Add Foundry Agent Canvas extension#2310
Closed
qinezh wants to merge 2 commits into
Closed
Conversation
Package the Foundry agent builder canvas and register it in the Awesome Copilot marketplace.
github-actions
Bot
added
canvas-extension
Contributor
|
Do we want to ship this in the Awesome Copilot repo, it have this treated as an external canvas (which becomes an external plugin)? Having it as an external would mean that you're able to be the codeowner of it and iterating would just be sending a PR to update the version in this repo. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a marketplace-ready Foundry Agent Canvas for building, configuring, deploying, and locally inspecting Microsoft Foundry hosted agents.
Changes:
- Adds the canvas runtime, UI, authentication, Foundry resource integration, and inspector.
- Bundles supporting icons, fonts, and generated inspector assets.
- Registers the extension in the Awesome Copilot marketplace.
Reviewed changes
Copilot reviewed 8 out of 134 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
.github/plugin/marketplace.json |
Registers the extension. |
extensions/foundry-agent-canvas/.github/plugin/plugin.json |
Defines extension metadata. |
extensions/foundry-agent-canvas/README.md |
Documents installation and usage. |
extensions/foundry-agent-canvas/assets/preview.png |
Supplies marketplace preview. |
extensions/foundry-agent-canvas/extension.mjs |
Implements the canvas backend. |
extensions/foundry-agent-canvas/package.json |
Defines package metadata. |
extensions/foundry-agent-canvas/public/app.css |
Styles the canvas UI. |
extensions/foundry-agent-canvas/public/app.js |
Implements client behavior. |
extensions/foundry-agent-canvas/public/index.html |
Defines canvas markup. |
extensions/foundry-agent-canvas/public/fluent-icons/* |
Provides Fluent UI icons. |
extensions/foundry-agent-canvas/public/tool-icons/* |
Provides tool branding icons. |
extensions/foundry-agent-canvas/inspector-ui/index.html |
Loads the inspector bundle. |
extensions/foundry-agent-canvas/inspector-ui/assets/* |
Bundles inspector code, styles, fonts, images, and model/provider icons. |
| Error: '${i.name}' | ||
| Error Description: '${i.message}'`,this.correlationId)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.",this.correlationId),this.logger.verbose("Creating custom Authority for custom domain scenario.",this.correlationId),n=t.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),n}isInKnownAuthorities(e){let r=e.toLowerCase();return this.authorityOptions.knownAuthorities.filter(o=>o&&j.getDomainFromUrl(o,this.correlationId).toLowerCase()===r).length>0}static generateAuthority(e,r){let n;if(r&&r.azureCloudInstance!==Tr.None){let o=r.tenant?r.tenant:es;n=`${r.azureCloudInstance}/${o}/`}return n||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return xf;if(this.discoveryComplete())return this.metadata.preferred_cache;throw E($t,this.correlationId)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return Lp.has(e)}validateIssuer(e){if(!e)throw Y(us,this.correlationId);let r;try{r=new URL(e)}catch{throw Y(us,this.correlationId)}let n=r.protocol,o=r.host,i=(this.canonicalAuthorityUrlComponents.Protocol||"").toLowerCase(),s=(this.canonicalAuthorityUrlComponents.HostNameAndPort||"").toLowerCase(),a=this.matchesAuthorityOrigin(n,o,i,s),l=n==="https:"&&this.isAliasOfKnownMicrosoftAuthority(o),c=n==="https:"&&this.matchesRegionalMicrosoftHost(o),u=this.matchesCiamTenantPattern(r,s,this.canonicalAuthorityUrlComponents.PathSegments),d=n==="https:"&&this.isInKnownAuthorities(o);if(!(a||l||c||u||d))throw Y(us,this.correlationId)}matchesAuthorityOrigin(e,r,n,o){return e===n&&r===o}matchesRegionalMicrosoftHost(e){let r=e.indexOf(".");if(r>0&&r<e.length-1){let n=e.substring(r+1);return this.isAliasOfKnownMicrosoftAuthority(n)}return!1}matchesCiamTenantPattern(e,r,n){let o=n[0],i=o?o.endsWith(En)?o.slice(0,-En.length):o:r.split(".")[0];if(!i)return!1;let s=`https://${i}${ts}`,a=[s,`${s}/${i}`,`${s}/${i}/v2.0`,`${s}/${i}${En}`,`${s}/${i}${En}/v2.0`],l=e.pathname.replace(/\/+$/,""),c=`${e.protocol}//${e.host}${l}`;return a.some(u=>u===c)}static isPublicCloudAuthority(e){return Ff.indexOf(e)>=0}static buildRegionalAuthorityString(e,r,n,o){let i=new j(e,n);i.validateAsUri();let s=i.getUrlComponents(),a=`${r}.${s.HostNameAndPort}`;this.isPublicCloudAuthority(s.HostNameAndPort)&&(a=`${r}.${$f}`);let l=j.constructAuthorityUriFromObject({...i.getUrlComponents(),HostNameAndPort:a},n).urlString;return o?`${l}?${o}`:l}static replaceWithRegionalInformation(e,r,n){let o={...e};return o.authorization_endpoint=t.buildRegionalAuthorityString(o.authorization_endpoint,r,n),o.token_endpoint=t.buildRegionalAuthorityString(o.token_endpoint,r,n),o.end_session_endpoint&&(o.end_session_endpoint=t.buildRegionalAuthorityString(o.end_session_endpoint,r,n)),o}static transformCIAMAuthority(e,r){let n=e,i=new j(e,r).getUrlComponents();if(i.PathSegments.length===0&&i.HostNameAndPort.endsWith(ts)){let s=i.HostNameAndPort.split(".")[0];n=`${n}${s}${En}`}return n}};Ht.reservedTenantDomains=new Set(["{tenant}","{tenantid}",Dt.COMMON,Dt.CONSUMERS,Dt.ORGANIZATIONS])});var dl={};we(dl,{createDiscoveredInstance:()=>sm});async function sm(t,e,r,n,o,i,s){let a=Ht.transformCIAMAuthority(ll(t),i),l=new Ht(a,e,r,n,o,i,s);try{return await G(l.resolveEndpointsAsync.bind(l),WC,o,s,i)(),l}catch{throw E($t,i)}}var am=h(()=>{"use strict";ul();pe();Ir();Sr();ge();});var Vs,yA=h(()=>{"use strict";Oo();Po();ue();bo();Ps();Us();pe();qr();el();Kr();Uo();$s();hr();Ir();Sr();sl();al();cl();am();Mo();Do();ge();mr();Vs=class{constructor(e,r){this.includeRedirectUri=!0,this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}async acquireToken(e,r,n){if(!e.code)throw E(dp,e.correlationId);n&&n.cloud_instance_host_name&&await G(this.updateTokenEndpointAuthority.bind(this),KC,this.logger,this.performanceClient,e.correlationId)(n.cloud_instance_host_name,e.correlationId);let o=ut(),i=await G(this.executeTokenRequest.bind(this),qC,this.logger,this.performanceClient,e.correlationId)(this.authority,e,this.serverTelemetryManager),s=i.headers?.[he.X_MS_REQUEST_ID],a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i.body,e.correlationId),G(a.handleServerTokenResponse.bind(a),Zc,this.logger,this.performanceClient,e.correlationId)(i.body,this.authority,o,e,r,n,void 0,void 0,void 0,s)}getLogoutUri(e){if(!e)throw Y(Zh,"");let r=this.createLogoutUrlQueryString(e);return j.appendQueryString(this.authority.endSessionEndpoint,r)}async executeTokenRequest(e,r,n){let o=Bs(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),i=j.appendQueryString(e.tokenEndpoint,o),s=await G(this.createTokenRequestBody.bind(this),GC,this.logger,this.performanceClient,r.correlationId)(r),a;if(r.clientInfo)try{let u=Lo(r.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${u.uid}${Ao}${u.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(u){this.logger.verbose(`Could not parse client info for CCS Header: '${u}'`,r.correlationId)}let l=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,a||r.ccsCredential),c=zo(this.config.authOptions.clientId,r);return G(js,HC,this.logger,this.performanceClient,r.correlationId)(i,s,l,c,r.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,n)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),this.includeRedirectUri)Rn(r,e.redirectUri);else if(!e.redirectUri)throw Y(Kh,e.correlationId);if(wn(r,e.scopes,e.correlationId,!0,this.oidcDefaultScopes),bs(r,e.resource),kp(r,e.code),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),e.codeVerifier&&xp(r,e.codeVerifier),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;Es(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,o.assertionType)}if(Cs(r,os.AUTHORIZATION_CODE_GRANT),xn(r),e.authenticationScheme===se.POP){let o=new Wr(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(await G(o.generateCnf.bind(o),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,i)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);let n;if(e.clientInfo)try{let o=Lo(e.clientInfo,this.cryptoUtils.base64Decode);n={credential:`${o.uid}${Ao}${o.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(o){this.logger.verbose(`Could not parse client info for CCS Header: '${o}'`,e.correlationId)}else n=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&n)switch(n.type){case Ge.HOME_ACCOUNT_ID:try{let o=Xt(n.credential);gr(r,o)}catch(o){this.logger.verbose(`Could not parse home account ID for CCS Header: '${o}'`,e.correlationId)}break;case Ge.UPN:Vr(r,n.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,e.extraParameters),e.enableSpaAuthorizationCode&&(!e.extraParameters||!e.extraParameters[Pc])&&yr(r,{[Pc]:"1"}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}createLogoutUrlQueryString(e){let r=new Map;return e.postLogoutRedirectUri&&Sp(r,e.postLogoutRedirectUri),e.correlationId&&vn(r,e.correlationId),e.idTokenHint&&_p(r,e.idTokenHint),e.state&&gs(r,e.state),e.logoutHint&&Pp(r,e.logoutHint),e.extraQueryParameters&&yr(r,e.extraQueryParameters),this.config.authOptions.instanceAware&&As(r),Wt(r)}async updateTokenEndpointAuthority(e,r){let n=`https://${e}/${this.authority.tenant}/`,o=await sm(n,this.networkClient,this.cacheManager,this.authority.options,this.logger,r,this.performanceClient);this.authority=o}}});var g0,Ln,EA=h(()=>{"use strict";Ps();Oo();Po();ue();bo();Us();el();hr();pe();jo();Kr();qr();$s();Uo();Ls();Ir();Sr();sl();al();cl();Mo();Do();nl();mr();ge();g0=300,Ln=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireToken(e,r){let n=ut(),o=await G(this.executeTokenRequest.bind(this),BC,this.logger,this.performanceClient,e.correlationId)(e,this.authority),i=o.headers?.[he.X_MS_REQUEST_ID],s=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o.body,e.correlationId),G(s.handleServerTokenResponse.bind(s),Zc,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,n,e,r,void 0,void 0,!0,e.forceCache,i)}async acquireTokenByRefreshToken(e,r){if(!e)throw Y(Qh,"");if(!e.account)throw E(ds,e.correlationId);if(this.cacheManager.isAppMetadataFOCI(e.account.environment,e.correlationId))try{return await G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!0,r)}catch(o){let i=o instanceof dt&&o.errorCode===tl,s=o instanceof qe&&o.errorCode===oh&&o.subError===ih;if(i||s)return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r);throw o}return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r)}async acquireTokenWithCachedRefreshToken(e,r,n){let o=rA(this.cacheManager.getRefreshToken.bind(this.cacheManager),tA,this.logger,this.performanceClient,e.correlationId)(e.account,r,e.correlationId,void 0);if(!o)throw il(tl,e.correlationId);if(o.expiresOn){let s=e.refreshTokenExpirationOffsetSeconds||g0;if(this.performanceClient?.addFields({cacheRtExpiresOnSeconds:Number(o.expiresOn),rtOffsetSeconds:s},e.correlationId),Fo(o.expiresOn,s))throw il(Jp,e.correlationId)}let i={...e,refreshToken:o.secret,authenticationScheme:e.authenticationScheme||se.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:Ge.HOME_ACCOUNT_ID}};try{return await G(this.acquireToken.bind(this),jC,this.logger,this.performanceClient,e.correlationId)(i,n)}catch(s){if(s instanceof dt&&s.subError===Ds){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache",e.correlationId);let a=this.cacheManager.generateCredentialKey(o);this.cacheManager.removeRefreshToken(a,e.correlationId)}throw s}}async executeTokenRequest(e,r){let n=Bs(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),o=j.appendQueryString(r.tokenEndpoint,n),i=await G(this.createTokenRequestBody.bind(this),zC,this.logger,this.performanceClient,e.correlationId)(e),s=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,e.ccsCredential),a=zo(this.config.authOptions.clientId,e);return G(js,FC,this.logger,this.performanceClient,e.correlationId)(o,i,s,a,e.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),e.redirectUri&&Rn(r,e.redirectUri),wn(r,e.scopes,e.correlationId,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),Cs(r,os.REFRESH_TOKEN_GRANT),xn(r),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),vp(r,e.refreshToken),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let n=this.config.clientCredentials.clientAssertion;Es(r,await Ne(n.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,n.assertionType)}if(e.authenticationScheme===se.POP){let n=new Wr(this.cryptoUtils,this.performanceClient),o;e.popKid?o=this.cryptoUtils.encodeKid(e.popKid):o=(await G(n.generateCnf.bind(n),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,o)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);if(this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case Ge.HOME_ACCOUNT_ID:try{let n=Xt(e.ccsCredential.credential);gr(r,n)}catch(n){this.logger.verbose(`Could not parse home account ID for CCS Header: '${n}'`,e.correlationId)}break;case Ge.UPN:Vr(r,e.ccsCredential.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,{...e.extraParameters}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}}});var qs,TA=h(()=>{"use strict";Ps();Kr();pe();Us();ue();cs();Pn();Ir();Sr();ul();Mo();Do();ge();qs=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireCachedToken(e){let r=Ut.NOT_APPLICABLE;if(e.forceRefresh||!Pe.isEmptyObj(e.claims))throw this.setCacheOutcome(Ut.FORCE_REFRESH_OR_CLAIMS,e.correlationId),E(vo,e.correlationId);if(!e.account)throw E(ds,e.correlationId);let n=e.account.tenantId||gA(e.authority,e.correlationId),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,n);if(i){if(qp(i.cachedAt)||Fo(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(Ut.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),E(vo,e.correlationId);if(e.resource){if(i.resource!==e.resource)throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId)}else i.refreshOn&&Fo(i.refreshOn,0)&&(r=Ut.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId);let s=e.authority||this.authority.getPreferredCache(),a={account:this.cacheManager.getAccount(this.cacheManager.generateAccountKey(e.account),e.correlationId),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,e.correlationId,o,n),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCache(s,e.correlationId)};return this.setCacheOutcome(r,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[await G(this.generateResultFromCacheRecord.bind(this),VC,this.logger,this.performanceClient,e.correlationId)(a,e),r]}setCacheOutcome(e,r){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},r),e!==Ut.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: '${e}'`,r)}async generateResultFromCacheRecord(e,r){let n;return e.idToken&&(n=Cr(e.idToken.secret,this.config.cryptoInterface.base64Decode,r.correlationId)),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,r,this.performanceClient,n)}}});var Gs={};we(Gs,{getAuthorizationCodePayload:()=>T0,getAuthorizeUrl:()=>E0,getStandardAuthorizeRequestParameters:()=>y0,validateAuthorizationResponse:()=>CA});function y0(t,e,r,n){let o=e.correlationId,i=new Map;bn(i,e.embeddedClientId||e.extraQueryParameters?.[Kt]||t.clientId);let s=[...e.scopes||[],...e.extraScopesToConsent||[]];if(wn(i,s,e.correlationId,!0,t.authority.options.OIDCOptions?.defaultScopes),bs(i,e.resource),Rn(i,e.redirectUri),vn(i,o),Ip(i,e.responseMode),xn(i),Op(i),e.prompt&&(bp(i,e.prompt),n?.addFields({prompt:e.prompt},o)),e.domainHint&&(wp(i,e.domainHint),n?.addFields({domainHintFromRequest:!0},o)),e.prompt!==ns.SELECT_ACCOUNT)if(e.sid&&e.prompt===ns.NONE)r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request",e.correlationId),Hc(i,e.sid),n?.addFields({sidFromRequest:!0},o);else if(e.account){let a=A0(e.account),l=I0(e.account);if(l&&e.domainHint&&(r.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint',e.correlationId),l=null),l){r.verbose("createAuthCodeUrlQueryString: login_hint claim present on account",e.correlationId),xo(i,l),n?.addFields({loginHintFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(a&&e.prompt===ns.NONE){r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account",e.correlationId),Hc(i,a),n?.addFields({sidFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(e.loginHint)r.verbose("createAuthCodeUrlQueryString: Adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o);else if(e.account.username){r.verbose("createAuthCodeUrlQueryString: Adding login_hint from account",e.correlationId),xo(i,e.account.username),n?.addFields({loginHintFromUpn:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}}else e.loginHint&&(r.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o));else r.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints",e.correlationId);return e.nonce&&Rp(i,e.nonce),e.state&&gs(i,e.state),e.embeddedClientId&&Er(i,t.clientId,t.redirectUri),kn(i,e.correlationId,e.claims,t.clientCapabilities,e.skipBrokerClaims),t.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(wo))&&As(i),i}function E0(t,e){let r=Wt(e);return j.appendQueryString(t.authorizationEndpoint,r)}function T0(t,e,r){if(CA(t,e,r),!t.code)throw E(yp,r);return t}function CA(t,e,r){if(!t.state||!e)throw t.state?E($c,r,"Cached State"):E($c,r,"Server State");let n,o;try{n=decodeURIComponent(t.state)}catch{throw E(Sn,r,t.state)}try{o=decodeURIComponent(e)}catch{throw E(Sn,r,t.state)}if(n!==o)throw E(cp,r);if(t.error||t.error_description||t.suberror){let i=C0(t);throw ol(t.error,t.error_description,t.suberror)?new dt(t.error||"",t.correlation_id||r,t.error_description,t.suberror,t.timestamp||"",t.trace_id||"",t.claims||"",i):new qe(t.error||"",t.correlation_id||r,t.error_description,t.suberror,i)}}function C0(t){let e="code=",r=t.error_uri?.lastIndexOf(e);return r&&r>=0?t.error_uri?.substring(r+e.length):void 0}function A0(t){return t.idTokenClaims?.sid||null}function I0(t){return t.loginHint||t.idTokenClaims?.login_hint||null}var AA=h(()=>{"use strict";Oo();bo();ue();Uo();Po();qr();pe();Ls();jo();ge();});function Un(t,e){if(t){if(e.resource&&(IA(e.extraParameters)||IA(e.extraQueryParameters)))throw E(Ap,e.correlationId||"");if(!e.resource)throw E(Cp,e.correlationId||"")}}function IA(t){return t?Object.prototype.hasOwnProperty.call(t,"resource"):!1}var SA=h(()=>{"use strict";pe();ge();});var qo={};we(qo,{postRequestFailed:()=>_0,unexpectedError:()=>S0});var S0,_0,_A=h(()=>{"use strict";S0="unexpected_error",_0="post_request_failed"});function w0(t){let{skus:e,libraryName:r,libraryVersion:n,extensionName:o,extensionVersion:i}=t,s=new Map([[0,[r,n]],[2,[o,i]]]),a=[];if(e?.length){if(a=e.split(wA),a.length<4)return e}else a=Array.from({length:4},()=>bA);return s.forEach((l,c)=>{l.length===2&&l[0]?.length&&l[1]?.length&&b0({skuArr:a,index:c,skuName:l[0],skuVersion:l[1]})}),a.join(wA)}function b0(t){let{skuArr:e,index:r,skuName:n,skuVersion:o}=t;r>=e.length||(e[r]=[n,o].join(bA))}var wA,bA,$n,RA=h(()=>{"use strict";ue();At();wA=",",bA="|";$n=class t{constructor(e,r){this.cacheOutcome=Ut.NOT_APPLICABLE,this.cacheManager=r,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||"",this.wrapperVer=e.wrapperVer||"",this.telemetryCacheKey=is+Cn+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${Br}${this.cacheOutcome}`,r=[this.wrapperSKU,this.wrapperVer],n=this.getNativeBrokerErrorCode();n?.length&&r.push(`broker_error=${n}`);let o=r.join(Br),i=this.getRegionDiscoveryFields(),s=[e,i].join(Br);return[bc,s,o].join(Rc)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.failedRequests.slice(0,2*r).join(Br),o=e.errors.slice(0,r).join(Br),i=e.errors.length,s=r<i?Qf:Zf,a=[i,s].join(Br);return[bc,e.cacheHits,n,o,a].join(Rc)}cacheFailedRequest(e){try{let r=this.getLastRequests();r.errors.length>=Jf&&(r.failedRequests.shift(),r.failedRequests.shift(),r.errors.shift()),r.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof H?e.subError?r.errors.push(e.subError):e.errorCode?r.errors.push(e.errorCode):r.errors.push(e.toString()):r.errors.push(e.toString()):r.errors.push(eh),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}catch{}}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey,this.correlationId)||e}clearTelemetryCache(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.errors.length;if(r===n)this.cacheManager.removeItem(this.telemetryCacheKey,this.correlationId);else{let o={failedRequests:e.failedRequests.slice(r*2),errors:e.errors.slice(r),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o,this.correlationId)}}static maxErrorsToSend(e){let r,n=0,o=0,i=e.errors.length;for(r=0;r<i;r++){let s=e.failedRequests[2*r]||"",a=e.failedRequests[2*r+1]||"",l=e.errors[r]||"";if(o+=s.toString().length+a.toString().length+l.length+3,o<Xf)n+=1;else break}return n}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||""),e.push(this.regionSource||""),e.push(this.regionOutcome||""),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let r=this.getLastRequests();r.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId)}static makeExtraSkuString(e){return w0(e)}}});var W=h(()=>{"use strict";yA();EA();TA();Ps();$s();ul();Bc();xs();jp();qr();Np();AA();cl();SA();Oo();Us();hs();Mo();Ls();nl();At();_A();jo();om();pe();ge();hr();mr();ue();cs();RA();Pn();am();Jc();Kr();Po();bo();Gc();Vp();sl();zp();});var _r,fl=h(()=>{"use strict";W();_r=class{static deserializeJSONBlob(e){return e?JSON.parse(e):{}}static deserializeAccounts(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,realm:o.realm,localAccountId:o.local_account_id,username:o.username,authorityType:o.authority_type,name:o.name,clientInfo:o.client_info,lastModificationTime:o.last_modification_time,lastModificationApp:o.last_modification_app,tenantProfiles:o.tenantProfiles?.map(a=>JSON.parse(a)),lastUpdatedAt:Date.now().toString()},s={};Gr.toObject(s,i),r[n]=s}),r}static deserializeIdTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAccessTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,target:o.target,cachedAt:o.cached_at,expiresOn:o.expires_on,extendedExpiresOn:o.extended_expires_on,refreshOn:o.refresh_on,keyId:o.key_id,tokenType:o.token_type,userAssertionHash:o.userAssertionHash,resource:o.resource,additionalCacheKeyComponents:o.additionalCacheKeyComponents,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeRefreshTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,familyId:o.family_id,target:o.target,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAppMetadata(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n];r[n]={clientId:o.client_id,environment:o.environment,familyId:o.family_id}}),r}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}}});var cm={};we(cm,{Deserializer:()=>_r,Serializer:()=>Hr});var kA=h(()=>{"use strict";Ec();fl();});var vA,R0,lm,Le,Ce,U,$,le,fe,xA,OA,PA,NA,hl,um,Ke,te,St,pl,MA,J=h(()=>{"use strict";W();vA="system_assigned_managed_identity",R0="managed_identity",lm=`https://login.microsoftonline.com/${R0}/`,Le={AUTHORIZATION_HEADER_NAME:"Authorization",METADATA_HEADER_NAME:"Metadata",APP_SERVICE_SECRET_HEADER_NAME:"X-IDENTITY-HEADER",ML_AND_SF_SECRET_HEADER_NAME:"secret",CLIENT_SKU:Be.X_CLIENT_SKU,CLIENT_VER:Be.X_CLIENT_VER,CLIENT_REQUEST_ID:"x-ms-client-request-id"},Ce={API_VERSION:"api-version",RESOURCE:"resource",SHA256_TOKEN_TO_REFRESH:"token_sha256_to_refresh",XMS_CC:"xms_cc"},U={AZURE_POD_IDENTITY_AUTHORITY_HOST:"AZURE_POD_IDENTITY_AUTHORITY_HOST",DEFAULT_IDENTITY_CLIENT_ID:"DEFAULT_IDENTITY_CLIENT_ID",IDENTITY_ENDPOINT:"IDENTITY_ENDPOINT",IDENTITY_HEADER:"IDENTITY_HEADER",IDENTITY_SERVER_THUMBPRINT:"IDENTITY_SERVER_THUMBPRINT",IMDS_ENDPOINT:"IMDS_ENDPOINT",MSI_ENDPOINT:"MSI_ENDPOINT",MSI_SECRET:"MSI_SECRET"},$={APP_SERVICE:"AppService",AZURE_ARC:"AzureArc",CLOUD_SHELL:"CloudShell",DEFAULT_TO_IMDS:"DefaultToImds",IMDS:"Imds",MACHINE_LEARNING:"MachineLearning",SERVICE_FABRIC:"ServiceFabric"},le={SYSTEM_ASSIGNED:"system-assigned",USER_ASSIGNED_CLIENT_ID:"user-assigned-client-id",USER_ASSIGNED_RESOURCE_ID:"user-assigned-resource-id",USER_ASSIGNED_OBJECT_ID:"user-assigned-object-id"},fe={GET:"GET",POST:"POST"},xA="REGION_NAME",OA="MSAL_FORCE_REGION",PA=32,NA={SHA256:"sha256"},hl={CV_CHARSET:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"},um={KEY_SEPARATOR:"-"},Ke={MSAL_SKU:"msal.js.node",JWT_BEARER_ASSERTION_TYPE:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",HTTP_PROTOCOL:"http://",LOCALHOST:"localhost"},te={acquireTokenSilent:62,acquireTokenByUsernamePassword:371,acquireTokenByDeviceCode:671,acquireTokenByClientCredential:771,acquireTokenByOBO:772,acquireTokenWithManagedIdentity:773,acquireTokenByUserFederatedIdentityCredential:774,acquireTokenByCode:871,acquireTokenByRefreshToken:872},St={RSA_256:"RS256",PSS_256:"PS256",X5T_256:"x5t#S256",X5T:"x5t",X5C:"x5c",AUDIENCE:"aud",EXPIRATION_TIME:"exp",ISSUER:"iss",SUBJECT:"sub",NOT_BEFORE:"nbf",JWT_ID:"jti"},pl={INTERVAL_MS:100,TIMEOUT_MS:5e3},MA=4096});function k0(t){let e={};return t.forEach((r,n)=>{e[n]=r}),e}function v0(t){let e=new Headers;return t&&t.headers&&Object.entries(t.headers).forEach(([r,n])=>{e.append(r,n)}),e}var Go,DA=h(()=>{"use strict";W();J();Go=class{async sendGetRequestAsync(e,r,n){return this.sendRequest(e,fe.GET,r,n)}async sendPostRequestAsync(e,r){return this.sendRequest(e,fe.POST,r)}async sendRequest(e,r,n,o){let i=new AbortController,s;o&&(s=setTimeout(()=>{i.abort()},o));let a={method:r,headers:v0(n),signal:i.signal};r===fe.POST&&(a.body=n?.body||"");let l;try{l=await fetch(e,a)}catch(c){if(s&&clearTimeout(s),c instanceof Error&&c.name==="AbortError")throw In(me.networkError,"","Request timeout");let u=In(me.networkError,"",`Network request failed: ${c instanceof Error?c.message:"unknown"}`);throw nm(u,void 0,void 0,c instanceof Error?c:void 0)}s&&clearTimeout(s);try{return{headers:k0(l.headers),body:await l.json(),status:l.status}}catch(c){throw In(me.tokenParsingError,"",`Failed to parse response: ${c instanceof Error?c.message:"unknown"}`)}}}});var ml,gl,Yr,yl,LA,UA,El,Tl,Cl,Al,Ks,$A,Il,Sl,Fn,Hn=h(()=>{"use strict";J();ml="invalid_file_extension",gl="invalid_file_path",Yr="invalid_managed_identity_id_type",yl="invalid_secret",LA="missing_client_id",UA="network_unavailable",El="platform_not_supported",Tl="unable_to_create_azure_arc",Cl="unable_to_create_cloud_shell",Al="unable_to_create_source",Ks="unable_to_read_secret_file",$A="user_assigned_not_available_at_runtime",Il="www_authenticate_header_missing",Sl="www_authenticate_header_unsupported_format",Fn={[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]:"azure_pod_identity_authority_host_url_malformed",[U.IDENTITY_ENDPOINT]:"identity_endpoint_url_malformed",[U.IMDS_ENDPOINT]:"imds_endpoint_url_malformed",[U.MSI_ENDPOINT]:"msi_endpoint_url_malformed"}});function ye(t,e){return new dm(t,e)}var x0,dm,Ko=h(()=>{"use strict";W();Hn();J();x0={[ml]:"The file path in the WWW-Authenticate header does not contain a .key file.",[gl]:"The file path in the WWW-Authenticate header is not in a valid Windows or Linux Format.",[Yr]:"More than one ManagedIdentityIdType was provided.",[yl]:"The secret in the file on the file path in the WWW-Authenticate header is greater than 4096 bytes.",[El]:"The platform is not supported by Azure Arc. Azure Arc only supports Windows and Linux.",[LA]:"A ManagedIdentityId id was not provided.",[Fn.AZURE_POD_IDENTITY_AUTHORITY_HOST]:`The Managed Identity's '${U.AZURE_POD_IDENTITY_AUTHORITY_HOST}' environment variable is malformed.`,[Fn.IDENTITY_ENDPOINT]:`The Managed Identity's '${U.IDENTITY_ENDPOINT}' environment variable is malformed.`,[Fn.IMDS_ENDPOINT]:`The Managed Identity's '${U.IMDS_ENDPOINT}' environment variable is malformed.`,[Fn.MSI_ENDPOINT]:`The Managed Identity's '${U.MSI_ENDPOINT}' environment variable is malformed.`,[UA]:"Authentication unavailable. The request to the managed identity endpoint timed out.",[Tl]:"Azure Arc Managed Identities can only be system assigned.",[Cl]:"Cloud Shell Managed Identities can only be system assigned.",[Al]:"Unable to create a Managed Identity source based on environment variables.",[Ks]:"Unable to read the secret file.",[$A]:"Service Fabric user assigned managed identity ClientId or ResourceId is not configurable at runtime.",[Il]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is missing.",[Sl]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format."},dm=class t extends H{constructor(e,r){super(e,r,x0[e]),this.name="ManagedIdentityError",Object.setPrototypeOf(this,t.prototype)}}});var _l,FA=h(()=>{"use strict";Ko();J();Hn();_l=class{get id(){return this._id}set id(e){this._id=e}get idType(){return this._idType}set idType(e){this._idType=e}constructor(e){let r=e?.userAssignedClientId,n=e?.userAssignedResourceId,o=e?.userAssignedObjectId;if(r){if(n||o)throw ye(Yr,"");this.id=r,this.idType=le.USER_ASSIGNED_CLIENT_ID}else if(n){if(r||o)throw ye(Yr,"");this.id=n,this.idType=le.USER_ASSIGNED_RESOURCE_ID}else if(o){if(r||n)throw ye(Yr,"");this.id=o,this.idType=le.USER_ASSIGNED_OBJECT_ID}else this.id=vA,this.idType=le.SYSTEM_ASSIGNED}}});var Ae,ze,Ws=h(()=>{"use strict";W();Ae={invalidLoopbackAddressType:{code:"invalid_loopback_server_address_type",desc:"Loopback server address is not type string. This is unexpected."},unableToLoadRedirectUri:{code:"unable_to_load_redirectUrl",desc:"Loopback server callback was invoked without a url. This is unexpected."},noAuthCodeInResponse:{code:"no_auth_code_in_response",desc:"No auth code found in the server response. Please check your network trace to determine what happened."},noLoopbackServerExists:{code:"no_loopback_server_exists",desc:"No loopback server exists yet."},loopbackServerAlreadyExists:{code:"loopback_server_already_exists",desc:"Loopback server already exists. Cannot create another."},loopbackServerTimeout:{code:"loopback_server_timeout",desc:"Timed out waiting for auth code listener to be registered."},stateNotFoundError:{code:"state_not_found",desc:"State not found. Please verify that the request originated from msal."},thumbprintMissing:{code:"thumbprint_missing_from_client_certificate",desc:"Client certificate does not contain a SHA-1 or SHA-256 thumbprint."},redirectUriNotSupported:{code:"redirect_uri_not_supported",desc:"RedirectUri is not supported in this scenario. Please remove redirectUri from the request."}},ze=class t extends H{constructor(e,r,n){super(e,r,n),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new t(Ae.invalidLoopbackAddressType.code,"",`${Ae.invalidLoopbackAddressType.desc}`)}static createUnableToLoadRedirectUrlError(){return new t(Ae.unableToLoadRedirectUri.code,"",`${Ae.unableToLoadRedirectUri.desc}`)}static createNoAuthCodeInResponseError(e=""){return new t(Ae.noAuthCodeInResponse.code,e,`${Ae.noAuthCodeInResponse.desc}`)}static createNoLoopbackServerExistsError(){return new t(Ae.noLoopbackServerExists.code,"",`${Ae.noLoopbackServerExists.desc}`)}static createLoopbackServerAlreadyExistsError(){return new t(Ae.loopbackServerAlreadyExists.code,"",`${Ae.loopbackServerAlreadyExists.desc}`)}static createLoopbackServerTimeoutError(e=""){return new t(Ae.loopbackServerTimeout.code,e,`${Ae.loopbackServerTimeout.desc}`)}static createStateNotFoundError(e=""){return new t(Ae.stateNotFoundError.code,e,Ae.stateNotFoundError.desc)}static createThumbprintMissingError(){return new t(Ae.thumbprintMissing.code,"",Ae.thumbprintMissing.desc)}static createRedirectUriNotSupportedError(e=""){return new t(Ae.redirectUriNotSupported.code,e,Ae.redirectUriNotSupported.desc)}}});function HA({auth:t,broker:e,cache:r,system:n,telemetry:o}){let i={...P0,networkClient:new Go,loggerOptions:n?.loggerOptions||fm,disableInternalRetries:n?.disableInternalRetries||!1};if(t.clientCertificate&&!t.clientCertificate.thumbprint&&!t.clientCertificate.thumbprintSha256)throw ze.createStateNotFoundError();return{auth:{...O0,...t},broker:{...e},cache:{...r},system:{...i,...n},telemetry:{...N0,...o}}}function BA({clientCapabilities:t,managedIdentityIdParams:e,system:r}){let n=new _l(e),o=r?.loggerOptions||fm,i;return r?.networkClient?i=r.networkClient:i=new Go,{clientCapabilities:t||[],managedIdentityId:n,system:{loggerOptions:o,networkClient:i},disableInternalRetries:r?.disableInternalRetries||!1}}var O0,fm,P0,N0,hm=h(()=>{"use strict";W();DA();FA();Ws();O0={clientId:"",authority:A.DEFAULT_AUTHORITY,clientSecret:"",clientAssertion:"",clientCertificate:{thumbprint:"",thumbprintSha256:"",privateKey:"",x5c:""},knownAuthorities:[],cloudDiscoveryMetadata:"",authorityMetadata:"",clientCapabilities:[],azureCloudOptions:{azureCloudInstance:Tr.None,tenant:""},isMcp:!1},fm={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:ae.Info},P0={loggerOptions:fm,networkClient:new Go,disableInternalRetries:!1,protocolMode:je.AAD},N0={application:{appName:"",appVersion:""}}});import{randomUUID as M0}from"node:crypto";var Wo,pm=h(()=>{"use strict";Wo=class{generateGuid(){return M0()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}}});var ft,Ys=h(()=>{"use strict";W();ft=class t{static base64Encode(e,r){return Buffer.from(e,r).toString(A.EncodingTypes.BASE64)}static base64EncodeUrl(e,r){return t.base64Encode(e,r).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,A.EncodingTypes.BASE64).toString("utf8")}static base64DecodeUrl(e){let r=e.replace(/-/g,"+").replace(/_/g,"/");for(;r.length%4;)r+="=";return t.base64Decode(r)}}});import D0 from"crypto";var Xr,wl=h(()=>{"use strict";J();Xr=class{sha256(e){return D0.createHash(NA.SHA256).update(e).digest()}}});import L0 from"crypto";var bl,jA=h(()=>{"use strict";W();J();Ys();wl();bl=class{constructor(){this.hashUtils=new Xr}async generatePkceCodes(){let e=this.generateCodeVerifier(),r=this.generateCodeChallengeFromVerifier(e);return{verifier:e,challenge:r}}generateCodeVerifier(){let e=[],r=256-256%hl.CV_CHARSET.length;for(;e.length<=PA;){let o=L0.randomBytes(1)[0];if(o>=r)continue;let i=o%hl.CV_CHARSET.length;e.push(hl.CV_CHARSET[i])}let n=e.join("");return ft.base64EncodeUrl(n)}generateCodeChallengeFromVerifier(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});var Jt,Xs=h(()=>{"use strict";W();pm();Ys();jA();wl();Jt=class{constructor(){this.pkceGenerator=new bl,this.guidGenerator=new Wo,this.hashUtils=new Xr}base64UrlEncode(){throw new Error("Method not implemented.")}encodeKid(){throw new Error("Method not implemented.")}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return ft.base64Encode(e)}base64Decode(e){return ft.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});import{createHash as U0}from"crypto";function $0(t){let r=Object.keys(t).sort().map(n=>n+t[n]).join("");return U0("sha256").update(r,"utf8").digest("base64url")}function zA(t){let e=t.credentialType===A.CredentialType.REFRESH_TOKEN&&t.familyId||t.clientId,r=t.tokenType&&t.tokenType.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?t.tokenType.toLowerCase():"",n=[t.homeAccountId,t.environment,t.credentialType,e,t.realm||"",t.target||"",r];return t.additionalCacheKeyComponents&&Object.keys(t.additionalCacheKeyComponents).length>0&&n.push($0(t.additionalCacheKeyComponents)),n.join(um.KEY_SEPARATOR).toLowerCase()}function VA(t){let e=t.homeAccountId.split(".")[1];return[t.homeAccountId,t.environment,e||t.tenantId||""].join(um.KEY_SEPARATOR).toLowerCase()}var qA=h(()=>{"use strict";W();J();});var Jr,Rl=h(()=>{"use strict";W();fl();Ec();qA();Jr=class extends Gr{constructor(e,r,n,o){super(r,n,e,new Te,o),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){let r={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(let n in e){let o=e[n];if(typeof o=="object")if(Mn.isAccountEntity(o))r.accounts[n]=o;else if(Ve.isIdTokenEntity(o))r.idTokens[n]=o;else if(Ve.isAccessTokenEntity(o))r.accessTokens[n]=o;else if(Ve.isRefreshTokenEntity(o))r.refreshTokens[n]=o;else if(Ve.isAppMetadataEntity(n,o))r.appMetadata[n]=o;else continue}return r}inMemoryCacheToCache(e){let r=this.getCache();return r={...r,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},r}getInMemoryCache(){return this.logger.trace("Getting in-memory cache",""),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache","");let r=this.inMemoryCacheToCache(e);this.setCache(r),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store",""),this.cache}setCache(e){this.logger.trace("Setting cache key value store",""),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii(`Item key: ${e}`,""),this.getCache()[e]}setItem(e,r){this.logger.tracePii(`Item key: ${e}`,"");let n=this.getCache();n[e]=r,this.setCache(n)}generateCredentialKey(e){return zA(e)}generateAccountKey(e){return VA(e)}getAccountKeys(){let e=this.getInMemoryCache();return Object.keys(e.accounts)}getTokenKeys(){let e=this.getInMemoryCache();return{idToken:Object.keys(e.idTokens),accessToken:Object.keys(e.accessTokens),refreshToken:Object.keys(e.refreshTokens)}}getAccount(e){let r=this.getItem(e);return r&&typeof r=="object"?{...r}:null}async setAccount(e){let r=this.generateAccountKey(Mn.getAccountInfo(e));this.setItem(r,e)}getIdTokenCredential(e){let r=this.getItem(e);return Ve.isIdTokenEntity(r)?r:null}async setIdTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAccessTokenCredential(e){let r=this.getItem(e);return Ve.isAccessTokenEntity(r)?r:null}async setAccessTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getRefreshTokenCredential(e){let r=this.getItem(e);return Ve.isRefreshTokenEntity(r)?r:null}async setRefreshTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAppMetadata(e){let r=this.getItem(e);return Ve.isAppMetadataEntity(e,r)?r:null}setAppMetadata(e){let r=Ve.generateAppMetadataKey(e);this.setItem(r,e)}getServerTelemetry(e){let r=this.getItem(e);return r&&Ve.isServerTelemetryEntity(e,r)?r:null}setServerTelemetry(e,r){this.setItem(e,r)}getAuthorityMetadata(e){let r=this.getItem(e);return r&&Ve.isAuthorityMetadataEntity(e,r)?r:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,r){this.setItem(e,r)}getThrottlingCache(e){let r=this.getItem(e);return r&&Ve.isThrottlingEntity(e,r)?r:null}setThrottlingCache(e,r){this.setItem(e,r)}removeItem(e){this.logger.tracePii(`Item key: ${e}`,"");let r=!1,n=this.getCache();return n[e]&&(delete n[e],r=!0),r&&(this.setCache(n),this.emitChange()),r}removeOutdatedAccount(e){this.removeItem(e)}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys","");let e=this.getCache();return[...Object.keys(e)]}clear(){this.logger.trace("Clearing cache entries created by MSAL",""),this.getKeys().forEach(r=>{this.isAuthorityMetadata(r)||this.removeItem(r)}),this.emitChange()}static generateInMemoryCache(e){return _r.deserializeAllCache(_r.deserializeJSONBlob(e))}static generateJsonCache(e){return Hr.serializeAllCache(e)}updateCredentialCacheKey(e,r){let n=this.generateCredentialKey(r);if(e!==n){let o=this.getItem(e);if(o)return this.removeItem(e),this.setItem(n,o),this.logger.verbose(`Updated an outdated ${r.credentialType} cache key`,""),n;this.logger.error(`Attempted to update an outdated ${r.credentialType} cache key but no item matching the outdated key was found in storage`,"")}return e}}});var Js,Yo,mm=h(()=>{"use strict";Rl();W();fl();Ec();pm();Xs();Js={Account:{},IdToken:{},AccessToken:{},RefreshToken:{},AppMetadata:{}},Yo=class{constructor(e,r,n){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),n&&(this.persistence=n),this.logger=r}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache","");let e=Hr.serializeAllCache(this.storage.getInMemoryCache());return this.cacheSnapshot?(this.logger.trace("Reading cache snapshot from disk",""),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)):this.logger.trace("No cache snapshot to merge",""),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache",""),this.cacheSnapshot=e,this.cacheSnapshot){this.logger.trace("Reading cache snapshot from disk","");let r=_r.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(r)}else this.logger.trace("No cache snapshot to deserialize","")}getKVStore(){return this.storage.getCache()}getCacheSnapshot(){let e=Jr.generateInMemoryCache(this.cacheSnapshot);return this.storage.inMemoryCacheToCache(e)}async getAllAccounts(e=new Jt().createNewGuid()){this.logger.trace("getAllAccounts called",e);let r;try{return this.persistence&&(r=new lt(this,!1),await this.persistence.beforeCacheAccess(r)),this.storage.getAllAccounts({},e)}finally{this.persistence&&r&&await this.persistence.afterCacheAccess(r)}}async getAccountByHomeId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.homeAccountId===e)[0]||null}async getAccountByLocalId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.localAccountId===e)[0]||null}async removeAccount(e,r){this.logger.trace("removeAccount called",r||"");let n;try{this.persistence&&(n=new lt(this,!0),await this.persistence.beforeCacheAccess(n)),this.storage.removeAccount(e,r||new Wo().generateGuid())}finally{this.persistence&&n&&await this.persistence.afterCacheAccess(n)}}async overwriteCache(){if(!this.persistence){this.logger.info("No persistence layer specified, cache cannot be overwritten","");return}this.logger.info("Overwriting in-memory cache with persistent cache",""),this.storage.clear();let e=new lt(this,!1);await this.persistence.beforeCacheAccess(e);let r=this.getCacheSnapshot();this.storage.setCache(r),await this.persistence.afterCacheAccess(e)}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,r){this.logger.trace("Merging in-memory cache with cache snapshot","");let n=this.mergeRemovals(e,r);return this.mergeUpdates(n,r)}mergeUpdates(e,r){return Object.keys(r).forEach(n=>{let o=r[n];if(!e.hasOwnProperty(n))o!==null&&(e[n]=o);else{let i=o!==null,s=typeof o=="object",a=!Array.isArray(o),l=typeof e[n]<"u"&&e[n]!==null;i&&s&&a&&l?this.mergeUpdates(e[n],o):e[n]=o}}),e}mergeRemovals(e,r){this.logger.trace("Remove updated entries in cache","");let n=e.Account?this.mergeRemovalsDict(e.Account,r.Account):e.Account,o=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,r.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,r.RefreshToken):e.RefreshToken,s=e.IdToken?this.mergeRemovalsDict(e.IdToken,r.IdToken):e.IdToken,a=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,r.AppMetadata):e.AppMetadata;return{...e,Account:n,AccessToken:o,RefreshToken:i,IdToken:s,AppMetadata:a}}mergeRemovalsDict(e,r){let n={...e};return Object.keys(e).forEach(o=>{(!r||!r.hasOwnProperty(o))&&delete n[o]}),n}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache",""),{Account:{...Js.Account,...e.Account},IdToken:{...Js.IdToken,...e.IdToken},AccessToken:{...Js.AccessToken,...e.AccessToken},RefreshToken:{...Js.RefreshToken,...e.RefreshToken},AppMetadata:{...Js.AppMetadata,...e.AppMetadata}}}}});var Xo=S((gm,KA)=>{var kl=L("buffer"),Qt=kl.Buffer;function GA(t,e){for(var r in t)e[r]=t[r]}Qt.from&&Qt.alloc&&Qt.allocUnsafe&&Qt.allocUnsafeSlow?KA.exports=kl:(GA(kl,gm),gm.Buffer=Bn);function Bn(t,e,r){return Qt(t,e,r)}Bn.prototype=Object.create(Qt.prototype);GA(Qt,Bn);Bn.from=function(t,e,r){if(typeof t=="number")throw new TypeError("Argument must not be a number");return Qt(t,e,r)};Bn.alloc=function(t,e,r){if(typeof t!="number")throw new TypeError("Argument must be a number");var n=Qt(t);return e!==void 0?typeof r=="string"?n.fill(e,r):n.fill(e):n.fill(0),n};Bn.allocUnsafe=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return Qt(t)};Bn.allocUnsafeSlow=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return kl.SlowBuffer(t)}});var ym=S((qY,WA)=>{var vl=Xo().Buffer,F0=L("stream"),H0=L("util");function xl(t){if(this.buffer=null,this.writable=!0,this.readable=!0,!t)return this.buffer=vl.alloc(0),this;if(typeof t.pipe=="function")return this.buffer=vl.alloc(0),t.pipe(this),this;if(t.length||typeof t=="object")return this.buffer=t,this.writable=!1,process.nextTick(function(){this.emit("end",t),this.readable=!1,this.emit("close")}.bind(this)),this;throw new TypeError("Unexpected data type ("+typeof t+")")}H0.inherits(xl,F0);xl.prototype.write=function(e){this.buffer=vl.concat([this.buffer,vl.from(e)]),this.emit("data",e)};xl.prototype.end=function(e){e&&this.write(e),this.emit("end",e),this.emit("close"),this.writable=!1,this.readable=!1};WA.exports=xl});var XA=S((GY,YA)=>{"use strict";function Em(t){var e=(t/8|0)+(t%8===0?0:1);return e}var B0={ES256:Em(256),ES384:Em(384),ES512:Em(521)};function j0(t){var e=B0[t];if(e)return e;throw new Error('Unknown algorithm "'+t+'"')}YA.exports=j0});var nI=S((KY,rI)=>{"use strict";var Ol=Xo().Buffer,QA=XA(),Pl=128,ZA=0,z0=32,V0=16,q0=2,eI=V0|z0|ZA<<6,Nl=q0|ZA<<6;function G0(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function tI(t){if(Ol.isBuffer(t))return t;if(typeof t=="string")return Ol.from(t,"base64");throw new TypeError("ECDSA signature must be a Base64 string or a Buffer")}function K0(t,e){t=tI(t);var r=QA(e),n=r+1,o=t.length,i=0;if(t[i++]!==eI)throw new Error('Could not find expected "seq"');var s=t[i++];if(s===(Pl|1)&&(s=t[i++]),o-i<s)throw new Error('"seq" specified length of "'+s+'", only "'+(o-i)+'" remaining');if(t[i++]!==Nl)throw new Error('Could not find expected "int" for "r"');var a=t[i++];if(o-i-2<a)throw new Error('"r" specified length of "'+a+'", only "'+(o-i-2)+'" available');if(n<a)throw new Error('"r" specified length of "'+a+'", max of "'+n+'" is acceptable');var l=i;if(i+=a,t[i++]!==Nl)throw new Error('Could not find expected "int" for "s"');var c=t[i++];if(o-i!==c)throw new Error('"s" specified length of "'+c+'", expected "'+(o-i)+'"');if(n<c)throw new Error('"s" specified length of "'+c+'", max of "'+n+'" is acceptable');var u=i;if(i+=c,i!==o)throw new Error('Expected to consume entire buffer, but "'+(o-i)+'" bytes remain');var d=r-a,f=r-c,p=Ol.allocUnsafe(d+a+f+c);for(i=0;i<d;++i)p[i]=0;t.copy(p,i,l+Math.max(-d,0),l+a),i=r;for(var g=i;i<g+f;++i)p[i]=0;return t.copy(p,i,u+Math.max(-f,0),u+c),p=p.toString("base64"),p=G0(p),p}function JA(t,e,r){for(var n=0;e+n<r&&t[e+n]===0;)++n;var o=t[e+n]>=Pl;return o&&--n,n}function W0(t,e){t=tI(t);var r=QA(e),n=t.length;if(n!==r*2)throw new TypeError('"'+e+'" signatures must be "'+r*2+'" bytes, saw "'+n+'"');var o=JA(t,0,r),i=JA(t,r,t.length),s=r-o,a=r-i,l=2+s+1+1+a,c=l<Pl,u=Ol.allocUnsafe((c?2:3)+l),d=0;return u[d++]=eI,c?u[d++]=l:(u[d++]=Pl|1,u[d++]=l&255),u[d++]=Nl,u[d++]=s,o<0?(u[d++]=0,d+=t.copy(u,d,0,r)):d+=t.copy(u,d,o,r),u[d++]=Nl,u[d++]=a,i<0?(u[d++]=0,t.copy(u,d,r)):t.copy(u,d,r+i),u}rI.exports={derToJose:K0,joseToDer:W0}});var iI=S((WY,oI)=>{"use strict";var Qs=L("buffer").Buffer,Tm=L("buffer").SlowBuffer;oI.exports=Ml;function Ml(t,e){if(!Qs.isBuffer(t)||!Qs.isBuffer(e)||t.length!==e.length)return!1;for(var r=0,n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}Ml.install=function(){Qs.prototype.equal=Tm.prototype.equal=function(e){return Ml(this,e)}};var Y0=Qs.prototype.equal,X0=Tm.prototype.equal;Ml.restore=function(){Qs.prototype.equal=Y0,Tm.prototype.equal=X0}});var Sm=S((YY,pI)=>{var Qo=Xo().Buffer,_t=L("crypto"),aI=nI(),sI=L("util"),J0=`"%s" is not a valid algorithm. | ||
| Supported algorithms are: | ||
