{"version":3,"file":"vendors-b6d182cb.xxxxxxxx.bundle.js","mappings":";yyBAuBA,MAAMA,EACFC,YAAYC,EAAUC,EAAYC,EAAQC,GACtCC,KAAKJ,SAAWA,EAChBI,KAAKH,WAAaA,EAClBG,KAAKC,aAAeH,EAAOI,MAAM,IAAM,KACvCF,KAAKD,uBAAyBA,CAClC,CAMAI,eAAeC,GACX,OAAOJ,KAAKK,oBAAoBL,KAAKM,sBAAsBF,GAAiB,CAAC,GAAIA,EACrF,CAIAG,yBAAyBH,GACrB,MAAMI,EAAcR,KAAKG,eAAeC,GACxC,OAAII,EAAYC,OAAS,EAEED,EAAYE,MAAMC,GAC9BA,EAAQC,eAAiB,EAAI,IAElB,GAEM,IAAvBJ,EAAYC,OAEVD,EAAY,GAGZ,IAEf,CAMAK,mBAAmBT,GACf,MAAMU,EAAkBd,KAAKM,sBAAsBF,GACnD,OAAIU,EAAgBL,OAAS,EAClBK,EAAgB,GAAGC,iBAGnB,IAEf,CAQAV,oBAAoBW,EAAgBZ,GAChC,OAAOY,EAAeC,SAASC,GACpBlB,KAAKmB,mCAAmCD,EAAed,GAAegB,SAAUhB,IAE/F,CACAiB,+BAA+BC,EAAaC,EAAWC,EAAeC,GAClE,IACIb,EADAc,EAAsB,KAE1B,GAAID,IACKzB,KAAK2B,2BAA2BH,EAAeC,GAChD,OAAO,KAGf,MAAMG,EAAU5B,KAAK6B,WAAWP,EAAaC,EAAWC,EAAcJ,UACtE,OAAIQ,IACAhB,GAAgB,QAAmBgB,EAAQE,OAAQ9B,KAAKH,WAAWkC,eAC9D/B,KAAKgC,sCAAsCpB,EAAea,IAEpD,MAIfC,GAAsB,QAA+BJ,EAAaE,EAAeZ,EAAegB,GAASE,QAClGJ,EACX,CACAP,mCAAmCD,EAAee,EAAgBR,GAC9D,MAAMH,EAAcJ,EAAcH,iBAClC,IAAImB,EAAuBZ,EAAYa,gBAAkB,IAAIC,IAC7D,MAAMb,EAAYvB,KAAKqC,eAEvB,GAAIJ,EAAgB,CAChB,MAAMT,EAAgBU,EAAqBI,IAAIL,GAC/C,IAAIT,EAQA,MAAO,GANPU,EAAuB,IAAIE,IAAI,CAC3B,CAACH,EAAgBT,IAO7B,CACA,MAAMe,EAAyB,GAO/B,OANAL,EAAqBM,SAAShB,IAC1B,MAAME,EAAsB1B,KAAKqB,+BAA+BC,EAAaC,EAAWC,EAAeC,GACnGC,GACAa,EAAuBE,KAAKf,EAChC,IAEGa,CACX,CACAZ,2BAA2BH,EAAeC,GACtC,QAAMA,EAAoBiB,iBACrB1C,KAAK2C,qCAAqCnB,EAAeC,EAAoBiB,iBAG5EjB,EAAoBmB,MACpBpB,EAAcoB,OAASnB,EAAoBmB,WAGRC,IAArCpB,EAAoBqB,cAClBtB,EAAcsB,eAAiBrB,EAAoBqB,aAI7D,CACAd,sCAAsCpB,EAAea,GAEjD,GAAIA,EAAqB,CACrB,GAAMA,EAAoBiB,iBACrB1C,KAAK+C,mCAAmCnC,EAAea,EAAoBiB,gBAC5E,OAAO,EAEX,GAAMjB,EAAoBuB,YACrBhD,KAAKiD,8BAA8BrC,EAAea,EAAoBuB,WACvE,OAAO,EAEX,GAAMvB,EAAoByB,WACrBlD,KAAKmD,cAAcvC,EAAcwC,mBAAoB3B,EAAoByB,UAC1E,OAAO,EAEX,GAAMzB,EAAoBmB,OACrB5C,KAAKqD,UAAUzC,EAAea,EAAoBmB,MACnD,OAAO,EAEX,GAAMnB,EAAoB6B,MACrBtD,KAAKuD,SAAS3C,EAAea,EAAoB6B,KAClD,OAAO,CAEf,CACA,OAAO,CACX,CAOAE,sBAAsBC,EAAaC,EAAcC,GAC7C,IAAKF,EACD,MAAM,QAAsB,MAEhC,IACUA,EAAY9C,SACdX,KAAK4D,WAAWH,EAAY9C,SAE1B8C,EAAY7B,UAAqC,IAA1B8B,GAAc9B,SACvC5B,KAAK6D,qBAAqBJ,EAAY7B,SAEpC6B,EAAYK,cACgB,IAA9BJ,GAAcI,mBACR9D,KAAK+D,gBAAgBN,EAAYK,aAErCL,EAAYO,eACiB,IAA/BN,GAAcM,cACdhE,KAAKiE,0BAA0BR,EAAYO,cAEzCP,EAAYS,aACdlE,KAAKmE,eAAeV,EAAYS,YAExC,CACA,MAAOE,GAEH,MADApE,KAAKC,cAAcoE,MAAM,wCACrBD,aAAaE,OACbtE,KAAKC,cAAcsE,SAAS,iCAAiCH,EAAEI,UAAWb,GAC3D,uBAAXS,EAAExB,MACS,+BAAXwB,EAAExB,MACFwB,EAAEI,QAAQC,SAAS,uBACnBzE,KAAKC,cAAcoE,MAAM,uDAAwDV,GAC3E,IAAI,KAAW,MAGf,IAAI,KAAWS,EAAExB,KAAMwB,EAAEI,WAInCxE,KAAKC,cAAcsE,SAAS,iCAAiCH,IAAKT,GAC5D,IAAI,KAAW,KAE7B,CACJ,CAKAH,sBAAsBkB,GAClB,MAAMC,EAAoB,CACtB/E,SAAU8E,EAAW9E,SACrBgF,eAAgBF,EAAWE,eAC3BC,YAAaH,EAAWG,YACxBC,cAAeJ,EAAWI,cAC1BC,MAAOL,EAAWK,MAClBC,UAAWN,EAAWM,UACtBC,oBAAqBP,EAAWO,qBAE9B1D,EAAYvB,KAAKqC,eACjB6C,EAAgB,eAAoBR,EAAWS,QAC/CC,EAAsB,GAC5B7D,EAAUuC,YAAYtB,SAAS6C,IAC3B,IAAKrF,KAAKsF,4BAA4BD,EAAKV,GAAmB,GAC1D,OAEJ,MAAMY,EAAcvF,KAAKwF,yBAAyBH,GAC9CE,GACAvF,KAAKyF,wBAAwBF,EAAaZ,IACpB,eAAoBY,EAAYJ,QACpCO,sBAAsBR,IACpCE,EAAoB3C,KAAKzC,KAAK2F,kBAAkBN,GAExD,UAEEO,QAAQC,IAAIT,GAClBpF,KAAK8F,yBAAyBpB,EAClC,CAMApE,sBAAsBF,GAClB,MAAM2F,EAAiB/F,KAAKgG,iBACtBC,EAAmB,GAiDzB,OAhDAF,EAAevD,SAAS0D,IACpB,IAAKlG,KAAKmG,aAAaD,EAAU9F,EAAc0E,eAE3C,OAEJ,MAAMsB,EAASpG,KAAKqG,WAAWH,EAAUlG,KAAKC,cAE9C,IAAKmG,EACD,OAEJ,GAAMhG,EAAc0E,gBACf9E,KAAKsG,mBAAmBF,EAAQhG,EAAc0E,eAC/C,OAEJ,GAAM1E,EAAc8C,WACflD,KAAKmD,cAAciD,EAAOlD,SAAU9C,EAAc8C,UACnD,OAEJ,GAAM9C,EAAcyE,cACf7E,KAAKuG,iBAAiBH,EAAQhG,EAAcyE,aAC7C,OAEJ,GAAMzE,EAAc2E,QACf/E,KAAKwG,WAAWJ,EAAQhG,EAAc2E,OACvC,OAEJ,GAAM3E,EAAcqG,kBACfzG,KAAK0G,qBAAqBN,EAAQhG,EAAcqG,iBACjD,OAEJ,GAAMrG,EAAcuG,gBACf3G,KAAK4G,mBAAmBR,EAAQhG,EAAcuG,eAC/C,OAGJ,MAAMlF,EAAsB,CACxBiB,eAAgBtC,GAAesC,eAC/BE,KAAMxC,GAAewC,MAEnBL,EAAyB6D,EAAOjE,gBAAgB0E,QAAQrF,GACnDxB,KAAK2B,2BAA2BH,EAAeC,KAEtDc,GAA4D,IAAlCA,EAAuB9B,QAIrDwF,EAAiBxD,KAAK2D,EAAO,IAE1BH,CACX,CAQAE,aAAad,EAAKP,EAAe1D,GAC7B,QAAIiE,EAAIyB,MAAM,0BAAgCrG,OAAS,GAInDqE,IACCO,EAAI0B,cAActC,SAASK,EAAciC,gBAG1C3F,IAAaiE,EAAI0B,cAActC,SAASrD,EAAS2F,eAKzD,CAKAC,gBAAgB3B,GACZ,GAAIA,EAAIyB,MAAM,0BAAgCrG,OAAS,EAEnD,OAAO,EAEX,MAAMwG,EAAe5B,EAAI0B,cAEzB,IACK,IADDE,EAAaC,QAAQ,+BAGhB,IADLD,EAAaC,QAAQ,mCAEiE,IAAtFD,EAAaC,QAAQ,oDAEhB,IADLD,EAAaC,QAAQ,kCAErB,OAAO,EAEX,GAAID,EAAaC,QAAQ,mCACpB,EAAG,CAEJ,MAAMC,EAAqB,GAAG,qBAA+B,2BAAiCnH,KAAKJ,WAAW,2BACxGwH,EAAqB,GAAG,qBAA+B,2BAAiC,OAAgB,2BAC9G,IAAgE,IAA5DH,EAAaC,QAAQC,EAAmBJ,iBACoB,IAA5DE,EAAaC,QAAQE,EAAmBL,eACxC,OAAO,CAEf,MACK,IAA2D,IAAvDE,EAAaC,QAAQlH,KAAKJ,SAASmH,eAExC,OAAO,EAEX,OAAO,CACX,CAOAtB,wBAAwBW,EAAQS,GAC5B,GAAMA,EAAOjH,WAAaI,KAAKqH,cAAcjB,EAAQS,EAAOjH,UACxD,OAAO,EAEX,GAAMiH,EAAOS,oBACRtH,KAAKuH,uBAAuBnB,EAAQS,EAAOS,mBAC5C,OAAO,EAMX,GAAoC,iBAAzBT,EAAO/B,gBACb9E,KAAKsG,mBAAmBF,EAAQS,EAAO/B,eACxC,OAAO,EAEX,GAAM+B,EAAOhC,cACR7E,KAAKuG,iBAAiBH,EAAQS,EAAOhC,aACtC,OAAO,EAEX,GAAMgC,EAAO9B,QAAU/E,KAAKwG,WAAWJ,EAAQS,EAAO9B,OAClD,OAAO,EAEX,GAAM8B,EAAOjC,iBACR5E,KAAKwH,oBAAoBpB,EAAQS,EAAOjC,gBACzC,OAAO,EAEX,GAAMiC,EAAOY,WAAazH,KAAK0H,cAActB,EAAQS,EAAOY,UACxD,OAAO,EAMX,GAAMZ,EAAO1B,SAAWnF,KAAK2H,YAAYvB,EAAQS,EAAO1B,QACpD,OAAO,EAGX,IAAI0B,EAAO5B,qBAAuBmB,EAAOnB,sBAEjCmB,EAAOnB,sBAAwB4B,EAAO5B,oBACtC,OAAO,EAIf,GAAImB,EAAOxB,iBACP,mCAA8C,CAC9C,GAAMiC,EAAO7B,YACRhF,KAAK4H,eAAexB,EAAQS,EAAO7B,WACpC,OAAO,EAGX,GAAI6B,EAAO7B,YAAc,UACjB6B,EAAOgB,QAAU7H,KAAK8H,WAAW1B,EAAQS,EAAOgB,OAChD,OAAO,CAGnB,CACA,OAAO,CACX,CAKAE,yBAAyBlB,GACrB,MAAMmB,EAAehI,KAAKiI,UACpBC,EAAsB,CAAC,EAqB7B,OApBAF,EAAaxF,SAAS0D,IAElB,IAAKlG,KAAKmI,cAAcjC,GACpB,OAGJ,MAAME,EAASpG,KAAKoI,eAAelC,GAC9BE,IAGCS,EAAOhC,cACR7E,KAAKuG,iBAAiBH,EAAQS,EAAOhC,cAGpCgC,EAAOjH,WACRI,KAAKqH,cAAcjB,EAAQS,EAAOjH,YAGvCsI,EAAoBhC,GAAYE,GAAM,IAEnC8B,CACX,CAKAG,4BAA4BC,GACxB,MAAMN,EAAehI,KAAKuI,2BAC1B,IAAIC,EAAgB,KAiBpB,OAhBAR,EAAaxF,SAAS0D,IAElB,IAAKlG,KAAKyI,oBAAoBvC,KACW,IAArCA,EAASgB,QAAQlH,KAAKJ,UACtB,OAGJ,MAAMwG,EAASpG,KAAK0I,qBAAqBxC,GACpCE,IAGiC,IAAlCA,EAAOuC,QAAQzB,QAAQoB,KAG3BE,EAAgBpC,EAAM,IAEnBoC,CACX,CAIAhF,0BACI,MAAMuC,EAAiB/F,KAAKgG,iBACtB4C,EAAkB,GACxB7C,EAAevD,SAAS0D,IACpB0C,EAAgBnG,KAAKzC,KAAK6I,cAAc3C,GAAU,UAEhDN,QAAQC,IAAI+C,EACtB,CAKApF,oBAAoBsF,GAChB,MAAMnI,EAAUX,KAAKqG,WAAWyC,EAAY9I,KAAKC,cAC5CU,UAGCX,KAAK+I,qBAAqBpI,GAChCX,KAAKgJ,WAAWF,GACpB,CAKAtF,2BAA2B7C,GACvB,MAAMsI,EAAejJ,KAAKqC,eACpB6G,EAAYvI,EAAQwI,oBACpBC,EAAqB,GAC3BH,EAAarH,QAAQY,SAAS6C,IACK,IAA3BA,EAAI6B,QAAQgC,IACZlJ,KAAKqJ,cAAchE,EACvB,IAEJ4D,EAAanF,YAAYtB,SAAS6C,IACC,IAA3BA,EAAI6B,QAAQgC,IACZE,EAAmB3G,KAAKzC,KAAK2F,kBAAkBN,GACnD,IAEJ4D,EAAajF,aAAaxB,SAAS6C,IACA,IAA3BA,EAAI6B,QAAQgC,IACZlJ,KAAKsJ,mBAAmBjE,EAC5B,UAEEO,QAAQC,IAAIuD,EACtB,CASAG,4BAA4BT,EAAY5H,EAAepB,GAEnD,GAAIoB,GAAiBA,EAAcsI,iBAAkB,CACjDxJ,KAAKC,cAAcwJ,QAAQ,uIAE3B,MAAMC,EAAsB1J,KAAKgG,iBAAiBa,QAAQxB,GAC/CA,EAAIsE,WAAWzI,EAAc4D,iBAGlC8E,EAAkB,GACxBF,EAAoBlH,SAAS6C,IACzB,MAAM1E,EAAUX,KAAK6J,uBAAuBxE,GACxC1E,GACAiJ,EAAgBnH,KAAK9B,EACzB,IAGJ,MAAMmJ,EAAcF,EAAgBG,MAAMpJ,IAC/B,QAA0BA,EAAQoE,MAAOpE,EAAQmE,kBACtD8E,EAAgB,GAEtBE,EAAY3H,eAAiByH,EAAgBI,KAAKrJ,IACvC,CACHS,SAAUT,EAAQoE,MAClBrC,eAAgB/B,EAAQ+B,eACxBE,KAAMjC,EAAQiC,KACdE,cAAc,QAA0BnC,EAAQoE,MAAOpE,EAAQmE,mBAGvE,MAAMmF,EAAiBvK,EAAawK,SAAS,IAAI,IAAiB,IAC3DJ,IAEDK,EAAgBF,EAAeG,qBAUrC,OARAV,EAAoBlH,SAAS6C,IACrBA,IAAQ8E,GACRnK,KAAKqK,sBAAsBvB,EAC/B,IAGJ9I,KAAK4D,WAAWqG,GAChBnK,GAAQ2J,QAAQ,mDACTQ,CACX,CAEA,OAAO/I,CACX,CAKAsC,wBAAwB6B,GACpB,MAAMX,EAAa1E,KAAKwF,yBAAyBH,GACjD,GAAKX,EAAL,CAIA,GAAIA,EAAWE,eAAemC,gBAC1B,kDACIrC,EAAWM,YAAc,SAA0B,CACnD,MACMsF,EADkC5F,EACImD,MAC5C,GAAIyC,EACA,UACUtK,KAAKH,WAAW0K,sBAAsBD,EAChD,CACA,MAAOjG,GACH,MAAM,QAAsB,KAChC,CAER,CAEJ,OAAOrE,KAAKgJ,WAAW3D,EAjBvB,CAkBJ,CAIAmF,oBAOI,OANqBxK,KAAKiI,UACbzF,SAAS0D,IACdlG,KAAKmI,cAAcjC,IACnBlG,KAAKgJ,WAAW9C,EACpB,KAEG,CACX,CAKAuE,qBAAqB9J,GACjB,MAAMmI,EAAa,4BAAsCnI,GACzD,OAAOX,KAAKqG,WAAWyC,EAAY9I,KAAKC,aAC5C,CASA4B,WAAWlB,EAASY,EAAWmJ,EAAaC,EAAmBhH,GAC3D3D,KAAKC,aAAa2K,MAAM,oCACxB,MAAMC,EAAgB,CAClB/F,cAAenE,EAAQmE,cACvBD,YAAalE,EAAQkE,YACrBD,eAAgB,cAChBhF,SAAUI,KAAKJ,SACfmF,MAAO2F,GAELI,EAAa9K,KAAK+K,oBAAoBF,EAAetJ,GACrDyJ,EAAcF,EAAWG,KAC/B,GAAID,EAAc,EAEd,OADAhL,KAAKC,aAAaiL,KAAK,4CAChB,KAEN,GAAIF,EAAc,EAAG,CACtB,IAAIG,EAAoBL,EAExB,IAAKJ,EAAa,CACd,MAAMU,EAAiB,IAAIhJ,IAC3B0I,EAAWtI,SAAQ,CAACZ,EAASyD,KACrBzD,EAAQmD,QAAUpE,EAAQS,UAC1BgK,EAAeC,IAAIhG,EAAKzD,EAC5B,IAEJ,MAAM0J,EAAkBF,EAAeH,KACvC,GAAIK,EAAkB,EAElB,OADAtL,KAAKC,aAAaiL,KAAK,kIAChBJ,EAAWS,SAASC,OAAOC,MAEjC,GAAwB,IAApBH,EAEL,OADAtL,KAAKC,aAAaiL,KAAK,qGAChBE,EAAeG,SAASC,OAAOC,MAItCN,EAAoBC,CAE5B,CASA,OAPApL,KAAKC,aAAaiL,KAAK,8EACvBC,EAAkB3I,SAAQ,CAACZ,EAASyD,KAChCrF,KAAKqJ,cAAchE,EAAI,IAEvBsF,GAAqBhH,GACrBgH,EAAkBe,UAAU,CAAEC,eAAgBb,EAAWG,MAAQtH,GAE9D,IACX,CAEA,OADA3D,KAAKC,aAAaiL,KAAK,gDAChBJ,EAAWS,SAASC,OAAOC,KACtC,CAMAV,oBAAoBlE,EAAQtF,GACxB,MAAMqK,EAAerK,GAAaA,EAAUK,SAAY5B,KAAKqC,eAAeT,QACtEiK,EAAW,IAAIzJ,IAarB,OAZAwJ,EAAYpJ,SAAS6C,IACjB,IAAKrF,KAAK8L,wBAAwBzG,EAAK,CACnCzF,SAAUI,KAAKJ,YACZiH,IAEH,OAEJ,MAAMjF,EAAU5B,KAAK+L,qBAAqB1G,GACtCzD,GAAW5B,KAAKyF,wBAAwB7D,EAASiF,IACjDgF,EAASR,IAAIhG,EAAKzD,EACtB,IAEGiK,CACX,CAOAC,wBAAwBE,EAAUnF,GAC9B,MAAMxB,EAAM2G,EAASjF,cACrB,QAAIF,EAAOjH,WACyC,IAAhDyF,EAAI6B,QAAQL,EAAOjH,SAASmH,gBAG5BF,EAAO/B,gBAC8C,IAArDO,EAAI6B,QAAQL,EAAO/B,cAAciC,eAIzC,CAKAsC,cAAchE,GACVrF,KAAKgJ,WAAW3D,EACpB,CAKAiE,mBAAmBjE,GACfrF,KAAKgJ,WAAW3D,EACpB,CASA4G,eAAetL,EAASuL,EAAS3K,EAAWmJ,EAAaC,EAAmBhH,GACxE3D,KAAKC,aAAa2K,MAAM,wCACxB,MAAMuB,EAAS,uBAA4BD,EAAQC,QAC7CC,EAAaF,EAAQG,sBAAwB,YAK7CzH,EAAiBwH,GACnBA,EAAWrF,gBACP,0BACF,mCACA,kBACApC,EAAoB,CACtBG,cAAenE,EAAQmE,cACvBD,YAAalE,EAAQkE,YACrBD,eAAgBA,EAChBhF,SAAUI,KAAKJ,SACfmF,MAAO2F,GAAe/J,EAAQS,SAC9B+D,OAAQgH,EACRnH,UAAWoH,EACXvE,MAAOqE,EAAQI,OACfrH,oBAAqBiH,EAAQjH,qBAE3BsH,EAAmBhL,GAAaA,EAAUuC,aAC5C9D,KAAKqC,eAAeyB,YAClB0I,EAAe,GACrBD,EAAgB/J,SAAS6C,IAErB,GAAIrF,KAAKsF,4BAA4BD,EAAKV,GAAmB,GAAO,CAChE,MAAMb,EAAc9D,KAAKwF,yBAAyBH,GAE9CvB,GACA9D,KAAKyF,wBAAwB3B,EAAaa,IAC1C6H,EAAa/J,KAAKqB,EAE1B,KAEJ,MAAM2I,EAAkBD,EAAa/L,OACrC,OAAIgM,EAAkB,GAClBzM,KAAKC,aAAaiL,KAAK,gDAChB,MAEFuB,EAAkB,GACvBzM,KAAKC,aAAaiL,KAAK,6EACvBsB,EAAahK,SAASsB,IACb9D,KAAK2F,mBAAkB,QAAsB7B,GAAa,IAE/D6G,GAAqBhH,GACrBgH,EAAkBe,UAAU,CAAEgB,eAAgBF,EAAa/L,QAAUkD,GAElE,OAEX3D,KAAKC,aAAaiL,KAAK,wDAChBsB,EAAa,GACxB,CAQAlH,4BAA4B0G,EAAUnF,EAAQ8F,GAC1C,MAAMtH,EAAM2G,EAASjF,cACrB,GAAIF,EAAOjH,WACyC,IAAhDyF,EAAI6B,QAAQL,EAAOjH,SAASmH,eAC5B,OAAO,EAEX,GAAIF,EAAO/B,gBAC8C,IAArDO,EAAI6B,QAAQL,EAAO/B,cAAciC,eACjC,OAAO,EAEX,GAAIF,EAAO9B,QAAsD,IAA7CM,EAAI6B,QAAQL,EAAO9B,MAAMgC,eACzC,OAAO,EAEX,GAAIF,EAAO5B,sBACoD,IAA3DI,EAAI6B,QAAQL,EAAO5B,oBAAoB8B,eACvC,OAAO,EAEX,GAAIF,EAAO1B,OAAQ,CACf,MAAMgH,EAAStF,EAAO1B,OAAOyH,UAC7B,IAAK,IAAIC,EAAI,EAAGA,EAAIV,EAAO1L,OAAQoM,IAAK,CACpC,GAAIF,IACCtH,EAAIZ,SAAS0H,EAAOU,GAAG9F,eAExB,OAAO,EAEN,IAAK4F,GACNtH,EAAIZ,SAAS0H,EAAOU,GAAG9F,eAEvB,OAAO,CAEf,CACJ,CACA,OAAO,CACX,CAMA+F,wBAAwBjG,GACpB,MAAMtF,EAAYvB,KAAKqC,eACjBmK,EAAe,GAWrB,OAVAjL,EAAUuC,YAAYtB,SAAS6C,IAC3B,IAAKrF,KAAKsF,4BAA4BD,EAAKwB,GAAQ,GAC/C,OAEJ,MAAM/C,EAAc9D,KAAKwF,yBAAyBH,GAC9CvB,GACA9D,KAAKyF,wBAAwB3B,EAAa+C,IAC1C2F,EAAa/J,KAAKqB,EACtB,IAEG0I,CACX,CASAO,gBAAgBpM,EAASqM,EAAUzL,EAAWoJ,EAAmBhH,GAC7D3D,KAAKC,aAAa2K,MAAM,yCACxB,MAAMqC,EAAKD,EAAW,UAAgBnK,EAChCqK,EAAqB,CACvBpI,cAAenE,EAAQmE,cACvBD,YAAalE,EAAQkE,YACrBD,eAAgB,mBAChBhF,SAAUI,KAAKJ,SACf6H,SAAUwF,GAERE,EAAoB5L,GAAaA,EAAUyC,cAC7ChE,KAAKqC,eAAe2B,aAClBoJ,EAAgB,GACtBD,EAAiB3K,SAAS6C,IAEtB,GAAIrF,KAAKqN,6BAA6BhI,EAAK6H,GAAqB,CAC5D,MAAMlJ,EAAehE,KAAKsN,0BAA0BjI,GAEhDrB,GACAhE,KAAKyF,wBAAwBzB,EAAckJ,IAC3CE,EAAc3K,KAAKuB,EAE3B,KAEJ,MAAMuJ,EAAmBH,EAAc3M,OACvC,OAAI8M,EAAmB,GACnBvN,KAAKC,aAAaiL,KAAK,0DAChB,OAGPqC,EAAmB,GAAK5C,GAAqBhH,GAC7CgH,EAAkBe,UAAU,CAAE8B,eAAgBD,GAAoB5J,GAEtE3D,KAAKC,aAAaiL,KAAK,0DAChBkC,EAAc,GACzB,CAMAC,6BAA6BrB,EAAUnF,GACnC,MAAMxB,EAAM2G,EAASjF,cACrB,QAAIF,EAAOY,WACyC,IAAhDpC,EAAI6B,QAAQL,EAAOY,SAASV,iBAI3BF,EAAOY,UACRZ,EAAOjH,WACyC,IAAhDyF,EAAI6B,QAAQL,EAAOjH,SAASmH,gBAG5BF,EAAO/B,gBAC8C,IAArDO,EAAI6B,QAAQL,EAAO/B,cAAciC,eAIzC,CAIA0G,yBAAyB5I,GACrB,MAAM6I,EAAoB,CACtB7I,cACAjF,SAAUI,KAAKJ,UAEbsE,EAAclE,KAAK+H,yBAAyB2F,GAC5CC,EAAqBC,OAAOC,KAAK3J,GAAa8F,KAAK3E,GAAQnB,EAAYmB,KACvEyI,EAAiBH,EAAmBlN,OAC1C,GAAIqN,EAAiB,EACjB,OAAO,KAEN,GAAIA,EAAiB,EACtB,MAAM,QAAsB,MAEhC,OAAOH,EAAmB,EAC9B,CAMAI,kBAAkBlJ,GACd,MAAMX,EAAclE,KAAKyN,yBAAyB5I,GAClD,SAAUX,GAAeA,EAAYuD,WAAa,KACtD,CAMAnB,mBAAmBF,EAAQtB,GACvB,QAA0C,iBAAzBsB,EAAOtB,eACpBA,IAAkBsB,EAAOtB,cACjC,CAOA/B,mCAAmCiL,EAAatL,GAE5C,OAAOA,KADuBsL,EAAYC,KAAOD,EAAYE,IAEjE,CACAvL,qCAAqCnB,EAAekB,GAChD,OAAOlB,EAAckB,iBAAmBA,CAC5C,CAOAW,UAAU8K,EAAQvL,GACd,QAAUA,EAAKmE,gBAAkBoH,EAAOvL,MAAMmE,cAClD,CAOA5D,cAAciL,EAAgBC,GAC1B,SAAUD,GACoB,iBAAnBA,GACPC,GAAgBtH,gBAAkBqH,EAAerH,cACzD,CAMAQ,uBAAuBnB,EAAQkB,GAC3B,SAAUlB,EAAOkB,mBACbA,IAAsBlB,EAAOkB,kBACrC,CAMAf,iBAAiBH,EAAQvB,GAErB,GAAI7E,KAAKD,uBAAwB,CAC7B,MAAMuO,GAAgB,QAA4BtO,KAAKD,uBAAwBC,KAAKC,cACpF,GAAIqO,EAAc7J,SAASI,IACvByJ,EAAc7J,SAAS2B,EAAOvB,aAC9B,OAAO,CAEf,CAEA,MAAM0J,EAAgBvO,KAAKqI,4BAA4BxD,GACvD,SAAI0J,GACAA,EAAc5F,QAAQzB,QAAQd,EAAOvB,cAAgB,EAI7D,CAMA2C,oBAAoBpB,EAAQxB,GACxB,OAAQwB,EAAOxB,gBACXA,EAAemC,gBAAkBX,EAAOxB,eAAemC,aAC/D,CAMAM,cAAcjB,EAAQxG,GAClB,SAAUwG,EAAOxG,UAAYA,IAAawG,EAAOxG,SACrD,CAMA8H,cAActB,EAAQqB,GAClB,SAAUrB,EAAOqB,UAAYA,IAAarB,EAAOqB,SACrD,CAMAjB,WAAWJ,EAAQrB,GACf,QAAUqB,EAAOrB,OAAOgC,gBAAkBhC,EAAMgC,cACpD,CAOAL,qBAAqBN,EAAQK,GACzB,SAAUL,EAAOK,iBAAmBA,IAAoBL,EAAOK,gBACnE,CAUAxD,8BAA8B+K,EAAahL,GACvC,OAAIgL,EAAYQ,aAAexL,GAG3BgL,EAAY5K,qBAAuBJ,GAGnCgL,EAAYS,MAAQzL,CAI5B,CAOAO,SAAS3C,EAAe0C,GACpB,OAAO1C,EAAc0C,MAAQA,CACjC,CACAsD,mBAAmBR,EAAQO,GACvB,SAAUP,EAAOO,eACbA,EAAcI,gBAAkBX,EAAOO,cAAcI,cAC7D,CAMAY,YAAYvB,EAAQjB,GAIhB,QAHmCiB,EAAOxB,iBAAmB,mBACzDwB,EAAOxB,iBACH,qCAC2BwB,EAAOjB,SAGnB,eAAoBiB,EAAOjB,QAC5BuJ,iBAAiBvJ,EAC3C,CAMAyC,eAAexB,EAAQpB,GACnB,SAAUoB,EAAOpB,WAAaoB,EAAOpB,YAAcA,EACvD,CAMA8C,WAAW1B,EAAQyB,GACf,SAAUzB,EAAOyB,OAASzB,EAAOyB,QAAUA,EAC/C,CAKAM,cAAc9C,GACV,OAAsC,IAA/BA,EAAI6B,QAAQ,KACvB,CAKAuB,oBAAoBpD,GAChB,OAAgE,IAAzDA,EAAI6B,QAAQ,eACvB,CAIAyH,kCAAkCC,GAC9B,MAAO,GAAG,kBAA0C5O,KAAKJ,YAAYgP,GACzE,CAMAC,gBAAgBC,EAAKC,GACjB,IAAK,MAAMC,KAAgBD,EACvBD,EAAIE,GAAgBD,EAAKC,GAE7B,OAAOF,CACX,EAGJ,MAAMG,UAA4BvP,EAC9BkE,aACI,MAAM,QAAsB,KAChC,CACAyC,aACI,MAAM,QAAsB,KAChC,CACAwD,yBACI,MAAM,QAAsB,KAChC,CACAhG,uBACI,MAAM,QAAsB,KAChC,CACAkI,uBACI,MAAM,QAAsB,KAChC,CACAjG,2BACI,MAAM,QAAsB,KAChC,CACAN,2BACI,MAAM,QAAsB,KAChC,CACAvB,4BACI,MAAM,QAAsB,KAChC,CACAqJ,4BACI,MAAM,QAAsB,KAChC,CACAnJ,iBACI,MAAM,QAAsB,KAChC,CACAiE,iBACI,MAAM,QAAsB,KAChC,CACA8G,qBACI,MAAM,QAAsB,KAChC,CACAC,qBACI,MAAM,QAAsB,KAChC,CACAC,uBACI,MAAM,QAAsB,KAChC,CACA1G,uBACI,MAAM,QAAsB,KAChC,CACAH,2BACI,MAAM,QAAsB,KAChC,CACA8G,qBACI,MAAM,QAAsB,KAChC,CACAC,qBACI,MAAM,QAAsB,KAChC,CACAtG,aACI,MAAM,QAAsB,KAChC,CACAf,UACI,MAAM,QAAsB,KAChC,CACAjC,iBACI,MAAM,QAAsB,KAChC,CACA3D,eACI,MAAM,QAAsB,KAChC,CACAmB,cACI,MAAM,QAAsB,KAChC,CACA+L,2BACI,MAAM,QAAsB,KAChC,CACAlF,wBACI,MAAM,QAAsB,KAChC,qJCxsCJ,MAAMmF,EAIFrG,oBAEI,MADkB,CAACnJ,KAAK8E,cAAe9E,KAAK6E,aAC3B4K,KAAK,0BAAgC1I,aAC1D,CAIAqD,qBACI,OAAOoF,EAAcE,wBAAwB,CACzC5K,cAAe9E,KAAK8E,cACpBD,YAAa7E,KAAK6E,YAClBzD,SAAUpB,KAAK+E,MACf7B,SAAUlD,KAAKkD,SACfR,eAAgB1C,KAAK0C,gBAE7B,CAIA3B,iBACI,MAAO,CACH+D,cAAe9E,KAAK8E,cACpBD,YAAa7E,KAAK6E,YAClBzD,SAAUpB,KAAK+E,MACf7B,SAAUlD,KAAKkD,SACfR,eAAgB1C,KAAK0C,eACrBE,KAAM5C,KAAK4C,KACX6D,gBAAiBzG,KAAKyG,gBACtBE,cAAe3G,KAAK2G,cAEpBxE,eAAgB,IAAIC,KAAKpC,KAAKmC,gBAAkB,IAAI6H,KAAKxI,GAC9C,CAACA,EAAcJ,SAAUI,MAG5C,CAIAgI,iBACI,OAAQxJ,KAAKmC,cACjB,CAKA0M,+BAA+Bc,GAC3B,MAAMC,EAAeD,EAAiB7K,cAAcgC,MAAM,KAAK,GAM/D,MALmB,CACf6I,EAAiB7K,cACjB6K,EAAiB9K,aAAe,GAChC+K,GAAgBD,EAAiBvO,UAAY,IAE/BqO,KAAK,0BAAgC1I,aAC3D,CAKA8H,qBAAqBgB,EAAgBjB,EAAW7M,GAC5C,MAAMpB,EAAU,IAAI6O,EAUpB,IAAIM,EATAlB,EAAUjI,gBAAkB,SAC5BhG,EAAQgG,cAAgB,uBAEnBiI,EAAUmB,eAAiB,QAChCpP,EAAQgG,cAAgB,wBAGxBhG,EAAQgG,cAAgB,0BAGxBkJ,EAAeC,YAAc/N,IAC7B+N,GAAa,OAAgBD,EAAeC,WAAY/N,IAE5DpB,EAAQmP,WAAaD,EAAeC,WACpCnP,EAAQmE,cAAgB+K,EAAe/K,cACvCnE,EAAQ8F,gBAAkBoJ,EAAepJ,gBACzC,MAAMuJ,EAAMH,EAAehL,aACtB+J,GAAaA,EAAUqB,oBAC5B,IAAKD,EACD,MAAM,QAAsB,MAEhCrP,EAAQkE,YAAcmL,EAEtBrP,EAAQoE,MACJ+K,GAAYI,OACR,OAA6BL,EAAejP,gBAC5C,GAERD,EAAQ+B,eACJoN,GAAYK,KACRN,EAAejP,eAAeqN,KAC9B4B,EAAejP,eAAesN,KAC9B,GAMR,MAAMkC,EAAoBP,EAAejP,eAAewC,oBACpDyM,EAAejP,eAAe6N,IAC5B4B,EAAQR,EAAejP,eAAe0P,OACtCT,EAAejP,cAAc0P,OAAO,GACpC,KAKN,GAJA3P,EAAQuC,SAAWkN,GAAqBC,GAAS,GACjD1P,EAAQiC,KAAOiN,EAAejP,eAAegC,MAAQ,GACrDjC,EAAQ4P,mBAAqBV,EAAeU,mBAC5C5P,EAAQ6P,YAAcX,EAAeW,YACjCX,EAAe1N,eACfxB,EAAQwB,eAAiB0N,EAAe1N,mBAEvC,CACD,MAAMX,GAAgB,QAAmBqO,EAAe/K,cAAenE,EAAQ+B,eAAgB/B,EAAQoE,MAAO8K,EAAejP,eAC7HD,EAAQwB,eAAiB,CAACX,EAC9B,CACA,OAAOb,CACX,CAQAkO,6BAA6BvN,EAAaiP,EAAoBC,GAC1D,MAAM7P,EAAU,IAAI6O,EAcpB,OAbA7O,EAAQgG,cACJrF,EAAYqF,eAAiB,0BACjChG,EAAQmE,cAAgBxD,EAAYwD,cACpCnE,EAAQ+B,eAAiBpB,EAAYoB,eACrC/B,EAAQ8F,gBAAkBnF,EAAYmF,gBACtC9F,EAAQoE,MAAQzD,EAAYF,SAC5BT,EAAQkE,YAAcvD,EAAYuD,YAClClE,EAAQuC,SAAW5B,EAAY4B,SAC/BvC,EAAQiC,KAAOtB,EAAYsB,KAC3BjC,EAAQ4P,mBAAqBA,EAC7B5P,EAAQ6P,YAAcA,EAEtB7P,EAAQwB,eAAiBsO,MAAMC,KAAKpP,EAAYa,gBAAgBoJ,UAAY,IACrE5K,CACX,CAMAkO,6BAA6B8B,EAAkBC,EAAU9Q,EAAQ+Q,EAAWjQ,GAExE,GAAMgQ,IAAa,UACfA,IAAa,SAAqB,CAElC,GAAID,EACA,IACI,MAAMb,GAAa,OAAgBa,EAAkBE,EAAU9O,cAC/D,GAAI+N,EAAWK,KAAOL,EAAWI,KAC7B,MAAO,GAAGJ,EAAWK,OAAOL,EAAWI,MAE/C,CACA,MAAO9L,GAAK,CAEhBtE,EAAOgR,QAAQ,6BACnB,CAEA,OAAOlQ,GAAesN,KAAO,EACjC,CAKAW,uBAAuBzI,GACnB,QAAKA,GAGGA,EAAO2K,eAAe,kBAC1B3K,EAAO2K,eAAe,gBACtB3K,EAAO2K,eAAe,UACtB3K,EAAO2K,eAAe,mBACtB3K,EAAO2K,eAAe,aACtB3K,EAAO2K,eAAe,gBAC9B,CAOAlC,0BAA0BmC,EAAUC,EAAUC,GAC1C,IAAKF,IAAaC,EACd,OAAO,EAEX,IAAIE,GAAc,EAClB,GAAID,EAAe,CACf,MAAME,EAAkBJ,EAASpQ,eAC7B,CAAC,EACCyQ,EAAkBJ,EAASrQ,eAC7B,CAAC,EAELuQ,EACIC,EAAeE,MAAQD,EAAeC,KAClCF,EAAeG,QAAUF,EAAeE,KACpD,CACA,OAAQP,EAASlM,gBAAkBmM,EAASnM,eACxCkM,EAAStO,iBAAmBuO,EAASvO,gBACrCsO,EAAS9N,WAAa+N,EAAS/N,UAC/B8N,EAAS5P,WAAa6P,EAAS7P,UAC/B4P,EAASnM,cAAgBoM,EAASpM,aAClCmM,EAASvK,kBAAoBwK,EAASxK,iBACtC0K,CACR,0DChPA,MAAMK,EACN7R,YAAY8R,EAAYC,GACpB1R,KAAK2R,MAAQF,EACbzR,KAAK0R,WAAaA,CACtB,CAIIE,sBACA,OAAO5R,KAAK0R,UAChB,CAIID,iBACA,OAAOzR,KAAK2R,KAChB,8dCLJ,SAASE,EAAsBC,GAQ3B,MAPsB,CAClB3I,EAAkB2I,GAClBC,EAAqBD,GACrBE,EAAeF,GACfG,EAAmBH,GACnBI,EAAeJ,IAEErC,KAAK,0BAAgC1I,aAC9D,CAQA,SAASoL,EAAoBrN,EAAeD,EAAajD,EAAShC,EAAUwB,GASxE,MARsB,CAClBwD,eAAgB,cAChBE,cAAeA,EACfD,YAAaA,EACbjF,SAAUA,EACVkC,OAAQF,EACRmD,MAAO3D,EAGf,CAYA,SAASgR,EAAwBtN,EAAeD,EAAaf,EAAalE,EAAUwB,EAAU+K,EAAQkG,EAAWC,EAAcvQ,EAAcwQ,EAAWvN,EAAWsC,EAAmBO,EAAO2K,EAAiBvN,GAC1M,MAAMwN,EAAW,CACb3N,cAAeA,EACfF,eAAgB,kBAChB9C,OAAQgC,EACR4O,UAAU,UAAaC,WACvBN,UAAWA,EAAUM,WACrBC,kBAAmBN,EAAaK,WAChC9N,YAAaA,EACbjF,SAAUA,EACVmF,MAAO3D,EACP+D,OAAQgH,EACRnH,UAAWA,GAAa,aAgB5B,GAdIsC,IACAmL,EAASnL,kBAAoBA,GAE7BiL,IACAE,EAASF,UAAYA,EAAUI,YAE/BH,IACAC,EAASD,gBAAkBA,EAC3BC,EAASxN,oBAAsBA,GAM/BwN,EAASzN,WAAW+B,gBACpB,0BAEA,OADA0L,EAAS7N,eAAiB,mCAClB6N,EAASzN,WACb,KAAK,SAED,MAAMgJ,GAAc,QAAmBlK,EAAa/B,GACpD,IAAKiM,GAAa6E,KAAKvI,IACnB,MAAM,QAAsB,MAEhCmI,EAAS5K,MAAQmG,EAAY6E,IAAIvI,IACjC,MACJ,KAAK,SACDmI,EAAS5K,MAAQA,EAG7B,OAAO4K,CACX,CAQA,SAASK,EAAyBhO,EAAeD,EAAab,EAAcpE,EAAU6H,EAAUH,EAAmB+K,GAC/G,MAAMU,EAAW,CACbnO,eAAgB,mBAChBE,cAAeA,EACfD,YAAaA,EACbjF,SAAUA,EACVkC,OAAQkC,GAWZ,OATIsD,IACAyL,EAASzL,kBAAoBA,GAE7BG,IACAsL,EAAStL,SAAWA,GAEpB4K,IACAU,EAASV,UAAYA,EAAUM,YAE5BI,CACX,CACA,SAASC,EAAmB5M,GACxB,OAAQA,EAAO2K,eAAe,kBAC1B3K,EAAO2K,eAAe,gBACtB3K,EAAO2K,eAAe,mBACtB3K,EAAO2K,eAAe,aACtB3K,EAAO2K,eAAe,SAC9B,CAKA,SAASkC,EAAoB7M,GACzB,QAAKA,GAGG4M,EAAmB5M,IACvBA,EAAO2K,eAAe,UACtB3K,EAAO2K,eAAe,YACrB3K,EAAuB,iBAAM,mBAC1BA,EAAuB,iBACnB,mCAChB,CAKA,SAAS8M,EAAgB9M,GACrB,QAAKA,GAGG4M,EAAmB5M,IACvBA,EAAO2K,eAAe,UACtB3K,EAAuB,iBAAM,aACrC,CAKA,SAAS+M,EAAqB/M,GAC1B,QAAKA,GAGG4M,EAAmB5M,IACvBA,EAAuB,iBAAM,kBACrC,CAIA,SAAS+C,EAAkB2I,GAKvB,MAJkB,CACdA,EAAiBhN,cACjBgN,EAAiBjN,aAEJ4K,KAAK,0BAAgC1I,aAC1D,CAIA,SAASgL,EAAqBD,GAC1B,MAAMsB,EAAmBtB,EAAiBlN,iBAAmB,oBACvDkN,EAAiBrK,UACjBqK,EAAiBlS,SAMvB,MALqB,CACjBkS,EAAiBlN,eACjBwO,EACAtB,EAAiB/M,OAAS,IAEV0K,KAAK,0BAAgC1I,aAC7D,CAIA,SAASiL,EAAeF,GACpB,OAAQA,EAAiB3M,QAAU,IAAI4B,aAC3C,CAIA,SAASkL,EAAmBH,GACxB,OAAQA,EAAiB7M,qBAAuB,IAAI8B,aACxD,CAIA,SAASmL,EAAeJ,GAKpB,OAAOA,EAAiB9M,WACpB8M,EAAiB9M,UAAU+B,gBACvB,0BACF+K,EAAiB9M,UAAU+B,cAC3B,EACV,CAMA,SAASsM,EAAwBhO,EAAKe,GAClC,MAAMkN,EAAgE,IAAlDjO,EAAI6B,QAAQ,gBAChC,IAAIqM,GAAiB,EAOrB,OANInN,IACAmN,EACInN,EAAO2K,eAAe,mBAClB3K,EAAO2K,eAAe,WACtB3K,EAAO2K,eAAe,cAE3BuC,GAAeC,CAC1B,CAMA,SAASC,EAAmBnO,EAAKe,GAC7B,IAAIkN,GAAc,EACdjO,IACAiO,EAAqE,IAAvDjO,EAAI6B,QAAQ,yBAE9B,IAAIqM,GAAiB,EAIrB,OAHInN,IACAmN,EAAiBnN,EAAO2K,eAAe,iBAEpCuC,GAAeC,CAC1B,CAIA,SAASE,GAAuB,YAAE5O,EAAW,SAAEjF,IAM3C,MAL4B,CACxB,KACAiF,EACAjF,GAGC6P,KAAK,0BACL1I,aACT,CAKA,SAAS2M,EAAoBrO,EAAKe,GAC9B,QAAKA,GAGiC,IAA9Bf,EAAI6B,QAAQ,OAChBd,EAAO2K,eAAe,aACtB3K,EAAO2K,eAAe,cAC9B,CAKA,SAAS4C,EAA0BtO,EAAKe,GACpC,QAAKA,GAG2D,IAAxDf,EAAI6B,QAAQ,iBAChBd,EAAO2K,eAAe,YACtB3K,EAAO2K,eAAe,oBACtB3K,EAAO2K,eAAe,sBACtB3K,EAAO2K,eAAe,wBACtB3K,EAAO2K,eAAe,2BACtB3K,EAAO2K,eAAe,mBACtB3K,EAAO2K,eAAe,WACtB3K,EAAO2K,eAAe,uBACtB3K,EAAO2K,eAAe,yBACtB3K,EAAO2K,eAAe,cACtB3K,EAAO2K,eAAe,WAC9B,CAIA,SAAS6C,IACL,OAAQ,UACJ,yBACR,CACA,SAASC,EAAgCC,EAAmBC,EAAeC,GACvEF,EAAkBG,uBACdF,EAAcE,uBAClBH,EAAkBI,eAAiBH,EAAcG,eACjDJ,EAAkBK,qBAAuBJ,EAAcI,qBACvDL,EAAkBM,OAASL,EAAcK,OACzCN,EAAkBO,qBAAuBL,EACzCF,EAAkBQ,SAAWP,EAAcO,QAC/C,CACA,SAASC,EAA6BT,EAAmBC,EAAeC,GACpEF,EAAkBnL,QAAUoL,EAAcpL,QAC1CmL,EAAkBU,gBAAkBT,EAAcS,gBAClDV,EAAkBW,kBAAoBV,EAAcU,kBACpDX,EAAkBY,mBAAqBV,CAC3C,CAIA,SAASW,EAA2BC,GAChC,OAAOA,EAASC,YAAa,SACjC,yRC5SA,MAAMC,UAAgC,IAClCnV,YAAYoV,EAAepK,GACvBqK,MAAMD,EAAepK,GAErB3K,KAAKiV,oBAAqB,EAC1BjV,KAAKkV,kBACDlV,KAAKmV,OAAOC,YAAYxG,UAAUyG,QAAQC,aAAaC,aAC/D,CAWA/R,qBAAqB0I,GACjBlM,KAAK2K,mBAAmB6K,oBAAoB,oBAAkCtJ,EAAQvI,eACtF,MAAM8R,QAAoB,IAAA5I,GAAY7M,KAAK0V,6BAA6BC,KAAK3V,MAAO,iCAA+CA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAtJ,CAAqKuI,GAC/L,OAAO,sBAA4BlM,KAAK4O,UAAUgH,sBAAuBH,EAC7E,CAMAjS,mBAAmB0I,EAAS2J,GAExB,GADA7V,KAAK2K,mBAAmB6K,oBAAoB,4BAA0CtJ,EAAQvI,gBACzFuI,EAAQ4J,KACT,MAAM,QAAsB,MAEhC,MAAMC,GAAe,UACfC,QAAiB,IAAAnJ,GAAY7M,KAAKiW,oBAAoBN,KAAK3V,MAAO,mCAAiDA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAA/I,CAA8J3D,KAAK4O,UAAW1C,GAE/LgK,EAAYF,EAASG,UAAU,sBAC/BC,EAAkB,IAAI,IAAgBpW,KAAKmV,OAAOC,YAAYxV,SAAUI,KAAKqW,aAAcrW,KAAKsW,YAAatW,KAAKF,OAAQE,KAAKmV,OAAOoB,kBAAmBvW,KAAKmV,OAAOqB,kBAAmBxW,KAAK2K,mBAGnM,OADAyL,EAAgBK,sBAAsBT,EAASU,OACxC,IAAA7J,GAAYuJ,EAAgBO,0BAA0BhB,KAAKS,GAAkB,+BAA6CpW,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvK,CAAsLqS,EAASU,KAAM1W,KAAK4O,UAAWmH,EAAc7J,EAAS2J,OAAiBhT,OAAWA,OAAWA,EAAWqT,EACzS,CAMAU,uBAAuBC,EAAcC,GAMjC,GAJwB,IAAI,IAAgB9W,KAAKmV,OAAOC,YAAYxV,SAAUI,KAAKqW,aAAcrW,KAAKsW,YAAatW,KAAKF,OAAQ,KAAM,MAEtHiX,wCAAwCF,EAAcC,IAEjED,EAAaf,KACd,MAAM,QAAsB,MAEhC,OAAOe,CACX,CAMAG,aAAaC,GAET,IAAKA,EACD,MAAM,QAA+B,MAEzC,MAAMxB,EAAczV,KAAKkX,2BAA2BD,GAEpD,OAAO,sBAA4BjX,KAAK4O,UAAUuI,mBAAoB1B,EAC1E,CAMAjS,0BAA0BoL,EAAW1C,GACjClM,KAAK2K,mBAAmB6K,oBAAoB,mCAAiDtJ,EAAQvI,eACrG,MAAMyT,EAAwBpX,KAAKqX,2BAA2BnL,GACxDoL,EAAW,sBAA4B1I,EAAU2I,cAAeH,GAChEI,QAAoB,IAAA3K,GAAY7M,KAAKyX,uBAAuB9B,KAAK3V,MAAO,sCAAoDA