority.replace(k.getDomainFromUrl(i),t.environment):i,l=Ae.generateAuthority(s,e.requestAzureCloudOptions||this.config.auth.azureCloudOptions),d=yield p(Hn.createDiscoveredInstance,c.AuthorityFactoryCreateDiscoveredInstance,this.logger,this.performanceClient,this.correlationId)(l,this.config.system.networkClient,this.browserStorage,o,this.logger,this.correlationId,this.performanceClient);if(t&&!d.isAlias(t.environment))throw O(Ne.authorityMismatch);return d})}};var Tl=32;function oc(n,e,t){return h(this,null,function*(){n.addQueueMeasurement(c.GeneratePkceCodes,t);let r=ae(Al,c.GenerateCodeVerifier,e,n,t)(n,e,t),o=yield p(yl,c.GenerateCodeChallengeFromVerifier,e,n,t)(r,n,e,t);return{verifier:r,challenge:o}})}function Al(n,e,t){try{let r=new Uint8Array(Tl);return ae(Ls,c.GetRandomValues,e,n,t)(r),Cr(r)}catch{throw C(gr)}}function yl(n,e,t,r){return h(this,null,function*(){e.addQueueMeasurement(c.GenerateCodeChallengeFromVerifier,r);try{let o=yield p(qa,c.Sha256Digest,t,e,r)(n,e,r);return Cr(new Uint8Array(o))}catch{throw C(gr)}})}function hn(n,e,t,r){return h(this,null,function*(){t.addQueueMeasurement(c.InitializeBaseRequest,n.correlationId);let o=n.authority||e.auth.authority,i=[...n&&n.scopes||[]],a=S(f({},n),{correlationId:n.correlationId,authority:o,scopes:i});if(!a.authenticationScheme)a.authenticationScheme=N.BEARER,r.verbose(`Authentication Scheme wasn't explicitly set in request, defaulting to "Bearer" request`);else{if(a.authenticationScheme===N.SSH){if(!n.sshJwk)throw O(Ne.missingSshJwk);if(!n.sshKid)throw O(Ne.missingSshKid)}r.verbose(`Authentication Scheme set to "${a.authenticationScheme}" as configured in Auth request`)}return e.cache.claimsBasedCachingEnabled&&n.claims&&!q.isEmptyObj(n.claims)&&(a.requestedClaimsHash=yield ei(n.claims)),a})}function nc(n,e,t,r,o){return h(this,null,function*(){r.addQueueMeasurement(c.InitializeSilentRequest,n.correlationId);let i=yield p(hn,c.InitializeBaseRequest,o,r,n.correlationId)(n,t,r,o);return S(f(f({},n),i),{account:e,forceRefresh:n.forceRefresh||!1})})}
7var ge=class extends uo{initializeAuthorizationCodeRequest(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.StandardInteractionClientInitializeAuthorizationCodeRequest,this.correlationId);let t=yield p(oc,c.GeneratePkceCodes,this.logger,this.performanceClient,this.correlationId)(this.performanceClient,this.logger,this.correlationId),r=S(f({},e),{redirectUri:e.redirectUri,code:u.EMPTY_STRING,codeVerifier:t.verifier});return e.codeChallenge=t.challenge,e.codeChallengeMethod=u.S256_CODE_CHALLENGE_METHOD,r})}initializeLogoutRequest(e){this.logger.verbose("initializeLogoutRequest called",e?.correlationId);let t=f({correlationId:this.correlationId||re()},e);if(e)if(e.logoutHint)this.logger.verbose("logoutHint has already been set in logoutRequest");else if(e.account){let r=this.getLogoutHintFromIdTokenClaims(e.account);r&&(this.logger.verbose("Setting logoutHint to login_hint ID Token Claim value for the account provided"),t.logoutHint=r)}else this.logger.verbose("logoutHint was not set and account was not passed into logout request, logoutHint will not be set");else this.logger.verbose("logoutHint will not be set since no logout request was configured");return!e||e.postLogoutRedirectUri!==null?e&&e.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to uri set on logout request",t.correlationId),t.postLogoutRedirectUri=k.getAbsoluteUrl(e.postLogoutRedirectUri,le())):this.config.auth.postLogoutRedirectUri===null?this.logger.verbose("postLogoutRedirectUri configured as null and no uri set on request, not passing post logout redirect",t.correlationId):this.config.auth.postLogoutRedirectUri?(this.logger.verbose("Setting postLogoutRedirectUri to configured uri",t.correlationId),t.postLogoutRedirectUri=k.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri,le())):(this.logger.verbose("Setting postLogoutRedirectUri to current page",t.correlationId),t.postLogoutRedirectUri=k.getAbsoluteUrl(le(),le())):this.logger.verbose("postLogoutRedirectUri passed as null, not setting post logout redirect uri",t.correlationId),t}getLogoutHintFromIdTokenClaims(e){let t=e.idTokenClaims;if(t){if(t.login_hint)return t.login_hint;this.logger.verbose("The ID Token Claims tied to the provided account do not contain a login_hint claim, logoutHint will not be added to logout request")}else this.logger.verbose("The provided account does not contain ID Token Claims, logoutHint will not be added to logout request");return null}createAuthCodeClient(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.StandardInteractionClientCreateAuthCodeClient,this.correlationId);let t=yield p(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)(e);return new hr(t,this.performanceClient)})}getClientConfiguration(e){return h(this,null,function*(){let{serverTelemetryManager:t,requestAuthority:r,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:a}=e;this.performanceClient.addQueueMeasurement(c.StandardInteractionClientGetClientConfiguration,this.correlationId);let s=yield p(this.getDiscoveredAuthority.bind(this),c.StandardInteractionClientGetDiscoveredAuthority,this.logger,this.performanceClient,this.correlationId)({requestAuthority:r,requestAzureCloudOptions:o,requestExtraQueryParameters:i,account:a}),l=this.config.system.loggerOptions;return{authOptions:{clientId:this.config.auth.clientId,authority:s,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:this.config.auth.redirectUri},systemOptions:{tokenRenewalOffsetSeconds:this.config.system.tokenRenewalOffsetSeconds,preventCorsPreflight:!0},loggerOptions:{loggerCallback:l.loggerCallback,piiLoggingEnabled:l.piiLoggingEnabled,logLevel:l.logLevel,correlationId:this.correlationId},cacheOptions:{claimsBasedCachingEnabled:this.config.cache.claimsBasedCachingEnabled},cryptoInterface:this.browserCrypto,networkInterface:this.networkClient,storageInterface:this.browserStorage,serverTelemetryManager:t,libraryInfo:{sku:V.MSAL_SKU,version:bt,cpu:u.EMPTY_STRING,os:u.EMPTY_STRING},telemetry:this.config.telemetry}})}initializeAuthorizationRequest(e,t){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.StandardInteractionClientInitializeAuthorizationRequest,this.correlationId);let r=this.getRedirectUri(e.redirectUri),o={interactionType:t},i=J.setRequestState(this.browserCrypto,e&&e.state||u.EMPTY_STRING,o),a=yield p(hn,c.InitializeBaseRequest,this.logger,this.performanceClient,this.correlationId)(S(f({},e),{correlationId:this.correlationId}),this.config,this.performanceClient,this.logger),s=S(f({},a),{redirectUri:r,state:i,nonce:e.nonce||re(),responseMode:this.config.auth.OIDCOptions.serverResponseType});if(e.loginHint||e.sid)return s;let l=e.account||this.browserStorage.getActiveAccount();if(l&&(this.logger.verbose("Setting validated request account",this.correlationId),this.logger.verbosePii(`Setting validated request account: ${l.homeAccountId}`,this.correlationId),s.account=l),!s.loginHint&&!l){let d=this.browserStorage.getLegacyLoginHint();d&&(s.loginHint=d)}return s})}};var ic="ContentError",Ti="user_switch";var ac="USER_INTERACTION_REQUIRED",sc="USER_CANCEL",cc="NO_NETWORK",lc="PERSISTENT_ERROR",dc="DISABLED",hc="ACCOUNT_UNAVAILABLE";var El=-2147186943,Il={[Ti]:"User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again."},Ee=class n extends b{constructor(e,t,r){super(e,t),Object.setPrototypeOf(this,n.prototype),this.name="NativeAuthError",this.ext=r}};function Nt(n){if(n.ext&&n.ext.status&&(n.ext.status===lc||n.ext.status===dc)||n.ext&&n.ext.error&&n.ext.error===El)return!0;switch(n.errorCode){case ic:return!0;default:return!1}}function un(n,e,t){if(t&&t.status)switch(t.status){case hc:return Or(rt.nativeAccountUnavailable);case ac:return new ee(n,e);case sc:return C(he);case cc:return C(ot)}return new Ee(n,Il[n]||e,t)}var go=class extends ge{acquireToken(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentCacheClientAcquireToken,e.correlationId);let t=this.initializeServerTelemetryManager(M.acquireTokenSilent_silentFlow),r=yield p(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:t,requestAuthority:e.authority,requestAzureCloudOptions:e.azureCloudOptions,account:e.account}),o=new tn(r,this.performanceClient);this.logger.verbose("Silent auth client created");try{let a=(yield p(o.acquireCachedToken.bind(o),c.SilentFlowClientAcquireCachedToken,this.logger,this.performanceClient,e.correlationId)(e))[0];return this.performanceClient.addFields({fromCache:!0},e.correlationId),a}catch(i){throw i instanceof fr&&i.errorCode===Rt&&this.logger.verbose("Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."),i}})}logout(e){this.logger.verbose("logoutRedirect called");
7let t=this.initializeLogoutRequest(e);return this.clearCacheOnLogout(t?.account)}};var Ie=class extends uo{constructor(e,t,r,o,i,a,s,l,d,m,T,A){super(e,t,r,o,i,a,l,d,A),this.apiId=s,this.accountId=m,this.nativeMessageHandler=d,this.nativeStorageManager=T,this.silentCacheClient=new go(e,this.nativeStorageManager,r,o,i,a,l,d,A),this.serverTelemetryManager=this.initializeServerTelemetryManager(this.apiId);let R=this.nativeMessageHandler.getExtensionId()===wt.PREFERRED_EXTENSION_ID?"chrome":this.nativeMessageHandler.getExtensionId()?.length?"unknown":void 0;this.skus=ur.makeExtraSkuString({libraryName:V.MSAL_SKU,libraryVersion:bt,extensionName:R,extensionVersion:this.nativeMessageHandler.getExtensionVersion()})}addRequestSKUs(e){e.extraParameters=S(f({},e.extraParameters),{[tt.X_CLIENT_EXTRA_SKU]:this.skus})}acquireToken(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.NativeInteractionClientAcquireToken,e.correlationId),this.logger.trace("NativeInteractionClient - acquireToken called.");let t=this.performanceClient.startMeasurement(c.NativeInteractionClientAcquireToken,e.correlationId),r=xo.nowSeconds();try{let o=yield this.initializeNativeRequest(e);try{let d=yield this.acquireTokensFromCache(this.accountId,o);return t.end({success:!0,isNativeBroker:!1,fromCache:!0}),d}catch{this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call")}let i=st(o,[]),a={method:it.GetToken,request:i},s=yield this.nativeMessageHandler.sendMessage(a),l=this.validateNativeResponse(s);return yield this.handleNativeResponse(l,o,r).then(d=>(t.end({success:!0,isNativeBroker:!0,requestId:d.requestId}),this.serverTelemetryManager.clearNativeBrokerErrorCode(),d)).catch(d=>{throw t.end({success:!1,errorCode:d.errorCode,subErrorCode:d.subError,isNativeBroker:!0}),d})}catch(o){throw o instanceof Ee&&this.serverTelemetryManager.setNativeBrokerErrorCode(o.errorCode),o}})}createSilentCacheRequest(e,t){return{authority:e.authority,correlationId:this.correlationId,scopes:B.fromString(e.scope).asArray(),account:t,forceRefresh:!1}}acquireTokensFromCache(e,t){return h(this,null,function*(){if(!e)throw this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided"),g(W.noAccountFound);let r=this.browserStorage.getBaseAccountInfo({nativeAccountId:e});if(!r)throw g(W.noAccountFound);try{let o=this.createSilentCacheRequest(t,r),i=yield this.silentCacheClient.acquireToken(o),a=S(f({},r),{idTokenClaims:i?.idTokenClaims,idToken:i?.idToken});return S(f({},i),{account:a})}catch(o){throw o}})}acquireTokenRedirect(e,t){return h(this,null,function*(){this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");let r=st(e,[]);delete r.onRedirectNavigate;let o=yield this.initializeNativeRequest(r),i={method:it.GetToken,request:o};try{let l=yield this.nativeMessageHandler.sendMessage(i);this.validateNativeResponse(l)}catch(l){if(l instanceof Ee&&(this.serverTelemetryManager.setNativeBrokerErrorCode(l.errorCode),Nt(l)))throw l}this.browserStorage.setTemporaryCache(P.NATIVE_REQUEST,JSON.stringify(o),!0);let a={apiId:M.acquireTokenRedirect,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},s=this.config.auth.navigateToLoginRequestUrl?window.location.href:this.getRedirectUri(e.redirectUri);t.end({success:!0}),yield this.navigationClient.navigateExternal(s,a)})}handleRedirectPromise(e,t){return h(this,null,function*(){if(this.logger.trace("NativeInteractionClient - handleRedirectPromise called."),!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;let r=this.browserStorage.getCachedNativeRequest();if(!r)return this.logger.verbose("NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null."),e&&t&&e?.addFields({errorCode:"no_cached_request"},t),null;let l=r,{prompt:o}=l,i=st(l,["prompt"]);o&&this.logger.verbose("NativeInteractionClient - handleRedirectPromise called and prompt was included in the original request, remov