| "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,Zs="secret must be a string or buffer",Jo="key must be a string or a buffer",Q0="key must be a string, a buffer or an object",Am=typeof _t.createPublicKey=="function";Am&&(Jo+=" or a KeyObject",Zs+="or a KeyObject");function cI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&(!Am||typeof t!="object"||typeof t.type!="string"||typeof t.asymmetricKeyType!="string"||typeof t.export!="function"))throw Bt(Jo)}function lI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&typeof t!="object")throw Bt(Q0)}function Z0(t){if(!Qo.isBuffer(t)){if(typeof t=="string")return t;if(!Am||typeof t!="object"||t.type!=="secret"||typeof t.export!="function")throw Bt(Zs)}}function Im(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function uI(t){t=t.toString();var e=4-t.length%4;if(e!==4)for(var r=0;r<e;++r)t+="=";return t.replace(/\-/g,"+").replace(/_/g,"/")}function Bt(t){var e=[].slice.call(arguments,1),r=sI.format.bind(sI,t).apply(null,e);return new TypeError(r)}function eM(t){return Qo.isBuffer(t)||typeof t=="string"}function ea(t){return eM(t)||(t=JSON.stringify(t)),t}function dI(t){return function(r,n){Z0(n),r=ea(r);var o=_t.createHmac("sha"+t,n),i=(o.update(r),o.digest("base64"));return Im(i)}}var Cm,tM="timingSafeEqual"in _t?function(e,r){return e.byteLength!==r.byteLength?!1:_t.timingSafeEqual(e,r)}:function(e,r){return Cm||(Cm=iI()),Cm(e,r)};function rM(t){return function(r,n,o){var i=dI(t)(r,o);return tM(Qo.from(n),Qo.from(i))}}function fI(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign(n,"base64"));return Im(i)}}function hI(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify(o,n,"base64")}}function nM(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign({key:n,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},"base64"));return Im(i)}}function oM(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify({key:o,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},n,"base64")}}function iM(t){var e=fI(t);return function(){var n=e.apply(null,arguments);return n=aI.derToJose(n,"ES"+t),n}}function sM(t){var e=hI(t);return function(n,o,i){o=aI.joseToDer(o,"ES"+t).toString("base64");var s=e(n,o,i);return s}}function aM(){return function(){return""}}function cM(){return function(e,r){return r===""}}pI.exports=function(e){var r={hs:dI,rs:fI,ps:nM,es:iM,none:aM},n={hs:rM,rs:hI,ps:oM,es:sM,none:cM},o=e.match(/^(RS|PS|ES|HS)(256|384|512)$|^(none)$/);if(!o)throw Bt(J0,e);var i=(o[1]||o[3]).toLowerCase(),s=o[2];return{sign:r[i](s),verify:n[i](s)}}});var _m=S((XY,mI)=>{var lM=L("buffer").Buffer;mI.exports=function(e){return typeof e=="string"?e:typeof e=="number"||lM.isBuffer(e)?e.toString():JSON.stringify(e)}});var AI=S((JY,CI)=>{var uM=Xo().Buffer,gI=ym(),dM=Sm(),fM=L("stream"),yI=_m(),wm=L("util");function EI(t,e){return uM.from(t,e).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function hM(t,e,r){r=r||"utf8";var n=EI(yI(t),"binary"),o=EI(yI(e),r);return wm.format("%s.%s",n,o)}function TI(t){var e=t.header,r=t.payload,n=t.secret||t.privateKey,o=t.encoding,i=dM(e.alg),s=hM(e,r,o),a=i.sign(s,n);return wm.format("%s.%s",s,a)}function Dl(t){var e=t.secret;if(e=e??t.privateKey,e=e??t.key,/^hs/i.test(t.header.alg)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new gI(e);this.readable=!0,this.header=t.header,this.encoding=t.encoding,this.secret=this.privateKey=this.key=r,this.payload=new gI(t.payload),this.secret.once("close",function(){!this.payload.writable&&this.readable&&this.sign()}.bind(this)),this.payload.once("close",function(){!this.secret.writable&&this.readable&&this.sign()}.bind(this))}wm.inherits(Dl,fM);Dl.prototype.sign=function(){try{var e=TI({header:this.header,payload:this.payload.buffer,secret:this.secret.buffer,encoding:this.encoding});return this.emit("done",e),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(r){this.readable=!1,this.emit("error",r),this.emit("close")}};Dl.sign=TI;CI.exports=Dl});var OI=S((QY,xI)=>{var SI=Xo().Buffer,II=ym(),pM=Sm(),mM=L("stream"),_I=_m(),gM=L("util"),yM=/^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;function EM(t){return Object.prototype.toString.call(t)==="[object Object]"}function TM(t){if(EM(t))return t;try{return JSON.parse(t)}catch{return}}function wI(t){var e=t.split(".",1)[0];return TM(SI.from(e,"base64").toString("binary"))}function CM(t){return t.split(".",2).join(".")}function bI(t){return t.split(".")[2]}function AM(t,e){e=e||"utf8";var r=t.split(".")[1];return SI.from(r,"base64").toString(e)}function RI(t){return yM.test(t)&&!!wI(t)}function kI(t,e,r){if(!e){var n=new Error("Missing algorithm parameter for jws.verify");throw n.code="MISSING_ALGORITHM",n}t=_I(t);var o=bI(t),i=CM(t),s=pM(e);return s.verify(i,o,r)}function vI(t,e){if(e=e||{},t=_I(t),!RI(t))return null;var r=wI(t);if(!r)return null;var n=AM(t);return(r.typ==="JWT"||e.json)&&(n=JSON.parse(n,e.encoding)),{header:r,payload:n,signature:bI(t)}}function Zo(t){t=t||{};var e=t.secret;if(e=e??t.publicKey,e=e??t.key,/^hs/i.test(t.algorithm)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new II(e);this.readable=!0,this.algorithm=t.algorithm,this.encoding=t.encoding,this.secret=this.publicKey=this.key=r,this.signature=new II(t.signature),this.secret.once("close",function(){!this.signature.writable&&this.readable&&this.verify()}.bind(this)),this.signature.once("close",function(){!this.secret.writable&&this.readable&&this.verify()}.bind(this))}gM.inherits(Zo,mM);Zo.prototype.verify=function(){try{var e=kI(this.signature.buffer,this.algorithm,this.key.buffer),r=vI(this.signature.buffer,this.encoding);return this.emit("done",e,r),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(n){this.readable=!1,this.emit("error",n),this.emit("close")}};Zo.decode=vI;Zo.isValid=RI;Zo.verify=kI;xI.exports=Zo});var Ul=S(Qr=>{var PI=AI(),Ll=OI(),IM=["HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512"];Qr.ALGORITHMS=IM;Qr.sign=PI.sign;Qr.verify=Ll.verify;Qr.decode=Ll.decode;Qr.isValid=Ll.isValid;Qr.createSign=function(e){return new PI(e)};Qr.createVerify=function(e){return new Ll(e)}});var bm=S((e5,NI)=>{var SM=Ul();NI.exports=function(t,e){e=e||{};var r=SM.decode(t,e);if(!r)return null;var n=r.payload;if(typeof n=="string")try{var o=JSON.parse(n);o!==null&&typeof o=="object"&&(n=o)}catch{}return e.complete===!0?{header:r.header,payload:n,signature:r.signature}:n}});var ta=S((t5,MI)=>{var $l=function(t,e){Error.call(this,t),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor),this.name="JsonWebTokenError",this.message=t,e&&(this.inner=e)};$l.prototype=Object.create(Error.prototype);$l.prototype.constructor=$l;MI.exports=$l});var Rm=S((r5,LI)=>{var DI=ta(),Fl=function(t,e){DI.call(this,t),this.name="NotBeforeError",this.date=e};Fl.prototype=Object.create(DI.prototype);Fl.prototype.constructor=Fl;LI.exports=Fl});var km=S((n5,$I)=>{var UI=ta(),Hl=function(t,e){UI.call(this,t),this.name="TokenExpiredError",this.expiredAt=e};Hl.prototype=Object.create(UI.prototype);Hl.prototype.constructor=Hl;$I.exports=Hl});var vm=S((o5,FI)=>{var ei=1e3,ti=ei*60,ri=ti*60,jn=ri*24,_M=jn*7,wM=jn*365.25;FI.exports=function(t,e){e=e||{};var r=typeof t;if(r==="string"&&t.length>0)return bM(t);if(r==="number"&&isFinite(t))return e.long?kM(t):RM(t);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(t))};function bM(t){if(t=String(t),!(t.length>100)){var e=/^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(t);if(e){var r=parseFloat(e[1]),n=(e[2]||"ms").toLowerCase();switch(n){case"years":case"year":case"yrs":case"yr":case"y":return r*wM;case"weeks":case"week":case"w":return r*_M;case"days":case"day":case"d":return r*jn;case"hours":case"hour":case"hrs":case"hr":case"h":return r*ri;case"minutes":case"minute":case"mins":case"min":case"m":return r*ti;case"seconds":case"second":case"secs":case"sec":case"s":return r*ei;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return r;default:return}}}}function RM(t){var e=Math.abs(t);return e>=jn?Math.round(t/jn)+"d":e>=ri?Math.round(t/ri)+"h":e>=ti?Math.round(t/ti)+"m":e>=ei?Math.round(t/ei)+"s":t+"ms"}function kM(t){var e=Math.abs(t);return e>=jn?Bl(t,e,jn,"day"):e>=ri?Bl(t,e,ri,"hour"):e>=ti?Bl(t,e,ti,"minute"):e>=ei?Bl(t,e,ei,"second"):t+" ms"}function Bl(t,e,r,n){var o=e>=r*1.5;return Math.round(t/r)+" "+n+(o?"s":"")}});var xm=S((i5,HI)=>{var vM=vm();HI.exports=function(t,e){var r=e||Math.floor(Date.now()/1e3);if(typeof t=="string"){var n=vM(t);return typeof n>"u"?void 0:Math.floor(r+n/1e3)}else return typeof t=="number"?r+t:void 0}});var ni=S((s5,BI)=>{"use strict";var xM="2.0.0",OM=Number.MAX_SAFE_INTEGER||9007199254740991,PM=16,NM=250,MM=["major","premajor","minor","preminor","patch","prepatch","prerelease"];BI.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:PM,MAX_SAFE_BUILD_LENGTH:NM,MAX_SAFE_INTEGER:OM,RELEASE_TYPES:MM,SEMVER_SPEC_VERSION:xM,FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var ra=S((a5,jI)=>{"use strict";var DM=typeof process=="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...t)=>console.error("SEMVER",...t):()=>{};jI.exports=DM});var oi=S((Zt,zI)=>{"use strict";var{MAX_SAFE_COMPONENT_LENGTH:Om,MAX_SAFE_BUILD_LENGTH:LM,MAX_LENGTH:UM}=ni(),$M=ra();Zt=zI.exports={};var FM=Zt.re=[],HM=Zt.safeRe=[],x=Zt.src=[],BM=Zt.safeSrc=[],O=Zt.t={},jM=0,Pm="[a-zA-Z0-9-]",zM=[["\\s",1],["\\d",UM],[Pm,LM]],VM=t=>{for(let[e,r]of zM)t=t.split(`${e}*`).join(`${e}{0,${r}}`).split(`${e}+`).join(`${e}{1,${r}}`);return t},B=(t,e,r)=>{let n=VM(e),o=jM++;$M(t,o,e),O[t]=o,x[o]=e,BM[o]=n,FM[o]=new RegExp(e,r?"g":void 0),HM[o]=new RegExp(n,r?"g":void 0)};B("NUMERICIDENTIFIER","0|[1-9]\\d*");B("NUMERICIDENTIFIERLOOSE","\\d+");B("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${Pm}*`);B("MAINVERSION",`(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})`);B("MAINVERSIONLOOSE",`(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASEIDENTIFIER",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIER]})`);B("PRERELEASEIDENTIFIERLOOSE",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASE",`(?:-(${x[O.PRERELEASEIDENTIFIER]}(?:\\.${x[O.PRERELEASEIDENTIFIER]})*))`);B("PRERELEASELOOSE",`(?:-?(${x[O.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${x[O.PRERELEASEIDENTIFIERLOOSE]})*))`);B("BUILDIDENTIFIER",`${Pm}+`);B("BUILD",`(?:\\+(${x[O.BUILDIDENTIFIER]}(?:\\.${x[O.BUILDIDENTIFIER]})*))`);B("FULLPLAIN",`v?${x[O.MAINVERSION]}${x[O.PRERELEASE]}?${x[O.BUILD]}?`);B("FULL",`^${x[O.FULLPLAIN]}$`);B("LOOSEPLAIN",`[v=\\s]*${x[O.MAINVERSIONLOOSE]}${x[O.PRERELEASELOOSE]}?${x[O.BUILD]}?`);B("LOOSE",`^${x[O.LOOSEPLAIN]}$`);B("GTLT","((?:<|>)?=?)");B("XRANGEIDENTIFIERLOOSE",`${x[O.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);B("XRANGEIDENTIFIER",`${x[O.NUMERICIDENTIFIER]}|x|X|\\*`);B("XRANGEPLAIN",`[v=\\s]*(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:${x[O.PRERELEASE]})?${x[O.BUILD]}?)?)?`);B("XRANGEPLAINLOOSE",`[v=\\s]*(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:${x[O.PRERELEASELOOSE]})?${x[O.BUILD]}?)?)?`);B("XRANGE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAIN]}$`);B("XRANGELOOSE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAINLOOSE]}$`);B("COERCEPLAIN",`(^|[^\\d])(\\d{1,${Om}})(?:\\.(\\d{1,${Om}}))?(?:\\.(\\d{1,${Om}}))?`);B("COERCE",`${x[O.COERCEPLAIN]}(?:$|[^\\d])`);B("COERCEFULL",x[O.COERCEPLAIN]+`(?:${x[O.PRERELEASE]})?(?:${x[O.BUILD]})?(?:$|[^\\d])`);B("COERCERTL",x[O.COERCE],!0);B("COERCERTLFULL",x[O.COERCEFULL],!0);B("LONETILDE","(?:~>?)");B("TILDETRIM",`(\\s*)${x[O.LONETILDE]}\\s+`,!0);Zt.tildeTrimReplace="$1~";B("TILDE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAIN]}$`);B("TILDELOOSE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAINLOOSE]}$`);B("LONECARET","(?:\\^)");B("CARETTRIM",`(\\s*)${x[O.LONECARET]}\\s+`,!0);Zt.caretTrimReplace="$1^";B("CARET",`^${x[O.LONECARET]}${x[O.XRANGEPLAIN]}$`);B("CARETLOOSE",`^${x[O.LONECARET]}${x[O.XRANGEPLAINLOOSE]}$`);B("COMPARATORLOOSE",`^${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]})$|^$`);B("COMPARATOR",`^${x[O.GTLT]}\\s*(${x[O.FULLPLAIN]})$|^$`);B("COMPARATORTRIM",`(\\s*)${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]}|${x[O.XRANGEPLAIN]})`,!0);Zt.comparatorTrimReplace="$1$2$3";B("HYPHENRANGE",`^\\s*(${x[O.XRANGEPLAIN]})\\s+-\\s+(${x[O.XRANGEPLAIN]})\\s*$`);B("HYPHENRANGELOOSE",`^\\s*(${x[O.XRANGEPLAINLOOSE]})\\s+-\\s+(${x[O.XRANGEPLAINLOOSE]})\\s*$`);B("STAR","(<|>)?=?\\s*\\*");B("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");B("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var jl=S((c5,VI)=>{"use strict";var qM=Object.freeze({loose:!0}),GM=Object.freeze({}),KM=t=>t?typeof t!="object"?qM:t:GM;VI.exports=KM});var Nm=S((l5,KI)=>{"use strict";var qI=/^[0-9]+$/,GI=(t,e)=>{if(typeof t=="number"&&typeof e=="number")return t===e?0:t<e?-1:1;let r=qI.test(t),n=qI.test(e);return r&&n&&(t=+t,e=+e),t===e?0:r&&!n?-1:n&&!r?1:t<e?-1:1},WM=(t,e)=>GI(e,t);KI.exports={compareIdentifiers:GI,rcompareIdentifiers:WM}});var Ue=S((u5,YI)=>{"use strict";var zl=ra(),{MAX_LENGTH:WI,MAX_SAFE_INTEGER:Vl}=ni(),{safeRe:ql,t:Gl}=oi(),YM=jl(),{compareIdentifiers:Mm}=Nm(),XM=(t,e)=>{let r=e.split(".");if(r.length>t.length)return!1;for(let n=0;n<r.length;n++)if(Mm(t[n],r[n])!==0)return!1;return!0},Dm=class t{constructor(e,r){if(r=YM(r),e instanceof t){if(e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease)return e;e=e.version}else if(typeof e!="string")throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>WI)throw new TypeError(`version is longer than ${WI} characters`);zl("SemVer",e,r),this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease;let n=e.trim().match(r.loose?ql[Gl.LOOSE]:ql[Gl.FULL]);if(!n)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+n[1],this.minor=+n[2],this.patch=+n[3],this.major>Vl||this.major<0)throw new TypeError("Invalid major version");if(this.minor>Vl||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>Vl||this.patch<0)throw new TypeError("Invalid patch version");n[4]?this.prerelease=n[4].split(".").map(o=>{if(/^[0-9]+$/.test(o)){let i=+o;if(i>=0&&i<Vl)return i}return o}):this.prerelease=[],this.build=n[5]?n[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(zl("SemVer.compare",this.version,this.options,e),!(e instanceof t)){if(typeof e=="string"&&e===this.version)return 0;e=new t(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof t||(e=new t(e,this.options)),this.major<e.major?-1:this.major>e.major?1:this.minor<e.minor?-1:this.minor>e.minor?1:this.patch<e.patch?-1:this.patch>e.patch?1:0}comparePre(e){if(e instanceof t||(e=new t(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let r=0;do{let n=this.prerelease[r],o=e.prerelease[r];if(zl("prerelease compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}compareBuild(e){e instanceof t||(e=new t(e,this.options));let r=0;do{let n=this.build[r],o=e.build[r];if(zl("build compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}inc(e,r,n){if(e.startsWith("pre")){if(!r&&n===!1)throw new Error("invalid increment argument: identifier is empty");if(r){let o=`-${r}`.match(this.options.loose?ql[Gl.PRERELEASELOOSE]:ql[Gl.PRERELEASE]);if(!o||o[1]!==r)throw new Error(`invalid identifier: ${r}`)}}switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",r,n);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",r,n);break;case"prepatch":this.prerelease.length=0,this.inc("patch",r,n),this.inc("pre",r,n);break;case"prerelease":this.prerelease.length===0&&this.inc("patch",r,n),this.inc("pre",r,n);break;case"release":if(this.prerelease.length===0)throw new Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":(this.minor!==0||this.patch!==0||this.prerelease.length===0)&&this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":(this.patch!==0||this.prerelease.length===0)&&this.minor++,this.patch=0,this.prerelease=[];break;case"patch":this.prerelease.length===0&&this.patch++,this.prerelease=[];break;case"pre":{let o=Number(n)?1:0;if(this.prerelease.length===0)this.prerelease=[o];else{let i=this.prerelease.length;for(;--i>=0;)typeof this.prerelease[i]=="number"&&(this.prerelease[i]++,i=-2);if(i===-1){if(r===this.prerelease.join(".")&&n===!1)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(o)}}if(r){let i=[r,o];if(n===!1&&(i=[r]),XM(this.prerelease,r)){let s=this.prerelease[r.split(".").length];isNaN(s)&&(this.prerelease=i)}else this.prerelease=i}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}};YI.exports=Dm});var Zr=S((d5,JI)=>{"use strict";var XI=Ue(),JM=(t,e,r=!1)=>{if(t instanceof XI)return t;try{return new XI(t,e)}catch(n){if(!r)return null;throw n}};JI.exports=JM});var ZI=S((f5,QI)=>{"use strict";var QM=Zr(),ZM=(t,e)=>{let r=QM(t,e);return r?r.version:null};QI.exports=ZM});var tS=S((h5,eS)=>{"use strict";var eD=Zr(),tD=(t,e)=>{let r=eD(t.trim().replace(/^[=v]+/,""),e);return r?r.version:null};eS.exports=tD});var oS=S((p5,nS)=>{"use strict";var rS=Ue(),rD=(t,e,r,n,o)=>{typeof r=="string"&&(o=n,n=r,r=void 0);try{return new rS(t instanceof rS?t.version:t,r).inc(e,n,o).version}catch{return null}};nS.exports=rD});var aS=S((m5,sS)=>{"use strict";var iS=Zr(),nD=(t,e)=>{let r=iS(t,null,!0),n=iS(e,null,!0),o=r.compare(n);if(o===0)return null;let i=o>0,s=i?r:n,a=i?n:r,l=!!s.prerelease.length;if(!!a.prerelease.length&&!l){if(!a.patch&&!a.minor)return"major";if(a.compareMain(s)===0)return a.minor&&!a.patch?"minor":"patch"}let u=l?"pre":"";return r.major!==n.major?u+"major":r.minor!==n.minor?u+"minor":r.patch!==n.patch?u+"patch":"prerelease"};sS.exports=nD});var lS=S((g5,cS)=>{"use strict";var oD=Ue(),iD=(t,e)=>new oD(t,e).major;cS.exports=iD});var dS=S((y5,uS)=>{"use strict";var sD=Ue(),aD=(t,e)=>new sD(t,e).minor;uS.exports=aD});var hS=S((E5,fS)=>{"use strict";var cD=Ue(),lD=(t,e)=>new cD(t,e).patch;fS.exports=lD});var mS=S((T5,pS)=>{"use strict";var uD=Zr(),dD=(t,e)=>{let r=uD(t,e);return r&&r.prerelease.length?r.prerelease:null};pS.exports=dD});var wt=S((C5,yS)=>{"use strict";var gS=Ue(),fD=(t,e,r)=>new gS(t,r).compare(new gS(e,r));yS.exports=fD});var TS=S((A5,ES)=>{"use strict";var hD=wt(),pD=(t,e,r)=>hD(e,t,r);ES.exports=pD});var AS=S((I5,CS)=>{"use strict";var mD=wt(),gD=(t,e)=>mD(t,e,!0);CS.exports=gD});var Kl=S((S5,SS)=>{"use strict";var IS=Ue(),yD=(t,e,r)=>{let n=new IS(t,r),o=new IS(e,r);return n.compare(o)||n.compareBuild(o)};SS.exports=yD});var wS=S((_5,_S)=>{"use strict";var ED=Kl(),TD=(t,e)=>t.sort((r,n)=>ED(r,n,e));_S.exports=TD});var RS=S((w5,bS)=>{"use strict";var CD=Kl(),AD=(t,e)=>t.sort((r,n)=>CD(n,r,e));bS.exports=AD});var na=S((b5,kS)=>{"use strict";var ID=wt(),SD=(t,e,r)=>ID(t,e,r)>0;kS.exports=SD});var Wl=S((R5,vS)=>{"use strict";var _D=wt(),wD=(t,e,r)=>_D(t,e,r)<0;vS.exports=wD});var Lm=S((k5,xS)=>{"use strict";var bD=wt(),RD=(t,e,r)=>bD(t,e,r)===0;xS.exports=RD});var Um=S((v5,OS)=>{"use strict";var kD=wt(),vD=(t,e,r)=>kD(t,e,r)!==0;OS.exports=vD});var Yl=S((x5,PS)=>{"use strict";var xD=wt(),OD=(t,e,r)=>xD(t,e,r)>=0;PS.exports=OD});var Xl=S((O5,NS)=>{"use strict";var PD=wt(),ND=(t,e,r)=>PD(t,e,r)<=0;NS.exports=ND});var $m=S((P5,MS)=>{"use strict";var MD=Lm(),DD=Um(),LD=na(),UD=Yl(),$D=Wl(),FD=Xl(),HD=(t,e,r,n)=>{switch(e){case"===":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t===r;case"!==":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t!==r;case"":case"=":case"==":return MD(t,r,n);case"!=":return DD(t,r,n);case">":return LD(t,r,n);case">=":return UD(t,r,n);case"<":return $D(t,r,n);case"<=":return FD(t,r,n);default:throw new TypeError(`Invalid operator: ${e}`)}};MS.exports=HD});var LS=S((N5,DS)=>{"use strict";var BD=Ue(),jD=Zr(),{safeRe:Jl,t:Ql}=oi(),zD=(t,e)=>{if(t instanceof BD)return t;if(typeof t=="number"&&(t=String(t)),typeof t!="string")return null;e=e||{};let r=null;if(!e.rtl)r=t.match(e.includePrerelease?Jl[Ql.COERCEFULL]:Jl[Ql.COERCE]);else{let l=e.includePrerelease?Jl[Ql.COERCERTLFULL]:Jl[Ql.COERCERTL],c;for(;(c=l.exec(t))&&(!r||r.index+r[0].length!==t.length);)(!r||c.index+c[0].length!==r.index+r[0].length)&&(r=c),l.lastIndex=c.index+c[1].length+c[2].length;l.lastIndex=-1}if(r===null)return null;let n=r[2],o=r[3]||"0",i=r[4]||"0",s=e.includePrerelease&&r[5]?`-${r[5]}`:"",a=e.includePrerelease&&r[6]?`+${r[6]}`:"";return jD(`${n}.${o}.${i}${s}${a}`,e)};DS.exports=zD});var $S=S((M5,US)=>{"use strict";var VD=Zr(),qD=ni(),GD=Ue(),KD=(t,e,r)=>{if(!qD.RELEASE_TYPES.includes(e))return null;let n=WD(t,r);return n&&YD(n,e)},WD=(t,e)=>{let r=t instanceof GD?t.version:t;return VD(r,e)},YD=(t,e)=>{if(XD(e))return t.version;switch(t.prerelease=[],e){case"major":t.minor=0,t.patch=0;break;case"minor":t.patch=0;break}return t.format()},XD=t=>t.startsWith("pre");US.exports=KD});var HS=S((D5,FS)=>{"use strict";var Fm=class{constructor(){this.max=1e3,this.map=new Map}get(e){let r=this.map.get(e);if(r!==void 0)return this.map.delete(e),this.map.set(e,r),r}delete(e){return this.map.delete(e)}set(e,r){if(!this.delete(e)&&r!==void 0){if(this.map.size>=this.max){let o=this.map.keys().next().value;this.delete(o)}this.map.set(e,r)}return this}};FS.exports=Fm});var bt=S((L5,VS)=>{"use strict";var JD=/\s+/g,Hm=class t{constructor(e,r){if(r=ZD(r),e instanceof t)return e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease?e:new t(e.raw,r);if(e instanceof Bm)return this.raw=e.value,this.set=[[e]],this.formatted=void 0,this;if(this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease,this.raw=e.trim().replace(JD," "),this.set=this.raw.split("||").map(n=>this.parseRange(n.trim())).filter(n=>n.length),!this.set.length)throw new TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let n=this.set[0];if(this.set=this.set.filter(o=>!jS(o[0])),this.set.length===0)this.set=[n];else if(this.set.length>1){for(let o of this.set)if(o.length===1&&cL(o[0])){this.set=[o];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let e=0;e<this.set.length;e++){e>0&&(this.formatted+="||");let r=this.set[e];for(let n=0;n<r.length;n++)n>0&&(this.formatted+=" "),this.formatted+=r[n].toString().trim()}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(e){e=e.replace(aL,"");let n=((this.options.includePrerelease&&iL)|(this.options.loose&&sL))+":"+e,o=BS.get(n);if(o)return o;let i=this.options.loose,s=i?We[$e.HYPHENRANGELOOSE]:We[$e.HYPHENRANGE];e=e.replace(s,TL(this.options.includePrerelease)),oe("hyphen replace",e),e=e.replace(We[$e.COMPARATORTRIM],rL),oe("comparator trim",e),e=e.replace(We[$e.TILDETRIM],nL),oe("tilde trim",e),e=e.replace(We[$e.CARETTRIM],oL),oe("caret trim",e);let a=e.split(" ").map(d=>lL(d,this.options)).join(" ").split(/\s+/).map(d=>EL(d,this.options));i&&(a=a.filter(d=>(oe("loose invalid filter",d,this.options),!!d.match(We[$e.COMPARATORLOOSE])))),oe("range list",a);let l=new Map,c=a.map(d=>new Bm(d,this.options));for(let d of c){if(jS(d))return[d];l.set(d.value,d)}l.size>1&&l.has("")&&l.delete("");let u=[...l.values()];return BS.set(n,u),u}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Range is required");return this.set.some(n=>zS(n,r)&&e.set.some(o=>zS(o,r)&&n.every(i=>o.every(s=>i.intersects(s,r)))))}test(e){if(!e)return!1;if(typeof e=="string")try{e=new eL(e,this.options)}catch{return!1}for(let r=0;r<this.set.length;r++)if(CL(this.set[r],e,this.options))return!0;return!1}};VS.exports=Hm;var QD=HS(),BS=new QD,ZD=jl(),Bm=oa(),oe=ra(),eL=Ue(),{safeRe:We,src:tL,t:$e,comparatorTrimReplace:rL,tildeTrimReplace:nL,caretTrimReplace:oL}=oi(),{FLAG_INCLUDE_PRERELEASE:iL,FLAG_LOOSE:sL}=ni(),aL=new RegExp(tL[$e.BUILD],"g"),jS=t=>t.value==="<0.0.0-0",cL=t=>t.value==="",zS=(t,e)=>{let r=!0,n=t.slice(),o=n.pop();for(;r&&n.length;)r=n.every(i=>o.intersects(i,e)),o=n.pop();return r},lL=(t,e)=>(t=t.replace(We[$e.BUILD],""),oe("comp",t,e),t=hL(t,e),oe("caret",t),t=dL(t,e),oe("tildes",t),t=mL(t,e),oe("xrange",t),t=yL(t,e),oe("stars",t),t),xe=t=>!t||t.toLowerCase()==="x"||t==="*",uL=(t,e,r)=>xe(t)&&!xe(e)||xe(e)&&r&&!xe(r),dL=(t,e)=>t.trim().split(/\s+/).map(r=>fL(r,e)).join(" "),fL=(t,e)=>{let r=e.loose?We[$e.TILDELOOSE]:We[$e.TILDE],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("tilde",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:l?(oe("replaceTilde pr",l),c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`):c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`,oe("tilde return",c),c})},hL=(t,e)=>t.trim().split(/\s+/).map(r=>pL(r,e)).join(" "),pL=(t,e)=>{oe("caret",t,e);let r=e.loose?We[$e.CARETLOOSE]:We[$e.CARET],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("caret",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?i==="0"?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.0${n} <${+i+1}.0.0-0`:l?(oe("replaceCaret pr",l),i==="0"?s==="0"?c=`>=${i}.${s}.${a}-${l} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a}-${l} <${+i+1}.0.0-0`):(oe("no pr"),i==="0"?s==="0"?c=`>=${i}.${s}.${a} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a} <${+i+1}.0.0-0`),oe("caret return",c),c})},mL=(t,e)=>(oe("replaceXRanges",t,e),t.split(/\s+/).map(r=>gL(r,e)).join(" ")),gL=(t,e)=>{t=t.trim();let r=e.loose?We[$e.XRANGELOOSE]:We[$e.XRANGE];return t.replace(r,(n,o,i,s,a,l)=>{if(oe("xRange",t,n,o,i,s,a,l),uL(i,s,a))return t;let c=xe(i),u=c||xe(s),d=u||xe(a),f=d;return o==="="&&f&&(o=""),l=e.includePrerelease?"-0":"",c?o===">"||o==="<"?n="<0.0.0-0":n="*":o&&f?(u&&(s=0),a=0,o===">"?(o=">=",u?(i=+i+1,s=0,a=0):(s=+s+1,a=0)):o==="<="&&(o="<",u?i=+i+1:s=+s+1),o==="<"&&(l="-0"),n=`${o+i}.${s}.${a}${l}`):u?n=`>=${i}.0.0${l} <${+i+1}.0.0-0`:d&&(n=`>=${i}.${s}.0${l} <${i}.${+s+1}.0-0`),oe("xRange return",n),n})},yL=(t,e)=>(oe("replaceStars",t,e),t.trim().replace(We[$e.STAR],"")),EL=(t,e)=>(oe("replaceGTE0",t,e),t.trim().replace(We[e.includePrerelease?$e.GTE0PRE:$e.GTE0],"")),TL=t=>(e,r,n,o,i,s,a,l,c,u,d,f)=>(xe(n)?r="":xe(o)?r=`>=${n}.0.0${t?"-0":""}`:xe(i)?r=`>=${n}.${o}.0${t?"-0":""}`:s?r=`>=${r}`:r=`>=${r}${t?"-0":""}`,xe(c)?l="":xe(u)?l=`<${+c+1}.0.0-0`:xe(d)?l=`<${c}.${+u+1}.0-0`:f?l=`<=${c}.${u}.${d}-${f}`:t?l=`<${c}.${u}.${+d+1}-0`:l=`<=${l}`,`${r} ${l}`.trim()),CL=(t,e,r)=>{for(let n=0;n<t.length;n++)if(!t[n].test(e))return!1;if(e.prerelease.length&&!r.includePrerelease){for(let n=0;n<t.length;n++)if(oe(t[n].semver),t[n].semver!==Bm.ANY&&t[n].semver.prerelease.length>0){let o=t[n].semver;if(o.major===e.major&&o.minor===e.minor&&o.patch===e.patch)return!0}return!1}return!0}});var oa=S((U5,XS)=>{"use strict";var ia=Symbol("SemVer ANY"),Vm=class t{static get ANY(){return ia}constructor(e,r){if(r=qS(r),e instanceof t){if(e.loose===!!r.loose)return e;e=e.value}e=e.trim().split(/\s+/).join(" "),zm("comparator",e,r),this.options=r,this.loose=!!r.loose,this.parse(e),this.semver===ia?this.value="":this.value=this.operator+this.semver.version,zm("comp",this)}parse(e){let r=this.options.loose?GS[KS.COMPARATORLOOSE]:GS[KS.COMPARATOR],n=e.match(r);if(!n)throw new TypeError(`Invalid comparator: ${e}`);this.operator=n[1]!==void 0?n[1]:"",this.operator==="="&&(this.operator=""),n[2]?this.semver=new WS(n[2],this.options.loose):this.semver=ia}toString(){return this.value}test(e){if(zm("Comparator.test",e,this.options.loose),this.semver===ia||e===ia)return!0;if(typeof e=="string")try{e=new WS(e,this.options)}catch{return!1}return jm(e,this.operator,this.semver,this.options)}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Comparator is required");return this.operator===""?this.value===""?!0:new YS(e.value,r).test(this.value):e.operator===""?e.value===""?!0:new YS(this.value,r).test(e.semver):(r=qS(r),r.includePrerelease&&(this.value==="<0.0.0-0"||e.value==="<0.0.0-0")||!r.includePrerelease&&(this.value.startsWith("<0.0.0")||e.value.startsWith("<0.0.0"))?!1:!!(this.operator.startsWith(">")&&e.operator.startsWith(">")||this.operator.startsWith("<")&&e.operator.startsWith("<")||this.semver.version===e.semver.version&&this.operator.includes("=")&&e.operator.includes("=")||jm(this.semver,"<",e.semver,r)&&this.operator.startsWith(">")&&e.operator.startsWith("<")||jm(this.semver,">",e.semver,r)&&this.operator.startsWith("<")&&e.operator.startsWith(">")))}};XS.exports=Vm;var qS=jl(),{safeRe:GS,t:KS}=oi(),jm=$m(),zm=ra(),WS=Ue(),YS=bt()});var sa=S(($5,JS)=>{"use strict";var AL=bt(),IL=(t,e,r)=>{try{e=new AL(e,r)}catch{return!1}return e.test(t)};JS.exports=IL});var ZS=S((F5,QS)=>{"use strict";var SL=bt(),_L=(t,e)=>new SL(t,e).set.map(r=>r.map(n=>n.value).join(" ").trim().split(" "));QS.exports=_L});var t_=S((H5,e_)=>{"use strict";var wL=Ue(),bL=bt(),RL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new bL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===-1)&&(n=s,o=new wL(n,r))}),n};e_.exports=RL});var n_=S((B5,r_)=>{"use strict";var kL=Ue(),vL=bt(),xL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new vL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===1)&&(n=s,o=new kL(n,r))}),n};r_.exports=xL});var s_=S((j5,i_)=>{"use strict";var qm=Ue(),OL=bt(),o_=na(),PL=(t,e)=>{t=new OL(t,e);let r=new qm("0.0.0");if(t.test(r)||(r=new qm("0.0.0-0"),t.test(r)))return r;r=null;for(let n=0;n<t.set.length;++n){let o=t.set[n],i=null;o.forEach(s=>{let a=new qm(s.semver.version);switch(s.operator){case">":a.prerelease.length===0?a.patch++:a.prerelease.push(0),a.raw=a.format();case"":case">=":(!i||o_(a,i))&&(i=a);break;case"<":case"<=":break;default:throw new Error(`Unexpected operation: ${s.operator}`)}}),i&&(!r||o_(r,i))&&(r=i)}return r&&t.test(r)?r:null};i_.exports=PL});var c_=S((z5,a_)=>{"use strict";var NL=bt(),ML=(t,e)=>{try{return new NL(t,e).range||"*"}catch{return null}};a_.exports=ML});var Zl=S((V5,f_)=>{"use strict";var DL=Ue(),d_=oa(),{ANY:LL}=d_,UL=bt(),$L=sa(),l_=na(),u_=Wl(),FL=Xl(),HL=Yl(),BL=(t,e,r,n)=>{t=new DL(t,n),e=new UL(e,n);let o,i,s,a,l;switch(r){case">":o=l_,i=FL,s=u_,a=">",l=">=";break;case"<":o=u_,i=HL,s=l_,a="<",l="<=";break;default:throw new TypeError('Must provide a hilo val of "<" or ">"')}if($L(t,e,n))return!1;for(let c=0;c<e.set.length;++c){let u=e.set[c],d=null,f=null;if(u.forEach(p=>{p.semver===LL&&(p=new d_(">=0.0.0")),d=d||p,f=f||p,o(p.semver,d.semver,n)?d=p:s(p.semver,f.semver,n)&&(f=p)}),d.operator===a||d.operator===l||(!f.operator||f.operator===a)&&i(t,f.semver))return!1;if(f.operator===l&&s(t,f.semver))return!1}return!0};f_.exports=BL});var p_=S((q5,h_)=>{"use strict";var jL=Zl(),zL=(t,e,r)=>jL(t,e,">",r);h_.exports=zL});var g_=S((G5,m_)=>{"use strict";var VL=Zl(),qL=(t,e,r)=>VL(t,e,"<",r);m_.exports=qL});var T_=S((K5,E_)=>{"use strict";var y_=bt(),GL=(t,e,r)=>(t=new y_(t,r),e=new y_(e,r),t.intersects(e,r));E_.exports=GL});var A_=S((W5,C_)=>{"use strict";var KL=sa(),WL=wt();C_.exports=(t,e,r)=>{let n=[],o=null,i=null,s=t.sort((u,d)=>WL(u,d,r));for(let u of s)KL(u,e,r)?(i=u,o||(o=u)):(i&&n.push([o,i]),i=null,o=null);o&&n.push([o,null]);let a=[];for(let[u,d]of n)u===d?a.push(u):!d&&u===s[0]?a.push("*"):d?u===s[0]?a.push(`<=${d}`):a.push(`${u} - ${d}`):a.push(`>=${u}`);let l=a.join(" || "),c=typeof e.raw=="string"?e.raw:String(e);return l.length<c.length?l:e}});var R_=S((Y5,b_)=>{"use strict";var I_=bt(),Wm=oa(),{ANY:Gm}=Wm,Km=sa(),Ym=wt(),YL=(t,e,r={})=>{if(t===e)return!0;t=new I_(t,r),e=new I_(e,r);let n=!1;e:for(let o of t.set){for(let i of e.set){let s=JL(o,i,r);if(n=n||s!==null,s)continue e}if(n)return!1}return!0},XL=[new Wm(">=0.0.0-0")],S_=[new Wm(">=0.0.0")],JL=(t,e,r)=>{if(t===e)return!0;if(t.length===1&&t[0].semver===Gm){if(e.length===1&&e[0].semver===Gm)return!0;r.includePrerelease?t=XL:t=S_}if(e.length===1&&e[0].semver===Gm){if(r.includePrerelease)return!0;e=S_}let n=new Set,o,i;for(let p of t)p.operator===">"||p.operator===">="?o=__(o,p,r):p.operator==="<"||p.operator==="<="?i=w_(i,p,r):n.add(p.semver);if(n.size>1)return null;let s;if(o&&i){if(s=Ym(o.semver,i.semver,r),s>0)return null;if(s===0&&(o.operator!==">="||i.operator!=="<="))return null}for(let p of n){if(o&&!Km(p,String(o),r)||i&&!Km(p,String(i),r))return null;for(let g of e)if(!Km(p,String(g),r))return!1;return!0}let a,l,c,u,d=i&&!r.includePrerelease&&i.semver.prerelease.length?i.semver:!1,f=o&&!r.includePrerelease&&o.semver.prerelease.length?o.semver:!1;d&&d.prerelease.length===1&&i.operator==="<"&&d.prerelease[0]===0&&(d=!1);for(let p of e){if(u=u||p.operator===">"||p.operator===">=",c=c||p.operator==="<"||p.operator==="<=",o){if(f&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===f.major&&p.semver.minor===f.minor&&p.semver.patch===f.patch&&(f=!1),p.operator===">"||p.operator===">="){if(a=__(o,p,r),a===p&&a!==o)return!1}else if(o.operator===">="&&!p.test(o.semver))return!1}if(i){if(d&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===d.major&&p.semver.minor===d.minor&&p.semver.patch===d.patch&&(d=!1),p.operator==="<"||p.operator==="<="){if(l=w_(i,p,r),l===p&&l!==i)return!1}else if(i.operator==="<="&&!p.test(i.semver))return!1}if(!p.operator&&(i||o)&&s!==0)return!1}return!(o&&c&&!i&&s!==0||i&&u&&!o&&s!==0||f||d)},__=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n>0?t:n<0||e.operator===">"&&t.operator===">="?e:t},w_=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n<0?t:n>0||e.operator==="<"&&t.operator==="<="?e:t};b_.exports=YL});var eu=S((X5,x_)=>{"use strict";var Xm=oi(),k_=ni(),QL=Ue(),v_=Nm(),ZL=Zr(),eU=ZI(),tU=tS(),rU=oS(),nU=aS(),oU=lS(),iU=dS(),sU=hS(),aU=mS(),cU=wt(),lU=TS(),uU=AS(),dU=Kl(),fU=wS(),hU=RS(),pU=na(),mU=Wl(),gU=Lm(),yU=Um(),EU=Yl(),TU=Xl(),CU=$m(),AU=LS(),IU=$S(),SU=oa(),_U=bt(),wU=sa(),bU=ZS(),RU=t_(),kU=n_(),vU=s_(),xU=c_(),OU=Zl(),PU=p_(),NU=g_(),MU=T_(),DU=A_(),LU=R_();x_.exports={parse:ZL,valid:eU,clean:tU,inc:rU,diff:nU,major:oU,minor:iU,patch:sU,prerelease:aU,compare:cU,rcompare:lU,compareLoose:uU,compareBuild:dU,sort:fU,rsort:hU,gt:pU,lt:mU,eq:gU,neq:yU,gte:EU,lte:TU,cmp:CU,coerce:AU,truncate:IU,Comparator:SU,Range:_U,satisfies:wU,toComparators:bU,maxSatisfying:RU,minSatisfying:kU,minVersion:vU,validRange:xU,outside:OU,gtr:PU,ltr:NU,intersects:MU,simplifyRange:DU,subset:LU,SemVer:QL,re:Xm.re,src:Xm.src,tokens:Xm.t,SEMVER_SPEC_VERSION:k_.SEMVER_SPEC_VERSION,RELEASE_TYPES:k_.RELEASE_TYPES,compareIdentifiers:v_.compareIdentifiers,rcompareIdentifiers:v_.rcompareIdentifiers}});var P_=S((J5,O_)=>{var UU=eu();O_.exports=UU.satisfies(process.version,">=15.7.0")});var M_=S((Q5,N_)=>{var $U=eu();N_.exports=$U.satisfies(process.version,">=16.9.0")});var Jm=S((Z5,D_)=>{var FU=P_(),HU=M_(),BU={ec:["ES256","ES384","ES512"],rsa:["RS256","PS256","RS384","PS384","RS512","PS512"],"rsa-pss":["PS256","PS384","PS512"]},jU={ES256:"prime256v1",ES384:"secp384r1",ES512:"secp521r1"};D_.exports=function(t,e){if(!t||!e)return;let r=e.asymmetricKeyType;if(!r)return;let n=BU[r];if(!n)throw new Error(`Unknown key type "${r}".`);if(!n.includes(t))throw new Error(`"alg" parameter for "${r}" key type must be one of: ${n.join(", ")}.`);if(FU)switch(r){case"ec":let o=e.asymmetricKeyDetails.namedCurve,i=jU[t];if(o!==i)throw new Error(`"alg" parameter "${t}" requires curve "${i}".`);break;case"rsa-pss":if(HU){let s=parseInt(t.slice(-3),10),{hashAlgorithm:a,mgf1HashAlgorithm:l,saltLength:c}=e.asymmetricKeyDetails;if(a!==`sha${s}`||l!==a)throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${t}.`);if(c!==void 0&&c>s>>3)throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${t}.`)}break}}});var Qm=S((e8,L_)=>{var zU=eu();L_.exports=zU.satisfies(process.version,"^6.12.0 || >=8.0.0")});var F_=S((t8,$_)=>{var re=ta(),VU=Rm(),U_=km(),qU=bm(),GU=xm(),KU=Jm(),WU=Qm(),YU=Ul(),{KeyObject:XU,createSecretKey:JU,createPublicKey:QU}=L("crypto"),Zm=["RS256","RS384","RS512"],ZU=["ES256","ES384","ES512"],eg=["RS256","RS384","RS512"],e$=["HS256","HS384","HS512"];WU&&(Zm.splice(Zm.length,0,"PS256","PS384","PS512"),eg.splice(eg.length,0,"PS256","PS384","PS512"));$_.exports=function(t,e,r,n){typeof r=="function"&&!n&&(n=r,r={}),r||(r={}),r=Object.assign({},r);let o;if(n?o=n:o=function(u,d){if(u)throw u;return d},r.clockTimestamp&&typeof r.clockTimestamp!="number")return o(new re("clockTimestamp must be a number"));if(r.nonce!==void 0&&(typeof r.nonce!="string"||r.nonce.trim()===""))return o(new re("nonce must be a non-empty string"));if(r.allowInvalidAsymmetricKeyTypes!==void 0&&typeof r.allowInvalidAsymmetricKeyTypes!="boolean")return o(new re("allowInvalidAsymmetricKeyTypes must be a boolean"));let i=r.clockTimestamp||Math.floor(Date.now()/1e3);if(!t)return o(new re("jwt must be provided"));if(typeof t!="string")return o(new re("jwt must be a string"));let s=t.split(".");if(s.length!==3)return o(new re("jwt malformed"));let a;try{a=qU(t,{complete:!0})}catch(u){return o(u)}if(!a)return o(new re("invalid token"));let l=a.header,c;if(typeof e=="function"){if(!n)return o(new re("verify must be called asynchronous if secret or public key is provided as a callback"));c=e}else c=function(u,d){return d(null,e)};return c(l,function(u,d){if(u)return o(new re("error in secret or public key callback: "+u.message));let f=s[2].trim()!=="";if(!f&&d)return o(new re("jwt signature is required"));if(f&&!d)return o(new re("secret or public key must be provided"));if(!f&&!r.algorithms)return o(new re('please specify "none" in "algorithms" to verify unsigned tokens'));if(d!=null&&!(d instanceof XU))try{d=QU(d)}catch{try{d=JU(typeof d=="string"?Buffer.from(d):d)}catch{return o(new re("secretOrPublicKey is not valid key material"))}}if(r.algorithms||(d.type==="secret"?r.algorithms=e$:["rsa","rsa-pss"].includes(d.asymmetricKeyType)?r.algorithms=eg:d.asymmetricKeyType==="ec"?r.algorithms=ZU:r.algorithms=Zm),r.algorithms.indexOf(a.header.alg)===-1)return o(new re("invalid algorithm"));if(l.alg.startsWith("HS")&&d.type!=="secret")return o(new re(`secretOrPublicKey must be a symmetric key when using ${l.alg}`));if(/^(?:RS|PS|ES)/.test(l.alg)&&d.type!=="public")return o(new re(`secretOrPublicKey must be an asymmetric key when using ${l.alg}`));if(!r.allowInvalidAsymmetricKeyTypes)try{KU(l.alg,d)}catch(m){return o(m)}let p;try{p=YU.verify(t,a.header.alg,d)}catch(m){return o(m)}if(!p)return o(new re("invalid signature"));let g=a.payload;if(typeof g.nbf<"u"&&!r.ignoreNotBefore){if(typeof g.nbf!="number")return o(new re("invalid nbf value"));if(g.nbf>i+(r.clockTolerance||0))return o(new VU("jwt not active",new Date(g.nbf*1e3)))}if(typeof g.exp<"u"&&!r.ignoreExpiration){if(typeof g.exp!="number")return o(new re("invalid exp value"));if(i>=g.exp+(r.clockTolerance||0))return o(new U_("jwt expired",new Date(g.exp*1e3)))}if(r.audience){let m=Array.isArray(r.audience)?r.audience:[r.audience];if(!(Array.isArray(g.aud)?g.aud:[g.aud]).some(function(T){return m.some(function(C){return C instanceof RegExp?C.test(T):C===T})}))return o(new re("jwt audience invalid. expected: "+m.join(" or ")))}if(r.issuer&&(typeof r.issuer=="string"&&g.iss!==r.issuer||Array.isArray(r.issuer)&&r.issuer.indexOf(g.iss)===-1))return o(new re("jwt issuer invalid. expected: "+r.issuer));if(r.subject&&g.sub!==r.subject)return o(new re("jwt subject invalid. expected: "+r.subject));if(r.jwtid&&g.jti!==r.jwtid)return o(new re("jwt jwtid invalid. expected: "+r.jwtid));if(r.nonce&&g.nonce!==r.nonce)return o(new re("jwt nonce invalid. expected: "+r.nonce));if(r.maxAge){if(typeof g.iat!="number")return o(new re("iat required when maxAge is specified"));let m=GU(r.maxAge,g.iat);if(typeof m>"u")return o(new re('"maxAge" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));if(i>=m+(r.clockTolerance||0))return o(new U_("maxAge exceeded",new Date(m*1e3)))}if(r.complete===!0){let m=a.signature;return o(null,{header:l,payload:g,signature:m})}return o(null,g)})}});var q_=S((r8,V_)=>{var H_=1/0,j_=9007199254740991,t$=17976931348623157e292,B_=NaN,r$="[object Arguments]",n$="[object Function]",o$="[object GeneratorFunction]",i$="[object String]",s$="[object Symbol]",a$=/^\s+|\s+$/g,c$=/^[-+]0x[0-9a-f]+$/i,l$=/^0b[01]+$/i,u$=/^0o[0-7]+$/i,d$=/^(?:0|[1-9]\d*)$/,f$=parseInt;function h$(t,e){for(var r=-1,n=t?t.length:0,o=Array(n);++r<n;)o[r]=e(t[r],r,t);return o}function p$(t,e,r,n){for(var o=t.length,i=r+(n?1:-1);n?i--:++i<o;)if(e(t[i],i,t))return i;return-1}function m$(t,e,r){if(e!==e)return p$(t,g$,r);for(var n=r-1,o=t.length;++n<o;)if(t[n]===e)return n;return-1}function g$(t){return t!==t}function y$(t,e){for(var r=-1,n=Array(t);++r<t;)n[r]=e(r);return n}function E$(t,e){return h$(e,function(r){return t[r]})}function T$(t,e){return function(r){return t(e(r))}}var tu=Object.prototype,rg=tu.hasOwnProperty,ru=tu.toString,C$=tu.propertyIsEnumerable,A$=T$(Object.keys,Object),I$=Math.max;function S$(t,e){var r=z_(t)||k$(t)?y$(t.length,String):[],n=r.length,o=!!n;for(var i in t)(e||rg.call(t,i))&&!(o&&(i=="length"||w$(i,n)))&&r.push(i);return r}function _$(t){if(!b$(t))return A$(t);var e=[];for(var r in Object(t))rg.call(t,r)&&r!="constructor"&&e.push(r);return e}function w$(t,e){return e=e??j_,!!e&&(typeof t=="number"||d$.test(t))&&t>-1&&t%1==0&&t<e}function b$(t){var e=t&&t.constructor,r=typeof e=="function"&&e.prototype||tu;return t===r}function R$(t,e,r,n){t=ng(t)?t:$$(t),r=r&&!n?D$(r):0;var o=t.length;return r<0&&(r=I$(o+r,0)),P$(t)?r<=o&&t.indexOf(e,r)>-1:!!o&&m$(t,e,r)>-1}function k$(t){return v$(t)&&rg.call(t,"callee")&&(!C$.call(t,"callee")||ru.call(t)==r$)}var z_=Array.isArray;function ng(t){return t!=null&&O$(t.length)&&!x$(t)}function v$(t){return og(t)&&ng(t)}function x$(t){var e=tg(t)?ru.call(t):"";return e==n$||e==o$}function O$(t){return typeof t=="number"&&t>-1&&t%1==0&&t<=j_}function tg(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function og(t){return!!t&&typeof t=="object"}function P$(t){return typeof t=="string"||!z_(t)&&og(t)&&ru.call(t)==i$}function N$(t){return typeof t=="symbol"||og(t)&&ru.call(t)==s$}function M$(t){if(!t)return t===0?t:0;if(t=L$(t),t===H_||t===-H_){var e=t<0?-1:1;return e*t$}return t===t?t:0}function D$(t){var e=M$(t),r=e%1;return e===e?r?e-r:e:0}function L$(t){if(typeof t=="number")return t;if(N$(t))return B_;if(tg(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=tg(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(a$,"");var r=l$.test(t);return r||u$.test(t)?f$(t.slice(2),r?2:8):c$.test(t)?B_:+t}function U$(t){return ng(t)?S$(t):_$(t)}function $$(t){return t?E$(t,U$(t)):[]}V_.exports=R$});var K_=S((n8,G_)=>{var F$="[object Boolean]",H$=Object.prototype,B$=H$.toString;function j$(t){return t===!0||t===!1||z$(t)&&B$.call(t)==F$}function z$(t){return!!t&&typeof t=="object"}G_.exports=j$});var Q_=S((o8,J_)=>{var W_=1/0,V$=17976931348623157e292,Y_=NaN,q$="[object Symbol]",G$=/^\s+|\s+$/g,K$=/^[-+]0x[0-9a-f]+$/i,W$=/^0b[01]+$/i,Y$=/^0o[0-7]+$/i,X$=parseInt,J$=Object.prototype,Q$=J$.toString;function Z$(t){return typeof t=="number"&&t==nF(t)}function X_(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function eF(t){return!!t&&typeof t=="object"}function tF(t){return typeof t=="symbol"||eF(t)&&Q$.call(t)==q$}function rF(t){if(!t)return t===0?t:0;if(t=oF(t),t===W_||t===-W_){var e=t<0?-1:1;return e*V$}return t===t?t:0}function nF(t){var e=rF(t),r=e%1;return e===e?r?e-r:e:0}function oF(t){if(typeof t=="number")return t;if(tF(t))return Y_;if(X_(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=X_(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(G$,"");var r=W$.test(t);return r||Y$.test(t)?X$(t.slice(2),r?2:8):K$.test(t)?Y_:+t}J_.exports=Z$});var ew=S((i8,Z_)=>{var iF="[object Number]",sF=Object.prototype,aF=sF.toString;function cF(t){return!!t&&typeof t=="object"}function lF(t){return typeof t=="number"||cF(t)&&aF.call(t)==iF}Z_.exports=lF});var ow=S((s8,nw)=>{var uF="[object Object]";function dF(t){var e=!1;if(t!=null&&typeof t.toString!="function")try{e=!!(t+"")}catch{}return e}function fF(t,e){return function(r){return t(e(r))}}var hF=Function.prototype,tw=Object.prototype,rw=hF.toString,pF=tw.hasOwnProperty,mF=rw.call(Object),gF=tw.toString,yF=fF(Object.getPrototypeOf,Object);function EF(t){return!!t&&typeof t=="object"}function TF(t){if(!EF(t)||gF.call(t)!=uF||dF(t))return!1;var e=yF(t);if(e===null)return!0;var r=pF.call(e,"constructor")&&e.constructor;return typeof r=="function"&&r instanceof r&&rw.call(r)==mF}nw.exports=TF});var sw=S((a8,iw)=>{var CF="[object String]",AF=Object.prototype,IF=AF.toString,SF=Array.isArray;function _F(t){return!!t&&typeof t=="object"}function wF(t){return typeof t=="string"||!SF(t)&&_F(t)&&IF.call(t)==CF}iw.exports=wF});var dw=S((c8,uw)=>{var bF="Expected a function",aw=1/0,RF=17976931348623157e292,cw=NaN,kF="[object Symbol]",vF=/^\s+|\s+$/g,xF=/^[-+]0x[0-9a-f]+$/i,OF=/^0b[01]+$/i,PF=/^0o[0-7]+$/i,NF=parseInt,MF=Object.prototype,DF=MF.toString;function LF(t,e){var r;if(typeof e!="function")throw new TypeError(bF);return t=BF(t),function(){return--t>0&&(r=e.apply(this,arguments)),t<=1&&(e=void 0),r}}function UF(t){return LF(2,t)}function lw(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function $F(t){return!!t&&typeof t=="object"}function FF(t){return typeof t=="symbol"||$F(t)&&DF.call(t)==kF}function HF(t){if(!t)return t===0?t:0;if(t=jF(t),t===aw||t===-aw){var e=t<0?-1:1;return e*RF}return t===t?t:0}function BF(t){var e=HF(t),r=e%1;return e===e?r?e-r:e:0}function jF(t){if(typeof t=="number")return t;if(FF(t))return cw;if(lw(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=lw(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(vF,"");var r=OF.test(t);return r||PF.test(t)?NF(t.slice(2),r?2:8):xF.test(t)?cw:+t}uw.exports=UF});var Cw=S((l8,Tw)=>{var fw=xm(),zF=Qm(),VF=Jm(),hw=Ul(),qF=q_(),nu=K_(),pw=Q_(),ig=ew(),gw=ow(),en=sw(),GF=dw(),{KeyObject:KF,createSecretKey:WF,createPrivateKey:YF}=L("crypto"),yw=["RS256","RS384","RS512","ES256","ES384","ES512","HS256","HS384","HS512","none"];zF&&yw.splice(3,0,"PS256","PS384","PS512");var XF={expiresIn:{isValid:function(t){return pw(t)||en(t)&&t},message:'"expiresIn" should be a number of seconds or string representing a timespan'},notBefore:{isValid:function(t){return pw(t)||en(t)&&t},message:'"notBefore" should be a number of seconds or string representing a timespan'},audience:{isValid:function(t){return en(t)||Array.isArray(t)},message:'"audience" must be a string or array'},algorithm:{isValid:qF.bind(null,yw),message:'"algorithm" must be a valid string enum value'},header:{isValid:gw,message:'"header" must be an object'},encoding:{isValid:en,message:'"encoding" must be a string'},issuer:{isValid:en,message:'"issuer" must be a string'},subject:{isValid:en,message:'"subject" must be a string'},jwtid:{isValid:en,message:'"jwtid" must be a string'},noTimestamp:{isValid:nu,message:'"noTimestamp" must be a boolean'},keyid:{isValid:en,message:'"keyid" must be a string'},mutatePayload:{isValid:nu,message:'"mutatePayload" must be a boolean'},allowInsecureKeySizes:{isValid:nu,message:'"allowInsecureKeySizes" must be a boolean'},allowInvalidAsymmetricKeyTypes:{isValid:nu,message:'"allowInvalidAsymmetricKeyTypes" must be a boolean'}},JF={iat:{isValid:ig,message:'"iat" should be a number of seconds'},exp:{isValid:ig,message:'"exp" should be a number of seconds'},nbf:{isValid:ig,message:'"nbf" should be a number of seconds'}};function Ew(t,e,r,n){if(!gw(r))throw new Error('Expected "'+n+'" to be a plain object.');Object.keys(r).forEach(function(o){let i=t[o];if(!i){if(!e)throw new Error('"'+o+'" is not allowed in "'+n+'"');return}if(!i.isValid(r[o]))throw new Error(i.message)})}function QF(t){return Ew(XF,!1,t,"options")}function ZF(t){return Ew(JF,!0,t,"payload")}var mw={audience:"aud",issuer:"iss",subject:"sub",jwtid:"jti"},eH=["expiresIn","notBefore","noTimestamp","audience","issuer","subject","jwtid"];Tw.exports=function(t,e,r,n){typeof r=="function"?(n=r,r={}):r=r||{};let o=typeof t=="object"&&!Buffer.isBuffer(t),i=Object.assign({alg:r.algorithm||"HS256",typ:o?"JWT":void 0,kid:r.keyid},r.header);function s(c){if(n)return n(c);throw c}if(!e&&r.algorithm!=="none")return s(new Error("secretOrPrivateKey must have a value"));if(e!=null&&!(e instanceof KF))try{e=YF(e)}catch{try{e=WF(typeof e=="string"?Buffer.from(e):e)}catch{return s(new Error("secretOrPrivateKey is not valid key material"))}}if(i.alg.startsWith("HS")&&e.type!=="secret")return s(new Error(`secretOrPrivateKey must be a symmetric key when using ${i.alg}`));if(/^(?:RS|PS|ES)/.test(i.alg)){if(e.type!=="private")return s(new Error(`secretOrPrivateKey must be an asymmetric key when using ${i.alg}`));if(!r.allowInsecureKeySizes&&!i.alg.startsWith("ES")&&e.asymmetricKeyDetails!==void 0&&e.asymmetricKeyDetails.modulusLength<2048)return s(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`))}if(typeof t>"u")return s(new Error("payload is required"));if(o){try{ZF(t)}catch(c){return s(c)}r.mutatePayload||(t=Object.assign({},t))}else{let c=eH.filter(function(u){return typeof r[u]<"u"});if(c.length>0)return s(new Error("invalid "+c.join(",")+" option for "+typeof t+" payload"))}if(typeof t.exp<"u"&&typeof r.expiresIn<"u")return s(new Error('Bad "options.expiresIn" option the payload already has an "exp" property.'));if(typeof t.nbf<"u"&&typeof r.notBefore<"u")return s(new Error('Bad "options.notBefore" option the payload already has an "nbf" property.'));try{QF(r)}catch(c){return s(c)}if(!r.allowInvalidAsymmetricKeyTypes)try{VF(i.alg,e)}catch(c){return s(c)}let a=t.iat||Math.floor(Date.now()/1e3);if(r.noTimestamp?delete t.iat:o&&(t.iat=a),typeof r.notBefore<"u"){try{t.nbf=fw(r.notBefore,a)}catch(c){return s(c)}if(typeof t.nbf>"u")return s(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}if(typeof r.expiresIn<"u"&&typeof t=="object"){try{t.exp=fw(r.expiresIn,a)}catch(c){return s(c)}if(typeof t.exp>"u")return s(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}Object.keys(mw).forEach(function(c){let u=mw[c];if(typeof r[c]<"u"){if(typeof t[u]<"u")return s(new Error('Bad "options.'+c+'" option. The payload already has an "'+u+'" property.'));t[u]=r[c]}});let l=r.encoding||"utf8";if(typeof n=="function")n=n&&GF(n),hw.createSign({header:i,privateKey:e,payload:t,encoding:l}).once("error",n).once("done",function(c){if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)return n(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`));n(null,c)});else{let c=hw.sign({header:i,payload:t,secret:e,encoding:l});if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)throw new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`);return c}}});var Iw=S((u8,Aw)=>{Aw.exports={decode:bm(),verify:F_(),sign:Cw(),JsonWebTokenError:ta(),NotBeforeError:Rm(),TokenExpiredError:km()}});var Sw,_w,ww,sg,bw,Rw,kw,vw,xw,Ow,ou=h(()=>{"use strict";Sw="missing_tenant_id_error",_w="user_timeout_reached",ww="invalid_assertion",sg="invalid_client_credential",bw="empty_fic_assertion",Rw="conflicting_user_identifiers",kw="missing_user_identifier",vw="device_code_polling_cancelled",xw="device_code_expired",Ow="device_code_unknown_error"});var Pw,wr,iu=h(()=>{"use strict";Pw=at(Iw(),1);W();Ys();J();ou();wr=class t{static fromAssertion(e){let r=new t;return r.jwt=e,r}static fromCertificate(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!1,n&&(o.publicCertificate=this.parseCertificate(n)),o}static fromCertificateWithSha256Thumbprint(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!0,n&&(o.publicCertificate=this.parseCertificate(n)),o}getJwt(e,r,n){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&r===this.issuer&&n===this.jwtAudience?this.jwt:this.createJwt(e,r,n);if(this.jwt)return this.jwt;throw E(ww,"")}createJwt(e,r,n){this.issuer=r,this.jwtAudience=n;let o=Z.nowSeconds();this.expirationTime=o+600;let s={alg:this.useSha256?St.PSS_256:St.RSA_256},a=this.useSha256?St.X5T_256:St.X5T;Object.assign(s,{[a]:ft.base64EncodeUrl(this.thumbprint,A.EncodingTypes.HEX)}),this.publicCertificate&&Object.assign(s,{[St.X5C]:this.publicCertificate});let l={[St.AUDIENCE]:this.jwtAudience,[St.EXPIRATION_TIME]:this.expirationTime,[St.ISSUER]:this.issuer,[St.SUBJECT]:this.issuer,[St.NOT_BEFORE]:o,[St.JWT_ID]:e.createNewGuid()};return this.jwt=Pw.default.sign(l,this.privateKey,{header:s}),this.jwt}isExpired(){return this.expirationTime<Z.nowSeconds()}static parseCertificate(e){let r=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,n=[],o;for(;(o=r.exec(e))!==null;)n.push(o[1].replace(/\r*\n/g,""));return n}}});var ii,Ye,tn=h(()=>{"use strict";ii="@azure/msal-node",Ye="5.3.0"});var Rt,si=h(()=>{"use strict";W();tn();Rt=class{constructor(e){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,ii,Ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=new Te}createTokenRequestHeaders(e){return Dn.createTokenRequestHeaders(this.logger,!1,e)}async executePostToTokenEndpoint(e,r,n,o,i){return Dn.executePostToTokenEndpoint(e,r,n,o,i,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async sendPostRequest(e,r,n,o){return Dn.sendPostRequest(e,r,n,o,this.cacheManager,this.networkClient,this.logger,this.performanceClient)}createTokenQueryParameters(e){return Dn.createTokenQueryParameters(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient)}}});var su,Nw=h(()=>{"use strict";W();J();si();su=class extends Rt{constructor(e){super(e)}async acquireToken(e){this.logger.info("in acquireToken call in username-password client",e.correlationId);let r=Z.nowSeconds(),n=await this.executeTokenRequest(this.authority,e),o=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return o.validateTokenResponse(n.body,e.correlationId),o.handleServerTokenResponse(n.body,this.authority,r,e,te.acquireTokenByUsernamePassword)}async executeTokenRequest(e,r){let n=this.createTokenQueryParameters(r),o=j.appendQueryString(e.tokenEndpoint,n),i=await this.createTokenRequestBody(r),s=this.createTokenRequestHeaders({credential:r.username,type:Ge.UPN}),a={clientId:this.config.authOptions.clientId,authority:e.canonicalAuthority,scopes:r.scopes,claims:r.claims,authenticationScheme:r.authenticationScheme,resourceRequestMethod:r.resourceRequestMethod,resourceRequestUri:r.resourceRequestUri,shrClaims:r.shrClaims,sshKid:r.sshKid};return this.executePostToTokenEndpoint(o,i,s,a,r.correlationId)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addUsername(r,e.username),b.addPassword(r,e.password),b.addScopes(r,e.scopes,e.correlationId),b.addResponseType(r,A.OAuthResponseType.IDTOKEN_TOKEN),b.addGrantType(r,A.GrantType.RESOURCE_OWNER_PASSWORD_GRANT),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.username&&b.addCcsUpn(r,e.username),ke.mapToQueryString(r)}}});function Mw(t,e,r,n){let o=Gs.getStandardAuthorizeRequestParameters({...t.auth,authority:e,redirectUri:r.redirectUri||""},r,n);return b.addLibraryInfo(o,{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""}),t.system.protocolMode!==je.OIDC&&b.addApplicationTelemetry(o,t.telemetry.application),b.addResponseType(o,A.OAuthResponseType.CODE),r.codeChallenge&&r.codeChallengeMethod&&b.addCodeChallengeParams(o,r.codeChallenge,r.codeChallengeMethod),b.addExtraParameters(o,r.extraQueryParameters||{}),Gs.getAuthorizeUrl(e,o)}var Dw=h(()=>{"use strict";W();J();tn();});var ai,ag=h(()=>{"use strict";W();hm();Xs();Rl();J();mm();iu();tn();Ws();Nw();Dw();ai=class{constructor(e){this.config=HA(e),this.cryptoProvider=new Jt,this.logger=new ve(this.config.system.loggerOptions,ii,Ye),this.storage=new Jr(this.logger,this.config.auth.clientId,this.cryptoProvider,im(this.config.auth)),this.tokenCache=new Yo(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||A.ResponseMode.QUERY,authenticationScheme:A.AuthenticationScheme.BEARER,state:e.state||"",nonce:e.nonce||""},n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions);return Mw(this.config,n,r,this.logger)}async acquireTokenByCode(e,r){this.logger.info("acquireTokenByCode called",e.correlationId||""),e.state&&r&&(this.logger.info("acquireTokenByCode - validating state",e.correlationId||""),this.validateState(e.state,r.state||"",e.correlationId||""),r={...r,state:""});let n={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},o=this.initializeServerTelemetryManager(te.acquireTokenByCode,n.correlationId);try{let i=await this.createAuthority(n.authority,n.correlationId,void 0,e.azureCloudOptions),s=await this.buildOauthClientConfiguration(i,n.correlationId,n.redirectUri,o),a=new Vs(s,new Te);return this.logger.verbose("Auth code client created",n.correlationId),await a.acquireToken(n,te.acquireTokenByCode,r)}catch(i){throw i instanceof H&&(i.correlationId=n.correlationId),o.cacheFailedRequest(i),i}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},n=this.initializeServerTelemetryManager(te.acquireTokenByRefreshToken,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new Ln(i,new Te);return this.logger.verbose("Refresh token client created",r.correlationId),await s.acquireToken(r,te.acquireTokenByRefreshToken)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenSilent(e){let r={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},n=this.initializeServerTelemetryManager(te.acquireTokenSilent,r.correlationId,r.forceRefresh);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new qs(i,new Te);this.logger.verbose("Silent flow client created",r.correlationId);try{return await this.tokenCache.overwriteCache(),await this.acquireCachedTokenSilent(r,s,i)}catch(a){if(a instanceof zr&&a.errorCode===me.tokenRefreshRequired)return new Ln(i,new Te).acquireTokenByRefreshToken(r,te.acquireTokenSilent);throw a}}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireCachedTokenSilent(e,r,n){let[o,i]=await r.acquireCachedToken({...e,scopes:e.scopes?.length?e.scopes:[...A.OIDC_DEFAULT_SCOPES]});if(i===A.CacheOutcome.PROACTIVELY_REFRESHED){this.logger.info("ClientApplication:acquireCachedTokenSilent - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId);let s=new Ln(n,new Te);try{await s.acquireTokenByRefreshToken(e,te.acquireTokenSilent)}catch{}}return o}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)},n=this.initializeServerTelemetryManager(te.acquireTokenByUsernamePassword,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new su(i);return this.logger.verbose("Username password client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}getTokenCache(){return this.logger.info("getTokenCache called",""),this.tokenCache}validateState(e,r,n){if(!e)throw ze.createStateNotFoundError(n);if(e!==r)throw E(me.stateMismatch,n)}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,r,n,o){return this.logger.verbose("buildOauthClientConfiguration called",r),this.logger.info(`Building oauth client configuration with the following authority: ${e.tokenEndpoint}.`,r),o?.updateRegionDiscoveryMetadata(e.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:e,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:n,isMcp:this.config.auth.isMcp},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:r},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:o,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:await this.getClientAssertion(e)},libraryInfo:{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}async getClientAssertion(e){return this.developerProvidedClientAssertion&&(this.clientAssertion=wr.fromAssertion(await Ne(this.developerProvidedClientAssertion,this.config.auth.clientId,e.tokenEndpoint))),this.clientAssertion&&{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE}}async initializeBaseRequest(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();return this.logger.verbose("initializeRequestScopes called",r),e.authenticationScheme&&e.authenticationScheme===A.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",r),e.authenticationScheme=A.AuthenticationScheme.BEARER,{...e,scopes:[...e&&e.scopes||[],...A.OIDC_DEFAULT_SCOPES],correlationId:r,authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,r,n){let o={clientId:this.config.auth.clientId,correlationId:r,apiId:e,forceRefresh:n||!1};return new $n(o,this.storage)}async createAuthority(e,r,n,o){this.logger.verbose("createAuthority called",r);let i=Ht.generateAuthority(e,o||this.config.auth.azureCloudOptions),s={protocolMode:this.config.system.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:n};return dl.createDiscoveredInstance(i,this.config.system.networkClient,this.storage,s,this.logger,r,new Te)}clearCache(){this.storage.clear()}}});import tH from"http";var au,Lw=h(()=>{"use strict";W();Ws();J();au=class{async listenForAuthCode(e,r){if(this.server)throw ze.createLoopbackServerAlreadyExistsError();return new Promise((n,o)=>{this.server=tH.createServer((i,s)=>{let a=i.url;if(a){if(a===A.FORWARD_SLASH){s.end(e||"Auth code was successfully acquired. You can close this window now.");return}}else{s.end(r||"Error occurred loading redirectUrl"),o(ze.createUnableToLoadRedirectUrlError());return}let l=this.getRedirectUri(),c=new URL(a,l),u=ke.getDeserializedResponse(c.search)||{};u.code&&(s.writeHead(A.HTTP_REDIRECT,{location:l}),s.end()),u.error&&s.end(r||`Error occurred: ${u.error}`),n(u)}),this.server.listen(0,"127.0.0.1")})}getRedirectUri(){if(!this.server||!this.server.listening)throw ze.createNoLoopbackServerExistsError();let e=this.server.address();if(!e||typeof e=="string"||!e.port)throw this.closeServer(),ze.createInvalidLoopbackAddressTypeError();let r=e&&e.port;return`${Ke.HTTP_PROTOCOL}${Ke.LOCALHOST}:${r}`}closeServer(){this.server&&(this.server.close(),typeof this.server.closeAllConnections=="function"&&this.server.closeAllConnections(),this.server.unref(),this.server=void 0)}}});var cu,Uw=h(()=>{"use strict";W();J();ou();si();cu=class extends Rt{constructor(e){super(e)}async acquireToken(e){let r=await this.getDeviceCode(e);e.deviceCodeCallback(r);let n=Z.nowSeconds(),o=await this.acquireTokenWithDeviceCode(e,r),i=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(o,e.correlationId),i.handleServerTokenResponse(o,this.authority,n,e,te.acquireTokenByDeviceCode)}async getDeviceCode(e){let r=this.createExtraQueryParameters(e),n=j.appendQueryString(this.authority.deviceCodeEndpoint,r),o=this.createQueryString(e),i=this.createTokenRequestHeaders(),s={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};return this.executePostRequestToDeviceCodeEndpoint(n,o,i,s,e.correlationId)}createExtraQueryParameters(e){let r=new Map;return e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),ke.mapToQueryString(r)}async executePostRequestToDeviceCodeEndpoint(e,r,n,o,i){let{body:{user_code:s,device_code:a,verification_uri:l,expires_in:c,interval:u,message:d}}=await this.sendPostRequest(o,e,{body:r,headers:n},i);return{userCode:s,deviceCode:a,verificationUri:l,expiresIn:c,interval:u,message:d}}createQueryString(e){let r=new Map;return b.addScopes(r,e.scopes,e.correlationId),b.addClientId(r,this.config.authOptions.clientId),e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}continuePolling(e,r,n,o){if(o)throw this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true",r),E(vw,r);if(n&&n<e&&Z.nowSeconds()>n)throw this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${n}`,r),E(_w,r);if(Z.nowSeconds()>e)throw n&&this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${n}`,r),this.logger.error(`Device code expired. Expiration time of device code was ${e}`,r),E(xw,r);return!0}async acquireTokenWithDeviceCode(e,r){let n=this.createTokenQueryParameters(e),o=j.appendQueryString(this.authority.tokenEndpoint,n),i=this.createTokenRequestBody(e,r),s=this.createTokenRequestHeaders(),a=e.timeout?Z.nowSeconds()+e.timeout:void 0,l=Z.nowSeconds()+r.expiresIn,c=r.interval*1e3;for(;this.continuePolling(l,e.correlationId,a,e.cancel);){let u={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},d=await this.executePostToTokenEndpoint(o,i,s,u,e.correlationId);if(d.body&&d.body.error)if(d.body.error===A.AUTHORIZATION_PENDING)this.logger.info("Authorization pending. Continue polling.",e.correlationId),await Z.delay(c);else throw this.logger.info("Unexpected error in polling from the server",e.correlationId),In(qo.postRequestFailed,e.correlationId,d.body.error);else return this.logger.verbose("Authorization completed successfully. Polling stopped.",e.correlationId),d.body}throw this.logger.error("Polling stopped for unknown reasons.",e.correlationId),E(Ow,e.correlationId)}createTokenRequestBody(e,r){let n=new Map;b.addScopes(n,e.scopes,e.correlationId),b.addClientId(n,this.config.authOptions.clientId),b.addGrantType(n,A.GrantType.DEVICE_CODE_GRANT),b.addDeviceCode(n,r.deviceCode);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();return b.addCorrelationId(n,o),b.addClientInfo(n),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ci,$w=h(()=>{"use strict";J();W();ag();Ws();Lw();Uw();tn();ci=class extends ai{constructor(e){super(e),this.config.broker.nativeBrokerPlugin&&(this.config.broker.nativeBrokerPlugin.isBrokerAvailable?