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAArJ,CAAoKuI,GAC9L,IAAIwL,EACJ,GAAIxL,EAAQ4D,WACR,IACI,MAAMA,GAAa,OAAgB5D,EAAQ4D,WAAY9P,KAAKsW,YAAYvU,cACxE2V,EAAgB,CACZhT,WAAY,GAAGoL,EAAWK,MAAM,6BAAmCL,EAAWI,OAC9EyH,KAAM,oBAEd,CACA,MAAOvT,GACHpE,KAAKF,OAAO2J,QAAQ,+CAAiDrF,EACzE,CAEJ,MAAM+R,EAAUnW,KAAK4X,0BAA0BF,GAAiBxL,EAAQwL,eAClEG,EAAa,CACfjY,SAAUsM,EAAQ4L,qBAAqBlY,UACnCI,KAAKmV,OAAOC,YAAYxV,SAC5BgP,UAAWA,EAAUmJ,mBACrB5L,OAAQD,EAAQC,OAChBgC,OAAQjC,EAAQiC,OAChB9B,qBAAsBH,EAAQG,qBAC9B2L,sBAAuB9L,EAAQ8L,sBAC/BC,mBAAoB/L,EAAQ+L,mBAC5BC,UAAWhM,EAAQgM,UACnB5L,OAAQJ,EAAQI,QAEpB,OAAO,IAAAO,GAAY7M,KAAKmY,2BAA2BxC,KAAK3V,MAAO,uDAAqEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAA1K,CAAyL2T,EAAUE,EAAarB,EAAS0B,EAAY3L,EAAQvI,cAAe,uDACvQ,CAKAH,6BAA6B0I,GACzBlM,KAAK2K,mBAAmB6K,oBAAoB,sCAAoDtJ,EAAQvI,eACxG,MAAMyU,EAAmB,IAAI,IAiC7B,GAhCAA,EAAiBC,YAAYnM,EAAQ4L,sBAAsB,OACvD9X,KAAKmV,OAAOC,YAAYxV,UAKvBI,KAAKiV,mBAMNmD,EAAiBE,eAAepM,EAAQqM,aAJxC,wBAAqCrM,EAAQqM,aAOjDH,EAAiBI,UAAUtM,EAAQC,QAAQ,EAAMnM,KAAKkV,mBAEtDkD,EAAiBK,qBAAqBvM,EAAQ4J,MAE9CsC,EAAiBM,eAAe1Y,KAAKmV,OAAOwD,aAC5CP,EAAiBQ,wBAAwB5Y,KAAKmV,OAAO0D,UAAUC,aAC/DV,EAAiBW,gBACb/Y,KAAKgZ,0BAA2B,QAAmBhZ,KAAKmV,SACxDiD,EAAiBa,mBAAmBjZ,KAAKgZ,wBAGzC9M,EAAQgN,cACRd,EAAiBe,gBAAgBjN,EAAQgN,cAEzClZ,KAAKmV,OAAOiE,kBAAkBC,cAC9BjB,EAAiBkB,gBAAgBtZ,KAAKmV,OAAOiE,kBAAkBC,cAE/DrZ,KAAKmV,OAAOiE,kBAAkBG,gBAAiB,CAC/C,MAAMA,EAAkBvZ,KAAKmV,OAAOiE,kBAAkBG,gBACtDnB,EAAiBoB,yBAAyB,OAAmBD,EAAgBE,UAAWzZ,KAAKmV,OAAOC,YAAYxV,SAAUsM,EAAQ+L,qBAClIG,EAAiBsB,uBAAuBH,EAAgBI,cAC5D,CAGA,GAFAvB,EAAiBwB,aAAa,+BAC9BxB,EAAiByB,gBACb3N,EAAQG,uBAAyB,SAA0B,CAC3D,MAAMyN,EAAoB,IAAI,IAAkB9Z,KAAKsW,YAAatW,KAAK2K,mBACvE,IAAIoP,EAMAA,EALC7N,EAAQ8N,OAKIha,KAAKsW,YAAY2D,UAAU/N,EAAQ8N,eAJd,IAAAnN,GAAYiN,EAAkBI,YAAYvE,KAAKmE,GAAoB,yBAAuC9Z,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvJ,CAAsKuI,EAASlM,KAAKF,SACrLqa,aAMrC/B,EAAiBgC,YAAYL,EACjC,MACK,GAAI7N,EAAQG,uBAAyB,SAA0B,CAChE,IAAIH,EAAQmO,OAIR,MAAM,QAA+B,MAHrCjC,EAAiBkC,UAAUpO,EAAQmO,OAK3C,CACA,MAAM1W,EAAgBuI,EAAQvI,eAC1B3D,KAAKmV,OAAOoF,gBAAgBC,gBAOhC,IAAIC,EACJ,GAPArC,EAAiBsC,iBAAiB/W,KAC7B,eAAuBuI,EAAQiC,SAC/BnO,KAAKmV,OAAOC,YAAYuF,oBACrB3a,KAAKmV,OAAOC,YAAYuF,mBAAmBla,OAAS,IACxD2X,EAAiBwC,UAAU1O,EAAQiC,OAAQnO,KAAKmV,OAAOC,YAAYuF,oBAGnEzO,EAAQ4D,WACR,IACI,MAAMA,GAAa,OAAgB5D,EAAQ4D,WAAY9P,KAAKsW,YAAYvU,cACxE0Y,EAAU,CACN/V,WAAY,GAAGoL,EAAWK,MAAM,6BAAmCL,EAAWI,OAC9EyH,KAAM,oBAEd,CACA,MAAOvT,GACHpE,KAAKF,OAAO2J,QAAQ,+CAAiDrF,EACzE,MAGAqW,EAAUvO,EAAQwL,cAGtB,GAAI1X,KAAKmV,OAAO0F,cAAcC,sBAAwBL,EAClD,OAAQA,EAAQ9C,MACZ,KAAK,oBACD,IACI,MAAM7H,GAAa,OAAiC2K,EAAQ/V,YAC5D0T,EAAiB2C,UAAUjL,EAC/B,CACA,MAAO1L,GACHpE,KAAKF,OAAO2J,QAAQ,mDAChBrF,EACR,CACA,MACJ,KAAK,QACDgU,EAAiB4C,UAAUP,EAAQ/V,YAe/C,OAXIwH,EAAQ4L,qBACRM,EAAiB6C,wBAAwB/O,EAAQ4L,sBAGjD5L,EAAQgP,4BACNhP,EAAQ4L,qBACL5L,EAAQ4L,oBAAoB,OACjCM,EAAiB6C,wBAAwB,CACrC,CAAC,MAAkB,MAGpB7C,EAAiB+C,mBAC5B,CAKA3X,mCAAmC0I,GAC/BlM,KAAK2K,mBAAmB6K,oBAAoB,iCAA+CtJ,EAAQvI,eACnG,MAAMyU,EAAmB,IAAI,IAC7BA,EAAiBC,YAAYnM,EAAQkP,uBAAuB,OACxDpb,KAAKmV,OAAOC,YAAYxV,UAC5B,MAAMyb,EAAgB,IACdnP,EAAQC,QAAU,MAClBD,EAAQoP,sBAAwB,IAExClD,EAAiBI,UAAU6C,GAAe,EAAMrb,KAAKkV,mBAErDkD,EAAiBE,eAAepM,EAAQqM,aAExC,MAAM5U,EAAgBuI,EAAQvI,eAC1B3D,KAAKmV,OAAOoF,gBAAgBC,gBAuBhC,GAtBApC,EAAiBsC,iBAAiB/W,GAElCyU,EAAiBmD,gBAAgBrP,EAAQsP,cAEzCpD,EAAiBqD,sBAEjBrD,EAAiBM,eAAe1Y,KAAKmV,OAAOwD,cACvC,QAAmB3Y,KAAKmV,SACzBiD,EAAiBQ,wBAAwB5Y,KAAKmV,OAAO0D,UAAUC,aAGnEV,EAAiByB,gBACb3N,EAAQwP,eAAiBxP,EAAQyP,qBACjCvD,EAAiBwD,uBAAuB1P,EAAQwP,cAAexP,EAAQyP,qBAEvEzP,EAAQ2P,QACRzD,EAAiB0D,UAAU5P,EAAQ2P,QAEnC3P,EAAQ6P,YACR3D,EAAiB4D,cAAc9P,EAAQ6P,YAGvC7P,EAAQ2P,SAAW,oBAEnB,GAAI3P,EAAQ5I,KAAO4I,EAAQ2P,SAAW,UAElC7b,KAAKF,OAAO2J,QAAQ,yEACpB2O,EAAiB6D,OAAO/P,EAAQ5I,UAE/B,GAAI4I,EAAQvL,QAAS,CACtB,MAAMub,EAAalc,KAAKmc,kBAAkBjQ,EAAQvL,SAClD,IAAIyb,EAAwBpc,KAAKqc,iBAAiBnQ,EAAQvL,SAM1D,GALIyb,GAAyBlQ,EAAQ6P,aACjC/b,KAAKF,OAAOgR,QAAQ,+JACpBsL,EAAwB,MAGxBA,EAAuB,CACvBpc,KAAKF,OAAO2J,QAAQ,qEACpB2O,EAAiBkE,aAAaF,GAC9B,IACI,MAAMtM,GAAa,OAAiC5D,EAAQvL,QAAQmE,eACpEsT,EAAiB2C,UAAUjL,EAC/B,CACA,MAAO1L,GACHpE,KAAKF,OAAO2J,QAAQ,+EACxB,CACJ,MACK,GAAIyS,GAAchQ,EAAQ2P,SAAW,UAAkB,CAKxD7b,KAAKF,OAAO2J,QAAQ,yEACpB2O,EAAiB6D,OAAOC,GACxB,IACI,MAAMpM,GAAa,OAAiC5D,EAAQvL,QAAQmE,eACpEsT,EAAiB2C,UAAUjL,EAC/B,CACA,MAAO1L,GACHpE,KAAKF,OAAO2J,QAAQ,+EACxB,CACJ,MACK,GAAIyC,EAAQlJ,UACbhD,KAAKF,OAAO2J,QAAQ,gEACpB2O,EAAiBkE,aAAapQ,EAAQlJ,WACtCoV,EAAiB4C,UAAU9O,EAAQlJ,gBAElC,GAAIkJ,EAAQvL,QAAQuC,SAAU,CAE/BlD,KAAKF,OAAO2J,QAAQ,gEACpB2O,EAAiBkE,aAAapQ,EAAQvL,QAAQuC,UAC9C,IACI,MAAM4M,GAAa,OAAiC5D,EAAQvL,QAAQmE,eACpEsT,EAAiB2C,UAAUjL,EAC/B,CACA,MAAO1L,GACHpE,KAAKF,OAAO2J,QAAQ,+EACxB,CACJ,CACJ,MACSyC,EAAQlJ,YACbhD,KAAKF,OAAO2J,QAAQ,4EACpB2O,EAAiBkE,aAAapQ,EAAQlJ,WACtCoV,EAAiB4C,UAAU9O,EAAQlJ,iBAIvChD,KAAKF,OAAO2J,QAAQ,kFAgBxB,GAdIyC,EAAQqF,OACR6G,EAAiBmE,SAASrQ,EAAQqF,OAElCrF,EAAQsQ,OACRpE,EAAiBqE,SAASvQ,EAAQsQ,QAElCtQ,EAAQiC,QACPnO,KAAKmV,OAAOC,YAAYuF,oBACrB3a,KAAKmV,OAAOC,YAAYuF,mBAAmBla,OAAS,IACxD2X,EAAiBwC,UAAU1O,EAAQiC,OAAQnO,KAAKmV,OAAOC,YAAYuF,oBAEnEzO,EAAQkP,sBACRhD,EAAiB6C,wBAAwB/O,EAAQkP,sBAEjDlP,EAAQwQ,eAERtE,EAAiBuE,kBAEbzQ,EAAQG,uBAAyB,UAA0B,CAC3D,MAAMyN,EAAoB,IAAI,IAAkB9Z,KAAKsW,aAErD,IAAIyD,EAMAA,EALC7N,EAAQ8N,OAKIha,KAAKsW,YAAY2D,UAAU/N,EAAQ8N,eAJd,IAAAnN,GAAYiN,EAAkBI,YAAYvE,KAAKmE,GAAoB,yBAAuC9Z,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvJ,CAAsKuI,EAASlM,KAAKF,SACrLqa,aAKrC/B,EAAiBgC,YAAYL,EACjC,CAEJ,OAAO3B,EAAiB+C,mBAC5B,CAKAjE,2BAA2BhL,GACvB,MAAMkM,EAAmB,IAAI,IAmB7B,OAlBIlM,EAAQ0Q,uBACRxE,EAAiByE,yBAAyB3Q,EAAQ0Q,uBAElD1Q,EAAQvI,eACRyU,EAAiBsC,iBAAiBxO,EAAQvI,eAE1CuI,EAAQ4Q,aACR1E,EAAiB2E,eAAe7Q,EAAQ4Q,aAExC5Q,EAAQsQ,OACRpE,EAAiBqE,SAASvQ,EAAQsQ,OAElCtQ,EAAQ8Q,YACR5E,EAAiB6E,cAAc/Q,EAAQ8Q,YAEvC9Q,EAAQkP,sBACRhD,EAAiB6C,wBAAwB/O,EAAQkP,sBAE9ChD,EAAiB+C,mBAC5B,CAKAgB,kBAAkBxb,GACd,OAAOA,EAAQC,eAAe0C,KAAO,IACzC,CACA+Y,iBAAiB1b,GACb,OAAOA,EAAQC,eAAe4N,YAAc,IAChD,4KCpaJ,MAAM0O,EACFvd,YAAYoV,EAAepK,GAEvB3K,KAAKmV,QAAS,QAAyBJ,GAEvC/U,KAAKF,OAAS,IAAI,IAAOE,KAAKmV,OAAOgI,cAAe,IAAM,KAE1Dnd,KAAKsW,YAActW,KAAKmV,OAAOoF,gBAE/Bva,KAAKqW,aAAerW,KAAKmV,OAAOiI,iBAEhCpd,KAAKqd,cAAgBrd,KAAKmV,OAAOmI,iBAEjCtd,KAAKud,eAAiB,IAAI,IAAevd,KAAKqd,cAAerd,KAAKqW,cAElErW,KAAKgZ,uBAAyBhZ,KAAKmV,OAAO6D,uBAE1ChZ,KAAK4O,UAAY5O,KAAKmV,OAAOC,YAAYxG,UAEzC5O,KAAK2K,kBAAoBA,CAC7B,CAIAiN,0BAA0B6C,GACtB,MAAMtE,EAAU,CAAC,EAEjB,GADAA,EAAQ,mBAA4B,4BAC/BnW,KAAKmV,OAAO0F,cAAcC,sBAAwBL,EACnD,OAAQA,EAAQ9C,MACZ,KAAK,oBACD,IACI,MAAM7H,GAAa,OAAiC2K,EAAQ/V,YAC5DyR,EAAQ,iBAA0B,OAAOrG,EAAWK,OAAOL,EAAWI,MAC1E,CACA,MAAO9L,GACHpE,KAAKF,OAAO2J,QAAQ,mDAChBrF,EACR,CACA,MACJ,KAAK,QACD+R,EAAQ,iBAA0B,QAAQsE,EAAQ/V,aAI9D,OAAOyR,CACX,CAQA3S,iCAAiC+T,EAAe9B,EAAaU,EAAS0B,EAAYlU,EAAe6Z,GACzFA,GACAxd,KAAK2K,mBAAmB6K,oBAAoBgI,EAAa7Z,GAE7D,MAAMqS,QAAiBhW,KAAKud,eAAeE,gBAAgB5F,EAAYN,EAAe,CAAEb,KAAMjB,EAAaU,QAASA,IAWpH,OAVAnW,KAAK2K,mBAAmBe,UAAU,CAC9BgS,iBAAkB1H,EAASU,KAAKiH,eAAeld,QAAU,EACzDmd,aAAc5H,EAASG,UAAU,yBAAkC,IACpExS,GACC3D,KAAKmV,OAAO6D,wBACZhD,EAAS6H,OAAS,KACE,MAApB7H,EAAS6H,QAET7d,KAAKmV,OAAO6D,uBAAuB8E,sBAEhC9H,CACX,CAKAxS,sBAAsBua,EAAuBpa,GACzC3D,KAAK2K,mBAAmB6K,oBAAoB,kCAAgD7R,GAC5F,MAAMqa,EAA4B,WAAWD,KAAyB/d,KAAK4O,UAAUqP,UAC/EC,QAA+B,OAAyBF,EAA2Bhe,KAAKqd,cAAerd,KAAKqW,aAAcrW,KAAK4O,UAAUyG,QAASrV,KAAKF,OAAQ6D,EAAe3D,KAAK2K,mBACzL3K,KAAK4O,UAAYsP,CACrB,CAKA7G,2BAA2BnL,GACvB,MAAMkM,EAAmB,IAAI,IAI7B,OAHIlM,EAAQiS,sBACR/F,EAAiB6C,wBAAwB/O,EAAQiS,sBAE9C/F,EAAiB+C,mBAC5B,2TC5EJ,MAAMiD,UAA2B,IAC7Bze,YAAYoV,EAAepK,GACvBqK,MAAMD,EAAepK,EACzB,CACAnH,mBAAmB0I,GACflM,KAAK2K,mBAAmB6K,oBAAoB,oCAAkDtJ,EAAQvI,eACtG,MAAMoS,GAAe,UACfC,QAAiB,IAAAnJ,GAAY7M,KAAKiW,oBAAoBN,KAAK3V,MAAO,2CAAyDA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvJ,CAAsKuI,EAASlM,KAAK4O,WAErMsH,EAAYF,EAASG,UAAU,sBAC/BC,EAAkB,IAAI,IAAgBpW,KAAKmV,OAAOC,YAAYxV,SAAUI,KAAKqW,aAAcrW,KAAKsW,YAAatW,KAAKF,OAAQE,KAAKmV,OAAOoB,kBAAmBvW,KAAKmV,OAAOqB,mBAE3K,OADAJ,EAAgBK,sBAAsBT,EAASU,OACxC,IAAA7J,GAAYuJ,EAAgBO,0BAA0BhB,KAAKS,GAAkB,+BAA6CpW,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvK,CAAsLqS,EAASU,KAAM1W,KAAK4O,UAAWmH,EAAc7J,OAASrJ,OAAWA,GAAW,EAAMqJ,EAAQmS,WAAYnI,EACvS,CAKA1S,iCAAiC0I,GAE7B,IAAKA,EACD,MAAM,QAA+B,MAIzC,GAFAlM,KAAK2K,mBAAmB6K,oBAAoB,kDAAgEtJ,EAAQvI,gBAE/GuI,EAAQvL,QACT,MAAM,QAAsB,MAKhC,GAFeX,KAAKqW,aAAatI,kBAAkB7B,EAAQvL,QAAQkE,aAG/D,IACI,aAAa,IAAAgI,GAAY7M,KAAKse,mCAAmC3I,KAAK3V,MAAO,0DAAwEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAArL,CAAoMuI,GAAS,EAC9N,CACA,MAAO9H,GACH,MAAMma,EAAoBna,aAAa,MACnCA,EAAEoa,YACE,KACFC,EAAkCra,aAAa,KACjDA,EAAEoa,YAAc,0BAChBpa,EAAEsa,WAAa,2BAEnB,GAAIH,GAAqBE,EACrB,OAAO,IAAA5R,GAAY7M,KAAKse,mCAAmC3I,KAAK3V,MAAO,0DAAwEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAArL,CAAoMuI,GAAS,GAIpN,MAAM9H,CAEd,CAGJ,OAAO,IAAAyI,GAAY7M,KAAKse,mCAAmC3I,KAAK3V,MAAO,0DAAwEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAArL,CAAoMuI,GAAS,EACxN,CAKA1I,yCAAyC0I,EAASyS,GAC9C3e,KAAK2K,mBAAmB6K,oBAAoB,0DAAwEtJ,EAAQvI,eAE5H,MAAMK,GAAe,OAAOhE,KAAKqW,aAAatJ,gBAAgB4I,KAAK3V,KAAKqW,cAAe,iCAA+CrW,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAA9J,CAA6KuI,EAAQvL,QAASge,OAAM9b,EAAW7C,KAAK2K,kBAAmBuB,EAAQvI,eACpQ,IAAKK,EACD,MAAM,QAAmC,MAE7C,GAAIA,EAAaqO,YACb,QAAerO,EAAaqO,UAAWnG,EAAQ0S,qCAxEH,KA0E5C,MAAM,QAAmC,MAG7C,MAAMC,EAAsB,IACrB3S,EACHlI,aAAcA,EAAalC,OAC3BuK,qBAAsBH,EAAQG,sBAAwB,YACtDqL,cAAe,CACXhT,WAAYwH,EAAQvL,QAAQmE,cAC5B6S,KAAM,sBAGd,IACI,aAAa,IAAA9K,GAAY7M,KAAK8e,aAAanJ,KAAK3V,MAAO,oCAAkDA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAzI,CAAwJkb,EACzK,CACA,MAAOza,GACH,GAAIA,aAAa,MACbA,EAAEsa,WAAa,KAAU,CAEzB1e,KAAKF,OAAO2J,QAAQ,wEACpB,MAAMsV,GAAqB,QAAsB/a,GACjDhE,KAAKqW,aAAa/M,mBAAmByV,EACzC,CACA,MAAM3a,CACV,CACJ,CAMAZ,0BAA0B0I,EAAS0C,GAC/B5O,KAAK2K,mBAAmB6K,oBAAoB,2CAAyDtJ,EAAQvI,eAC7G,MAAMyT,EAAwBpX,KAAKqX,2BAA2BnL,GACxDoL,EAAW,sBAA4B1I,EAAU2I,cAAeH,GAChEI,QAAoB,IAAA3K,GAAY7M,KAAKyX,uBAAuB9B,KAAK3V,MAAO,8CAA4DA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAA7J,CAA4KuI,GAChMiK,EAAUnW,KAAK4X,0BAA0B1L,EAAQwL,eACjDG,EAAa,CACfjY,SAAUsM,EAAQ4L,qBAAqBlY,UACnCI,KAAKmV,OAAOC,YAAYxV,SAC5BgP,UAAWA,EAAUmJ,mBACrB5L,OAAQD,EAAQC,OAChBgC,OAAQjC,EAAQiC,OAChB9B,qBAAsBH,EAAQG,qBAC9B2L,sBAAuB9L,EAAQ8L,sBAC/BC,mBAAoB/L,EAAQ+L,mBAC5BC,UAAWhM,EAAQgM,UACnB5L,OAAQJ,EAAQI,QAEpB,OAAO,IAAAO,GAAY7M,KAAKmY,2BAA2BxC,KAAK3V,MAAO,kDAAgEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAArK,CAAoL2T,EAAUE,EAAarB,EAAS0B,EAAY3L,EAAQvI,cAAe,kDAClQ,CAKAH,6BAA6B0I,GACzBlM,KAAK2K,mBAAmB6K,oBAAoB,8CAA4DtJ,EAAQvI,eAChH,MAAMA,EAAgBuI,EAAQvI,cACxByU,EAAmB,IAAI,IAoB7B,GAnBAA,EAAiBC,YAAYnM,EAAQ4L,sBAAsB,OACvD9X,KAAKmV,OAAOC,YAAYxV,UACxBsM,EAAQqM,aACRH,EAAiBE,eAAepM,EAAQqM,aAE5CH,EAAiBI,UAAUtM,EAAQC,QAAQ,EAAMnM,KAAKmV,OAAOC,YAAYxG,UAAUyG,QAAQC,aAAaC,eACxG6C,EAAiBwB,aAAa,0BAC9BxB,EAAiByB,gBACjBzB,EAAiBM,eAAe1Y,KAAKmV,OAAOwD,aAC5CP,EAAiBQ,wBAAwB5Y,KAAKmV,OAAO0D,UAAUC,aAC/DV,EAAiBW,gBACb/Y,KAAKgZ,0BAA2B,QAAmBhZ,KAAKmV,SACxDiD,EAAiBa,mBAAmBjZ,KAAKgZ,wBAE7CZ,EAAiBsC,iBAAiB/W,GAClCyU,EAAiB4G,gBAAgB9S,EAAQlI,cACrChE,KAAKmV,OAAOiE,kBAAkBC,cAC9BjB,EAAiBkB,gBAAgBtZ,KAAKmV,OAAOiE,kBAAkBC,cAE/DrZ,KAAKmV,OAAOiE,kBAAkBG,gBAAiB,CAC/C,MAAMA,EAAkBvZ,KAAKmV,OAAOiE,kBAAkBG,gBACtDnB,EAAiBoB,yBAAyB,OAAmBD,EAAgBE,UAAWzZ,KAAKmV,OAAOC,YAAYxV,SAAUsM,EAAQ+L,qBAClIG,EAAiBsB,uBAAuBH,EAAgBI,cAC5D,CACA,GAAIzN,EAAQG,uBAAyB,SAA0B,CAC3D,MAAMyN,EAAoB,IAAI,IAAkB9Z,KAAKsW,YAAatW,KAAK2K,mBACvE,IAAIoP,EAMAA,EALC7N,EAAQ8N,OAKIha,KAAKsW,YAAY2D,UAAU/N,EAAQ8N,eAJd,IAAAnN,GAAYiN,EAAkBI,YAAYvE,KAAKmE,GAAoB,yBAAuC9Z,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAvJ,CAAsKuI,EAASlM,KAAKF,SACrLqa,aAMrC/B,EAAiBgC,YAAYL,EACjC,MACK,GAAI7N,EAAQG,uBAAyB,SAA0B,CAChE,IAAIH,EAAQmO,OAIR,MAAM,QAA+B,MAHrCjC,EAAiBkC,UAAUpO,EAAQmO,OAK3C,CAMA,KALK,eAAuBnO,EAAQiC,SAC/BnO,KAAKmV,OAAOC,YAAYuF,oBACrB3a,KAAKmV,OAAOC,YAAYuF,mBAAmBla,OAAS,IACxD2X,EAAiBwC,UAAU1O,EAAQiC,OAAQnO,KAAKmV,OAAOC,YAAYuF,oBAEnE3a,KAAKmV,OAAO0F,cAAcC,sBAC1B5O,EAAQwL,cACR,OAAQxL,EAAQwL,cAAcC,MAC1B,KAAK,oBACD,IACI,MAAM7H,GAAa,OAAiC5D,EAAQwL,cAAchT,YAC1E0T,EAAiB2C,UAAUjL,EAC/B,CACA,MAAO1L,GACHpE,KAAKF,OAAO2J,QAAQ,mDAChBrF,EACR,CACA,MACJ,KAAK,QACDgU,EAAiB4C,UAAU9O,EAAQwL,cAAchT,YAO7D,OAHIwH,EAAQ4L,qBACRM,EAAiB6C,wBAAwB/O,EAAQ4L,qBAE9CM,EAAiB+C,mBAC5B,kMCvNJ,MAAM8D,UAAyB,IAC3Btf,YAAYoV,EAAepK,GACvBqK,MAAMD,EAAepK,EACzB,CAMAnH,mBAAmB0I,GACf,IACI,MAAOgT,EAAcC,SAAsBnf,KAAKof,mBAAmB,IAC5DlT,EACHC,OAAQD,EAAQC,QAAQ1L,OAClByL,EAAQC,OACR,IAAI,QAcd,OAXIgT,IAAiB,6BACjBnf,KAAKF,OAAOoL,KAAK,+IAEU,IAAI,IAAmBlL,KAAKmV,OAAQnV,KAAK2K,mBAE/D0U,2BAA2BnT,GAC3BoT,OAAM,UAKRJ,CACX,CACA,MAAO9a,GACH,GAAIA,aAAa,MACbA,EAAEoa,YAAc,KAEhB,OAD2B,IAAI,IAAmBxe,KAAKmV,OAAQnV,KAAK2K,mBAC1C0U,2BAA2BnT,GAGrD,MAAM9H,CAEd,CACJ,CAKAZ,yBAAyB0I,GACrBlM,KAAK2K,mBAAmB6K,oBAAoB,wCAAsDtJ,EAAQvI,eAC1G,IAAI4b,EAAmB,oBACvB,GAAIrT,EAAQsT,eACNxf,KAAKmV,OAAOsK,aAAaC,4BACtB,eAAuBxT,EAAQiC,QAGpC,MADAnO,KAAK2f,gBAAgB,6BAAsCzT,EAAQvI,gBAC7D,QAAsB,MAGhC,IAAKuI,EAAQvL,QACT,MAAM,QAAsB,MAEhC,MAAMif,EAAkB1T,EAAQvL,QAAQS,WACpC,QAA6B8K,EAAQ0C,WACnCrN,EAAYvB,KAAKqW,aAAahU,eAC9Bwd,EAAoB7f,KAAKqW,aAAapK,eAAeC,EAAQvL,QAASuL,EAAS3K,EAAWqe,EAAiB5f,KAAK2K,kBAAmBuB,EAAQvI,eACjJ,IAAKkc,EAGD,MADA7f,KAAK2f,gBAAgB,4BAAqCzT,EAAQvI,gBAC5D,QAAsB,MAE3B,IAAI,QAAmBkc,EAAkBnN,YAC1C,QAAemN,EAAkBxN,UAAWrS,KAAKmV,OAAO0F,cAAciF,2BAGtE,MADA9f,KAAK2f,gBAAgB,iCAA0CzT,EAAQvI,gBACjE,QAAsB,MAEvBkc,EAAkBtN,YACvB,QAAesN,EAAkBtN,UAAW,KAE5CgN,EAAmB,4BAGvB,MAAM1a,EAAcqH,EAAQ0C,WAAa5O,KAAK4O,UAAUqB,oBAClDxM,EAAc,CAChB9C,QAASX,KAAKqW,aAAa5L,qBAAqByB,EAAQvL,SACxDmD,YAAa+b,EACbje,QAAS5B,KAAKqW,aAAaxU,WAAWqK,EAAQvL,QAASY,EAAWqe,EAAiB5f,KAAK2K,kBAAmBuB,EAAQvI,eACnHK,aAAc,KACdE,YAAalE,KAAKqW,aAAa5I,yBAAyB5I,IAM5D,OAJA7E,KAAK2f,gBAAgBJ,EAAkBrT,EAAQvI,eAC3C3D,KAAKmV,OAAO6D,wBACZhZ,KAAKmV,OAAO6D,uBAAuB+G,qBAEhC,OACG,IAAAlT,GAAY7M,KAAKggB,8BAA8BrK,KAAK3V,MAAO,mDAAiEA,KAAKF,OAAQE,KAAK2K,kBAAmBuB,EAAQvI,cAAzK,CAAwLF,EAAayI,GAC3MqT,EAER,CACAI,gBAAgBR,EAAcxb,GAC1B3D,KAAKgZ,wBAAwB2G,gBAAgBR,GAC7Cnf,KAAK2K,mBAAmBe,UAAU,CAC9ByT,aAAcA,GACfxb,GACCwb,IAAiB,qBACjBnf,KAAKF,OAAOoL,KAAK,mDAAmDiU,IAE5E,CAKA3b,oCAAoCC,EAAayI,GAE7C,IAAItL,EAKJ,GANAZ,KAAK2K,mBAAmB6K,oBAAoB,mDAAiEtJ,EAAQvI,eAEjHF,EAAY7B,UACZhB,GAAgB,QAAmB6C,EAAY7B,QAAQE,OAAQ9B,KAAKmV,OAAOoF,gBAAgBxY,eAG3FmK,EAAQ+T,QAA6B,IAAnB/T,EAAQ+T,OAAc,CACxC,MAAMC,EAAWtf,GAAeuf,UAChC,IAAKD,EACD,MAAM,QAAsB,OAEhC,QAAYA,EAAUhU,EAAQ+T,OAClC,CACA,OAAO,iCAA6CjgB,KAAKsW,YAAatW,KAAK4O,UAAWnL,GAAa,EAAMyI,EAAStL,EACtH,iNClIJ,MAAMwf,EAAyB,CAC3BN,0BAA2B,KAC3BhF,sBAAsB,GAEpBuF,EAAgC,CAClCC,eAAgB,OAGhBC,mBAAmB,EACnBC,SAAU,SACV7c,cAAe,mBAEb8c,EAAwB,CAC1Bf,2BAA2B,GAEzBgB,EAAiC,CACnCld,4BACI,MAAM,QAAsB,KAChC,EACAA,6BACI,MAAM,QAAsB,KAChC,GAEEmd,EAAuB,CACzBC,IAAK,SACLC,QAAS,IACTC,IAAK,kBACLC,GAAI,mBAEFC,EAA6B,CAC/B3H,aAAc,kBACdE,qBAAiB1W,GAEfoe,EAA8B,CAChCC,mBAAoB,SACpBjD,OAAQ,GAAG,8BAETkD,EAA4B,CAC9BrI,YAAa,CACTsI,QAAS,GACTC,WAAY,KAUpB,SAASC,GAA2BlM,YAAamM,EAAiB1G,cAAe2G,EAAmBrE,cAAesE,EAAkBhC,aAAciC,EAAkBtE,iBAAkBuE,EAAuBrE,iBAAkBsE,EAAuBrH,gBAAiBsH,EAAsBzI,kBAAmBA,EAAmBT,YAAaA,EAAaE,UAAWA,EAAWG,uBAAwBA,EAAwBxC,kBAAmBA,EAAmBD,kBAAmBA,IACzd,MAAM4G,EAAgB,IACfkD,KACAoB,GAEP,MAAO,CACHrM,aAoBkBA,EApBYmM,EAqB3B,CACH5G,mBAAoB,GACpBmH,kBAAmBb,EACnBc,4BAA4B,KACzB3M,IAxBHyF,cAAe,IAAKuF,KAA2BoB,GAC/CrE,cAAeA,EACfsC,aAAc,IAAKgB,KAA0BiB,GAC7CtE,iBAAkBuE,GACd,IAAI,IAAoBJ,EAAgB3hB,SAAU,IAA+B,IAAI,IAAOud,IAChGG,iBAAkBsE,GAAyBlB,EAC3CnG,gBAAiBsH,GAAwB,IACzCzI,kBAAmBA,GAAqB4H,EACxCrI,YAAa,IAAKgI,KAAyBhI,GAC3CE,UAAW,IAAKsI,KAA8BtI,GAC9CG,uBAAwBA,GAA0B,KAClDxC,kBAAmBA,GAAqB,KACxCD,kBAAmBA,GAAqB,MAOhD,IAA0BnB,CAL1B,CAiBA,SAAS4M,EAAmB7M,GACxB,OAAQA,EAAOC,YAAYxG,UAAUyG,QAAQtF,eAAiB,QAClE,khCCpGA,MAAMkS,EAAY,YACZC,EAAe,eACfC,EAAgB,gBAChBC,EAAgB,gBAChBC,EAAa,aACbC,EAAS,SACTC,EAAQ,QAKRC,EAAgB,gBAGhBC,EAAQ,QACRC,EAAQ,QACRC,EAAS,SAGTC,EAAO,OACPC,EAAiB,iBACjBC,EAAwB,wBACxBC,EAAgB,gBAChBC,EAAoB,oBACpBC,EAAe,eACfC,EAAe,eACfC,EAAc,cACdC,EAAe,eACfC,EAAsB,6BACtBC,EAAsB,0BACtBC,EAAsB,sBACtBC,EAAa,aACbC,EAAY,YACZC,EAAkB,2BAClBC,EAAgB,gBAChBC,EAAc,cACdC,EAAgB,gBAChBC,EAAmB,mBACnBC,EAAwB,wBACxBC,EAAa,aACbC,EAAU,UACVC,EAAgB,YAChBC,EAAsB,sBAItBC,EAAkB,kBAClBC,EAAgB,eAChBC,EAAc,cACdC,EAAM,MACNC,EAAa,aACbC,EAAc,cACdC,EAAqB","sources":["webpack://iadviser/./node_modules/@azure/msal-common/dist/cache/CacheManager.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/cache/entities/AccountEntity.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/cache/persistence/TokenCacheContext.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/cache/utils/CacheHelpers.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/client/AuthorizationCodeClient.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/client/BaseClient.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/client/RefreshTokenClient.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/client/SilentFlowClient.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/config/ClientConfiguration.mjs","webpack://iadviser/./node_modules/@azure/msal-common/dist/constants/AADServerParamKeys.mjs"],"sourcesContent":["/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { Separators, CredentialType, AuthenticationScheme, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.mjs';\nimport { generateCredentialKey } from './utils/CacheHelpers.mjs';\nimport { ScopeSet } from '../request/ScopeSet.mjs';\nimport { AccountEntity } from './entities/AccountEntity.mjs';\nimport { createClientAuthError } from '../error/ClientAuthError.mjs';\nimport { updateAccountTenantProfileData, tenantIdMatchesHomeTenant } from '../account/AccountInfo.mjs';\nimport { extractTokenClaims } from '../account/AuthToken.mjs';\nimport { name, version } from '../packageMetadata.mjs';\nimport { getAliasesFromStaticSources } from '../authority/AuthorityMetadata.mjs';\nimport { CacheError } from '../error/CacheError.mjs';\nimport { invalidCacheRecord, bindingKeyNotRemoved, multipleMatchingAppMetadata, methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';\nimport { cacheQuotaExceededErrorCode, cacheUnknownErrorCode } from '../error/CacheErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.\r\n * @internal\r\n */\r\nclass CacheManager {\r\n    constructor(clientId, cryptoImpl, logger, staticAuthorityOptions) {\r\n        this.clientId = clientId;\r\n        this.cryptoImpl = cryptoImpl;\r\n        this.commonLogger = logger.clone(name, version);\r\n        this.staticAuthorityOptions = staticAuthorityOptions;\r\n    }\r\n    /**\r\n     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.\r\n     * @param accountFilter - (Optional) filter to narrow down the accounts returned\r\n     * @returns Array of AccountInfo objects in cache\r\n     */\r\n    getAllAccounts(accountFilter) {\r\n        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);\r\n    }\r\n    /**\r\n     * Gets first tenanted AccountInfo object found based on provided filters\r\n     */\r\n    getAccountInfoFilteredBy(accountFilter) {\r\n        const allAccounts = this.getAllAccounts(accountFilter);\r\n        if (allAccounts.length > 1) {\r\n            // If one or more accounts are found, prioritize accounts that have an ID token\r\n            const sortedAccounts = allAccounts.sort((account) => {\r\n                return account.idTokenClaims ? -1 : 1;\r\n            });\r\n            return sortedAccounts[0];\r\n        }\r\n        else if (allAccounts.length === 1) {\r\n            // If only one account is found, return it regardless of whether a matching ID token was found\r\n            return allAccounts[0];\r\n        }\r\n        else {\r\n            return null;\r\n        }\r\n    }\r\n    /**\r\n     * Returns a single matching\r\n     * @param accountFilter\r\n     * @returns\r\n     */\r\n    getBaseAccountInfo(accountFilter) {\r\n        const accountEntities = this.getAccountsFilteredBy(accountFilter);\r\n        if (accountEntities.length > 0) {\r\n            return accountEntities[0].getAccountInfo();\r\n        }\r\n        else {\r\n            return null;\r\n        }\r\n    }\r\n    /**\r\n     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters\r\n     * and builds the account info objects from the matching ID token's claims\r\n     * @param cachedAccounts\r\n     * @param accountFilter\r\n     * @returns Array of AccountInfo objects that match account and tenant profile filters\r\n     */\r\n    buildTenantProfiles(cachedAccounts, accountFilter) {\r\n        return cachedAccounts.flatMap((accountEntity) => {\r\n            return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);\r\n        });\r\n    }\r\n    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {\r\n        let tenantedAccountInfo = null;\r\n        let idTokenClaims;\r\n        if (tenantProfileFilter) {\r\n            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {\r\n                return null;\r\n            }\r\n        }\r\n        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);\r\n        if (idToken) {\r\n            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);\r\n            if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {\r\n                // ID token sourced claims don't match so this tenant profile is not a match\r\n                return null;\r\n            }\r\n        }\r\n        // Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims\r\n        tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);\r\n        return tenantedAccountInfo;\r\n    }\r\n    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {\r\n        const accountInfo = accountEntity.getAccountInfo();\r\n        let searchTenantProfiles = accountInfo.tenantProfiles || new Map();\r\n        const tokenKeys = this.getTokenKeys();\r\n        // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists\r\n        if (targetTenantId) {\r\n            const tenantProfile = searchTenantProfiles.get(targetTenantId);\r\n            if (tenantProfile) {\r\n                // Reduce search field to just this tenant profile\r\n                searchTenantProfiles = new Map([\r\n                    [targetTenantId, tenantProfile],\r\n                ]);\r\n            }\r\n            else {\r\n                // No tenant profile for search tenant ID, return empty array\r\n                return [];\r\n            }\r\n        }\r\n        const matchingTenantProfiles = [];\r\n        searchTenantProfiles.forEach((tenantProfile) => {\r\n            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);\r\n            if (tenantedAccountInfo) {\r\n                matchingTenantProfiles.push(tenantedAccountInfo);\r\n            }\r\n        });\r\n        return matchingTenantProfiles;\r\n    }\r\n    tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter) {\r\n        if (!!tenantProfileFilter.localAccountId &&\r\n            !this.matchLocalAccountIdFromTenantProfile(tenantProfile, tenantProfileFilter.localAccountId)) {\r\n            return false;\r\n        }\r\n        if (!!tenantProfileFilter.name &&\r\n            !