7ing prompt from cached request to prevent second interaction with native broker window."),this.browserStorage.removeItem(this.browserStorage.generateCacheKey(P.NATIVE_REQUEST));let a={method:it.GetToken,request:i},s=xo.nowSeconds();try{this.logger.verbose("NativeInteractionClient - handleRedirectPromise sending message to native broker.");let d=yield this.nativeMessageHandler.sendMessage(a);this.validateNativeResponse(d);let m=this.handleNativeResponse(d,i,s);this.browserStorage.setInteractionInProgress(!1);let T=yield m;return this.serverTelemetryManager.clearNativeBrokerErrorCode(),T}catch(d){throw this.browserStorage.setInteractionInProgress(!1),d}})}logout(){return this.logger.trace("NativeInteractionClient - logout called."),Promise.reject("Logout not implemented yet")}handleNativeResponse(e,t,r){return h(this,null,function*(){this.logger.trace("NativeInteractionClient - handleNativeResponse called.");let o=ft.extractTokenClaims(e.id_token,ue),i=this.createHomeAccountIdentifier(e,o),a=this.browserStorage.getAccountInfoFilteredBy({nativeAccountId:t.accountId})?.homeAccountId;if(i!==a&&e.account.id!==t.accountId)throw un(Ti);let s=yield this.getDiscoveredAuthority({requestAuthority:t.authority}),l=Pr(this.browserStorage,s,i,ue,o,e.client_info,void 0,o.tid,void 0,e.account.id,this.logger),d=yield this.generateAuthenticationResult(e,t,o,l,s.canonicalAuthority,r);return this.cacheAccount(l),this.cacheNativeTokens(e,t,i,o,e.access_token,d.tenantId,r),d})}createHomeAccountIdentifier(e,t){return x.generateHomeAccountId(e.client_info||u.EMPTY_STRING,ie.Default,this.logger,this.browserCrypto,t)}generateScopes(e,t){return e.scope?B.fromString(e.scope):B.fromString(t.scope)}generatePopAccessToken(e,t){return h(this,null,function*(){if(t.tokenType===N.POP&&t.signPopToken){if(e.shr)return this.logger.trace("handleNativeServerResponse: SHR is enabled in native layer"),e.shr;let r=new fe(this.browserCrypto),o={resourceRequestMethod:t.resourceRequestMethod,resourceRequestUri:t.resourceRequestUri,shrClaims:t.shrClaims,shrNonce:t.shrNonce};if(!t.keyId)throw g(W.keyIdMissing);return r.signPopToken(e.access_token,t.keyId,o)}else return e.access_token})}generateAuthenticationResult(e,t,r,o,i,a){return h(this,null,function*(){let s=this.addTelemetryFromNativeResponse(e),l=e.scope?B.fromString(e.scope):B.fromString(t.scope),d=e.account.properties||{},m=d.UID||r.oid||r.sub||u.EMPTY_STRING,T=d.TenantId||r.tid||u.EMPTY_STRING,A=dr(o.getAccountInfo(),void 0,r,e.id_token);A.nativeAccountId!==e.account.id&&(A.nativeAccountId=e.account.id);let R=yield this.generatePopAccessToken(e,t),L=t.tokenType===N.POP?N.POP:N.BEARER;return{authority:i,uniqueId:m,tenantId:T,scopes:l.asArray(),account:A,idToken:e.id_token,idTokenClaims:r,accessToken:R,fromCache:s?this.isResponseFromCache(s):!1,expiresOn:new Date(Number(a+e.expires_in)*1e3),tokenType:L,correlationId:this.correlationId,state:e.state,fromNativeBroker:!0}})}cacheAccount(e){this.browserStorage.setAccount(e),this.browserStorage.removeAccountContext(e).catch(t=>{this.logger.error(`Error occurred while removing account context from browser storage. ${t}`)})}cacheNativeTokens(e,t,r,o,i,a,s){let l=H.createIdTokenEntity(r,t.authority,e.id_token||"",t.clientId,o.tid||""),d=t.tokenType===N.POP?u.SHR_NONCE_VALIDITY:(typeof e.expires_in=="str
7ing"?parseInt(e.expires_in,10):e.expires_in)||0,m=s+d,T=this.generateScopes(e,t),A=H.createAccessTokenEntity(r,t.authority,i,t.clientId,o.tid||a,T.printScopes(),m,0,ue,void 0,t.tokenType,void 0,t.keyId),R={idToken:l,accessToken:A};this.nativeStorageManager.saveCacheRecord(R,t.storeInCache)}addTelemetryFromNativeResponse(e){let t=this.getMATSFromResponse(e);return t?(this.performanceClient.addFields({extensionId:this.nativeMessageHandler.getExtensionId(),extensionVersion:this.nativeMessageHandler.getExtensionVersion(),matsBrokerVersion:t.broker_version,matsAccountJoinOnStart:t.account_join_on_start,matsAccountJoinOnEnd:t.account_join_on_end,matsDeviceJoin:t.device_join,matsPromptBehavior:t.prompt_behavior,matsApiErrorCode:t.api_error_code,matsUiVisible:t.ui_visible,matsSilentCode:t.silent_code,matsSilentBiSubCode:t.silent_bi_sub_code,matsSilentMessage:t.silent_message,matsSilentStatus:t.silent_status,matsHttpStatus:t.http_status,matsHttpEventCount:t.http_event_count},this.correlationId),t):null}validateNativeResponse(e){if(e.hasOwnProperty("access_token")&&e.hasOwnProperty("id_token")&&e.hasOwnProperty("client_info")&&e.hasOwnProperty("account")&&e.hasOwnProperty("scope")&&e.hasOwnProperty("expires_in"))return e;throw Io(Ut.unexpectedError,"Response missing expected properties.")}getMATSFromResponse(e){if(e.properties.MATS)try{return JSON.parse(e.properties.MATS)}catch{this.logger.error("NativeInteractionClient - Error parsing MATS telemetry, returning null instead")}return null}isResponseFromCache(e){return typeof e.is_cached>"u"?(this.logger.verbose("NativeInteractionClient - MATS telemetry does not contain field indicating if response was served from cache. Returning false."),!1):!!e.is_cached}initializeNativeRequest(e){return h(this,null,function*(){this.logger.trace("NativeInteractionClient - initializeNativeRequest called");let t=e.authority||this.config.auth.authority;e.account&&(yield this.getDiscoveredAuthority({requestAuthority:t,requestAzureCloudOptions:e.azureCloudOptions,account:e.account}));let r=new k(t);r.validateAsUri();let d=e,{scopes:o}=d,i=st(d,["scopes"]),a=new B(o||[]);a.appendScopes(me);let s=()=>{switch(this.apiId){case M.ssoSilent:case M.acquireTokenSilent_silentFlow:return this.logger.trace("initializeNativeRequest: silent request sets prompt to none"),F.NONE}if(!e.prompt){this.logger.trace("initializeNativeRequest: prompt was not provided");return}switch(e.prompt){case F.NONE:case F.CONSENT:case F.LOGIN:return this.logger.trace("initializeNativeRequest: prompt is compatible with native flow"),e.prompt;default:throw this.logger.trace(`initializeNativeRequest: prompt = ${e.prompt} is not compatible with native flow`),C(no)}},l=S(f({},i),{accountId:this.accountId,clientId:this.config.auth.clientId,authority:r.urlString,scope:a.printScopes(),redirectUri:this.getRedirectUri(e.redirectUri),prompt:s(),correlationId:this.correlationId,tokenType:e.authenticationScheme,windowTitleSubstring:document.title,extraParameters:f(f({},e.extraQueryParameters),e.tokenQueryParameters),extendedExpiryToken:!1,keyId:e.popKid});if(l.signPopToken&&e.popKid)throw C(ao);if(this.handleExtraBrokerParams(l),l.extraParameters=l.extraParameters||{},l.extraParameters.telemetry=wt.MATS_TELEMETRY,e.authenticationScheme===N.POP){let m={resourceRequestUri:e.resourceRequestUri,resourceRequestMethod:e.resourceRequestMethod,shrClaims:e.shrClaims,shrNonce:e.shrNonce},T=new fe(this.browserCrypto),A;if(l.keyId)A=this.browserCrypto.base64UrlEncode(JSON.stringify({kid:l.keyId})),l.signPopToken=!1;else{let R=yield p(T.generateCnf.bind(T),c.PopTokenGenerateCnf,this.logger,this.performanceClient,e.correlationId)(m,this.logger);A=R.reqCnfString,l.keyId=R.kid,l.signPopToken=!0}l.reqCnf=A}return this.addRequestSKUs(l),l})}handleExtraBrokerParams(e){let t=e.extraParameters&&e.extraParameters.hasOwnProperty(tt.BROKER_CLIENT_ID)&&e.extraParameters.hasOwnProperty(tt.BROKER_REDIRECT_URI)&&e.extraParameters.hasOwnProperty(tt.CLIENT_ID);if(!e.embeddedClientId&&!t)return;let r="",o=e.redirectUri;e.embeddedClientId?(e.redirectUri=this.config.auth.redirectUri,r=e.embeddedClientId):e.extraParameters&&(e.redirectUri=e.extraParameters[tt.BROKER_REDIRECT_URI],r=e.extraParameters[tt.CLIENT_ID]),e.extraParameters={child_client_id:r,child_redirect_uri:o},this.performanceClient?.addFields({embeddedClientId:r,embeddedRedirectUri:o},e.correlationId)}};var Ce=class n{constructor(e,t,r,o){this.logger=e,this.handshakeTimeoutMs=t,this.extensionId=o,this.resolvers=new Map,this.handshakeResolvers=new Map,this.messageChannel=new MessageChannel,this.windowListener=this.onWindowMessage.bind(this),this.performanceClient=r,this.handshakeEvent=r.startMeasurement(c.NativeMessageHandlerHandshake)}sendMessage(e){return h(this,null,function*(){this.logger.trace("NativeMessageHandler - sendMessage called.");let t={channel:wt.CHANNEL_ID,extensionId:this.extensionId,responseId:re(),body:e};return this.logger.trace("NativeMessageHandler - Sending request to browser extension"),this.logger.tracePii(`NativeMessageHandler - Sending request to browser extension: ${JSON.stringify(t)}`),this.messageChannel.port1.postMessage(t),new Promise((r,o)=>{this.resolvers.set(t.responseId,{resolve:r,reject:o})})})}static createProvider(e,t,r){return h(this,null,function*(){e.trace("NativeMessageHandler - createProvider called.");try{let o=new n(e,t,r,wt.PREFERRED_EXTENSION_ID);