(this.nativeBrokerPlugin=this.config.broker.nativeBrokerPlugin,this.nativeBrokerPlugin.setLogger(this.config.system.loggerOptions)):this.logger.warning("NativeBroker implementation was provided but the broker is unavailable.","")),this.skus=$n.makeExtraSkuString({libraryName:Ke.MSAL_SKU,libraryVersion:Ye})}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId||""),Un(this.config.auth.isMcp,e);let r=Object.assign(e,await this.initializeBaseRequest(e)),n=this.initializeServerTelemetryManager(te.acquireTokenByDeviceCode,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new cu(i);return this.logger.verbose("Device code client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenInteractive(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();this.logger.trace("acquireTokenInteractive called",r),Un(this.config.auth.isMcp,e);let{openBrowser:n,successTemplate:o,errorTemplate:i,windowHandle:s,loopbackClient:a,...l}=e;if(this.nativeBrokerPlugin){let g={...l,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...l.extraQueryParameters,...l.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:l.account?.nativeAccountId};return this.nativeBrokerPlugin.acquireTokenInteractive(g,s)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}let{verifier:c,challenge:u}=await this.cryptoProvider.generatePkceCodes(),d=a||new au,f={},p=null;try{let g=d.listenForAuthCode(o,i).then(_=>{f=_}).catch(_=>{p=_}),m=await this.waitForRedirectUri(d,r),y={...l,correlationId:r,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:m,responseMode:A.ResponseMode.QUERY,codeChallenge:u,codeChallengeMethod:A.CodeChallengeMethodValues.S256},R=await this.getAuthCodeUrl(y);if(await n(R),await g,p)throw p;if(f.error)throw new qe(f.error,r,f.error_description,f.suberror);if(!f.code)throw ze.createNoAuthCodeInResponseError(r);let T=f.client_info,C={code:f.code,codeVerifier:c,clientInfo:T||"",...y};return await this.acquireTokenByCode(C)}finally{d.closeServer()}}async acquireTokenSilent(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();if(this.logger.trace("acquireTokenSilent called",r),Un(this.config.auth.isMcp,e),this.nativeBrokerPlugin){let n={...e,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...e.extraQueryParameters,...e.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:e.account.nativeAccountId,forceRefresh:e.forceRefresh||!1};return this.nativeBrokerPlugin.acquireTokenSilent(n)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}return super.acquireTokenSilent(e)}async acquireTokenByCode(e,r){return Un(this.config.auth.isMcp,e),super.acquireTokenByCode(e,r)}async acquireTokenByRefreshToken(e){return Un(this.config.auth.isMcp,e),super.acquireTokenByRefreshToken(e)}async signOut(e){if(this.nativeBrokerPlugin&&e.account.nativeAccountId){let r={clientId:this.config.auth.clientId,accountId:e.account.nativeAccountId,correlationId:e.correlationId||this.cryptoProvider.createNewGuid()};await this.nativeBrokerPlugin.signOut(r)}await this.getTokenCache().removeAccount(e.account,e.correlationId)}async getAllAccounts(){if(this.nativeBrokerPlugin){let e=this.cryptoProvider.createNewGuid();return this.nativeBrokerPlugin.getAllAccounts(this.config.auth.clientId,e)}return this.getTokenCache().getAllAccounts()}async waitForRedirectUri(e,r){return new Promise((n,o)=>{let i=0,s=setInterval(()=>{if(pl.TIMEOUT_MS/pl.INTERVAL_MS<i){clearInterval(s),o(ze.createLoopbackServerTimeoutError(r));return}try{let a=e.getRedirectUri();clearInterval(s),n(a);return}catch(a){if(a instanceof H&&a.errorCode===Ae.noLoopbackServerExists.code){i++;return}clearInterval(s),o(a);return}},pl.INTERVAL_MS)})}}});var li,cg=h(()=>{"use strict";W();J();si();li=class extends Rt{constructor(e,r){super(e),this.appTokenProvider=r}async acquireToken(e){let r;if(e.fmiPath&&(r={fmi_path:e.fmiPath}),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,void 0,r);let[n,o]=await this.getCachedAuthenticationResult(e,this.config,this.cryptoUtils,this.authority,this.cacheManager,this.serverTelemetryManager,r);return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId),await this.executeTokenRequest(e,this.authority,!0,r)),n):this.executeTokenRequest(e,this.authority,void 0,r)}async getCachedAuthenticationResult(e,r,n,o,i,s,a){let l=r,c=r,u=A.CacheOutcome.NOT_APPLICABLE,d;l.serializableCache&&l.persistencePlugin&&(d=new lt(l.serializableCache,!1),await l.persistencePlugin.beforeCacheAccess(d));let f=this.readAccessTokenFromCache(o,c.managedIdentityId?.id||l.authOptions.clientId,new de(e.scopes||[],e.correlationId),i,e.correlationId,a);return l.serializableCache&&l.persistencePlugin&&d&&await l.persistencePlugin.afterCacheAccess(d),f?Z.isTokenExpired(f.expiresOn,l.systemOptions?.tokenRenewalOffsetSeconds||A.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)?(s?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),[null,A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED]):(f.refreshOn&&Z.isTokenExpired(f.refreshOn.toString(),0)&&(u=A.CacheOutcome.PROACTIVELY_REFRESHED,s?.setCacheOutcome(A.CacheOutcome.PROACTIVELY_REFRESHED)),[await ce.generateAuthenticationResult(n,o,{account:null,idToken:null,accessToken:f,refreshToken:null,appMetadata:null},!0,e,this.performanceClient),u]):(s?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),[null,A.CacheOutcome.NO_CACHED_ACCESS_TOKEN])}readAccessTokenFromCache(e,r,n,o,i,s){let a={homeAccountId:"",environment:e.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ACCESS_TOKEN,clientId:r,realm:e.tenant,target:de.createSearchScopes(n.asArray(),i),additionalCacheKeyComponents:s},l=o.getAccessTokensByFilter(a,i);if(l.length<1)return null;if(l.length>1)throw E(me.multipleMatchingTokens,i);return l[0]}async executeTokenRequest(e,r,n,o){let i,s;if(this.appTokenProvider){this.logger.info("Using appTokenProvider extensibility.",e.correlationId);let c={correlationId:e.correlationId,tenantId:this.config.authOptions.authority.tenant,scopes:e.scopes,claims:e.claims};s=Z.nowSeconds();let u=await this.appTokenProvider(c);i={access_token:u.accessToken,expires_in:u.expiresInSeconds,refresh_in:u.refreshInSeconds,token_type:A.AuthenticationScheme.BEARER}}else{let c=this.createTokenQueryParameters(e),u=j.appendQueryString(r.tokenEndpoint,c),d=await this.createTokenRequestBody(e),f=this.createTokenRequestHeaders(),p={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};this.logger.info("Sending token request to endpoint: "+r.tokenEndpoint,e.correlationId),s=Z.nowSeconds();let g=await this.executePostToTokenEndpoint(u,d,f,p,e.correlationId);i=g.body,i.status=g.status}let a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i,e.correlationId,n),await a.handleServerTokenResponse(i,this.authority,s,e,te.acquireTokenByClientCredential,void 0,void 0,void 0,void 0,void 0,o)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId,!1),b.addGrantType(r,A.GrantType.CLIENT_CREDENTIALS_GRANT),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=e.clientAssertion||this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint,e.fmiPath)),b.addClientAssertionType(r,o.assertionType)),e.fmiPath&&r.set(Be.FMI_PATH,e.fmiPath),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var lu,Fw=h(()=>{"use strict";W();J();Ys();si();lu=class extends Rt{constructor(e){super(e)}async acquireToken(e){if(this.scopeSet=new de(e.scopes||[],e.correlationId),this.userAssertionHash=await this.cryptoUtils.hashString(e.oboAssertion),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,this.userAssertionHash);try{return await this.getCachedAuthenticationResult(e)}catch{return await this.executeTokenRequest(e,this.authority,this.userAssertionHash)}}async getCachedAuthenticationResult(e){let r=this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId,e);if(r){if(Z.isTokenExpired(r.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`,e.correlationId),E(me.tokenRefreshRequired,e.correlationId)}else throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.",e.correlationId),E(me.tokenRefreshRequired,e.correlationId);let n=this.readIdTokenFromCacheForOBO(r.homeAccountId,e.correlationId),o,i=null;if(n){o=jc.extractTokenClaims(n.secret,ft.base64Decode,e.correlationId);let s=o.oid||o.sub,a={homeAccountId:n.homeAccountId,environment:n.environment,tenantId:n.realm,username:"",localAccountId:s||""};i=this.cacheManager.getAccount(this.cacheManager.generateAccountKey(a),e.correlationId)}return this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,{account:i,accessToken:r,idToken:n,refreshToken:null,appMetadata:null},!0,e,this.performanceClient,o)}readIdTokenFromCacheForOBO(e,r){let n={homeAccountId:e,environment:this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ID_TOKEN,clientId:this.config.authOptions.clientId,realm:this.authority.tenant},o=this.cacheManager.getIdTokensByFilter(n,r);return Object.values(o).length<1?null:Object.values(o)[0]}readAccessTokenFromCacheForOBO(e,r){let n=r.authenticationScheme||A.AuthenticationScheme.BEARER,i={credentialType:n&&n.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?A.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:A.CredentialType.ACCESS_TOKEN,clientId:e,target:de.createSearchScopes(this.scopeSet.asArray(),r.correlationId),tokenType:n,keyId:r.sshKid,userAssertionHash:this.userAssertionHash},s=this.cacheManager.getAccessTokensByFilter(i,r.correlationId),a=s.length;if(a<1)return null;if(a>1)throw E(me.multipleMatchingTokens,r.correlationId);return s[0]}async executeTokenRequest(e,r,n){let o=this.createTokenQueryParameters(e),i=j.appendQueryString(r.tokenEndpoint,o),s=await this.createTokenRequestBody(e),a=this.createTokenRequestHeaders(),l={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},c=Z.nowSeconds(),u=await this.executePostToTokenEndpoint(i,s,a,l,e.correlationId),d=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return d.validateTokenResponse(u.body,e.correlationId),await d.handleServerTokenResponse(u.body,this.authority,c,e,te.acquireTokenByOBO,void 0,n)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId),b.addGrantType(r,A.GrantType.JWT_BEARER),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),b.addRequestTokenUse(r,Be.ON_BEHALF_OF),b.addOboAssertion(r,e.oboAssertion),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var uu,Hw=h(()=>{"use strict";W();J();si();uu=class extends Rt{constructor(e){super(e)}async acquireToken(e){return this.executeTokenRequest(e,this.authority)}async executeTokenRequest(e,r){let n=new de(e.scopes||[],e.correlationId);n.appendScopes(A.OIDC_DEFAULT_SCOPES);let o=n.asArray(),i=this.createTokenQueryParameters(e),s=j.appendQueryString(r.tokenEndpoint,i),a=await this.createTokenRequestBody(e,o),l=this.createTokenRequestHeaders(),c={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:o,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},u=Z.nowSeconds(),d=await this.executePostToTokenEndpoint(s,a,l,c,e.correlationId),f=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return f.validateTokenResponse(d.body,e.correlationId),await f.handleServerTokenResponse(d.body,this.authority,u,e,te.acquireTokenByUserFederatedIdentityCredential)}async createTokenRequestBody(e,r){let n=new Map;b.addClientId(n,this.config.authOptions.clientId),b.addScopes(n,r,e.correlationId),b.addGrantType(n,A.GrantType.USER_FIC),b.addClientInfo(n),n.set(Be.USER_FEDERATED_IDENTITY_CREDENTIAL,e.assertion),e.username?n.set(Be.USERNAME,e.username):e.userObjectId&&n.set(Be.USER_ID,e.userObjectId),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(n,o),this.config.clientCredentials.clientSecret&&b.addClientSecret(n,this.config.clientCredentials.clientSecret);let i=e.clientAssertion||this.config.clientCredentials.clientAssertion;return i&&(b.addClientAssertion(n,await Ne(i.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint)),b.addClientAssertionType(n,i.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ui,Bw=h(()=>{"use strict";ag();iu();J();W();cg();Fw();Hw();ou();ui=class extends ai{constructor(e){super(e);let r=!!this.config.auth.clientSecret,n=!!this.config.auth.clientAssertion,o=(!!this.config.auth.clientCertificate?.thumbprint||!!this.config.auth.clientCertificate?.thumbprintSha256)&&!!this.config.auth.clientCertificate?.privateKey;if(!this.appTokenProvider){if(r&&n||n&&o||r&&o)throw E(sg,"");if(this.config.auth.clientSecret){this.clientSecret=this.config.auth.clientSecret;return}if(this.config.auth.clientAssertion){this.developerProvidedClientAssertion=this.config.auth.clientAssertion;return}if(o)this.clientAssertion=this.config.auth.clientCertificate.thumbprintSha256?wr.fromCertificateWithSha256Thumbprint(this.config.auth.clientCertificate.thumbprintSha256,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c):wr.fromCertificate(this.config.auth.clientCertificate.thumbprint,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c);else throw E(sg,"");this.appTokenProvider=void 0}}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){this.logger.info("acquireTokenByClientCredential called",e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...n,scopes:n.scopes.filter(f=>!A.OIDC_DEFAULT_SCOPES.includes(f))},i={...e,...o,clientAssertion:r},a=new j(i.authority,i.correlationId).getUrlComponents().PathSegments[0];if(Object.values(A.AADAuthority).includes(a))throw E(Sw,i.correlationId);let l=process.env[OA],c;i.azureRegion!=="DisableMsalForceRegion"&&(!i.azureRegion&&l?c=l:c=i.azureRegion);let u={azureRegion:c,environmentRegion:process.env[xA]},d=this.initializeServerTelemetryManager(te.acquireTokenByClientCredential,i.correlationId,i.skipCache);try{let f=await this.createAuthority(i.authority,i.correlationId,u,e.azureCloudOptions),p=await this.buildOauthClientConfiguration(f,i.correlationId,"",d),g=new li(p,this.appTokenProvider);return this.logger.verbose("Client credential client created",i.correlationId),await g.acquireToken(i)}catch(f){throw f instanceof H&&(f.correlationId=i.correlationId),d.cacheFailedRequest(f),f}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)};try{let n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),o=await this.buildOauthClientConfiguration(n,r.correlationId,"",void 0),i=new lu(o);return this.logger.verbose("On behalf of client created",r.correlationId),await i.acquireToken(r)}catch(n){throw n instanceof H&&(n.correlationId=r.correlationId),n}}async acquireTokenByUserFederatedIdentityCredential(e){if(this.logger.info("acquireTokenByUserFederatedIdentityCredential called",e.correlationId||""),e.userObjectId&&e.username)throw E(Rw,e.correlationId||"");if(!e.userObjectId&&!e.username)throw E(kw,e.correlationId||"");if(!e.assertion)throw E(bw,e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...e,...n,assertion:e.assertion,clientAssertion:r},i=this.initializeServerTelemetryManager(te.acquireTokenByUserFederatedIdentityCredential,o.correlationId);try{let s=await this.createAuthority(o.authority,o.correlationId,void 0,e.azureCloudOptions),a=await this.buildOauthClientConfiguration(s,o.correlationId,"",i),l=new uu(a);return this.logger.verbose("UserFederatedIdentityCredential client created",o.correlationId),await l.acquireToken(o)}catch(s){throw s instanceof H&&(s.correlationId=o.correlationId),i.cacheFailedRequest(s),s}}}});function jw(t){if(typeof t!="string")return!1;let e=new Date(t);return!isNaN(e.getTime())&&e.toISOString()===t}var zw=h(()=>{"use strict";});var du,Vw=h(()=>{"use strict";W();J();du=class{constructor(e,r,n){this.httpClientNoRetries=e,this.retryPolicy=r,this.logger=n}async sendNetworkRequestAsyncHelper(e,r,n){return e===fe.GET?this.httpClientNoRetries.sendGetRequestAsync(r,n):this.httpClientNoRetries.sendPostRequestAsync(r,n)}async sendNetworkRequestAsync(e,r,n){let o=await this.sendNetworkRequestAsyncHelper(e,r,n);"isNewRequest"in this.retryPolicy&&(this.retryPolicy.isNewRequest=!0);let i=0;for(;await this.retryPolicy.pauseForRetry(o.status,i,this.logger,o.headers[A.HeaderNames.RETRY_AFTER]);)o=await this.sendNetworkRequestAsyncHelper(e,r,n),i++;return o}async sendGetRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.GET,e,r)}async sendPostRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.POST,e,r)}}});var zn,Xe,Vn=h(()=>{"use strict";W();J();Ko();zw();Vw();Hn();zn={MANAGED_IDENTITY_CLIENT_ID_2017:"clientid",MANAGED_IDENTITY_CLIENT_ID:"client_id",MANAGED_IDENTITY_OBJECT_ID:"object_id",MANAGED_IDENTITY_RESOURCE_ID_IMDS:"msi_res_id",MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS:"mi_res_id"},Xe=class{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}createCorrelationId(){return this.cryptoProvider.createNewGuid()}async getServerTokenResponseAsync(e,r,n,o){return this.getServerTokenResponse(e)}getServerTokenResponse(e){let r,n;return e.body.expires_on&&(jw(e.body.expires_on)&&(e.body.expires_on=new Date(e.body.expires_on).getTime()/1e3),n=e.body.expires_on-Z.nowSeconds(),n>2*3600&&(r=n/2)),{status:e.status,access_token:e.body.access_token,expires_in:n,scope:e.body.resource,token_type:e.body.token_type,refresh_in:r,correlation_id:e.body.correlation_id||e.body.correlationId,error:typeof e.body.error=="string"?e.body.error:e.body.error?.code,error_description:e.body.message||(typeof e.body.error=="string"?e.body.error_description:e.body.error?.message),error_codes:e.body.error_codes,timestamp:e.body.timestamp,trace_id:e.body.trace_id}}async acquireTokenWithManagedIdentity(e,r,n,o){let i=this.createRequest(e.resource,r);if(e.revokedTokenSha256Hash&&(this.logger.info(`[Managed Identity] The following claims are present in the request: ${e.claims}`,""),i.queryParameters[Ce.SHA256_TOKEN_TO_REFRESH]=e.revokedTokenSha256Hash),e.clientCapabilities?.length){let p=e.clientCapabilities.toString();this.logger.info(`[Managed Identity] The following client capabilities are present in the request: ${p}`,""),i.queryParameters[Ce.XMS_CC]=p}let s=i.headers;s[A.HeaderNames.CONTENT_TYPE]=A.URL_FORM_CONTENT_TYPE;let a={headers:s};Object.keys(i.bodyParameters).length&&(a.body=i.computeParametersBodyString());let l=this.disableInternalRetries?this.networkClient:new du(this.networkClient,i.retryPolicy,this.logger),c=Z.nowSeconds(),u;try{i.httpMethod===fe.POST?u=await l.sendPostRequestAsync(i.computeUri(),a):u=await l.sendGetRequestAsync(i.computeUri(),a)}catch(p){throw p instanceof H?p:E(me.networkError,e.correlationId)}let d=new ce(r.id,this.nodeStorage,this.cryptoProvider,this.logger,new Te,null,null),f=await this.getServerTokenResponseAsync(u,l,i,a);return d.validateTokenResponse(f,f.correlation_id||"",o),d.handleServerTokenResponse(f,n,c,e,te.acquireTokenWithManagedIdentity)}getManagedIdentityUserAssignedIdQueryParameterKey(e,r,n){switch(e){case le.USER_ASSIGNED_CLIENT_ID:return this.logger.info(`[Managed Identity] [API version ${n?"2017+":"2019+"}] Adding user assigned client id to the request.`,""),n?zn.MANAGED_IDENTITY_CLIENT_ID_2017:zn.MANAGED_IDENTITY_CLIENT_ID;case le.USER_ASSIGNED_RESOURCE_ID:return this.logger.info("[Managed Identity] Adding user assigned resource id to the request.",""),r?zn.MANAGED_IDENTITY_RESOURCE_ID_IMDS:zn.MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS;case le.USER_ASSIGNED_OBJECT_ID:return this.logger.info("[Managed Identity] Adding user assigned object id to the request.",""),zn.MANAGED_IDENTITY_OBJECT_ID;default:throw ye(Yr,"")}}};Xe.getValidatedEnvVariableUrlString=(t,e,r,n)=>{try{return new j(e,"").urlString}catch{throw n.info(`[Managed Identity] ${r} managed identity is unavailable because the '${t}' environment variable is malformed.`,""),ye(Fn[t],"")}}});var fu,qw=h(()=>{"use strict";fu=class{calculateDelay(e,r){if(!e)return r;let n=Math.round(parseFloat(e)*1e3);return isNaN(n)&&(n=new Date(e).valueOf()-new Date().valueOf()),Math.max(r,n)}}});var rH,nH,oH,hu,Gw=h(()=>{"use strict";W();qw();rH=3,nH=1e3,oH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_TOO_MANY_REQUESTS,A.HTTP_SERVER_ERROR,A.HTTP_SERVICE_UNAVAILABLE,A.HTTP_GATEWAY_TIMEOUT],hu=class t{constructor(){this.linearRetryStrategy=new fu}static get DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS(){return nH}async pauseForRetry(e,r,n,o){if(oH.includes(e)&&r<rH){let i=this.linearRetryStrategy.calculateDelay(o,t.DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS);return n.verbose(`Retrying request in ${i}ms (retry attempt: ${r+1})`,""),await new Promise(s=>setTimeout(s,i)),!0}return!1}}});var et,qn=h(()=>{"use strict";W();Gw();et=class{constructor(e,r,n){this.httpMethod=e,this._baseEndpoint=r,this.headers={},this.bodyParameters={},this.queryParameters={},this.retryPolicy=n||new hu}computeUri(){let e=new Map;this.queryParameters&&b.addExtraParameters(e,this.queryParameters);let r=ke.mapToQueryString(e);return j.appendQueryString(this._baseEndpoint,r)}computeParametersBodyString(){let e=new Map;return this.bodyParameters&&b.addExtraParameters(e,this.bodyParameters),ke.mapToQueryString(e)}}});var iH,aa,Kw=h(()=>{"use strict";Vn();J();qn();iH="2019-08-01",aa=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.APP_SERVICE} managed identity is unavailable because one or both of the '${U.IDENTITY_HEADER}' and '${U.IDENTITY_ENDPOINT}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,s,$.APP_SERVICE,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.APP_SERVICE} managed identity. Endpoint URI: ${l}. Creating ${$.APP_SERVICE} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.APP_SERVICE_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=iH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});import{accessSync as sH,constants as Ww,statSync as aH,readFileSync as cH}from"fs";import lH from"path";var uH,Yw,Xw,Jw,dH,ca,Qw=h(()=>{"use strict";W();qn();Vn();Ko();J();Hn();uH="2019-11-01",Yw="http://127.0.0.1:40342/metadata/identity/oauth2/token",Xw="N/A: himds executable exists",Jw={win32:`${process.env.ProgramData}\\AzureConnectedMachineAgent\\Tokens\\`,linux:"/var/opt/azcmagent/tokens/"},dH={win32:`${process.env.ProgramFiles}\\AzureConnectedMachineAgent\\himds.exe`,linux:"/opt/azcmagent/bin/himds"},ca=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IMDS_ENDPOINT];if(!e||!r){let n=dH[process.platform];try{sH(n,Ww.F_OK|Ww.R_OK),e=Yw,r=Xw}catch{}}return[e,r]}static tryCreate(e,r,n,o,i,s){let[a,l]=t.getEnvironmentVariables();if(!a||!l)return e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is unavailable through environment variables because one or both of '${U.IDENTITY_ENDPOINT}' and '${U.IMDS_ENDPOINT}' are not defined. ${$.AZURE_ARC} managed identity is also unavailable through file detection.`,""),null;if(l===Xw)e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is available through file detection. Defaulting to known ${$.AZURE_ARC} endpoint: ${Yw}. Creating ${$.AZURE_ARC} managed identity.`,"");else{let c=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.AZURE_ARC,e);c.endsWith("/")&&c.slice(0,-1),t.getValidatedEnvVariableUrlString(U.IMDS_ENDPOINT,l,$.AZURE_ARC,e),e.info(`[Managed Identity] Environment variables validation passed for ${$.AZURE_ARC} managed identity. Endpoint URI: ${c}. Creating ${$.AZURE_ARC} managed identity.`,"")}if(s.idType!==le.SYSTEM_ASSIGNED)throw ye(Tl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.GET,this.identityEndpoint.replace("localhost","127.0.0.1"));return r.headers[Le.METADATA_HEADER_NAME]="true",r.queryParameters[Ce.API_VERSION]=uH,r.queryParameters[Ce.RESOURCE]=e,r}async getServerTokenResponseAsync(e,r,n,o){let i;if(e.status===A.HTTP_UNAUTHORIZED){let s=e.headers["www-authenticate"];if(!s)throw ye(Il,"");if(!s.includes("Basic realm="))throw ye(Sl,"");let a=s.split("Basic realm=")[1];if(!Jw.hasOwnProperty(process.platform))throw ye(El,"");let l=Jw[process.platform],c=lH.basename(a);if(!c.endsWith(".key"))throw ye(ml,"");if(l+c!==a)throw ye(gl,"");let u;try{u=await aH(a).size}catch{throw ye(Ks,"")}if(u>MA)throw ye(yl,"");let d;try{d=cH(a,A.EncodingTypes.UTF8)}catch{throw ye(Ks,"")}let f=`Basic ${d}`;this.logger.info("[Managed Identity] Adding authorization header to the request.",""),n.headers[Le.AUTHORIZATION_HEADER_NAME]=f;try{i=await r.sendGetRequestAsync(n.computeUri(),o)}catch(p){throw p instanceof H?p:E(me.networkError,"")}}return this.getServerTokenResponse(i||e)}}});var la,Zw=h(()=>{"use strict";qn();Vn();J();Ko();Hn();la=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.msiEndpoint=s}static getEnvironmentVariables(){return[process.env[U.MSI_ENDPOINT]]}static tryCreate(e,r,n,o,i,s){let[a]=t.getEnvironmentVariables();if(!a)return e.info(`[Managed Identity] ${$.CLOUD_SHELL} managed identity is unavailable because the '${U.MSI_ENDPOINT} environment variable is not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,a,$.CLOUD_SHELL,e);if(e.info(`[Managed Identity] Environment variable validation passed for ${$.CLOUD_SHELL} managed identity. Endpoint URI: ${l}. Creating ${$.CLOUD_SHELL} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED)throw ye(Cl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.POST,this.msiEndpoint);return r.headers[Le.METADATA_HEADER_NAME]="true",r.bodyParameters[Ce.RESOURCE]=e,r}}});var pu,eb=h(()=>{"use strict";pu=class{constructor(e,r,n){this.minExponentialBackoff=e,this.maxExponentialBackoff=r,this.exponentialDeltaBackoff=n}calculateDelay(e){return e===0?this.minExponentialBackoff:Math.min(Math.pow(2,e-1)*this.exponentialDeltaBackoff,this.maxExponentialBackoff)}}});var fH,hH,pH,mH,gH,yH,EH,mu,tb=h(()=>{"use strict";W();eb();fH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_GONE,A.HTTP_TOO_MANY_REQUESTS],hH=3,pH=7,mH=1e3,gH=4e3,yH=2e3,EH=10*1e3,mu=class t{constructor(){this.exponentialRetryStrategy=new pu(t.MIN_EXPONENTIAL_BACKOFF_MS,t.MAX_EXPONENTIAL_BACKOFF_MS,t.EXPONENTIAL_DELTA_BACKOFF_MS)}static get MIN_EXPONENTIAL_BACKOFF_MS(){return mH}static get MAX_EXPONENTIAL_BACKOFF_MS(){return gH}static get EXPONENTIAL_DELTA_BACKOFF_MS(){return yH}static get HTTP_STATUS_GONE_RETRY_AFTER_MS(){return EH}set isNewRequest(e){this._isNewRequest=e}async pauseForRetry(e,r,n){if(this._isNewRequest&&(this._isNewRequest=!1,this.maxRetries=e===A.HTTP_GONE?pH:hH),(fH.includes(e)||e>=A.HTTP_SERVER_ERROR_RANGE_START&&e<=A.HTTP_SERVER_ERROR_RANGE_END&&r<this.maxRetries)&&r<this.maxRetries){let o=e===A.HTTP_GONE?t.HTTP_STATUS_GONE_RETRY_AFTER_MS:this.exponentialRetryStrategy.calculateDelay(r);return n.verbose(`Retrying request in ${o}ms (retry attempt: ${r+1})`,""),await new Promise(i=>setTimeout(i,o)),!0}return!1}}});var rb,TH,CH,gu,nb=h(()=>{"use strict";qn();Vn();J();tb();tn();rb="/metadata/identity/oauth2/token",TH=`http://169.254.169.254${rb}`,CH="2018-02-01",gu=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static tryCreate(e,r,n,o,i){let s;return process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]?(e.info(`[Managed Identity] Environment variable ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} for ${$.IMDS} returned endpoint: ${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}`,""),s=t.getValidatedEnvVariableUrlString(U.AZURE_POD_IDENTITY_AUTHORITY_HOST,`${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}${rb}`,$.IMDS,e)):(e.info(`[Managed Identity] Unable to find ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} environment variable for ${$.IMDS}, using the default endpoint.`,""),s=TH),new t(e,r,n,o,i,s)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.CLIENT_SKU]=Ke.MSAL_SKU,n.headers[Le.CLIENT_VER]=Ye,n.headers[Le.CLIENT_REQUEST_ID]=this.createCorrelationId(),n.queryParameters[Ce.API_VERSION]=CH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!0)]=r.id),n.retryPolicy=new mu,n}}});var AH,ua,ob=h(()=>{"use strict";qn();Vn();J();AH="2019-07-01-preview",ua=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER],n=process.env[U.IDENTITY_SERVER_THUMBPRINT];return[e,r,n]}static tryCreate(e,r,n,o,i,s){let[a,l,c]=t.getEnvironmentVariables();if(!a||!l||!c)return e.info(`[Managed Identity] ${$.SERVICE_FABRIC} managed identity is unavailable because one or all of the '${U.IDENTITY_HEADER}', '${U.IDENTITY_ENDPOINT}' or '${U.IDENTITY_SERVER_THUMBPRINT}' environment variables are not defined.`,""),null;let u=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.SERVICE_FABRIC,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.SERVICE_FABRIC} managed identity. Endpoint URI: ${u}. Creating ${$.SERVICE_FABRIC} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED&&e.warning(`[Managed Identity] ${$.SERVICE_FABRIC} user assigned managed identity is configured in the cluster, not during runtime. See also: https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-service.`,""),new t(e,r,n,o,i,a,l)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=AH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});var IH,SH,da,ib=h(()=>{"use strict";Vn();J();qn();IH="2017-09-01",SH=`Only client id is supported for user-assigned managed identity in ${$.MACHINE_LEARNING}.`,da=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.msiEndpoint=s,this.secret=a}static getEnvironmentVariables(){let e=process.env[U.MSI_ENDPOINT],r=process.env[U.MSI_SECRET];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.MACHINE_LEARNING} managed identity is unavailable because one or both of the '${U.MSI_ENDPOINT}' and '${U.MSI_SECRET}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,s,$.MACHINE_LEARNING,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.MACHINE_LEARNING} managed identity. Endpoint URI: ${l}. Creating ${$.MACHINE_LEARNING} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.msiEndpoint);if(n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.secret,n.queryParameters[Ce.API_VERSION]=IH,n.queryParameters[Ce.RESOURCE]=e,r.idType===le.SYSTEM_ASSIGNED)n.queryParameters[zn.MANAGED_IDENTITY_CLIENT_ID_2017]=process.env[U.DEFAULT_IDENTITY_CLIENT_ID];else if(r.idType===le.USER_ASSIGNED_CLIENT_ID)n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!1,!0)]=r.id;else throw new Error(SH);return n}}});var fa,sb=h(()=>{"use strict";Kw();Qw();Zw();nb();ob();Ko();J();ib();Hn();fa=class t{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}async sendManagedIdentityTokenRequest(e,r,n,o){return t.identitySource||(t.identitySource=this.selectManagedIdentitySource(this.logger,this.nodeStorage,this.networkClient,this.cryptoProvider,this.disableInternalRetries,r)),t.identitySource.acquireTokenWithManagedIdentity(e,r,n,o)}allEnvironmentVariablesAreDefined(e){return Object.values(e).every(r=>r!==void 0)}getManagedIdentitySource(){return t.sourceName=this.allEnvironmentVariablesAreDefined(ua.getEnvironmentVariables())?$.SERVICE_FABRIC:this.allEnvironmentVariablesAreDefined(aa.getEnvironmentVariables())?$.APP_SERVICE:this.allEnvironmentVariablesAreDefined(da.getEnvironmentVariables())?$.MACHINE_LEARNING:this.allEnvironmentVariablesAreDefined(la.getEnvironmentVariables())?$.CLOUD_SHELL:this.allEnvironmentVariablesAreDefined(ca.getEnvironmentVariables())?$.AZURE_ARC:$.DEFAULT_TO_IMDS,t.sourceName}selectManagedIdentitySource(e,r,n,o,i,s){let a=ua.tryCreate(e,r,n,o,i,s)||aa.tryCreate(e,r,n,o,i)||da.tryCreate(e,r,n,o,i)||la.tryCreate(e,r,n,o,i,s)||ca.tryCreate(e,r,n,o,i,s)||gu.tryCreate(e,r,n,o,i);if(!a)throw ye(Al,"");return a}}});var _H,di,ab=h(()=>{"use strict";W();hm();tn();Xs();cg();sb();Rl();J();wl();_H=[$.SERVICE_FABRIC],di=class t{constructor(e){this.config=BA(e||{}),this.logger=new ve(this.config.system.loggerOptions,ii,Ye);let r={canonicalAuthority:A.DEFAULT_AUTHORITY};t.nodeStorage||(t.nodeStorage=new Jr(this.logger,this.config.managedIdentityId.id,No,r)),this.networkClient=this.config.system.networkClient,this.cryptoProvider=new Jt;let n={protocolMode:je.AAD,knownAuthorities:[lm],cloudDiscoveryMetadata:"",authorityMetadata:""};this.fakeAuthority=new Ht(lm,this.networkClient,t.nodeStorage,n,this.logger,this.cryptoProvider.createNewGuid(),new Te,!0),this.fakeClientCredentialClient=new li({authOptions:{clientId:this.config.managedIdentityId.id,authority:this.fakeAuthority}}),this.managedIdentityClient=new fa(this.logger,t.nodeStorage,this.networkClient,this.cryptoProvider,this.config.disableInternalRetries),this.hashUtils=new Xr}async acquireToken(e){if(!e.resource)throw Y(ko.urlEmptyError,"");let r={forceRefresh:e.forceRefresh,resource:e.resource.replace("/.default",""),scopes:[e.resource.replace("/.default","")],authority:this.fakeAuthority.canonicalAuthority,correlationId:this.cryptoProvider.createNewGuid(),claims:e.claims,clientCapabilities:this.config.clientCapabilities};if(r.forceRefresh)return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority);let[n,o]=await this.fakeClientCredentialClient.getCachedAuthenticationResult(r,this.config,this.cryptoProvider,this.fakeAuthority,t.nodeStorage);if(r.claims){let i=this.managedIdentityClient.getManagedIdentitySource();if(n&&_H.includes(i)){let s=this.hashUtils.sha256(n.accessToken).toString(A.EncodingTypes.HEX);r.revokedTokenSha256Hash=s}return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority)}return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",r.correlationId),await this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority,!0)), |
| Error: '${i.name}' | ||
| Error Description: '${i.message}'`,this.correlationId)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.",this.correlationId),this.logger.verbose("Creating custom Authority for custom domain scenario.",this.correlationId),n=t.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),n}isInKnownAuthorities(e){let r=e.toLowerCase();return this.authorityOptions.knownAuthorities.filter(o=>o&&j.getDomainFromUrl(o,this.correlationId).toLowerCase()===r).length>0}static generateAuthority(e,r){let n;if(r&&r.azureCloudInstance!==Tr.None){let o=r.tenant?r.tenant:es;n=`${r.azureCloudInstance}/${o}/`}return n||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return xf;if(this.discoveryComplete())return this.metadata.preferred_cache;throw E($t,this.correlationId)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return Lp.has(e)}validateIssuer(e){if(!e)throw Y(us,this.correlationId);let r;try{r=new URL(e)}catch{throw Y(us,this.correlationId)}let n=r.protocol,o=r.host,i=(this.canonicalAuthorityUrlComponents.Protocol||"").toLowerCase(),s=(this.canonicalAuthorityUrlComponents.HostNameAndPort||"").toLowerCase(),a=this.matchesAuthorityOrigin(n,o,i,s),l=n==="https:"&&this.isAliasOfKnownMicrosoftAuthority(o),c=n==="https:"&&this.matchesRegionalMicrosoftHost(o),u=this.matchesCiamTenantPattern(r,s,this.canonicalAuthorityUrlComponents.PathSegments),d=n==="https:"&&this.isInKnownAuthorities(o);if(!(a||l||c||u||d))throw Y(us,this.correlationId)}matchesAuthorityOrigin(e,r,n,o){return e===n&&r===o}matchesRegionalMicrosoftHost(e){let r=e.indexOf(".");if(r>0&&r<e.length-1){let n=e.substring(r+1);return this.isAliasOfKnownMicrosoftAuthority(n)}return!1}matchesCiamTenantPattern(e,r,n){let o=n[0],i=o?o.endsWith(En)?o.slice(0,-En.length):o:r.split(".")[0];if(!i)return!1;let s=`https://${i}${ts}`,a=[s,`${s}/${i}`,`${s}/${i}/v2.0`,`${s}/${i}${En}`,`${s}/${i}${En}/v2.0`],l=e.pathname.replace(/\/+$/,""),c=`${e.protocol}//${e.host}${l}`;return a.some(u=>u===c)}static isPublicCloudAuthority(e){return Ff.indexOf(e)>=0}static buildRegionalAuthorityString(e,r,n,o){let i=new j(e,n);i.validateAsUri();let s=i.getUrlComponents(),a=`${r}.${s.HostNameAndPort}`;this.isPublicCloudAuthority(s.HostNameAndPort)&&(a=`${r}.${$f}`);let l=j.constructAuthorityUriFromObject({...i.getUrlComponents(),HostNameAndPort:a},n).urlString;return o?`${l}?${o}`:l}static replaceWithRegionalInformation(e,r,n){let o={...e};return o.authorization_endpoint=t.buildRegionalAuthorityString(o.authorization_endpoint,r,n),o.token_endpoint=t.buildRegionalAuthorityString(o.token_endpoint,r,n),o.end_session_endpoint&&(o.end_session_endpoint=t.buildRegionalAuthorityString(o.end_session_endpoint,r,n)),o}static transformCIAMAuthority(e,r){let n=e,i=new j(e,r).getUrlComponents();if(i.PathSegments.length===0&&i.HostNameAndPort.endsWith(ts)){let s=i.HostNameAndPort.split(".")[0];n=`${n}${s}${En}`}return n}};Ht.reservedTenantDomains=new Set(["{tenant}","{tenantid}",Dt.COMMON,Dt.CONSUMERS,Dt.ORGANIZATIONS])});var dl={};we(dl,{createDiscoveredInstance:()=>sm});async function sm(t,e,r,n,o,i,s){let a=Ht.transformCIAMAuthority(ll(t),i),l=new Ht(a,e,r,n,o,i,s);try{return await G(l.resolveEndpointsAsync.bind(l),WC,o,s,i)(),l}catch{throw E($t,i)}}var am=h(()=>{"use strict";ul();pe();Ir();Sr();ge();});var Vs,yA=h(()=>{"use strict";Oo();Po();ue();bo();Ps();Us();pe();qr();el();Kr();Uo();$s();hr();Ir();Sr();sl();al();cl();am();Mo();Do();ge();mr();Vs=class{constructor(e,r){this.includeRedirectUri=!0,this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}async acquireToken(e,r,n){if(!e.code)throw E(dp,e.correlationId);n&&n.cloud_instance_host_name&&await G(this.updateTokenEndpointAuthority.bind(this),KC,this.logger,this.performanceClient,e.correlationId)(n.cloud_instance_host_name,e.correlationId);let o=ut(),i=await G(this.executeTokenRequest.bind(this),qC,this.logger,this.performanceClient,e.correlationId)(this.authority,e,this.serverTelemetryManager),s=i.headers?.[he.X_MS_REQUEST_ID],a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i.body,e.correlationId),G(a.handleServerTokenResponse.bind(a),Zc,this.logger,this.performanceClient,e.correlationId)(i.body,this.authority,o,e,r,n,void 0,void 0,void 0,s)}getLogoutUri(e){if(!e)throw Y(Zh,"");let r=this.createLogoutUrlQueryString(e);return j.appendQueryString(this.authority.endSessionEndpoint,r)}async executeTokenRequest(e,r,n){let o=Bs(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),i=j.appendQueryString(e.tokenEndpoint,o),s=await G(this.createTokenRequestBody.bind(this),GC,this.logger,this.performanceClient,r.correlationId)(r),a;if(r.clientInfo)try{let u=Lo(r.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${u.uid}${Ao}${u.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(u){this.logger.verbose(`Could not parse client info for CCS Header: '${u}'`,r.correlationId)}let l=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,a||r.ccsCredential),c=zo(this.config.authOptions.clientId,r);return G(js,HC,this.logger,this.performanceClient,r.correlationId)(i,s,l,c,r.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,n)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),this.includeRedirectUri)Rn(r,e.redirectUri);else if(!e.redirectUri)throw Y(Kh,e.correlationId);if(wn(r,e.scopes,e.correlationId,!0,this.oidcDefaultScopes),bs(r,e.resource),kp(r,e.code),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),e.codeVerifier&&xp(r,e.codeVerifier),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;Es(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,o.assertionType)}if(Cs(r,os.AUTHORIZATION_CODE_GRANT),xn(r),e.authenticationScheme===se.POP){let o=new Wr(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(await G(o.generateCnf.bind(o),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,i)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);let n;if(e.clientInfo)try{let o=Lo(e.clientInfo,this.cryptoUtils.base64Decode);n={credential:`${o.uid}${Ao}${o.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(o){this.logger.verbose(`Could not parse client info for CCS Header: '${o}'`,e.correlationId)}else n=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&n)switch(n.type){case Ge.HOME_ACCOUNT_ID:try{let o=Xt(n.credential);gr(r,o)}catch(o){this.logger.verbose(`Could not parse home account ID for CCS Header: '${o}'`,e.correlationId)}break;case Ge.UPN:Vr(r,n.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,e.extraParameters),e.enableSpaAuthorizationCode&&(!e.extraParameters||!e.extraParameters[Pc])&&yr(r,{[Pc]:"1"}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}createLogoutUrlQueryString(e){let r=new Map;return e.postLogoutRedirectUri&&Sp(r,e.postLogoutRedirectUri),e.correlationId&&vn(r,e.correlationId),e.idTokenHint&&_p(r,e.idTokenHint),e.state&&gs(r,e.state),e.logoutHint&&Pp(r,e.logoutHint),e.extraQueryParameters&&yr(r,e.extraQueryParameters),this.config.authOptions.instanceAware&&As(r),Wt(r)}async updateTokenEndpointAuthority(e,r){let n=`https://${e}/${this.authority.tenant}/`,o=await sm(n,this.networkClient,this.cacheManager,this.authority.options,this.logger,r,this.performanceClient);this.authority=o}}});var g0,Ln,EA=h(()=>{"use strict";Ps();Oo();Po();ue();bo();Us();el();hr();pe();jo();Kr();qr();$s();Uo();Ls();Ir();Sr();sl();al();cl();Mo();Do();nl();mr();ge();g0=300,Ln=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireToken(e,r){let n=ut(),o=await G(this.executeTokenRequest.bind(this),BC,this.logger,this.performanceClient,e.correlationId)(e,this.authority),i=o.headers?.[he.X_MS_REQUEST_ID],s=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o.body,e.correlationId),G(s.handleServerTokenResponse.bind(s),Zc,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,n,e,r,void 0,void 0,!0,e.forceCache,i)}async acquireTokenByRefreshToken(e,r){if(!e)throw Y(Qh,"");if(!e.account)throw E(ds,e.correlationId);if(this.cacheManager.isAppMetadataFOCI(e.account.environment,e.correlationId))try{return await G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!0,r)}catch(o){let i=o instanceof dt&&o.errorCode===tl,s=o instanceof qe&&o.errorCode===oh&&o.subError===ih;if(i||s)return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r);throw o}return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r)}async acquireTokenWithCachedRefreshToken(e,r,n){let o=rA(this.cacheManager.getRefreshToken.bind(this.cacheManager),tA,this.logger,this.performanceClient,e.correlationId)(e.account,r,e.correlationId,void 0);if(!o)throw il(tl,e.correlationId);if(o.expiresOn){let s=e.refreshTokenExpirationOffsetSeconds||g0;if(this.performanceClient?.addFields({cacheRtExpiresOnSeconds:Number(o.expiresOn),rtOffsetSeconds:s},e.correlationId),Fo(o.expiresOn,s))throw il(Jp,e.correlationId)}let i={...e,refreshToken:o.secret,authenticationScheme:e.authenticationScheme||se.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:Ge.HOME_ACCOUNT_ID}};try{return await G(this.acquireToken.bind(this),jC,this.logger,this.performanceClient,e.correlationId)(i,n)}catch(s){if(s instanceof dt&&s.subError===Ds){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache",e.correlationId);let a=this.cacheManager.generateCredentialKey(o);this.cacheManager.removeRefreshToken(a,e.correlationId)}throw s}}async executeTokenRequest(e,r){let n=Bs(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),o=j.appendQueryString(r.tokenEndpoint,n),i=await G(this.createTokenRequestBody.bind(this),zC,this.logger,this.performanceClient,e.correlationId)(e),s=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,e.ccsCredential),a=zo(this.config.authOptions.clientId,e);return G(js,FC,this.logger,this.performanceClient,e.correlationId)(o,i,s,a,e.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),e.redirectUri&&Rn(r,e.redirectUri),wn(r,e.scopes,e.correlationId,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),Cs(r,os.REFRESH_TOKEN_GRANT),xn(r),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),vp(r,e.refreshToken),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let n=this.config.clientCredentials.clientAssertion;Es(r,await Ne(n.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,n.assertionType)}if(e.authenticationScheme===se.POP){let n=new Wr(this.cryptoUtils,this.performanceClient),o;e.popKid?o=this.cryptoUtils.encodeKid(e.popKid):o=(await G(n.generateCnf.bind(n),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,o)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);if(this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case Ge.HOME_ACCOUNT_ID:try{let n=Xt(e.ccsCredential.credential);gr(r,n)}catch(n){this.logger.verbose(`Could not parse home account ID for CCS Header: '${n}'`,e.correlationId)}break;case Ge.UPN:Vr(r,e.ccsCredential.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,{...e.extraParameters}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}}});var qs,TA=h(()=>{"use strict";Ps();Kr();pe();Us();ue();cs();Pn();Ir();Sr();ul();Mo();Do();ge();qs=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireCachedToken(e){let r=Ut.NOT_APPLICABLE;if(e.forceRefresh||!Pe.isEmptyObj(e.claims))throw this.setCacheOutcome(Ut.FORCE_REFRESH_OR_CLAIMS,e.correlationId),E(vo,e.correlationId);if(!e.account)throw E(ds,e.correlationId);let n=e.account.tenantId||gA(e.authority,e.correlationId),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,n);if(i){if(qp(i.cachedAt)||Fo(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(Ut.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),E(vo,e.correlationId);if(e.resource){if(i.resource!==e.resource)throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId)}else i.refreshOn&&Fo(i.refreshOn,0)&&(r=Ut.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId);let s=e.authority||this.authority.getPreferredCache(),a={account:this.cacheManager.getAccount(this.cacheManager.generateAccountKey(e.account),e.correlationId),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,e.correlationId,o,n),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCache(s,e.correlationId)};return this.setCacheOutcome(r,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[await G(this.generateResultFromCacheRecord.bind(this),VC,this.logger,this.performanceClient,e.correlationId)(a,e),r]}setCacheOutcome(e,r){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},r),e!==Ut.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: '${e}'`,r)}async generateResultFromCacheRecord(e,r){let n;return e.idToken&&(n=Cr(e.idToken.secret,this.config.cryptoInterface.base64Decode,r.correlationId)),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,r,this.performanceClient,n)}}});var Gs={};we(Gs,{getAuthorizationCodePayload:()=>T0,getAuthorizeUrl:()=>E0,getStandardAuthorizeRequestParameters:()=>y0,validateAuthorizationResponse:()=>CA});function y0(t,e,r,n){let o=e.correlationId,i=new Map;bn(i,e.embeddedClientId||e.extraQueryParameters?.[Kt]||t.clientId);let s=[...e.scopes||[],...e.extraScopesToConsent||[]];if(wn(i,s,e.correlationId,!0,t.authority.options.OIDCOptions?.defaultScopes),bs(i,e.resource),Rn(i,e.redirectUri),vn(i,o),Ip(i,e.responseMode),xn(i),Op(i),e.prompt&&(bp(i,e.prompt),n?.addFields({prompt:e.prompt},o)),e.domainHint&&(wp(i,e.domainHint),n?.addFields({domainHintFromRequest:!0},o)),e.prompt!==ns.SELECT_ACCOUNT)if(e.sid&&e.prompt===ns.NONE)r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request",e.correlationId),Hc(i,e.sid),n?.addFields({sidFromRequest:!0},o);else if(e.account){let a=A0(e.account),l=I0(e.account);if(l&&e.domainHint&&(r.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint',e.correlationId),l=null),l){r.verbose("createAuthCodeUrlQueryString: login_hint claim present on account",e.correlationId),xo(i,l),n?.addFields({loginHintFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(a&&e.prompt===ns.NONE){r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account",e.correlationId),Hc(i,a),n?.addFields({sidFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(e.loginHint)r.verbose("createAuthCodeUrlQueryString: Adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o);else if(e.account.username){r.verbose("createAuthCodeUrlQueryString: Adding login_hint from account",e.correlationId),xo(i,e.account.username),n?.addFields({loginHintFromUpn:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}}else e.loginHint&&(r.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o));else r.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints",e.correlationId);return e.nonce&&Rp(i,e.nonce),e.state&&gs(i,e.state),e.embeddedClientId&&Er(i,t.clientId,t.redirectUri),kn(i,e.correlationId,e.claims,t.clientCapabilities,e.skipBrokerClaims),t.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(wo))&&As(i),i}function E0(t,e){let r=Wt(e);return j.appendQueryString(t.authorizationEndpoint,r)}function T0(t,e,r){if(CA(t,e,r),!t.code)throw E(yp,r);return t}function CA(t,e,r){if(!t.state||!e)throw t.state?E($c,r,"Cached State"):E($c,r,"Server State");let n,o;try{n=decodeURIComponent(t.state)}catch{throw E(Sn,r,t.state)}try{o=decodeURIComponent(e)}catch{throw E(Sn,r,t.state)}if(n!==o)throw E(cp,r);if(t.error||t.error_description||t.suberror){let i=C0(t);throw ol(t.error,t.error_description,t.suberror)?new dt(t.error||"",t.correlation_id||r,t.error_description,t.suberror,t.timestamp||"",t.trace_id||"",t.claims||"",i):new qe(t.error||"",t.correlation_id||r,t.error_description,t.suberror,i)}}function C0(t){let e="code=",r=t.error_uri?.lastIndexOf(e);return r&&r>=0?t.error_uri?.substring(r+e.length):void 0}function A0(t){return t.idTokenClaims?.sid||null}function I0(t){return t.loginHint||t.idTokenClaims?.login_hint||null}var AA=h(()=>{"use strict";Oo();bo();ue();Uo();Po();qr();pe();Ls();jo();ge();});function Un(t,e){if(t){if(e.resource&&(IA(e.extraParameters)||IA(e.extraQueryParameters)))throw E(Ap,e.correlationId||"");if(!e.resource)throw E(Cp,e.correlationId||"")}}function IA(t){return t?Object.prototype.hasOwnProperty.call(t,"resource"):!1}var SA=h(()=>{"use strict";pe();ge();});var qo={};we(qo,{postRequestFailed:()=>_0,unexpectedError:()=>S0});var S0,_0,_A=h(()=>{"use strict";S0="unexpected_error",_0="post_request_failed"});function w0(t){let{skus:e,libraryName:r,libraryVersion:n,extensionName:o,extensionVersion:i}=t,s=new Map([[0,[r,n]],[2,[o,i]]]),a=[];if(e?.length){if(a=e.split(wA),a.length<4)return e}else a=Array.from({length:4},()=>bA);return s.forEach((l,c)=>{l.length===2&&l[0]?.length&&l[1]?.length&&b0({skuArr:a,index:c,skuName:l[0],skuVersion:l[1]})}),a.join(wA)}function b0(t){let{skuArr:e,index:r,skuName:n,skuVersion:o}=t;r>=e.length||(e[r]=[n,o].join(bA))}var wA,bA,$n,RA=h(()=>{"use strict";ue();At();wA=",",bA="|";$n=class t{constructor(e,r){this.cacheOutcome=Ut.NOT_APPLICABLE,this.cacheManager=r,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||"",this.wrapperVer=e.wrapperVer||"",this.telemetryCacheKey=is+Cn+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${Br}${this.cacheOutcome}`,r=[this.wrapperSKU,this.wrapperVer],n=this.getNativeBrokerErrorCode();n?.length&&r.push(`broker_error=${n}`);let o=r.join(Br),i=this.getRegionDiscoveryFields(),s=[e,i].join(Br);return[bc,s,o].join(Rc)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.failedRequests.slice(0,2*r).join(Br),o=e.errors.slice(0,r).join(Br),i=e.errors.length,s=r<i?Qf:Zf,a=[i,s].join(Br);return[bc,e.cacheHits,n,o,a].join(Rc)}cacheFailedRequest(e){try{let r=this.getLastRequests();r.errors.length>=Jf&&(r.failedRequests.shift(),r.failedRequests.shift(),r.errors.shift()),r.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof H?e.subError?r.errors.push(e.subError):e.errorCode?r.errors.push(e.errorCode):r.errors.push(e.toString()):r.errors.push(e.toString()):r.errors.push(eh),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}catch{}}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey,this.correlationId)||e}clearTelemetryCache(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.errors.length;if(r===n)this.cacheManager.removeItem(this.telemetryCacheKey,this.correlationId);else{let o={failedRequests:e.failedRequests.slice(r*2),errors:e.errors.slice(r),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o,this.correlationId)}}static maxErrorsToSend(e){let r,n=0,o=0,i=e.errors.length;for(r=0;r<i;r++){let s=e.failedRequests[2*r]||"",a=e.failedRequests[2*r+1]||"",l=e.errors[r]||"";if(o+=s.toString().length+a.toString().length+l.length+3,o<Xf)n+=1;else break}return n}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||""),e.push(this.regionSource||""),e.push(this.regionOutcome||""),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let r=this.getLastRequests();r.