(tenantProfile.name === tenantProfileFilter.name)) {\r\n            return false;\r\n        }\r\n        if (tenantProfileFilter.isHomeTenant !== undefined &&\r\n            !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {\r\n        // Tenant Profile filtering\r\n        if (tenantProfileFilter) {\r\n            if (!!tenantProfileFilter.localAccountId &&\r\n                !this.matchLocalAccountIdFromTokenClaims(idTokenClaims, tenantProfileFilter.localAccountId)) {\r\n                return false;\r\n            }\r\n            if (!!tenantProfileFilter.loginHint &&\r\n                !this.matchLoginHintFromTokenClaims(idTokenClaims, tenantProfileFilter.loginHint)) {\r\n                return false;\r\n            }\r\n            if (!!tenantProfileFilter.username &&\r\n                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {\r\n                return false;\r\n            }\r\n            if (!!tenantProfileFilter.name &&\r\n                !this.matchName(idTokenClaims, tenantProfileFilter.name)) {\r\n                return false;\r\n            }\r\n            if (!!tenantProfileFilter.sid &&\r\n                !this.matchSid(idTokenClaims, tenantProfileFilter.sid)) {\r\n                return false;\r\n            }\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * saves a cache record\r\n     * @param cacheRecord {CacheRecord}\r\n     * @param storeInCache {?StoreInCache}\r\n     * @param correlationId {?string} correlation id\r\n     */\r\n    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {\r\n        if (!cacheRecord) {\r\n            throw createClientAuthError(invalidCacheRecord);\r\n        }\r\n        try {\r\n            if (!!cacheRecord.account) {\r\n                this.setAccount(cacheRecord.account);\r\n            }\r\n            if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {\r\n                this.setIdTokenCredential(cacheRecord.idToken);\r\n            }\r\n            if (!!cacheRecord.accessToken &&\r\n                storeInCache?.accessToken !== false) {\r\n                await this.saveAccessToken(cacheRecord.accessToken);\r\n            }\r\n            if (!!cacheRecord.refreshToken &&\r\n                storeInCache?.refreshToken !== false) {\r\n                this.setRefreshTokenCredential(cacheRecord.refreshToken);\r\n            }\r\n            if (!!cacheRecord.appMetadata) {\r\n                this.setAppMetadata(cacheRecord.appMetadata);\r\n            }\r\n        }\r\n        catch (e) {\r\n            this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);\r\n            if (e instanceof Error) {\r\n                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);\r\n                if (e.name === \"QuotaExceededError\" ||\r\n                    e.name === \"NS_ERROR_DOM_QUOTA_REACHED\" ||\r\n                    e.message.includes(\"exceeded the quota\")) {\r\n                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);\r\n                    throw new CacheError(cacheQuotaExceededErrorCode);\r\n                }\r\n                else {\r\n                    throw new CacheError(e.name, e.message);\r\n                }\r\n            }\r\n            else {\r\n                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);\r\n                throw new CacheError(cacheUnknownErrorCode);\r\n            }\r\n        }\r\n    }\r\n    /**\r\n     * saves access token credential\r\n     * @param credential\r\n     */\r\n    async saveAccessToken(credential) {\r\n        const accessTokenFilter = {\r\n            clientId: credential.clientId,\r\n            credentialType: credential.credentialType,\r\n            environment: credential.environment,\r\n            homeAccountId: credential.homeAccountId,\r\n            realm: credential.realm,\r\n            tokenType: credential.tokenType,\r\n            requestedClaimsHash: credential.requestedClaimsHash,\r\n        };\r\n        const tokenKeys = this.getTokenKeys();\r\n        const currentScopes = ScopeSet.fromString(credential.target);\r\n        const removedAccessTokens = [];\r\n        tokenKeys.accessToken.forEach((key) => {\r\n            if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {\r\n                return;\r\n            }\r\n            const tokenEntity = this.getAccessTokenCredential(key);\r\n            if (tokenEntity &&\r\n                this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {\r\n                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);\r\n                if (tokenScopeSet.intersectingScopeSets(currentScopes)) {\r\n                    removedAccessTokens.push(this.removeAccessToken(key));\r\n                }\r\n            }\r\n        });\r\n        await Promise.all(removedAccessTokens);\r\n        this.setAccessTokenCredential(credential);\r\n    }\r\n    /**\r\n     * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache\r\n     * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared\r\n     * @param accountFilter - An object containing Account properties to filter by\r\n     */\r\n    getAccountsFilteredBy(accountFilter) {\r\n        const allAccountKeys = this.getAccountKeys();\r\n        const matchingAccounts = [];\r\n        allAccountKeys.forEach((cacheKey) => {\r\n            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId)) {\r\n                // Don't parse value if the key doesn't match the account filters\r\n                return;\r\n            }\r\n            const entity = this.getAccount(cacheKey, this.commonLogger);\r\n            // Match base account fields\r\n            if (!entity) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.homeAccountId &&\r\n                !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.username &&\r\n                !this.matchUsername(entity.username, accountFilter.username)) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.environment &&\r\n                !this.matchEnvironment(entity, accountFilter.environment)) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.realm &&\r\n                !this.matchRealm(entity, accountFilter.realm)) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.nativeAccountId &&\r\n                !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {\r\n                return;\r\n            }\r\n            if (!!accountFilter.authorityType &&\r\n                !this.matchAuthorityType(entity, accountFilter.authorityType)) {\r\n                return;\r\n            }\r\n            // If at least one tenant profile matches the tenant profile filter, add the account to the list of matching accounts\r\n            const tenantProfileFilter = {\r\n                localAccountId: accountFilter?.localAccountId,\r\n                name: accountFilter?.name,\r\n            };\r\n            const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {\r\n                return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);\r\n            });\r\n            if (matchingTenantProfiles && matchingTenantProfiles.length === 0) {\r\n                // No tenant profile for this account matches filter, don't add to list of matching accounts\r\n                return;\r\n            }\r\n            matchingAccounts.push(entity);\r\n        });\r\n        return matchingAccounts;\r\n    }\r\n    /**\r\n     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided\r\n     * @param key\r\n     * @param homeAccountId\r\n     * @param tenantId\r\n     * @returns\r\n     */\r\n    isAccountKey(key, homeAccountId, tenantId) {\r\n        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {\r\n            // Account cache keys contain 3 items separated by '-' (each item may also contain '-')\r\n            return false;\r\n        }\r\n        if (homeAccountId &&\r\n            !key.toLowerCase().includes(homeAccountId.toLowerCase())) {\r\n            return false;\r\n        }\r\n        if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {\r\n            return false;\r\n        }\r\n        // Do not check environment as aliasing can cause false negatives\r\n        return true;\r\n    }\r\n    /**\r\n     * Returns true if the given key matches our credential key schema.\r\n     * @param key\r\n     */\r\n    isCredentialKey(key) {\r\n        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {\r\n            // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')\r\n            return false;\r\n        }\r\n        const lowerCaseKey = key.toLowerCase();\r\n        // Credential keys must indicate what credential type they represent\r\n        if (lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) ===\r\n            -1 &&\r\n            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) ===\r\n                -1 &&\r\n            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) === -1 &&\r\n            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) ===\r\n                -1) {\r\n            return false;\r\n        }\r\n        if (lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) >\r\n            -1) {\r\n            // Refresh tokens must contain the client id or family id\r\n            const clientIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${this.clientId}${Separators.CACHE_KEY_SEPARATOR}`;\r\n            const familyIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${THE_FAMILY_ID}${Separators.CACHE_KEY_SEPARATOR}`;\r\n            if (lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 &&\r\n                lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1) {\r\n                return false;\r\n            }\r\n        }\r\n        else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {\r\n            // Tokens must contain the clientId\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * Returns whether or not the given credential entity matches the filter\r\n     * @param entity\r\n     * @param filter\r\n     * @returns\r\n     */\r\n    credentialMatchesFilter(entity, filter) {\r\n        if (!!filter.clientId && !this.matchClientId(entity, filter.clientId)) {\r\n            return false;\r\n        }\r\n        if (!!filter.userAssertionHash &&\r\n            !this.matchUserAssertionHash(entity, filter.userAssertionHash)) {\r\n            return false;\r\n        }\r\n        /*\r\n         * homeAccountId can be undefined, and we want to filter out cached items that have a homeAccountId of \"\"\r\n         * because we don't want a client_credential request to return a cached token that has a homeAccountId\r\n         */\r\n        if (typeof filter.homeAccountId === \"string\" &&\r\n            !this.matchHomeAccountId(entity, filter.homeAccountId)) {\r\n            return false;\r\n        }\r\n        if (!!filter.environment &&\r\n            !this.matchEnvironment(entity, filter.environment)) {\r\n            return false;\r\n        }\r\n        if (!!filter.realm && !this.matchRealm(entity, filter.realm)) {\r\n            return false;\r\n        }\r\n        if (!!filter.credentialType &&\r\n            !this.matchCredentialType(entity, filter.credentialType)) {\r\n            return false;\r\n        }\r\n        if (!!filter.familyId && !this.matchFamilyId(entity, filter.familyId)) {\r\n            return false;\r\n        }\r\n        /*\r\n         * idTokens do not have \"target\", target specific refreshTokens do exist for some types of authentication\r\n         * Resource specific refresh tokens case will be added when the support is deemed necessary\r\n         */\r\n        if (!!filter.target && !this.matchTarget(entity, filter.target)) {\r\n            return false;\r\n        }\r\n        // If request OR cached entity has requested Claims Hash, check if they match\r\n        if (filter.requestedClaimsHash || entity.requestedClaimsHash) {\r\n            // Don't match if either is undefined or they are different\r\n            if (entity.requestedClaimsHash !