7return yield o.sendHandshakeRequest(),o}catch{let i=new n(e,t,r);return yield i.sendHandshakeRequest(),i}})}sendHandshakeRequest(){return h(this,null,function*(){this.logger.trace("NativeMessageHandler - sendHandshakeRequest called."),window.addEventListener("message",this.windowListener,!1);let e={channel:wt.CHANNEL_ID,extensionId:this.extensionId,responseId:re(),body:{method:it.HandshakeRequest}};return this.handshakeEvent.add({extensionId:this.extensionId,extensionHandshakeTimeoutMs:this.handshakeTimeoutMs}),this.messageChannel.port1.onmessage=t=>{this.onChannelMessage(t)},window.postMessage(e,window.origin,[this.messageChannel.port2]),new Promise((t,r)=>{this.handshakeResolvers.set(e.responseId,{resolve:t,reject:r}),this.timeoutId=window.setTimeout(()=>{window.removeEventListener("message",this.windowListener,!1),this.messageChannel.port1.close(),this.messageChannel.port2.close(),this.handshakeEvent.end({extensionHandshakeTimedOut:!0,success:!1}),r(C(to)),this.handshakeResolvers.delete(e.responseId)},this.handshakeTimeoutMs)})})}onWindowMessage(e){if(this.logger.trace("NativeMessageHandler - onWindowMessage called"),e.source!==window)return;let t=e.data;if(!(!t.channel||t.channel!==wt.CHANNEL_ID)&&!(t.extensionId&&t.extensionId!==this.extensionId)&&t.body.method===it.HandshakeRequest){let r=this.handshakeResolvers.get(t.responseId);if(!r){this.logger.trace(`NativeMessageHandler.onWindowMessage - resolver can't be found for request ${t.responseId}`);return}this.logger.verbose(t.extensionId?`Extension with id: ${t.extensionId} not installed`:"No extension installed"),clearTimeout(this.timeoutId),this.messageChannel.port1.close(),this.messageChannel.port2.close(),window.removeEventListener("message",this.windowListener,!1),this.handshakeEvent.end({success:!1,extensionInstalled:!1}),r.reject(C(ro))}}onChannelMessage(e){this.logger.trace("NativeMessageHandler - onChannelMessage called.");let t=e.data,r=this.resolvers.get(t.responseId),o=this.handshakeResolvers.get(t.responseId);try{let i=t.body.method;if(i===it.Response){if(!r)return;let a=t.body.response;if(this.logger.trace("NativeMessageHandler - Received response from browser extension"),this.logger.tracePii(`NativeMessageHandler - Received response from browser extension: ${JSON.stringify(a)}`),a.status!=="Success")r.reject(un(a.code,a.description,a.ext));else if(a.result)a.result.code&&a.result.description?r.reject(un(a.result.code,a.result.description,a.result.ext)):r.resolve(a.result);else throw Io(Ut.unexpectedError,"Event does not contain result.");this.resolvers.delete(t.responseId)}else if(i===it.HandshakeResponse){if(!o){this.logger.trace(`NativeMessageHandler.onChannelMessage - resolver can't be found for request ${t.responseId}`);return}clearTimeout(this.timeoutId),window.removeEventListener("message",this.windowListener,!1),this.extensionId=t.extensionId,this.extensionVersion=t.body.version,this.logger.verbose(`NativeMessageHandler - Received HandshakeResponse from extension: ${this.extensionId}`),this.handshakeEvent.end({extensionInstalled:!0,success:!0}),o.resolve(),this.handshakeResolvers.delete(t.responseId)}}catch(i){this.logger.error("Error parsing response from WAM Extension"),this.logger.errorPii(`Error parsing response from WAM Extension: ${i}`),this.logger.errorPii(`Unable to parse ${e}`),r?r.reject(i):o&&o.reject(i)}}getExtensionId(){return this.extensionId}getExtensionVersion(){return this.extensionVersion}static isNativeAvailable(e,t,r,o){if(t.trace("isNativeAvailable called"),!e.system.allowNativeBroker)return t.trace("isNativeAvailable: allowNativeBroker is not enabled, returning false"),!1;if(!r)return t.trace("isNativeAvailable: WAM extension provider is not initialized, returning false"),!1;if(o)switch(o){case N.BEARER:case N.POP:return t.trace("isNativeAvailable: authenticationScheme is supported, returning true"),!0;default:return t.trace("isNativeAvailable: authenticationScheme is not supported, returning false"),!1}return!0}};var Ot=class{constructor(e,t,r,o,i){this.authModule=e,this.browserStorage=t,this.authCodeRequest=r,this.logger=o,this.performanceClient=i}handleCodeResponse(e,t){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.HandleCodeResponse,t.correlationId);let r;try{r=this.authModule.handleFragmentResponse(e,t.state)}
7catch(o){throw o instanceof se&&o.subError===he?C(he):o}return p(this.handleCodeResponseFromServer.bind(this),c.HandleCodeResponseFromServer,this.logger,this.performanceClient,t.correlationId)(r,t)})}handleCodeResponseFromServer(e,t,r=!0){return h(this,null,function*(){if(this.performanceClient.addQueueMeasurement(c.HandleCodeResponseFromServer,t.correlationId),this.logger.trace("InteractionHandler.handleCodeResponseFromServer called"),this.authCodeRequest.code=e.code,e.cloud_instance_host_name&&(yield p(this.authModule.updateAuthority.bind(this.authModule),c.UpdateTokenEndpointAuthority,this.logger,this.performanceClient,t.correlationId)(e.cloud_instance_host_name,t.correlationId)),r&&(e.nonce=t.nonce||void 0),e.state=t.state,e.client_info)this.authCodeRequest.clientInfo=e.client_info;else{let i=this.createCcsCredentials(t);i&&(this.authCodeRequest.ccsCredential=i)}return yield p(this.authModule.acquireToken.bind(this.authModule),c.AuthClientAcquireToken,this.logger,this.performanceClient,t.correlationId)(this.authCodeRequest,e)})}createCcsCredentials(e){return e.account?{credential:e.account.homeAccountId,type:j.HOME_ACCOUNT_ID}:e.loginHint?{credential:e.loginHint,type:j.UPN}:null}};function Ai(n,e,t){let r=Tt.getDeserializedResponse(n);if(!r)throw Tt.stripLeadingHashOrQuery(n)?(t.error(`A ${e} is present in the iframe but it does not contain known properties. It's likely that the ${e} has been replaced by code running on the redirectUri page.`),t.errorPii(`The ${e} detected is: ${n}`),C(Lr)):(t.error(`The request has returned to the redirectUri but a ${e} is not present. It's likely that the ${e} has been removed or the page has been redirected by code running on the redirectUri page.`),C(Ur));return r}function uc(n,e,t){if(!n.state)throw C(St);let r=pi(e,n.state);if(!r)throw C(Dr);if(r.interactionType!==t)throw C(Hr)}var yi=class extends ge{constructor(e,t,r,o,i,a,s,l,d,m){super(e,t,r,o,i,a,s,d,m),this.unloadWindow=this.unloadWindow.bind(this),this.nativeStorage=l}acquireToken(e){try{let r={popupName:this.generatePopupName(e.scopes||me,e.authority||this.config.auth.authority),popupWindowAttributes:e.popupWindowAttributes||{},popupWindowParent:e.popupWindowParent??window};return this.config.system.asyncPopups?(this.logger.verbose("asyncPopups set to true, acquiring token"),this.acquireTokenPopupAsync(e,r)):(this.logger.verbose("asyncPopup set to false, opening popup before acquiring token"),r.popup=this.openSizedPopup("about:blank",r),this.acquireTokenPopupAsync(e,r))}catch(t){return Promise.reject(t)}}logout(e){try{this.logger.verbose("logoutPopup called");let t=this.initializeLogoutRequest(e),r={popupName:this.generateLogoutPopupName(t),popupWindowAttributes:e?.popupWindowAttributes||{},popupWindowParent:e?.popupWindowParent??window},o=e&&e.authority,i=e&&e.mainWindowRedirectUri;return this.config.system.asyncPopups?(this.logger.verbose("asyncPopups set to true"),this.logoutPopupAsync(t,r,o,i)):(this.logger.verbose("asyncPopup set to false, opening popup"),r.popup=this.openSizedPopup("about:blank",r),this.logoutPopupAsync(t,r,o,i))}catch(t){return Promise.reject(t)}}acquireTokenPopupAsync(e,t){return h(this,null,function*(){this.logger.verbose("acquireTokenPopupAsync called");let r=this.initializeServerTelemetryManager(M.acquireTokenPopup),o=yield p(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,y.Popup);ln(o.authority);try{let i=yield p(this.initializeAuthorizationCodeRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationCodeRequest,this.logger,this.performanceClient,this.correlationId)(o),a=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:r,requestAuthority:o.authority,requestAzureCloudOptions:o.azureCloudOptions,requestExtraQueryParameters:o.extraQueryParameters,account:o.account}),s=Ce.isNativeAvailable(this.config,this.logger,this.nativeMessageHandler,e.authenticationScheme),l;s&&(l=this.performanceClient.startMeasurement(c.FetchAccountIdWithNativeBroker,e.correlationId));let d=yield a.getAuthCodeUrl(S(f({},o),{nativeBroker:s})),m=new Ot(a,this.browserStorage,i,this.logger,this.performanceClient),T=this.initiateAuthRequest(d,t);this.eventHandler.emitEvent(E.POPUP_OPENED,y.Popup,{popupWindow:T},null);let A=yield this.monitorPopupForHash(T,t.popupWindowParent),R=ae(Ai,c.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(A,this.config.auth.OIDCOptions.serverResponseType,this.logger);if(Le.removeThrottle(this.browserStorage,this.config.auth.clientId,i),R.accountId){if
7(this.logger.verbose("Account id found in hash, calling WAM for token"),l&&l.end({success:!0,isNativeBroker:!0}),!this.nativeMessageHandler)throw C(ye);let U=new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.acquireTokenPopup,this.performanceClient,this.nativeMessageHandler,R.accountId,this.nativeStorage,o.correlationId),{userRequestState:te}=J.parseRequestState(this.browserCrypto,o.state);return yield U.acquireToken(S(f({},o),{state:te,prompt:void 0}))}return yield m.handleCodeResponse(R,o)}catch(i){throw t.popup?.close(),i instanceof b&&(i.setCorrelationId(this.correlationId),r.cacheFailedRequest(i)),i}})}logoutPopupAsync(e,t,r,o){return h(this,null,function*(){this.logger.verbose("logoutPopupAsync called"),this.eventHandler.emitEvent(E.LOGOUT_START,y.Popup,e);let i=this.initializeServerTelemetryManager(M.logoutPopup);try{yield this.clearCacheOnLogout(e.account);let a=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:i,requestAuthority:r,account:e.account||void 0});try{a.authority.endSessionEndpoint}catch{if(e.account?.homeAccountId&&e.postLogoutRedirectUri&&a.authority.protocolMode===Z.OIDC){if(this.browserStorage.removeAccount(e.account?.homeAccountId),this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,y.Popup,e),o){let d={apiId:M.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},m=k.getAbsoluteUrl(o,le());yield this.navigationClient.navigateInternal(m,d)}t.popup?.close();return}}let s=a.getLogoutUri(e);this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,y.Popup,e);let l=this.openPopup(s,t);if(this.eventHandler.emitEvent(E.POPUP_OPENED,y.Popup,{popupWindow:l},null),yield this.monitorPopupForHash(l,t.popupWindowParent).catch(()=>{}),o){let d={apiId:M.logoutPopup,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},m=k.getAbsoluteUrl(o,le());this.logger.verbose("Redirecting main window to url specified in the request"),this.logger.verbosePii(`Redirecting main window to: ${m}`),yield this.navigationClient.navigateInternal(m,d)}else this.logger.verbose("No main window navigation requested")}catch(a){throw t.popup?.close(),a instanceof b&&(a.setCorrelationId(this.correlationId),i.cacheFailedRequest(a)),this.browserStorage.setInteractionInProgress(!1),this.eventHandler.emitEvent(E.LOGOUT_FAILURE,y.Popup,null,a),this.eventHandler.emitEvent(E.LOGOUT_END,y.Popup),a}this.eventHandler.emitEvent(E.LOGOUT_END,y.Popup)})}initiateAuthRequest(e,t){if(e)return this.logger.infoPii(`Navigate to: ${e}`),this.openPopup(e,t);throw this.logger.error("Navigate url is empty"),C(He)}monitorPopupForHash(e,t){return new Promise((r,o)=>{this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");let i=setInterval(()=>{if(e.closed){this.logger.error("PopupHandler.monitorPopupForHash - window closed"),clearInterval(i),o(C(he));return}let a="";try{a=e.location.href}catch{}if(!a||a==="about:blank")return;clearInterval(i);let s="",l=this.config.auth.OIDCOptions.serverResponseType;e&&(l===we.QUERY?s=e.location.search:s=e.location.hash),this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller"),r(s)},this.config.system.pollIntervalMilliseconds)}).finally(()=>{this.cleanPopup(e,t)})}openPopup(e,t){try{let r;if(t.popup?