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId)}static makeExtraSkuString(e){return w0(e)}}});var W=h(()=>{"use strict";yA();EA();TA();Ps();$s();ul();Bc();xs();jp();qr();Np();AA();cl();SA();Oo();Us();hs();Mo();Ls();nl();At();_A();jo();om();pe();ge();hr();mr();ue();cs();RA();Pn();am();Jc();Kr();Po();bo();Gc();Vp();sl();zp();});var _r,fl=h(()=>{"use strict";W();_r=class{static deserializeJSONBlob(e){return e?JSON.parse(e):{}}static deserializeAccounts(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,realm:o.realm,localAccountId:o.local_account_id,username:o.username,authorityType:o.authority_type,name:o.name,clientInfo:o.client_info,lastModificationTime:o.last_modification_time,lastModificationApp:o.last_modification_app,tenantProfiles:o.tenantProfiles?.map(a=>JSON.parse(a)),lastUpdatedAt:Date.now().toString()},s={};Gr.toObject(s,i),r[n]=s}),r}static deserializeIdTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAccessTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,target:o.target,cachedAt:o.cached_at,expiresOn:o.expires_on,extendedExpiresOn:o.extended_expires_on,refreshOn:o.refresh_on,keyId:o.key_id,tokenType:o.token_type,userAssertionHash:o.userAssertionHash,resource:o.resource,additionalCacheKeyComponents:o.additionalCacheKeyComponents,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeRefreshTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,familyId:o.family_id,target:o.target,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAppMetadata(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n];r[n]={clientId:o.client_id,environment:o.environment,familyId:o.family_id}}),r}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}}});var cm={};we(cm,{Deserializer:()=>_r,Serializer:()=>Hr});var kA=h(()=>{"use strict";Ec();fl();});var vA,R0,lm,Le,Ce,U,$,le,fe,xA,OA,PA,NA,hl,um,Ke,te,St,pl,MA,J=h(()=>{"use strict";W();vA="system_assigned_managed_identity",R0="managed_identity",lm=`https://login.microsoftonline.com/${R0}/`,Le={AUTHORIZATION_HEADER_NAME:"Authorization",METADATA_HEADER_NAME:"Metadata",APP_SERVICE_SECRET_HEADER_NAME:"X-IDENTITY-HEADER",ML_AND_SF_SECRET_HEADER_NAME:"secret",CLIENT_SKU:Be.X_CLIENT_SKU,CLIENT_VER:Be.X_CLIENT_VER,CLIENT_REQUEST_ID:"x-ms-client-request-id"},Ce={API_VERSION:"api-version",RESOURCE:"resource",SHA256_TOKEN_TO_REFRESH:"token_sha256_to_refresh",XMS_CC:"xms_cc"},U={AZURE_POD_IDENTITY_AUTHORITY_HOST:"AZURE_POD_IDENTITY_AUTHORITY_HOST",DEFAULT_IDENTITY_CLIENT_ID:"DEFAULT_IDENTITY_CLIENT_ID",IDENTITY_ENDPOINT:"IDENTITY_ENDPOINT",IDENTITY_HEADER:"IDENTITY_HEADER",IDENTITY_SERVER_THUMBPRINT:"IDENTITY_SERVER_THUMBPRINT",IMDS_ENDPOINT:"IMDS_ENDPOINT",MSI_ENDPOINT:"MSI_ENDPOINT",MSI_SECRET:"MSI_SECRET"},$={APP_SERVICE:"AppService",AZURE_ARC:"AzureArc",CLOUD_SHELL:"CloudShell",DEFAULT_TO_IMDS:"DefaultToImds",IMDS:"Imds",MACHINE_LEARNING:"MachineLearning",SERVICE_FABRIC:"ServiceFabric"},le={SYSTEM_ASSIGNED:"system-assigned",USER_ASSIGNED_CLIENT_ID:"user-assigned-client-id",USER_ASSIGNED_RESOURCE_ID:"user-assigned-resource-id",USER_ASSIGNED_OBJECT_ID:"user-assigned-object-id"},fe={GET:"GET",POST:"POST"},xA="REGION_NAME",OA="MSAL_FORCE_REGION",PA=32,NA={SHA256:"sha256"},hl={CV_CHARSET:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"},um={KEY_SEPARATOR:"-"},Ke={MSAL_SKU:"msal.js.node",JWT_BEARER_ASSERTION_TYPE:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",HTTP_PROTOCOL:"http://",LOCALHOST:"localhost"},te={acquireTokenSilent:62,acquireTokenByUsernamePassword:371,acquireTokenByDeviceCode:671,acquireTokenByClientCredential:771,acquireTokenByOBO:772,acquireTokenWithManagedIdentity:773,acquireTokenByUserFederatedIdentityCredential:774,acquireTokenByCode:871,acquireTokenByRefreshToken:872},St={RSA_256:"RS256",PSS_256:"PS256",X5T_256:"x5t#S256",X5T:"x5t",X5C:"x5c",AUDIENCE:"aud",EXPIRATION_TIME:"exp",ISSUER:"iss",SUBJECT:"sub",NOT_BEFORE:"nbf",JWT_ID:"jti"},pl={INTERVAL_MS:100,TIMEOUT_MS:5e3},MA=4096});function k0(t){let e={};return t.forEach((r,n)=>{e[n]=r}),e}function v0(t){let e=new Headers;return t&&t.headers&&Object.entries(t.headers).forEach(([r,n])=>{e.append(r,n)}),e}var Go,DA=h(()=>{"use strict";W();J();Go=class{async sendGetRequestAsync(e,r,n){return this.sendRequest(e,fe.GET,r,n)}async sendPostRequestAsync(e,r){return this.sendRequest(e,fe.POST,r)}async sendRequest(e,r,n,o){let i=new AbortController,s;o&&(s=setTimeout(()=>{i.abort()},o));let a={method:r,headers:v0(n),signal:i.signal};r===fe.POST&&(a.body=n?.body||"");let l;try{l=await fetch(e,a)}catch(c){if(s&&clearTimeout(s),c instanceof Error&&c.name==="AbortError")throw In(me.networkError,"","Request timeout");let u=In(me.networkError,"",`Network request failed: ${c instanceof Error?c.message:"unknown"}`);throw nm(u,void 0,void 0,c instanceof Error?c:void 0)}s&&clearTimeout(s);try{return{headers:k0(l.headers),body:await l.json(),status:l.status}}catch(c){throw In(me.tokenParsingError,"",`Failed to parse response: ${c instanceof Error?c.message:"unknown"}`)}}}});var ml,gl,Yr,yl,LA,UA,El,Tl,Cl,Al,Ks,$A,Il,Sl,Fn,Hn=h(()=>{"use strict";J();ml="invalid_file_extension",gl="invalid_file_path",Yr="invalid_managed_identity_id_type",yl="invalid_secret",LA="missing_client_id",UA="network_unavailable",El="platform_not_supported",Tl="unable_to_create_azure_arc",Cl="unable_to_create_cloud_shell",Al="unable_to_create_source",Ks="unable_to_read_secret_file",$A="user_assigned_not_available_at_runtime",Il="www_authenticate_header_missing",Sl="www_authenticate_header_unsupported_format",Fn={[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]:"azure_pod_identity_authority_host_url_malformed",[U.IDENTITY_ENDPOINT]:"identity_endpoint_url_malformed",[U.IMDS_ENDPOINT]:"imds_endpoint_url_malformed",[U.MSI_ENDPOINT]:"msi_endpoint_url_malformed"}});function ye(t,e){return new dm(t,e)}var x0,dm,Ko=h(()=>{"use strict";W();Hn();J();x0={[ml]:"The file path in the WWW-Authenticate header does not contain a .key file.",[gl]:"The file path in the WWW-Authenticate header is not in a valid Windows or Linux Format.",[Yr]:"More than one ManagedIdentityIdType was provided.",[yl]:"The secret in the file on the file path in the WWW-Authenticate header is greater than 4096 bytes.",[El]:"The platform is not supported by Azure Arc. Azure Arc only supports Windows and Linux.",[LA]:"A ManagedIdentityId id was not provided.",[Fn.AZURE_POD_IDENTITY_AUTHORITY_HOST]:`The Managed Identity's '${U.AZURE_POD_IDENTITY_AUTHORITY_HOST}' environment variable is malformed.`,[Fn.IDENTITY_ENDPOINT]:`The Managed Identity's '${U.IDENTITY_ENDPOINT}' environment variable is malformed.`,[Fn.IMDS_ENDPOINT]:`The Managed Identity's '${U.IMDS_ENDPOINT}' environment variable is malformed.`,[Fn.MSI_ENDPOINT]:`The Managed Identity's '${U.MSI_ENDPOINT}' environment variable is malformed.`,[UA]:"Authentication unavailable. The request to the managed identity endpoint timed out.",[Tl]:"Azure Arc Managed Identities can only be system assigned.",[Cl]:"Cloud Shell Managed Identities can only be system assigned.",[Al]:"Unable to create a Managed Identity source based on environment variables.",[Ks]:"Unable to read the secret file.",[$A]:"Service Fabric user assigned managed identity ClientId or ResourceId is not configurable at runtime.",[Il]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is missing.",[Sl]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format."},dm=class t extends H{constructor(e,r){super(e,r,x0[e]),this.name="ManagedIdentityError",Object.setPrototypeOf(this,t.prototype)}}});var _l,FA=h(()=>{"use strict";Ko();J();Hn();_l=class{get id(){return this._id}set id(e){this._id=e}get idType(){return this._idType}set idType(e){this._idType=e}constructor(e){let r=e?.userAssignedClientId,n=e?.userAssignedResourceId,o=e?.userAssignedObjectId;if(r){if(n||o)throw ye(Yr,"");this.id=r,this.idType=le.USER_ASSIGNED_CLIENT_ID}else if(n){if(r||o)throw ye(Yr,"");this.id=n,this.idType=le.USER_ASSIGNED_RESOURCE_ID}else if(o){if(r||n)throw ye(Yr,"");this.id=o,this.idType=le.USER_ASSIGNED_OBJECT_ID}else this.id=vA,this.idType=le.SYSTEM_ASSIGNED}}});var Ae,ze,Ws=h(()=>{"use strict";W();Ae={invalidLoopbackAddressType:{code:"invalid_loopback_server_address_type",desc:"Loopback server address is not type string. This is unexpected."},unableToLoadRedirectUri:{code:"unable_to_load_redirectUrl",desc:"Loopback server callback was invoked without a url. This is unexpected."},noAuthCodeInResponse:{code:"no_auth_code_in_response",desc:"No auth code found in the server response. Please check your network trace to determine what happened."},noLoopbackServerExists:{code:"no_loopback_server_exists",desc:"No loopback server exists yet."},loopbackServerAlreadyExists:{code:"loopback_server_already_exists",desc:"Loopback server already exists. Cannot create another."},loopbackServerTimeout:{code:"loopback_server_timeout",desc:"Timed out waiting for auth code listener to be registered."},stateNotFoundError:{code:"state_not_found",desc:"State not found. Please verify that the request originated from msal."},thumbprintMissing:{code:"thumbprint_missing_from_client_certificate",desc:"Client certificate does not contain a SHA-1 or SHA-256 thumbprint."},redirectUriNotSupported:{code:"redirect_uri_not_supported",desc:"RedirectUri is not supported in this scenario. Please remove redirectUri from the request."}},ze=class t extends H{constructor(e,r,n){super(e,r,n),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new t(Ae.invalidLoopbackAddressType.code,"",`${Ae.invalidLoopbackAddressType.desc}`)}static createUnableToLoadRedirectUrlError(){return new t(Ae.unableToLoadRedirectUri.code,"",`${Ae.unableToLoadRedirectUri.desc}`)}static createNoAuthCodeInResponseError(e=""){return new t(Ae.noAuthCodeInResponse.code,e,`${Ae.noAuthCodeInResponse.desc}`)}static createNoLoopbackServerExistsError(){return new t(Ae.noLoopbackServerExists.code,"",`${Ae.noLoopbackServerExists.desc}`)}static createLoopbackServerAlreadyExistsError(){return new t(Ae.loopbackServerAlreadyExists.code,"",`${Ae.loopbackServerAlreadyExists.desc}`)}static createLoopbackServerTimeoutError(e=""){return new t(Ae.loopbackServerTimeout.code,e,`${Ae.loopbackServerTimeout.desc}`)}static createStateNotFoundError(e=""){return new t(Ae.stateNotFoundError.code,e,Ae.stateNotFoundError.desc)}static createThumbprintMissingError(){return new t(Ae.thumbprintMissing.code,"",Ae.thumbprintMissing.desc)}static createRedirectUriNotSupportedError(e=""){return new t(Ae.redirectUriNotSupported.code,e,Ae.redirectUriNotSupported.desc)}}});function HA({auth:t,broker:e,cache:r,system:n,telemetry:o}){let i={...P0,networkClient:new Go,loggerOptions:n?.loggerOptions||fm,disableInternalRetries:n?.disableInternalRetries||!1};if(t.clientCertificate&&!t.clientCertificate.thumbprint&&!t.clientCertificate.thumbprintSha256)throw ze.createStateNotFoundError();return{auth:{...O0,...t},broker:{...e},cache:{...r},system:{...i,...n},telemetry:{...N0,...o}}}function BA({clientCapabilities:t,managedIdentityIdParams:e,system:r}){let n=new _l(e),o=r?.loggerOptions||fm,i;return r?.networkClient?i=r.networkClient:i=new Go,{clientCapabilities:t||[],managedIdentityId:n,system:{loggerOptions:o,networkClient:i},disableInternalRetries:r?.disableInternalRetries||!1}}var O0,fm,P0,N0,hm=h(()=>{"use strict";W();DA();FA();Ws();O0={clientId:"",authority:A.DEFAULT_AUTHORITY,clientSecret:"",clientAssertion:"",clientCertificate:{thumbprint:"",thumbprintSha256:"",privateKey:"",x5c:""},knownAuthorities:[],cloudDiscoveryMetadata:"",authorityMetadata:"",clientCapabilities:[],azureCloudOptions:{azureCloudInstance:Tr.None,tenant:""},isMcp:!1},fm={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:ae.Info},P0={loggerOptions:fm,networkClient:new Go,disableInternalRetries:!1,protocolMode:je.AAD},N0={application:{appName:"",appVersion:""}}});import{randomUUID as M0}from"node:crypto";var Wo,pm=h(()=>{"use strict";Wo=class{generateGuid(){return M0()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}}});var ft,Ys=h(()=>{"use strict";W();ft=class t{static base64Encode(e,r){return Buffer.from(e,r).toString(A.EncodingTypes.BASE64)}static base64EncodeUrl(e,r){return t.base64Encode(e,r).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,A.EncodingTypes.BASE64).toString("utf8")}static base64DecodeUrl(e){let r=e.replace(/-/g,"+").replace(/_/g,"/");for(;r.length%4;)r+="=";return t.base64Decode(r)}}});import D0 from"crypto";var Xr,wl=h(()=>{"use strict";J();Xr=class{sha256(e){return D0.createHash(NA.SHA256).update(e).digest()}}});import L0 from"crypto";var bl,jA=h(()=>{"use strict";W();J();Ys();wl();bl=class{constructor(){this.hashUtils=new Xr}async generatePkceCodes(){let e=this.generateCodeVerifier(),r=this.generateCodeChallengeFromVerifier(e);return{verifier:e,challenge:r}}generateCodeVerifier(){let e=[],r=256-256%hl.CV_CHARSET.length;for(;e.length<=PA;){let o=L0.randomBytes(1)[0];if(o>=r)continue;let i=o%hl.CV_CHARSET.length;e.push(hl.CV_CHARSET[i])}let n=e.join("");return ft.base64EncodeUrl(n)}generateCodeChallengeFromVerifier(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});var Jt,Xs=h(()=>{"use strict";W();pm();Ys();jA();wl();Jt=class{constructor(){this.pkceGenerator=new bl,this.guidGenerator=new Wo,this.hashUtils=new Xr}base64UrlEncode(){throw new Error("Method not implemented.")}encodeKid(){throw new Error("Method not implemented.")}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return ft.base64Encode(e)}base64Decode(e){return ft.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});import{createHash as U0}from"crypto";function $0(t){let r=Object.keys(t).sort().map(n=>n+t[n]).join("");return U0("sha256").update(r,"utf8").digest("base64url")}function zA(t){let e=t.credentialType===A.CredentialType.REFRESH_TOKEN&&t.familyId||t.clientId,r=t.tokenType&&t.tokenType.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?t.tokenType.toLowerCase():"",n=[t.homeAccountId,t.environment,t.credentialType,e,t.realm||"",t.target||"",r];return t.additionalCacheKeyComponents&&Object.keys(t.additionalCacheKeyComponents).length>0&&n.push($0(t.additionalCacheKeyComponents)),n.join(um.KEY_SEPARATOR).toLowerCase()}function VA(t){let e=t.homeAccountId.split(".")[1];return[t.homeAccountId,t.environment,e||t.tenantId||""].join(um.KEY_SEPARATOR).toLowerCase()}var qA=h(()=>{"use strict";W();J();});var Jr,Rl=h(()=>{"use strict";W();fl();Ec();qA();Jr=class extends Gr{constructor(e,r,n,o){super(r,n,e,new Te,o),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){let r={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(let n in e){let o=e[n];if(typeof o=="object")if(Mn.isAccountEntity(o))r.accounts[n]=o;else if(Ve.isIdTokenEntity(o))r.idTokens[n]=o;else if(Ve.isAccessTokenEntity(o))r.accessTokens[n]=o;else if(Ve.isRefreshTokenEntity(o))r.refreshTokens[n]=o;else if(Ve.isAppMetadataEntity(n,o))r.appMetadata[n]=o;else continue}return r}inMemoryCacheToCache(e){let r=this.getCache();return r={...r,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},r}getInMemoryCache(){return this.logger.trace("Getting in-memory cache",""),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache","");let r=this.inMemoryCacheToCache(e);this.setCache(r),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store",""),this.cache}setCache(e){this.logger.trace("Setting cache key value store",""),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii(`Item key: ${e}`,""),this.getCache()[e]}setItem(e,r){this.logger.tracePii(`Item key: ${e}`,"");let n=this.getCache();n[e]=r,this.setCache(n)}generateCredentialKey(e){return zA(e)}generateAccountKey(e){return VA(e)}getAccountKeys(){let e=this.getInMemoryCache();return Object.keys(e.accounts)}getTokenKeys(){let e=this.getInMemoryCache();return{idToken:Object.keys(e.idTokens),accessToken:Object.keys(e.accessTokens),refreshToken:Object.keys(e.refreshTokens)}}getAccount(e){let r=this.getItem(e);return r&&typeof r=="object"?{...r}:null}async setAccount(e){let r=this.generateAccountKey(Mn.getAccountInfo(e));this.setItem(r,e)}getIdTokenCredential(e){let r=this.getItem(e);return Ve.isIdTokenEntity(r)?r:null}async setIdTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAccessTokenCredential(e){let r=this.getItem(e);return Ve.isAccessTokenEntity(r)?r:null}async setAccessTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getRefreshTokenCredential(e){let r=this.getItem(e);return Ve.isRefreshTokenEntity(r)?r:null}async setRefreshTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAppMetadata(e){let r=this.getItem(e);return Ve.isAppMetadataEntity(e,r)?r:null}setAppMetadata(e){let r=Ve.generateAppMetadataKey(e);this.setItem(r,e)}getServerTelemetry(e){let r=this.getItem(e);return r&&Ve.isServerTelemetryEntity(e,r)?r:null}setServerTelemetry(e,r){this.setItem(e,r)}getAuthorityMetadata(e){let r=this.getItem(e);return r&&Ve.isAuthorityMetadataEntity(e,r)?r:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,r){this.setItem(e,r)}getThrottlingCache(e){let r=this.getItem(e);return r&&Ve.isThrottlingEntity(e,r)?r:null}setThrottlingCache(e,r){this.setItem(e,r)}removeItem(e){this.logger.tracePii(`Item key: ${e}`,"");let r=!1,n=this.getCache();return n[e]&&(delete n[e],r=!0),r&&(this.setCache(n),this.emitChange()),r}removeOutdatedAccount(e){this.removeItem(e)}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys","");let e=this.getCache();return[...Object.keys(e)]}clear(){this.logger.trace("Clearing cache entries created by MSAL",""),this.getKeys().forEach(r=>{this.isAuthorityMetadata(r)||this.removeItem(r)}),this.emitChange()}static generateInMemoryCache(e){return _r.deserializeAllCache(_r.deserializeJSONBlob(e))}static generateJsonCache(e){return Hr.serializeAllCache(e)}updateCredentialCacheKey(e,r){let n=this.generateCredentialKey(r);if(e!==n){let o=this.getItem(e);if(o)return this.removeItem(e),this.setItem(n,o),this.logger.verbose(`Updated an outdated ${r.credentialType} cache key`,""),n;this.logger.error(`Attempted to update an outdated ${r.credentialType} cache key but no item matching the outdated key was found in storage`,"")}return e}}});var Js,Yo,mm=h(()=>{"use strict";Rl();W();fl();Ec();pm();Xs();Js={Account:{},IdToken:{},AccessToken:{},RefreshToken:{},AppMetadata:{}},Yo=class{constructor(e,r,n){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),n&&(this.persistence=n),this.logger=r}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache","");let e=Hr.serializeAllCache(this.storage.getInMemoryCache());return this.cacheSnapshot?(this.logger.trace("Reading cache snapshot from disk",""),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)):this.logger.trace("No cache snapshot to merge",""),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache",""),this.cacheSnapshot=e,this.cacheSnapshot){this.logger.trace("Reading cache snapshot from disk","");let r=_r.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(r)}else this.logger.trace("No cache snapshot to deserialize","")}getKVStore(){return this.storage.getCache()}getCacheSnapshot(){let e=Jr.generateInMemoryCache(this.cacheSnapshot);return this.storage.inMemoryCacheToCache(e)}async getAllAccounts(e=new Jt().createNewGuid()){this.logger.trace("getAllAccounts called",e);let r;try{return this.persistence&&(r=new lt(this,!1),await this.persistence.beforeCacheAccess(r)),this.storage.getAllAccounts({},e)}finally{this.persistence&&r&&await this.persistence.afterCacheAccess(r)}}async getAccountByHomeId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.homeAccountId===e)[0]||null}async getAccountByLocalId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.localAccountId===e)[0]||null}async removeAccount(e,r){this.logger.trace("removeAccount called",r||"");let n;try{this.persistence&&(n=new lt(this,!0),await this.persistence.beforeCacheAccess(n)),this.storage.removeAccount(e,r||new Wo().generateGuid())}finally{this.persistence&&n&&await this.persistence.afterCacheAccess(n)}}async overwriteCache(){if(!this.persistence){this.logger.info("No persistence layer specified, cache cannot be overwritten","");return}this.logger.info("Overwriting in-memory cache with persistent cache",""),this.storage.clear();let e=new lt(this,!1);await this.persistence.beforeCacheAccess(e);let r=this.getCacheSnapshot();this.storage.setCache(r),await this.persistence.afterCacheAccess(e)}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,r){this.logger.trace("Merging in-memory cache with cache snapshot","");let n=this.mergeRemovals(e,r);return this.mergeUpdates(n,r)}mergeUpdates(e,r){return Object.keys(r).forEach(n=>{let o=r[n];if(!e.hasOwnProperty(n))o!==null&&(e[n]=o);else{let i=o!==null,s=typeof o=="object",a=!Array.isArray(o),l=typeof e[n]<"u"&&e[n]!==null;i&&s&&a&&l?this.mergeUpdates(e[n],o):e[n]=o}}),e}mergeRemovals(e,r){this.logger.trace("Remove updated entries in cache","");let n=e.Account?this.mergeRemovalsDict(e.Account,r.Account):e.Account,o=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,r.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,r.RefreshToken):e.RefreshToken,s=e.IdToken?this.mergeRemovalsDict(e.IdToken,r.IdToken):e.IdToken,a=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,r.AppMetadata):e.AppMetadata;return{...e,Account:n,AccessToken:o,RefreshToken:i,IdToken:s,AppMetadata:a}}mergeRemovalsDict(e,r){let n={...e};return Object.keys(e).forEach(o=>{(!r||!r.hasOwnProperty(o))&&delete n[o]}),n}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache",""),{Account:{...Js.Account,...e.Account},IdToken:{...Js.IdToken,...e.IdToken},AccessToken:{...Js.AccessToken,...e.AccessToken},RefreshToken:{...Js.RefreshToken,...e.RefreshToken},AppMetadata:{...Js.AppMetadata,...e.AppMetadata}}}}});var Xo=S((gm,KA)=>{var kl=L("buffer"),Qt=kl.Buffer;function GA(t,e){for(var r in t)e[r]=t[r]}Qt.from&&Qt.alloc&&Qt.allocUnsafe&&Qt.allocUnsafeSlow?KA.exports=kl:(GA(kl,gm),gm.Buffer=Bn);function Bn(t,e,r){return Qt(t,e,r)}Bn.prototype=Object.create(Qt.prototype);GA(Qt,Bn);Bn.from=function(t,e,r){if(typeof t=="number")throw new TypeError("Argument must not be a number");return Qt(t,e,r)};Bn.alloc=function(t,e,r){if(typeof t!="number")throw new TypeError("Argument must be a number");var n=Qt(t);return e!==void 0?typeof r=="string"?n.fill(e,r):n.fill(e):n.fill(0),n};Bn.allocUnsafe=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return Qt(t)};Bn.allocUnsafeSlow=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return kl.SlowBuffer(t)}});var ym=S((qY,WA)=>{var vl=Xo().Buffer,F0=L("stream"),H0=L("util");function xl(t){if(this.buffer=null,this.writable=!0,this.readable=!0,!t)return this.buffer=vl.alloc(0),this;if(typeof t.pipe=="function")return this.buffer=vl.alloc(0),t.pipe(this),this;if(t.length||typeof t=="object")return this.buffer=t,this.writable=!1,process.nextTick(function(){this.emit("end",t),this.readable=!1,this.emit("close")}.bind(this)),this;throw new TypeError("Unexpected data type ("+typeof t+")")}H0.inherits(xl,F0);xl.prototype.write=function(e){this.buffer=vl.concat([this.buffer,vl.from(e)]),this.emit("data",e)};xl.prototype.end=function(e){e&&this.write(e),this.emit("end",e),this.emit("close"),this.writable=!1,this.readable=!1};WA.exports=xl});var XA=S((GY,YA)=>{"use strict";function Em(t){var e=(t/8|0)+(t%8===0?0:1);return e}var B0={ES256:Em(256),ES384:Em(384),ES512:Em(521)};function j0(t){var e=B0[t];if(e)return e;throw new Error('Unknown algorithm "'+t+'"')}YA.exports=j0});var nI=S((KY,rI)=>{"use strict";var Ol=Xo().Buffer,QA=XA(),Pl=128,ZA=0,z0=32,V0=16,q0=2,eI=V0|z0|ZA<<6,Nl=q0|ZA<<6;function G0(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function tI(t){if(Ol.isBuffer(t))return t;if(typeof t=="string")return Ol.from(t,"base64");throw new TypeError("ECDSA signature must be a Base64 string or a Buffer")}function K0(t,e){t=tI(t);var r=QA(e),n=r+1,o=t.length,i=0;if(t[i++]!==eI)throw new Error('Could not find expected "seq"');var s=t[i++];if(s===(Pl|1)&&(s=t[i++]),o-i<s)throw new Error('"seq" specified length of "'+s+'", only "'+(o-i)+'" remaining');if(t[i++]!==Nl)throw new Error('Could not find expected "int" for "r"');var a=t[i++];if(o-i-2<a)throw new Error('"r" specified length of "'+a+'", only "'+(o-i-2)+'" available');if(n<a)throw new Error('"r" specified length of "'+a+'", max of "'+n+'" is acceptable');var l=i;if(i+=a,t[i++]!==Nl)throw new Error('Could not find expected "int" for "s"');var c=t[i++];if(o-i!==c)throw new Error('"s" specified length of "'+c+'", expected "'+(o-i)+'"');if(n<c)throw new Error('"s" specified length of "'+c+'", max of "'+n+'" is acceptable');var u=i;if(i+=c,i!==o)throw new Error('Expected to consume entire buffer, but "'+(o-i)+'" bytes remain');var d=r-a,f=r-c,p=Ol.allocUnsafe(d+a+f+c);for(i=0;i<d;++i)p[i]=0;t.copy(p,i,l+Math.max(-d,0),l+a),i=r;for(var g=i;i<g+f;++i)p[i]=0;return t.copy(p,i,u+Math.max(-f,0),u+c),p=p.toString("base64"),p=G0(p),p}function JA(t,e,r){for(var n=0;e+n<r&&t[e+n]===0;)++n;var o=t[e+n]>=Pl;return o&&--n,n}function W0(t,e){t=tI(t);var r=QA(e),n=t.length;if(n!==r*2)throw new TypeError('"'+e+'" signatures must be "'+r*2+'" bytes, saw "'+n+'"');var o=JA(t,0,r),i=JA(t,r,t.length),s=r-o,a=r-i,l=2+s+1+1+a,c=l<Pl,u=Ol.allocUnsafe((c?2:3)+l),d=0;return u[d++]=eI,c?u[d++]=l:(u[d++]=Pl|1,u[d++]=l&255),u[d++]=Nl,u[d++]=s,o<0?(u[d++]=0,d+=t.copy(u,d,0,r)):d+=t.copy(u,d,o,r),u[d++]=Nl,u[d++]=a,i<0?(u[d++]=0,t.copy(u,d,r)):t.copy(u,d,r+i),u}rI.exports={derToJose:K0,joseToDer:W0}});var iI=S((WY,oI)=>{"use strict";var Qs=L("buffer").Buffer,Tm=L("buffer").SlowBuffer;oI.exports=Ml;function Ml(t,e){if(!Qs.isBuffer(t)||!Qs.isBuffer(e)||t.length!==e.length)return!1;for(var r=0,n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}Ml.install=function(){Qs.prototype.equal=Tm.prototype.equal=function(e){return Ml(this,e)}};var Y0=Qs.prototype.equal,X0=Tm.prototype.equal;Ml.restore=function(){Qs.prototype.equal=Y0,Tm.prototype.equal=X0}});var Sm=S((YY,pI)=>{var Qo=Xo().Buffer,_t=L("crypto"),aI=nI(),sI=L("util"),J0=`"%s" is not a valid algorithm. | ||
| Supported algorithms are: | ||
| "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,Zs="secret must be a string or buffer",Jo="key must be a string or a buffer",Q0="key must be a string, a buffer or an object",Am=typeof _t.createPublicKey=="function";Am&&(Jo+=" or a KeyObject",Zs+="or a KeyObject");function cI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&(!Am||typeof t!="object"||typeof t.type!="string"||typeof t.asymmetricKeyType!="string"||typeof t.export!="function"))throw Bt(Jo)}function lI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&typeof t!="object")throw Bt(Q0)}function Z0(t){if(!Qo.isBuffer(t)){if(typeof t=="string")return t;if(!Am||typeof t!="object"||t.type!=="secret"||typeof t.export!="function")throw Bt(Zs)}}function Im(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function uI(t){t=t.toString();var e=4-t.length%4;if(e!==4)for(var r=0;r<e;++r)t+="=";return t.replace(/\-/g,"+").replace(/_/g,"/")}function Bt(t){var e=[].slice.call(arguments,1),r=sI.format.bind(sI,t).apply(null,e);return new TypeError(r)}function eM(t){return Qo.isBuffer(t)||typeof t=="string"}function ea(t){return eM(t)||(t=JSON.stringify(t)),t}function dI(t){return function(r,n){Z0(n),r=ea(r);var o=_t.createHmac("sha"+t,n),i=(o.update(r),o.digest("base64"));return Im(i)}}var Cm,tM="timingSafeEqual"in _t?function(e,r){return e.byteLength!==r.byteLength?!1:_t.timingSafeEqual(e,r)}:function(e,r){return Cm||(Cm=iI()),Cm(e,r)};function rM(t){return function(r,n,o){var i=dI(t)(r,o);return tM(Qo.from(n),Qo.from(i))}}function fI(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign(n,"base64"));return Im(i)}}function hI(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify(o,n,"base64")}}function nM(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign({key:n,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},"base64"));return Im(i)}}function oM(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify({key:o,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},n,"base64")}}function iM(t){var e=fI(t);return function(){var n=e.apply(null,arguments);return n=aI.derToJose(n,"ES"+t),n}}function sM(t){var e=hI(t);return function(n,o,i){o=aI.joseToDer(o,"ES"+t).toString("base64");var s=e(n,o,i);return s}}function aM(){return function(){return""}}function cM(){return function(e,r){return r===""}}pI.exports=function(e){var r={hs:dI,rs:fI,ps:nM,es:iM,none:aM},n={hs:rM,rs:hI,ps:oM,es:sM,none:cM},o=e.match(/^(RS|PS|ES|HS)(256|384|512)$|^(none)$/);if(!o)throw Bt(J0,e);var i=(o[1]||o[3]).toLowerCase(),s=o[2];return{sign:r[i](s),verify:n[i](s)}}});var _m=S((XY,mI)=>{var lM=L("buffer").Buffer;mI.exports=function(e){return typeof e=="string"?e:typeof e=="number"||lM.isBuffer(e)?e.toString():JSON.stringify(e)}});var AI=S((JY,CI)=>{var uM=Xo().Buffer,gI=ym(),dM=Sm(),fM=L("stream"),yI=_m(),wm=L("util");function EI(t,e){return uM.from(t,e).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function hM(t,e,r){r=r||"utf8";var n=EI(yI(t),"binary"),o=EI(yI(e),r);return wm.format("%s.%s",n,o)}function TI(t){var e=t.header,r=t.payload,n=t.secret||t.privateKey,o=t.encoding,i=dM(e.alg),s=hM(e,r,o),a=i.sign(s,n);return wm.format("%s.%s",s,a)}function Dl(t){var e=t.secret;if(e=e??t.privateKey,e=e??t.key,/^hs/i.test(t.header.alg)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new gI(e);this.readable=!0,this.header=t.header,this.encoding=t.encoding,this.secret=this.privateKey=this.key=r,this.payload=new gI(t.payload),this.secret.once("close",function(){!this.payload.writable&&this.readable&&this.sign()}.bind(this)),this.payload.once("close",function(){!this.secret.writable&&this.readable&&this.sign()}.bind(this))}wm.inherits(Dl,fM);Dl.prototype.sign=function(){try{var e=TI({header:this.header,payload:this.payload.buffer,secret:this.secret.buffer,encoding:this.encoding});return this.emit("done",e),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(r){this.readable=!1,this.emit("error",r),this.emit("close")}};Dl.sign=TI;CI.exports=Dl});var OI=S((QY,xI)=>{var SI=Xo().Buffer,II=ym(),pM=Sm(),mM=L("stream"),_I=_m(),gM=L("util"),yM=/^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;function EM(t){return Object.prototype.toString.call(t)==="[object Object]"}function TM(t){if(EM(t))return t;try{return JSON.parse(t)}catch{return}}function wI(t){var e=t.split(".",1)[0];return TM(SI.from(e,"base64").toString("binary"))}function CM(t){return t.split(".",2).join(".")}function bI(t){return t.split(".")[2]}function AM(t,e){e=e||"utf8";var r=t.split(".")[1];return SI.from(r,"base64").toString(e)}function RI(t){return yM.test(t)&&!!wI(t)}function kI(t,e,r){if(!e){var n=new Error("Missing algorithm parameter for jws.verify");throw n.code="MISSING_ALGORITHM",n}t=_I(t);var o=bI(t),i=CM(t),s=pM(e);return s.verify(i,o,r)}function vI(t,e){if(e=e||{},t=_I(t),!RI(t))return null;var r=wI(t);if(!r)return null;var n=AM(t);return(r.typ==="JWT"||e.json)&&(n=JSON.parse(n,e.encoding)),{header:r,payload:n,signature:bI(t)}}function Zo(t){t=t||{};var e=t.secret;if(e=e??t.publicKey,e=e??t.key,/^hs/i.test(t.algorithm)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new II(e);this.readable=!0,this.algorithm=t.algorithm,this.encoding=t.encoding,this.secret=this.publicKey=this.key=r,this.signature=new II(t.signature),this.secret.once("close",function(){!this.signature.writable&&this.readable&&this.verify()}.bind(this)),this.signature.once("close",function(){!this.secret.writable&&this.readable&&this.verify()}.bind(this))}gM.inherits(Zo,mM);Zo.prototype.verify=function(){try{var e=kI(this.signature.buffer,this.algorithm,this.key.buffer),r=vI(this.signature.buffer,this.encoding);return this.emit("done",e,r),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(n){this.readable=!1,this.emit("error",n),this.emit("close")}};Zo.decode=vI;Zo.isValid=RI;Zo.verify=kI;xI.exports=Zo});var Ul=S(Qr=>{var PI=AI(),Ll=OI(),IM=["HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512"];Qr.ALGORITHMS=IM;Qr.sign=PI.sign;Qr.verify=Ll.verify;Qr.decode=Ll.decode;Qr.isValid=Ll.isValid;Qr.createSign=function(e){return new PI(e)};Qr.createVerify=function(e){return new Ll(e)}});var bm=S((e5,NI)=>{var SM=Ul();NI.exports=function(t,e){e=e||{};var r=SM.decode(t,e);if(!r)return null;var n=r.payload;if(typeof n=="string")try{var o=JSON.parse(n);o!==null&&typeof o=="object"&&(n=o)}catch{}return e.complete===!0?{header:r.header,payload:n,signature:r.signature}:n}});var ta=S((t5,MI)=>{var $l=function(t,e){Error.call(this,t),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor),this.name="JsonWebTokenError",this.message=t,e&&(this.inner=e)};$l.prototype=Object.create(Error.prototype);$l.prototype.constructor=$l;MI.exports=$l});var Rm=S((r5,LI)=>{var DI=ta(),Fl=function(t,e){DI.call(this,t),this.name="NotBeforeError",this.date=e};Fl.prototype=Object.create(DI.prototype);Fl.prototype.constructor=Fl;LI.exports=Fl});var km=S((n5,$I)=>{var UI=ta(),Hl=function(t,e){UI.call(this,t),this.name="TokenExpiredError",this.expiredAt=e};Hl.prototype=Object.create(UI.prototype);Hl.prototype.constructor=Hl;$I.exports=Hl});var vm=S((o5,FI)=>{var ei=1e3,ti=ei*60,ri=ti*60,jn=ri*24,_M=jn*7,wM=jn*365.25;FI.exports=function(t,e){e=e||{};var r=typeof t;if(r==="string"&&t.length>0)return bM(t);if(r==="number"&&isFinite(t))return e.long?kM(t):RM(t);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(t))};function bM(t){if(t=String(t),!(t.length>100)){var e=/^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(t);if(e){var r=parseFloat(e[1]),n=(e[2]||"ms").toLowerCase();switch(n){case"years":case"year":case"yrs":case"yr":case"y":return r*wM;case"weeks":case"week":case"w":return r*_M;case"days":case"day":case"d":return r*jn;case"hours":case"hour":case"hrs":case"hr":case"h":return r*ri;case"minutes":case"minute":case"mins":case"min":case"m":return r*ti;case"seconds":case"second":case"secs":case"sec":case"s":return r*ei;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return r;default:return}}}}function RM(t){var e=Math.abs(t);return e>=jn?Math.round(t/jn)+"d":e>=ri?Math.round(t/ri)+"h":e>=ti?Math.round(t/ti)+"m":e>=ei?Math.round(t/ei)+"s":t+"ms"}function kM(t){var e=Math.abs(t);return e>=jn?Bl(t,e,jn,"day"):e>=ri?Bl(t,e,ri,"hour"):e>=ti?Bl(t,e,ti,"minute"):e>=ei?Bl(t,e,ei,"second"):t+" ms"}function Bl(t,e,r,n){var o=e>=r*1.5;return Math.round(t/r)+" "+n+(o?"s":"")}});var xm=S((i5,HI)=>{var vM=vm();HI.exports=function(t,e){var r=e||Math.floor(Date.now()/1e3);if(typeof t=="string"){var n=vM(t);return typeof n>"u"?void 0:Math.floor(r+n/1e3)}else return typeof t=="number"?r+t:void 0}});var ni=S((s5,BI)=>{"use strict";var xM="2.0.0",OM=Number.MAX_SAFE_INTEGER||9007199254740991,PM=16,NM=250,MM=["major","premajor","minor","preminor","patch","prepatch","prerelease"];BI.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:PM,MAX_SAFE_BUILD_LENGTH:NM,MAX_SAFE_INTEGER:OM,RELEASE_TYPES:MM,SEMVER_SPEC_VERSION:xM,FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var ra=S((a5,jI)=>{"use strict";var DM=typeof process=="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...t)=>console.error("SEMVER",...t):()=>{};jI.exports=DM});var oi=S((Zt,zI)=>{"use strict";var{MAX_SAFE_COMPONENT_LENGTH:Om,MAX_SAFE_BUILD_LENGTH:LM,MAX_LENGTH:UM}=ni(),$M=ra();Zt=zI.exports={};var FM=Zt.re=[],HM=Zt.safeRe=[],x=Zt.src=[],BM=Zt.safeSrc=[],O=Zt.t={},jM=0,Pm="[a-zA-Z0-9-]",zM=[["\\s",1],["\\d",UM],[Pm,LM]],VM=t=>{for(let[e,r]of zM)t=t.split(`${e}*`).join(`${e}{0,${r}}`).split(`${e}+`).join(`${e}{1,${r}}`);return t},B=(t,e,r)=>{let n=VM(e),o=jM++;$M(t,o,e),O[t]=o,x[o]=e,BM[o]=n,FM[o]=new RegExp(e,r?"g":void 0),HM[o]=new RegExp(n,r?"g":void 0)};B("NUMERICIDENTIFIER","0|[1-9]\\d*");B("NUMERICIDENTIFIERLOOSE","\\d+");B("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${Pm}*`);B("MAINVERSION",`(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})`);B("MAINVERSIONLOOSE",`(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASEIDENTIFIER",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIER]})`);B("PRERELEASEIDENTIFIERLOOSE",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASE",`(?:-(${x[O.PRERELEASEIDENTIFIER]}(?:\\.${x[O.PRERELEASEIDENTIFIER]})*))`);B("PRERELEASELOOSE",`(?:-?(${x[O.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${x[O.PRERELEASEIDENTIFIERLOOSE]})*))`);B("BUILDIDENTIFIER",`${Pm}+`);B("BUILD",`(?:\\+(${x[O.BUILDIDENTIFIER]}(?:\\.${x[O.BUILDIDENTIFIER]})*))`);B("FULLPLAIN",`v?${x[O.MAINVERSION]}${x[O.PRERELEASE]}?${x[O.BUILD]}?`);B("FULL",`^${x[O.FULLPLAIN]}$`);B("LOOSEPLAIN",`[v=\\s]*${x[O.MAINVERSIONLOOSE]}${x[O.PRERELEASELOOSE]}?${x[O.BUILD]}?`);B("LOOSE",`^${x[O.LOOSEPLAIN]}$`);B("GTLT","((?:<|>)?=?)");B("XRANGEIDENTIFIERLOOSE",`${x[O.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);B("XRANGEIDENTIFIER",`${x[O.NUMERICIDENTIFIER]}|x|X|\\*`);B("XRANGEPLAIN",`[v=\\s]*(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:${x[O.PRERELEASE]})?${x[O.BUILD]}?)?)?`);B("XRANGEPLAINLOOSE",`[v=\\s]*(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:${x[O.PRERELEASELOOSE]})?${x[O.BUILD]}?)?)?`);B("XRANGE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAIN]}$`);B("XRANGELOOSE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAINLOOSE]}$`);B("COERCEPLAIN",`(^|[^\\d])(\\d{1,${Om}})(?:\\.(\\d{1,${Om}}))?(?:\\.(\\d{1,${Om}}))?`);B("COERCE",`${x[O.COERCEPLAIN]}(?:$|[^\\d])`);B("COERCEFULL",x[O.COERCEPLAIN]+`(?:${x[O.PRERELEASE]})?(?:${x[O.BUILD]})?(?:$|[^\\d])`);B("COERCERTL",x[O.COERCE],!0);B("COERCERTLFULL",x[O.COERCEFULL],!0);B("LONETILDE","(?:~>?)");B("TILDETRIM",`(\\s*)${x[O.LONETILDE]}\\s+`,!0);Zt.tildeTrimReplace="$1~";B("TILDE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAIN]}$`);B("TILDELOOSE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAINLOOSE]}$`);B("LONECARET","(?:\\^)");B("CARETTRIM",`(\\s*)${x[O.LONECARET]}\\s+`,!0);Zt.caretTrimReplace="$1^";B("CARET",`^${x[O.LONECARET]}${x[O.XRANGEPLAIN]}$`);B("CARETLOOSE",`^${x[O.LONECARET]}${x[O.XRANGEPLAINLOOSE]}$`);B("COMPARATORLOOSE",`^${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]})$|^$`);B("COMPARATOR",`^${x[O.GTLT]}\\s*(${x[O.FULLPLAIN]})$|^$`);B("COMPARATORTRIM",`(\\s*)${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]}|${x[O.XRANGEPLAIN]})`,!0);Zt.comparatorTrimReplace="$1$2$3";B("HYPHENRANGE",`^\\s*(${x[O.XRANGEPLAIN]})\\s+-\\s+(${x[O.XRANGEPLAIN]})\\s*$`);B("HYPHENRANGELOOSE",`^\\s*(${x[O.XRANGEPLAINLOOSE]})\\s+-\\s+(${x[O.XRANGEPLAINLOOSE]})\\s*$`);B("STAR","(<|>)?=?\\s*\\*");B("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");B("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var jl=S((c5,VI)=>{"use strict";var qM=Object.freeze({loose:!0}),GM=Object.freeze({}),KM=t=>t?typeof t!="object"?qM:t:GM;VI.exports=KM});var Nm=S((l5,KI)=>{"use strict";var qI=/^[0-9]+$/,GI=(t,e)=>{if(typeof t=="number"&&typeof e=="number")return t===e?0:t<e?-1:1;let r=qI.test(t),n=qI.test(e);return r&&n&&(t=+t,e=+e),t===e?0:r&&!n?-1:n&&!r?1:t<e?-1:1},WM=(t,e)=>GI(e,t);KI.exports={compareIdentifiers:GI,rcompareIdentifiers:WM}});var Ue=S((u5,YI)=>{"use strict";var zl=ra(),{MAX_LENGTH:WI,MAX_SAFE_INTEGER:Vl}=ni(),{safeRe:ql,t:Gl}=oi(),YM=jl(),{compareIdentifiers:Mm}=Nm(),XM=(t,e)=>{let r=e.split(".");if(r.length>t.length)return!1;for(let n=0;n<r.length;n++)if(Mm(t[n],r[n])!==0)return!1;return!0},Dm=class t{constructor(e,r){if(r=YM(r),e instanceof t){if(e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease)return e;e=e.version}else if(typeof e!="string")throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>WI)throw new TypeError(`version is longer than ${WI} characters`);zl("SemVer",e,r),this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease;let n=e.trim().match(r.loose?ql[Gl.LOOSE]:ql[Gl.FULL]);if(!n)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+n[1],this.minor=+n[2],this.patch=+n[3],this.major>Vl||this.major<0)throw new TypeError("Invalid major version");if(this.minor>Vl||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>Vl||this.patch<0)throw new TypeError("Invalid patch version");n[4]?this.prerelease=n[4].split(".").map(o=>{if(/^[0-9]+$/.test(o)){let i=+o;if(i>=0&&i<Vl)return i}return o}):this.prerelease=[],this.build=n[5]?n[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(zl("SemVer.compare",this.version,this.options,e),!(e instanceof t)){if(typeof e=="string"&&e===this.version)return 0;e=new t(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof t||(e=new t(e,this.options)),this.major<e.major?-1:this.major>e.major?1:this.minor<e.minor?-1:this.minor>e.minor?1:this.patch<e.patch?-1:this.patch>e.patch?1:0}comparePre(e){if(e instanceof t||(e=new t(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let r=0;do{let n=this.prerelease[r],o=e.prerelease[r];if(zl("prerelease compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}compareBuild(e){e instanceof t||(e=new t(e,this.options));let r=0;do{let n=this.build[r],o=e.build[r];if(zl("build compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}inc(e,r,n){if(e.startsWith("pre")){if(!r&&n===!1)throw new Error("invalid increment argument: identifier is empty");if(r){let o=`-${r}`.match(this.options.loose?ql[Gl.PRERELEASELOOSE]:ql[Gl.PRERELEASE]);if(!o||o[1]!==r)throw new Error(`invalid identifier: ${r}`)}}switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",r,n);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",r,n);break;case"prepatch":this.prerelease.length=0,this.inc("patch",r,n),this.inc("pre",r,n);break;case"prerelease":this.prerelease.length===0&&this.inc("patch",r,n),this.inc("pre",r,n);break;case"release":if(this.prerelease.length===0)throw new Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":(this.minor!==0||this.patch!==0||this.prerelease.length===0)&&this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":(this.patch!==0||this.prerelease.length===0)&&this.minor++,this.patch=0,this.prerelease=[];break;case"patch":this.prerelease.length===0&&this.patch++,this.prerelease=[];break;case"pre":{let o=Number(n)?1:0;if(this.prerelease.length===0)this.prerelease=[o];else{let i=this.prerelease.length;for(;--i>=0;)typeof this.prerelease[i]=="number"&&(this.prerelease[i]++,i=-2);if(i===-1){if(r===this.prerelease.join(".")&&n===!1)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(o)}}if(r){let i=[r,o];if(n===!1&&(i=[r]),XM(this.prerelease,r)){let s=this.prerelease[r.split(".").length];isNaN(s)&&(this.prerelease=i)}else this.prerelease=i}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}};YI.exports=Dm});var Zr=S((d5,JI)=>{"use strict";var XI=Ue(),JM=(t,e,r=!1)=>{if(t instanceof XI)return t;try{return new XI(t,e)}catch(n){if(!r)return null;throw n}};JI.exports=JM});var ZI=S((f5,QI)=>{"use strict";var QM=Zr(),ZM=(t,e)=>{let r=QM(t,e);return r?r.version:null};QI.exports=ZM});var tS=S((h5,eS)=>{"use strict";var eD=Zr(),tD=(t,e)=>{let r=eD(t.trim().replace(/^[=v]+/,""),e);return r?r.version:null};eS.exports=tD});var oS=S((p5,nS)=>{"use strict";var rS=Ue(),rD=(t,e,r,n,o)=>{typeof r=="string"&&(o=n,n=r,r=void 0);try{return new rS(t instanceof rS?t.version:t,r).inc(e,n,o).version}catch{return null}};nS.exports=rD});var aS=S((m5,sS)=>{"use strict";var iS=Zr(),nD=(t,e)=>{let r=iS(t,null,!0),n=iS(e,null,!0),o=r.compare(n);if(o===0)return null;let i=o>0,s=i?r:n,a=i?n:r,l=!!s.prerelease.length;if(!!a.prerelease.length&&!l){if(!a.patch&&!a.minor)return"major";if(a.compareMain(s)===0)return a.minor&&!a.patch?"minor":"patch"}let u=l?"pre":"";return r.major!==n.major?u+"major":r.minor!==n.minor?u+"minor":r.patch!==n.patch?u+"patch":"prerelease"};sS.exports=nD});var lS=S((g5,cS)=>{"use strict";var oD=Ue(),iD=(t,e)=>new oD(t,e).major;cS.exports=iD});var dS=S((y5,uS)=>{"use strict";var sD=Ue(),aD=(t,e)=>new sD(t,e).minor;uS.exports=aD});var hS=S((E5,fS)=>{"use strict";var cD=Ue(),lD=(t,e)=>new cD(t,e).patch;fS.exports=lD});var mS=S((T5,pS)=>{"use strict";var uD=Zr(),dD=(t,e)=>{let r=uD(t,e);return r&&r.prerelease.length?r.prerelease:null};pS.exports=dD});var wt=S((C5,yS)=>{"use strict";var gS=Ue(),fD=(t,e,r)=>new gS(t,r).compare(new gS(e,r));yS.exports=fD});var TS=S((A5,ES)=>{"use strict";var hD=wt(),pD=(t,e,r)=>hD(e,t,r);ES.exports=pD});var AS=S((I5,CS)=>{"use strict";var mD=wt(),gD=(t,e)=>mD(t,e,!0);CS.exports=gD});var Kl=S((S5,SS)=>{"use strict";var IS=Ue(),yD=(t,e,r)=>{let n=new IS(t,r),o=new IS(e,r);return n.compare(o)||n.compareBuild(o)};SS.exports=yD});var wS=S((_5,_S)=>{"use strict";var ED=Kl(),TD=(t,e)=>t.sort((r,n)=>ED(r,n,e));_S.exports=TD});var RS=S((w5,bS)=>{"use strict";var CD=Kl(),AD=(t,e)=>t.sort((r,n)=>CD(n,r,e));bS.exports=AD});var na=S((b5,kS)=>{"use strict";var ID=wt(),SD=(t,e,r)=>ID(t,e,r)>0;kS.exports=SD});var Wl=S((R5,vS)=>{"use strict";var _D=wt(),wD=(t,e,r)=>_D(t,e,r)<0;vS.exports=wD});var Lm=S((k5,xS)=>{"use strict";var bD=wt(),RD=(t,e,r)=>bD(t,e,r)===0;xS.exports=RD});var Um=S((v5,OS)=>{"use strict";var kD=wt(),vD=(t,e,r)=>kD(t,e,r)!==0;OS.exports=vD});var Yl=S((x5,PS)=>{"use strict";var xD=wt(),OD=(t,e,r)=>xD(t,e,r)>=0;PS.exports=OD});var Xl=S((O5,NS)=>{"use strict";var PD=wt(),ND=(t,e,r)=>PD(t,e,r)<=0;NS.exports=ND});var $m=S((P5,MS)=>{"use strict";var MD=Lm(),DD=Um(),LD=na(),UD=Yl(),$D=Wl(),FD=Xl(),HD=(t,e,r,n)=>{switch(e){case"===":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t===r;case"!==":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t!==r;case"":case"=":case"==":return MD(t,r,n);case"!=":return DD(t,r,n);case">":return LD(t,r,n);case">=":return UD(t,r,n);case"<":return $D(t,r,n);case"<=":return FD(t,r,n);default:throw new TypeError(`Invalid operator: ${e}`)}};MS.exports=HD});var LS=S((N5,DS)=>{"use strict";var BD=Ue(),jD=Zr(),{safeRe:Jl,t:Ql}=oi(),zD=(t,e)=>{if(t instanceof BD)return t;if(typeof t=="number"&&(t=String(t)),typeof t!="string")return null;e=e||{};let r=null;if(!e.rtl)r=t.match(e.includePrerelease?Jl[Ql.COERCEFULL]:Jl[Ql.COERCE]);else{let l=e.includePrerelease?Jl[Ql.COERCERTLFULL]:Jl[Ql.COERCERTL],c;for(;(c=l.exec(t))&&(!r||r.index+r[0].length!==t.length);)(!r||c.index+c[0].length!==r.index+r[0].length)&&(r=c),l.lastIndex=c.index+c[1].length+c[2].length;l.lastIndex=-1}if(r===null)return null;let n=r[2],o=r[3]||"0",i=r[4]||"0",s=e.includePrerelease&&r[5]?`-${r[5]}`:"",a=e.includePrerelease&&r[6]?`+${r[6]}`:"";return jD(`${n}.${o}.${i}${s}${a}`,e)};DS.exports=zD});var $S=S((M5,US)=>{"use strict";var VD=Zr(),qD=ni(),GD=Ue(),KD=(t,e,r)=>{if(!qD.RELEASE_TYPES.includes(e))return null;let n=WD(t,r);return n&&YD(n,e)},WD=(t,e)=>{let r=t instanceof GD?t.version:t;return VD(r,e)},YD=(t,e)=>{if(XD(e))return t.version;switch(t.prerelease=[],e){case"major":t.minor=0,t.patch=0;break;case"minor":t.patch=0;break}return t.format()},XD=t=>t.startsWith("pre");US.exports=KD});var HS=S((D5,FS)=>{"use strict";var Fm=class{constructor(){this.max=1e3,this.map=new Map}get(e){let r=this.map.get(e);if(r!==void 0)return this.map.delete(e),this.map.set(e,r),r}delete(e){return this.map.delete(e)}set(e,r){if(!this.delete(e)&&r!==void 0){if(this.map.size>=this.max){let o=this.map.keys().next().value;this.delete(o)}this.map.set(e,r)}return this}};FS.exports=Fm});var bt=S((L5,VS)=>{"use strict";var JD=/\s+/g,Hm=class t{constructor(e,r){if(r=ZD(r),e instanceof t)return e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease?e:new t(e.raw,r);if(e instanceof Bm)return this.raw=e.value,this.set=[[e]],this.formatted=void 0,this;if(this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease,this.raw=e.trim().replace(JD," "),this.set=this.raw.split("||").map(n=>this.parseRange(n.trim())).filter(n=>n.length),!this.set.length)throw new TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let n=this.set[0];if(this.set=this.set.filter(o=>!jS(o[0])),this.set.length===0)this.set=[n];else if(this.set.length>1){for(let o of this.set)if(o.length===1&&cL(o[0])){this.set=[o];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let e=0;e<this.set.length;e++){e>0&&(this.formatted+="||");let r=this.set[e];for(let n=0;n<r.length;n++)n>0&&(this.formatted+=" "),this.formatted+=r[n].toString().trim()}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(e){e=e.replace(aL,"");let n=((this.options.includePrerelease&&iL)|(this.options.loose&&sL))+":"+e,o=BS.get(n);if(o)return o;let i=this.options.loose,s=i?We[$e.HYPHENRANGELOOSE]:We[$e.HYPHENRANGE];e=e.replace(s,TL(this.options.includePrerelease)),oe("hyphen replace",e),e=e.replace(We[$e.COMPARATORTRIM],rL),oe("comparator trim",e),e=e.replace(We[$e.TILDETRIM],nL),oe("tilde trim",e),e=e.replace(We[$e.CARETTRIM],oL),oe("caret trim",e);let a=e.split(" ").map(d=>lL(d,this.options)).join(" ").split(/\s+/).map(d=>EL(d,this.options));i&&(a=a.filter(d=>(oe("loose invalid filter",d,this.options),!!d.match(We[$e.COMPARATORLOOSE])))),oe("range list",a);let l=new Map,c=a.map(d=>new Bm(d,this.options));for(let d of c){if(jS(d))return[d];l.set(d.value,d)}l.size>1&&l.has("")&&l.delete("");let u=[...l.values()];return BS.set(n,u),u}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Range is required");return this.set.some(n=>zS(n,r)&&e.set.some(o=>zS(o,r)&&n.every(i=>o.every(s=>i.intersects(s,r)))))}test(e){if(!e)return!1;if(typeof e=="string")try{e=new eL(e,this.options)}catch{return!1}for(let r=0;r<this.set.length;r++)if(CL(this.set[r],e,this.options))return!0;return!1}};VS.exports=Hm;var QD=HS(),BS=new QD,ZD=jl(),Bm=oa(),oe=ra(),eL=Ue(),{safeRe:We,src:tL,t:$e,comparatorTrimReplace:rL,tildeTrimReplace:nL,caretTrimReplace:oL}=oi(),{FLAG_INCLUDE_PRERELEASE:iL,FLAG_LOOSE:sL}=ni(),aL=new RegExp(tL[$e.BUILD],"g"),jS=t=>t.value==="<0.0.0-0",cL=t=>t.value==="",zS=(t,e)=>{let r=!0,n=t.slice(),o=n.pop();for(;r&&n.length;)r=n.every(i=>o.intersects(i,e)),o=n.pop();return r},lL=(t,e)=>(t=t.replace(We[$e.BUILD],""),oe("comp",t,e),t=hL(t,e),oe("caret",t),t=dL(t,e),oe("tildes",t),t=mL(t,e),oe("xrange",t),t=yL(t,e),oe("stars",t),t),xe=t=>!t||t.toLowerCase()==="x"||t==="*",uL=(t,e,r)=>xe(t)&&!xe(e)||xe(e)&&r&&!xe(r),dL=(t,e)=>t.trim().split(/\s+/).map(r=>fL(r,e)).join(" "),fL=(t,e)=>{let r=e.loose?We[$e.TILDELOOSE]:We[$e.TILDE],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("tilde",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:l?(oe("replaceTilde pr",l),c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`):c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`,oe("tilde return",c),c})},hL=(t,e)=>t.trim().split(/\s+/).map(r=>pL(r,e)).join(" "),pL=(t,e)=>{oe("caret",t,e);let r=e.loose?We[$e.CARETLOOSE]:We[$e.CARET],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("caret",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?i==="0"?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.0${n} <${+i+1}.0.0-0`:l?(oe("replaceCaret pr",l),i==="0"?s==="0"?c=`>=${i}.${s}.${a}-${l} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a}-${l} <${+i+1}.0.0-0`):(oe("no pr"),i==="0"?s==="0"?c=`>=${i}.${s}.${a} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a} <${+i+1}.0.0-0`),oe("caret return",c),c})},mL=(t,e)=>(oe("replaceXRanges",t,e),t.split(/\s+/).map(r=>gL(r,e)).join(" ")),gL=(t,e)=>{t=t.trim();let r=e.loose?We[$e.XRANGELOOSE]:We[$e.XRANGE];return t.replace(r,(n,o,i,s,a,l)=>{if(oe("xRange",t,n,o,i,s,a,l),uL(i,s,a))return t;let c=xe(i),u=c||xe(s),d=u||xe(a),f=d;return o==="="&&f&&(o=""),l=e.includePrerelease?"-0":"",c?o===">"||o==="<"?n="<0.0.0-0":n="*":o&&f?(u&&(s=0),a=0,o===">"?(o=">=",u?(i=+i+1,s=0,a=0):(s=+s+1,a=0)):o==="<="&&(o="<",u?i=+i+1:s=+s+1),o==="<"&&(l="-0"),n=`${o+i}.${s}.${a}${l}`):u?n=`>=${i}.0.0${l} <${+i+1}.0.0-0`:d&&(n=`>=${i}.${s}.0${l} <${i}.${+s+1}.0-0`),oe("xRange return",n),n})},yL=(t,e)=>(oe("replaceStars",t,e),t.trim().replace(We[$e.STAR],"")),EL=(t,e)=>(oe("replaceGTE0",t,e),t.trim().replace(We[e.includePrerelease?$e.GTE0PRE:$e.GTE0],"")),TL=t=>(e,r,n,o,i,s,a,l,c,u,d,f)=>(xe(n)?r="":xe(o)?r=`>=${n}.0.0${t?"-0":""}`:xe(i)?r=`>=${n}.${o}.0${t?"-0":""}`:s?r=`>=${r}`:r=`>=${r}${t?"-0":""}`,xe(c)?l="":xe(u)?l=`<${+c+1}.0.0-0`:xe(d)?l=`<${c}.${+u+1}.0-0`:f?l=`<=${c}.${u}.${d}-${f}`:t?l=`<${c}.${u}.${+d+1}-0`:l=`<=${l}`,`${r} ${l}`.trim()),CL=(t,e,r)=>{for(let n=0;n<t.length;n++)if(!t[n].test(e))return!1;if(e.prerelease.length&&!r.includePrerelease){for(let n=0;n<t.length;n++)if(oe(t[n].semver),t[n].semver!==Bm.ANY&&t[n].semver.prerelease.length>0){let o=t[n].semver;if(o.major===e.major&&o.minor===e.minor&&o.patch===e.patch)return!0}return!1}return!0}});var oa=S((U5,XS)=>{"use strict";var ia=Symbol("SemVer ANY"),Vm=class t{static get ANY(){return ia}constructor(e,r){if(r=qS(r),e instanceof t){if(e.loose===!!r.loose)return e;e=e.value}e=e.trim().split(/\s+/).join(" "),zm("comparator",e,r),this.options=r,this.loose=!!r.loose,this.parse(e),this.semver===ia?this.value="":this.value=this.operator+this.semver.version,zm("comp",this)}parse(e){let r=this.options.loose?GS[KS.COMPARATORLOOSE]:GS[KS.COMPARATOR],n=e.match(r);if(!n)throw new TypeError(`Invalid comparator: ${e}`);this.operator=n[1]!==void 0?n[1]:"",this.operator==="="&&(this.operator=""),n[2]?this.semver=new WS(n[2],this.options.loose):this.semver=ia}toString(){return this.value}test(e){if(zm("Comparator.test",e,this.options.loose),this.semver===ia||e===ia)return!0;if(typeof e=="string")try{e=new WS(e,this.options)}catch{return!1}return jm(e,this.operator,this.semver,this.options)}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Comparator is required");return this.operator===""?this.value===""?!0:new YS(e.value,r).test(this.value):e.operator===""?e.value===""?!0:new YS(this.value,r).test(e.semver):(r=qS(r),r.includePrerelease&&(this.value==="<0.0.0-0"||e.value==="<0.0.0-0")||!r.includePrerelease&&(this.value.startsWith("<0.0.0")||e.value.startsWith("<0.0.0"))?!1:!!(this.operator.startsWith(">")&&e.operator.startsWith(">")||this.operator.startsWith("<")&&e.operator.startsWith("<")||this.semver.version===e.semver.version&&this.operator.includes("=")&&e.operator.includes("=")||jm(this.semver,"<",e.semver,r)&&this.operator.startsWith(">")&&e.operator.startsWith("<")||jm(this.semver,">",e.semver,r)&&this.operator.startsWith("<")&&e.operator.startsWith(">")))}};XS.exports=Vm;var qS=jl(),{safeRe:GS,t:KS}=oi(),jm=$m(),zm=ra(),WS=Ue(),YS=bt()});var sa=S(($5,JS)=>{"use strict";var AL=bt(),IL=(t,e,r)=>{try{e=new AL(e,r)}catch{return!1}return e.test(t)};JS.exports=IL});var ZS=S((F5,QS)=>{"use strict";var SL=bt(),_L=(t,e)=>new SL(t,e).set.map(r=>r.map(n=>n.value).join(" ").trim().split(" "));QS.exports=_L});var t_=S((H5,e_)=>{"use strict";var wL=Ue(),bL=bt(),RL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new bL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===-1)&&(n=s,o=new wL(n,r))}),n};e_.exports=RL});var n_=S((B5,r_)=>{"use strict";var kL=Ue(),vL=bt(),xL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new vL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===1)&&(n=s,o=new kL(n,r))}),n};r_.exports=xL});var s_=S((j5,i_)=>{"use strict";var qm=Ue(),OL=bt(),o_=na(),PL=(t,e)=>{t=new OL(t,e);let r=new qm("0.0.0");if(t.test(r)||(r=new qm("0.0.0-0"),t.test(r)))return r;r=null;for(let n=0;n<t.set.length;++n){let o=t.set[n],i=null;o.forEach(s=>{let a=new qm(s.semver.version);switch(s.operator){case">":a.prerelease.length===0?a.patch++:a.prerelease.push(0),a.raw=a.format();case"":case">=":(!i||o_(a,i))&&(i=a);break;case"<":case"<=":break;default:throw new Error(`Unexpected operation: ${s.operator}`)}}),i&&(!r||o_(r,i))&&(r=i)}return r&&t.test(r)?r:null};i_.exports=PL});var c_=S((z5,a_)=>{"use strict";var NL=bt(),ML=(t,e)=>{try{return new NL(t,e).range||"*"}catch{return null}};a_.exports=ML});var Zl=S((V5,f_)=>{"use strict";var DL=Ue(),d_=oa(),{ANY:LL}=d_,UL=bt(),$L=sa(),l_=na(),u_=Wl(),FL=Xl(),HL=Yl(),BL=(t,e,r,n)=>{t=new DL(t,n),e=new UL(e,n);let o,i,s,a,l;switch(r){case">":o=l_,i=FL,s=u_,a=">",l=">=";break;case"<":o=u_,i=HL,s=l_,a="<",l="<=";break;default:throw new TypeError('Must provide a hilo val of "<" or ">"')}if($L(t,e,n))return!1;for(let c=0;c<e.set.length;++c){let u=e.set[c],d=null,f=null;if(u.forEach(p=>{p.semver===LL&&(p=new d_(">=0.0.0")),d=d||p,f=f||p,o(p.semver,d.semver,n)?d=p:s(p.semver,f.semver,n)&&(f=p)}),d.operator===a||d.operator===l||(!f.operator||f.operator===a)&&i(t,f.semver))return!1;if(f.operator===l&&s(t,f.semver))return!1}return!0};f_.exports=BL});var p_=S((q5,h_)=>{"use strict";var jL=Zl(),zL=(t,e,r)=>jL(t,e,">",r);h_.exports=zL});var g_=S((G5,m_)=>{"use strict";var VL=Zl(),qL=(t,e,r)=>VL(t,e,"<",r);m_.exports=qL});var T_=S((K5,E_)=>{"use strict";var y_=bt(),GL=(t,e,r)=>(t=new y_(t,r),e=new y_(e,r),t.intersects(e,r));E_.exports=GL});var A_=S((W5,C_)=>{"use strict";var KL=sa(),WL=wt();C_.exports=(t,e,r)=>{let n=[],o=null,i=null,s=t.sort((u,d)=>WL(u,d,r));for(let u of s)KL(u,e,r)?