== filter.requestedClaimsHash) {\r\n                return false;\r\n            }\r\n        }\r\n        // Access Token with Auth Scheme specific matching\r\n        if (entity.credentialType ===\r\n            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {\r\n            if (!!filter.tokenType &&\r\n                !this.matchTokenType(entity, filter.tokenType)) {\r\n                return false;\r\n            }\r\n            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key\r\n            if (filter.tokenType === AuthenticationScheme.SSH) {\r\n                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {\r\n                    return false;\r\n                }\r\n            }\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * retrieve appMetadata matching all provided filters; if no filter is set, get all appMetadata\r\n     * @param filter\r\n     */\r\n    getAppMetadataFilteredBy(filter) {\r\n        const allCacheKeys = this.getKeys();\r\n        const matchingAppMetadata = {};\r\n        allCacheKeys.forEach((cacheKey) => {\r\n            // don't parse any non-appMetadata type cache entities\r\n            if (!this.isAppMetadata(cacheKey)) {\r\n                return;\r\n            }\r\n            // Attempt retrieval\r\n            const entity = this.getAppMetadata(cacheKey);\r\n            if (!entity) {\r\n                return;\r\n            }\r\n            if (!!filter.environment &&\r\n                !this.matchEnvironment(entity, filter.environment)) {\r\n                return;\r\n            }\r\n            if (!!filter.clientId &&\r\n                !this.matchClientId(entity, filter.clientId)) {\r\n                return;\r\n            }\r\n            matchingAppMetadata[cacheKey] = entity;\r\n        });\r\n        return matchingAppMetadata;\r\n    }\r\n    /**\r\n     * retrieve authorityMetadata that contains a matching alias\r\n     * @param filter\r\n     */\r\n    getAuthorityMetadataByAlias(host) {\r\n        const allCacheKeys = this.getAuthorityMetadataKeys();\r\n        let matchedEntity = null;\r\n        allCacheKeys.forEach((cacheKey) => {\r\n            // don't parse any non-authorityMetadata type cache entities\r\n            if (!this.isAuthorityMetadata(cacheKey) ||\r\n                cacheKey.indexOf(this.clientId) === -1) {\r\n                return;\r\n            }\r\n            // Attempt retrieval\r\n            const entity = this.getAuthorityMetadata(cacheKey);\r\n            if (!entity) {\r\n                return;\r\n            }\r\n            if (entity.aliases.indexOf(host) === -1) {\r\n                return;\r\n            }\r\n            matchedEntity = entity;\r\n        });\r\n        return matchedEntity;\r\n    }\r\n    /**\r\n     * Removes all accounts and related tokens from cache.\r\n     */\r\n    async removeAllAccounts() {\r\n        const allAccountKeys = this.getAccountKeys();\r\n        const removedAccounts = [];\r\n        allAccountKeys.forEach((cacheKey) => {\r\n            removedAccounts.push(this.removeAccount(cacheKey));\r\n        });\r\n        await Promise.all(removedAccounts);\r\n    }\r\n    /**\r\n     * Removes the account and related tokens for a given account key\r\n     * @param account\r\n     */\r\n    async removeAccount(accountKey) {\r\n        const account = this.getAccount(accountKey, this.commonLogger);\r\n        if (!account) {\r\n            return;\r\n        }\r\n        await this.removeAccountContext(account);\r\n        this.removeItem(accountKey);\r\n    }\r\n    /**\r\n     * Removes credentials associated with the provided account\r\n     * @param account\r\n     */\r\n    async removeAccountContext(account) {\r\n        const allTokenKeys = this.getTokenKeys();\r\n        const accountId = account.generateAccountId();\r\n        const removedCredentials = [];\r\n        allTokenKeys.idToken.forEach((key) => {\r\n            if (key.indexOf(accountId) === 0) {\r\n                this.removeIdToken(key);\r\n            }\r\n        });\r\n        allTokenKeys.accessToken.forEach((key) => {\r\n            if (key.indexOf(accountId) === 0) {\r\n                removedCredentials.push(this.removeAccessToken(key));\r\n            }\r\n        });\r\n        allTokenKeys.refreshToken.forEach((key) => {\r\n            if (key.indexOf(accountId) === 0) {\r\n                this.removeRefreshToken(key);\r\n            }\r\n        });\r\n        await Promise.all(removedCredentials);\r\n    }\r\n    /**\r\n     * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the\r\n     * cache into a condensed multi-tenant account object with tenant profiles.\r\n     * @param accountKey\r\n     * @param accountEntity\r\n     * @param logger\r\n     * @returns\r\n     */\r\n    updateOutdatedCachedAccount(accountKey, accountEntity, logger) {\r\n        // Only update if account entity is defined and has no tenantProfiles object (is outdated)\r\n        if (accountEntity && accountEntity.isSingleTenant()) {\r\n            this.commonLogger?.verbose(\"updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity\");\r\n            // Get keys of all accounts belonging to user\r\n            const matchingAccountKeys = this.getAccountKeys().filter((key) => {\r\n                return key.startsWith(accountEntity.homeAccountId);\r\n            });\r\n            // Get all account entities belonging to user\r\n            const accountsToMerge = [];\r\n            matchingAccountKeys.forEach((key) => {\r\n                const account = this.getCachedAccountEntity(key);\r\n                if (account) {\r\n                    accountsToMerge.push(account);\r\n                }\r\n            });\r\n            // Set base account to home account if available, any account if not\r\n            const baseAccount = accountsToMerge.find((account) => {\r\n                return tenantIdMatchesHomeTenant(account.realm, account.homeAccountId);\r\n            }) || accountsToMerge[0];\r\n            // Populate tenant profiles built from each account entity belonging to the user\r\n            baseAccount.tenantProfiles = accountsToMerge.map((account) => {\r\n                return {\r\n                    tenantId: account.realm,\r\n                    localAccountId: account.localAccountId,\r\n                    name: account.name,\r\n                    isHomeTenant: tenantIdMatchesHomeTenant(account.realm, account.homeAccountId),\r\n                };\r\n            });\r\n            const updatedAccount = CacheManager.toObject(new AccountEntity(), {\r\n                ...baseAccount,\r\n            });\r\n            const newAccountKey = updatedAccount.generateAccountKey();\r\n            // Clear cache of legacy account objects that have been collpsed into tenant profiles\r\n            matchingAccountKeys.forEach((key) => {\r\n                if (key !== newAccountKey) {\r\n                    this.removeOutdatedAccount(accountKey);\r\n                }\r\n            });\r\n            // Cache updated account object\r\n            this.setAccount(updatedAccount);\r\n            logger?.verbose(\"Updated an outdated account entity in the cache\");\r\n            return updatedAccount;\r\n        }\r\n        // No update is necessary\r\n        return accountEntity;\r\n    }\r\n    /**\r\n     * returns a boolean if the given credential is removed\r\n     * @param credential\r\n     */\r\n    async removeAccessToken(key) {\r\n        const credential = this.getAccessTokenCredential(key);\r\n        if (!credential) {\r\n            return;\r\n        }\r\n        // Remove Token Binding Key from key store for PoP Tokens Credentials\r\n        if (credential.credentialType.toLowerCase() ===\r\n            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {\r\n            if (credential.tokenType === AuthenticationScheme.POP) {\r\n                const accessTokenWithAuthSchemeEntity = credential;\r\n                const kid = accessTokenWithAuthSchemeEntity.keyId;\r\n                if (kid) {\r\n                    try {\r\n                        await this.cryptoImpl.removeTokenBindingKey(kid);\r\n                    }\r\n                    catch (error) {\r\n                        throw createClientAuthError(bindingKeyNotRemoved);\r\n                    }\r\n                }\r\n            }\r\n        }\r\n        return this.removeItem(key);\r\n    }\r\n    /**\r\n     * Removes all app metadata objects from cache.\r\n     */\r\n    removeAppMetadata() {\r\n        const allCacheKeys = this.getKeys();\r\n        allCacheKeys.forEach((cacheKey) => {\r\n            if (this.isAppMetadata(cacheKey)) {\r\n                this.removeItem(cacheKey);\r\n            }\r\n        });\r\n        return true;\r\n    }\r\n    /**\r\n     * Retrieve AccountEntity from cache\r\n     * @param account\r\n     */\r\n    readAccountFromCache(account) {\r\n        const accountKey = AccountEntity.generateAccountCacheKey(account);\r\n        return this.getAccount(accountKey, this.commonLogger);\r\n    }\r\n    /**\r\n     * Retrieve IdTokenEntity from cache\r\n     * @param account {AccountInfo}\r\n     * @param tokenKeys {?TokenKeys}\r\n     * @param targetRealm {?string}\r\n     * @param performanceClient {?IPerformanceClient}\r\n     * @param correlationId {?string}\r\n     */\r\n    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {\r\n        this.commonLogger.trace(\"CacheManager - getIdToken called\");\r\n        const idTokenFilter = {\r\n            homeAccountId: account.homeAccountId,\r\n            environment: account.environment,\r\n            credentialType: CredentialType.ID_TOKEN,\r\n            clientId: this.clientId,\r\n            realm: targetRealm,\r\n        };\r\n        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);\r\n        const numIdTokens = idTokenMap.size;\r\n        if (numIdTokens < 1) {\r\n            this.commonLogger.info(\"CacheManager:getIdToken - No token found\");\r\n            return null;\r\n        }\r\n        else if (numIdTokens > 1) {\r\n            let tokensToBeRemoved = idTokenMap;\r\n            // Multiple tenant profiles and no tenant specified, pick home account\r\n            if (!targetRealm) {\r\n                const homeIdTokenMap = new Map();\r\n                idTokenMap.forEach((idToken, key) => {\r\n                    if (idToken.realm === account.tenantId) {\r\n                        homeIdTokenMap.set(key, idToken);\r\n                    }\r\n                });\r\n                const numHomeIdTokens = homeIdTokenMap.size;\r\n                if (numHomeIdTokens < 1) {\r\n                    this.commonLogger.info(\"CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result\");\r\n                    return idTokenMap.values().next().value;\r\n                }\r\n                else if (numHomeIdTokens === 1) {\r\n                    this.commonLogger.info(\"CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile\");\r\n                    return homeIdTokenMap.values().next().value;\r\n                }\r\n                else {\r\n                    // Multiple ID tokens for home tenant profile, remove all and return null\r\n                    tokensToBeRemoved = homeIdTokenMap;\r\n                }\r\n            }\r\n            // Multiple tokens for a single tenant profile, remove all and return null\r\n            this.commonLogger.info(\"CacheManager:getIdToken - Multiple matching ID tokens found, clearing them\");\r\n            tokensToBeRemoved.forEach((idToken, key) => {\r\n                this.removeIdToken(key);\r\n            });\r\n            if (performanceClient && correlationId) {\r\n                performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);\r\n            }\r\n            return null;\r\n        }\r\n        this.commonLogger.info(\"CacheManager:getIdToken - Returning ID token\");\r\n        return idTokenMap.values().next().value;\r\n    }\r\n    /**\r\n     * Gets all idTokens matching the given filter\r\n     * @param filter\r\n     * @returns\r\n     */\r\n    getIdTokensByFilter(filter, tokenKeys) {\r\n        const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;\r\n        const idTokens = new Map();\r\n        idTokenKeys.forEach((key) => {\r\n            if (!this.idTokenKeyMatchesFilter(key, {\r\n                clientId: this.clientId,\r\n                ...filter,\r\n            })) {\r\n                return;\r\n            }\r\n            const idToken = this.getIdTokenCredential(key);\r\n            if (idToken && this.credentialMatchesFilter(idToken, filter)) {\r\n                idTokens.set(key, idToken);\r\n            }\r\n        });\r\n        return idTokens;\r\n    }\r\n    /**\r\n     * Validate the cache key against filter before retrieving and parsing cache value\r\n     * @param key\r\n     * @param filter\r\n     * @returns\r\n     */\r\n    idTokenKeyMatchesFilter(inputKey, filter) {\r\n        const key = inputKey.toLowerCase();\r\n        if (filter.clientId &&\r\n            key.indexOf(filter.clientId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.homeAccountId &&\r\n            key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * Removes idToken from the cache\r\n     * @param key\r\n     */\r\n    removeIdToken(key) {\r\n        this.removeItem(key);\r\n    }\r\n    /**\r\n     * Removes refresh token from the cache\r\n     * @param key\r\n     */\r\n    removeRefreshToken(key) {\r\n        this.removeItem(key);\r\n    }\r\n    /**\r\n     * Retrieve AccessTokenEntity from cache\r\n     * @param account {AccountInfo}\r\n     * @param request {BaseAuthRequest}\r\n     * @param tokenKeys {?TokenKeys}\r\n     * @param performanceClient {?IPerformanceClient}\r\n     * @param correlationId {?string}\r\n     */\r\n    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {\r\n        this.commonLogger.trace(\"CacheManager - getAccessToken called\");\r\n        const scopes = ScopeSet.createSearchScopes(request.scopes);\r\n        const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;\r\n        /*\r\n         * Distinguish between Bearer and PoP/SSH token cache types\r\n         * Cast to lowercase to handle \"bearer\" from ADFS\r\n         */\r\n        const credentialType = authScheme &&\r\n            authScheme.toLowerCase() !==\r\n                AuthenticationScheme.BEARER.toLowerCase()\r\n            ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME\r\n            : CredentialType.ACCESS_TOKEN;\r\n        const accessTokenFilter = {\r\n            homeAccountId: account.homeAccountId,\r\n            environment: account.environment,\r\n            credentialType: credentialType,\r\n            clientId: this.clientId,\r\n            realm: targetRealm || account.tenantId,\r\n            target: scopes,\r\n            tokenType: authScheme,\r\n            keyId: request.sshKid,\r\n            requestedClaimsHash: request.requestedClaimsHash,\r\n        };\r\n        const accessTokenKeys = (tokenKeys && tokenKeys.accessToken) ||\r\n            this.getTokenKeys().accessToken;\r\n        const accessTokens = [];\r\n        accessTokenKeys.forEach((key) => {\r\n            // Validate key\r\n            if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {\r\n                const accessToken = this.getAccessTokenCredential(key);\r\n                // Validate value\r\n                if (accessToken &&\r\n                    this.credentialMatchesFilter(accessToken, accessTokenFilter)) {\r\n                    accessTokens.push(accessToken);\r\n                }\r\n            }\r\n        });\r\n        const numAccessTokens = accessTokens.length;\r\n        if (numAccessTokens < 1) {\r\n            this.commonLogger.info(\"CacheManager:getAccessToken - No token found\");\r\n            return null;\r\n        }\r\n        else if (numAccessTokens > 1) {\r\n            this.commonLogger.info(\"CacheManager:getAccessToken - Multiple access tokens found, clearing them\");\r\n            accessTokens.forEach((accessToken) => {\r\n                void this.removeAccessToken(generateCredentialKey(accessToken));\r\n            });\r\n            if (performanceClient && correlationId) {\r\n                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);\r\n            }\r\n            return null;\r\n        }\r\n        this.commonLogger.info(\"CacheManager:getAccessToken - Returning access token\");\r\n        return accessTokens[0];\r\n    }\r\n    /**\r\n     * Validate the cache key against filter before retrieving and parsing cache value\r\n     * @param key\r\n     * @param filter\r\n     * @param keyMustContainAllScopes\r\n     * @returns\r\n     */\r\n    accessTokenKeyMatchesFilter(inputKey, filter, keyMustContainAllScopes) {\r\n        const key = inputKey.toLowerCase();\r\n        if (filter.clientId &&\r\n            key.indexOf(filter.clientId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.homeAccountId &&\r\n            key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.realm && key.indexOf(filter.realm.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.requestedClaimsHash &&\r\n            key.indexOf(filter.requestedClaimsHash.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.target) {\r\n            const scopes = filter.target.asArray();\r\n            for (let i = 0; i < scopes.length; i++) {\r\n                if (keyMustContainAllScopes &&\r\n                    !key.includes(scopes[i].toLowerCase())) {\r\n                    // When performing a cache lookup a missing scope would be a cache miss\r\n                    return false;\r\n                }\r\n                else if (!keyMustContainAllScopes &&\r\n                    key.includes(scopes[i].toLowerCase())) {\r\n                    // When performing a cache write, any token with a subset of requested scopes should be replaced\r\n                    return true;\r\n                }\r\n            }\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * Gets all access tokens matching the filter\r\n     * @param filter\r\n     * @returns\r\n     */\r\n    getAccessTokensByFilter(filter) {\r\n        const tokenKeys = this.getTokenKeys();\r\n        const accessTokens = [];\r\n        tokenKeys.accessToken.forEach((key) => {\r\n            if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {\r\n                return;\r\n            }\r\n            const accessToken = this.getAccessTokenCredential(key);\r\n            if (accessToken &&\r\n                this.credentialMatchesFilter(accessToken, filter)) {\r\n                accessTokens.push(accessToken);\r\n            }\r\n        });\r\n        return accessTokens;\r\n    }\r\n    /**\r\n     * Helper to retrieve the appropriate refresh token from cache\r\n     * @param account {AccountInfo}\r\n     * @param familyRT {boolean}\r\n     * @param tokenKeys {?TokenKeys}\r\n     * @param performanceClient {?IPerformanceClient}\r\n     * @param correlationId {?string}\r\n     */\r\n    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {\r\n        this.commonLogger.trace(\"CacheManager - getRefreshToken called\");\r\n        const id = familyRT ? THE_FAMILY_ID : undefined;\r\n        const refreshTokenFilter = {\r\n            homeAccountId: account.homeAccountId,\r\n            environment: account.environment,\r\n            credentialType: CredentialType.REFRESH_TOKEN,\r\n            clientId: this.clientId,\r\n            familyId: id,\r\n        };\r\n        const refreshTokenKeys = (tokenKeys && tokenKeys.refreshToken) ||\r\n            this.getTokenKeys().refreshToken;\r\n        const refreshTokens = [];\r\n        refreshTokenKeys.forEach((key) => {\r\n            // Validate key\r\n            if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {\r\n                const refreshToken = this.getRefreshTokenCredential(key);\r\n                // Validate value\r\n                if (refreshToken &&\r\n                    this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {\r\n                    refreshTokens.push(refreshToken);\r\n                }\r\n            }\r\n        });\r\n        const numRefreshTokens = refreshTokens.length;\r\n        if (numRefreshTokens < 1) {\r\n            this.commonLogger.info(\"CacheManager:getRefreshToken - No refresh token found.\");\r\n            return null;\r\n        }\r\n        // address the else case after remove functions address environment aliases\r\n        if (numRefreshTokens > 1 && performanceClient && correlationId) {\r\n            performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);\r\n        }\r\n        this.commonLogger.info(\"CacheManager:getRefreshToken - returning refresh token\");\r\n        return refreshTokens[0];\r\n    }\r\n    /**\r\n     * Validate the cache key against filter before retrieving and parsing cache value\r\n     * @param key\r\n     * @param filter\r\n     */\r\n    refreshTokenKeyMatchesFilter(inputKey, filter) {\r\n        const key = inputKey.toLowerCase();\r\n        if (filter.familyId &&\r\n            key.indexOf(filter.familyId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        // If familyId is used, clientId is not in the key\r\n        if (!filter.familyId &&\r\n            filter.clientId &&\r\n            key.indexOf(filter.clientId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        if (filter.homeAccountId &&\r\n            key.indexOf(filter.homeAccountId.toLowerCase()) === -1) {\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    /**\r\n     * Retrieve AppMetadataEntity from cache\r\n     */\r\n    readAppMetadataFromCache(environment) {\r\n        const appMetadataFilter = {\r\n            environment,\r\n            clientId: this.clientId,\r\n        };\r\n        const appMetadata = this.getAppMetadataFilteredBy(appMetadataFilter);\r\n        const appMetadataEntries = Object.keys(appMetadata).map((key) => appMetadata[key]);\r\n        const numAppMetadata = appMetadataEntries.length;\r\n        if (numAppMetadata < 1) {\r\n            return null;\r\n        }\r\n        else if (numAppMetadata > 1) {\r\n            throw createClientAuthError(multipleMatchingAppMetadata);\r\n        }\r\n        return appMetadataEntries[0];\r\n    }\r\n    /**\r\n     * Return the family_id value associated  with FOCI\r\n     * @param environment\r\n     * @param clientId\r\n     */\r\n    isAppMetadataFOCI(environment) {\r\n        const appMetadata = this.readAppMetadataFromCache(environment);\r\n        return !!