(r=t.popup,this.logger.verbosePii(`Navigating popup window to: ${e}`),r.location.assign(e)):typeof t.popup>"u"&&(this.logger.verbosePii(`Opening popup window to: ${e}`),r=this.openSizedPopup(e,t)),!r)throw C(Br);return r.focus&&r.focus(),this.currentWindow=r,t.popupWindowParent.addEventListener("beforeunload",this.unloadWindow),r}catch(r){throw this.logger.error("error opening popup "+r.message),this.browserStorage.setInteractionInProgress(!1),C(Fr)}}openSizedPopup(e,{popupName:t,popupWindowAttributes:r,popupWindowParent:o}){let i=o.screenLeft?o.screenLeft:o.screenX,a=o.screenTop?o.screenTop:o.screenY,s=o.innerWidth||document.documentElement.clientWidth||document.body.clientWidth,l=o.innerHeight||document.documentElement.clientHeight||document.body.clientHeight,d=r.popupSize?.width,m=r.popupSize?.height,T=r.popupPosition?.top,A=r.popupPosition?.left;return(!d||d<0||d>s)&&(this.logger.verbose("Default popup window width used. Window width not configured or invalid."),d=V.POPUP_WIDTH),(!m||m<0||m>l)&&(this.logger.verbose("Default popup window height used. Window height not configured or invalid."),m=V.POPUP_HEIGHT),(!T||T<0||T>l)&&(this.logger.verbose("Default popup window top position used. Window top not configured or invalid."),T=Math.max(0,l/2-V.POPUP_HEIGHT/2+a)),(!A||A<0||A>s)&&(this.logger.verbose("Default popup window left position used. Window left not configured or invalid."),A=Math.max(0,s/2-V.POPUP_WIDTH/2+i)),o.open(e,t,`width=${d}, height=${m}, top=${T}, left=${A}, scrollbars=yes`)}unloadWindow(e){this.browserStorage.cleanRequestByInteractionType(y.Popup),this.currentWindow&&this.currentWindow.close(),e.preventDefault()}cleanPopup(e,t){e.close(),t.removeEventListener("beforeunload",this.unloadWindow),this.browserStorage.setInteractionInProgress(!1)}generatePopupName(e,t){return`${V.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${e.join("-")}.${t}.${this.correlationId}`}generateLogoutPopupName(e){let t=e.account&&e.account.homeAccountId;return`${V.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${t}.${this.correlationId}`}};var gn=class{constructor(e,t,r,o,i){this.authModule=e,this.browserStorage=t,this.authCodeRequest=r,this.logger=o,this.performanceClient=i}initiateAuthRequest(e,t){return h(this,null,function*(){if(this.logger.verbose("RedirectHandler.initiateAuthRequest called"),e){t.redirectStartPage&&(this.logger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page"),this.browserStorage.setTemporaryCache(P.ORIGIN_URI,t.redirectStartPage,!0)),this.browserStorage.setTemporaryCache(P.CORRELATION_ID,this.authCodeRequest.correlationId,!0),this.browserStorage.cacheCodeRequest
7(this.authCodeRequest),this.logger.infoPii(`RedirectHandler.initiateAuthRequest: Navigate to: ${e}`);let r={apiId:M.acquireTokenRedirect,timeout:t.redirectTimeout,noHistory:!1};if(typeof t.onRedirectNavigate=="function")if(this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback"),t.onRedirectNavigate(e)!==!1){this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating"),yield t.navigationClient.navigateExternal(e,r);return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");return}else{this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url"),yield t.navigationClient.navigateExternal(e,r);return}}else throw this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty"),C(He)})}handleCodeResponse(e,t){return h(this,null,function*(){this.logger.verbose("RedirectHandler.handleCodeResponse called"),this.browserStorage.setInteractionInProgress(!1);let r=this.browserStorage.generateStateKey(t),o=this.browserStorage.getTemporaryCache(r);if(!o)throw g(W.stateNotFound,"Cached State");let i;try{i=this.authModule.handleFragmentResponse(e,o)}catch(d){throw d instanceof se&&d.subError===he?C(he):d}let a=this.browserStorage.generateNonceKey(o),s=this.browserStorage.getTemporaryCache(a);if(this.authCodeRequest.code=i.code,i.cloud_instance_host_name&&(yield p(this.authModule.updateAuthority.bind(this.authModule),c.UpdateTokenEndpointAuthority,this.logger,this.performanceClient,this.authCodeRequest.correlationId)(i.cloud_instance_host_name,this.authCodeRequest.correlationId)),i.nonce=s||void 0,i.state=o,i.client_info)this.authCodeRequest.clientInfo=i.client_info;else{let d=this.checkCcsCredentials();d&&(this.authCodeRequest.ccsCredential=d)}let l=yield this.authModule.acquireToken(this.authCodeRequest,i);return this.browserStorage.cleanRequestByState(t),l})}checkCcsCredentials(){let e=this.browserStorage.getTemporaryCache(P.CCS_CREDENTIAL,!0);if(e)try{return JSON.parse(e)}catch{this.authModule.logger.error("Cache credential could not be parsed"),this.authModule.logger.errorPii(`Cache
7credential could not be parsed: ${e}`)}return null}};function Sl(){if(typeof window>"u"||typeof window.performance>"u"||typeof window.performance.getEntriesByType!="function")return;let n=window.performance.getEntriesByType("navigation");return(n.length?n[0]:void 0)?.type}var Ei=class extends ge{constructor(e,t,r,o,i,a,s,l,d,m){super(e,t,r,o,i,a,s,d,m),this.nativeStorage=l}acquireToken(e){return h(this,null,function*(){let t=yield p(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,this.correlationId)(e,y.Redirect);this.browserStorage.updateCacheEntries(t.state,t.nonce,t.authority,t.loginHint||"",t.account||null);let r=this.initializeServerTelemetryManager(M.acquireTokenRedirect),o=i=>{i.persisted&&(this.logger.verbose("Page was restored from back/forward cache. Clearing temporary cache."),this.browserStorage.cleanRequestByState(t.state),this.eventHandler.emitEvent(E.RESTORE_FROM_BFCACHE,y.Redirect))};try{let i=yield p(this.initializeAuthorizationCodeRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationCodeRequest,this.logger,this.performanceClient,this.correlationId)(t),a=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:r,requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account}),s=new gn(a,this.browserStorage,i,this.logger,this.performanceClient),l=yield a.getAuthCodeUrl(S(f({},t),{nativeBroker:Ce.isNativeAvailable(this.config,this.logger,this.nativeMessageHandler,e.authenticationScheme)})),d=this.getRedirectStartPage(e.redirectStartPage);return this.logger.verbosePii(`Redirect start page: ${d}`),window.addEventListener("pageshow",o),yield s.initiateAuthRequest(l,{navigationClient:this.navigationClient,redirectTimeout:this.config.system.redirectNavigationTimeout,redirectStartPage:d,onRedirectNavigate:e.onRedirectNavigate||this.config.auth.onRedirectNavigate})}catch(i){throw i instanceof b&&(i.setCorrelationId(this.correlationId),r.cacheFailedRequest(i)),window.removeEventListener("pageshow",o),this.browserStorage.cleanRequestByState(t.state),i}})}handleRedirectPromise(e="",t){return h(this,null,function*(){let r=this.initializeServerTelemetryManager(M.handleRedirectPromise);try{if(!this.browserStorage.isInteractionInProgress(!0))return this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null."),null;let[o,i]=this.getRedirectResponse(e||"");if(!o)return this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."),this.browserStorage.cleanRequestByInteractionType(y.Redirect),Sl()!=="back_forward"?t.event.errorCode="no_server_response":this.logger.verbose("Back navigation event detected. Muting no_server_response error"),null;let a=this.browserStorage.getTemporaryCache(P.ORIGIN_URI,!0)||u.EMPTY_STRING,s=k.removeHashFromUrl(a),l=k.removeHashFromUrl(window.location.href);if(s===l&&this.config.auth.navigateToLoginRequestUrl)return this.logger.verbose("Current page is loginRequestUrl, handling response"),a.indexOf("#")>-1&&za(a),yield this.handleResponse(o,r);if(this.config.auth.navigateToLoginRequestUrl){if(!sn()||this.config.system.allowRedirectInIframe){this.browserStorage.setTemporaryCache(P.URL_HASH,i,!0);let d={apiId:M.handleRedirectPromise,timeout:this.config.system.redirectNavigationTimeout,noHistory:!0},m=!0;if(!a||a==="null"){let T=$a();this.browserStorage.setTemporaryCache(P.ORIGIN_URI,T,!0),this.logger.warning("Unable to get valid login request url from cache, redirecting to home page"),m=yield this.navigationClient.navigateInternal(T,d)}else this.logger.verbose(`Navigating to loginRequestUrl: ${a}`),m=yield this.navigationClient.navigateInternal(a,d);if(!m)return yield this.handleResponse(o,r)}}else return this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response"),yield this.handleResponse(o,r);return null}catch(o){throw o instanceof b&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),this.browserStorage.cleanRequestByInteractionType(y.Redirect),o}})}getRedirectResponse(e){this.logger.verbose("getRedirectResponseHash called");let t=e;t||(this.config.auth.OIDCOptions.serverResponseType===we.QUERY?t=window.location.search:t=window.location.hash);let r=Tt.getDeserializedResponse(t);if(r){try{uc(r,this.browserCrypto,y.Redirect)}catch(i){return i instanceof b&&this.logger.error(`Interaction type validation failed due to ${i.errorCode}: ${i.errorMessage}`),[null,""]}return Ga(window),this.logger.verbose("Hash contains known properties, returning response hash"),[r,t]}let o=this.browserStorage.getTemporaryCache(P.URL_HASH,!0);return this.browserStorage.removeItem(this.browserStorage.generateCacheKey(P.URL_HASH)),o&&(r=Tt.getDeserializedResponse(o),r)?(this.logger.verbose("Hash does not contain known properties, returning c
7ached hash"),[r,o]):[null,""]}handleResponse(e,t){return h(this,null,function*(){let r=e.state;if(!r)throw C(St);let o=this.browserStorage.getCachedRequest(r);if(this.logger.verbose("handleResponse called, retrieved cached request"),e.accountId){if(this.logger.verbose("Account id found in hash, calling WAM for token"),!this.nativeMessageHandler)throw C(ye);let l=new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.acquireTokenPopup,this.performanceClient,this.nativeMessageHandler,e.accountId,this.nativeStorage,o.correlationId),{userRequestState:d}=J.parseRequestState(this.browserCrypto,r);return l.acquireToken(S(f({},o),{state:d,prompt:void 0})).finally(()=>{this.browserStorage.cleanRequestByState(r)})}let i=this.browserStorage.getCachedAuthority(r);if(!i)throw C(vt);let a=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:t,requestAuthority:i});return Le.removeThrottle(this.browserStorage,this.config.auth.clientId,o),new gn(a,this.browserStorage,o,this.logger,this.performanceClient).handleCodeResponse(e,r)})}logout(e){return h(this,null,function*(){this.logger.verbose("logoutRedirect called");let t=this.initializeLogoutRequest(e),r=this.initializeServerTelemetryManager(M.logout);try{this.eventHandler.emitEvent(E.LOGOUT_START,y.Redirect,e),yield this.clearCacheOnLogout(t.account);let o={apiId:M.logout,timeout:this.config.system.redirectNavigationTimeout,noHistory:!1},i=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:r,requestAuthority:e&&e.authority,requestExtraQueryParameters:e?.extraQueryParameters,account:e&&e.account||void 0});if(i.authority.protocolMode===Z.OIDC)try{i.authority.endSessionEndpoint}catch{if(t.account?.homeAccountId){this.browserStorage.removeAccount(t.account?.homeAccountId),this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,y.Redirect,t);return}}let a=i.getLogoutUri(t);if(this.eventHandler.emitEvent(E.LOGOUT_SUCCESS,y.Redirect,t),e&&typeof e.onRedirectNavigate=="function")if(e.onRedirectNavigate(a)!==!1){this.logger.verbose("Logout onRedirectNavigate did not return false, navigating"),this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0),yield this.navigationClient.navigateExternal(a,o);return}else this.browserStorage.setInteractionInProgress(!1),this.logger.verbose("Logout onRedirectNavigate returned false, stopping navigation");else{this.browserStorage.getInteractionInProgress()||this.browserStorage.setInteractionInProgress(!0),yield this.navigationClient.navigateExternal(a,o);return}}catch(o){throw o instanceof b&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),this.eventHandler.emitEvent(E.LOGOUT_FAILURE,y.Redirect,null,o),this.eventHandler.emitEvent(E.LOGOUT_END,y.Redirect),o}this.eventHandler.emitEvent(E.LOGOUT_END,y.Redirect)})}getRedirectStartPage(e){let t=e||window.location.href;return k.getAbsoluteUrl(t,le())}};function gc(n,e,t,r,o){return h(this,null,function*(){if(e.addQueueMeasurement(c.SilentHandlerInitiateAuthRequest,r),!n)throw t.info("Navigate url is empty"),C(He);return o?p(vl,c.SilentHandlerLoadFrame,t,e,r)(n,o,e,r):ae(Rl,c.SilentHandlerLoadFrameSync,t,e,r)(n)})}function mc(n,e,t,r,o,i,a){return h(this,null,function*(){return r.addQueueMeasurement(c.SilentHandlerMonitorIframeForHash,i),new Promise((s,l)=>{e<ci&&o.warning(`system.loadFrameTimeout or system.iframeHashTimeout set to lower (${e}ms) than the default (${ci}ms). This may result in timeouts.