(i=u,o||(o=u)):(i&&n.push([o,i]),i=null,o=null);o&&n.push([o,null]);let a=[];for(let[u,d]of n)u===d?a.push(u):!d&&u===s[0]?a.push("*"):d?u===s[0]?a.push(`<=${d}`):a.push(`${u} - ${d}`):a.push(`>=${u}`);let l=a.join(" || "),c=typeof e.raw=="string"?e.raw:String(e);return l.length<c.length?l:e}});var R_=S((Y5,b_)=>{"use strict";var I_=bt(),Wm=oa(),{ANY:Gm}=Wm,Km=sa(),Ym=wt(),YL=(t,e,r={})=>{if(t===e)return!0;t=new I_(t,r),e=new I_(e,r);let n=!1;e:for(let o of t.set){for(let i of e.set){let s=JL(o,i,r);if(n=n||s!==null,s)continue e}if(n)return!1}return!0},XL=[new Wm(">=0.0.0-0")],S_=[new Wm(">=0.0.0")],JL=(t,e,r)=>{if(t===e)return!0;if(t.length===1&&t[0].semver===Gm){if(e.length===1&&e[0].semver===Gm)return!0;r.includePrerelease?t=XL:t=S_}if(e.length===1&&e[0].semver===Gm){if(r.includePrerelease)return!0;e=S_}let n=new Set,o,i;for(let p of t)p.operator===">"||p.operator===">="?o=__(o,p,r):p.operator==="<"||p.operator==="<="?i=w_(i,p,r):n.add(p.semver);if(n.size>1)return null;let s;if(o&&i){if(s=Ym(o.semver,i.semver,r),s>0)return null;if(s===0&&(o.operator!==">="||i.operator!=="<="))return null}for(let p of n){if(o&&!Km(p,String(o),r)||i&&!Km(p,String(i),r))return null;for(let g of e)if(!Km(p,String(g),r))return!1;return!0}let a,l,c,u,d=i&&!r.includePrerelease&&i.semver.prerelease.length?i.semver:!1,f=o&&!r.includePrerelease&&o.semver.prerelease.length?o.semver:!1;d&&d.prerelease.length===1&&i.operator==="<"&&d.prerelease[0]===0&&(d=!1);for(let p of e){if(u=u||p.operator===">"||p.operator===">=",c=c||p.operator==="<"||p.operator==="<=",o){if(f&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===f.major&&p.semver.minor===f.minor&&p.semver.patch===f.patch&&(f=!1),p.operator===">"||p.operator===">="){if(a=__(o,p,r),a===p&&a!==o)return!1}else if(o.operator===">="&&!p.test(o.semver))return!1}if(i){if(d&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===d.major&&p.semver.minor===d.minor&&p.semver.patch===d.patch&&(d=!1),p.operator==="<"||p.operator==="<="){if(l=w_(i,p,r),l===p&&l!==i)return!1}else if(i.operator==="<="&&!p.test(i.semver))return!1}if(!p.operator&&(i||o)&&s!==0)return!1}return!(o&&c&&!i&&s!==0||i&&u&&!o&&s!==0||f||d)},__=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n>0?t:n<0||e.operator===">"&&t.operator===">="?e:t},w_=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n<0?t:n>0||e.operator==="<"&&t.operator==="<="?e:t};b_.exports=YL});var eu=S((X5,x_)=>{"use strict";var Xm=oi(),k_=ni(),QL=Ue(),v_=Nm(),ZL=Zr(),eU=ZI(),tU=tS(),rU=oS(),nU=aS(),oU=lS(),iU=dS(),sU=hS(),aU=mS(),cU=wt(),lU=TS(),uU=AS(),dU=Kl(),fU=wS(),hU=RS(),pU=na(),mU=Wl(),gU=Lm(),yU=Um(),EU=Yl(),TU=Xl(),CU=$m(),AU=LS(),IU=$S(),SU=oa(),_U=bt(),wU=sa(),bU=ZS(),RU=t_(),kU=n_(),vU=s_(),xU=c_(),OU=Zl(),PU=p_(),NU=g_(),MU=T_(),DU=A_(),LU=R_();x_.exports={parse:ZL,valid:eU,clean:tU,inc:rU,diff:nU,major:oU,minor:iU,patch:sU,prerelease:aU,compare:cU,rcompare:lU,compareLoose:uU,compareBuild:dU,sort:fU,rsort:hU,gt:pU,lt:mU,eq:gU,neq:yU,gte:EU,lte:TU,cmp:CU,coerce:AU,truncate:IU,Comparator:SU,Range:_U,satisfies:wU,toComparators:bU,maxSatisfying:RU,minSatisfying:kU,minVersion:vU,validRange:xU,outside:OU,gtr:PU,ltr:NU,intersects:MU,simplifyRange:DU,subset:LU,SemVer:QL,re:Xm.re,src:Xm.src,tokens:Xm.t,SEMVER_SPEC_VERSION:k_.SEMVER_SPEC_VERSION,RELEASE_TYPES:k_.RELEASE_TYPES,compareIdentifiers:v_.compareIdentifiers,rcompareIdentifiers:v_.rcompareIdentifiers}});var P_=S((J5,O_)=>{var UU=eu();O_.exports=UU.satisfies(process.version,">=15.7.0")});var M_=S((Q5,N_)=>{var $U=eu();N_.exports=$U.satisfies(process.version,">=16.9.0")});var Jm=S((Z5,D_)=>{var FU=P_(),HU=M_(),BU={ec:["ES256","ES384","ES512"],rsa:["RS256","PS256","RS384","PS384","RS512","PS512"],"rsa-pss":["PS256","PS384","PS512"]},jU={ES256:"prime256v1",ES384:"secp384r1",ES512:"secp521r1"};D_.exports=function(t,e){if(!t||!e)return;let r=e.asymmetricKeyType;if(!r)return;let n=BU[r];if(!n)throw new Error(`Unknown key type "${r}".`);if(!n.includes(t))throw new Error(`"alg" parameter for "${r}" key type must be one of: ${n.join(", ")}.`);if(FU)switch(r){case"ec":let o=e.asymmetricKeyDetails.namedCurve,i=jU[t];if(o!==i)throw new Error(`"alg" parameter "${t}" requires curve "${i}".`);break;case"rsa-pss":if(HU){let s=parseInt(t.slice(-3),10),{hashAlgorithm:a,mgf1HashAlgorithm:l,saltLength:c}=e.asymmetricKeyDetails;if(a!==`sha${s}`||l!==a)throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${t}.`);if(c!==void 0&&c>s>>3)throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${t}.`)}break}}});var Qm=S((e8,L_)=>{var zU=eu();L_.exports=zU.satisfies(process.version,"^6.12.0 || >=8.0.0")});var F_=S((t8,$_)=>{var re=ta(),VU=Rm(),U_=km(),qU=bm(),GU=xm(),KU=Jm(),WU=Qm(),YU=Ul(),{KeyObject:XU,createSecretKey:JU,createPublicKey:QU}=L("crypto"),Zm=["RS256","RS384","RS512"],ZU=["ES256","ES384","ES512"],eg=["RS256","RS384","RS512"],e$=["HS256","HS384","HS512"];WU&&(Zm.splice(Zm.length,0,"PS256","PS384","PS512"),eg.splice(eg.length,0,"PS256","PS384","PS512"));$_.exports=function(t,e,r,n){typeof r=="function"&&!n&&(n=r,r={}),r||(r={}),r=Object.assign({},r);let o;if(n?o=n:o=function(u,d){if(u)throw u;return d},r.clockTimestamp&&typeof r.clockTimestamp!="number")return o(new re("clockTimestamp must be a number"));if(r.nonce!==void 0&&(typeof r.nonce!="string"||r.nonce.trim()===""))return o(new re("nonce must be a non-empty string"));if(r.allowInvalidAsymmetricKeyTypes!==void 0&&typeof r.allowInvalidAsymmetricKeyTypes!="boolean")return o(new re("allowInvalidAsymmetricKeyTypes must be a boolean"));let i=r.clockTimestamp||Math.floor(Date.now()/1e3);if(!t)return o(new re("jwt must be provided"));if(typeof t!="string")return o(new re("jwt must be a string"));let s=t.split(".");if(s.length!==3)return o(new re("jwt malformed"));let a;try{a=qU(t,{complete:!0})}catch(u){return o(u)}if(!a)return o(new re("invalid token"));let l=a.header,c;if(typeof e=="function"){if(!n)return o(new re("verify must be called asynchronous if secret or public key is provided as a callback"));c=e}else c=function(u,d){return d(null,e)};return c(l,function(u,d){if(u)return o(new re("error in secret or public key callback: "+u.message));let f=s[2].trim()!=="";if(!f&&d)return o(new re("jwt signature is required"));if(f&&!d)return o(new re("secret or public key must be provided"));if(!f&&!r.algorithms)return o(new re('please specify "none" in "algorithms" to verify unsigned tokens'));if(d!=null&&!(d instanceof XU))try{d=QU(d)}catch{try{d=JU(typeof d=="string"?Buffer.from(d):d)}catch{return o(new re("secretOrPublicKey is not valid key material"))}}if(r.algorithms||(d.type==="secret"?r.algorithms=e$:["rsa","rsa-pss"].includes(d.asymmetricKeyType)?r.algorithms=eg:d.asymmetricKeyType==="ec"?r.algorithms=ZU:r.algorithms=Zm),r.algorithms.indexOf(a.header.alg)===-1)return o(new re("invalid algorithm"));if(l.alg.startsWith("HS")&&d.type!=="secret")return o(new re(`secretOrPublicKey must be a symmetric key when using ${l.alg}`));if(/^(?:RS|PS|ES)/.test(l.alg)&&d.type!=="public")return o(new re(`secretOrPublicKey must be an asymmetric key when using ${l.alg}`));if(!r.allowInvalidAsymmetricKeyTypes)try{KU(l.alg,d)}catch(m){return o(m)}let p;try{p=YU.verify(t,a.header.alg,d)}catch(m){return o(m)}if(!p)return o(new re("invalid signature"));let g=a.payload;if(typeof g.nbf<"u"&&!r.ignoreNotBefore){if(typeof g.nbf!="number")return o(new re("invalid nbf value"));if(g.nbf>i+(r.clockTolerance||0))return o(new VU("jwt not active",new Date(g.nbf*1e3)))}if(typeof g.exp<"u"&&!r.ignoreExpiration){if(typeof g.exp!="number")return o(new re("invalid exp value"));if(i>=g.exp+(r.clockTolerance||0))return o(new U_("jwt expired",new Date(g.exp*1e3)))}if(r.audience){let m=Array.isArray(r.audience)?r.audience:[r.audience];if(!(Array.isArray(g.aud)?g.aud:[g.aud]).some(function(T){return m.some(function(C){return C instanceof RegExp?C.test(T):C===T})}))return o(new re("jwt audience invalid. expected: "+m.join(" or ")))}if(r.issuer&&(typeof r.issuer=="string"&&g.iss!==r.issuer||Array.isArray(r.issuer)&&r.issuer.indexOf(g.iss)===-1))return o(new re("jwt issuer invalid. expected: "+r.issuer));if(r.subject&&g.sub!==r.subject)return o(new re("jwt subject invalid. expected: "+r.subject));if(r.jwtid&&g.jti!==r.jwtid)return o(new re("jwt jwtid invalid. expected: "+r.jwtid));if(r.nonce&&g.nonce!==r.nonce)return o(new re("jwt nonce invalid. expected: "+r.nonce));if(r.maxAge){if(typeof g.iat!="number")return o(new re("iat required when maxAge is specified"));let m=GU(r.maxAge,g.iat);if(typeof m>"u")return o(new re('"maxAge" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));if(i>=m+(r.clockTolerance||0))return o(new U_("maxAge exceeded",new Date(m*1e3)))}if(r.complete===!0){let m=a.signature;return o(null,{header:l,payload:g,signature:m})}return o(null,g)})}});var q_=S((r8,V_)=>{var H_=1/0,j_=9007199254740991,t$=17976931348623157e292,B_=NaN,r$="[object Arguments]",n$="[object Function]",o$="[object GeneratorFunction]",i$="[object String]",s$="[object Symbol]",a$=/^\s+|\s+$/g,c$=/^[-+]0x[0-9a-f]+$/i,l$=/^0b[01]+$/i,u$=/^0o[0-7]+$/i,d$=/^(?:0|[1-9]\d*)$/,f$=parseInt;function h$(t,e){for(var r=-1,n=t?t.length:0,o=Array(n);++r<n;)o[r]=e(t[r],r,t);return o}function p$(t,e,r,n){for(var o=t.length,i=r+(n?1:-1);n?i--:++i<o;)if(e(t[i],i,t))return i;return-1}function m$(t,e,r){if(e!==e)return p$(t,g$,r);for(var n=r-1,o=t.length;++n<o;)if(t[n]===e)return n;return-1}function g$(t){return t!==t}function y$(t,e){for(var r=-1,n=Array(t);++r<t;)n[r]=e(r);return n}function E$(t,e){return h$(e,function(r){return t[r]})}function T$(t,e){return function(r){return t(e(r))}}var tu=Object.prototype,rg=tu.hasOwnProperty,ru=tu.toString,C$=tu.propertyIsEnumerable,A$=T$(Object.keys,Object),I$=Math.max;function S$(t,e){var r=z_(t)||k$(t)?y$(t.length,String):[],n=r.length,o=!!n;for(var i in t)(e||rg.call(t,i))&&!(o&&(i=="length"||w$(i,n)))&&r.push(i);return r}function _$(t){if(!b$(t))return A$(t);var e=[];for(var r in Object(t))rg.call(t,r)&&r!="constructor"&&e.push(r);return e}function w$(t,e){return e=e??j_,!!e&&(typeof t=="number"||d$.test(t))&&t>-1&&t%1==0&&t<e}function b$(t){var e=t&&t.constructor,r=typeof e=="function"&&e.prototype||tu;return t===r}function R$(t,e,r,n){t=ng(t)?t:$$(t),r=r&&!n?D$(r):0;var o=t.length;return r<0&&(r=I$(o+r,0)),P$(t)?r<=o&&t.indexOf(e,r)>-1:!!o&&m$(t,e,r)>-1}function k$(t){return v$(t)&&rg.call(t,"callee")&&(!C$.call(t,"callee")||ru.call(t)==r$)}var z_=Array.isArray;function ng(t){return t!=null&&O$(t.length)&&!x$(t)}function v$(t){return og(t)&&ng(t)}function x$(t){var e=tg(t)?ru.call(t):"";return e==n$||e==o$}function O$(t){return typeof t=="number"&&t>-1&&t%1==0&&t<=j_}function tg(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function og(t){return!!t&&typeof t=="object"}function P$(t){return typeof t=="string"||!z_(t)&&og(t)&&ru.call(t)==i$}function N$(t){return typeof t=="symbol"||og(t)&&ru.call(t)==s$}function M$(t){if(!t)return t===0?t:0;if(t=L$(t),t===H_||t===-H_){var e=t<0?-1:1;return e*t$}return t===t?t:0}function D$(t){var e=M$(t),r=e%1;return e===e?r?e-r:e:0}function L$(t){if(typeof t=="number")return t;if(N$(t))return B_;if(tg(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=tg(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(a$,"");var r=l$.test(t);return r||u$.test(t)?f$(t.slice(2),r?2:8):c$.test(t)?B_:+t}function U$(t){return ng(t)?S$(t):_$(t)}function $$(t){return t?E$(t,U$(t)):[]}V_.exports=R$});var K_=S((n8,G_)=>{var F$="[object Boolean]",H$=Object.prototype,B$=H$.toString;function j$(t){return t===!0||t===!1||z$(t)&&B$.call(t)==F$}function z$(t){return!!t&&typeof t=="object"}G_.exports=j$});var Q_=S((o8,J_)=>{var W_=1/0,V$=17976931348623157e292,Y_=NaN,q$="[object Symbol]",G$=/^\s+|\s+$/g,K$=/^[-+]0x[0-9a-f]+$/i,W$=/^0b[01]+$/i,Y$=/^0o[0-7]+$/i,X$=parseInt,J$=Object.prototype,Q$=J$.toString;function Z$(t){return typeof t=="number"&&t==nF(t)}function X_(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function eF(t){return!!t&&typeof t=="object"}function tF(t){return typeof t=="symbol"||eF(t)&&Q$.call(t)==q$}function rF(t){if(!t)return t===0?t:0;if(t=oF(t),t===W_||t===-W_){var e=t<0?-1:1;return e*V$}return t===t?t:0}function nF(t){var e=rF(t),r=e%1;return e===e?r?e-r:e:0}function oF(t){if(typeof t=="number")return t;if(tF(t))return Y_;if(X_(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=X_(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(G$,"");var r=W$.test(t);return r||Y$.test(t)?X$(t.slice(2),r?2:8):K$.test(t)?Y_:+t}J_.exports=Z$});var ew=S((i8,Z_)=>{var iF="[object Number]",sF=Object.prototype,aF=sF.toString;function cF(t){return!!t&&typeof t=="object"}function lF(t){return typeof t=="number"||cF(t)&&aF.call(t)==iF}Z_.exports=lF});var ow=S((s8,nw)=>{var uF="[object Object]";function dF(t){var e=!1;if(t!=null&&typeof t.toString!="function")try{e=!!(t+"")}catch{}return e}function fF(t,e){return function(r){return t(e(r))}}var hF=Function.prototype,tw=Object.prototype,rw=hF.toString,pF=tw.hasOwnProperty,mF=rw.call(Object),gF=tw.toString,yF=fF(Object.getPrototypeOf,Object);function EF(t){return!!t&&typeof t=="object"}function TF(t){if(!EF(t)||gF.call(t)!=uF||dF(t))return!1;var e=yF(t);if(e===null)return!0;var r=pF.call(e,"constructor")&&e.constructor;return typeof r=="function"&&r instanceof r&&rw.call(r)==mF}nw.exports=TF});var sw=S((a8,iw)=>{var CF="[object String]",AF=Object.prototype,IF=AF.toString,SF=Array.isArray;function _F(t){return!!t&&typeof t=="object"}function wF(t){return typeof t=="string"||!SF(t)&&_F(t)&&IF.call(t)==CF}iw.exports=wF});var dw=S((c8,uw)=>{var bF="Expected a function",aw=1/0,RF=17976931348623157e292,cw=NaN,kF="[object Symbol]",vF=/^\s+|\s+$/g,xF=/^[-+]0x[0-9a-f]+$/i,OF=/^0b[01]+$/i,PF=/^0o[0-7]+$/i,NF=parseInt,MF=Object.prototype,DF=MF.toString;function LF(t,e){var r;if(typeof e!="function")throw new TypeError(bF);return t=BF(t),function(){return--t>0&&(r=e.apply(this,arguments)),t<=1&&(e=void 0),r}}function UF(t){return LF(2,t)}function lw(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function $F(t){return!!t&&typeof t=="object"}function FF(t){return typeof t=="symbol"||$F(t)&&DF.call(t)==kF}function HF(t){if(!t)return t===0?t:0;if(t=jF(t),t===aw||t===-aw){var e=t<0?-1:1;return e*RF}return t===t?t:0}function BF(t){var e=HF(t),r=e%1;return e===e?r?e-r:e:0}function jF(t){if(typeof t=="number")return t;if(FF(t))return cw;if(lw(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=lw(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(vF,"");var r=OF.test(t);return r||PF.test(t)?NF(t.slice(2),r?2:8):xF.test(t)?cw:+t}uw.exports=UF});var Cw=S((l8,Tw)=>{var fw=xm(),zF=Qm(),VF=Jm(),hw=Ul(),qF=q_(),nu=K_(),pw=Q_(),ig=ew(),gw=ow(),en=sw(),GF=dw(),{KeyObject:KF,createSecretKey:WF,createPrivateKey:YF}=L("crypto"),yw=["RS256","RS384","RS512","ES256","ES384","ES512","HS256","HS384","HS512","none"];zF&&yw.splice(3,0,"PS256","PS384","PS512");var XF={expiresIn:{isValid:function(t){return pw(t)||en(t)&&t},message:'"expiresIn" should be a number of seconds or string representing a timespan'},notBefore:{isValid:function(t){return pw(t)||en(t)&&t},message:'"notBefore" should be a number of seconds or string representing a timespan'},audience:{isValid:function(t){return en(t)||Array.isArray(t)},message:'"audience" must be a string or array'},algorithm:{isValid:qF.bind(null,yw),message:'"algorithm" must be a valid string enum value'},header:{isValid:gw,message:'"header" must be an object'},encoding:{isValid:en,message:'"encoding" must be a string'},issuer:{isValid:en,message:'"issuer" must be a string'},subject:{isValid:en,message:'"subject" must be a string'},jwtid:{isValid:en,message:'"jwtid" must be a string'},noTimestamp:{isValid:nu,message:'"noTimestamp" must be a boolean'},keyid:{isValid:en,message:'"keyid" must be a string'},mutatePayload:{isValid:nu,message:'"mutatePayload" must be a boolean'},allowInsecureKeySizes:{isValid:nu,message:'"allowInsecureKeySizes" must be a boolean'},allowInvalidAsymmetricKeyTypes:{isValid:nu,message:'"allowInvalidAsymmetricKeyTypes" must be a boolean'}},JF={iat:{isValid:ig,message:'"iat" should be a number of seconds'},exp:{isValid:ig,message:'"exp" should be a number of seconds'},nbf:{isValid:ig,message:'"nbf" should be a number of seconds'}};function Ew(t,e,r,n){if(!gw(r))throw new Error('Expected "'+n+'" to be a plain object.');Object.keys(r).forEach(function(o){let i=t[o];if(!i){if(!e)throw new Error('"'+o+'" is not allowed in "'+n+'"');return}if(!i.isValid(r[o]))throw new Error(i.message)})}function QF(t){return Ew(XF,!1,t,"options")}function ZF(t){return Ew(JF,!0,t,"payload")}var mw={audience:"aud",issuer:"iss",subject:"sub",jwtid:"jti"},eH=["expiresIn","notBefore","noTimestamp","audience","issuer","subject","jwtid"];Tw.exports=function(t,e,r,n){typeof r=="function"?(n=r,r={}):r=r||{};let o=typeof t=="object"&&!Buffer.isBuffer(t),i=Object.assign({alg:r.algorithm||"HS256",typ:o?"JWT":void 0,kid:r.keyid},r.header);function s(c){if(n)return n(c);throw c}if(!e&&r.algorithm!=="none")return s(new Error("secretOrPrivateKey must have a value"));if(e!=null&&!(e instanceof KF))try{e=YF(e)}catch{try{e=WF(typeof e=="string"?Buffer.from(e):e)}catch{return s(new Error("secretOrPrivateKey is not valid key material"))}}if(i.alg.startsWith("HS")&&e.type!=="secret")return s(new Error(`secretOrPrivateKey must be a symmetric key when using ${i.alg}`));if(/^(?:RS|PS|ES)/.test(i.alg)){if(e.type!=="private")return s(new Error(`secretOrPrivateKey must be an asymmetric key when using ${i.alg}`));if(!r.allowInsecureKeySizes&&!i.alg.startsWith("ES")&&e.asymmetricKeyDetails!==void 0&&e.asymmetricKeyDetails.modulusLength<2048)return s(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`))}if(typeof t>"u")return s(new Error("payload is required"));if(o){try{ZF(t)}catch(c){return s(c)}r.mutatePayload||(t=Object.assign({},t))}else{let c=eH.filter(function(u){return typeof r[u]<"u"});if(c.length>0)return s(new Error("invalid "+c.join(",")+" option for "+typeof t+" payload"))}if(typeof t.exp<"u"&&typeof r.expiresIn<"u")return s(new Error('Bad "options.expiresIn" option the payload already has an "exp" property.'));if(typeof t.nbf<"u"&&typeof r.notBefore<"u")return s(new Error('Bad "options.notBefore" option the payload already has an "nbf" property.'));try{QF(r)}catch(c){return s(c)}if(!r.allowInvalidAsymmetricKeyTypes)try{VF(i.alg,e)}catch(c){return s(c)}let a=t.iat||Math.floor(Date.now()/1e3);if(r.noTimestamp?delete t.iat:o&&(t.iat=a),typeof r.notBefore<"u"){try{t.nbf=fw(r.notBefore,a)}catch(c){return s(c)}if(typeof t.nbf>"u")return s(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}if(typeof r.expiresIn<"u"&&typeof t=="object"){try{t.exp=fw(r.expiresIn,a)}catch(c){return s(c)}if(typeof t.exp>"u")return s(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}Object.keys(mw).forEach(function(c){let u=mw[c];if(typeof r[c]<"u"){if(typeof t[u]<"u")return s(new Error('Bad "options.'+c+'" option. The payload already has an "'+u+'" property.'));t[u]=r[c]}});let l=r.encoding||"utf8";if(typeof n=="function")n=n&&GF(n),hw.createSign({header:i,privateKey:e,payload:t,encoding:l}).once("error",n).once("done",function(c){if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)return n(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`));n(null,c)});else{let c=hw.sign({header:i,payload:t,secret:e,encoding:l});if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)throw new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`);return c}}});var Iw=S((u8,Aw)=>{Aw.exports={decode:bm(),verify:F_(),sign:Cw(),JsonWebTokenError:ta(),NotBeforeError:Rm(),TokenExpiredError:km()}});var Sw,_w,ww,sg,bw,Rw,kw,vw,xw,Ow,ou=h(()=>{"use strict";Sw="missing_tenant_id_error",_w="user_timeout_reached",ww="invalid_assertion",sg="invalid_client_credential",bw="empty_fic_assertion",Rw="conflicting_user_identifiers",kw="missing_user_identifier",vw="device_code_polling_cancelled",xw="device_code_expired",Ow="device_code_unknown_error"});var Pw,wr,iu=h(()=>{"use strict";Pw=at(Iw(),1);W();Ys();J();ou();wr=class t{static fromAssertion(e){let r=new t;return r.jwt=e,r}static fromCertificate(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!1,n&&(o.publicCertificate=this.parseCertificate(n)),o}static fromCertificateWithSha256Thumbprint(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!0,n&&(o.publicCertificate=this.parseCertificate(n)),o}getJwt(e,r,n){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&r===this.issuer&&n===this.jwtAudience?this.jwt:this.createJwt(e,r,n);if(this.jwt)return this.jwt;throw E(ww,"")}createJwt(e,r,n){this.issuer=r,this.jwtAudience=n;let o=Z.nowSeconds();this.expirationTime=o+600;let s={alg:this.useSha256?St.PSS_256:St.RSA_256},a=this.useSha256?St.X5T_256:St.X5T;Object.assign(s,{[a]:ft.base64EncodeUrl(this.thumbprint,A.EncodingTypes.HEX)}),this.publicCertificate&&Object.assign(s,{[St.X5C]:this.publicCertificate});let l={[St.AUDIENCE]:this.jwtAudience,[St.EXPIRATION_TIME]:this.expirationTime,[St.ISSUER]:this.issuer,[St.SUBJECT]:this.issuer,[St.NOT_BEFORE]:o,[St.JWT_ID]:e.createNewGuid()};return this.jwt=Pw.default.sign(l,this.privateKey,{header:s}),this.jwt}isExpired(){return this.expirationTime<Z.nowSeconds()}static parseCertificate(e){let r=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,n=[],o;for(;(o=r.exec(e))!==null;)n.push(o[1].replace(/\r*\n/g,""));return n}}});var ii,Ye,tn=h(()=>{"use strict";ii="@azure/msal-node",Ye="5.3.0"});var Rt,si=h(()=>{"use strict";W();tn();Rt=class{constructor(e){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,ii,Ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=new Te}createTokenRequestHeaders(e){return Dn.createTokenRequestHeaders(this.logger,!1,e)}async executePostToTokenEndpoint(e,r,n,o,i){return Dn.executePostToTokenEndpoint(e,r,n,o,i,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async sendPostRequest(e,r,n,o){return Dn.sendPostRequest(e,r,n,o,this.cacheManager,this.networkClient,this.logger,this.performanceClient)}createTokenQueryParameters(e){return Dn.createTokenQueryParameters(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient)}}});var su,Nw=h(()=>{"use strict";W();J();si();su=class extends Rt{constructor(e){super(e)}async acquireToken(e){this.logger.info("in acquireToken call in username-password client",e.correlationId);let r=Z.nowSeconds(),n=await this.executeTokenRequest(this.authority,e),o=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return o.validateTokenResponse(n.body,e.correlationId),o.handleServerTokenResponse(n.body,this.authority,r,e,te.acquireTokenByUsernamePassword)}async executeTokenRequest(e,r){let n=this.createTokenQueryParameters(r),o=j.appendQueryString(e.tokenEndpoint,n),i=await this.createTokenRequestBody(r),s=this.createTokenRequestHeaders({credential:r.username,type:Ge.UPN}),a={clientId:this.config.authOptions.clientId,authority:e.canonicalAuthority,scopes:r.scopes,claims:r.claims,authenticationScheme:r.authenticationScheme,resourceRequestMethod:r.resourceRequestMethod,resourceRequestUri:r.resourceRequestUri,shrClaims:r.shrClaims,sshKid:r.sshKid};return this.executePostToTokenEndpoint(o,i,s,a,r.correlationId)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addUsername(r,e.username),b.addPassword(r,e.password),b.addScopes(r,e.scopes,e.correlationId),b.addResponseType(r,A.OAuthResponseType.IDTOKEN_TOKEN),b.addGrantType(r,A.GrantType.RESOURCE_OWNER_PASSWORD_GRANT),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.username&&b.addCcsUpn(r,e.username),ke.mapToQueryString(r)}}});function Mw(t,e,r,n){let o=Gs.getStandardAuthorizeRequestParameters({...t.auth,authority:e,redirectUri:r.redirectUri||""},r,n);return b.addLibraryInfo(o,{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""}),t.system.protocolMode!==je.OIDC&&b.addApplicationTelemetry(o,t.telemetry.application),b.addResponseType(o,A.OAuthResponseType.CODE),r.codeChallenge&&r.codeChallengeMethod&&b.addCodeChallengeParams(o,r.codeChallenge,r.codeChallengeMethod),b.addExtraParameters(o,r.extraQueryParameters||{}),Gs.getAuthorizeUrl(e,o)}var Dw=h(()=>{"use strict";W();J();tn();});var ai,ag=h(()=>{"use strict";W();hm();Xs();Rl();J();mm();iu();tn();Ws();Nw();Dw();ai=class{constructor(e){this.config=HA(e),this.cryptoProvider=new Jt,this.logger=new ve(this.config.system.loggerOptions,ii,Ye),this.storage=new Jr(this.logger,this.config.auth.clientId,this.cryptoProvider,im(this.config.auth)),this.tokenCache=new Yo(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||A.ResponseMode.QUERY,authenticationScheme:A.AuthenticationScheme.BEARER,state:e.state||"",nonce:e.nonce||""},n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions);return Mw(this.config,n,r,this.logger)}async acquireTokenByCode(e,r){this.logger.info("acquireTokenByCode called",e.correlationId||""),e.state&&r&&(this.logger.info("acquireTokenByCode - validating state",e.correlationId||""),this.validateState(e.state,r.state||"",e.correlationId||""),r={...r,state:""});let n={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},o=this.initializeServerTelemetryManager(te.acquireTokenByCode,n.correlationId);try{let i=await this.createAuthority(n.authority,n.correlationId,void 0,e.azureCloudOptions),s=await this.buildOauthClientConfiguration(i,n.correlationId,n.redirectUri,o),a=new Vs(s,new Te);return this.logger.verbose("Auth code client created",n.correlationId),await a.acquireToken(n,te.acquireTokenByCode,r)}catch(i){throw i instanceof H&&(i.correlationId=n.correlationId),o.cacheFailedRequest(i),i}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},n=this.initializeServerTelemetryManager(te.acquireTokenByRefreshToken,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new Ln(i,new Te);return this.logger.verbose("Refresh token client created",r.correlationId),await s.acquireToken(r,te.acquireTokenByRefreshToken)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenSilent(e){let r={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},n=this.initializeServerTelemetryManager(te.acquireTokenSilent,r.correlationId,r.forceRefresh);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new qs(i,new Te);this.logger.verbose("Silent flow client created",r.correlationId);try{return await this.tokenCache.overwriteCache(),await this.acquireCachedTokenSilent(r,s,i)}catch(a){if(a instanceof zr&&a.errorCode===me.tokenRefreshRequired)return new Ln(i,new Te).acquireTokenByRefreshToken(r,te.acquireTokenSilent);throw a}}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireCachedTokenSilent(e,r,n){let[o,i]=await r.acquireCachedToken({...e,scopes:e.scopes?.length?e.scopes:[...A.OIDC_DEFAULT_SCOPES]});if(i===A.CacheOutcome.PROACTIVELY_REFRESHED){this.logger.info("ClientApplication:acquireCachedTokenSilent - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId);let s=new Ln(n,new Te);try{await s.acquireTokenByRefreshToken(e,te.acquireTokenSilent)}catch{}}return o}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)},n=this.initializeServerTelemetryManager(te.acquireTokenByUsernamePassword,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new su(i);return this.logger.verbose("Username password client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}getTokenCache(){return this.logger.info("getTokenCache called",""),this.tokenCache}validateState(e,r,n){if(!e)throw ze.createStateNotFoundError(n);if(e!==r)throw E(me.stateMismatch,n)}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,r,n,o){return this.logger.verbose("buildOauthClientConfiguration called",r),this.logger.info(`Building oauth client configuration with the following authority: ${e.tokenEndpoint}.`,r),o?.updateRegionDiscoveryMetadata(e.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:e,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:n,isMcp:this.config.auth.isMcp},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:r},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:o,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:await this.getClientAssertion(e)},libraryInfo:{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}async getClientAssertion(e){return this.developerProvidedClientAssertion&&(this.clientAssertion=wr.fromAssertion(await Ne(this.developerProvidedClientAssertion,this.config.auth.clientId,e.tokenEndpoint))),this.clientAssertion&&{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE}}async initializeBaseRequest(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();return this.logger.verbose("initializeRequestScopes called",r),e.authenticationScheme&&e.authenticationScheme===A.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",r),e.authenticationScheme=A.AuthenticationScheme.BEARER,{...e,scopes:[...e&&e.scopes||[],...A.OIDC_DEFAULT_SCOPES],correlationId:r,authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,r,n){let o={clientId:this.config.auth.clientId,correlationId:r,apiId:e,forceRefresh:n||!1};return new $n(o,this.storage)}async createAuthority(e,r,n,o){this.logger.verbose("createAuthority called",r);let i=Ht.generateAuthority(e,o||this.config.auth.azureCloudOptions),s={protocolMode:this.config.system.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:n};return dl.createDiscoveredInstance(i,this.config.system.networkClient,this.storage,s,this.logger,r,new Te)}clearCache(){this.storage.clear()}}});import tH from"http";var au,Lw=h(()=>{"use strict";W();Ws();J();au=class{async listenForAuthCode(e,r){if(this.server)throw ze.createLoopbackServerAlreadyExistsError();return new Promise((n,o)=>{this.server=tH.createServer((i,s)=>{let a=i.url;if(a){if(a===A.FORWARD_SLASH){s.end(e||"Auth code was successfully acquired. You can close this window now.");return}}else{s.end(r||"Error occurred loading redirectUrl"),o(ze.createUnableToLoadRedirectUrlError());return}let l=this.getRedirectUri(),c=new URL(a,l),u=ke.getDeserializedResponse(c.search)||{};u.code&&(s.writeHead(A.HTTP_REDIRECT,{location:l}),s.end()),u.error&&s.end(r||`Error occurred: ${u.error}`),n(u)}),this.server.listen(0,"127.0.0.1")})}getRedirectUri(){if(!this.server||!this.server.listening)throw ze.createNoLoopbackServerExistsError();let e=this.server.address();if(!e||typeof e=="string"||!e.port)throw this.closeServer(),ze.createInvalidLoopbackAddressTypeError();let r=e&&e.port;return`${Ke.HTTP_PROTOCOL}${Ke.LOCALHOST}:${r}`}closeServer(){this.server&&(this.server.close(),typeof this.server.closeAllConnections=="function"&&this.server.closeAllConnections(),this.server.unref(),this.server=void 0)}}});var cu,Uw=h(()=>{"use strict";W();J();ou();si();cu=class extends Rt{constructor(e){super(e)}async acquireToken(e){let r=await this.getDeviceCode(e);e.deviceCodeCallback(r);let n=Z.nowSeconds(),o=await this.acquireTokenWithDeviceCode(e,r),i=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(o,e.correlationId),i.handleServerTokenResponse(o,this.authority,n,e,te.acquireTokenByDeviceCode)}async getDeviceCode(e){let r=this.createExtraQueryParameters(e),n=j.appendQueryString(this.authority.deviceCodeEndpoint,r),o=this.createQueryString(e),i=this.createTokenRequestHeaders(),s={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};return this.executePostRequestToDeviceCodeEndpoint(n,o,i,s,e.correlationId)}createExtraQueryParameters(e){let r=new Map;return e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),ke.mapToQueryString(r)}async executePostRequestToDeviceCodeEndpoint(e,r,n,o,i){let{body:{user_code:s,device_code:a,verification_uri:l,expires_in:c,interval:u,message:d}}=await this.sendPostRequest(o,e,{body:r,headers:n},i);return{userCode:s,deviceCode:a,verificationUri:l,expiresIn:c,interval:u,message:d}}createQueryString(e){let r=new Map;return b.addScopes(r,e.scopes,e.correlationId),b.addClientId(r,this.config.authOptions.clientId),e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}continuePolling(e,r,n,o){if(o)throw this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true",r),E(vw,r);if(n&&n<e&&Z.nowSeconds()>n)throw this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${n}`,r),E(_w,r);if(Z.nowSeconds()>e)throw n&&this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${n}`,r),this.logger.error(`Device code expired. Expiration time of device code was ${e}`,r),E(xw,r);return!0}async acquireTokenWithDeviceCode(e,r){let n=this.createTokenQueryParameters(e),o=j.appendQueryString(this.authority.tokenEndpoint,n),i=this.createTokenRequestBody(e,r),s=this.createTokenRequestHeaders(),a=e.timeout?Z.nowSeconds()+e.timeout:void 0,l=Z.nowSeconds()+r.expiresIn,c=r.interval*1e3;for(;this.continuePolling(l,e.correlationId,a,e.cancel);){let u={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},d=await this.executePostToTokenEndpoint(o,i,s,u,e.correlationId);if(d.body&&d.body.error)if(d.body.error===A.AUTHORIZATION_PENDING)this.logger.info("Authorization pending. Continue polling.",e.correlationId),await Z.delay(c);else throw this.logger.info("Unexpected error in polling from the server",e.correlationId),In(qo.postRequestFailed,e.correlationId,d.body.error);else return this.logger.verbose("Authorization completed successfully. Polling stopped.",e.correlationId),d.body}throw this.logger.error("Polling stopped for unknown reasons.",e.correlationId),E(Ow,e.correlationId)}createTokenRequestBody(e,r){let n=new Map;b.addScopes(n,e.scopes,e.correlationId),b.addClientId(n,this.config.authOptions.clientId),b.addGrantType(n,A.GrantType.DEVICE_CODE_GRANT),b.addDeviceCode(n,r.deviceCode);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();return b.addCorrelationId(n,o),b.addClientInfo(n),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ci,$w=h(()=>{"use strict";J();W();ag();Ws();Lw();Uw();tn();ci=class extends ai{constructor(e){super(e),this.config.broker.nativeBrokerPlugin&&(this.config.broker.nativeBrokerPlugin.isBrokerAvailable?(this.nativeBrokerPlugin=this.config.broker.nativeBrokerPlugin,this.nativeBrokerPlugin.setLogger(this.config.system.loggerOptions)):this.logger.warning("NativeBroker implementation was provided but the broker is unavailable.","")),this.skus=$n.makeExtraSkuString({libraryName:Ke.MSAL_SKU,libraryVersion:Ye})}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId||""),Un(this.config.auth.isMcp,e);let r=Object.assign(e,await this.initializeBaseRequest(e)),n=this.initializeServerTelemetryManager(te.acquireTokenByDeviceCode,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new cu(i);return this.logger.verbose("Device code client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenInteractive(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();this.logger.trace("acquireTokenInteractive called",r),Un(this.config.auth.isMcp,e);let{openBrowser:n,successTemplate:o,errorTemplate:i,windowHandle:s,loopbackClient:a,...l}=e;if(this.nativeBrokerPlugin){let g={...l,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...l.extraQueryParameters,...l.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:l.account?.nativeAccountId};return this.nativeBrokerPlugin.acquireTokenInteractive(g,s)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}let{verifier:c,challenge:u}=await this.cryptoProvider.generatePkceCodes(),d=a||new au,f={},p=null;try{let g=d.listenForAuthCode(o,i).then(_=>{f=_}).catch(_=>{p=_}),m=await this.waitForRedirectUri(d,r),y={...l,correlationId:r,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:m,responseMode:A.ResponseMode.QUERY,codeChallenge:u,codeChallengeMethod:A.CodeChallengeMethodValues.S256},R=await this.getAuthCodeUrl(y);if(await n(R),await g,p)throw p;if(f.error)throw new qe(f.error,r,f.error_description,f.suberror);if(!f.code)throw ze.createNoAuthCodeInResponseError(r);let T=f.client_info,C={code:f.code,codeVerifier:c,clientInfo:T||"",...y};return await this.acquireTokenByCode(C)}finally{d.closeServer()}}async acquireTokenSilent(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();if(this.logger.trace("acquireTokenSilent called",r),Un(this.config.auth.isMcp,e),this.nativeBrokerPlugin){let n={...e,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...e.extraQueryParameters,...e.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:e.account.nativeAccountId,forceRefresh:e.forceRefresh||!1};return this.nativeBrokerPlugin.acquireTokenSilent(n)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}return super.acquireTokenSilent(e)}async acquireTokenByCode(e,r){return Un(this.config.auth.isMcp,e),super.acquireTokenByCode(e,r)}async acquireTokenByRefreshToken(e){return Un(this.config.auth.isMcp,e),super.acquireTokenByRefreshToken(e)}async signOut(e){if(this.nativeBrokerPlugin&&e.account.nativeAccountId){let r={clientId:this.config.auth.clientId,accountId:e.account.nativeAccountId,correlationId:e.correlationId||this.cryptoProvider.createNewGuid()};await this.nativeBrokerPlugin.signOut(r)}await this.getTokenCache().removeAccount(e.account,e.correlationId)}async getAllAccounts(){if(this.nativeBrokerPlugin){let e=this.cryptoProvider.createNewGuid();return this.nativeBrokerPlugin.getAllAccounts(this.config.auth.clientId,e)}return this.getTokenCache().getAllAccounts()}async waitForRedirectUri(e,r){return new Promise((n,o)=>{let i=0,s=setInterval(()=>{if(pl.TIMEOUT_MS/pl.INTERVAL_MS<i){clearInterval(s),o(ze.createLoopbackServerTimeoutError(r));return}try{let a=e.getRedirectUri();clearInterval(s),n(a);return}catch(a){if(a instanceof H&&a.errorCode===Ae.noLoopbackServerExists.code){i++;return}clearInterval(s),o(a);return}},pl.INTERVAL_MS)})}}});var li,cg=h(()=>{"use strict";W();J();si();li=class extends Rt{constructor(e,r){super(e),this.appTokenProvider=r}async acquireToken(e){let r;if(e.fmiPath&&(r={fmi_path:e.fmiPath}),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,void 0,r);let[n,o]=await this.getCachedAuthenticationResult(e,this.config,this.cryptoUtils,this.authority,this.cacheManager,this.serverTelemetryManager,r);return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId),await this.executeTokenRequest(e,this.authority,!0,r)),n):this.executeTokenRequest(e,this.authority,void 0,r)}async getCachedAuthenticationResult(e,r,n,o,i,s,a){let l=r,c=r,u=A.CacheOutcome.NOT_APPLICABLE,d;l.serializableCache&&l.persistencePlugin&&(d=new lt(l.serializableCache,!1),await l.persistencePlugin.beforeCacheAccess(d));let f=this.readAccessTokenFromCache(o,c.managedIdentityId?.id||l.authOptions.clientId,new de(e.scopes||[],e.correlationId),i,e.correlationId,a);return l.serializableCache&&l.persistencePlugin&&d&&await l.persistencePlugin.afterCacheAccess(d),f?Z.isTokenExpired(f.expiresOn,l.systemOptions?.tokenRenewalOffsetSeconds||A.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)?(s?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),[null,A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED]):(f.refreshOn&&Z.isTokenExpired(f.refreshOn.toString(),0)&&(u=A.CacheOutcome.PROACTIVELY_REFRESHED,s?.setCacheOutcome(A.CacheOutcome.PROACTIVELY_REFRESHED)),[await ce.generateAuthenticationResult(n,o,{account:null,idToken:null,accessToken:f,refreshToken:null,appMetadata:null},!0,e,this.performanceClient),u]):(s?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),[null,A.CacheOutcome.NO_CACHED_ACCESS_TOKEN])}readAccessTokenFromCache(e,r,n,o,i,s){let a={homeAccountId:"",environment:e.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ACCESS_TOKEN,clientId:r,realm:e.tenant,target:de.createSearchScopes(n.asArray(),i),additionalCacheKeyComponents:s},l=o.getAccessTokensByFilter(a,i);if(l.length<1)return null;if(l.length>1)throw E(me.multipleMatchingTokens,i);return l[0]}async executeTokenRequest(e,r,n,o){let i,s;if(this.appTokenProvider){this.logger.info("Using appTokenProvider extensibility.",e.correlationId);let c={correlationId:e.correlationId,tenantId:this.config.authOptions.authority.tenant,scopes:e.scopes,claims:e.claims};s=Z.nowSeconds();let u=await this.appTokenProvider(c);i={access_token:u.accessToken,expires_in:u.expiresInSeconds,refresh_in:u.refreshInSeconds,token_type:A.AuthenticationScheme.BEARER}}else{let c=this.createTokenQueryParameters(e),u=j.appendQueryString(r.tokenEndpoint,c),d=await this.createTokenRequestBody(e),f=this.createTokenRequestHeaders(),p={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};this.logger.info("Sending token request to endpoint: "+r.tokenEndpoint,e.correlationId),s=Z.nowSeconds();let g=await this.executePostToTokenEndpoint(u,d,f,p,e.correlationId);i=g.body,i.status=g.status}let a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i,e.correlationId,n),await a.handleServerTokenResponse(i,this.authority,s,e,te.acquireTokenByClientCredential,void 0,void 0,void 0,void 0,void 0,o)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId,!1),b.addGrantType(r,A.GrantType.CLIENT_CREDENTIALS_GRANT),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=e.clientAssertion||this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint,e.fmiPath)),b.addClientAssertionType(r,o.assertionType)),e.fmiPath&&r.set(Be.FMI_PATH,e.fmiPath),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var lu,Fw=h(()=>{"use strict";W();J();Ys();si();lu=class extends Rt{constructor(e){super(e)}async acquireToken(e){if(this.scopeSet=new de(e.scopes||[],e.correlationId),this.userAssertionHash=await this.cryptoUtils.hashString(e.oboAssertion),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,this.userAssertionHash);try{return await this.getCachedAuthenticationResult(e)}catch{return await this.executeTokenRequest(e,this.authority,this.userAssertionHash)}}async getCachedAuthenticationResult(e){let r=this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId,e);if(r){if(Z.isTokenExpired(r.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`,e.correlationId),E(me.tokenRefreshRequired,e.correlationId)}else throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.",e.correlationId),E(me.tokenRefreshRequired,e.correlationId);let n=this.readIdTokenFromCacheForOBO(r.homeAccountId,e.correlationId),o,i=null;if(n){o=jc.extractTokenClaims(n.secret,ft.base64Decode,e.correlationId);let s=o.oid||o.sub,a={homeAccountId:n.homeAccountId,environment:n.environment,tenantId:n.realm,username:"",localAccountId:s||""};i=this.cacheManager.getAccount(this.cacheManager.generateAccountKey(a),e.correlationId)}return this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,{account:i,accessToken:r,idToken:n,refreshToken:null,appMetadata:null},!0,e,this.performanceClient,o)}readIdTokenFromCacheForOBO(e,r){let n={homeAccountId:e,environment:this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ID_TOKEN,clientId:this.config.authOptions.clientId,realm:this.authority.tenant},o=this.cacheManager.getIdTokensByFilter(n,r);return Object.values(o).length<1?null:Object.values(o)[0]}readAccessTokenFromCacheForOBO(e,r){let n=r.authenticationScheme||A.AuthenticationScheme.BEARER,i={credentialType:n&&n.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?A.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:A.CredentialType.ACCESS_TOKEN,clientId:e,target:de.createSearchScopes(this.scopeSet.asArray(),r.correlationId),tokenType:n,keyId:r.sshKid,userAssertionHash:this.userAssertionHash},s=this.cacheManager.getAccessTokensByFilter(i,r.correlationId),a=s.length;if(a<1)return null;if(a>1)throw E(me.multipleMatchingTokens,r.correlationId);return s[0]}async executeTokenRequest(e,r,n){let o=this.createTokenQueryParameters(e),i=j.appendQueryString(r.tokenEndpoint,o),s=await this.createTokenRequestBody(e),a=this.createTokenRequestHeaders(),l={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},c=Z.nowSeconds(),u=await this.executePostToTokenEndpoint(i,s,a,l,e.correlationId),d=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return d.validateTokenResponse(u.body,e.correlationId),await d.handleServerTokenResponse(u.body,this.authority,c,e,te.acquireTokenByOBO,void 0,n)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId),b.addGrantType(r,A.GrantType.JWT_BEARER),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),b.addRequestTokenUse(r,Be.ON_BEHALF_OF),b.addOboAssertion(r,e.oboAssertion),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var uu,Hw=h(()=>{"use strict";W();J();si();uu=class extends Rt{constructor(e){super(e)}async acquireToken(e){return this.executeTokenRequest(e,this.authority)}async executeTokenRequest(e,r){let n=new de(e.scopes||[],e.correlationId);n.appendScopes(A.OIDC_DEFAULT_SCOPES);let o=n.asArray(),i=this.createTokenQueryParameters(e),s=j.appendQueryString(r.tokenEndpoint,i),a=await this.createTokenRequestBody(e,o),l=this.createTokenRequestHeaders(),c={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:o,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},u=Z.nowSeconds(),d=await this.executePostToTokenEndpoint(s,a,l,c,e.correlationId),f=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return f.validateTokenResponse(d.body,e.correlationId),await f.handleServerTokenResponse(d.body,this.authority,u,e,te.acquireTokenByUserFederatedIdentityCredential)}async createTokenRequestBody(e,r){let n=new Map;b.addClientId(n,this.config.authOptions.clientId),b.addScopes(n,r,e.correlationId),b.addGrantType(n,A.GrantType.USER_FIC),b.addClientInfo(n),n.set(Be.USER_FEDERATED_IDENTITY_CREDENTIAL,e.assertion),e.username?n.set(Be.USERNAME,e.username):e.userObjectId&&n.set(Be.USER_ID,e.userObjectId),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(n,o),this.config.clientCredentials.clientSecret&&b.addClientSecret(n,this.config.clientCredentials.clientSecret);let i=e.clientAssertion||this.config.clientCredentials.clientAssertion;return i&&(b.addClientAssertion(n,await Ne(i.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint)),b.addClientAssertionType(n,i.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ui,Bw=h(()=>{"use strict";ag();iu();J();W();cg();Fw();Hw();ou();ui=class extends ai{constructor(e){super(e);let r=!!this.config.auth.clientSecret,n=!!this.config.auth.clientAssertion,o=(!!this.config.auth.clientCertificate?.thumbprint||!!this.config.auth.clientCertificate?.thumbprintSha256)&&!!this.config.auth.clientCertificate?.privateKey;if(!this.appTokenProvider){if(r&&n||n&&o||r&&o)throw E(sg,"");if(this.config.auth.clientSecret){this.clientSecret=this.config.auth.clientSecret;return}if(this.config.auth.clientAssertion){this.developerProvidedClientAssertion=this.config.auth.clientAssertion;return}if(o)this.clientAssertion=this.config.auth.clientCertificate.thumbprintSha256?wr.fromCertificateWithSha256Thumbprint(this.config.auth.clientCertificate.thumbprintSha256,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c):wr.fromCertificate(this.config.auth.clientCertificate.thumbprint,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c);else throw E(sg,"");this.appTokenProvider=void 0}}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){this.logger.info("acquireTokenByClientCredential called",e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...n,scopes:n.scopes.filter(f=>!A.OIDC_DEFAULT_SCOPES.includes(f))},i={...e,...o,clientAssertion:r},a=new j(i.authority,i.correlationId).getUrlComponents().PathSegments[0];if(Object.values(A.AADAuthority).includes(a))throw E(Sw,i.correlationId);let l=process.env[OA],c;i.azureRegion!=="DisableMsalForceRegion"&&(!i.azureRegion&&l?c=l:c=i.azureRegion);let u={azureRegion:c,environmentRegion:process.env[xA]},d=this.initializeServerTelemetryManager(te.acquireTokenByClientCredential,i.correlationId,i.skipCache);try{let f=await this.createAuthority(i.authority,i.correlationId,u,e.azureCloudOptions),p=await this.buildOauthClientConfiguration(f,i.correlationId,"",d),g=new li(p,this.appTokenProvider);return this.logger.verbose("Client credential client created",i.correlationId),await g.acquireToken(i)}catch(f){throw f instanceof H&&(f.correlationId=i.correlationId),d.cacheFailedRequest(f),f}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)};try{let n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),o=await this.buildOauthClientConfiguration(n,r.correlationId,"",void 0),i=new lu(o);return this.logger.verbose("On behalf of client created",r.correlationId),await i.acquireToken(r)}catch(n){throw n instanceof H&&(n.correlationId=r.correlationId),n}}async acquireTokenByUserFederatedIdentityCredential(e){if(this.logger.info("acquireTokenByUserFederatedIdentityCredential called",e.correlationId||""),e.userObjectId&&e.username)throw E(Rw,e.correlationId||"");if(!e.userObjectId&&!e.username)throw E(kw,e.correlationId||"");if(!e.assertion)throw E(bw,e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...e,...n,assertion:e.assertion,clientAssertion:r},i=this.initializeServerTelemetryManager(te.acquireTokenByUserFederatedIdentityCredential,o.correlationId);try{let s=await this.createAuthority(o.authority,o.correlationId,void 0,e.azureCloudOptions),a=await this.buildOauthClientConfiguration(s,o.correlationId,"",i),l=new uu(a);return this.logger.verbose("UserFederatedIdentityCredential client created",o.correlationId),await l.acquireToken(o)}catch(s){throw s instanceof H&&(s.correlationId=o.correlationId),i.cacheFailedRequest(s),s}}}});function jw(t){if(typeof t!="string")return!1;let e=new Date(t);return!isNaN(e.getTime())&&e.toISOString()===t}var zw=h(()=>{"use strict";});var du,Vw=h(()=>{"use strict";W();J();du=class{constructor(e,r,n){this.httpClientNoRetries=e,this.retryPolicy=r,this.logger=n}async sendNetworkRequestAsyncHelper(e,r,n){return e===fe.GET?this.httpClientNoRetries.sendGetRequestAsync(r,n):this.httpClientNoRetries.sendPostRequestAsync(r,n)}async sendNetworkRequestAsync(e,r,n){let o=await this.sendNetworkRequestAsyncHelper(e,r,n);"isNewRequest"in this.retryPolicy&&(this.retryPolicy.isNewRequest=!0);let i=0;for(;await this.retryPolicy.pauseForRetry(o.status,i,this.logger,o.headers[A.HeaderNames.RETRY_AFTER]);)o=await this.sendNetworkRequestAsyncHelper(e,r,n),i++;return o}async sendGetRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.GET,e,r)}async sendPostRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.POST,e,r)}}});var zn,Xe,Vn=h(()=>{"use strict";W();J();Ko();zw();Vw();Hn();zn={MANAGED_IDENTITY_CLIENT_ID_2017:"clientid",MANAGED_IDENTITY_CLIENT_ID:"client_id",MANAGED_IDENTITY_OBJECT_ID:"object_id",MANAGED_IDENTITY_RESOURCE_ID_IMDS:"msi_res_id",MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS:"mi_res_id"},Xe=class{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}createCorrelationId(){return this.cryptoProvider.createNewGuid()}async getServerTokenResponseAsync(e,r,n,o){return this.getServerTokenResponse(e)}getServerTokenResponse(e){let r,n;return e.body.expires_on&&(jw(e.body.expires_on)&&(e.body.expires_on=new Date(e.body.expires_on).getTime()/1e3),n=e.body.expires_on-Z.nowSeconds(),n>2*3600&&(r=n/2)),{status:e.status,access_token:e.body.access_token,expires_in:n,scope:e.body.resource,token_type:e.body.token_type,refresh_in:r,correlation_id:e.body.correlation_id||e.body.correlationId,error:typeof e.body.error=="string"?e.body.error:e.body.error?.code,error_description:e.body.message||(typeof e.body.error=="string"?e.body.error_description:e.body.error?.message),error_codes:e.body.error_codes,timestamp:e.body.timestamp,trace_id:e.body.trace_id}}async acquireTokenWithManagedIdentity(e,r,n,o){let i=this.createRequest(e.resource,r);if(e.revokedTokenSha256Hash&&(this.logger.info(`[Managed Identity] The following claims are present in the request: ${e.claims}`,""),i.queryParameters[Ce.SHA256_TOKEN_TO_REFRESH]=e.revokedTokenSha256Hash),e.clientCapabilities?.length){let p=e.clientCapabilities.toString();this.logger.info(`[Managed Identity] The following client capabilities are present in the request: ${p}`,""),i.queryParameters[Ce.XMS_CC]=p}let s=i.headers;s[A.HeaderNames.CONTENT_TYPE]=A.URL_FORM_CONTENT_TYPE;let a={headers:s};Object.keys(i.bodyParameters).length&&(a.body=i.computeParametersBodyString());let l=this.disableInternalRetries?this.networkClient:new du(this.networkClient,i.retryPolicy,this.logger),c=Z.nowSeconds(),u;try{i.httpMethod===fe.POST?u=await l.sendPostRequestAsync(i.computeUri(),a):u=await l.sendGetRequestAsync(i.computeUri(),a)}catch(p){throw p instanceof H?p:E(me.networkError,e.correlationId)}let d=new ce(r.id,this.nodeStorage,this.cryptoProvider,this.logger,new Te,null,null),f=await this.getServerTokenResponseAsync(u,l,i,a);return d.validateTokenResponse(f,f.correlation_id||"",o),d.handleServerTokenResponse(f,n,c,e,te.acquireTokenWithManagedIdentity)}getManagedIdentityUserAssignedIdQueryParameterKey(e,r,n){switch(e){case le.USER_ASSIGNED_CLIENT_ID:return this.logger.info(`[Managed Identity] [API version ${n?"2017+":"2019+"}] Adding user assigned client id to the request.`,""),n?zn.MANAGED_IDENTITY_CLIENT_ID_2017:zn.MANAGED_IDENTITY_CLIENT_ID;case le.USER_ASSIGNED_RESOURCE_ID:return this.logger.info("[Managed Identity] Adding user assigned resource id to the request.",""),r?zn.MANAGED_IDENTITY_RESOURCE_ID_IMDS:zn.MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS;case le.USER_ASSIGNED_OBJECT_ID:return this.logger.info("[Managed Identity] Adding user assigned object id to the request.",""),zn.MANAGED_IDENTITY_OBJECT_ID;default:throw ye(Yr,"")}}};Xe.getValidatedEnvVariableUrlString=(t,e,r,n)=>{try{return new j(e,"").urlString}catch{throw n.info(`[Managed Identity] ${r} managed identity is unavailable because the '${t}' environment variable is malformed.