`);let d=window.setTimeout(()=>{window.clearInterval(m),l(C(Kr))},e),m=window.setInterval(()=>{let T="",A=n.contentWindow;try{T=A?A.location.href:""}catch{}if(!T||T==="about:blank")return;let R="";A&&(a===we.QUERY?R=A.location.search:R=A.location.hash),window.clearTimeout(d),window.clearInterval(m),s(R)},t)}).finally(()=>{ae(_l,c.RemoveHiddenIframe,o,r,i)(n)})})}function vl(n,e,t,r){return t.addQueueMeasurement(c.SilentHandlerLoadFrame,r),new Promise((o,i)=>{let a=pc();window.setTimeout(()=>{if(!a){i("Unable to load iframe");return}a.src=n,o(a)},e)})}function Rl(n){let e=pc();return e.src=n,e}function pc(){let n=document.createElement("iframe");return n.className="msalSilentIframe",n.style.visibility="hidden",n.style.position="absolute",n.style.width=n.style.height="0",n.style.border="0",n.setAttribute("sandbox","allow-scripts allow-same-origin allow-forms"),document.body.appendChild(n),n}function _l(n){document.body===n.parentNode&&document.body.removeChild(n)}var Ii=class extends ge{constructor(e,t,r,o,i,a,s,l,d,m,T){super(e,t,r,o,i,a,l,m,T),this.apiId=s,this.nativeStorage=d}acquireToken(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentIframeClientAcquireToken,e.correlationId),!e.loginHint&&!e.sid&&(!e.account||!e.account.username)&&this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");let t=f({},e);t.prompt?t.prompt!==F.NONE&&t.prompt!==F.NO_SESSION&&(this.logger.warning(`SilentIframeClient. Replacing invalid prompt ${t.prompt} with ${F.NONE}`),t.prompt=F.NONE):t.prompt=F.NONE;let r=yield p(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(t,y.Silent);ln(r.authority);let o=this.initializeServerTelemetryManager(this.apiId),i;try{return i=yield p(this.createAuthCodeClient.bind(this),c.StandardInteractionClientCreateAuthCodeClient,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:o,requestAuthority:r.authority,requestAzureCloudOptions:r.azureCloudOptions,requestExtraQueryParameters:r.extraQueryParameters,account:r.account}),yield p(this.silentTokenHelper.bind(this),c.SilentIframeClientTokenHelper,this.logger,this.performanceClient,e.correlationId)(i,r)}catch(a){if(a instanceof b&&(a.setCorrelationId(this.correlationId),o.cacheFailedRequest(a)),!i||!(a instanceof b)||a.errorCode!==V.INVALID_GRANT_ERROR)throw a;this.performanceClient.addFields({retryError:a.errorCode},this.correlationId);let s=yield p(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(t,y.Silent);return yield p(this.silentTokenHelper.bind(this),c.SilentIframeClientTokenHelper,this.logger,this.performanceClient,this.correlationId)(i,s)}})}logout(){return Promise.reject(C(xe))}silentTokenHelper(e,t){return h(this,null,function*(){let r=t.correlationId;this.performanceClient.addQueueMeasurement(c.SilentIframeClientTokenHelper,r);let o=yield p(this.initializeAuthorizationCodeRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationCodeRequest,this.logger,this.performanceClient,r)(t),i=yield p(e.getAuthCodeUrl.bind(e),c.GetAuthCodeUrl,this.logger,this.performanceClient,r)(S(f({},t),{nativeBroker:Ce.isNativeAvailable(this.config,this.logger,this.nativeMessageHandler,t.authenticationScheme)})),a=new Ot(e,this.browserStorage,o,this.logger,this.performanceClient),s=yield p(gc,c.SilentHandlerInitiateAuthRequest,this.logger,this.performanceClient,r)(i,this.performanceClient,this.logger,r,this.config.system.navigateFrameWait),l=this.config.auth.OIDCOptions.serverResponseType,d=yield p(mc,c.SilentHandlerMonitorIframeForHash,this.logger,this.performanceClient,r)(s,this.config.system.iframeHashTimeout,this.config.system.pollIntervalMilliseconds,this.performanceClient,this.logger,r,l),m=ae(Ai,c.DeserializeResponse,this.logger,this.performanceClient,this.correlationId)(d,l,this.logger);
7if(m.accountId){if(this.logger.verbose("Account id found in hash, calling WAM for token"),!this.nativeMessageHandler)throw C(ye);let T=new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.apiId,this.performanceClient,this.nativeMessageHandler,m.accountId,this.browserStorage,r),{userRequestState:A}=J.parseRequestState(this.browserCrypto,t.state);return p(T.acquireToken.bind(T),c.NativeInteractionClientAcquireToken,this.logger,this.performanceClient,r)(S(f({},t),{state:A,prompt:t.prompt||F.NONE}))}return p(a.handleCodeResponse.bind(a),c.HandleCodeResponse,this.logger,this.performanceClient,r)(m,t)})}};var Si=class extends ge{acquireToken(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.SilentRefreshClientAcquireToken,e.correlationId);let t=yield p(hn,c.InitializeBaseRequest,this.logger,this.performanceClient,e.correlationId)(e,this.config,this.performanceClient,this.logger),r=f(f({},e),t);e.redirectUri&&(r.redirectUri=this.getRedirectUri(e.redirectUri));let o=this.initializeServerTelemetryManager(M.acquireTokenSilent_silentFlow),i=yield this.createRefreshTokenClient({serverTelemetryManager:o,authorityUrl:r.authority,azureCloudOptions:r.azureCloudOptions,account:r.account});return p(i.acquireTokenByRefreshToken.bind(i),c.RefreshTokenClientAcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(r).catch(a=>{throw a.setCorrelationId(this.correlationId),o.cacheFailedRequest(a),a})})}logout(){return Promise.reject(C(xe))}createRefreshTokenClient(e){return h(this,null,function*(){let t=yield p(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,this.correlationId)({serverTelemetryManager:e.serverTelemetryManager,requestAuthority:e.authorityUrl,requestAzureCloudOptions:e.azureCloudOptions,requestExtraQueryParameters:e.extraQueryParameters,account:e.account});return new It(t,this.performanceClient)})}};var vi=class{constructor(e,t,r,o){this.isBrowserEnvironment=typeof window<"u",this.config=e,this.storage=t,this.logger=r,this.cryptoObj=o}loadExternalTokens(e,t,r){if(!this.isBrowserEnvironment)throw C(Fe);let o=t.id_token?ft.extractTokenClaims(t.id_token,ue):void 0,i={protocolMode:this.config.auth.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache},a=e.authority?new Ae(Ae.generateAuthority(e.authority,e.azureCloudOptions),this.config.system.networkClient,this.storage,i,this.logger,e.correlationId||re()):void 0,s=this.loadAccount(e,r.clientInfo||t.client_info||"",o,a),l=this.loadIdToken(t,s.homeAccountId,s.environment,s.realm),d=this.loadAccessToken(e,t,s.homeAccountId,s.environment,s.realm,r),m=this.loadRefreshToken(t,s.homeAccountId,s.environment);return this.generateAuthenticationResult(e,{account:s,idToken:l,accessToken:d,refreshToken:m},o,a)}loadAccount(e,t,r,o){if(this.logger.verbose("TokenCache - loading account"),e.account){let l=x.createFromAccountInfo(e.account);return this.storage.setAccount(l),l}else if(!o||!t&&!r)throw this.logger.error("TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead."),C(jr);let i=x.generateHomeAccountId(t,o.authorityType,this.logger,this.cryptoObj,r),a=r?.tid,s=Pr(this.storage,o,i,ue,r,t,o.hostnameAndPort,a,void 0,void 0,this.logger);return this.storage.setAccount(s),s}loadIdToken(e,t,r,o){if(!e.id_token)return this.logger.verbose("TokenCache - no id token found in response"),null;this.logger.verbose("TokenCache - loading id token");let i=H.createIdTokenEntity(t,r,e.id_token,this.config.auth.clientId,o);return this.storage.setIdTokenCredential(i),i}loadAccessToken(e,t,r,o,i,a){if(t.access_token)if(t.expires_in){if(!t.scope&&(!e.scopes||!e.scopes.length))return this.logger.error("TokenCache - scopes not specified in the request or response. Cannot add token to the cache."),null}else return this.logger.error("TokenCache - no expiration set on the access token. Cannot add it to the cache."),null;else return this.logger.verbose("TokenCache - no access token found in response"),null;this.logger.verbose("TokenCache - loading access token");let s=t.scope?B.fromString(t.scope):new B(e.scopes),l=a.expiresOn||t.expires_in+new Date().getTime()/1e3,d=a.extendedExpiresOn||(t.ext_expires_in||t.expires_in)+new Date().getTime()/1e3,m=H.createAccessTokenEntity(r,o,t.access_token,this.config.auth.clientId,i,s.printScopes(),l,d,ue);return this.storage.setAccessTokenCredential(m),m}loadRefreshToken(e,t,r){if(!e.refresh_token)return this.logger.verbose("TokenCache - no refresh token found in response"),null;this.logger.verbose("TokenCache - loading refresh token");let o=H.createRefreshTokenEntity(t,r,e.refresh_token,this.config.auth.clientId,e.foci,void 0,e.refresh_token_expires_in);return this.storage.setRefreshTokenCredential(o),o}generateAuthenticationResult(e,t,r,o){let i="",a=[],s=null,l;t?.accessToken&&(i=t.accessToken.secret,a=B.fromString(t.accessToken.target).asArray(),s=new Date(Number(t.accessToken.expiresOn)*1e3),l=new Date(Number(t.accessToken.extendedExpiresOn)*1e3));let d=t.account;return{authority:o?o.canonicalAuthority:"",uniqueId:t.account.localAccountId,tenantId:t.account.realm,scopes:a,account:d.getAccountInfo(),idToken:t.idToken?.secret||"",idTokenClaims:r||{},accessToken:i,fromCache:!0,expiresOn:s,correlationId:e.correlationId||"",requestId:"",extExpiresOn:l,familyId:t.refreshToken?.familyId||"",tokenType:t?.accessToken?.tokenType||"",state:e.state||"",cloudGraphHostName:d.cloudGraphHostName||"",msGraphHost:d.msGraphHost||"",fromNativeBroker:!1}}};var Ri=class extends hr{constructor(e){super(e),this.includeRedirectUri=!1}};var _i=class extends ge{constructor(e,t,r,o,i,a,s,l,d,m){super(e,t,r,o,i,a,l,d,m),this.apiId=s}acquireToken(e){return h(this,null,function*(){if(!e.code)throw C(Jr);let t=yield p(this.initializeAuthorizationRequest.bind(this),c.StandardInteractionClientInitializeAuthorizationRequest,this.logger,this.performanceClient,e.correlationId)(e,y.Silent),r=this.initializeServerTelemetryManager(this.apiId);try{let o=S(f({},t),{code:e.code}),i=yield p(this.getClientConfiguration.bind(this),c.StandardInteractionClientGetClientConfiguration,this.logger,this.performanceClient,e.correlationId)({serverTelemetryManager:r,requestAuthority:t.authority,requestAzureCloudOptions:t.azureCloudOptions,requestExtraQueryParameters:t.extraQueryParameters,account:t.account}),a=new Ri(i);this.logger.verbose("Auth code client created");let s=new Ot(a,this.browserStorage,o,this.logger,this.performanceClient);return yield p(s.handleCodeResponseFromServer.bind(s),c.HandleCodeResponseFromServer,this.logger,this.performanceClient,e.correlationId)({code:e.code,msgraph_host:e.msGraphHost,cloud_graph_host_name:e.cloudGraphHostName,cloud_instance_host_name:e.cloudInstanceHostName},t,!1)}catch(o){throw o instanceof b&&(o.setCorrelationId(this.correlationId),r.cacheFailedRequest(o)),o}})}logout(){return Promise.reject(C(xe))}};function Ke(n){let e=n?.idTokenClaims;if(e?.tfp||e?.acr)return"B2C";if(e?.tid){if(e?.tid==="9188040d-6c67-4c5b-b112-36a304b66dad")return"MSA"}else return;return"AAD"}function wi(n,e){try{cn(n)}catch(t){throw e.end({success:!1},t),t}}var mo=class n{constructor(e){this.operatingContext=e,this.isBrowserEnvironment=this.operatingContext.
7isBrowserEnvironment(),this.config=e.getConfig(),this.initialized=!1,this.logger=this.operatingContext.getLogger(),this.networkClient=this.config.system.networkClient,this.navigationClient=this.config.system.navigationClient,this.redirectResponse=new Map,this.hybridAuthCodeResponses=new Map,this.performanceClient=this.config.telemetry.client,this.browserCrypto=this.isBrowserEnvironment?new Ys(this.logger,this.performanceClient):mt,this.eventHandler=new Ci(this.logger),this.browserStorage=this.isBrowserEnvironment?new ho(this.config.auth.clientId,this.config.cache,this.browserCrypto,this.logger,wa(this.config.auth),this.performanceClient):Ws(this.config.auth.clientId,this.logger);let t={cacheLocation:Q.MemoryStorage,temporaryCacheLocation:Q.MemoryStorage,storeAuthStateInCookie:!1,secureCookies:!1,cacheMigrationEnabled:!1,claimsBasedCachingEnabled:!1};this.nativeInternalStorage=new ho(this.config.auth.clientId,t,this.browserCrypto,this.logger,void 0,this.performanceClient),this.tokenCache=new vi(this.config,this.browserStorage,this.logger,this.browserCrypto),this.activeSilentTokenRequests=new Map,this.trackPageVisibility=this.trackPageVisibility.bind(this),this.trackPageVisibilityWithMeasurement=this.trackPageVisibilityWithMeasurement.bind(this),this.listeningToStorageEvents=!1,this.handleAccountCacheChange=this.handleAccountCacheChange.bind(this)}static createController(e,t){return h(this,null,function*(){let r=new n(e);return yield r.initialize(t),r})}trackPageVisibility(e){e&&(this.logger.info("Perf: Visibility change detected"),this.performanceClient.incrementFields({visibilityChangeCount:1},e))}initialize(e){return h(this,null,function*(){if(this.logger.trace("initialize called"),this.initialized){this.logger.info("initialize has already been called, exiting early.");return}if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, exiting early."),this.initialized=!0,this.eventHandler.emitEvent(E.INITIALIZE_END);return}let t=e?.correlationId||this.getRequestCorrelationId(),r=this.config.system.allowNativeBroker,o=this.performanceClient.startMeasurement(c.InitializeClientApplication,t);if(this.eventHandler.emitEvent(E.INITIALIZE_START),r)try{this.nativeExtensionProvider=yield Ce.createProvider(this.logger,this.config.system.nativeBrokerHandshakeTimeout,this.performanceClient)}catch(i){this.logger.verbose(i)}this.config.cache.claimsBasedCachingEnabled||(this.logger.verbose("Claims-based caching is disabled. Clearing the previous cache with claims"),yield p(this.browserStorage.clearTokensAndKeysWithClaims.bind(this.browserStorage),c.ClearTokensAndKeysWithClaims,this.logger,this.performanceClient,t)(this.performanceClient,t)),this.initialized=!0,this.eventHandler.emitEvent(E.INITIALIZE_END),o.end({allowNativeBroker:r,success:!0})})}handleRedirectPromise(e){return h(this,null,function*(){if(this.logger.verbose("handleRedirectPromise called"),ni(this.initialized),this.isBrowserEnvironment){let t=e||"",r=this.redirectResponse.get(t);return typeof r>"u"?(r=this.handleRedirectPromiseInternal(e),this.redirectResponse.set(t,r),this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise")):this.logger.verbose("handleRedirectPromise has been called previously, returning the result from the first call"),r}return this.logger.verbose("handleRedirectPromise returns null, not browser environment"),null})}handleRedirectPromiseInternal(e){return h(this,null,function*(){let t=this.getAllAccounts(),r=this.browserStorage.getCachedNativeRequest(),o=r&&Ce.isNativeAvailable(this.config,this.logger,this.nativeExtensionProvider)&&this.nativeExtensionProvider&&!e,i=o?r?.correlationId:this.browserStorage.getTemporaryCache(P.CORRELATION_ID,!0)||"",a=this.performanceClient.startMeasurement(c.AcquireTokenRedirect,i);this.eventHandler.emitEvent(E.HANDLE_REDIRECT_START,y.Redirect);let s;if(o&&this.nativeExtensionProvider){this.logger.trace("handleRedirectPromise - acquiring token from native platform");let l=new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.handleRedirectPromise,this.performanceClient,this.nativeExtensionProvider,r.accountId,this.nativeInternalStorage,r.correlationId);s=p(l.handleRedirectPromise.bind(l),c.HandleNativeRedirectPromiseMeasurement,this.logger,this.performanceClient,a.event.correlationId)(this.performanceClient,a.event.correlationId)}else{this.logger.trace("handleRedirectPromise - acquiring token from web flow");let l=this.createRedirectClient(i);s=p(l.handleRedirectPromise.bind(l),c.HandleRedirectPromiseMeasurement,this.logger,this.performanceClient,a.event.correlationId)(e,a)}return s.then(l=>(l?(t.length<this.getAllAccounts().length?(this.eventHandler.emitEvent(E.LOGIN_SUCCESS,y.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, login success")):(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,y.Redirect,l),this.logger.verbose("handleRedirectResponse returned result, acquire token success")),a.end({success:!0,accountType:Ke(l.account)})):a.event.errorCode?a.end({success:!1}):a.discard(),this.eventHandler.emitEvent(E.HANDLE_REDIRECT_END,y.Redirect),l)).catch(l=>{let d=l;throw t.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,y.Redirect,null,d):this.eventHandler.emitEvent(E.LOGIN_FAILURE,y.Redirect,null,d),this.eventHandler.emitEvent(E.HANDLE_REDIRECT_END,y.Redirect),a.end({success:!1},d),l})})}acquireTokenRedirect(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e);this.logger.verbose("acquireTokenRedirect called",t);let r=this.performanceClient.startMeasurement(c.AcquireTokenPreRedirect,t);r.add({accountType:Ke(e.account),scenarioId:e.scenarioId});let o=e.onRedirectNavigate;if(o)e.onRedirectNavigate=a=>{let s=typeof o=="function"?o(a):void 0;return s!==!1?r.end({success:!0}):r.discard(),s};else{let a=this.config.auth.onRedirectNavigate;this.config.auth.onRedirectNavigate=s=>{let l=typeof a=="function"?a(s):void 0;return l!==!1?r.end({success:!0}):r.discard(),l}}let i=this.getAllAccounts().length>0;try{ii(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0),i?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,y.Redirect,e):this.eventHandler.emitEvent(E.LOGIN_START,y.Redirect,e);let a;return this.nativeExtensionProvider&&this.canUseNative(e)?a=new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.acquireTokenRedirect,this.performanceClient,this.nativeExtensionProvider,this.getNativeAccountId(e),this.nativeInternalStorage,t).acquireTokenRedirect(e,r).catch(l=>{if(l instanceof Ee&&Nt(l))return this.nativeExtensionProvider=void 0,this.createRedirectClient(t).acquireToken(e);if(l instanceof ee)return this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createRedirectClient(t).acquireToken(e);throw this.browserStorage.setInteractionInProgress(!1),l}):a=this.createRedirectClient(t).acquireToken(e),yield a}catch(a){throw r.end({success:!1},a),i?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,y.Redirect,null,a):this.eventHandler.emitEvent(E.LOGIN_FAILURE,y.Redirect,null,a),a}})}acquireTokenPopup(e){let t=this.getRequestCorrelationId(e),r=this.performanceClient.startMeasurement(c.AcquireTokenPopup,t);r.add({scenarioId:e.scenarioId,accountType:Ke(e.account)});try{this.logger.verbose("acquireTokenPopup called",t),wi(this.initialized,r),this.browserStorage.setInteractionInProgress(!0)}catch(a){return Promise.reject(a)}let o=this.getAllAccounts();o.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,y.Popup,e):this.eventHandler.emitEvent(E.LOGIN_START,y.Popup,e);let i;return this.canUseNative(e)?i=this.acquireTokenNative(S(f({},e),{correlationId:t}),M.acquireTokenPopup).then(a=>(this.browserStorage.setInteractionInProgress(!1),r.end({success:!0,isNativeBroker:!0,accountType:Ke(a.account)}),a)).catch(a=>{if(a instanceof Ee&&Nt(a))return this.nativeExtensionProvider=void 0,this.createPopupClient(t).acquireToken(e);if(a instanceof ee)return this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"),this.createPopupClient(t).acquireToken(e);throw this.browserStorage.setInteractionInProgress(!1),a}):i=this.createPopupClient(t).acquireToken(e),i.then(a=>(o.length<this.getAllAccounts().length?this.eventHandler.emitEvent(E.LOGIN_SUCCESS,y.Popup,a):this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,y.Popup,a),r.end({success:!0,accessTokenSize:a.accessToken.length,idTokenSize:a.idToken.length,accountType:Ke(a.account)}),a)).catch(a=>(o.length>0?this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,y.Popup,null,a):this.eventHandler.emitEvent(E.LOGIN_FAILURE,y.Popup,null,a),r.end({success:!1},a),Promise.reject(a)))}trackPageVisibilityWithMeasurement(){let e=this.ssoSilentMeasurement||this.acquireTokenByCodeAsyncMeasurement;e&&(this.logger.info("Perf: Visibility change detected in ",e.event.name),e.increment({visibilityChangeCount:1}))}ssoSilent(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e),r=S(f({},e),{prompt:e.prompt,correlationId:t});this.ssoSilentMeasurement=this.performanceClient.startMeasurement(c.SsoSilent,t),this.ssoSilentMeasurement?.add({scenarioId:e.scenarioId,accountType:Ke(e.account)}),wi(this.initialized,this.ssoSilentMeasurement),this.ssoSilentMeasurement?.increment({visibilityChangeCount:0}),document.addEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement),this.logger.verbose("ssoSilent called",t),this.eventHandler.emitEvent(E.SSO_SILENT_START,y.Silent,r);let o;return this.canUseNative(r)?o=this.acquireTokenNative(r,M.ssoSilent).catch(i=>{if(i instanceof Ee&&Nt(i))return this.nativeExtensionProvider=void 0,this.createSilentIframeClient(r.correlationId).acquireToken(r);throw i}):o=this.createSilentIframeClient(r.correlationId).acquireToken(r),o.then(i=>(this.eventHandler.emitEvent(E.SSO_SILENT_SUCCESS,y.Silent,i),this.ssoSilentMeasurement?.end({success:!0,isNativeBroker:i.fromNativeBroker,accessTokenSize:i.accessToken.length,idTokenSize:i.idToken.length,accountType:Ke(i.account)}),i)).catch(i=>{throw this.eventHandler.emitEvent(E.SSO_SILENT_FAILURE,y.Silent,null,i),this.ssoSilentMeasurement?.end({success:!1},i),i}).finally(()=>{document.removeEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement)})})}acquireTokenByCode(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e);this.logger.trace("acquireTokenByCode called",t);let r=this.performanceClient.startMeasurement(c.AcquireTokenByCode,t);wi(this.initialized,r),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_START,y.Silent,e),r.add({scenarioId:e.scenarioId});try{if(e.code&&e.nativeAccountId)throw C(Zr);if(e.code){let o=e.code,i=this.hybridAuthCodeResponses.get(o);return i?