`,""),ye(Fn[t],"")}}});var fu,qw=h(()=>{"use strict";fu=class{calculateDelay(e,r){if(!e)return r;let n=Math.round(parseFloat(e)*1e3);return isNaN(n)&&(n=new Date(e).valueOf()-new Date().valueOf()),Math.max(r,n)}}});var rH,nH,oH,hu,Gw=h(()=>{"use strict";W();qw();rH=3,nH=1e3,oH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_TOO_MANY_REQUESTS,A.HTTP_SERVER_ERROR,A.HTTP_SERVICE_UNAVAILABLE,A.HTTP_GATEWAY_TIMEOUT],hu=class t{constructor(){this.linearRetryStrategy=new fu}static get DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS(){return nH}async pauseForRetry(e,r,n,o){if(oH.includes(e)&&r<rH){let i=this.linearRetryStrategy.calculateDelay(o,t.DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS);return n.verbose(`Retrying request in ${i}ms (retry attempt: ${r+1})`,""),await new Promise(s=>setTimeout(s,i)),!0}return!1}}});var et,qn=h(()=>{"use strict";W();Gw();et=class{constructor(e,r,n){this.httpMethod=e,this._baseEndpoint=r,this.headers={},this.bodyParameters={},this.queryParameters={},this.retryPolicy=n||new hu}computeUri(){let e=new Map;this.queryParameters&&b.addExtraParameters(e,this.queryParameters);let r=ke.mapToQueryString(e);return j.appendQueryString(this._baseEndpoint,r)}computeParametersBodyString(){let e=new Map;return this.bodyParameters&&b.addExtraParameters(e,this.bodyParameters),ke.mapToQueryString(e)}}});var iH,aa,Kw=h(()=>{"use strict";Vn();J();qn();iH="2019-08-01",aa=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.APP_SERVICE} managed identity is unavailable because one or both of the '${U.IDENTITY_HEADER}' and '${U.IDENTITY_ENDPOINT}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,s,$.APP_SERVICE,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.APP_SERVICE} managed identity. Endpoint URI: ${l}. Creating ${$.APP_SERVICE} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.APP_SERVICE_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=iH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});import{accessSync as sH,constants as Ww,statSync as aH,readFileSync as cH}from"fs";import lH from"path";var uH,Yw,Xw,Jw,dH,ca,Qw=h(()=>{"use strict";W();qn();Vn();Ko();J();Hn();uH="2019-11-01",Yw="http://127.0.0.1:40342/metadata/identity/oauth2/token",Xw="N/A: himds executable exists",Jw={win32:`${process.env.ProgramData}\\AzureConnectedMachineAgent\\Tokens\\`,linux:"/var/opt/azcmagent/tokens/"},dH={win32:`${process.env.ProgramFiles}\\AzureConnectedMachineAgent\\himds.exe`,linux:"/opt/azcmagent/bin/himds"},ca=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IMDS_ENDPOINT];if(!e||!r){let n=dH[process.platform];try{sH(n,Ww.F_OK|Ww.R_OK),e=Yw,r=Xw}catch{}}return[e,r]}static tryCreate(e,r,n,o,i,s){let[a,l]=t.getEnvironmentVariables();if(!a||!l)return e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is unavailable through environment variables because one or both of '${U.IDENTITY_ENDPOINT}' and '${U.IMDS_ENDPOINT}' are not defined. ${$.AZURE_ARC} managed identity is also unavailable through file detection.`,""),null;if(l===Xw)e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is available through file detection. Defaulting to known ${$.AZURE_ARC} endpoint: ${Yw}. Creating ${$.AZURE_ARC} managed identity.`,"");else{let c=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.AZURE_ARC,e);c.endsWith("/")&&c.slice(0,-1),t.getValidatedEnvVariableUrlString(U.IMDS_ENDPOINT,l,$.AZURE_ARC,e),e.info(`[Managed Identity] Environment variables validation passed for ${$.AZURE_ARC} managed identity. Endpoint URI: ${c}. Creating ${$.AZURE_ARC} managed identity.`,"")}if(s.idType!==le.SYSTEM_ASSIGNED)throw ye(Tl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.GET,this.identityEndpoint.replace("localhost","127.0.0.1"));return r.headers[Le.METADATA_HEADER_NAME]="true",r.queryParameters[Ce.API_VERSION]=uH,r.queryParameters[Ce.RESOURCE]=e,r}async getServerTokenResponseAsync(e,r,n,o){let i;if(e.status===A.HTTP_UNAUTHORIZED){let s=e.headers["www-authenticate"];if(!s)throw ye(Il,"");if(!s.includes("Basic realm="))throw ye(Sl,"");let a=s.split("Basic realm=")[1];if(!Jw.hasOwnProperty(process.platform))throw ye(El,"");let l=Jw[process.platform],c=lH.basename(a);if(!c.endsWith(".key"))throw ye(ml,"");if(l+c!==a)throw ye(gl,"");let u;try{u=await aH(a).size}catch{throw ye(Ks,"")}if(u>MA)throw ye(yl,"");let d;try{d=cH(a,A.EncodingTypes.UTF8)}catch{throw ye(Ks,"")}let f=`Basic ${d}`;this.logger.info("[Managed Identity] Adding authorization header to the request.",""),n.headers[Le.AUTHORIZATION_HEADER_NAME]=f;try{i=await r.sendGetRequestAsync(n.computeUri(),o)}catch(p){throw p instanceof H?p:E(me.networkError,"")}}return this.getServerTokenResponse(i||e)}}});var la,Zw=h(()=>{"use strict";qn();Vn();J();Ko();Hn();la=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.msiEndpoint=s}static getEnvironmentVariables(){return[process.env[U.MSI_ENDPOINT]]}static tryCreate(e,r,n,o,i,s){let[a]=t.getEnvironmentVariables();if(!a)return e.info(`[Managed Identity] ${$.CLOUD_SHELL} managed identity is unavailable because the '${U.MSI_ENDPOINT} environment variable is not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,a,$.CLOUD_SHELL,e);if(e.info(`[Managed Identity] Environment variable validation passed for ${$.CLOUD_SHELL} managed identity. Endpoint URI: ${l}. Creating ${$.CLOUD_SHELL} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED)throw ye(Cl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.POST,this.msiEndpoint);return r.headers[Le.METADATA_HEADER_NAME]="true",r.bodyParameters[Ce.RESOURCE]=e,r}}});var pu,eb=h(()=>{"use strict";pu=class{constructor(e,r,n){this.minExponentialBackoff=e,this.maxExponentialBackoff=r,this.exponentialDeltaBackoff=n}calculateDelay(e){return e===0?this.minExponentialBackoff:Math.min(Math.pow(2,e-1)*this.exponentialDeltaBackoff,this.maxExponentialBackoff)}}});var fH,hH,pH,mH,gH,yH,EH,mu,tb=h(()=>{"use strict";W();eb();fH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_GONE,A.HTTP_TOO_MANY_REQUESTS],hH=3,pH=7,mH=1e3,gH=4e3,yH=2e3,EH=10*1e3,mu=class t{constructor(){this.exponentialRetryStrategy=new pu(t.MIN_EXPONENTIAL_BACKOFF_MS,t.MAX_EXPONENTIAL_BACKOFF_MS,t.EXPONENTIAL_DELTA_BACKOFF_MS)}static get MIN_EXPONENTIAL_BACKOFF_MS(){return mH}static get MAX_EXPONENTIAL_BACKOFF_MS(){return gH}static get EXPONENTIAL_DELTA_BACKOFF_MS(){return yH}static get HTTP_STATUS_GONE_RETRY_AFTER_MS(){return EH}set isNewRequest(e){this._isNewRequest=e}async pauseForRetry(e,r,n){if(this._isNewRequest&&(this._isNewRequest=!1,this.maxRetries=e===A.HTTP_GONE?pH:hH),(fH.includes(e)||e>=A.HTTP_SERVER_ERROR_RANGE_START&&e<=A.HTTP_SERVER_ERROR_RANGE_END&&r<this.maxRetries)&&r<this.maxRetries){let o=e===A.HTTP_GONE?t.HTTP_STATUS_GONE_RETRY_AFTER_MS:this.exponentialRetryStrategy.calculateDelay(r);return n.verbose(`Retrying request in ${o}ms (retry attempt: ${r+1})`,""),await new Promise(i=>setTimeout(i,o)),!0}return!1}}});var rb,TH,CH,gu,nb=h(()=>{"use strict";qn();Vn();J();tb();tn();rb="/metadata/identity/oauth2/token",TH=`http://169.254.169.254${rb}`,CH="2018-02-01",gu=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static tryCreate(e,r,n,o,i){let s;return process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]?(e.info(`[Managed Identity] Environment variable ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} for ${$.IMDS} returned endpoint: ${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}`,""),s=t.getValidatedEnvVariableUrlString(U.AZURE_POD_IDENTITY_AUTHORITY_HOST,`${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}${rb}`,$.IMDS,e)):(e.info(`[Managed Identity] Unable to find ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} environment variable for ${$.IMDS}, using the default endpoint.`,""),s=TH),new t(e,r,n,o,i,s)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.CLIENT_SKU]=Ke.MSAL_SKU,n.headers[Le.CLIENT_VER]=Ye,n.headers[Le.CLIENT_REQUEST_ID]=this.createCorrelationId(),n.queryParameters[Ce.API_VERSION]=CH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!0)]=r.id),n.retryPolicy=new mu,n}}});var AH,ua,ob=h(()=>{"use strict";qn();Vn();J();AH="2019-07-01-preview",ua=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER],n=process.env[U.IDENTITY_SERVER_THUMBPRINT];return[e,r,n]}static tryCreate(e,r,n,o,i,s){let[a,l,c]=t.getEnvironmentVariables();if(!a||!l||!c)return e.info(`[Managed Identity] ${$.SERVICE_FABRIC} managed identity is unavailable because one or all of the '${U.IDENTITY_HEADER}', '${U.IDENTITY_ENDPOINT}' or '${U.IDENTITY_SERVER_THUMBPRINT}' environment variables are not defined.`,""),null;let u=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.SERVICE_FABRIC,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.SERVICE_FABRIC} managed identity. Endpoint URI: ${u}. Creating ${$.SERVICE_FABRIC} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED&&e.warning(`[Managed Identity] ${$.SERVICE_FABRIC} user assigned managed identity is configured in the cluster, not during runtime. See also: https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-service.`,""),new t(e,r,n,o,i,a,l)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=AH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});var IH,SH,da,ib=h(()=>{"use strict";Vn();J();qn();IH="2017-09-01",SH=`Only client id is supported for user-assigned managed identity in ${$.MACHINE_LEARNING}.`,da=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.msiEndpoint=s,this.secret=a}static getEnvironmentVariables(){let e=process.env[U.MSI_ENDPOINT],r=process.env[U.MSI_SECRET];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.MACHINE_LEARNING} managed identity is unavailable because one or both of the '${U.MSI_ENDPOINT}' and '${U.MSI_SECRET}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,s,$.MACHINE_LEARNING,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.MACHINE_LEARNING} managed identity. Endpoint URI: ${l}. Creating ${$.MACHINE_LEARNING} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.msiEndpoint);if(n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.secret,n.queryParameters[Ce.API_VERSION]=IH,n.queryParameters[Ce.RESOURCE]=e,r.idType===le.SYSTEM_ASSIGNED)n.queryParameters[zn.MANAGED_IDENTITY_CLIENT_ID_2017]=process.env[U.DEFAULT_IDENTITY_CLIENT_ID];else if(r.idType===le.USER_ASSIGNED_CLIENT_ID)n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!1,!0)]=r.id;else throw new Error(SH);return n}}});var fa,sb=h(()=>{"use strict";Kw();Qw();Zw();nb();ob();Ko();J();ib();Hn();fa=class t{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}async sendManagedIdentityTokenRequest(e,r,n,o){return t.identitySource||(t.identitySource=this.selectManagedIdentitySource(this.logger,this.nodeStorage,this.networkClient,this.cryptoProvider,this.disableInternalRetries,r)),t.identitySource.acquireTokenWithManagedIdentity(e,r,n,o)}allEnvironmentVariablesAreDefined(e){return Object.values(e).every(r=>r!==void 0)}getManagedIdentitySource(){return t.sourceName=this.allEnvironmentVariablesAreDefined(ua.getEnvironmentVariables())?$.SERVICE_FABRIC:this.allEnvironmentVariablesAreDefined(aa.getEnvironmentVariables())?$.APP_SERVICE:this.allEnvironmentVariablesAreDefined(da.getEnvironmentVariables())?$.MACHINE_LEARNING:this.allEnvironmentVariablesAreDefined(la.getEnvironmentVariables())?$.CLOUD_SHELL:this.allEnvironmentVariablesAreDefined(ca.getEnvironmentVariables())?$.AZURE_ARC:$.DEFAULT_TO_IMDS,t.sourceName}selectManagedIdentitySource(e,r,n,o,i,s){let a=ua.tryCreate(e,r,n,o,i,s)||aa.tryCreate(e,r,n,o,i)||da.tryCreate(e,r,n,o,i)||la.tryCreate(e,r,n,o,i,s)||ca.tryCreate(e,r,n,o,i,s)||gu.tryCreate(e,r,n,o,i);if(!a)throw ye(Al,"");return a}}});var _H,di,ab=h(()=>{"use strict";W();hm();tn();Xs();cg();sb();Rl();J();wl();_H=[$.SERVICE_FABRIC],di=class t{constructor(e){this.config=BA(e||{}),this.logger=new ve(this.config.system.loggerOptions,ii,Ye);let r={canonicalAuthority:A.DEFAULT_AUTHORITY};t.nodeStorage||(t.nodeStorage=new Jr(this.logger,this.config.managedIdentityId.id,No,r)),this.networkClient=this.config.system.networkClient,this.cryptoProvider=new Jt;let n={protocolMode:je.AAD,knownAuthorities:[lm],cloudDiscoveryMetadata:"",authorityMetadata:""};this.fakeAuthority=new Ht(lm,this.networkClient,t.nodeStorage,n,this.logger,this.cryptoProvider.createNewGuid(),new Te,!0),this.fakeClientCredentialClient=new li({authOptions:{clientId:this.config.managedIdentityId.id,authority:this.fakeAuthority}}),this.managedIdentityClient=new fa(this.logger,t.nodeStorage,this.networkClient,this.cryptoProvider,this.config.disableInternalRetries),this.hashUtils=new Xr}async acquireToken(e){if(!e.resource)throw Y(ko.urlEmptyError,"");let r={forceRefresh:e.forceRefresh,resource:e.resource.replace("/.default",""),scopes:[e.resource.replace("/.default","")],authority:this.fakeAuthority.canonicalAuthority,correlationId:this.cryptoProvider.createNewGuid(),claims:e.claims,clientCapabilities:this.config.clientCapabilities};if(r.forceRefresh)return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority);let[n,o]=await this.fakeClientCredentialClient.getCachedAuthenticationResult(r,this.config,this.cryptoProvider,this.fakeAuthority,t.nodeStorage);if(r.claims){let i=this.managedIdentityClient.getManagedIdentitySource();if(n&&_H.includes(i)){let s=this.hashUtils.sha256(n.accessToken).toString(A.EncodingTypes.HEX);r.revokedTokenSha256Hash=s}return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority)}return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",r.correlationId),await this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority,!0)), |
| Error: '${i.name}' | ||
| Error Description: '${i.message}'`,this.correlationId)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.",this.correlationId),this.logger.verbose("Creating custom Authority for custom domain scenario.",this.correlationId),n=t.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort)),n}isInKnownAuthorities(e){let r=e.toLowerCase();return this.authorityOptions.knownAuthorities.filter(o=>o&&j.getDomainFromUrl(o,this.correlationId).toLowerCase()===r).length>0}static generateAuthority(e,r){let n;if(r&&r.azureCloudInstance!==Tr.None){let o=r.tenant?r.tenant:es;n=`${r.azureCloudInstance}/${o}/`}return n||e}static createCloudDiscoveryMetadataFromHost(e){return{preferred_network:e,preferred_cache:e,aliases:[e]}}getPreferredCache(){if(this.managedIdentity)return xf;if(this.discoveryComplete())return this.metadata.preferred_cache;throw E($t,this.correlationId)}isAlias(e){return this.metadata.aliases.indexOf(e)>-1}isAliasOfKnownMicrosoftAuthority(e){return Lp.has(e)}validateIssuer(e){if(!e)throw Y(us,this.correlationId);let r;try{r=new URL(e)}catch{throw Y(us,this.correlationId)}let n=r.protocol,o=r.host,i=(this.canonicalAuthorityUrlComponents.Protocol||"").toLowerCase(),s=(this.canonicalAuthorityUrlComponents.HostNameAndPort||"").toLowerCase(),a=this.matchesAuthorityOrigin(n,o,i,s),l=n==="https:"&&this.isAliasOfKnownMicrosoftAuthority(o),c=n==="https:"&&this.matchesRegionalMicrosoftHost(o),u=this.matchesCiamTenantPattern(r,s,this.canonicalAuthorityUrlComponents.PathSegments),d=n==="https:"&&this.isInKnownAuthorities(o);if(!(a||l||c||u||d))throw Y(us,this.correlationId)}matchesAuthorityOrigin(e,r,n,o){return e===n&&r===o}matchesRegionalMicrosoftHost(e){let r=e.indexOf(".");if(r>0&&r<e.length-1){let n=e.substring(r+1);return this.isAliasOfKnownMicrosoftAuthority(n)}return!1}matchesCiamTenantPattern(e,r,n){let o=n[0],i=o?o.endsWith(En)?o.slice(0,-En.length):o:r.split(".")[0];if(!i)return!1;let s=`https://${i}${ts}`,a=[s,`${s}/${i}`,`${s}/${i}/v2.0`,`${s}/${i}${En}`,`${s}/${i}${En}/v2.0`],l=e.pathname.replace(/\/+$/,""),c=`${e.protocol}//${e.host}${l}`;return a.some(u=>u===c)}static isPublicCloudAuthority(e){return Ff.indexOf(e)>=0}static buildRegionalAuthorityString(e,r,n,o){let i=new j(e,n);i.validateAsUri();let s=i.getUrlComponents(),a=`${r}.${s.HostNameAndPort}`;this.isPublicCloudAuthority(s.HostNameAndPort)&&(a=`${r}.${$f}`);let l=j.constructAuthorityUriFromObject({...i.getUrlComponents(),HostNameAndPort:a},n).urlString;return o?`${l}?${o}`:l}static replaceWithRegionalInformation(e,r,n){let o={...e};return o.authorization_endpoint=t.buildRegionalAuthorityString(o.authorization_endpoint,r,n),o.token_endpoint=t.buildRegionalAuthorityString(o.token_endpoint,r,n),o.end_session_endpoint&&(o.end_session_endpoint=t.buildRegionalAuthorityString(o.end_session_endpoint,r,n)),o}static transformCIAMAuthority(e,r){let n=e,i=new j(e,r).getUrlComponents();if(i.PathSegments.length===0&&i.HostNameAndPort.endsWith(ts)){let s=i.HostNameAndPort.split(".")[0];n=`${n}${s}${En}`}return n}};Ht.reservedTenantDomains=new Set(["{tenant}","{tenantid}",Dt.COMMON,Dt.CONSUMERS,Dt.ORGANIZATIONS])});var dl={};we(dl,{createDiscoveredInstance:()=>sm});async function sm(t,e,r,n,o,i,s){let a=Ht.transformCIAMAuthority(ll(t),i),l=new Ht(a,e,r,n,o,i,s);try{return await G(l.resolveEndpointsAsync.bind(l),WC,o,s,i)(),l}catch{throw E($t,i)}}var am=h(()=>{"use strict";ul();pe();Ir();Sr();ge();});var Vs,yA=h(()=>{"use strict";Oo();Po();ue();bo();Ps();Us();pe();qr();el();Kr();Uo();$s();hr();Ir();Sr();sl();al();cl();am();Mo();Do();ge();mr();Vs=class{constructor(e,r){this.includeRedirectUri=!0,this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r,this.oidcDefaultScopes=this.config.authOptions.authority.options.OIDCOptions?.defaultScopes}async acquireToken(e,r,n){if(!e.code)throw E(dp,e.correlationId);n&&n.cloud_instance_host_name&&await G(this.updateTokenEndpointAuthority.bind(this),KC,this.logger,this.performanceClient,e.correlationId)(n.cloud_instance_host_name,e.correlationId);let o=ut(),i=await G(this.executeTokenRequest.bind(this),qC,this.logger,this.performanceClient,e.correlationId)(this.authority,e,this.serverTelemetryManager),s=i.headers?.[he.X_MS_REQUEST_ID],a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i.body,e.correlationId),G(a.handleServerTokenResponse.bind(a),Zc,this.logger,this.performanceClient,e.correlationId)(i.body,this.authority,o,e,r,n,void 0,void 0,void 0,s)}getLogoutUri(e){if(!e)throw Y(Zh,"");let r=this.createLogoutUrlQueryString(e);return j.appendQueryString(this.authority.endSessionEndpoint,r)}async executeTokenRequest(e,r,n){let o=Bs(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),i=j.appendQueryString(e.tokenEndpoint,o),s=await G(this.createTokenRequestBody.bind(this),GC,this.logger,this.performanceClient,r.correlationId)(r),a;if(r.clientInfo)try{let u=Lo(r.clientInfo,this.cryptoUtils.base64Decode);a={credential:`${u.uid}${Ao}${u.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(u){this.logger.verbose(`Could not parse client info for CCS Header: '${u}'`,r.correlationId)}let l=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,a||r.ccsCredential),c=zo(this.config.authOptions.clientId,r);return G(js,HC,this.logger,this.performanceClient,r.correlationId)(i,s,l,c,r.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,n)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),this.includeRedirectUri)Rn(r,e.redirectUri);else if(!e.redirectUri)throw Y(Kh,e.correlationId);if(wn(r,e.scopes,e.correlationId,!0,this.oidcDefaultScopes),bs(r,e.resource),kp(r,e.code),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),e.codeVerifier&&xp(r,e.codeVerifier),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let o=this.config.clientCredentials.clientAssertion;Es(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,o.assertionType)}if(Cs(r,os.AUTHORIZATION_CODE_GRANT),xn(r),e.authenticationScheme===se.POP){let o=new Wr(this.cryptoUtils,this.performanceClient),i;e.popKid?i=this.cryptoUtils.encodeKid(e.popKid):i=(await G(o.generateCnf.bind(o),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,i)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);let n;if(e.clientInfo)try{let o=Lo(e.clientInfo,this.cryptoUtils.base64Decode);n={credential:`${o.uid}${Ao}${o.utid}`,type:Ge.HOME_ACCOUNT_ID}}catch(o){this.logger.verbose(`Could not parse client info for CCS Header: '${o}'`,e.correlationId)}else n=e.ccsCredential;if(this.config.systemOptions.preventCorsPreflight&&n)switch(n.type){case Ge.HOME_ACCOUNT_ID:try{let o=Xt(n.credential);gr(r,o)}catch(o){this.logger.verbose(`Could not parse home account ID for CCS Header: '${o}'`,e.correlationId)}break;case Ge.UPN:Vr(r,n.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,e.extraParameters),e.enableSpaAuthorizationCode&&(!e.extraParameters||!e.extraParameters[Pc])&&yr(r,{[Pc]:"1"}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}createLogoutUrlQueryString(e){let r=new Map;return e.postLogoutRedirectUri&&Sp(r,e.postLogoutRedirectUri),e.correlationId&&vn(r,e.correlationId),e.idTokenHint&&_p(r,e.idTokenHint),e.state&&gs(r,e.state),e.logoutHint&&Pp(r,e.logoutHint),e.extraQueryParameters&&yr(r,e.extraQueryParameters),this.config.authOptions.instanceAware&&As(r),Wt(r)}async updateTokenEndpointAuthority(e,r){let n=`https://${e}/${this.authority.tenant}/`,o=await sm(n,this.networkClient,this.cacheManager,this.authority.options,this.logger,r,this.performanceClient);this.authority=o}}});var g0,Ln,EA=h(()=>{"use strict";Ps();Oo();Po();ue();bo();Us();el();hr();pe();jo();Kr();qr();$s();Uo();Ls();Ir();Sr();sl();al();cl();Mo();Do();nl();mr();ge();g0=300,Ln=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireToken(e,r){let n=ut(),o=await G(this.executeTokenRequest.bind(this),BC,this.logger,this.performanceClient,e.correlationId)(e,this.authority),i=o.headers?.[he.X_MS_REQUEST_ID],s=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return s.validateTokenResponse(o.body,e.correlationId),G(s.handleServerTokenResponse.bind(s),Zc,this.logger,this.performanceClient,e.correlationId)(o.body,this.authority,n,e,r,void 0,void 0,!0,e.forceCache,i)}async acquireTokenByRefreshToken(e,r){if(!e)throw Y(Qh,"");if(!e.account)throw E(ds,e.correlationId);if(this.cacheManager.isAppMetadataFOCI(e.account.environment,e.correlationId))try{return await G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!0,r)}catch(o){let i=o instanceof dt&&o.errorCode===tl,s=o instanceof qe&&o.errorCode===oh&&o.subError===ih;if(i||s)return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r);throw o}return G(this.acquireTokenWithCachedRefreshToken.bind(this),Qc,this.logger,this.performanceClient,e.correlationId)(e,!1,r)}async acquireTokenWithCachedRefreshToken(e,r,n){let o=rA(this.cacheManager.getRefreshToken.bind(this.cacheManager),tA,this.logger,this.performanceClient,e.correlationId)(e.account,r,e.correlationId,void 0);if(!o)throw il(tl,e.correlationId);if(o.expiresOn){let s=e.refreshTokenExpirationOffsetSeconds||g0;if(this.performanceClient?.addFields({cacheRtExpiresOnSeconds:Number(o.expiresOn),rtOffsetSeconds:s},e.correlationId),Fo(o.expiresOn,s))throw il(Jp,e.correlationId)}let i={...e,refreshToken:o.secret,authenticationScheme:e.authenticationScheme||se.BEARER,ccsCredential:{credential:e.account.homeAccountId,type:Ge.HOME_ACCOUNT_ID}};try{return await G(this.acquireToken.bind(this),jC,this.logger,this.performanceClient,e.correlationId)(i,n)}catch(s){if(s instanceof dt&&s.subError===Ds){this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache",e.correlationId);let a=this.cacheManager.generateCredentialKey(o);this.cacheManager.removeRefreshToken(a,e.correlationId)}throw s}}async executeTokenRequest(e,r){let n=Bs(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient),o=j.appendQueryString(r.tokenEndpoint,n),i=await G(this.createTokenRequestBody.bind(this),zC,this.logger,this.performanceClient,e.correlationId)(e),s=Hs(this.logger,this.config.systemOptions.preventCorsPreflight,e.ccsCredential),a=zo(this.config.authOptions.clientId,e);return G(js,FC,this.logger,this.performanceClient,e.correlationId)(o,i,s,a,e.correlationId,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async createTokenRequestBody(e){let r=new Map;if(bn(r,e.embeddedClientId||e.extraParameters?.[Kt]||this.config.authOptions.clientId),e.redirectUri&&Rn(r,e.redirectUri),wn(r,e.scopes,e.correlationId,!0,this.config.authOptions.authority.options.OIDCOptions?.defaultScopes),Cs(r,os.REFRESH_TOKEN_GRANT),xn(r),ps(r,this.config.libraryInfo),ms(r,this.config.telemetry.application),ws(r),this.serverTelemetryManager&&!Kc(this.config)&&_s(r,this.serverTelemetryManager),vp(r,e.refreshToken),this.config.clientCredentials.clientSecret&&ys(r,this.config.clientCredentials.clientSecret),this.config.clientCredentials.clientAssertion){let n=this.config.clientCredentials.clientAssertion;Es(r,await Ne(n.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),Ts(r,n.assertionType)}if(e.authenticationScheme===se.POP){let n=new Wr(this.cryptoUtils,this.performanceClient),o;e.popKid?o=this.cryptoUtils.encodeKid(e.popKid):o=(await G(n.generateCnf.bind(n),Bo,this.logger,this.performanceClient,e.correlationId)(e,this.logger)).reqCnfString,Is(r,o)}else if(e.authenticationScheme===se.SSH)if(e.sshJwk)Ss(r,e.sshJwk);else throw Y(ls,e.correlationId);if(this.config.systemOptions.preventCorsPreflight&&e.ccsCredential)switch(e.ccsCredential.type){case Ge.HOME_ACCOUNT_ID:try{let n=Xt(e.ccsCredential.credential);gr(r,n)}catch(n){this.logger.verbose(`Could not parse home account ID for CCS Header: '${n}'`,e.correlationId)}break;case Ge.UPN:Vr(r,e.ccsCredential.credential);break}return e.embeddedClientId&&Er(r,this.config.authOptions.clientId,this.config.authOptions.redirectUri),e.extraParameters&&yr(r,{...e.extraParameters}),_n(r,e.correlationId,this.performanceClient),kn(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities,e.skipBrokerClaims),Wt(r)}}});var qs,TA=h(()=>{"use strict";Ps();Kr();pe();Us();ue();cs();Pn();Ir();Sr();ul();Mo();Do();ge();qs=class{constructor(e,r){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,Yt,Ft),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=r}async acquireCachedToken(e){let r=Ut.NOT_APPLICABLE;if(e.forceRefresh||!Pe.isEmptyObj(e.claims))throw this.setCacheOutcome(Ut.FORCE_REFRESH_OR_CLAIMS,e.correlationId),E(vo,e.correlationId);if(!e.account)throw E(ds,e.correlationId);let n=e.account.tenantId||gA(e.authority,e.correlationId),o=this.cacheManager.getTokenKeys(),i=this.cacheManager.getAccessToken(e.account,e,o,n);if(i){if(qp(i.cachedAt)||Fo(i.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.setCacheOutcome(Ut.CACHED_ACCESS_TOKEN_EXPIRED,e.correlationId),E(vo,e.correlationId);if(e.resource){if(i.resource!==e.resource)throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId)}else i.refreshOn&&Fo(i.refreshOn,0)&&(r=Ut.PROACTIVELY_REFRESHED)}else throw this.setCacheOutcome(Ut.NO_CACHED_ACCESS_TOKEN,e.correlationId),E(vo,e.correlationId);let s=e.authority||this.authority.getPreferredCache(),a={account:this.cacheManager.getAccount(this.cacheManager.generateAccountKey(e.account),e.correlationId),accessToken:i,idToken:this.cacheManager.getIdToken(e.account,e.correlationId,o,n),refreshToken:null,appMetadata:this.cacheManager.readAppMetadataFromCache(s,e.correlationId)};return this.setCacheOutcome(r,e.correlationId),this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),[await G(this.generateResultFromCacheRecord.bind(this),VC,this.logger,this.performanceClient,e.correlationId)(a,e),r]}setCacheOutcome(e,r){this.serverTelemetryManager?.setCacheOutcome(e),this.performanceClient?.addFields({cacheOutcome:e},r),e!==Ut.NOT_APPLICABLE&&this.logger.info(`Token refresh is required due to cache outcome: '${e}'`,r)}async generateResultFromCacheRecord(e,r){let n;return e.idToken&&(n=Cr(e.idToken.secret,this.config.cryptoInterface.base64Decode,r.correlationId)),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,e,!0,r,this.performanceClient,n)}}});var Gs={};we(Gs,{getAuthorizationCodePayload:()=>T0,getAuthorizeUrl:()=>E0,getStandardAuthorizeRequestParameters:()=>y0,validateAuthorizationResponse:()=>CA});function y0(t,e,r,n){let o=e.correlationId,i=new Map;bn(i,e.embeddedClientId||e.extraQueryParameters?.[Kt]||t.clientId);let s=[...e.scopes||[],...e.extraScopesToConsent||[]];if(wn(i,s,e.correlationId,!0,t.authority.options.OIDCOptions?.defaultScopes),bs(i,e.resource),Rn(i,e.redirectUri),vn(i,o),Ip(i,e.responseMode),xn(i),Op(i),e.prompt&&(bp(i,e.prompt),n?.addFields({prompt:e.prompt},o)),e.domainHint&&(wp(i,e.domainHint),n?.addFields({domainHintFromRequest:!0},o)),e.prompt!==ns.SELECT_ACCOUNT)if(e.sid&&e.prompt===ns.NONE)r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request",e.correlationId),Hc(i,e.sid),n?.addFields({sidFromRequest:!0},o);else if(e.account){let a=A0(e.account),l=I0(e.account);if(l&&e.domainHint&&(r.warning('AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint',e.correlationId),l=null),l){r.verbose("createAuthCodeUrlQueryString: login_hint claim present on account",e.correlationId),xo(i,l),n?.addFields({loginHintFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(a&&e.prompt===ns.NONE){r.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account",e.correlationId),Hc(i,a),n?.addFields({sidFromClaim:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}else if(e.loginHint)r.verbose("createAuthCodeUrlQueryString: Adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o);else if(e.account.username){r.verbose("createAuthCodeUrlQueryString: Adding login_hint from account",e.correlationId),xo(i,e.account.username),n?.addFields({loginHintFromUpn:!0},o);try{let c=Xt(e.account.homeAccountId);gr(i,c)}catch{r.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header",e.correlationId)}}}else e.loginHint&&(r.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request",e.correlationId),xo(i,e.loginHint),Vr(i,e.loginHint),n?.addFields({loginHintFromRequest:!0},o));else r.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints",e.correlationId);return e.nonce&&Rp(i,e.nonce),e.state&&gs(i,e.state),e.embeddedClientId&&Er(i,t.clientId,t.redirectUri),kn(i,e.correlationId,e.claims,t.clientCapabilities,e.skipBrokerClaims),t.instanceAware&&(!e.extraQueryParameters||!Object.keys(e.extraQueryParameters).includes(wo))&&As(i),i}function E0(t,e){let r=Wt(e);return j.appendQueryString(t.authorizationEndpoint,r)}function T0(t,e,r){if(CA(t,e,r),!t.code)throw E(yp,r);return t}function CA(t,e,r){if(!t.state||!e)throw t.state?E($c,r,"Cached State"):E($c,r,"Server State");let n,o;try{n=decodeURIComponent(t.state)}catch{throw E(Sn,r,t.state)}try{o=decodeURIComponent(e)}catch{throw E(Sn,r,t.state)}if(n!==o)throw E(cp,r);if(t.error||t.error_description||t.suberror){let i=C0(t);throw ol(t.error,t.error_description,t.suberror)?new dt(t.error||"",t.correlation_id||r,t.error_description,t.suberror,t.timestamp||"",t.trace_id||"",t.claims||"",i):new qe(t.error||"",t.correlation_id||r,t.error_description,t.suberror,i)}}function C0(t){let e="code=",r=t.error_uri?.lastIndexOf(e);return r&&r>=0?t.error_uri?.substring(r+e.length):void 0}function A0(t){return t.idTokenClaims?.sid||null}function I0(t){return t.loginHint||t.idTokenClaims?.login_hint||null}var AA=h(()=>{"use strict";Oo();bo();ue();Uo();Po();qr();pe();Ls();jo();ge();});function Un(t,e){if(t){if(e.resource&&(IA(e.extraParameters)||IA(e.extraQueryParameters)))throw E(Ap,e.correlationId||"");if(!e.resource)throw E(Cp,e.correlationId||"")}}function IA(t){return t?Object.prototype.hasOwnProperty.call(t,"resource"):!1}var SA=h(()=>{"use strict";pe();ge();});var qo={};we(qo,{postRequestFailed:()=>_0,unexpectedError:()=>S0});var S0,_0,_A=h(()=>{"use strict";S0="unexpected_error",_0="post_request_failed"});function w0(t){let{skus:e,libraryName:r,libraryVersion:n,extensionName:o,extensionVersion:i}=t,s=new Map([[0,[r,n]],[2,[o,i]]]),a=[];if(e?.length){if(a=e.split(wA),a.length<4)return e}else a=Array.from({length:4},()=>bA);return s.forEach((l,c)=>{l.length===2&&l[0]?.length&&l[1]?.length&&b0({skuArr:a,index:c,skuName:l[0],skuVersion:l[1]})}),a.join(wA)}function b0(t){let{skuArr:e,index:r,skuName:n,skuVersion:o}=t;r>=e.length||(e[r]=[n,o].join(bA))}var wA,bA,$n,RA=h(()=>{"use strict";ue();At();wA=",",bA="|";$n=class t{constructor(e,r){this.cacheOutcome=Ut.NOT_APPLICABLE,this.cacheManager=r,this.apiId=e.apiId,this.correlationId=e.correlationId,this.wrapperSKU=e.wrapperSKU||"",this.wrapperVer=e.wrapperVer||"",this.telemetryCacheKey=is+Cn+e.clientId}generateCurrentRequestHeaderValue(){let e=`${this.apiId}${Br}${this.cacheOutcome}`,r=[this.wrapperSKU,this.wrapperVer],n=this.getNativeBrokerErrorCode();n?.length&&r.push(`broker_error=${n}`);let o=r.join(Br),i=this.getRegionDiscoveryFields(),s=[e,i].join(Br);return[bc,s,o].join(Rc)}generateLastRequestHeaderValue(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.failedRequests.slice(0,2*r).join(Br),o=e.errors.slice(0,r).join(Br),i=e.errors.length,s=r<i?Qf:Zf,a=[i,s].join(Br);return[bc,e.cacheHits,n,o,a].join(Rc)}cacheFailedRequest(e){try{let r=this.getLastRequests();r.errors.length>=Jf&&(r.failedRequests.shift(),r.failedRequests.shift(),r.errors.shift()),r.failedRequests.push(this.apiId,this.correlationId),e instanceof Error&&e&&e.toString()?e instanceof H?e.subError?r.errors.push(e.subError):e.errorCode?r.errors.push(e.errorCode):r.errors.push(e.toString()):r.errors.push(e.toString()):r.errors.push(eh),this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}catch{}}incrementCacheHits(){let e=this.getLastRequests();return e.cacheHits+=1,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId),e.cacheHits}getLastRequests(){let e={failedRequests:[],errors:[],cacheHits:0};return this.cacheManager.getServerTelemetry(this.telemetryCacheKey,this.correlationId)||e}clearTelemetryCache(){let e=this.getLastRequests(),r=t.maxErrorsToSend(e),n=e.errors.length;if(r===n)this.cacheManager.removeItem(this.telemetryCacheKey,this.correlationId);else{let o={failedRequests:e.failedRequests.slice(r*2),errors:e.errors.slice(r),cacheHits:0};this.cacheManager.setServerTelemetry(this.telemetryCacheKey,o,this.correlationId)}}static maxErrorsToSend(e){let r,n=0,o=0,i=e.errors.length;for(r=0;r<i;r++){let s=e.failedRequests[2*r]||"",a=e.failedRequests[2*r+1]||"",l=e.errors[r]||"";if(o+=s.toString().length+a.toString().length+l.length+3,o<Xf)n+=1;else break}return n}getRegionDiscoveryFields(){let e=[];return e.push(this.regionUsed||""),e.push(this.regionSource||""),e.push(this.regionOutcome||""),e.join(",")}updateRegionDiscoveryMetadata(e){this.regionUsed=e.region_used,this.regionSource=e.region_source,this.regionOutcome=e.region_outcome}setCacheOutcome(e){this.cacheOutcome=e}setNativeBrokerErrorCode(e){let r=this.getLastRequests();r.nativeBrokerErrorCode=e,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,r,this.correlationId)}getNativeBrokerErrorCode(){return this.getLastRequests().nativeBrokerErrorCode}clearNativeBrokerErrorCode(){let e=this.getLastRequests();delete e.nativeBrokerErrorCode,this.cacheManager.setServerTelemetry(this.telemetryCacheKey,e,this.correlationId)}static makeExtraSkuString(e){return w0(e)}}});var W=h(()=>{"use strict";yA();EA();TA();Ps();$s();ul();Bc();xs();jp();qr();Np();AA();cl();SA();Oo();Us();hs();Mo();Ls();nl();At();_A();jo();om();pe();ge();hr();mr();ue();cs();RA();Pn();am();Jc();Kr();Po();bo();Gc();Vp();sl();zp();});var _r,fl=h(()=>{"use strict";W();_r=class{static deserializeJSONBlob(e){return e?JSON.parse(e):{}}static deserializeAccounts(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,realm:o.realm,localAccountId:o.local_account_id,username:o.username,authorityType:o.authority_type,name:o.name,clientInfo:o.client_info,lastModificationTime:o.last_modification_time,lastModificationApp:o.last_modification_app,tenantProfiles:o.tenantProfiles?.map(a=>JSON.parse(a)),lastUpdatedAt:Date.now().toString()},s={};Gr.toObject(s,i),r[n]=s}),r}static deserializeIdTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAccessTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,realm:o.realm,target:o.target,cachedAt:o.cached_at,expiresOn:o.expires_on,extendedExpiresOn:o.extended_expires_on,refreshOn:o.refresh_on,keyId:o.key_id,tokenType:o.token_type,userAssertionHash:o.userAssertionHash,resource:o.resource,additionalCacheKeyComponents:o.additionalCacheKeyComponents,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeRefreshTokens(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n],i={homeAccountId:o.home_account_id,environment:o.environment,credentialType:o.credential_type,clientId:o.client_id,secret:o.secret,familyId:o.family_id,target:o.target,realm:o.realm,lastUpdatedAt:Date.now().toString()};r[n]=i}),r}static deserializeAppMetadata(e){let r={};return e&&Object.keys(e).map(function(n){let o=e[n];r[n]={clientId:o.client_id,environment:o.environment,familyId:o.family_id}}),r}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}}});var cm={};we(cm,{Deserializer:()=>_r,Serializer:()=>Hr});var kA=h(()=>{"use strict";Ec();fl();});var vA,R0,lm,Le,Ce,U,$,le,fe,xA,OA,PA,NA,hl,um,Ke,te,St,pl,MA,J=h(()=>{"use strict";W();vA="system_assigned_managed_identity",R0="managed_identity",lm=`https://login.microsoftonline.com/${R0}/`,Le={AUTHORIZATION_HEADER_NAME:"Authorization",METADATA_HEADER_NAME:"Metadata",APP_SERVICE_SECRET_HEADER_NAME:"X-IDENTITY-HEADER",ML_AND_SF_SECRET_HEADER_NAME:"secret",CLIENT_SKU:Be.X_CLIENT_SKU,CLIENT_VER:Be.X_CLIENT_VER,CLIENT_REQUEST_ID:"x-ms-client-request-id"},Ce={API_VERSION:"api-version",RESOURCE:"resource",SHA256_TOKEN_TO_REFRESH:"token_sha256_to_refresh",XMS_CC:"xms_cc"},U={AZURE_POD_IDENTITY_AUTHORITY_HOST:"AZURE_POD_IDENTITY_AUTHORITY_HOST",DEFAULT_IDENTITY_CLIENT_ID:"DEFAULT_IDENTITY_CLIENT_ID",IDENTITY_ENDPOINT:"IDENTITY_ENDPOINT",IDENTITY_HEADER:"IDENTITY_HEADER",IDENTITY_SERVER_THUMBPRINT:"IDENTITY_SERVER_THUMBPRINT",IMDS_ENDPOINT:"IMDS_ENDPOINT",MSI_ENDPOINT:"MSI_ENDPOINT",MSI_SECRET:"MSI_SECRET"},$={APP_SERVICE:"AppService",AZURE_ARC:"AzureArc",CLOUD_SHELL:"CloudShell",DEFAULT_TO_IMDS:"DefaultToImds",IMDS:"Imds",MACHINE_LEARNING:"MachineLearning",SERVICE_FABRIC:"ServiceFabric"},le={SYSTEM_ASSIGNED:"system-assigned",USER_ASSIGNED_CLIENT_ID:"user-assigned-client-id",USER_ASSIGNED_RESOURCE_ID:"user-assigned-resource-id",USER_ASSIGNED_OBJECT_ID:"user-assigned-object-id"},fe={GET:"GET",POST:"POST"},xA="REGION_NAME",OA="MSAL_FORCE_REGION",PA=32,NA={SHA256:"sha256"},hl={CV_CHARSET:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"},um={KEY_SEPARATOR:"-"},Ke={MSAL_SKU:"msal.js.node",JWT_BEARER_ASSERTION_TYPE:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",HTTP_PROTOCOL:"http://",LOCALHOST:"localhost"},te={acquireTokenSilent:62,acquireTokenByUsernamePassword:371,acquireTokenByDeviceCode:671,acquireTokenByClientCredential:771,acquireTokenByOBO:772,acquireTokenWithManagedIdentity:773,acquireTokenByUserFederatedIdentityCredential:774,acquireTokenByCode:871,acquireTokenByRefreshToken:872},St={RSA_256:"RS256",PSS_256:"PS256",X5T_256:"x5t#S256",X5T:"x5t",X5C:"x5c",AUDIENCE:"aud",EXPIRATION_TIME:"exp",ISSUER:"iss",SUBJECT:"sub",NOT_BEFORE:"nbf",JWT_ID:"jti"},pl={INTERVAL_MS:100,TIMEOUT_MS:5e3},MA=4096});function k0(t){let e={};return t.forEach((r,n)=>{e[n]=r}),e}function v0(t){let e=new Headers;return t&&t.headers&&Object.entries(t.headers).forEach(([r,n])=>{e.append(r,n)}),e}var Go,DA=h(()=>{"use strict";W();J();Go=class{async sendGetRequestAsync(e,r,n){return this.sendRequest(e,fe.GET,r,n)}async sendPostRequestAsync(e,r){return this.sendRequest(e,fe.POST,r)}async sendRequest(e,r,n,o){let i=new AbortController,s;o&&(s=setTimeout(()=>{i.abort()},o));let a={method:r,headers:v0(n),signal:i.signal};r===fe.POST&&(a.body=n?.body||"");let l;try{l=await fetch(e,a)}catch(c){if(s&&clearTimeout(s),c instanceof Error&&c.name==="AbortError")throw In(me.networkError,"","Request timeout");let u=In(me.networkError,"",`Network request failed: ${c instanceof Error?c.message:"unknown"}`);throw nm(u,void 0,void 0,c instanceof Error?c:void 0)}s&&clearTimeout(s);try{return{headers:k0(l.headers),body:await l.json(),status:l.status}}catch(c){throw In(me.tokenParsingError,"",`Failed to parse response: ${c instanceof Error?c.message:"unknown"}`)}}}});var ml,gl,Yr,yl,LA,UA,El,Tl,Cl,Al,Ks,$A,Il,Sl,Fn,Hn=h(()=>{"use strict";J();ml="invalid_file_extension",gl="invalid_file_path",Yr="invalid_managed_identity_id_type",yl="invalid_secret",LA="missing_client_id",UA="network_unavailable",El="platform_not_supported",Tl="unable_to_create_azure_arc",Cl="unable_to_create_cloud_shell",Al="unable_to_create_source",Ks="unable_to_read_secret_file",$A="user_assigned_not_available_at_runtime",Il="www_authenticate_header_missing",Sl="www_authenticate_header_unsupported_format",Fn={[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]:"azure_pod_identity_authority_host_url_malformed",[U.IDENTITY_ENDPOINT]:"identity_endpoint_url_malformed",[U.IMDS_ENDPOINT]:"imds_endpoint_url_malformed",[U.MSI_ENDPOINT]:"msi_endpoint_url_malformed"}});function ye(t,e){return new dm(t,e)}var x0,dm,Ko=h(()=>{"use strict";W();Hn();J();x0={[ml]:"The file path in the WWW-Authenticate header does not contain a .key file.",[gl]:"The file path in the WWW-Authenticate header is not in a valid Windows or Linux Format.",[Yr]:"More than one ManagedIdentityIdType was provided.",[yl]:"The secret in the file on the file path in the WWW-Authenticate header is greater than 4096 bytes.",[El]:"The platform is not supported by Azure Arc. Azure Arc only supports Windows and Linux.",[LA]:"A ManagedIdentityId id was not provided.",[Fn.AZURE_POD_IDENTITY_AUTHORITY_HOST]:`The Managed Identity's '${U.AZURE_POD_IDENTITY_AUTHORITY_HOST}' environment variable is malformed.`,[Fn.IDENTITY_ENDPOINT]:`The Managed Identity's '${U.IDENTITY_ENDPOINT}' environment variable is malformed.`,[Fn.IMDS_ENDPOINT]:`The Managed Identity's '${U.IMDS_ENDPOINT}' environment variable is malformed.`,[Fn.MSI_ENDPOINT]:`The Managed Identity's '${U.MSI_ENDPOINT}' environment variable is malformed.`,[UA]:"Authentication unavailable. The request to the managed identity endpoint timed out.",[Tl]:"Azure Arc Managed Identities can only be system assigned.",[Cl]:"Cloud Shell Managed Identities can only be system assigned.",[Al]:"Unable to create a Managed Identity source based on environment variables.",[Ks]:"Unable to read the secret file.",[$A]:"Service Fabric user assigned managed identity ClientId or ResourceId is not configurable at runtime.",[Il]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is missing.",[Sl]:"A 401 response was received form the Azure Arc Managed Identity, but the www-authenticate header is in an unsupported format."},dm=class t extends H{constructor(e,r){super(e,r,x0[e]),this.name="ManagedIdentityError",Object.setPrototypeOf(this,t.prototype)}}});var _l,FA=h(()=>{"use strict";Ko();J();Hn();_l=class{get id(){return this._id}set id(e){this._id=e}get idType(){return this._idType}set idType(e){this._idType=e}constructor(e){let r=e?.userAssignedClientId,n=e?.userAssignedResourceId,o=e?.userAssignedObjectId;if(r){if(n||o)throw ye(Yr,"");this.id=r,this.idType=le.USER_ASSIGNED_CLIENT_ID}else if(n){if(r||o)throw ye(Yr,"");this.id=n,this.idType=le.USER_ASSIGNED_RESOURCE_ID}else if(o){if(r||n)throw ye(Yr,"");this.id=o,this.idType=le.USER_ASSIGNED_OBJECT_ID}else this.id=vA,this.idType=le.SYSTEM_ASSIGNED}}});var Ae,ze,Ws=h(()=>{"use strict";W();Ae={invalidLoopbackAddressType:{code:"invalid_loopback_server_address_type",desc:"Loopback server address is not type string. This is unexpected."},unableToLoadRedirectUri:{code:"unable_to_load_redirectUrl",desc:"Loopback server callback was invoked without a url. This is unexpected."},noAuthCodeInResponse:{code:"no_auth_code_in_response",desc:"No auth code found in the server response. Please check your network trace to determine what happened."},noLoopbackServerExists:{code:"no_loopback_server_exists",desc:"No loopback server exists yet."},loopbackServerAlreadyExists:{code:"loopback_server_already_exists",desc:"Loopback server already exists. Cannot create another."},loopbackServerTimeout:{code:"loopback_server_timeout",desc:"Timed out waiting for auth code listener to be registered."},stateNotFoundError:{code:"state_not_found",desc:"State not found. Please verify that the request originated from msal."},thumbprintMissing:{code:"thumbprint_missing_from_client_certificate",desc:"Client certificate does not contain a SHA-1 or SHA-256 thumbprint."},redirectUriNotSupported:{code:"redirect_uri_not_supported",desc:"RedirectUri is not supported in this scenario. Please remove redirectUri from the request."}},ze=class t extends H{constructor(e,r,n){super(e,r,n),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new t(Ae.invalidLoopbackAddressType.code,"",`${Ae.invalidLoopbackAddressType.desc}`)}static createUnableToLoadRedirectUrlError(){return new t(Ae.unableToLoadRedirectUri.code,"",`${Ae.unableToLoadRedirectUri.desc}`)}static createNoAuthCodeInResponseError(e=""){return new t(Ae.noAuthCodeInResponse.code,e,`${Ae.noAuthCodeInResponse.desc}`)}static createNoLoopbackServerExistsError(){return new t(Ae.noLoopbackServerExists.code,"",`${Ae.noLoopbackServerExists.desc}`)}static createLoopbackServerAlreadyExistsError(){return new t(Ae.loopbackServerAlreadyExists.code,"",`${Ae.loopbackServerAlreadyExists.desc}`)}static createLoopbackServerTimeoutError(e=""){return new t(Ae.loopbackServerTimeout.code,e,`${Ae.loopbackServerTimeout.desc}`)}static createStateNotFoundError(e=""){return new t(Ae.stateNotFoundError.code,e,Ae.stateNotFoundError.desc)}static createThumbprintMissingError(){return new t(Ae.thumbprintMissing.code,"",Ae.thumbprintMissing.desc)}static createRedirectUriNotSupportedError(e=""){return new t(Ae.redirectUriNotSupported.code,e,Ae.redirectUriNotSupported.desc)}}});function HA({auth:t,broker:e,cache:r,system:n,telemetry:o}){let i={...P0,networkClient:new Go,loggerOptions:n?.loggerOptions||fm,disableInternalRetries:n?.disableInternalRetries||!1};if(t.clientCertificate&&!t.clientCertificate.thumbprint&&!t.clientCertificate.thumbprintSha256)throw ze.createStateNotFoundError();return{auth:{...O0,...t},broker:{...e},cache:{...r},system:{...i,...n},telemetry:{...N0,...o}}}function BA({clientCapabilities:t,managedIdentityIdParams:e,system:r}){let n=new _l(e),o=r?.loggerOptions||fm,i;return r?.networkClient?i=r.networkClient:i=new Go,{clientCapabilities:t||[],managedIdentityId:n,system:{loggerOptions:o,networkClient:i},disableInternalRetries:r?.disableInternalRetries||!1}}var O0,fm,P0,N0,hm=h(()=>{"use strict";W();DA();FA();Ws();O0={clientId:"",authority:A.DEFAULT_AUTHORITY,clientSecret:"",clientAssertion:"",clientCertificate:{thumbprint:"",thumbprintSha256:"",privateKey:"",x5c:""},knownAuthorities:[],cloudDiscoveryMetadata:"",authorityMetadata:"",clientCapabilities:[],azureCloudOptions:{azureCloudInstance:Tr.None,tenant:""},isMcp:!1},fm={loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:ae.Info},P0={loggerOptions:fm,networkClient:new Go,disableInternalRetries:!1,protocolMode:je.AAD},N0={application:{appName:"",appVersion:""}}});import{randomUUID as M0}from"node:crypto";var Wo,pm=h(()=>{"use strict";Wo=class{generateGuid(){return M0()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}}});var ft,Ys=h(()=>{"use strict";W();ft=class t{static base64Encode(e,r){return Buffer.from(e,r).toString(A.EncodingTypes.BASE64)}static base64EncodeUrl(e,r){return t.base64Encode(e,r).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,A.EncodingTypes.BASE64).toString("utf8")}static base64DecodeUrl(e){let r=e.replace(/-/g,"+").replace(/_/g,"/");for(;r.length%4;)r+="=";return t.base64Decode(r)}}});import D0 from"crypto";var Xr,wl=h(()=>{"use strict";J();Xr=class{sha256(e){return D0.createHash(NA.SHA256).update(e).digest()}}});import L0 from"crypto";var bl,jA=h(()=>{"use strict";W();J();Ys();wl();bl=class{constructor(){this.hashUtils=new Xr}async generatePkceCodes(){let e=this.generateCodeVerifier(),r=this.generateCodeChallengeFromVerifier(e);return{verifier:e,challenge:r}}generateCodeVerifier(){let e=[],r=256-256%hl.CV_CHARSET.length;for(;e.length<=PA;){let o=L0.randomBytes(1)[0];if(o>=r)continue;let i=o%hl.CV_CHARSET.length;e.push(hl.CV_CHARSET[i])}let n=e.join("");return ft.base64EncodeUrl(n)}generateCodeChallengeFromVerifier(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});var Jt,Xs=h(()=>{"use strict";W();pm();Ys();jA();wl();Jt=class{constructor(){this.pkceGenerator=new bl,this.guidGenerator=new Wo,this.hashUtils=new Xr}base64UrlEncode(){throw new Error("Method not implemented.")}encodeKid(){throw new Error("Method not implemented.")}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return ft.base64Encode(e)}base64Decode(e){return ft.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return ft.base64EncodeUrl(this.hashUtils.sha256(e).toString(A.EncodingTypes.BASE64),A.EncodingTypes.BASE64)}}});import{createHash as U0}from"crypto";function $0(t){let r=Object.keys(t).sort().map(n=>n+t[n]).join("");return U0("sha256").update(r,"utf8").digest("base64url")}function zA(t){let e=t.credentialType===A.CredentialType.REFRESH_TOKEN&&t.familyId||t.clientId,r=t.tokenType&&t.tokenType.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?t.tokenType.toLowerCase():"",n=[t.homeAccountId,t.environment,t.credentialType,e,t.realm||"",t.target||"",r];return t.additionalCacheKeyComponents&&Object.keys(t.additionalCacheKeyComponents).length>0&&n.push($0(t.additionalCacheKeyComponents)),n.join(um.KEY_SEPARATOR).toLowerCase()}function VA(t){let e=t.homeAccountId.split(".")[1];return[t.homeAccountId,t.environment,e||t.tenantId||""].join(um.KEY_SEPARATOR).toLowerCase()}var qA=h(()=>{"use strict";W();J();});var Jr,Rl=h(()=>{"use strict";W();fl();Ec();qA();Jr=class extends Gr{constructor(e,r,n,o){super(r,n,e,new Te,o),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){let r={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(let n in e){let o=e[n];if(typeof o=="object")if(Mn.isAccountEntity(o))r.accounts[n]=o;else if(Ve.isIdTokenEntity(o))r.idTokens[n]=o;else if(Ve.isAccessTokenEntity(o))r.accessTokens[n]=o;else if(Ve.isRefreshTokenEntity(o))r.refreshTokens[n]=o;else if(Ve.isAppMetadataEntity(n,o))r.appMetadata[n]=o;else continue}return r}inMemoryCacheToCache(e){let r=this.getCache();return r={...r,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},r}getInMemoryCache(){return this.logger.trace("Getting in-memory cache",""),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache","");let r=this.inMemoryCacheToCache(e);this.setCache(r),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store",""),this.cache}setCache(e){this.logger.trace("Setting cache key value store",""),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii(`Item key: ${e}`,""),this.getCache()[e]}setItem(e,r){this.logger.tracePii(`Item key: ${e}`,"");let n=this.getCache();n[e]=r,this.setCache(n)}generateCredentialKey(e){return zA(e)}generateAccountKey(e){return VA(e)}getAccountKeys(){let e=this.getInMemoryCache();return Object.keys(e.accounts)}getTokenKeys(){let e=this.getInMemoryCache();return{idToken:Object.keys(e.idTokens),accessToken:Object.keys(e.accessTokens),refreshToken:Object.keys(e.refreshTokens)}}getAccount(e){let r=this.getItem(e);return r&&typeof r=="object"?{...r}:null}async setAccount(e){let r=this.generateAccountKey(Mn.getAccountInfo(e));this.setItem(r,e)}getIdTokenCredential(e){let r=this.getItem(e);return Ve.isIdTokenEntity(r)?r:null}async setIdTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAccessTokenCredential(e){let r=this.getItem(e);return Ve.isAccessTokenEntity(r)?r:null}async setAccessTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getRefreshTokenCredential(e){let r=this.getItem(e);return Ve.isRefreshTokenEntity(r)?r:null}async setRefreshTokenCredential(e){let r=this.generateCredentialKey(e);this.setItem(r,e)}getAppMetadata(e){let r=this.getItem(e);return Ve.isAppMetadataEntity(e,r)?r:null}setAppMetadata(e){let r=Ve.generateAppMetadataKey(e);this.setItem(r,e)}getServerTelemetry(e){let r=this.getItem(e);return r&&Ve.isServerTelemetryEntity(e,r)?r:null}setServerTelemetry(e,r){this.setItem(e,r)}getAuthorityMetadata(e){let r=this.getItem(e);return r&&Ve.isAuthorityMetadataEntity(e,r)?r:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,r){this.setItem(e,r)}getThrottlingCache(e){let r=this.getItem(e);return r&&Ve.isThrottlingEntity(e,r)?r:null}setThrottlingCache(e,r){this.setItem(e,r)}removeItem(e){this.logger.tracePii(`Item key: ${e}`,"");let r=!1,n=this.getCache();return n[e]&&(delete n[e],r=!0),r&&(this.setCache(n),this.emitChange()),r}removeOutdatedAccount(e){this.removeItem(e)}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys","");let e=this.getCache();return[...Object.keys(e)]}clear(){this.logger.trace("Clearing cache entries created by MSAL",""),this.getKeys().forEach(r=>{this.isAuthorityMetadata(r)||this.removeItem(r)}),this.emitChange()}static generateInMemoryCache(e){return _r.deserializeAllCache(_r.deserializeJSONBlob(e))}static generateJsonCache(e){return Hr.serializeAllCache(e)}updateCredentialCacheKey(e,r){let n=this.generateCredentialKey(r);if(e!==n){let o=this.getItem(e);if(o)return this.removeItem(e),this.setItem(n,o),this.logger.verbose(`Updated an outdated ${r.credentialType} cache key`,""),n;this.logger.error(`Attempted to update an outdated ${r.credentialType} cache key but no item matching the outdated key was found in storage`,"")}return e}}});var Js,Yo,mm=h(()=>{"use strict";Rl();W();fl();Ec();pm();Xs();Js={Account:{},IdToken:{},AccessToken:{},RefreshToken:{},AppMetadata:{}},Yo=class{constructor(e,r,n){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),n&&(this.persistence=n),this.logger=r}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache","");let e=Hr.serializeAllCache(this.storage.getInMemoryCache());return this.cacheSnapshot?(this.logger.trace("Reading cache snapshot from disk",""),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)):this.logger.trace("No cache snapshot to merge",""),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache",""),this.cacheSnapshot=e,this.cacheSnapshot){this.logger.trace("Reading cache snapshot from disk","");let r=_r.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(r)}else this.logger.trace("No cache snapshot to deserialize","")}getKVStore(){return this.storage.getCache()}getCacheSnapshot(){let e=Jr.generateInMemoryCache(this.cacheSnapshot);return this.storage.inMemoryCacheToCache(e)}async getAllAccounts(e=new Jt().createNewGuid()){this.logger.trace("getAllAccounts called",e);let r;try{return this.persistence&&(r=new lt(this,!1),await this.persistence.beforeCacheAccess(r)),this.storage.getAllAccounts({},e)}finally{this.persistence&&r&&await this.persistence.afterCacheAccess(r)}}async getAccountByHomeId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.homeAccountId===e)[0]||null}async getAccountByLocalId(e){let r=await this.getAllAccounts();return e&&r&&r.length&&r.filter(n=>n.localAccountId===e)[0]||null}async removeAccount(e,r){this.logger.trace("removeAccount called",r||"");let n;try{this.persistence&&(n=new lt(this,!0),await this.persistence.beforeCacheAccess(n)),this.storage.removeAccount(e,r||new Wo().generateGuid())}finally{this.persistence&&n&&await this.persistence.afterCacheAccess(n)}}async overwriteCache(){if(!this.persistence){this.logger.info("No persistence layer specified, cache cannot be overwritten","");return}this.logger.info("Overwriting in-memory cache with persistent cache",""),this.storage.clear();let e=new lt(this,!1);await this.persistence.beforeCacheAccess(e);let r=this.getCacheSnapshot();this.storage.setCache(r),await this.persistence.afterCacheAccess(e)}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,r){this.logger.trace("Merging in-memory cache with cache snapshot","");let n=this.mergeRemovals(e,r);return this.mergeUpdates(n,r)}mergeUpdates(e,r){return Object.keys(r).forEach(n=>{let o=r[n];if(!e.hasOwnProperty(n))o!==null&&(e[n]=o);else{let i=o!==null,s=typeof o=="object",a=!Array.isArray(o),l=typeof e[n]<"u"&&e[n]!==null;i&&s&&a&&l?this.mergeUpdates(e[n],o):e[n]=o}}),e}mergeRemovals(e,r){this.logger.trace("Remove updated entries in cache","");let n=e.Account?this.mergeRemovalsDict(e.Account,r.Account):e.Account,o=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,r.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,r.RefreshToken):e.RefreshToken,s=e.IdToken?this.mergeRemovalsDict(e.IdToken,r.IdToken):e.IdToken,a=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,r.AppMetadata):e.AppMetadata;return{...e,Account:n,AccessToken:o,RefreshToken:i,IdToken:s,AppMetadata:a}}mergeRemovalsDict(e,r){let n={...e};return Object.keys(e).forEach(o=>{(!r||!r.hasOwnProperty(o))&&delete n[o]}),n}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache",""),{Account:{...Js.Account,...e.Account},IdToken:{...Js.IdToken,...e.IdToken},AccessToken:{...Js.AccessToken,...e.AccessToken},RefreshToken:{...Js.RefreshToken,...e.RefreshToken},AppMetadata:{...Js.AppMetadata,...e.AppMetadata}}}}});var Xo=S((gm,KA)=>{var kl=L("buffer"),Qt=kl.Buffer;function GA(t,e){for(var r in t)e[r]=t[r]}Qt.from&&Qt.alloc&&Qt.allocUnsafe&&Qt.allocUnsafeSlow?KA.exports=kl:(GA(kl,gm),gm.Buffer=Bn);function Bn(t,e,r){return Qt(t,e,r)}Bn.prototype=Object.create(Qt.prototype);GA(Qt,Bn);Bn.from=function(t,e,r){if(typeof t=="number")throw new TypeError("Argument must not be a number");return Qt(t,e,r)};Bn.alloc=function(t,e,r){if(typeof t!="number")throw new TypeError("Argument must be a number");var n=Qt(t);return e!==void 0?typeof r=="string"?n.fill(e,r):n.fill(e):n.fill(0),n};Bn.allocUnsafe=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return Qt(t)};Bn.allocUnsafeSlow=function(t){if(typeof t!="number")throw new TypeError("Argument must be a number");return kl.SlowBuffer(t)}});var ym=S((qY,WA)=>{var vl=Xo().Buffer,F0=L("stream"),H0=L("util");function xl(t){if(this.buffer=null,this.writable=!0,this.readable=!0,!t)return this.buffer=vl.alloc(0),this;if(typeof t.pipe=="function")return this.buffer=vl.alloc(0),t.pipe(this),this;if(t.length||typeof t=="object")return this.buffer=t,this.writable=!1,process.nextTick(function(){this.emit("end",t),this.readable=!1,this.emit("close")}.bind(this)),this;throw new TypeError("Unexpected data type ("+typeof t+")")}H0.inherits(xl,F0);xl.prototype.write=function(e){this.buffer=vl.concat([this.buffer,vl.from(e)]),this.emit("data",e)};xl.prototype.end=function(e){e&&this.write(e),this.emit("end",e),this.emit("close"),this.writable=!1,this.readable=!1};WA.exports=xl});var XA=S((GY,YA)=>{"use strict";function Em(t){var e=(t/8|0)+(t%8===0?0:1);return e}var B0={ES256:Em(256),ES384:Em(384),ES512:Em(521)};function j0(t){var e=B0[t];if(e)return e;throw new Error('Unknown algorithm "'+t+'"')}YA.exports=j0});var nI=S((KY,rI)=>{"use strict";var Ol=Xo().Buffer,QA=XA(),Pl=128,ZA=0,z0=32,V0=16,q0=2,eI=V0|z0|ZA<<6,Nl=q0|ZA<<6;function G0(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function tI(t){if(Ol.isBuffer(t))return t;if(typeof t=="string")return Ol.from(t,"base64");throw new TypeError("ECDSA signature must be a Base64 string or a Buffer")}function K0(t,e){t=tI(t);var r=QA(e),n=r+1,o=t.length,i=0;if(t[i++]!==eI)throw new Error('Could not find expected "seq"');var s=t[i++];if(s===(Pl|1)&&(s=t[i++]),o-i<s)throw new Error('"seq" specified length of "'+s+'", only "'+(o-i)+'" remaining');if(t[i++]!==Nl)throw new Error('Could not find expected "int" for "r"');var a=t[i++];if(o-i-2<a)throw new Error('"r" specified length of "'+a+'", only "'+(o-i-2)+'" available');if(n<a)throw new Error('"r" specified length of "'+a+'", max of "'+n+'" is acceptable');var l=i;if(i+=a,t[i++]!==Nl)throw new Error('Could not find expected "int" for "s"');var c=t[i++];if(o-i!==c)throw new Error('"s" specified length of "'+c+'", expected "'+(o-i)+'"');if(n<c)throw new Error('"s" specified length of "'+c+'", max of "'+n+'" is acceptable');var u=i;if(i+=c,i!==o)throw new Error('Expected to consume entire buffer, but "'+(o-i)+'" bytes remain');var d=r-a,f=r-c,p=Ol.allocUnsafe(d+a+f+c);for(i=0;i<d;++i)p[i]=0;t.copy(p,i,l+Math.max(-d,0),l+a),i=r;for(var g=i;i<g+f;++i)p[i]=0;return t.copy(p,i,u+Math.max(-f,0),u+c),p=p.toString("base64"),p=G0(p),p}function JA(t,e,r){for(var n=0;e+n<r&&t[e+n]===0;)++n;var o=t[e+n]>=Pl;return o&&--n,n}function W0(t,e){t=tI(t);var r=QA(e),n=t.length;if(n!==r*2)throw new TypeError('"'+e+'" signatures must be "'+r*2+'" bytes, saw "'+n+'"');var o=JA(t,0,r),i=JA(t,r,t.length),s=r-o,a=r-i,l=2+s+1+1+a,c=l<Pl,u=Ol.allocUnsafe((c?2:3)+l),d=0;return u[d++]=eI,c?u[d++]=l:(u[d++]=Pl|1,u[d++]=l&255),u[d++]=Nl,u[d++]=s,o<0?(u[d++]=0,d+=t.copy(u,d,0,r)):d+=t.copy(u,d,o,r),u[d++]=Nl,u[d++]=a,i<0?(u[d++]=0,t.copy(u,d,r)):t.copy(u,d,r+i),u}rI.exports={derToJose:K0,joseToDer:W0}});var iI=S((WY,oI)=>{"use strict";var Qs=L("buffer").Buffer,Tm=L("buffer").SlowBuffer;oI.exports=Ml;function Ml(t,e){if(!Qs.isBuffer(t)||!Qs.isBuffer(e)||t.length!==e.length)return!1;for(var r=0,n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}Ml.install=function(){Qs.prototype.equal=Tm.prototype.equal=function(e){return Ml(this,e)}};var Y0=Qs.prototype.equal,X0=Tm.prototype.equal;Ml.restore=function(){Qs.prototype.equal=Y0,Tm.prototype.equal=X0}});var Sm=S((YY,pI)=>{var Qo=Xo().Buffer,_t=L("crypto"),aI=nI(),sI=L("util"),J0=`"%s" is not a valid algorithm. | ||