(this.logger.verbose("Existing acquireTokenByCode request found",t),r.discard()):(this.logger.verbose("Initiating new acquireTokenByCode request",t),i=this.acquireTokenByCodeAsync(S(f({},e),{correlationId:t})).then(a=>(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_SUCCESS,y.Silent,a),this.hybridAuthCodeResponses.delete(o),r.end({success:!0,isNativeBroker:a.fromNativeBroker,accessTokenSize:a.accessToken.length,idTokenSize:a.idToken.length,accountType:Ke(a.account)}),a)).catch(a=>{throw this.hybridAuthCodeResponses.delete(o),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_FAILURE,y.Silent,null,a),r.end({success:!1},a),a}),this.hybridAuthCodeResponses.set(o,i)),yield i}else if(e.nativeAccountId)if(this.canUseNative(e,e.nativeAccountId)){let o=yield this.acquireTokenNative(S(f({},e),{correlationId:t}),M.acquireTokenByCode,e.nativeAccountId).catch(i=>{throw i instanceof Ee&&Nt(i)&&(this.nativeExtensionProvider=void 0),i});return r.end({accountType:Ke(o.account),success:!0}),o}else throw C(eo);else throw C(Xr)}catch(o){throw this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_BY_CODE_FAILURE,y.Silent,null,o),r.end({success:!1},o),o}})}acquireTokenByCodeAsync(e){return h(this,null,function*(){return this.logger.trace("acquireTokenByCodeAsync called",e.correlationId),this.acquireTokenByCodeAsyncMeasurement=this.performanceClient.startMeasurement(c.AcquireTokenByCodeAsync,e.correlationId),this.acquireTokenByCodeAsyncMeasurement?.increment({visibilityChangeCount:0}),document.addEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement),yield this.createSilentAuthCodeClient(e.correlationId).acquireToken(e).then(o=>(this.acquireTokenByCodeAsyncMeasurement?.end({success:!0,fromCache:o.fromCache,isNativeBroker:o.fromNativeBroker}),o)).catch(o=>{throw this.acquireTokenByCodeAsyncMeasurement?.end({success:!1},o),o}).finally(()=>{document.removeEventListener("visibilitychange",this.trackPageVisibilityWithMeasurement)})})}acquireTokenFromCache(e,t){return h(this,null,function*(){switch(this.performanceClient.addQueueMeasurement(c.AcquireTokenFromCache,e.correlationId),t){case ce.Default:case ce.AccessToken:case ce.AccessTokenAndRefreshToken:let r=this.createSilentCacheClient(e.correlationId);return p(r.acquireToken.bind(r),c.SilentCacheClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw g(W.tokenRefreshRequired)}})}acquireTokenByRefreshToken(e,t){return h(this,null,function*(){switch(this.performanceClient.addQueueMeasurement(c.AcquireTokenByRefreshToken,e.correlationId),t){case ce.Default:case ce.AccessTokenAndRefreshToken:case ce.RefreshToken:case ce.RefreshTokenAndNetwork:let r=this.createSilentRefreshClient(e.correlationId);return p(r.acquireToken.bind(r),c.SilentRefreshClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e);default:throw g(W.tokenRefreshRequired)}})}acquireTokenBySilentIframe(e){return h(this,null,function*(){this.performanceClient.addQueueMeasurement(c.AcquireTokenBySilentIframe,e.correlationId);let t=this.createSilentIframeClient(e.correlationId);return p(t.acquireToken.bind(t),c.SilentIframeClientAcquireToken,this.logger,this.performanceClient,e.correlationId)(e)})}logout(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e);return this.logger.warning("logout API is deprecated and will be removed in msal-browser v3.0.0. Use logoutRedirect instead.",t),this.logoutRedirect(f({correlationId:t},e))})}logoutRedirect(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e);return ii(this.initialized,this.config),this.browserStorage.setInteractionInProgress(!0),this.createRedirectClient(t).logout(e)})}logoutPopup(e){try{let t=this.getRequestCorrelationId(e);return cn(this.initialized),this.browserStorage.setInteractionInProgress(!0),this.createPopupClient(t).logout(e)}catch(t){return Promise.reject(t)}}clearCache(e){return h(this,null,function*(){if(!this.isBrowserEnvironment){this.logger.info("in non-browser environment, returning early.");return}let t=this.getRequestCorrelationId(e);return this.createSilentCacheClient(t).logout(e)})}getAllAccounts(e){return js(this.logger,this.browserStorage,this.isBrowserEnvironment,e)}getAccount(e){return Js(e,this.logger,this.browserStorage)}getAccountByUsername(e){return Xs(e,this.logger,this.browserStorage)}getAccountByHomeId(e){return Zs(e,this.logger,this.browserStorage)}getAccountByLocalId(e){return ec(e,this.logger,this.browserStorage)}setActiveAccount(e){tc(e,this.browserStorage)}getActiveAccount(){return rc(this.browserStorage)}hydrateCache(e,t){return h(this,null,function*(){this.logger.verbose("hydrateCache called");let r=x.createFromAccountInfo(e.account,e.cloudGraphHostName,e.msGraphHost);return this.browserStorage.setAccount(r),e.fromNativeBroker?(this.logger.verbose("Response was from native broker, storing in-memory"),this.nativeInternalStorage.hydrateCache(e,t)):this.browserStorage.hydrateCache(e,t)})}acquireTokenNative(e,t,r){return h(this,null,function*(){if(this.logger.trace("acquireTokenNative called"),!this.nativeExtensionProvider)throw C(ye);return new Ie(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,t,this.performanceClient,this.nativeExtensionProvider,r||this.getNativeAccountId(e),this.nativeInternalStorage,e.correlationId).acquireToken(e)})}canUseNative(e,t){if(this.logger.trace("canUseNative called"),!Ce.isNativeAvailable(this.confi
7g,this.logger,this.nativeExtensionProvider,e.authenticationScheme))return this.logger.trace("canUseNative: isNativeAvailable returned false, returning false"),!1;if(e.prompt)switch(e.prompt){case F.NONE:case F.CONSENT:case F.LOGIN:this.logger.trace("canUseNative: prompt is compatible with native flow");break;default:return this.logger.trace(`canUseNative: prompt = ${e.prompt} is not compatible with native flow, returning false`),!1}return!t&&!this.getNativeAccountId(e)?(this.logger.trace("canUseNative: nativeAccountId is not available, returning false"),!1):!0}getNativeAccountId(e){let t=e.account||this.getAccount({loginHint:e.loginHint,sid:e.sid})||this.getActiveAccount();return t&&t.nativeAccountId||""}createPopupClient(e){return new yi(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.nativeExtensionProvider,e)}createRedirectClient(e){return new Ei(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeInternalStorage,this.nativeExtensionProvider,e)}createSilentIframeClient(e){return new Ii(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.ssoSilent,this.performanceClient,this.nativeInternalStorage,this.nativeExtensionProvider,e)}createSilentCacheClient(e){return new go(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeExtensionProvider,e)}createSilentRefreshClient(e){return new Si(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,this.performanceClient,this.nativeExtensionProvider,e)}createSilentAuthCodeClient(e){return new _i(this.config,this.browserStorage,this.browserCrypto,this.logger,this.eventHandler,this.navigationClient,M.acquireTokenByCode,this.performanceClient,this.nativeExtensionProvider,e)}addEventCallback(e,t){return this.eventHandler.addEventCallback(e,t)}removeEventCallback(e){this.eventHandler.removeEventCallback(e)}addPerformanceCallback(e){return oi(),this.performanceClient.addPerformanceCallback(e)}removePerformanceCallback(e){return this.performanceClient.removePerformanceCallback(e)}enableAccountStorageEvents(){typeof window>"u"||(this.listeningToStorageEvents?this.logger.verbose("Account storage listener already registered."):(this.logger.verbose("Adding account storage listener."),this.listeningToStorageEvents=!0,window.addEventListener("storage",this.handleAccountCacheChange)))}disableAccountStorageEvents(){typeof window>"u"||(this.listeningToStorageEvents?(this.logger.verbose("Removing account storage listener."),window.removeEventListener("storage",this.handleAccountCacheChange),this.listeningToStorageEvents=!1):this.logger.verbose("No account storage listener registered."))}handleAccountCacheChange(e){try{e.key?.includes($.ACTIVE_ACCOUNT_FILTERS)&&this.eventHandler.emitEvent(E.ACTIVE_ACCOUNT_CHANGED);let t=e.newValue||e.oldValue;if(!t)return;let r=JSON.parse(t);if(typeof r!="object"||!x.isAccountEntity(r))return;let i=Ze.toObject(new x,r).getAccountInfo();!e.oldValue&&e.newValue?(this.logger.info("Account was added to cache in a different window"),this.eventHandler.emitEvent(E.ACCOUNT_ADDED,void 0,i)):!e.newValue&&e.oldValue&&(this.logger.info("Account was removed from cache in a different window"),this.eventHandler.emitEvent(E.ACCOUNT_REMOVED,void 0,i))}catch{return}}getTokenCache(){return this.tokenCache}getLogger(){return this.logger}setLogger(e){this.logger=e}initializeWrapperLibrary(e,t){this.browserStorage.setWrapperMetadata(e,t)}setNavigationClient(e){this.navigationClient=e}getConfiguration(){return this.config}getPerformanceClient(){return this.performanceClient}isBrowserEnv(){return this.isBrowserEnvironment}getRequestCorrelationId(e){return e?.correlationId?e.correlationId:this.isBrowserEnvironment?re():u.EMPTY_STRING}loginRedirect(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e);return this.logger.verbose("loginRedirect called",t),this.acquireTokenRedirect(f({correlationId:t},e||Ha))})}loginPopup(e){let t=this.getRequestCorrelationId(e);return this.logger.verbose("loginPopup called",t),this.acquireTokenPopup(f({correlationId:t},e||Ha))}acquireTokenSilent(e){return h(this,null,function*(){let t=this.getRequestCorrelationId(e),r=this.performanceClient.startMeasurement(c.AcquireTokenSilent,t);r.add({cacheLookupPolicy:e.cacheLookupPolicy,scenarioId:e.scenarioId}),wi(this.initialized,r),this.logger.verbose("acquireTokenSilent called",t);let o=e.account||this.getActiveAccount();if(!o)throw C($r);r.add({accountType:Ke(o)});let i={clientId:this.config.auth.clientId,authority:e.authority||u.EMPTY_STRING,scopes:e.scopes,homeAccountIdentifier:o.homeAccountId,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid,shrOptions:e.shrOptions},a=JSON.stringify(i),s=this.activeSilentTokenRequests.get(a);if(typeof s>"u"){this.logger.verbose("acquireTokenSilent called for the first time, storing active request",t);let l=p(this.acquireTokenSilentAsync.bind(this),c.AcquireTokenSilentAsync,this.logger,this.performanceClient,t)(S(f({},e),{correlationId:t}),o).then(d=>(this.activeSilentTokenRequests.delete(a),r.end({success:!0,fromCache:d.fromCache,isNativeBroker:d.fromNativeBroker,cacheLookupPolicy:e.cacheLookupPolicy,accessTokenSize:d.accessToken.length,idTokenSize:d.idToken.length}),d)).catch(d=>{throw this.activeSilentTokenRequests.delete(a),r.end({success:!1},d),d});return this.activeSilentTokenRequests.set(a,l),S(f({},yield l),{state:e.state})}else return this.logger.verbose("acquireTokenSilent has been called previously, returning the result from the first call",t),r.discard(),S(f({},yield s),{state:e.state})})}acquireTokenSilentAsync(e,t){return h(this,null,function*(){let r=()=>this.trackPageVisibility(e.correlationId);this.performanceClient.addQueueMeasurement(c.AcquireTokenSilentAsync,e.correlationId),this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_START,y.Silent,e),e.correlationId&&this.performanceClient.incrementFields({visibilityChangeCount:0},e.correlationId),document.addEventListener("visibilitychange",r);let o=yield p(nc,c.InitializeSilentRequest,this.logger,this.performanceClient,e.correlationId)(e,t,this.config,this.performanceClient,this.logger),i=e.cacheLookupPolicy||ce.Default;return this.acquireTokenSilentNoIframe(o,i).catch(s=>h(this,null,function*(){if(wl(s,i))if(this.activeIframeRequest)if(i!==ce.Skip){let[d,m]=this.activeIframeRequest;this.logger.verbose(`Iframe request is already in progress, awaiting resolution for request with correlationId: ${m}`,o.correlationId);let T=this.performanceClient.startMeasurement(c.AwaitConcurrentIframe,o.correlationId);T.add({awaitIframeCorrelationId:m});let A=yield d;if(T.end({success:A}),A)return this.logger.verbose(`Parallel iframe request with correlationId: ${m}