| Supported algorithms are: | ||
| "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".`,Zs="secret must be a string or buffer",Jo="key must be a string or a buffer",Q0="key must be a string, a buffer or an object",Am=typeof _t.createPublicKey=="function";Am&&(Jo+=" or a KeyObject",Zs+="or a KeyObject");function cI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&(!Am||typeof t!="object"||typeof t.type!="string"||typeof t.asymmetricKeyType!="string"||typeof t.export!="function"))throw Bt(Jo)}function lI(t){if(!Qo.isBuffer(t)&&typeof t!="string"&&typeof t!="object")throw Bt(Q0)}function Z0(t){if(!Qo.isBuffer(t)){if(typeof t=="string")return t;if(!Am||typeof t!="object"||t.type!=="secret"||typeof t.export!="function")throw Bt(Zs)}}function Im(t){return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function uI(t){t=t.toString();var e=4-t.length%4;if(e!==4)for(var r=0;r<e;++r)t+="=";return t.replace(/\-/g,"+").replace(/_/g,"/")}function Bt(t){var e=[].slice.call(arguments,1),r=sI.format.bind(sI,t).apply(null,e);return new TypeError(r)}function eM(t){return Qo.isBuffer(t)||typeof t=="string"}function ea(t){return eM(t)||(t=JSON.stringify(t)),t}function dI(t){return function(r,n){Z0(n),r=ea(r);var o=_t.createHmac("sha"+t,n),i=(o.update(r),o.digest("base64"));return Im(i)}}var Cm,tM="timingSafeEqual"in _t?function(e,r){return e.byteLength!==r.byteLength?!1:_t.timingSafeEqual(e,r)}:function(e,r){return Cm||(Cm=iI()),Cm(e,r)};function rM(t){return function(r,n,o){var i=dI(t)(r,o);return tM(Qo.from(n),Qo.from(i))}}function fI(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign(n,"base64"));return Im(i)}}function hI(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify(o,n,"base64")}}function nM(t){return function(r,n){lI(n),r=ea(r);var o=_t.createSign("RSA-SHA"+t),i=(o.update(r),o.sign({key:n,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},"base64"));return Im(i)}}function oM(t){return function(r,n,o){cI(o),r=ea(r),n=uI(n);var i=_t.createVerify("RSA-SHA"+t);return i.update(r),i.verify({key:o,padding:_t.constants.RSA_PKCS1_PSS_PADDING,saltLength:_t.constants.RSA_PSS_SALTLEN_DIGEST},n,"base64")}}function iM(t){var e=fI(t);return function(){var n=e.apply(null,arguments);return n=aI.derToJose(n,"ES"+t),n}}function sM(t){var e=hI(t);return function(n,o,i){o=aI.joseToDer(o,"ES"+t).toString("base64");var s=e(n,o,i);return s}}function aM(){return function(){return""}}function cM(){return function(e,r){return r===""}}pI.exports=function(e){var r={hs:dI,rs:fI,ps:nM,es:iM,none:aM},n={hs:rM,rs:hI,ps:oM,es:sM,none:cM},o=e.match(/^(RS|PS|ES|HS)(256|384|512)$|^(none)$/);if(!o)throw Bt(J0,e);var i=(o[1]||o[3]).toLowerCase(),s=o[2];return{sign:r[i](s),verify:n[i](s)}}});var _m=S((XY,mI)=>{var lM=L("buffer").Buffer;mI.exports=function(e){return typeof e=="string"?e:typeof e=="number"||lM.isBuffer(e)?e.toString():JSON.stringify(e)}});var AI=S((JY,CI)=>{var uM=Xo().Buffer,gI=ym(),dM=Sm(),fM=L("stream"),yI=_m(),wm=L("util");function EI(t,e){return uM.from(t,e).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function hM(t,e,r){r=r||"utf8";var n=EI(yI(t),"binary"),o=EI(yI(e),r);return wm.format("%s.%s",n,o)}function TI(t){var e=t.header,r=t.payload,n=t.secret||t.privateKey,o=t.encoding,i=dM(e.alg),s=hM(e,r,o),a=i.sign(s,n);return wm.format("%s.%s",s,a)}function Dl(t){var e=t.secret;if(e=e??t.privateKey,e=e??t.key,/^hs/i.test(t.header.alg)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new gI(e);this.readable=!0,this.header=t.header,this.encoding=t.encoding,this.secret=this.privateKey=this.key=r,this.payload=new gI(t.payload),this.secret.once("close",function(){!this.payload.writable&&this.readable&&this.sign()}.bind(this)),this.payload.once("close",function(){!this.secret.writable&&this.readable&&this.sign()}.bind(this))}wm.inherits(Dl,fM);Dl.prototype.sign=function(){try{var e=TI({header:this.header,payload:this.payload.buffer,secret:this.secret.buffer,encoding:this.encoding});return this.emit("done",e),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(r){this.readable=!1,this.emit("error",r),this.emit("close")}};Dl.sign=TI;CI.exports=Dl});var OI=S((QY,xI)=>{var SI=Xo().Buffer,II=ym(),pM=Sm(),mM=L("stream"),_I=_m(),gM=L("util"),yM=/^[a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$/;function EM(t){return Object.prototype.toString.call(t)==="[object Object]"}function TM(t){if(EM(t))return t;try{return JSON.parse(t)}catch{return}}function wI(t){var e=t.split(".",1)[0];return TM(SI.from(e,"base64").toString("binary"))}function CM(t){return t.split(".",2).join(".")}function bI(t){return t.split(".")[2]}function AM(t,e){e=e||"utf8";var r=t.split(".")[1];return SI.from(r,"base64").toString(e)}function RI(t){return yM.test(t)&&!!wI(t)}function kI(t,e,r){if(!e){var n=new Error("Missing algorithm parameter for jws.verify");throw n.code="MISSING_ALGORITHM",n}t=_I(t);var o=bI(t),i=CM(t),s=pM(e);return s.verify(i,o,r)}function vI(t,e){if(e=e||{},t=_I(t),!RI(t))return null;var r=wI(t);if(!r)return null;var n=AM(t);return(r.typ==="JWT"||e.json)&&(n=JSON.parse(n,e.encoding)),{header:r,payload:n,signature:bI(t)}}function Zo(t){t=t||{};var e=t.secret;if(e=e??t.publicKey,e=e??t.key,/^hs/i.test(t.algorithm)===!0&&e==null)throw new TypeError("secret must be a string or buffer or a KeyObject");var r=new II(e);this.readable=!0,this.algorithm=t.algorithm,this.encoding=t.encoding,this.secret=this.publicKey=this.key=r,this.signature=new II(t.signature),this.secret.once("close",function(){!this.signature.writable&&this.readable&&this.verify()}.bind(this)),this.signature.once("close",function(){!this.secret.writable&&this.readable&&this.verify()}.bind(this))}gM.inherits(Zo,mM);Zo.prototype.verify=function(){try{var e=kI(this.signature.buffer,this.algorithm,this.key.buffer),r=vI(this.signature.buffer,this.encoding);return this.emit("done",e,r),this.emit("data",e),this.emit("end"),this.readable=!1,e}catch(n){this.readable=!1,this.emit("error",n),this.emit("close")}};Zo.decode=vI;Zo.isValid=RI;Zo.verify=kI;xI.exports=Zo});var Ul=S(Qr=>{var PI=AI(),Ll=OI(),IM=["HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512"];Qr.ALGORITHMS=IM;Qr.sign=PI.sign;Qr.verify=Ll.verify;Qr.decode=Ll.decode;Qr.isValid=Ll.isValid;Qr.createSign=function(e){return new PI(e)};Qr.createVerify=function(e){return new Ll(e)}});var bm=S((e5,NI)=>{var SM=Ul();NI.exports=function(t,e){e=e||{};var r=SM.decode(t,e);if(!r)return null;var n=r.payload;if(typeof n=="string")try{var o=JSON.parse(n);o!==null&&typeof o=="object"&&(n=o)}catch{}return e.complete===!0?{header:r.header,payload:n,signature:r.signature}:n}});var ta=S((t5,MI)=>{var $l=function(t,e){Error.call(this,t),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor),this.name="JsonWebTokenError",this.message=t,e&&(this.inner=e)};$l.prototype=Object.create(Error.prototype);$l.prototype.constructor=$l;MI.exports=$l});var Rm=S((r5,LI)=>{var DI=ta(),Fl=function(t,e){DI.call(this,t),this.name="NotBeforeError",this.date=e};Fl.prototype=Object.create(DI.prototype);Fl.prototype.constructor=Fl;LI.exports=Fl});var km=S((n5,$I)=>{var UI=ta(),Hl=function(t,e){UI.call(this,t),this.name="TokenExpiredError",this.expiredAt=e};Hl.prototype=Object.create(UI.prototype);Hl.prototype.constructor=Hl;$I.exports=Hl});var vm=S((o5,FI)=>{var ei=1e3,ti=ei*60,ri=ti*60,jn=ri*24,_M=jn*7,wM=jn*365.25;FI.exports=function(t,e){e=e||{};var r=typeof t;if(r==="string"&&t.length>0)return bM(t);if(r==="number"&&isFinite(t))return e.long?kM(t):RM(t);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(t))};function bM(t){if(t=String(t),!(t.length>100)){var e=/^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(t);if(e){var r=parseFloat(e[1]),n=(e[2]||"ms").toLowerCase();switch(n){case"years":case"year":case"yrs":case"yr":case"y":return r*wM;case"weeks":case"week":case"w":return r*_M;case"days":case"day":case"d":return r*jn;case"hours":case"hour":case"hrs":case"hr":case"h":return r*ri;case"minutes":case"minute":case"mins":case"min":case"m":return r*ti;case"seconds":case"second":case"secs":case"sec":case"s":return r*ei;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return r;default:return}}}}function RM(t){var e=Math.abs(t);return e>=jn?Math.round(t/jn)+"d":e>=ri?Math.round(t/ri)+"h":e>=ti?Math.round(t/ti)+"m":e>=ei?Math.round(t/ei)+"s":t+"ms"}function kM(t){var e=Math.abs(t);return e>=jn?Bl(t,e,jn,"day"):e>=ri?Bl(t,e,ri,"hour"):e>=ti?Bl(t,e,ti,"minute"):e>=ei?Bl(t,e,ei,"second"):t+" ms"}function Bl(t,e,r,n){var o=e>=r*1.5;return Math.round(t/r)+" "+n+(o?"s":"")}});var xm=S((i5,HI)=>{var vM=vm();HI.exports=function(t,e){var r=e||Math.floor(Date.now()/1e3);if(typeof t=="string"){var n=vM(t);return typeof n>"u"?void 0:Math.floor(r+n/1e3)}else return typeof t=="number"?r+t:void 0}});var ni=S((s5,BI)=>{"use strict";var xM="2.0.0",OM=Number.MAX_SAFE_INTEGER||9007199254740991,PM=16,NM=250,MM=["major","premajor","minor","preminor","patch","prepatch","prerelease"];BI.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:PM,MAX_SAFE_BUILD_LENGTH:NM,MAX_SAFE_INTEGER:OM,RELEASE_TYPES:MM,SEMVER_SPEC_VERSION:xM,FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var ra=S((a5,jI)=>{"use strict";var DM=typeof process=="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...t)=>console.error("SEMVER",...t):()=>{};jI.exports=DM});var oi=S((Zt,zI)=>{"use strict";var{MAX_SAFE_COMPONENT_LENGTH:Om,MAX_SAFE_BUILD_LENGTH:LM,MAX_LENGTH:UM}=ni(),$M=ra();Zt=zI.exports={};var FM=Zt.re=[],HM=Zt.safeRe=[],x=Zt.src=[],BM=Zt.safeSrc=[],O=Zt.t={},jM=0,Pm="[a-zA-Z0-9-]",zM=[["\\s",1],["\\d",UM],[Pm,LM]],VM=t=>{for(let[e,r]of zM)t=t.split(`${e}*`).join(`${e}{0,${r}}`).split(`${e}+`).join(`${e}{1,${r}}`);return t},B=(t,e,r)=>{let n=VM(e),o=jM++;$M(t,o,e),O[t]=o,x[o]=e,BM[o]=n,FM[o]=new RegExp(e,r?"g":void 0),HM[o]=new RegExp(n,r?"g":void 0)};B("NUMERICIDENTIFIER","0|[1-9]\\d*");B("NUMERICIDENTIFIERLOOSE","\\d+");B("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${Pm}*`);B("MAINVERSION",`(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})\\.(${x[O.NUMERICIDENTIFIER]})`);B("MAINVERSIONLOOSE",`(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})\\.(${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASEIDENTIFIER",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIER]})`);B("PRERELEASEIDENTIFIERLOOSE",`(?:${x[O.NONNUMERICIDENTIFIER]}|${x[O.NUMERICIDENTIFIERLOOSE]})`);B("PRERELEASE",`(?:-(${x[O.PRERELEASEIDENTIFIER]}(?:\\.${x[O.PRERELEASEIDENTIFIER]})*))`);B("PRERELEASELOOSE",`(?:-?(${x[O.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${x[O.PRERELEASEIDENTIFIERLOOSE]})*))`);B("BUILDIDENTIFIER",`${Pm}+`);B("BUILD",`(?:\\+(${x[O.BUILDIDENTIFIER]}(?:\\.${x[O.BUILDIDENTIFIER]})*))`);B("FULLPLAIN",`v?${x[O.MAINVERSION]}${x[O.PRERELEASE]}?${x[O.BUILD]}?`);B("FULL",`^${x[O.FULLPLAIN]}$`);B("LOOSEPLAIN",`[v=\\s]*${x[O.MAINVERSIONLOOSE]}${x[O.PRERELEASELOOSE]}?${x[O.BUILD]}?`);B("LOOSE",`^${x[O.LOOSEPLAIN]}$`);B("GTLT","((?:<|>)?=?)");B("XRANGEIDENTIFIERLOOSE",`${x[O.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);B("XRANGEIDENTIFIER",`${x[O.NUMERICIDENTIFIER]}|x|X|\\*`);B("XRANGEPLAIN",`[v=\\s]*(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:\\.(${x[O.XRANGEIDENTIFIER]})(?:${x[O.PRERELEASE]})?${x[O.BUILD]}?)?)?`);B("XRANGEPLAINLOOSE",`[v=\\s]*(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:\\.(${x[O.XRANGEIDENTIFIERLOOSE]})(?:${x[O.PRERELEASELOOSE]})?${x[O.BUILD]}?)?)?`);B("XRANGE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAIN]}$`);B("XRANGELOOSE",`^${x[O.GTLT]}\\s*${x[O.XRANGEPLAINLOOSE]}$`);B("COERCEPLAIN",`(^|[^\\d])(\\d{1,${Om}})(?:\\.(\\d{1,${Om}}))?(?:\\.(\\d{1,${Om}}))?`);B("COERCE",`${x[O.COERCEPLAIN]}(?:$|[^\\d])`);B("COERCEFULL",x[O.COERCEPLAIN]+`(?:${x[O.PRERELEASE]})?(?:${x[O.BUILD]})?(?:$|[^\\d])`);B("COERCERTL",x[O.COERCE],!0);B("COERCERTLFULL",x[O.COERCEFULL],!0);B("LONETILDE","(?:~>?)");B("TILDETRIM",`(\\s*)${x[O.LONETILDE]}\\s+`,!0);Zt.tildeTrimReplace="$1~";B("TILDE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAIN]}$`);B("TILDELOOSE",`^${x[O.LONETILDE]}${x[O.XRANGEPLAINLOOSE]}$`);B("LONECARET","(?:\\^)");B("CARETTRIM",`(\\s*)${x[O.LONECARET]}\\s+`,!0);Zt.caretTrimReplace="$1^";B("CARET",`^${x[O.LONECARET]}${x[O.XRANGEPLAIN]}$`);B("CARETLOOSE",`^${x[O.LONECARET]}${x[O.XRANGEPLAINLOOSE]}$`);B("COMPARATORLOOSE",`^${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]})$|^$`);B("COMPARATOR",`^${x[O.GTLT]}\\s*(${x[O.FULLPLAIN]})$|^$`);B("COMPARATORTRIM",`(\\s*)${x[O.GTLT]}\\s*(${x[O.LOOSEPLAIN]}|${x[O.XRANGEPLAIN]})`,!0);Zt.comparatorTrimReplace="$1$2$3";B("HYPHENRANGE",`^\\s*(${x[O.XRANGEPLAIN]})\\s+-\\s+(${x[O.XRANGEPLAIN]})\\s*$`);B("HYPHENRANGELOOSE",`^\\s*(${x[O.XRANGEPLAINLOOSE]})\\s+-\\s+(${x[O.XRANGEPLAINLOOSE]})\\s*$`);B("STAR","(<|>)?=?\\s*\\*");B("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");B("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var jl=S((c5,VI)=>{"use strict";var qM=Object.freeze({loose:!0}),GM=Object.freeze({}),KM=t=>t?typeof t!="object"?qM:t:GM;VI.exports=KM});var Nm=S((l5,KI)=>{"use strict";var qI=/^[0-9]+$/,GI=(t,e)=>{if(typeof t=="number"&&typeof e=="number")return t===e?0:t<e?-1:1;let r=qI.test(t),n=qI.test(e);return r&&n&&(t=+t,e=+e),t===e?0:r&&!n?-1:n&&!r?1:t<e?-1:1},WM=(t,e)=>GI(e,t);KI.exports={compareIdentifiers:GI,rcompareIdentifiers:WM}});var Ue=S((u5,YI)=>{"use strict";var zl=ra(),{MAX_LENGTH:WI,MAX_SAFE_INTEGER:Vl}=ni(),{safeRe:ql,t:Gl}=oi(),YM=jl(),{compareIdentifiers:Mm}=Nm(),XM=(t,e)=>{let r=e.split(".");if(r.length>t.length)return!1;for(let n=0;n<r.length;n++)if(Mm(t[n],r[n])!==0)return!1;return!0},Dm=class t{constructor(e,r){if(r=YM(r),e instanceof t){if(e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease)return e;e=e.version}else if(typeof e!="string")throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>WI)throw new TypeError(`version is longer than ${WI} characters`);zl("SemVer",e,r),this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease;let n=e.trim().match(r.loose?ql[Gl.LOOSE]:ql[Gl.FULL]);if(!n)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+n[1],this.minor=+n[2],this.patch=+n[3],this.major>Vl||this.major<0)throw new TypeError("Invalid major version");if(this.minor>Vl||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>Vl||this.patch<0)throw new TypeError("Invalid patch version");n[4]?this.prerelease=n[4].split(".").map(o=>{if(/^[0-9]+$/.test(o)){let i=+o;if(i>=0&&i<Vl)return i}return o}):this.prerelease=[],this.build=n[5]?n[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(zl("SemVer.compare",this.version,this.options,e),!(e instanceof t)){if(typeof e=="string"&&e===this.version)return 0;e=new t(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof t||(e=new t(e,this.options)),this.major<e.major?-1:this.major>e.major?1:this.minor<e.minor?-1:this.minor>e.minor?1:this.patch<e.patch?-1:this.patch>e.patch?1:0}comparePre(e){if(e instanceof t||(e=new t(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let r=0;do{let n=this.prerelease[r],o=e.prerelease[r];if(zl("prerelease compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}compareBuild(e){e instanceof t||(e=new t(e,this.options));let r=0;do{let n=this.build[r],o=e.build[r];if(zl("build compare",r,n,o),n===void 0&&o===void 0)return 0;if(o===void 0)return 1;if(n===void 0)return-1;if(n===o)continue;return Mm(n,o)}while(++r)}inc(e,r,n){if(e.startsWith("pre")){if(!r&&n===!1)throw new Error("invalid increment argument: identifier is empty");if(r){let o=`-${r}`.match(this.options.loose?ql[Gl.PRERELEASELOOSE]:ql[Gl.PRERELEASE]);if(!o||o[1]!==r)throw new Error(`invalid identifier: ${r}`)}}switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",r,n);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",r,n);break;case"prepatch":this.prerelease.length=0,this.inc("patch",r,n),this.inc("pre",r,n);break;case"prerelease":this.prerelease.length===0&&this.inc("patch",r,n),this.inc("pre",r,n);break;case"release":if(this.prerelease.length===0)throw new Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":(this.minor!==0||this.patch!==0||this.prerelease.length===0)&&this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":(this.patch!==0||this.prerelease.length===0)&&this.minor++,this.patch=0,this.prerelease=[];break;case"patch":this.prerelease.length===0&&this.patch++,this.prerelease=[];break;case"pre":{let o=Number(n)?1:0;if(this.prerelease.length===0)this.prerelease=[o];else{let i=this.prerelease.length;for(;--i>=0;)typeof this.prerelease[i]=="number"&&(this.prerelease[i]++,i=-2);if(i===-1){if(r===this.prerelease.join(".")&&n===!1)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(o)}}if(r){let i=[r,o];if(n===!1&&(i=[r]),XM(this.prerelease,r)){let s=this.prerelease[r.split(".").length];isNaN(s)&&(this.prerelease=i)}else this.prerelease=i}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}};YI.exports=Dm});var Zr=S((d5,JI)=>{"use strict";var XI=Ue(),JM=(t,e,r=!1)=>{if(t instanceof XI)return t;try{return new XI(t,e)}catch(n){if(!r)return null;throw n}};JI.exports=JM});var ZI=S((f5,QI)=>{"use strict";var QM=Zr(),ZM=(t,e)=>{let r=QM(t,e);return r?r.version:null};QI.exports=ZM});var tS=S((h5,eS)=>{"use strict";var eD=Zr(),tD=(t,e)=>{let r=eD(t.trim().replace(/^[=v]+/,""),e);return r?r.version:null};eS.exports=tD});var oS=S((p5,nS)=>{"use strict";var rS=Ue(),rD=(t,e,r,n,o)=>{typeof r=="string"&&(o=n,n=r,r=void 0);try{return new rS(t instanceof rS?t.version:t,r).inc(e,n,o).version}catch{return null}};nS.exports=rD});var aS=S((m5,sS)=>{"use strict";var iS=Zr(),nD=(t,e)=>{let r=iS(t,null,!0),n=iS(e,null,!0),o=r.compare(n);if(o===0)return null;let i=o>0,s=i?r:n,a=i?n:r,l=!!s.prerelease.length;if(!!a.prerelease.length&&!l){if(!a.patch&&!a.minor)return"major";if(a.compareMain(s)===0)return a.minor&&!a.patch?"minor":"patch"}let u=l?"pre":"";return r.major!==n.major?u+"major":r.minor!==n.minor?u+"minor":r.patch!==n.patch?u+"patch":"prerelease"};sS.exports=nD});var lS=S((g5,cS)=>{"use strict";var oD=Ue(),iD=(t,e)=>new oD(t,e).major;cS.exports=iD});var dS=S((y5,uS)=>{"use strict";var sD=Ue(),aD=(t,e)=>new sD(t,e).minor;uS.exports=aD});var hS=S((E5,fS)=>{"use strict";var cD=Ue(),lD=(t,e)=>new cD(t,e).patch;fS.exports=lD});var mS=S((T5,pS)=>{"use strict";var uD=Zr(),dD=(t,e)=>{let r=uD(t,e);return r&&r.prerelease.length?r.prerelease:null};pS.exports=dD});var wt=S((C5,yS)=>{"use strict";var gS=Ue(),fD=(t,e,r)=>new gS(t,r).compare(new gS(e,r));yS.exports=fD});var TS=S((A5,ES)=>{"use strict";var hD=wt(),pD=(t,e,r)=>hD(e,t,r);ES.exports=pD});var AS=S((I5,CS)=>{"use strict";var mD=wt(),gD=(t,e)=>mD(t,e,!0);CS.exports=gD});var Kl=S((S5,SS)=>{"use strict";var IS=Ue(),yD=(t,e,r)=>{let n=new IS(t,r),o=new IS(e,r);return n.compare(o)||n.compareBuild(o)};SS.exports=yD});var wS=S((_5,_S)=>{"use strict";var ED=Kl(),TD=(t,e)=>t.sort((r,n)=>ED(r,n,e));_S.exports=TD});var RS=S((w5,bS)=>{"use strict";var CD=Kl(),AD=(t,e)=>t.sort((r,n)=>CD(n,r,e));bS.exports=AD});var na=S((b5,kS)=>{"use strict";var ID=wt(),SD=(t,e,r)=>ID(t,e,r)>0;kS.exports=SD});var Wl=S((R5,vS)=>{"use strict";var _D=wt(),wD=(t,e,r)=>_D(t,e,r)<0;vS.exports=wD});var Lm=S((k5,xS)=>{"use strict";var bD=wt(),RD=(t,e,r)=>bD(t,e,r)===0;xS.exports=RD});var Um=S((v5,OS)=>{"use strict";var kD=wt(),vD=(t,e,r)=>kD(t,e,r)!==0;OS.exports=vD});var Yl=S((x5,PS)=>{"use strict";var xD=wt(),OD=(t,e,r)=>xD(t,e,r)>=0;PS.exports=OD});var Xl=S((O5,NS)=>{"use strict";var PD=wt(),ND=(t,e,r)=>PD(t,e,r)<=0;NS.exports=ND});var $m=S((P5,MS)=>{"use strict";var MD=Lm(),DD=Um(),LD=na(),UD=Yl(),$D=Wl(),FD=Xl(),HD=(t,e,r,n)=>{switch(e){case"===":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t===r;case"!==":return typeof t=="object"&&(t=t.version),typeof r=="object"&&(r=r.version),t!==r;case"":case"=":case"==":return MD(t,r,n);case"!=":return DD(t,r,n);case">":return LD(t,r,n);case">=":return UD(t,r,n);case"<":return $D(t,r,n);case"<=":return FD(t,r,n);default:throw new TypeError(`Invalid operator: ${e}`)}};MS.exports=HD});var LS=S((N5,DS)=>{"use strict";var BD=Ue(),jD=Zr(),{safeRe:Jl,t:Ql}=oi(),zD=(t,e)=>{if(t instanceof BD)return t;if(typeof t=="number"&&(t=String(t)),typeof t!="string")return null;e=e||{};let r=null;if(!e.rtl)r=t.match(e.includePrerelease?Jl[Ql.COERCEFULL]:Jl[Ql.COERCE]);else{let l=e.includePrerelease?Jl[Ql.COERCERTLFULL]:Jl[Ql.COERCERTL],c;for(;(c=l.exec(t))&&(!r||r.index+r[0].length!==t.length);)(!r||c.index+c[0].length!==r.index+r[0].length)&&(r=c),l.lastIndex=c.index+c[1].length+c[2].length;l.lastIndex=-1}if(r===null)return null;let n=r[2],o=r[3]||"0",i=r[4]||"0",s=e.includePrerelease&&r[5]?`-${r[5]}`:"",a=e.includePrerelease&&r[6]?`+${r[6]}`:"";return jD(`${n}.${o}.${i}${s}${a}`,e)};DS.exports=zD});var $S=S((M5,US)=>{"use strict";var VD=Zr(),qD=ni(),GD=Ue(),KD=(t,e,r)=>{if(!qD.RELEASE_TYPES.includes(e))return null;let n=WD(t,r);return n&&YD(n,e)},WD=(t,e)=>{let r=t instanceof GD?t.version:t;return VD(r,e)},YD=(t,e)=>{if(XD(e))return t.version;switch(t.prerelease=[],e){case"major":t.minor=0,t.patch=0;break;case"minor":t.patch=0;break}return t.format()},XD=t=>t.startsWith("pre");US.exports=KD});var HS=S((D5,FS)=>{"use strict";var Fm=class{constructor(){this.max=1e3,this.map=new Map}get(e){let r=this.map.get(e);if(r!==void 0)return this.map.delete(e),this.map.set(e,r),r}delete(e){return this.map.delete(e)}set(e,r){if(!this.delete(e)&&r!==void 0){if(this.map.size>=this.max){let o=this.map.keys().next().value;this.delete(o)}this.map.set(e,r)}return this}};FS.exports=Fm});var bt=S((L5,VS)=>{"use strict";var JD=/\s+/g,Hm=class t{constructor(e,r){if(r=ZD(r),e instanceof t)return e.loose===!!r.loose&&e.includePrerelease===!!r.includePrerelease?e:new t(e.raw,r);if(e instanceof Bm)return this.raw=e.value,this.set=[[e]],this.formatted=void 0,this;if(this.options=r,this.loose=!!r.loose,this.includePrerelease=!!r.includePrerelease,this.raw=e.trim().replace(JD," "),this.set=this.raw.split("||").map(n=>this.parseRange(n.trim())).filter(n=>n.length),!this.set.length)throw new TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let n=this.set[0];if(this.set=this.set.filter(o=>!jS(o[0])),this.set.length===0)this.set=[n];else if(this.set.length>1){for(let o of this.set)if(o.length===1&&cL(o[0])){this.set=[o];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let e=0;e<this.set.length;e++){e>0&&(this.formatted+="||");let r=this.set[e];for(let n=0;n<r.length;n++)n>0&&(this.formatted+=" "),this.formatted+=r[n].toString().trim()}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(e){e=e.replace(aL,"");let n=((this.options.includePrerelease&&iL)|(this.options.loose&&sL))+":"+e,o=BS.get(n);if(o)return o;let i=this.options.loose,s=i?We[$e.HYPHENRANGELOOSE]:We[$e.HYPHENRANGE];e=e.replace(s,TL(this.options.includePrerelease)),oe("hyphen replace",e),e=e.replace(We[$e.COMPARATORTRIM],rL),oe("comparator trim",e),e=e.replace(We[$e.TILDETRIM],nL),oe("tilde trim",e),e=e.replace(We[$e.CARETTRIM],oL),oe("caret trim",e);let a=e.split(" ").map(d=>lL(d,this.options)).join(" ").split(/\s+/).map(d=>EL(d,this.options));i&&(a=a.filter(d=>(oe("loose invalid filter",d,this.options),!!d.match(We[$e.COMPARATORLOOSE])))),oe("range list",a);let l=new Map,c=a.map(d=>new Bm(d,this.options));for(let d of c){if(jS(d))return[d];l.set(d.value,d)}l.size>1&&l.has("")&&l.delete("");let u=[...l.values()];return BS.set(n,u),u}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Range is required");return this.set.some(n=>zS(n,r)&&e.set.some(o=>zS(o,r)&&n.every(i=>o.every(s=>i.intersects(s,r)))))}test(e){if(!e)return!1;if(typeof e=="string")try{e=new eL(e,this.options)}catch{return!1}for(let r=0;r<this.set.length;r++)if(CL(this.set[r],e,this.options))return!0;return!1}};VS.exports=Hm;var QD=HS(),BS=new QD,ZD=jl(),Bm=oa(),oe=ra(),eL=Ue(),{safeRe:We,src:tL,t:$e,comparatorTrimReplace:rL,tildeTrimReplace:nL,caretTrimReplace:oL}=oi(),{FLAG_INCLUDE_PRERELEASE:iL,FLAG_LOOSE:sL}=ni(),aL=new RegExp(tL[$e.BUILD],"g"),jS=t=>t.value==="<0.0.0-0",cL=t=>t.value==="",zS=(t,e)=>{let r=!0,n=t.slice(),o=n.pop();for(;r&&n.length;)r=n.every(i=>o.intersects(i,e)),o=n.pop();return r},lL=(t,e)=>(t=t.replace(We[$e.BUILD],""),oe("comp",t,e),t=hL(t,e),oe("caret",t),t=dL(t,e),oe("tildes",t),t=mL(t,e),oe("xrange",t),t=yL(t,e),oe("stars",t),t),xe=t=>!t||t.toLowerCase()==="x"||t==="*",uL=(t,e,r)=>xe(t)&&!xe(e)||xe(e)&&r&&!xe(r),dL=(t,e)=>t.trim().split(/\s+/).map(r=>fL(r,e)).join(" "),fL=(t,e)=>{let r=e.loose?We[$e.TILDELOOSE]:We[$e.TILDE],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("tilde",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:l?(oe("replaceTilde pr",l),c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`):c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`,oe("tilde return",c),c})},hL=(t,e)=>t.trim().split(/\s+/).map(r=>pL(r,e)).join(" "),pL=(t,e)=>{oe("caret",t,e);let r=e.loose?We[$e.CARETLOOSE]:We[$e.CARET],n=e.includePrerelease?"-0":"";return t.replace(r,(o,i,s,a,l)=>{oe("caret",t,o,i,s,a,l);let c;return xe(i)?c="":xe(s)?c=`>=${i}.0.0${n} <${+i+1}.0.0-0`:xe(a)?i==="0"?c=`>=${i}.${s}.0${n} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.0${n} <${+i+1}.0.0-0`:l?(oe("replaceCaret pr",l),i==="0"?s==="0"?c=`>=${i}.${s}.${a}-${l} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a}-${l} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a}-${l} <${+i+1}.0.0-0`):(oe("no pr"),i==="0"?s==="0"?c=`>=${i}.${s}.${a} <${i}.${s}.${+a+1}-0`:c=`>=${i}.${s}.${a} <${i}.${+s+1}.0-0`:c=`>=${i}.${s}.${a} <${+i+1}.0.0-0`),oe("caret return",c),c})},mL=(t,e)=>(oe("replaceXRanges",t,e),t.split(/\s+/).map(r=>gL(r,e)).join(" ")),gL=(t,e)=>{t=t.trim();let r=e.loose?We[$e.XRANGELOOSE]:We[$e.XRANGE];return t.replace(r,(n,o,i,s,a,l)=>{if(oe("xRange",t,n,o,i,s,a,l),uL(i,s,a))return t;let c=xe(i),u=c||xe(s),d=u||xe(a),f=d;return o==="="&&f&&(o=""),l=e.includePrerelease?"-0":"",c?o===">"||o==="<"?n="<0.0.0-0":n="*":o&&f?(u&&(s=0),a=0,o===">"?(o=">=",u?(i=+i+1,s=0,a=0):(s=+s+1,a=0)):o==="<="&&(o="<",u?i=+i+1:s=+s+1),o==="<"&&(l="-0"),n=`${o+i}.${s}.${a}${l}`):u?n=`>=${i}.0.0${l} <${+i+1}.0.0-0`:d&&(n=`>=${i}.${s}.0${l} <${i}.${+s+1}.0-0`),oe("xRange return",n),n})},yL=(t,e)=>(oe("replaceStars",t,e),t.trim().replace(We[$e.STAR],"")),EL=(t,e)=>(oe("replaceGTE0",t,e),t.trim().replace(We[e.includePrerelease?$e.GTE0PRE:$e.GTE0],"")),TL=t=>(e,r,n,o,i,s,a,l,c,u,d,f)=>(xe(n)?r="":xe(o)?r=`>=${n}.0.0${t?"-0":""}`:xe(i)?r=`>=${n}.${o}.0${t?"-0":""}`:s?r=`>=${r}`:r=`>=${r}${t?"-0":""}`,xe(c)?l="":xe(u)?l=`<${+c+1}.0.0-0`:xe(d)?l=`<${c}.${+u+1}.0-0`:f?l=`<=${c}.${u}.${d}-${f}`:t?l=`<${c}.${u}.${+d+1}-0`:l=`<=${l}`,`${r} ${l}`.trim()),CL=(t,e,r)=>{for(let n=0;n<t.length;n++)if(!t[n].test(e))return!1;if(e.prerelease.length&&!r.includePrerelease){for(let n=0;n<t.length;n++)if(oe(t[n].semver),t[n].semver!==Bm.ANY&&t[n].semver.prerelease.length>0){let o=t[n].semver;if(o.major===e.major&&o.minor===e.minor&&o.patch===e.patch)return!0}return!1}return!0}});var oa=S((U5,XS)=>{"use strict";var ia=Symbol("SemVer ANY"),Vm=class t{static get ANY(){return ia}constructor(e,r){if(r=qS(r),e instanceof t){if(e.loose===!!r.loose)return e;e=e.value}e=e.trim().split(/\s+/).join(" "),zm("comparator",e,r),this.options=r,this.loose=!!r.loose,this.parse(e),this.semver===ia?this.value="":this.value=this.operator+this.semver.version,zm("comp",this)}parse(e){let r=this.options.loose?GS[KS.COMPARATORLOOSE]:GS[KS.COMPARATOR],n=e.match(r);if(!n)throw new TypeError(`Invalid comparator: ${e}`);this.operator=n[1]!==void 0?n[1]:"",this.operator==="="&&(this.operator=""),n[2]?this.semver=new WS(n[2],this.options.loose):this.semver=ia}toString(){return this.value}test(e){if(zm("Comparator.test",e,this.options.loose),this.semver===ia||e===ia)return!0;if(typeof e=="string")try{e=new WS(e,this.options)}catch{return!1}return jm(e,this.operator,this.semver,this.options)}intersects(e,r){if(!(e instanceof t))throw new TypeError("a Comparator is required");return this.operator===""?this.value===""?!0:new YS(e.value,r).test(this.value):e.operator===""?e.value===""?!0:new YS(this.value,r).test(e.semver):(r=qS(r),r.includePrerelease&&(this.value==="<0.0.0-0"||e.value==="<0.0.0-0")||!r.includePrerelease&&(this.value.startsWith("<0.0.0")||e.value.startsWith("<0.0.0"))?!1:!!(this.operator.startsWith(">")&&e.operator.startsWith(">")||this.operator.startsWith("<")&&e.operator.startsWith("<")||this.semver.version===e.semver.version&&this.operator.includes("=")&&e.operator.includes("=")||jm(this.semver,"<",e.semver,r)&&this.operator.startsWith(">")&&e.operator.startsWith("<")||jm(this.semver,">",e.semver,r)&&this.operator.startsWith("<")&&e.operator.startsWith(">")))}};XS.exports=Vm;var qS=jl(),{safeRe:GS,t:KS}=oi(),jm=$m(),zm=ra(),WS=Ue(),YS=bt()});var sa=S(($5,JS)=>{"use strict";var AL=bt(),IL=(t,e,r)=>{try{e=new AL(e,r)}catch{return!1}return e.test(t)};JS.exports=IL});var ZS=S((F5,QS)=>{"use strict";var SL=bt(),_L=(t,e)=>new SL(t,e).set.map(r=>r.map(n=>n.value).join(" ").trim().split(" "));QS.exports=_L});var t_=S((H5,e_)=>{"use strict";var wL=Ue(),bL=bt(),RL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new bL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===-1)&&(n=s,o=new wL(n,r))}),n};e_.exports=RL});var n_=S((B5,r_)=>{"use strict";var kL=Ue(),vL=bt(),xL=(t,e,r)=>{let n=null,o=null,i=null;try{i=new vL(e,r)}catch{return null}return t.forEach(s=>{i.test(s)&&(!n||o.compare(s)===1)&&(n=s,o=new kL(n,r))}),n};r_.exports=xL});var s_=S((j5,i_)=>{"use strict";var qm=Ue(),OL=bt(),o_=na(),PL=(t,e)=>{t=new OL(t,e);let r=new qm("0.0.0");if(t.test(r)||(r=new qm("0.0.0-0"),t.test(r)))return r;r=null;for(let n=0;n<t.set.length;++n){let o=t.set[n],i=null;o.forEach(s=>{let a=new qm(s.semver.version);switch(s.operator){case">":a.prerelease.length===0?a.patch++:a.prerelease.push(0),a.raw=a.format();case"":case">=":(!i||o_(a,i))&&(i=a);break;case"<":case"<=":break;default:throw new Error(`Unexpected operation: ${s.operator}`)}}),i&&(!r||o_(r,i))&&(r=i)}return r&&t.test(r)?r:null};i_.exports=PL});var c_=S((z5,a_)=>{"use strict";var NL=bt(),ML=(t,e)=>{try{return new NL(t,e).range||"*"}catch{return null}};a_.exports=ML});var Zl=S((V5,f_)=>{"use strict";var DL=Ue(),d_=oa(),{ANY:LL}=d_,UL=bt(),$L=sa(),l_=na(),u_=Wl(),FL=Xl(),HL=Yl(),BL=(t,e,r,n)=>{t=new DL(t,n),e=new UL(e,n);let o,i,s,a,l;switch(r){case">":o=l_,i=FL,s=u_,a=">",l=">=";break;case"<":o=u_,i=HL,s=l_,a="<",l="<=";break;default:throw new TypeError('Must provide a hilo val of "<" or ">"')}if($L(t,e,n))return!1;for(let c=0;c<e.set.length;++c){let u=e.set[c],d=null,f=null;if(u.forEach(p=>{p.semver===LL&&(p=new d_(">=0.0.0")),d=d||p,f=f||p,o(p.semver,d.semver,n)?d=p:s(p.semver,f.semver,n)&&(f=p)}),d.operator===a||d.operator===l||(!f.operator||f.operator===a)&&i(t,f.semver))return!1;if(f.operator===l&&s(t,f.semver))return!1}return!0};f_.exports=BL});var p_=S((q5,h_)=>{"use strict";var jL=Zl(),zL=(t,e,r)=>jL(t,e,">",r);h_.exports=zL});var g_=S((G5,m_)=>{"use strict";var VL=Zl(),qL=(t,e,r)=>VL(t,e,"<",r);m_.exports=qL});var T_=S((K5,E_)=>{"use strict";var y_=bt(),GL=(t,e,r)=>(t=new y_(t,r),e=new y_(e,r),t.intersects(e,r));E_.exports=GL});var A_=S((W5,C_)=>{"use strict";var KL=sa(),WL=wt();C_.exports=(t,e,r)=>{let n=[],o=null,i=null,s=t.sort((u,d)=>WL(u,d,r));for(let u of s)KL(u,e,r)?(i=u,o||(o=u)):(i&&n.push([o,i]),i=null,o=null);o&&n.push([o,null]);let a=[];for(let[u,d]of n)u===d?a.push(u):!d&&u===s[0]?a.push("*"):d?u===s[0]?a.push(`<=${d}`):a.push(`${u} - ${d}`):a.push(`>=${u}`);let l=a.join(" || "),c=typeof e.raw=="string"?e.raw:String(e);return l.length<c.length?l:e}});var R_=S((Y5,b_)=>{"use strict";var I_=bt(),Wm=oa(),{ANY:Gm}=Wm,Km=sa(),Ym=wt(),YL=(t,e,r={})=>{if(t===e)return!0;t=new I_(t,r),e=new I_(e,r);let n=!1;e:for(let o of t.set){for(let i of e.set){let s=JL(o,i,r);if(n=n||s!==null,s)continue e}if(n)return!1}return!0},XL=[new Wm(">=0.0.0-0")],S_=[new Wm(">=0.0.0")],JL=(t,e,r)=>{if(t===e)return!0;if(t.length===1&&t[0].semver===Gm){if(e.length===1&&e[0].semver===Gm)return!0;r.includePrerelease?t=XL:t=S_}if(e.length===1&&e[0].semver===Gm){if(r.includePrerelease)return!0;e=S_}let n=new Set,o,i;for(let p of t)p.operator===">"||p.operator===">="?o=__(o,p,r):p.operator==="<"||p.operator==="<="?i=w_(i,p,r):n.add(p.semver);if(n.size>1)return null;let s;if(o&&i){if(s=Ym(o.semver,i.semver,r),s>0)return null;if(s===0&&(o.operator!==">="||i.operator!=="<="))return null}for(let p of n){if(o&&!Km(p,String(o),r)||i&&!Km(p,String(i),r))return null;for(let g of e)if(!Km(p,String(g),r))return!1;return!0}let a,l,c,u,d=i&&!r.includePrerelease&&i.semver.prerelease.length?i.semver:!1,f=o&&!r.includePrerelease&&o.semver.prerelease.length?o.semver:!1;d&&d.prerelease.length===1&&i.operator==="<"&&d.prerelease[0]===0&&(d=!1);for(let p of e){if(u=u||p.operator===">"||p.operator===">=",c=c||p.operator==="<"||p.operator==="<=",o){if(f&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===f.major&&p.semver.minor===f.minor&&p.semver.patch===f.patch&&(f=!1),p.operator===">"||p.operator===">="){if(a=__(o,p,r),a===p&&a!==o)return!1}else if(o.operator===">="&&!p.test(o.semver))return!1}if(i){if(d&&p.semver.prerelease&&p.semver.prerelease.length&&p.semver.major===d.major&&p.semver.minor===d.minor&&p.semver.patch===d.patch&&(d=!1),p.operator==="<"||p.operator==="<="){if(l=w_(i,p,r),l===p&&l!==i)return!1}else if(i.operator==="<="&&!p.test(i.semver))return!1}if(!p.operator&&(i||o)&&s!==0)return!1}return!(o&&c&&!i&&s!==0||i&&u&&!o&&s!==0||f||d)},__=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n>0?t:n<0||e.operator===">"&&t.operator===">="?e:t},w_=(t,e,r)=>{if(!t)return e;let n=Ym(t.semver,e.semver,r);return n<0?t:n>0||e.operator==="<"&&t.operator==="<="?e:t};b_.exports=YL});var eu=S((X5,x_)=>{"use strict";var Xm=oi(),k_=ni(),QL=Ue(),v_=Nm(),ZL=Zr(),eU=ZI(),tU=tS(),rU=oS(),nU=aS(),oU=lS(),iU=dS(),sU=hS(),aU=mS(),cU=wt(),lU=TS(),uU=AS(),dU=Kl(),fU=wS(),hU=RS(),pU=na(),mU=Wl(),gU=Lm(),yU=Um(),EU=Yl(),TU=Xl(),CU=$m(),AU=LS(),IU=$S(),SU=oa(),_U=bt(),wU=sa(),bU=ZS(),RU=t_(),kU=n_(),vU=s_(),xU=c_(),OU=Zl(),PU=p_(),NU=g_(),MU=T_(),DU=A_(),LU=R_();x_.exports={parse:ZL,valid:eU,clean:tU,inc:rU,diff:nU,major:oU,minor:iU,patch:sU,prerelease:aU,compare:cU,rcompare:lU,compareLoose:uU,compareBuild:dU,sort:fU,rsort:hU,gt:pU,lt:mU,eq:gU,neq:yU,gte:EU,lte:TU,cmp:CU,coerce:AU,truncate:IU,Comparator:SU,Range:_U,satisfies:wU,toComparators:bU,maxSatisfying:RU,minSatisfying:kU,minVersion:vU,validRange:xU,outside:OU,gtr:PU,ltr:NU,intersects:MU,simplifyRange:DU,subset:LU,SemVer:QL,re:Xm.re,src:Xm.src,tokens:Xm.t,SEMVER_SPEC_VERSION:k_.SEMVER_SPEC_VERSION,RELEASE_TYPES:k_.RELEASE_TYPES,compareIdentifiers:v_.compareIdentifiers,rcompareIdentifiers:v_.rcompareIdentifiers}});var P_=S((J5,O_)=>{var UU=eu();O_.exports=UU.satisfies(process.version,">=15.7.0")});var M_=S((Q5,N_)=>{var $U=eu();N_.exports=$U.satisfies(process.version,">=16.9.0")});var Jm=S((Z5,D_)=>{var FU=P_(),HU=M_(),BU={ec:["ES256","ES384","ES512"],rsa:["RS256","PS256","RS384","PS384","RS512","PS512"],"rsa-pss":["PS256","PS384","PS512"]},jU={ES256:"prime256v1",ES384:"secp384r1",ES512:"secp521r1"};D_.exports=function(t,e){if(!t||!e)return;let r=e.asymmetricKeyType;if(!r)return;let n=BU[r];if(!n)throw new Error(`Unknown key type "${r}".`);if(!n.includes(t))throw new Error(`"alg" parameter for "${r}" key type must be one of: ${n.join(", ")}.`);if(FU)switch(r){case"ec":let o=e.asymmetricKeyDetails.namedCurve,i=jU[t];if(o!==i)throw new Error(`"alg" parameter "${t}" requires curve "${i}".`);break;case"rsa-pss":if(HU){let s=parseInt(t.slice(-3),10),{hashAlgorithm:a,mgf1HashAlgorithm:l,saltLength:c}=e.asymmetricKeyDetails;if(a!==`sha${s}`||l!==a)throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${t}.`);if(c!==void 0&&c>s>>3)throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${t}.`)}break}}});var Qm=S((e8,L_)=>{var zU=eu();L_.exports=zU.satisfies(process.version,"^6.12.0 || >=8.0.0")});var F_=S((t8,$_)=>{var re=ta(),VU=Rm(),U_=km(),qU=bm(),GU=xm(),KU=Jm(),WU=Qm(),YU=Ul(),{KeyObject:XU,createSecretKey:JU,createPublicKey:QU}=L("crypto"),Zm=["RS256","RS384","RS512"],ZU=["ES256","ES384","ES512"],eg=["RS256","RS384","RS512"],e$=["HS256","HS384","HS512"];WU&&(Zm.splice(Zm.length,0,"PS256","PS384","PS512"),eg.splice(eg.length,0,"PS256","PS384","PS512"));$_.exports=function(t,e,r,n){typeof r=="function"&&!n&&(n=r,r={}),r||(r={}),r=Object.assign({},r);let o;if(n?o=n:o=function(u,d){if(u)throw u;return d},r.clockTimestamp&&typeof r.clockTimestamp!="number")return o(new re("clockTimestamp must be a number"));if(r.nonce!==void 0&&(typeof r.nonce!="string"||r.nonce.trim()===""))return o(new re("nonce must be a non-empty string"));if(r.allowInvalidAsymmetricKeyTypes!==void 0&&typeof r.allowInvalidAsymmetricKeyTypes!="boolean")return o(new re("allowInvalidAsymmetricKeyTypes must be a boolean"));let i=r.clockTimestamp||Math.floor(Date.now()/1e3);if(!t)return o(new re("jwt must be provided"));if(typeof t!="string")return o(new re("jwt must be a string"));let s=t.split(".");if(s.length!==3)return o(new re("jwt malformed"));let a;try{a=qU(t,{complete:!0})}catch(u){return o(u)}if(!a)return o(new re("invalid token"));let l=a.header,c;if(typeof e=="function"){if(!n)return o(new re("verify must be called asynchronous if secret or public key is provided as a callback"));c=e}else c=function(u,d){return d(null,e)};return c(l,function(u,d){if(u)return o(new re("error in secret or public key callback: "+u.message));let f=s[2].trim()!=="";if(!f&&d)return o(new re("jwt signature is required"));if(f&&!d)return o(new re("secret or public key must be provided"));if(!f&&!r.algorithms)return o(new re('please specify "none" in "algorithms" to verify unsigned tokens'));if(d!=null&&!(d instanceof XU))try{d=QU(d)}catch{try{d=JU(typeof d=="string"?Buffer.from(d):d)}catch{return o(new re("secretOrPublicKey is not valid key material"))}}if(r.algorithms||(d.type==="secret"?r.algorithms=e$:["rsa","rsa-pss"].includes(d.asymmetricKeyType)?r.algorithms=eg:d.asymmetricKeyType==="ec"?r.algorithms=ZU:r.algorithms=Zm),r.algorithms.indexOf(a.header.alg)===-1)return o(new re("invalid algorithm"));if(l.alg.startsWith("HS")&&d.type!=="secret")return o(new re(`secretOrPublicKey must be a symmetric key when using ${l.alg}`));if(/^(?:RS|PS|ES)/.test(l.alg)&&d.type!=="public")return o(new re(`secretOrPublicKey must be an asymmetric key when using ${l.alg}`));if(!r.allowInvalidAsymmetricKeyTypes)try{KU(l.alg,d)}catch(m){return o(m)}let p;try{p=YU.verify(t,a.header.alg,d)}catch(m){return o(m)}if(!p)return o(new re("invalid signature"));let g=a.payload;if(typeof g.nbf<"u"&&!r.ignoreNotBefore){if(typeof g.nbf!="number")return o(new re("invalid nbf value"));if(g.nbf>i+(r.clockTolerance||0))return o(new VU("jwt not active",new Date(g.nbf*1e3)))}if(typeof g.exp<"u"&&!r.ignoreExpiration){if(typeof g.exp!="number")return o(new re("invalid exp value"));if(i>=g.exp+(r.clockTolerance||0))return o(new U_("jwt expired",new Date(g.exp*1e3)))}if(r.audience){let m=Array.isArray(r.audience)?r.audience:[r.audience];if(!(Array.isArray(g.aud)?g.aud:[g.aud]).some(function(T){return m.some(function(C){return C instanceof RegExp?C.test(T):C===T})}))return o(new re("jwt audience invalid. expected: "+m.join(" or ")))}if(r.issuer&&(typeof r.issuer=="string"&&g.iss!==r.issuer||Array.isArray(r.issuer)&&r.issuer.indexOf(g.iss)===-1))return o(new re("jwt issuer invalid. expected: "+r.issuer));if(r.subject&&g.sub!==r.subject)return o(new re("jwt subject invalid. expected: "+r.subject));if(r.jwtid&&g.jti!==r.jwtid)return o(new re("jwt jwtid invalid. expected: "+r.jwtid));if(r.nonce&&g.nonce!==r.nonce)return o(new re("jwt nonce invalid. expected: "+r.nonce));if(r.maxAge){if(typeof g.iat!="number")return o(new re("iat required when maxAge is specified"));let m=GU(r.maxAge,g.iat);if(typeof m>"u")return o(new re('"maxAge" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));if(i>=m+(r.clockTolerance||0))return o(new U_("maxAge exceeded",new Date(m*1e3)))}if(r.complete===!0){let m=a.signature;return o(null,{header:l,payload:g,signature:m})}return o(null,g)})}});var q_=S((r8,V_)=>{var H_=1/0,j_=9007199254740991,t$=17976931348623157e292,B_=NaN,r$="[object Arguments]",n$="[object Function]",o$="[object GeneratorFunction]",i$="[object String]",s$="[object Symbol]",a$=/^\s+|\s+$/g,c$=/^[-+]0x[0-9a-f]+$/i,l$=/^0b[01]+$/i,u$=/^0o[0-7]+$/i,d$=/^(?:0|[1-9]\d*)$/,f$=parseInt;function h$(t,e){for(var r=-1,n=t?t.length:0,o=Array(n);++r<n;)o[r]=e(t[r],r,t);return o}function p$(t,e,r,n){for(var o=t.length,i=r+(n?1:-1);n?i--:++i<o;)if(e(t[i],i,t))return i;return-1}function m$(t,e,r){if(e!==e)return p$(t,g$,r);for(var n=r-1,o=t.length;++n<o;)if(t[n]===e)return n;return-1}function g$(t){return t!==t}function y$(t,e){for(var r=-1,n=Array(t);++r<t;)n[r]=e(r);return n}function E$(t,e){return h$(e,function(r){return t[r]})}function T$(t,e){return function(r){return t(e(r))}}var tu=Object.prototype,rg=tu.hasOwnProperty,ru=tu.toString,C$=tu.propertyIsEnumerable,A$=T$(Object.keys,Object),I$=Math.max;function S$(t,e){var r=z_(t)||k$(t)?y$(t.length,String):[],n=r.length,o=!!n;for(var i in t)(e||rg.call(t,i))&&!(o&&(i=="length"||w$(i,n)))&&r.push(i);return r}function _$(t){if(!b$(t))return A$(t);var e=[];for(var r in Object(t))rg.call(t,r)&&r!="constructor"&&e.push(r);return e}function w$(t,e){return e=e??j_,!!e&&(typeof t=="number"||d$.test(t))&&t>-1&&t%1==0&&t<e}function b$(t){var e=t&&t.constructor,r=typeof e=="function"&&e.prototype||tu;return t===r}function R$(t,e,r,n){t=ng(t)?t:$$(t),r=r&&!n?D$(r):0;var o=t.length;return r<0&&(r=I$(o+r,0)),P$(t)?r<=o&&t.indexOf(e,r)>-1:!!o&&m$(t,e,r)>-1}function k$(t){return v$(t)&&rg.call(t,"callee")&&(!C$.call(t,"callee")||ru.call(t)==r$)}var z_=Array.isArray;function ng(t){return t!=null&&O$(t.length)&&!x$(t)}function v$(t){return og(t)&&ng(t)}function x$(t){var e=tg(t)?ru.call(t):"";return e==n$||e==o$}function O$(t){return typeof t=="number"&&t>-1&&t%1==0&&t<=j_}function tg(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function og(t){return!!t&&typeof t=="object"}function P$(t){return typeof t=="string"||!z_(t)&&og(t)&&ru.call(t)==i$}function N$(t){return typeof t=="symbol"||og(t)&&ru.call(t)==s$}function M$(t){if(!t)return t===0?t:0;if(t=L$(t),t===H_||t===-H_){var e=t<0?-1:1;return e*t$}return t===t?t:0}function D$(t){var e=M$(t),r=e%1;return e===e?r?e-r:e:0}function L$(t){if(typeof t=="number")return t;if(N$(t))return B_;if(tg(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=tg(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(a$,"");var r=l$.test(t);return r||u$.test(t)?f$(t.slice(2),r?2:8):c$.test(t)?B_:+t}function U$(t){return ng(t)?S$(t):_$(t)}function $$(t){return t?E$(t,U$(t)):[]}V_.exports=R$});var K_=S((n8,G_)=>{var F$="[object Boolean]",H$=Object.prototype,B$=H$.toString;function j$(t){return t===!0||t===!1||z$(t)&&B$.call(t)==F$}function z$(t){return!!t&&typeof t=="object"}G_.exports=j$});var Q_=S((o8,J_)=>{var W_=1/0,V$=17976931348623157e292,Y_=NaN,q$="[object Symbol]",G$=/^\s+|\s+$/g,K$=/^[-+]0x[0-9a-f]+$/i,W$=/^0b[01]+$/i,Y$=/^0o[0-7]+$/i,X$=parseInt,J$=Object.prototype,Q$=J$.toString;function Z$(t){return typeof t=="number"&&t==nF(t)}function X_(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function eF(t){return!!t&&typeof t=="object"}function tF(t){return typeof t=="symbol"||eF(t)&&Q$.call(t)==q$}function rF(t){if(!t)return t===0?t:0;if(t=oF(t),t===W_||t===-W_){var e=t<0?-1:1;return e*V$}return t===t?t:0}function nF(t){var e=rF(t),r=e%1;return e===e?r?e-r:e:0}function oF(t){if(typeof t=="number")return t;if(tF(t))return Y_;if(X_(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=X_(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(G$,"");var r=W$.test(t);return r||Y$.test(t)?X$(t.slice(2),r?2:8):K$.test(t)?Y_:+t}J_.exports=Z$});var ew=S((i8,Z_)=>{var iF="[object Number]",sF=Object.prototype,aF=sF.toString;function cF(t){return!!t&&typeof t=="object"}function lF(t){return typeof t=="number"||cF(t)&&aF.call(t)==iF}Z_.exports=lF});var ow=S((s8,nw)=>{var uF="[object Object]";function dF(t){var e=!1;if(t!=null&&typeof t.toString!="function")try{e=!!(t+"")}catch{}return e}function fF(t,e){return function(r){return t(e(r))}}var hF=Function.prototype,tw=Object.prototype,rw=hF.toString,pF=tw.hasOwnProperty,mF=rw.call(Object),gF=tw.toString,yF=fF(Object.getPrototypeOf,Object);function EF(t){return!!t&&typeof t=="object"}function TF(t){if(!EF(t)||gF.call(t)!=uF||dF(t))return!1;var e=yF(t);if(e===null)return!0;var r=pF.call(e,"constructor")&&e.constructor;return typeof r=="function"&&r instanceof r&&rw.call(r)==mF}nw.exports=TF});var sw=S((a8,iw)=>{var CF="[object String]",AF=Object.prototype,IF=AF.toString,SF=Array.isArray;function _F(t){return!!t&&typeof t=="object"}function wF(t){return typeof t=="string"||!SF(t)&&_F(t)&&IF.call(t)==CF}iw.exports=wF});var dw=S((c8,uw)=>{var bF="Expected a function",aw=1/0,RF=17976931348623157e292,cw=NaN,kF="[object Symbol]",vF=/^\s+|\s+$/g,xF=/^[-+]0x[0-9a-f]+$/i,OF=/^0b[01]+$/i,PF=/^0o[0-7]+$/i,NF=parseInt,MF=Object.prototype,DF=MF.toString;function LF(t,e){var r;if(typeof e!="function")throw new TypeError(bF);return t=BF(t),function(){return--t>0&&(r=e.apply(this,arguments)),t<=1&&(e=void 0),r}}function UF(t){return LF(2,t)}function lw(t){var e=typeof t;return!!t&&(e=="object"||e=="function")}function $F(t){return!!t&&typeof t=="object"}function FF(t){return typeof t=="symbol"||$F(t)&&DF.call(t)==kF}function HF(t){if(!t)return t===0?t:0;if(t=jF(t),t===aw||t===-aw){var e=t<0?-1:1;return e*RF}return t===t?t:0}function BF(t){var e=HF(t),r=e%1;return e===e?r?e-r:e:0}function jF(t){if(typeof t=="number")return t;if(FF(t))return cw;if(lw(t)){var e=typeof t.valueOf=="function"?t.valueOf():t;t=lw(e)?e+"":e}if(typeof t!="string")return t===0?t:+t;t=t.replace(vF,"");var r=OF.test(t);return r||PF.test(t)?NF(t.slice(2),r?2:8):xF.test(t)?cw:+t}uw.exports=UF});var Cw=S((l8,Tw)=>{var fw=xm(),zF=Qm(),VF=Jm(),hw=Ul(),qF=q_(),nu=K_(),pw=Q_(),ig=ew(),gw=ow(),en=sw(),GF=dw(),{KeyObject:KF,createSecretKey:WF,createPrivateKey:YF}=L("crypto"),yw=["RS256","RS384","RS512","ES256","ES384","ES512","HS256","HS384","HS512","none"];zF&&yw.splice(3,0,"PS256","PS384","PS512");var XF={expiresIn:{isValid:function(t){return pw(t)||en(t)&&t},message:'"expiresIn" should be a number of seconds or string representing a timespan'},notBefore:{isValid:function(t){return pw(t)||en(t)&&t},message:'"notBefore" should be a number of seconds or string representing a timespan'},audience:{isValid:function(t){return en(t)||Array.isArray(t)},message:'"audience" must be a string or array'},algorithm:{isValid:qF.bind(null,yw),message:'"algorithm" must be a valid string enum value'},header:{isValid:gw,message:'"header" must be an object'},encoding:{isValid:en,message:'"encoding" must be a string'},issuer:{isValid:en,message:'"issuer" must be a string'},subject:{isValid:en,message:'"subject" must be a string'},jwtid:{isValid:en,message:'"jwtid" must be a string'},noTimestamp:{isValid:nu,message:'"noTimestamp" must be a boolean'},keyid:{isValid:en,message:'"keyid" must be a string'},mutatePayload:{isValid:nu,message:'"mutatePayload" must be a boolean'},allowInsecureKeySizes:{isValid:nu,message:'"allowInsecureKeySizes" must be a boolean'},allowInvalidAsymmetricKeyTypes:{isValid:nu,message:'"allowInvalidAsymmetricKeyTypes" must be a boolean'}},JF={iat:{isValid:ig,message:'"iat" should be a number of seconds'},exp:{isValid:ig,message:'"exp" should be a number of seconds'},nbf:{isValid:ig,message:'"nbf" should be a number of seconds'}};function Ew(t,e,r,n){if(!gw(r))throw new Error('Expected "'+n+'" to be a plain object.');Object.keys(r).forEach(function(o){let i=t[o];if(!i){if(!e)throw new Error('"'+o+'" is not allowed in "'+n+'"');return}if(!i.isValid(r[o]))throw new Error(i.message)})}function QF(t){return Ew(XF,!1,t,"options")}function ZF(t){return Ew(JF,!0,t,"payload")}var mw={audience:"aud",issuer:"iss",subject:"sub",jwtid:"jti"},eH=["expiresIn","notBefore","noTimestamp","audience","issuer","subject","jwtid"];Tw.exports=function(t,e,r,n){typeof r=="function"?(n=r,r={}):r=r||{};let o=typeof t=="object"&&!Buffer.isBuffer(t),i=Object.assign({alg:r.algorithm||"HS256",typ:o?"JWT":void 0,kid:r.keyid},r.header);function s(c){if(n)return n(c);throw c}if(!e&&r.algorithm!=="none")return s(new Error("secretOrPrivateKey must have a value"));if(e!=null&&!(e instanceof KF))try{e=YF(e)}catch{try{e=WF(typeof e=="string"?Buffer.from(e):e)}catch{return s(new Error("secretOrPrivateKey is not valid key material"))}}if(i.alg.startsWith("HS")&&e.type!=="secret")return s(new Error(`secretOrPrivateKey must be a symmetric key when using ${i.alg}`));if(/^(?:RS|PS|ES)/.test(i.alg)){if(e.type!=="private")return s(new Error(`secretOrPrivateKey must be an asymmetric key when using ${i.alg}`));if(!r.allowInsecureKeySizes&&!i.alg.startsWith("ES")&&e.asymmetricKeyDetails!