7 succeeded. Retrying cache and/or RT redemption`,o.correlationId),this.acquireTokenSilentNoIframe(o,i);throw this.logger.info(`Iframe request with correlationId: ${m} failed. Interaction is required.`),s}else return this.logger.warning("Another iframe request is currently in progress and CacheLookupPolicy is set to Skip. This may result in degraded performance and/or reliability for both calls. Please consider changing the CacheLookupPolicy to take advantage of request queuing and token cache.",o.correlationId),p(this.acquireTokenBySilentIframe.bind(this),c.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o);else{let d;return this.activeIframeRequest=[new Promise(m=>{d=m}),o.correlationId],this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",o.correlationId),p(this.acquireTokenBySilentIframe.bind(this),c.AcquireTokenBySilentIframe,this.logger,this.performanceClient,o.correlationId)(o).then(m=>(d(!0),m)).catch(m=>{throw d(!1),m}).finally(()=>{this.activeIframeRequest=void 0})}else throw s})).then(s=>(this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_SUCCESS,y.Silent,s),e.correlationId&&this.performanceClient.addFields({fromCache:s.fromCache,isNativeBroker:s.fromNativeBroker},e.correlationId),s)).catch(s=>{throw this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_FAILURE,y.Silent,null,s),s}).finally(()=>{document.removeEventListener("visibilitychange",r)})})}acquireTokenSilentNoIframe(e,t){return h(this,null,function*(){return Ce.isNativeAvailable(this.config,this.logger,this.nativeExtensionProvider,e.authenticationScheme)&&e.account.nativeAccountId?(this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform"),this.acquireTokenNative(e,M.acquireTokenSilent_silentFlow).catch(r=>h(this,null,function*(){throw r instanceof Ee&&Nt(r)?(this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow"),this.nativeExtensionProvider=void 0,g(W.tokenRefreshRequired)):r}))):(this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow"),p(this.acquireTokenFromCache.bind(this),c.AcquireTokenFromCache,this.logger,this.performanceClient,e.correlationId)(e,t).catch(r=>{if(t===ce.AccessToken)throw r;return this.eventHandler.emitEvent(E.ACQUIRE_TOKEN_NETWORK_START,y.Silent,e),p(this.acquireTokenByRefreshToken.bind(this),c.AcquireTokenByRefreshToken,this.logger,this.performanceClient,e.correlationId)(e,t)}))})}};function wl(n,e){let t=!(n instanceof ee&&n.subError!==rt.badToken),r=n.errorCode===V.INVALID_GRANT_ERROR||n.errorCode===W.tokenRefreshRequired,o=t&&r||n.errorCode===rt.noTokensFound||n.errorCode===rt.refreshTokenExpired,i=ws.includes(e);return o&&i}function fc(n,e){return h(this,null,function*(){let t=new di(n);return yield t.initialize(),mo.createController(t,e)})}var Qa=class n{static createPublicClientApplication(e){return h(this,null,function*(){let t=yield fc(e);return new n(e,t)})}constructor(e,t){this.controller=t||new mo(new di(e))}initialize(e){return h(this,null,function*(){return this.controller.initialize(e)})}acquireTokenPopup(e){return h(this,null,function*(){return this.controller.acquireTokenPopup(e)})}acquireTokenRedirect(e){return this.controller.acquireTokenRedirect(e)}acquireTokenSilent(e){return this.controller.acquireTokenSilent(e)}acquireTokenByCode(e){return this.controller.acquireTokenByCode(e)}addEventCallback(e,t){return this.controller.addEventCallback(e,t)}removeEventCallback(e){return this.controller.removeEventCallback(e)}addPerformanceCallback(e){return this.controller.addPerformanceCallback(e)}removePerformanceCallback(e){return this.controller.removePerformanceCallback(e)}enableAccountStorageEvents(){this.controller.enableAccountStorageEvents()}disableAccountStorageEvents(){this.controller.disableAccountStorageEvents()}getAccount(e){return this.controller.getAccount(e)}getAccountByHomeId(e){return this.controller.getAccountByHomeId(e)}getAccountByLocalId(e){return this.controller.getAccountByLocalId(e)}getAccountByUsername(e){return this.controller.getAccountByUsername(e)}getAllAccounts(e){return this.controller.getAllAccounts(e)}handleRedirectPromise(e){return this.controller.handleRedirectPromise(e)}loginPopup(e){return this.controller.loginPopup(e)}loginRedirect(e){return this.controller.loginRedirect(e)}logout(e){return this.controller.logout(e)}logoutRedirect(e){return this.controller.logoutRedirect(e)}logoutPopup(e){return this.controller.logoutPopup(e)}ssoSilent(e){return this.controller.ssoSilent(e)}getTokenCache(){return this.controller.getTokenCache()}getLogger(){return this.controller.getLogger()}setLogger(e){this.controller.setLogger(e)}setActiveAccount(e){this.controller.setActiveAccount(e)}getActiveAccount(){return this.controller.getActiveAccount()}initializeWrapperLibrary(e,t){return this.controller.initializeWrapperLibrary(e,t)}setNavigationClient(e){this.controller.setNavigationClient(e)}getConfiguration(){return this.controller.getConfiguration()}hydrateCache(e,t){return h(this,null,function*(){return this.controller.hydrateCache(e,t)})}clearCache(e){return this.controller.clearCache(e)}};var mn=class{static getInteractionStatusFromEvent(e,t){switch(e.eventType){case E.LOGIN_START:return X.Login;case E.SSO_SILENT_START:return X.SsoSilent;case E.ACQUIRE_TOKEN_START:if(e.interactionType===y.Redirect||e.
7interactionType===y.Popup)return X.AcquireToken;break;case E.HANDLE_REDIRECT_START:return X.HandleRedirect;case E.LOGOUT_START:return X.Logout;case E.SSO_SILENT_SUCCESS:case E.SSO_SILENT_FAILURE:if(t&&t!==X.SsoSilent)break;return X.None;case E.LOGOUT_END:if(t&&t!==X.Logout)break;return X.None;case E.HANDLE_REDIRECT_END:if(t&&t!==X.HandleRedirect)break;return X.None;case E.LOGIN_SUCCESS:case E.LOGIN_FAILURE:case E.ACQUIRE_TOKEN_SUCCESS:case E.ACQUIRE_TOKEN_FAILURE:case E.RESTORE_FROM_BFCACHE:if(e.interactionType===y.Redirect||e.interactionType===y.Popup){if(t&&t!==X.Login&&t!==X.AcquireToken)break;return X.None}break}return null}};var Cc="@azure/msal-angular",Ya="3.1.0",Wa=new fo("MSAL_INSTANCE"),Tc=new fo("MSAL_GUARD_CONFIG"),kl=new fo("MSAL_INTERCEPTOR_CONFIG"),bl=new fo("MSAL_BROADCAST_CONFIG"),ja=(()=>{class n{constructor(t,r){this.instance=t,this.location=r;let o=this.location.path(!0).split("#").pop();o&&(this.redirectHash=`#${o}`),this.instance.initializeWrapperLibrary(Fa.Angular,Ya)}initialize(){return Te(this.instance.initialize())}acquireTokenPopup(t){return Te(this.instance.acquireTokenPopup(t))}acquireTokenRedirect(t){return Te(this.instance.acquireTokenRedirect(t))}acquireTokenSilent(t){return Te(this.instance.acquireTokenSilent(t))}handleRedirectObservable(t){return Te(this.instance.initialize().then(()=>this.instance.handleRedirectPromise(t||this.redirectHash)))}loginPopup(t){return Te(this.instance.loginPopup(t))}loginRedirect(t){return Te(this.instance.loginRedirect(t))}logout(t){return Te(this.instance.logout(t))}logoutRedirect(t){return Te(this.instance.logoutRedirect(t))}logoutPopup(t){return Te(this.instance.logoutPopup(t))}ssoSilent(t){return Te(this.instance.ssoSilent(t))}getLogger(){return this.logger||(this.logger=this.instance.getLogger().clone(Cc,Ya)),this.logger}setLogger(t){this.logger=t.clone(Cc,Ya),this.instance.setLogger(t)}}return n.\u0275fac=function(t){return new(t||n)(Re(Wa),Re(Oi))},n.\u0275prov=fn({token:n,factory:n.\u0275fac}),n})(),Ac=(()=>{class n{constructor(t,r,o){this.msalInstance=t,this.authService=r,this.msalBroadcastConfig=o,this.msalBroadcastConfig&&this.msalBroadcastConfig.eventsToReplay>0?(this.authService.getLogger().verbose(`BroadcastService - eventsToReplay set on BroadcastConfig, replaying the last ${this.msalBroadcastConfig.eventsToReplay} events`),this._msalSubject=new Za(this.msalBroadcastConfig.eventsToReplay)):this._msalSubject=new Ja,this.msalSubject$=this._msalSubject.asObservable(),this._inProgress=new Xa(X.Startup),this.inProgress$=this._inProgress.asObservable(),this.msalInstance.addEventCallback(i=>{this._msalSubject.next(i);let a=mn.getInteractionStatusFromEvent(i,this._inProgress.value);a!==null&&(this.authService.getLogger().verbose(`BroadcastService - ${i.eventType} results in setting inProgress from ${this._inProgress.value} to ${a}`),this._inProgress.next(a))})}}return n.\u0275fac=function(t){return new(t||n)(Re(Wa),Re(ja),Re(bl,8))},n.\u0275prov=fn({token:n,factory:n.\u0275fac}),n})(),Nl=(()=>{class n{constructor(t,r,o,i,a){this.msalGuardConfig=t,this.msalBroadcastService=r,this.authService=o,this.location=i,this.router=a,this.msalBroadcastService.inProgress$.subscribe()}parseUrl(t){return this.router.parseUrl(t)}getDestinationUrl(t){this.authService.getLogger().verbose("Guard - getting destination url");let r=document.getElementsByTagName("base"),o=this.location.normalize(r.length?r[0].href:window.location.origin),i=this.location.prepareExternalUrl(t);return i.startsWith("#")?(this.authService.getLogger().verbose("Guard - destination by hash routing"),`${o}/${i}`):`${o}${t}`}loginInteractively(t){let r=typeof this.msalGuardConfig.authRequest=="function"?this.msalGuardConfig.authRequest(this.authService,t):f({},this.msalGuardConfig.authRequest);if(this.msalGuardConfig.interactionType===y.Popup)return this.authService.getLogger().verbose("Guard - logging in by popup"),this.authService.loginPopup(r).pipe(bi(i=>(this.authService.getLogger().verbose("Guard - login by popup successful, can activate, setting active account"),this.authService.instance.setActiveAccount(i.account),!0)));this.authService.getLogger().verbose("Guard - logging in by redirect");let o=this.getDestinationUrl(t.url);return this.authService.loginRedirect(f({redirectStartPage:o},r)).pipe(bi(()=>!1))}activateHelper(t){if(this.msalGuardConfig.interactionType!==y.Popup&&this.msalGuardConfig.interactionType!==y.Redirect)throw new co("invalid_interaction_type","Invalid interaction type provided to MSAL Guard. InteractionType.Popup or InteractionType.Redirect must be provided in the MsalGuardConfiguration");if(this.authService.getLogger().verbose("MSAL Guard activated"),typeof window<"u"){if(k.hashContainsKnownProperties(window.location.hash)&&ai.isInIframe()&&!this.authService.instance.getConfiguration().system.allowRedirectInIframe)return this.authService.getLogger().warning("Guard - redirectUri set to page with MSAL Guard. It is recommended to not set redirectUri to a page that requires authentication."),qe(!1)}else return this.authService.getLogger().info("Guard - window is undefined, MSAL does not support server-side token acquisition"),qe(!0);this.msalGuardConfig.loginFailedRoute&&(this.loginFailedRoute=this.parseUrl(this.msalGuardConfig.loginFailedRoute));let r=this.location.path(!0);return this.authService.initialize().pipe(Ni(()=>this.authService.handleRedirectObservable()),Ni(()=>
7{if(!this.authService.instance.getAllAccounts().length)return t?(this.authService.getLogger().verbose("Guard - no accounts retrieved, log in required to activate"),this.loginInteractively(t)):(this.authService.getLogger().verbose("Guard - no accounts retrieved, no state, cannot load"),qe(!1));if(this.authService.getLogger().verbose("Guard - at least 1 account exists, can activate or load"),t){let o=this.includesCode(t.url),i=!!t.root&&!!t.root.fragment&&this.includesCode(`#${t.root.fragment}`),a=this.location.prepareExternalUrl(t.url).indexOf("#")===0;if(o&&(i||a))return this.authService.getLogger().info("Guard - Hash contains known code response, stopping navigation."),r.indexOf("#")>-1?qe(this.parseUrl(this.location.path())):qe(this.parseUrl(""))}return qe(!0)}),es(o=>(this.authService.getLogger().error("Guard - error while logging in, unable to activate"),this.authService.getLogger().errorPii(`Guard - error: ${o.message}`),this.loginFailedRoute&&t?(this.authService.getLogger().verbose("Guard - loginFailedRoute set, redirecting"),qe(this.loginFailedRoute)):qe(!1))))}includesCode(t){return t.lastIndexOf("/code")>-1&&t.lastIndexOf("/code")===t.length-5||t.indexOf("#code=")>-1||t.indexOf("&code=")>-1}canActivate(t,r){return this.authService.getLogger().verbose("Guard - canActivate"),this.activateHelper(r)}canActivateChild(t,r){return this.authService.getLogger().verbose("Guard - canActivateChild"),this.activateHelper(r)}canMatch(){return this.authService.getLogger().verbose("Guard - canLoad"),this.activateHelper()}}return n.\u0275fac=function(t){return new(t||n)(Re(Tc),Re(Ac),Re(ja),Re(Oi),Re(ns))},n.\u0275prov=fn({token:n,factory:n.\u0275fac}),n})();var mE=(()=>{class n{static forRoot(t,r,o){return{ngModule:n,providers:[{provide:Wa,useValue:t},{provide:Tc,useValue:r},{provide:kl,useValue:o},ja]}}}return n.\u0275fac=function(t){return new(t||n)},n.\u0275mod=rs({type:n}),n.\u0275inj=ts({providers:[Nl,Ac],imports:[os]}),n})();export{y as a,Qa as b,ja as c,mE as d};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.