==void 0&&e.asymmetricKeyDetails.modulusLength<2048)return s(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`))}if(typeof t>"u")return s(new Error("payload is required"));if(o){try{ZF(t)}catch(c){return s(c)}r.mutatePayload||(t=Object.assign({},t))}else{let c=eH.filter(function(u){return typeof r[u]<"u"});if(c.length>0)return s(new Error("invalid "+c.join(",")+" option for "+typeof t+" payload"))}if(typeof t.exp<"u"&&typeof r.expiresIn<"u")return s(new Error('Bad "options.expiresIn" option the payload already has an "exp" property.'));if(typeof t.nbf<"u"&&typeof r.notBefore<"u")return s(new Error('Bad "options.notBefore" option the payload already has an "nbf" property.'));try{QF(r)}catch(c){return s(c)}if(!r.allowInvalidAsymmetricKeyTypes)try{VF(i.alg,e)}catch(c){return s(c)}let a=t.iat||Math.floor(Date.now()/1e3);if(r.noTimestamp?delete t.iat:o&&(t.iat=a),typeof r.notBefore<"u"){try{t.nbf=fw(r.notBefore,a)}catch(c){return s(c)}if(typeof t.nbf>"u")return s(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}if(typeof r.expiresIn<"u"&&typeof t=="object"){try{t.exp=fw(r.expiresIn,a)}catch(c){return s(c)}if(typeof t.exp>"u")return s(new Error('"expiresIn" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'))}Object.keys(mw).forEach(function(c){let u=mw[c];if(typeof r[c]<"u"){if(typeof t[u]<"u")return s(new Error('Bad "options.'+c+'" option. The payload already has an "'+u+'" property.'));t[u]=r[c]}});let l=r.encoding||"utf8";if(typeof n=="function")n=n&&GF(n),hw.createSign({header:i,privateKey:e,payload:t,encoding:l}).once("error",n).once("done",function(c){if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)return n(new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`));n(null,c)});else{let c=hw.sign({header:i,payload:t,secret:e,encoding:l});if(!r.allowInsecureKeySizes&&/^(?:RS|PS)/.test(i.alg)&&c.length<256)throw new Error(`secretOrPrivateKey has a minimum key size of 2048 bits for ${i.alg}`);return c}}});var Iw=S((u8,Aw)=>{Aw.exports={decode:bm(),verify:F_(),sign:Cw(),JsonWebTokenError:ta(),NotBeforeError:Rm(),TokenExpiredError:km()}});var Sw,_w,ww,sg,bw,Rw,kw,vw,xw,Ow,ou=h(()=>{"use strict";Sw="missing_tenant_id_error",_w="user_timeout_reached",ww="invalid_assertion",sg="invalid_client_credential",bw="empty_fic_assertion",Rw="conflicting_user_identifiers",kw="missing_user_identifier",vw="device_code_polling_cancelled",xw="device_code_expired",Ow="device_code_unknown_error"});var Pw,wr,iu=h(()=>{"use strict";Pw=at(Iw(),1);W();Ys();J();ou();wr=class t{static fromAssertion(e){let r=new t;return r.jwt=e,r}static fromCertificate(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!1,n&&(o.publicCertificate=this.parseCertificate(n)),o}static fromCertificateWithSha256Thumbprint(e,r,n){let o=new t;return o.privateKey=r,o.thumbprint=e,o.useSha256=!0,n&&(o.publicCertificate=this.parseCertificate(n)),o}getJwt(e,r,n){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&r===this.issuer&&n===this.jwtAudience?this.jwt:this.createJwt(e,r,n);if(this.jwt)return this.jwt;throw E(ww,"")}createJwt(e,r,n){this.issuer=r,this.jwtAudience=n;let o=Z.nowSeconds();this.expirationTime=o+600;let s={alg:this.useSha256?St.PSS_256:St.RSA_256},a=this.useSha256?St.X5T_256:St.X5T;Object.assign(s,{[a]:ft.base64EncodeUrl(this.thumbprint,A.EncodingTypes.HEX)}),this.publicCertificate&&Object.assign(s,{[St.X5C]:this.publicCertificate});let l={[St.AUDIENCE]:this.jwtAudience,[St.EXPIRATION_TIME]:this.expirationTime,[St.ISSUER]:this.issuer,[St.SUBJECT]:this.issuer,[St.NOT_BEFORE]:o,[St.JWT_ID]:e.createNewGuid()};return this.jwt=Pw.default.sign(l,this.privateKey,{header:s}),this.jwt}isExpired(){return this.expirationTime<Z.nowSeconds()}static parseCertificate(e){let r=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,n=[],o;for(;(o=r.exec(e))!==null;)n.push(o[1].replace(/\r*\n/g,""));return n}}});var ii,Ye,tn=h(()=>{"use strict";ii="@azure/msal-node",Ye="5.3.0"});var Rt,si=h(()=>{"use strict";W();tn();Rt=class{constructor(e){this.config=Ar(e),this.logger=new ve(this.config.loggerOptions,ii,Ye),this.cryptoUtils=this.config.cryptoInterface,this.cacheManager=this.config.storageInterface,this.networkClient=this.config.networkInterface,this.serverTelemetryManager=this.config.serverTelemetryManager,this.authority=this.config.authOptions.authority,this.performanceClient=new Te}createTokenRequestHeaders(e){return Dn.createTokenRequestHeaders(this.logger,!1,e)}async executePostToTokenEndpoint(e,r,n,o,i){return Dn.executePostToTokenEndpoint(e,r,n,o,i,this.cacheManager,this.networkClient,this.logger,this.performanceClient,this.serverTelemetryManager)}async sendPostRequest(e,r,n,o){return Dn.sendPostRequest(e,r,n,o,this.cacheManager,this.networkClient,this.logger,this.performanceClient)}createTokenQueryParameters(e){return Dn.createTokenQueryParameters(e,this.config.authOptions.clientId,this.config.authOptions.redirectUri,this.performanceClient)}}});var su,Nw=h(()=>{"use strict";W();J();si();su=class extends Rt{constructor(e){super(e)}async acquireToken(e){this.logger.info("in acquireToken call in username-password client",e.correlationId);let r=Z.nowSeconds(),n=await this.executeTokenRequest(this.authority,e),o=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return o.validateTokenResponse(n.body,e.correlationId),o.handleServerTokenResponse(n.body,this.authority,r,e,te.acquireTokenByUsernamePassword)}async executeTokenRequest(e,r){let n=this.createTokenQueryParameters(r),o=j.appendQueryString(e.tokenEndpoint,n),i=await this.createTokenRequestBody(r),s=this.createTokenRequestHeaders({credential:r.username,type:Ge.UPN}),a={clientId:this.config.authOptions.clientId,authority:e.canonicalAuthority,scopes:r.scopes,claims:r.claims,authenticationScheme:r.authenticationScheme,resourceRequestMethod:r.resourceRequestMethod,resourceRequestUri:r.resourceRequestUri,shrClaims:r.shrClaims,sshKid:r.sshKid};return this.executePostToTokenEndpoint(o,i,s,a,r.correlationId)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addUsername(r,e.username),b.addPassword(r,e.password),b.addScopes(r,e.scopes,e.correlationId),b.addResponseType(r,A.OAuthResponseType.IDTOKEN_TOKEN),b.addGrantType(r,A.GrantType.RESOURCE_OWNER_PASSWORD_GRANT),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),this.config.systemOptions.preventCorsPreflight&&e.username&&b.addCcsUpn(r,e.username),ke.mapToQueryString(r)}}});function Mw(t,e,r,n){let o=Gs.getStandardAuthorizeRequestParameters({...t.auth,authority:e,redirectUri:r.redirectUri||""},r,n);return b.addLibraryInfo(o,{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""}),t.system.protocolMode!==je.OIDC&&b.addApplicationTelemetry(o,t.telemetry.application),b.addResponseType(o,A.OAuthResponseType.CODE),r.codeChallenge&&r.codeChallengeMethod&&b.addCodeChallengeParams(o,r.codeChallenge,r.codeChallengeMethod),b.addExtraParameters(o,r.extraQueryParameters||{}),Gs.getAuthorizeUrl(e,o)}var Dw=h(()=>{"use strict";W();J();tn();});var ai,ag=h(()=>{"use strict";W();hm();Xs();Rl();J();mm();iu();tn();Ws();Nw();Dw();ai=class{constructor(e){this.config=HA(e),this.cryptoProvider=new Jt,this.logger=new ve(this.config.system.loggerOptions,ii,Ye),this.storage=new Jr(this.logger,this.config.auth.clientId,this.cryptoProvider,im(this.config.auth)),this.tokenCache=new Yo(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||A.ResponseMode.QUERY,authenticationScheme:A.AuthenticationScheme.BEARER,state:e.state||"",nonce:e.nonce||""},n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions);return Mw(this.config,n,r,this.logger)}async acquireTokenByCode(e,r){this.logger.info("acquireTokenByCode called",e.correlationId||""),e.state&&r&&(this.logger.info("acquireTokenByCode - validating state",e.correlationId||""),this.validateState(e.state,r.state||"",e.correlationId||""),r={...r,state:""});let n={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},o=this.initializeServerTelemetryManager(te.acquireTokenByCode,n.correlationId);try{let i=await this.createAuthority(n.authority,n.correlationId,void 0,e.azureCloudOptions),s=await this.buildOauthClientConfiguration(i,n.correlationId,n.redirectUri,o),a=new Vs(s,new Te);return this.logger.verbose("Auth code client created",n.correlationId),await a.acquireToken(n,te.acquireTokenByCode,r)}catch(i){throw i instanceof H&&(i.correlationId=n.correlationId),o.cacheFailedRequest(i),i}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e),authenticationScheme:A.AuthenticationScheme.BEARER},n=this.initializeServerTelemetryManager(te.acquireTokenByRefreshToken,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new Ln(i,new Te);return this.logger.verbose("Refresh token client created",r.correlationId),await s.acquireToken(r,te.acquireTokenByRefreshToken)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenSilent(e){let r={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},n=this.initializeServerTelemetryManager(te.acquireTokenSilent,r.correlationId,r.forceRefresh);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,r.redirectUri||"",n),s=new qs(i,new Te);this.logger.verbose("Silent flow client created",r.correlationId);try{return await this.tokenCache.overwriteCache(),await this.acquireCachedTokenSilent(r,s,i)}catch(a){if(a instanceof zr&&a.errorCode===me.tokenRefreshRequired)return new Ln(i,new Te).acquireTokenByRefreshToken(r,te.acquireTokenSilent);throw a}}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireCachedTokenSilent(e,r,n){let[o,i]=await r.acquireCachedToken({...e,scopes:e.scopes?.length?e.scopes:[...A.OIDC_DEFAULT_SCOPES]});if(i===A.CacheOutcome.PROACTIVELY_REFRESHED){this.logger.info("ClientApplication:acquireCachedTokenSilent - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId);let s=new Ln(n,new Te);try{await s.acquireTokenByRefreshToken(e,te.acquireTokenSilent)}catch{}}return o}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)},n=this.initializeServerTelemetryManager(te.acquireTokenByUsernamePassword,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new su(i);return this.logger.verbose("Username password client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}getTokenCache(){return this.logger.info("getTokenCache called",""),this.tokenCache}validateState(e,r,n){if(!e)throw ze.createStateNotFoundError(n);if(e!==r)throw E(me.stateMismatch,n)}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,r,n,o){return this.logger.verbose("buildOauthClientConfiguration called",r),this.logger.info(`Building oauth client configuration with the following authority: ${e.tokenEndpoint}.`,r),o?.updateRegionDiscoveryMetadata(e.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:e,clientCapabilities:this.config.auth.clientCapabilities,redirectUri:n,isMcp:this.config.auth.isMcp},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:r},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:o,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:await this.getClientAssertion(e)},libraryInfo:{sku:Ke.MSAL_SKU,version:Ye,cpu:process.arch||"",os:process.platform||""},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}async getClientAssertion(e){return this.developerProvidedClientAssertion&&(this.clientAssertion=wr.fromAssertion(await Ne(this.developerProvidedClientAssertion,this.config.auth.clientId,e.tokenEndpoint))),this.clientAssertion&&{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE}}async initializeBaseRequest(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();return this.logger.verbose("initializeRequestScopes called",r),e.authenticationScheme&&e.authenticationScheme===A.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",r),e.authenticationScheme=A.AuthenticationScheme.BEARER,{...e,scopes:[...e&&e.scopes||[],...A.OIDC_DEFAULT_SCOPES],correlationId:r,authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,r,n){let o={clientId:this.config.auth.clientId,correlationId:r,apiId:e,forceRefresh:n||!1};return new $n(o,this.storage)}async createAuthority(e,r,n,o){this.logger.verbose("createAuthority called",r);let i=Ht.generateAuthority(e,o||this.config.auth.azureCloudOptions),s={protocolMode:this.config.system.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:n};return dl.createDiscoveredInstance(i,this.config.system.networkClient,this.storage,s,this.logger,r,new Te)}clearCache(){this.storage.clear()}}});import tH from"http";var au,Lw=h(()=>{"use strict";W();Ws();J();au=class{async listenForAuthCode(e,r){if(this.server)throw ze.createLoopbackServerAlreadyExistsError();return new Promise((n,o)=>{this.server=tH.createServer((i,s)=>{let a=i.url;if(a){if(a===A.FORWARD_SLASH){s.end(e||"Auth code was successfully acquired. You can close this window now.");return}}else{s.end(r||"Error occurred loading redirectUrl"),o(ze.createUnableToLoadRedirectUrlError());return}let l=this.getRedirectUri(),c=new URL(a,l),u=ke.getDeserializedResponse(c.search)||{};u.code&&(s.writeHead(A.HTTP_REDIRECT,{location:l}),s.end()),u.error&&s.end(r||`Error occurred: ${u.error}`),n(u)}),this.server.listen(0,"127.0.0.1")})}getRedirectUri(){if(!this.server||!this.server.listening)throw ze.createNoLoopbackServerExistsError();let e=this.server.address();if(!e||typeof e=="string"||!e.port)throw this.closeServer(),ze.createInvalidLoopbackAddressTypeError();let r=e&&e.port;return`${Ke.HTTP_PROTOCOL}${Ke.LOCALHOST}:${r}`}closeServer(){this.server&&(this.server.close(),typeof this.server.closeAllConnections=="function"&&this.server.closeAllConnections(),this.server.unref(),this.server=void 0)}}});var cu,Uw=h(()=>{"use strict";W();J();ou();si();cu=class extends Rt{constructor(e){super(e)}async acquireToken(e){let r=await this.getDeviceCode(e);e.deviceCodeCallback(r);let n=Z.nowSeconds(),o=await this.acquireTokenWithDeviceCode(e,r),i=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return i.validateTokenResponse(o,e.correlationId),i.handleServerTokenResponse(o,this.authority,n,e,te.acquireTokenByDeviceCode)}async getDeviceCode(e){let r=this.createExtraQueryParameters(e),n=j.appendQueryString(this.authority.deviceCodeEndpoint,r),o=this.createQueryString(e),i=this.createTokenRequestHeaders(),s={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};return this.executePostRequestToDeviceCodeEndpoint(n,o,i,s,e.correlationId)}createExtraQueryParameters(e){let r=new Map;return e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),ke.mapToQueryString(r)}async executePostRequestToDeviceCodeEndpoint(e,r,n,o,i){let{body:{user_code:s,device_code:a,verification_uri:l,expires_in:c,interval:u,message:d}}=await this.sendPostRequest(o,e,{body:r,headers:n},i);return{userCode:s,deviceCode:a,verificationUri:l,expiresIn:c,interval:u,message:d}}createQueryString(e){let r=new Map;return b.addScopes(r,e.scopes,e.correlationId),b.addClientId(r,this.config.authOptions.clientId),e.extraQueryParameters&&b.addExtraParameters(r,e.extraQueryParameters),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}continuePolling(e,r,n,o){if(o)throw this.logger.error("Token request cancelled by setting DeviceCodeRequest.cancel = true",r),E(vw,r);if(n&&n<e&&Z.nowSeconds()>n)throw this.logger.error(`User defined timeout for device code polling reached. The timeout was set for ${n}`,r),E(_w,r);if(Z.nowSeconds()>e)throw n&&this.logger.verbose(`User specified timeout ignored as the device code has expired before the timeout elapsed. The user specified timeout was set for ${n}`,r),this.logger.error(`Device code expired. Expiration time of device code was ${e}`,r),E(xw,r);return!0}async acquireTokenWithDeviceCode(e,r){let n=this.createTokenQueryParameters(e),o=j.appendQueryString(this.authority.tokenEndpoint,n),i=this.createTokenRequestBody(e,r),s=this.createTokenRequestHeaders(),a=e.timeout?Z.nowSeconds()+e.timeout:void 0,l=Z.nowSeconds()+r.expiresIn,c=r.interval*1e3;for(;this.continuePolling(l,e.correlationId,a,e.cancel);){let u={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},d=await this.executePostToTokenEndpoint(o,i,s,u,e.correlationId);if(d.body&&d.body.error)if(d.body.error===A.AUTHORIZATION_PENDING)this.logger.info("Authorization pending. Continue polling.",e.correlationId),await Z.delay(c);else throw this.logger.info("Unexpected error in polling from the server",e.correlationId),In(qo.postRequestFailed,e.correlationId,d.body.error);else return this.logger.verbose("Authorization completed successfully. Polling stopped.",e.correlationId),d.body}throw this.logger.error("Polling stopped for unknown reasons.",e.correlationId),E(Ow,e.correlationId)}createTokenRequestBody(e,r){let n=new Map;b.addScopes(n,e.scopes,e.correlationId),b.addClientId(n,this.config.authOptions.clientId),b.addGrantType(n,A.GrantType.DEVICE_CODE_GRANT),b.addDeviceCode(n,r.deviceCode);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();return b.addCorrelationId(n,o),b.addClientInfo(n),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ci,$w=h(()=>{"use strict";J();W();ag();Ws();Lw();Uw();tn();ci=class extends ai{constructor(e){super(e),this.config.broker.nativeBrokerPlugin&&(this.config.broker.nativeBrokerPlugin.isBrokerAvailable?(this.nativeBrokerPlugin=this.config.broker.nativeBrokerPlugin,this.nativeBrokerPlugin.setLogger(this.config.system.loggerOptions)):this.logger.warning("NativeBroker implementation was provided but the broker is unavailable.","")),this.skus=$n.makeExtraSkuString({libraryName:Ke.MSAL_SKU,libraryVersion:Ye})}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId||""),Un(this.config.auth.isMcp,e);let r=Object.assign(e,await this.initializeBaseRequest(e)),n=this.initializeServerTelemetryManager(te.acquireTokenByDeviceCode,r.correlationId);try{let o=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),i=await this.buildOauthClientConfiguration(o,r.correlationId,"",n),s=new cu(i);return this.logger.verbose("Device code client created",r.correlationId),await s.acquireToken(r)}catch(o){throw o instanceof H&&(o.correlationId=r.correlationId),n.cacheFailedRequest(o),o}}async acquireTokenInteractive(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();this.logger.trace("acquireTokenInteractive called",r),Un(this.config.auth.isMcp,e);let{openBrowser:n,successTemplate:o,errorTemplate:i,windowHandle:s,loopbackClient:a,...l}=e;if(this.nativeBrokerPlugin){let g={...l,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...l.extraQueryParameters,...l.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:l.account?.nativeAccountId};return this.nativeBrokerPlugin.acquireTokenInteractive(g,s)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}let{verifier:c,challenge:u}=await this.cryptoProvider.generatePkceCodes(),d=a||new au,f={},p=null;try{let g=d.listenForAuthCode(o,i).then(_=>{f=_}).catch(_=>{p=_}),m=await this.waitForRedirectUri(d,r),y={...l,correlationId:r,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:m,responseMode:A.ResponseMode.QUERY,codeChallenge:u,codeChallengeMethod:A.CodeChallengeMethodValues.S256},R=await this.getAuthCodeUrl(y);if(await n(R),await g,p)throw p;if(f.error)throw new qe(f.error,r,f.error_description,f.suberror);if(!f.code)throw ze.createNoAuthCodeInResponseError(r);let T=f.client_info,C={code:f.code,codeVerifier:c,clientInfo:T||"",...y};return await this.acquireTokenByCode(C)}finally{d.closeServer()}}async acquireTokenSilent(e){let r=e.correlationId||this.cryptoProvider.createNewGuid();if(this.logger.trace("acquireTokenSilent called",r),Un(this.config.auth.isMcp,e),this.nativeBrokerPlugin){let n={...e,clientId:this.config.auth.clientId,scopes:e.scopes||A.OIDC_DEFAULT_SCOPES,redirectUri:e.redirectUri||"",authority:e.authority||this.config.auth.authority,correlationId:r,extraParameters:{...e.extraQueryParameters,...e.extraParameters,[Be.X_CLIENT_EXTRA_SKU]:this.skus},accountId:e.account.nativeAccountId,forceRefresh:e.forceRefresh||!1};return this.nativeBrokerPlugin.acquireTokenSilent(n)}if(e.redirectUri){if(!this.config.broker.nativeBrokerPlugin)throw ze.createRedirectUriNotSupportedError(r);e.redirectUri=""}return super.acquireTokenSilent(e)}async acquireTokenByCode(e,r){return Un(this.config.auth.isMcp,e),super.acquireTokenByCode(e,r)}async acquireTokenByRefreshToken(e){return Un(this.config.auth.isMcp,e),super.acquireTokenByRefreshToken(e)}async signOut(e){if(this.nativeBrokerPlugin&&e.account.nativeAccountId){let r={clientId:this.config.auth.clientId,accountId:e.account.nativeAccountId,correlationId:e.correlationId||this.cryptoProvider.createNewGuid()};await this.nativeBrokerPlugin.signOut(r)}await this.getTokenCache().removeAccount(e.account,e.correlationId)}async getAllAccounts(){if(this.nativeBrokerPlugin){let e=this.cryptoProvider.createNewGuid();return this.nativeBrokerPlugin.getAllAccounts(this.config.auth.clientId,e)}return this.getTokenCache().getAllAccounts()}async waitForRedirectUri(e,r){return new Promise((n,o)=>{let i=0,s=setInterval(()=>{if(pl.TIMEOUT_MS/pl.INTERVAL_MS<i){clearInterval(s),o(ze.createLoopbackServerTimeoutError(r));return}try{let a=e.getRedirectUri();clearInterval(s),n(a);return}catch(a){if(a instanceof H&&a.errorCode===Ae.noLoopbackServerExists.code){i++;return}clearInterval(s),o(a);return}},pl.INTERVAL_MS)})}}});var li,cg=h(()=>{"use strict";W();J();si();li=class extends Rt{constructor(e,r){super(e),this.appTokenProvider=r}async acquireToken(e){let r;if(e.fmiPath&&(r={fmi_path:e.fmiPath}),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,void 0,r);let[n,o]=await this.getCachedAuthenticationResult(e,this.config,this.cryptoUtils,this.authority,this.cacheManager,this.serverTelemetryManager,r);return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",e.correlationId),await this.executeTokenRequest(e,this.authority,!0,r)),n):this.executeTokenRequest(e,this.authority,void 0,r)}async getCachedAuthenticationResult(e,r,n,o,i,s,a){let l=r,c=r,u=A.CacheOutcome.NOT_APPLICABLE,d;l.serializableCache&&l.persistencePlugin&&(d=new lt(l.serializableCache,!1),await l.persistencePlugin.beforeCacheAccess(d));let f=this.readAccessTokenFromCache(o,c.managedIdentityId?.id||l.authOptions.clientId,new de(e.scopes||[],e.correlationId),i,e.correlationId,a);return l.serializableCache&&l.persistencePlugin&&d&&await l.persistencePlugin.afterCacheAccess(d),f?Z.isTokenExpired(f.expiresOn,l.systemOptions?.tokenRenewalOffsetSeconds||A.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)?(s?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),[null,A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED]):(f.refreshOn&&Z.isTokenExpired(f.refreshOn.toString(),0)&&(u=A.CacheOutcome.PROACTIVELY_REFRESHED,s?.setCacheOutcome(A.CacheOutcome.PROACTIVELY_REFRESHED)),[await ce.generateAuthenticationResult(n,o,{account:null,idToken:null,accessToken:f,refreshToken:null,appMetadata:null},!0,e,this.performanceClient),u]):(s?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),[null,A.CacheOutcome.NO_CACHED_ACCESS_TOKEN])}readAccessTokenFromCache(e,r,n,o,i,s){let a={homeAccountId:"",environment:e.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ACCESS_TOKEN,clientId:r,realm:e.tenant,target:de.createSearchScopes(n.asArray(),i),additionalCacheKeyComponents:s},l=o.getAccessTokensByFilter(a,i);if(l.length<1)return null;if(l.length>1)throw E(me.multipleMatchingTokens,i);return l[0]}async executeTokenRequest(e,r,n,o){let i,s;if(this.appTokenProvider){this.logger.info("Using appTokenProvider extensibility.",e.correlationId);let c={correlationId:e.correlationId,tenantId:this.config.authOptions.authority.tenant,scopes:e.scopes,claims:e.claims};s=Z.nowSeconds();let u=await this.appTokenProvider(c);i={access_token:u.accessToken,expires_in:u.expiresInSeconds,refresh_in:u.refreshInSeconds,token_type:A.AuthenticationScheme.BEARER}}else{let c=this.createTokenQueryParameters(e),u=j.appendQueryString(r.tokenEndpoint,c),d=await this.createTokenRequestBody(e),f=this.createTokenRequestHeaders(),p={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid};this.logger.info("Sending token request to endpoint: "+r.tokenEndpoint,e.correlationId),s=Z.nowSeconds();let g=await this.executePostToTokenEndpoint(u,d,f,p,e.correlationId);i=g.body,i.status=g.status}let a=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return a.validateTokenResponse(i,e.correlationId,n),await a.handleServerTokenResponse(i,this.authority,s,e,te.acquireTokenByClientCredential,void 0,void 0,void 0,void 0,void 0,o)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId,!1),b.addGrantType(r,A.GrantType.CLIENT_CREDENTIALS_GRANT),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=e.clientAssertion||this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint,e.fmiPath)),b.addClientAssertionType(r,o.assertionType)),e.fmiPath&&r.set(Be.FMI_PATH,e.fmiPath),(!Pe.isEmptyObj(e.claims)||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var lu,Fw=h(()=>{"use strict";W();J();Ys();si();lu=class extends Rt{constructor(e){super(e)}async acquireToken(e){if(this.scopeSet=new de(e.scopes||[],e.correlationId),this.userAssertionHash=await this.cryptoUtils.hashString(e.oboAssertion),e.skipCache||e.claims)return this.executeTokenRequest(e,this.authority,this.userAssertionHash);try{return await this.getCachedAuthenticationResult(e)}catch{return await this.executeTokenRequest(e,this.authority,this.userAssertionHash)}}async getCachedAuthenticationResult(e){let r=this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId,e);if(r){if(Z.isTokenExpired(r.expiresOn,this.config.systemOptions.tokenRenewalOffsetSeconds))throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED),this.logger.info(`OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`,e.correlationId),E(me.tokenRefreshRequired,e.correlationId)}else throw this.serverTelemetryManager?.setCacheOutcome(A.CacheOutcome.NO_CACHED_ACCESS_TOKEN),this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.",e.correlationId),E(me.tokenRefreshRequired,e.correlationId);let n=this.readIdTokenFromCacheForOBO(r.homeAccountId,e.correlationId),o,i=null;if(n){o=jc.extractTokenClaims(n.secret,ft.base64Decode,e.correlationId);let s=o.oid||o.sub,a={homeAccountId:n.homeAccountId,environment:n.environment,tenantId:n.realm,username:"",localAccountId:s||""};i=this.cacheManager.getAccount(this.cacheManager.generateAccountKey(a),e.correlationId)}return this.config.serverTelemetryManager&&this.config.serverTelemetryManager.incrementCacheHits(),ce.generateAuthenticationResult(this.cryptoUtils,this.authority,{account:i,accessToken:r,idToken:n,refreshToken:null,appMetadata:null},!0,e,this.performanceClient,o)}readIdTokenFromCacheForOBO(e,r){let n={homeAccountId:e,environment:this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,credentialType:A.CredentialType.ID_TOKEN,clientId:this.config.authOptions.clientId,realm:this.authority.tenant},o=this.cacheManager.getIdTokensByFilter(n,r);return Object.values(o).length<1?null:Object.values(o)[0]}readAccessTokenFromCacheForOBO(e,r){let n=r.authenticationScheme||A.AuthenticationScheme.BEARER,i={credentialType:n&&n.toLowerCase()!==A.AuthenticationScheme.BEARER.toLowerCase()?A.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:A.CredentialType.ACCESS_TOKEN,clientId:e,target:de.createSearchScopes(this.scopeSet.asArray(),r.correlationId),tokenType:n,keyId:r.sshKid,userAssertionHash:this.userAssertionHash},s=this.cacheManager.getAccessTokensByFilter(i,r.correlationId),a=s.length;if(a<1)return null;if(a>1)throw E(me.multipleMatchingTokens,r.correlationId);return s[0]}async executeTokenRequest(e,r,n){let o=this.createTokenQueryParameters(e),i=j.appendQueryString(r.tokenEndpoint,o),s=await this.createTokenRequestBody(e),a=this.createTokenRequestHeaders(),l={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:e.scopes,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},c=Z.nowSeconds(),u=await this.executePostToTokenEndpoint(i,s,a,l,e.correlationId),d=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return d.validateTokenResponse(u.body,e.correlationId),await d.handleServerTokenResponse(u.body,this.authority,c,e,te.acquireTokenByOBO,void 0,n)}async createTokenRequestBody(e){let r=new Map;b.addClientId(r,this.config.authOptions.clientId),b.addScopes(r,e.scopes,e.correlationId),b.addGrantType(r,A.GrantType.JWT_BEARER),b.addClientInfo(r),b.addLibraryInfo(r,this.config.libraryInfo),b.addApplicationTelemetry(r,this.config.telemetry.application),b.addThrottling(r),this.serverTelemetryManager&&b.addServerTelemetry(r,this.serverTelemetryManager);let n=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(r,n),b.addRequestTokenUse(r,Be.ON_BEHALF_OF),b.addOboAssertion(r,e.oboAssertion),this.config.clientCredentials.clientSecret&&b.addClientSecret(r,this.config.clientCredentials.clientSecret);let o=this.config.clientCredentials.clientAssertion;return o&&(b.addClientAssertion(r,await Ne(o.assertion,this.config.authOptions.clientId,e.resourceRequestUri)),b.addClientAssertionType(r,o.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(r,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(r)}}});var uu,Hw=h(()=>{"use strict";W();J();si();uu=class extends Rt{constructor(e){super(e)}async acquireToken(e){return this.executeTokenRequest(e,this.authority)}async executeTokenRequest(e,r){let n=new de(e.scopes||[],e.correlationId);n.appendScopes(A.OIDC_DEFAULT_SCOPES);let o=n.asArray(),i=this.createTokenQueryParameters(e),s=j.appendQueryString(r.tokenEndpoint,i),a=await this.createTokenRequestBody(e,o),l=this.createTokenRequestHeaders(),c={clientId:this.config.authOptions.clientId,authority:e.authority,scopes:o,claims:e.claims,authenticationScheme:e.authenticationScheme,resourceRequestMethod:e.resourceRequestMethod,resourceRequestUri:e.resourceRequestUri,shrClaims:e.shrClaims,sshKid:e.sshKid},u=Z.nowSeconds(),d=await this.executePostToTokenEndpoint(s,a,l,c,e.correlationId),f=new ce(this.config.authOptions.clientId,this.cacheManager,this.cryptoUtils,this.logger,this.performanceClient,this.config.serializableCache,this.config.persistencePlugin);return f.validateTokenResponse(d.body,e.correlationId),await f.handleServerTokenResponse(d.body,this.authority,u,e,te.acquireTokenByUserFederatedIdentityCredential)}async createTokenRequestBody(e,r){let n=new Map;b.addClientId(n,this.config.authOptions.clientId),b.addScopes(n,r,e.correlationId),b.addGrantType(n,A.GrantType.USER_FIC),b.addClientInfo(n),n.set(Be.USER_FEDERATED_IDENTITY_CREDENTIAL,e.assertion),e.username?n.set(Be.USERNAME,e.username):e.userObjectId&&n.set(Be.USER_ID,e.userObjectId),b.addLibraryInfo(n,this.config.libraryInfo),b.addApplicationTelemetry(n,this.config.telemetry.application),b.addThrottling(n),this.serverTelemetryManager&&b.addServerTelemetry(n,this.serverTelemetryManager);let o=e.correlationId||this.config.cryptoInterface.createNewGuid();b.addCorrelationId(n,o),this.config.clientCredentials.clientSecret&&b.addClientSecret(n,this.config.clientCredentials.clientSecret);let i=e.clientAssertion||this.config.clientCredentials.clientAssertion;return i&&(b.addClientAssertion(n,await Ne(i.assertion,this.config.authOptions.clientId,this.authority.tokenEndpoint)),b.addClientAssertionType(n,i.assertionType)),(e.claims||this.config.authOptions.clientCapabilities&&this.config.authOptions.clientCapabilities.length>0)&&b.addClaims(n,e.correlationId,e.claims,this.config.authOptions.clientCapabilities),ke.mapToQueryString(n)}}});var ui,Bw=h(()=>{"use strict";ag();iu();J();W();cg();Fw();Hw();ou();ui=class extends ai{constructor(e){super(e);let r=!!this.config.auth.clientSecret,n=!!this.config.auth.clientAssertion,o=(!!this.config.auth.clientCertificate?.thumbprint||!!this.config.auth.clientCertificate?.thumbprintSha256)&&!!this.config.auth.clientCertificate?.privateKey;if(!this.appTokenProvider){if(r&&n||n&&o||r&&o)throw E(sg,"");if(this.config.auth.clientSecret){this.clientSecret=this.config.auth.clientSecret;return}if(this.config.auth.clientAssertion){this.developerProvidedClientAssertion=this.config.auth.clientAssertion;return}if(o)this.clientAssertion=this.config.auth.clientCertificate.thumbprintSha256?wr.fromCertificateWithSha256Thumbprint(this.config.auth.clientCertificate.thumbprintSha256,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c):wr.fromCertificate(this.config.auth.clientCertificate.thumbprint,this.config.auth.clientCertificate.privateKey,this.config.auth.clientCertificate.x5c);else throw E(sg,"");this.appTokenProvider=void 0}}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){this.logger.info("acquireTokenByClientCredential called",e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...n,scopes:n.scopes.filter(f=>!A.OIDC_DEFAULT_SCOPES.includes(f))},i={...e,...o,clientAssertion:r},a=new j(i.authority,i.correlationId).getUrlComponents().PathSegments[0];if(Object.values(A.AADAuthority).includes(a))throw E(Sw,i.correlationId);let l=process.env[OA],c;i.azureRegion!=="DisableMsalForceRegion"&&(!i.azureRegion&&l?c=l:c=i.azureRegion);let u={azureRegion:c,environmentRegion:process.env[xA]},d=this.initializeServerTelemetryManager(te.acquireTokenByClientCredential,i.correlationId,i.skipCache);try{let f=await this.createAuthority(i.authority,i.correlationId,u,e.azureCloudOptions),p=await this.buildOauthClientConfiguration(f,i.correlationId,"",d),g=new li(p,this.appTokenProvider);return this.logger.verbose("Client credential client created",i.correlationId),await g.acquireToken(i)}catch(f){throw f instanceof H&&(f.correlationId=i.correlationId),d.cacheFailedRequest(f),f}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId||"");let r={...e,...await this.initializeBaseRequest(e)};try{let n=await this.createAuthority(r.authority,r.correlationId,void 0,e.azureCloudOptions),o=await this.buildOauthClientConfiguration(n,r.correlationId,"",void 0),i=new lu(o);return this.logger.verbose("On behalf of client created",r.correlationId),await i.acquireToken(r)}catch(n){throw n instanceof H&&(n.correlationId=r.correlationId),n}}async acquireTokenByUserFederatedIdentityCredential(e){if(this.logger.info("acquireTokenByUserFederatedIdentityCredential called",e.correlationId||""),e.userObjectId&&e.username)throw E(Rw,e.correlationId||"");if(!e.userObjectId&&!e.username)throw E(kw,e.correlationId||"");if(!e.assertion)throw E(bw,e.correlationId||"");let r;e.clientAssertion&&(r={assertion:await Ne(e.clientAssertion,this.config.auth.clientId),assertionType:Ke.JWT_BEARER_ASSERTION_TYPE});let n=await this.initializeBaseRequest(e),o={...e,...n,assertion:e.assertion,clientAssertion:r},i=this.initializeServerTelemetryManager(te.acquireTokenByUserFederatedIdentityCredential,o.correlationId);try{let s=await this.createAuthority(o.authority,o.correlationId,void 0,e.azureCloudOptions),a=await this.buildOauthClientConfiguration(s,o.correlationId,"",i),l=new uu(a);return this.logger.verbose("UserFederatedIdentityCredential client created",o.correlationId),await l.acquireToken(o)}catch(s){throw s instanceof H&&(s.correlationId=o.correlationId),i.cacheFailedRequest(s),s}}}});function jw(t){if(typeof t!="string")return!1;let e=new Date(t);return!isNaN(e.getTime())&&e.toISOString()===t}var zw=h(()=>{"use strict";});var du,Vw=h(()=>{"use strict";W();J();du=class{constructor(e,r,n){this.httpClientNoRetries=e,this.retryPolicy=r,this.logger=n}async sendNetworkRequestAsyncHelper(e,r,n){return e===fe.GET?this.httpClientNoRetries.sendGetRequestAsync(r,n):this.httpClientNoRetries.sendPostRequestAsync(r,n)}async sendNetworkRequestAsync(e,r,n){let o=await this.sendNetworkRequestAsyncHelper(e,r,n);"isNewRequest"in this.retryPolicy&&(this.retryPolicy.isNewRequest=!0);let i=0;for(;await this.retryPolicy.pauseForRetry(o.status,i,this.logger,o.headers[A.HeaderNames.RETRY_AFTER]);)o=await this.sendNetworkRequestAsyncHelper(e,r,n),i++;return o}async sendGetRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.GET,e,r)}async sendPostRequestAsync(e,r){return this.sendNetworkRequestAsync(fe.POST,e,r)}}});var zn,Xe,Vn=h(()=>{"use strict";W();J();Ko();zw();Vw();Hn();zn={MANAGED_IDENTITY_CLIENT_ID_2017:"clientid",MANAGED_IDENTITY_CLIENT_ID:"client_id",MANAGED_IDENTITY_OBJECT_ID:"object_id",MANAGED_IDENTITY_RESOURCE_ID_IMDS:"msi_res_id",MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS:"mi_res_id"},Xe=class{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}createCorrelationId(){return this.cryptoProvider.createNewGuid()}async getServerTokenResponseAsync(e,r,n,o){return this.getServerTokenResponse(e)}getServerTokenResponse(e){let r,n;return e.body.expires_on&&(jw(e.body.expires_on)&&(e.body.expires_on=new Date(e.body.expires_on).getTime()/1e3),n=e.body.expires_on-Z.nowSeconds(),n>2*3600&&(r=n/2)),{status:e.status,access_token:e.body.access_token,expires_in:n,scope:e.body.resource,token_type:e.body.token_type,refresh_in:r,correlation_id:e.body.correlation_id||e.body.correlationId,error:typeof e.body.error=="string"?e.body.error:e.body.error?.code,error_description:e.body.message||(typeof e.body.error=="string"?e.body.error_description:e.body.error?.message),error_codes:e.body.error_codes,timestamp:e.body.timestamp,trace_id:e.body.trace_id}}async acquireTokenWithManagedIdentity(e,r,n,o){let i=this.createRequest(e.resource,r);if(e.revokedTokenSha256Hash&&(this.logger.info(`[Managed Identity] The following claims are present in the request: ${e.claims}`,""),i.queryParameters[Ce.SHA256_TOKEN_TO_REFRESH]=e.revokedTokenSha256Hash),e.clientCapabilities?.length){let p=e.clientCapabilities.toString();this.logger.info(`[Managed Identity] The following client capabilities are present in the request: ${p}`,""),i.queryParameters[Ce.XMS_CC]=p}let s=i.headers;s[A.HeaderNames.CONTENT_TYPE]=A.URL_FORM_CONTENT_TYPE;let a={headers:s};Object.keys(i.bodyParameters).length&&(a.body=i.computeParametersBodyString());let l=this.disableInternalRetries?this.networkClient:new du(this.networkClient,i.retryPolicy,this.logger),c=Z.nowSeconds(),u;try{i.httpMethod===fe.POST?u=await l.sendPostRequestAsync(i.computeUri(),a):u=await l.sendGetRequestAsync(i.computeUri(),a)}catch(p){throw p instanceof H?p:E(me.networkError,e.correlationId)}let d=new ce(r.id,this.nodeStorage,this.cryptoProvider,this.logger,new Te,null,null),f=await this.getServerTokenResponseAsync(u,l,i,a);return d.validateTokenResponse(f,f.correlation_id||"",o),d.handleServerTokenResponse(f,n,c,e,te.acquireTokenWithManagedIdentity)}getManagedIdentityUserAssignedIdQueryParameterKey(e,r,n){switch(e){case le.USER_ASSIGNED_CLIENT_ID:return this.logger.info(`[Managed Identity] [API version ${n?"2017+":"2019+"}] Adding user assigned client id to the request.`,""),n?zn.MANAGED_IDENTITY_CLIENT_ID_2017:zn.MANAGED_IDENTITY_CLIENT_ID;case le.USER_ASSIGNED_RESOURCE_ID:return this.logger.info("[Managed Identity] Adding user assigned resource id to the request.",""),r?zn.MANAGED_IDENTITY_RESOURCE_ID_IMDS:zn.MANAGED_IDENTITY_RESOURCE_ID_NON_IMDS;case le.USER_ASSIGNED_OBJECT_ID:return this.logger.info("[Managed Identity] Adding user assigned object id to the request.",""),zn.MANAGED_IDENTITY_OBJECT_ID;default:throw ye(Yr,"")}}};Xe.getValidatedEnvVariableUrlString=(t,e,r,n)=>{try{return new j(e,"").urlString}catch{throw n.info(`[Managed Identity] ${r} managed identity is unavailable because the '${t}' environment variable is malformed.`,""),ye(Fn[t],"")}}});var fu,qw=h(()=>{"use strict";fu=class{calculateDelay(e,r){if(!e)return r;let n=Math.round(parseFloat(e)*1e3);return isNaN(n)&&(n=new Date(e).valueOf()-new Date().valueOf()),Math.max(r,n)}}});var rH,nH,oH,hu,Gw=h(()=>{"use strict";W();qw();rH=3,nH=1e3,oH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_TOO_MANY_REQUESTS,A.HTTP_SERVER_ERROR,A.HTTP_SERVICE_UNAVAILABLE,A.HTTP_GATEWAY_TIMEOUT],hu=class t{constructor(){this.linearRetryStrategy=new fu}static get DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS(){return nH}async pauseForRetry(e,r,n,o){if(oH.includes(e)&&r<rH){let i=this.linearRetryStrategy.calculateDelay(o,t.DEFAULT_MANAGED_IDENTITY_RETRY_DELAY_MS);return n.verbose(`Retrying request in ${i}ms (retry attempt: ${r+1})`,""),await new Promise(s=>setTimeout(s,i)),!0}return!1}}});var et,qn=h(()=>{"use strict";W();Gw();et=class{constructor(e,r,n){this.httpMethod=e,this._baseEndpoint=r,this.headers={},this.bodyParameters={},this.queryParameters={},this.retryPolicy=n||new hu}computeUri(){let e=new Map;this.queryParameters&&b.addExtraParameters(e,this.queryParameters);let r=ke.mapToQueryString(e);return j.appendQueryString(this._baseEndpoint,r)}computeParametersBodyString(){let e=new Map;return this.bodyParameters&&b.addExtraParameters(e,this.bodyParameters),ke.mapToQueryString(e)}}});var iH,aa,Kw=h(()=>{"use strict";Vn();J();qn();iH="2019-08-01",aa=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.APP_SERVICE} managed identity is unavailable because one or both of the '${U.IDENTITY_HEADER}' and '${U.IDENTITY_ENDPOINT}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,s,$.APP_SERVICE,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.APP_SERVICE} managed identity. Endpoint URI: ${l}. Creating ${$.APP_SERVICE} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.APP_SERVICE_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=iH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});import{accessSync as sH,constants as Ww,statSync as aH,readFileSync as cH}from"fs";import lH from"path";var uH,Yw,Xw,Jw,dH,ca,Qw=h(()=>{"use strict";W();qn();Vn();Ko();J();Hn();uH="2019-11-01",Yw="http://127.0.0.1:40342/metadata/identity/oauth2/token",Xw="N/A: himds executable exists",Jw={win32:`${process.env.ProgramData}\\AzureConnectedMachineAgent\\Tokens\\`,linux:"/var/opt/azcmagent/tokens/"},dH={win32:`${process.env.ProgramFiles}\\AzureConnectedMachineAgent\\himds.exe`,linux:"/opt/azcmagent/bin/himds"},ca=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IMDS_ENDPOINT];if(!e||!r){let n=dH[process.platform];try{sH(n,Ww.F_OK|Ww.R_OK),e=Yw,r=Xw}catch{}}return[e,r]}static tryCreate(e,r,n,o,i,s){let[a,l]=t.getEnvironmentVariables();if(!a||!l)return e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is unavailable through environment variables because one or both of '${U.IDENTITY_ENDPOINT}' and '${U.IMDS_ENDPOINT}' are not defined. ${$.AZURE_ARC} managed identity is also unavailable through file detection.`,""),null;if(l===Xw)e.info(`[Managed Identity] ${$.AZURE_ARC} managed identity is available through file detection. Defaulting to known ${$.AZURE_ARC} endpoint: ${Yw}. Creating ${$.AZURE_ARC} managed identity.`,"");else{let c=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.AZURE_ARC,e);c.endsWith("/")&&c.slice(0,-1),t.getValidatedEnvVariableUrlString(U.IMDS_ENDPOINT,l,$.AZURE_ARC,e),e.info(`[Managed Identity] Environment variables validation passed for ${$.AZURE_ARC} managed identity. Endpoint URI: ${c}. Creating ${$.AZURE_ARC} managed identity.`,"")}if(s.idType!==le.SYSTEM_ASSIGNED)throw ye(Tl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.GET,this.identityEndpoint.replace("localhost","127.0.0.1"));return r.headers[Le.METADATA_HEADER_NAME]="true",r.queryParameters[Ce.API_VERSION]=uH,r.queryParameters[Ce.RESOURCE]=e,r}async getServerTokenResponseAsync(e,r,n,o){let i;if(e.status===A.HTTP_UNAUTHORIZED){let s=e.headers["www-authenticate"];if(!s)throw ye(Il,"");if(!s.includes("Basic realm="))throw ye(Sl,"");let a=s.split("Basic realm=")[1];if(!Jw.hasOwnProperty(process.platform))throw ye(El,"");let l=Jw[process.platform],c=lH.basename(a);if(!c.endsWith(".key"))throw ye(ml,"");if(l+c!==a)throw ye(gl,"");let u;try{u=await aH(a).size}catch{throw ye(Ks,"")}if(u>MA)throw ye(yl,"");let d;try{d=cH(a,A.EncodingTypes.UTF8)}catch{throw ye(Ks,"")}let f=`Basic ${d}`;this.logger.info("[Managed Identity] Adding authorization header to the request.",""),n.headers[Le.AUTHORIZATION_HEADER_NAME]=f;try{i=await r.sendGetRequestAsync(n.computeUri(),o)}catch(p){throw p instanceof H?p:E(me.networkError,"")}}return this.getServerTokenResponse(i||e)}}});var la,Zw=h(()=>{"use strict";qn();Vn();J();Ko();Hn();la=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.msiEndpoint=s}static getEnvironmentVariables(){return[process.env[U.MSI_ENDPOINT]]}static tryCreate(e,r,n,o,i,s){let[a]=t.getEnvironmentVariables();if(!a)return e.info(`[Managed Identity] ${$.CLOUD_SHELL} managed identity is unavailable because the '${U.MSI_ENDPOINT} environment variable is not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,a,$.CLOUD_SHELL,e);if(e.info(`[Managed Identity] Environment variable validation passed for ${$.CLOUD_SHELL} managed identity. Endpoint URI: ${l}. Creating ${$.CLOUD_SHELL} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED)throw ye(Cl,"");return new t(e,r,n,o,i,a)}createRequest(e){let r=new et(fe.POST,this.msiEndpoint);return r.headers[Le.METADATA_HEADER_NAME]="true",r.bodyParameters[Ce.RESOURCE]=e,r}}});var pu,eb=h(()=>{"use strict";pu=class{constructor(e,r,n){this.minExponentialBackoff=e,this.maxExponentialBackoff=r,this.exponentialDeltaBackoff=n}calculateDelay(e){return e===0?this.minExponentialBackoff:Math.min(Math.pow(2,e-1)*this.exponentialDeltaBackoff,this.maxExponentialBackoff)}}});var fH,hH,pH,mH,gH,yH,EH,mu,tb=h(()=>{"use strict";W();eb();fH=[A.HTTP_NOT_FOUND,A.HTTP_REQUEST_TIMEOUT,A.HTTP_GONE,A.HTTP_TOO_MANY_REQUESTS],hH=3,pH=7,mH=1e3,gH=4e3,yH=2e3,EH=10*1e3,mu=class t{constructor(){this.exponentialRetryStrategy=new pu(t.MIN_EXPONENTIAL_BACKOFF_MS,t.MAX_EXPONENTIAL_BACKOFF_MS,t.EXPONENTIAL_DELTA_BACKOFF_MS)}static get MIN_EXPONENTIAL_BACKOFF_MS(){return mH}static get MAX_EXPONENTIAL_BACKOFF_MS(){return gH}static get EXPONENTIAL_DELTA_BACKOFF_MS(){return yH}static get HTTP_STATUS_GONE_RETRY_AFTER_MS(){return EH}set isNewRequest(e){this._isNewRequest=e}async pauseForRetry(e,r,n){if(this._isNewRequest&&(this._isNewRequest=!1,this.maxRetries=e===A.HTTP_GONE?pH:hH),(fH.includes(e)||e>=A.HTTP_SERVER_ERROR_RANGE_START&&e<=A.HTTP_SERVER_ERROR_RANGE_END&&r<this.maxRetries)&&r<this.maxRetries){let o=e===A.HTTP_GONE?t.HTTP_STATUS_GONE_RETRY_AFTER_MS:this.exponentialRetryStrategy.calculateDelay(r);return n.verbose(`Retrying request in ${o}ms (retry attempt: ${r+1})`,""),await new Promise(i=>setTimeout(i,o)),!0}return!1}}});var rb,TH,CH,gu,nb=h(()=>{"use strict";qn();Vn();J();tb();tn();rb="/metadata/identity/oauth2/token",TH=`http://169.254.169.254${rb}`,CH="2018-02-01",gu=class t extends Xe{constructor(e,r,n,o,i,s){super(e,r,n,o,i),this.identityEndpoint=s}static tryCreate(e,r,n,o,i){let s;return process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]?(e.info(`[Managed Identity] Environment variable ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} for ${$.IMDS} returned endpoint: ${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}`,""),s=t.getValidatedEnvVariableUrlString(U.AZURE_POD_IDENTITY_AUTHORITY_HOST,`${process.env[U.AZURE_POD_IDENTITY_AUTHORITY_HOST]}${rb}`,$.IMDS,e)):(e.info(`[Managed Identity] Unable to find ${U.AZURE_POD_IDENTITY_AUTHORITY_HOST} environment variable for ${$.IMDS}, using the default endpoint.`,""),s=TH),new t(e,r,n,o,i,s)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.CLIENT_SKU]=Ke.MSAL_SKU,n.headers[Le.CLIENT_VER]=Ye,n.headers[Le.CLIENT_REQUEST_ID]=this.createCorrelationId(),n.queryParameters[Ce.API_VERSION]=CH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!0)]=r.id),n.retryPolicy=new mu,n}}});var AH,ua,ob=h(()=>{"use strict";qn();Vn();J();AH="2019-07-01-preview",ua=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.identityEndpoint=s,this.identityHeader=a}static getEnvironmentVariables(){let e=process.env[U.IDENTITY_ENDPOINT],r=process.env[U.IDENTITY_HEADER],n=process.env[U.IDENTITY_SERVER_THUMBPRINT];return[e,r,n]}static tryCreate(e,r,n,o,i,s){let[a,l,c]=t.getEnvironmentVariables();if(!a||!l||!c)return e.info(`[Managed Identity] ${$.SERVICE_FABRIC} managed identity is unavailable because one or all of the '${U.IDENTITY_HEADER}', '${U.IDENTITY_ENDPOINT}' or '${U.IDENTITY_SERVER_THUMBPRINT}' environment variables are not defined.`,""),null;let u=t.getValidatedEnvVariableUrlString(U.IDENTITY_ENDPOINT,a,$.SERVICE_FABRIC,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.SERVICE_FABRIC} managed identity. Endpoint URI: ${u}. Creating ${$.SERVICE_FABRIC} managed identity.`,""),s.idType!==le.SYSTEM_ASSIGNED&&e.warning(`[Managed Identity] ${$.SERVICE_FABRIC} user assigned managed identity is configured in the cluster, not during runtime. See also: https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-service.`,""),new t(e,r,n,o,i,a,l)}createRequest(e,r){let n=new et(fe.GET,this.identityEndpoint);return n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.identityHeader,n.queryParameters[Ce.API_VERSION]=AH,n.queryParameters[Ce.RESOURCE]=e,r.idType!==le.SYSTEM_ASSIGNED&&(n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType)]=r.id),n}}});var IH,SH,da,ib=h(()=>{"use strict";Vn();J();qn();IH="2017-09-01",SH=`Only client id is supported for user-assigned managed identity in ${$.MACHINE_LEARNING}.`,da=class t extends Xe{constructor(e,r,n,o,i,s,a){super(e,r,n,o,i),this.msiEndpoint=s,this.secret=a}static getEnvironmentVariables(){let e=process.env[U.MSI_ENDPOINT],r=process.env[U.MSI_SECRET];return[e,r]}static tryCreate(e,r,n,o,i){let[s,a]=t.getEnvironmentVariables();if(!s||!a)return e.info(`[Managed Identity] ${$.MACHINE_LEARNING} managed identity is unavailable because one or both of the '${U.MSI_ENDPOINT}' and '${U.MSI_SECRET}' environment variables are not defined.`,""),null;let l=t.getValidatedEnvVariableUrlString(U.MSI_ENDPOINT,s,$.MACHINE_LEARNING,e);return e.info(`[Managed Identity] Environment variables validation passed for ${$.MACHINE_LEARNING} managed identity. Endpoint URI: ${l}. Creating ${$.MACHINE_LEARNING} managed identity.`,""),new t(e,r,n,o,i,s,a)}createRequest(e,r){let n=new et(fe.GET,this.msiEndpoint);if(n.headers[Le.METADATA_HEADER_NAME]="true",n.headers[Le.ML_AND_SF_SECRET_HEADER_NAME]=this.secret,n.queryParameters[Ce.API_VERSION]=IH,n.queryParameters[Ce.RESOURCE]=e,r.idType===le.SYSTEM_ASSIGNED)n.queryParameters[zn.MANAGED_IDENTITY_CLIENT_ID_2017]=process.env[U.DEFAULT_IDENTITY_CLIENT_ID];else if(r.idType===le.USER_ASSIGNED_CLIENT_ID)n.queryParameters[this.getManagedIdentityUserAssignedIdQueryParameterKey(r.idType,!1,!0)]=r.id;else throw new Error(SH);return n}}});var fa,sb=h(()=>{"use strict";Kw();Qw();Zw();nb();ob();Ko();J();ib();Hn();fa=class t{constructor(e,r,n,o,i){this.logger=e,this.nodeStorage=r,this.networkClient=n,this.cryptoProvider=o,this.disableInternalRetries=i}async sendManagedIdentityTokenRequest(e,r,n,o){return t.identitySource||(t.identitySource=this.selectManagedIdentitySource(this.logger,this.nodeStorage,this.networkClient,this.cryptoProvider,this.disableInternalRetries,r)),t.identitySource.acquireTokenWithManagedIdentity(e,r,n,o)}allEnvironmentVariablesAreDefined(e){return Object.values(e).every(r=>r!==void 0)}getManagedIdentitySource(){return t.sourceName=this.allEnvironmentVariablesAreDefined(ua.getEnvironmentVariables())?$.SERVICE_FABRIC:this.allEnvironmentVariablesAreDefined(aa.getEnvironmentVariables())?$.APP_SERVICE:this.allEnvironmentVariablesAreDefined(da.getEnvironmentVariables())?$.MACHINE_LEARNING:this.allEnvironmentVariablesAreDefined(la.getEnvironmentVariables())?$.CLOUD_SHELL:this.allEnvironmentVariablesAreDefined(ca.getEnvironmentVariables())?$.AZURE_ARC:$.DEFAULT_TO_IMDS,t.sourceName}selectManagedIdentitySource(e,r,n,o,i,s){let a=ua.tryCreate(e,r,n,o,i,s)||aa.tryCreate(e,r,n,o,i)||da.tryCreate(e,r,n,o,i)||la.tryCreate(e,r,n,o,i,s)||ca.tryCreate(e,r,n,o,i,s)||gu.tryCreate(e,r,n,o,i);if(!a)throw ye(Al,"");return a}}});var _H,di,ab=h(()=>{"use strict";W();hm();tn();Xs();cg();sb();Rl();J();wl();_H=[$.SERVICE_FABRIC],di=class t{constructor(e){this.config=BA(e||{}),this.logger=new ve(this.config.system.loggerOptions,ii,Ye);let r={canonicalAuthority:A.DEFAULT_AUTHORITY};t.nodeStorage||(t.nodeStorage=new Jr(this.logger,this.config.managedIdentityId.id,No,r)),this.networkClient=this.config.system.networkClient,this.cryptoProvider=new Jt;let n={protocolMode:je.AAD,knownAuthorities:[lm],cloudDiscoveryMetadata:"",authorityMetadata:""};this.fakeAuthority=new Ht(lm,this.networkClient,t.nodeStorage,n,this.logger,this.cryptoProvider.createNewGuid(),new Te,!0),this.fakeClientCredentialClient=new li({authOptions:{clientId:this.config.managedIdentityId.id,authority:this.fakeAuthority}}),this.managedIdentityClient=new fa(this.logger,t.nodeStorage,this.networkClient,this.cryptoProvider,this.config.disableInternalRetries),this.hashUtils=new Xr}async acquireToken(e){if(!e.resource)throw Y(ko.urlEmptyError,"");let r={forceRefresh:e.forceRefresh,resource:e.resource.replace("/.default",""),scopes:[e.resource.replace("/.default","")],authority:this.fakeAuthority.canonicalAuthority,correlationId:this.cryptoProvider.createNewGuid(),claims:e.claims,clientCapabilities:this.config.clientCapabilities};if(r.forceRefresh)return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority);let[n,o]=await this.fakeClientCredentialClient.getCachedAuthenticationResult(r,this.config,this.cryptoProvider,this.fakeAuthority,t.nodeStorage);if(r.claims){let i=this.managedIdentityClient.getManagedIdentitySource();if(n&&_H.includes(i)){let s=this.hashUtils.sha256(n.accessToken).toString(A.EncodingTypes.HEX);r.revokedTokenSha256Hash=s}return this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority)}return n?(o===A.CacheOutcome.PROACTIVELY_REFRESHED&&(this.logger.info("ClientCredentialClient:getCachedAuthenticationResult - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.",r.correlationId),await this.acquireTokenFromManagedIdentity(r,this.config.managedIdentityId,this.fakeAuthority,!0)), |
Comment on lines
+1829
to
+1833
| const overlay = document.createElement("div"); | ||
| overlay.className = "wiq-overlay"; | ||
| const panel = document.createElement("div"); | ||
| panel.className = "wiq-dialog"; | ||
| overlay.appendChild(panel); |
| <span class="fi fi-num-2" aria-hidden="true"></span> | ||
| <span class="accordion-title-copy"> | ||
| <span>Build current Hosted Agent</span> | ||
| <span class="accordion-description">Switch to a new model, add tools and skills or apply guardrail to your current hosted agent.</span> |
Contributor
Author
@aaronpowell Thank you for the suggestion. I just submit an issue (#2311) to add it as an external plugin, it's ready to be listed in the awesome-copilot marketplace, please help to take a look. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Package the Foundry agent builder canvas and register it in the Awesome Copilot marketplace.
Pull Request Checklist
npm startand verified thatREADME.mdis up to date.mainbranch for this pull request.Description
Type of Contribution
By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.