(appMetadata && appMetadata.familyId === THE_FAMILY_ID);\r\n    }\r\n    /**\r\n     * helper to match account ids\r\n     * @param value\r\n     * @param homeAccountId\r\n     */\r\n    matchHomeAccountId(entity, homeAccountId) {\r\n        return !!(typeof entity.homeAccountId === \"string\" &&\r\n            homeAccountId === entity.homeAccountId);\r\n    }\r\n    /**\r\n     * helper to match account ids\r\n     * @param entity\r\n     * @param localAccountId\r\n     * @returns\r\n     */\r\n    matchLocalAccountIdFromTokenClaims(tokenClaims, localAccountId) {\r\n        const idTokenLocalAccountId = tokenClaims.oid || tokenClaims.sub;\r\n        return localAccountId === idTokenLocalAccountId;\r\n    }\r\n    matchLocalAccountIdFromTenantProfile(tenantProfile, localAccountId) {\r\n        return tenantProfile.localAccountId === localAccountId;\r\n    }\r\n    /**\r\n     * helper to match names\r\n     * @param entity\r\n     * @param name\r\n     * @returns true if the downcased name properties are present and match in the filter and the entity\r\n     */\r\n    matchName(claims, name) {\r\n        return !!(name.toLowerCase() === claims.name?.toLowerCase());\r\n    }\r\n    /**\r\n     * helper to match usernames\r\n     * @param entity\r\n     * @param username\r\n     * @returns\r\n     */\r\n    matchUsername(cachedUsername, filterUsername) {\r\n        return !!(cachedUsername &&\r\n            typeof cachedUsername === \"string\" &&\r\n            filterUsername?.toLowerCase() === cachedUsername.toLowerCase());\r\n    }\r\n    /**\r\n     * helper to match assertion\r\n     * @param value\r\n     * @param oboAssertion\r\n     */\r\n    matchUserAssertionHash(entity, userAssertionHash) {\r\n        return !!(entity.userAssertionHash &&\r\n            userAssertionHash === entity.userAssertionHash);\r\n    }\r\n    /**\r\n     * helper to match environment\r\n     * @param value\r\n     * @param environment\r\n     */\r\n    matchEnvironment(entity, environment) {\r\n        // Check static authority options first for cases where authority metadata has not been resolved and cached yet\r\n        if (this.staticAuthorityOptions) {\r\n            const staticAliases = getAliasesFromStaticSources(this.staticAuthorityOptions, this.commonLogger);\r\n            if (staticAliases.includes(environment) &&\r\n                staticAliases.includes(entity.environment)) {\r\n                return true;\r\n            }\r\n        }\r\n        // Query metadata cache if no static authority configuration has aliases that match enviroment\r\n        const cloudMetadata = this.getAuthorityMetadataByAlias(environment);\r\n        if (cloudMetadata &&\r\n            cloudMetadata.aliases.indexOf(entity.environment) > -1) {\r\n            return true;\r\n        }\r\n        return false;\r\n    }\r\n    /**\r\n     * helper to match credential type\r\n     * @param entity\r\n     * @param credentialType\r\n     */\r\n    matchCredentialType(entity, credentialType) {\r\n        return (entity.credentialType &&\r\n            credentialType.toLowerCase() === entity.credentialType.toLowerCase());\r\n    }\r\n    /**\r\n     * helper to match client ids\r\n     * @param entity\r\n     * @param clientId\r\n     */\r\n    matchClientId(entity, clientId) {\r\n        return !!(entity.clientId && clientId === entity.clientId);\r\n    }\r\n    /**\r\n     * helper to match family ids\r\n     * @param entity\r\n     * @param familyId\r\n     */\r\n    matchFamilyId(entity, familyId) {\r\n        return !!(entity.familyId && familyId === entity.familyId);\r\n    }\r\n    /**\r\n     * helper to match realm\r\n     * @param entity\r\n     * @param realm\r\n     */\r\n    matchRealm(entity, realm) {\r\n        return !!(entity.realm?.toLowerCase() === realm.toLowerCase());\r\n    }\r\n    /**\r\n     * helper to match nativeAccountId\r\n     * @param entity\r\n     * @param nativeAccountId\r\n     * @returns boolean indicating the match result\r\n     */\r\n    matchNativeAccountId(entity, nativeAccountId) {\r\n        return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);\r\n    }\r\n    /**\r\n     * helper to match loginHint which can be either:\r\n     * 1. login_hint ID token claim\r\n     * 2. username in cached account object\r\n     * 3. upn in ID token claims\r\n     * @param entity\r\n     * @param loginHint\r\n     * @returns\r\n     */\r\n    matchLoginHintFromTokenClaims(tokenClaims, loginHint) {\r\n        if (tokenClaims.login_hint === loginHint) {\r\n            return true;\r\n        }\r\n        if (tokenClaims.preferred_username === loginHint) {\r\n            return true;\r\n        }\r\n        if (tokenClaims.upn === loginHint) {\r\n            return true;\r\n        }\r\n        return false;\r\n    }\r\n    /**\r\n     * Helper to match sid\r\n     * @param entity\r\n     * @param sid\r\n     * @returns true if the sid claim is present and matches the filter\r\n     */\r\n    matchSid(idTokenClaims, sid) {\r\n        return idTokenClaims.sid === sid;\r\n    }\r\n    matchAuthorityType(entity, authorityType) {\r\n        return !!(entity.authorityType &&\r\n            authorityType.toLowerCase() === entity.authorityType.toLowerCase());\r\n    }\r\n    /**\r\n     * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.\r\n     * @param entity\r\n     * @param target\r\n     */\r\n    matchTarget(entity, target) {\r\n        const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&\r\n            entity.credentialType !==\r\n                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;\r\n        if (isNotAccessTokenCredential || !entity.target) {\r\n            return false;\r\n        }\r\n        const entityScopeSet = ScopeSet.fromString(entity.target);\r\n        return entityScopeSet.containsScopeSet(target);\r\n    }\r\n    /**\r\n     * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise\r\n     * @param entity\r\n     * @param tokenType\r\n     */\r\n    matchTokenType(entity, tokenType) {\r\n        return !!(entity.tokenType && entity.tokenType === tokenType);\r\n    }\r\n    /**\r\n     * Returns true if the credential's keyId matches the one in the request, false otherwise\r\n     * @param entity\r\n     * @param keyId\r\n     */\r\n    matchKeyId(entity, keyId) {\r\n        return !!(entity.keyId && entity.keyId === keyId);\r\n    }\r\n    /**\r\n     * returns if a given cache entity is of the type appmetadata\r\n     * @param key\r\n     */\r\n    isAppMetadata(key) {\r\n        return key.indexOf(APP_METADATA) !== -1;\r\n    }\r\n    /**\r\n     * returns if a given cache entity is of the type authoritymetadata\r\n     * @param key\r\n     */\r\n    isAuthorityMetadata(key) {\r\n        return key.indexOf(AUTHORITY_METADATA_CONSTANTS.CACHE_KEY) !== -1;\r\n    }\r\n    /**\r\n     * returns cache key used for cloud instance metadata\r\n     */\r\n    generateAuthorityMetadataCacheKey(authority) {\r\n        return `${AUTHORITY_METADATA_CONSTANTS.CACHE_KEY}-${this.clientId}-${authority}`;\r\n    }\r\n    /**\r\n     * Helper to convert serialized data to object\r\n     * @param obj\r\n     * @param json\r\n     */\r\n    static toObject(obj, json) {\r\n        for (const propertyName in json) {\r\n            obj[propertyName] = json[propertyName];\r\n        }\r\n        return obj;\r\n    }\r\n}\r\n/** @internal */\r\nclass DefaultStorageClass extends CacheManager {\r\n    setAccount() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAccount() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getCachedAccountEntity() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setIdTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getIdTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setAccessTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAccessTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setRefreshTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getRefreshTokenCredential() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setAppMetadata() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAppMetadata() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setServerTelemetry() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getServerTelemetry() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setAuthorityMetadata() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAuthorityMetadata() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAuthorityMetadataKeys() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    setThrottlingCache() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getThrottlingCache() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    removeItem() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getKeys() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getAccountKeys() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    getTokenKeys() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    async clear() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    updateCredentialCacheKey() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n    removeOutdatedAccount() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    }\r\n}\n\nexport { CacheManager, DefaultStorageClass };\n//# sourceMappingURL=CacheManager.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { Separators, CacheAccountType } from '../../utils/Constants.mjs';\nimport { buildClientInfo } from '../../account/ClientInfo.mjs';\nimport { buildTenantProfile } from '../../account/AccountInfo.mjs';\nimport { createClientAuthError } from '../../error/ClientAuthError.mjs';\nimport { AuthorityType } from '../../authority/AuthorityType.mjs';\nimport { getTenantIdFromIdTokenClaims } from '../../account/TokenClaims.mjs';\nimport { ProtocolMode } from '../../authority/ProtocolMode.mjs';\nimport { invalidCacheEnvironment } from '../../error/ClientAuthErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).\r\n *\r\n * Key : Value Schema\r\n *\r\n * Key: <home_account_id>-<environment>-<realm*>\r\n *\r\n * Value Schema:\r\n * {\r\n *      homeAccountId: home account identifier for the auth scheme,\r\n *      environment: entity that issued the token, represented as a full host\r\n *      realm: Full tenant or organizational identifier that the account belongs to\r\n *      localAccountId: Original tenant-specific accountID, usually used for legacy cases\r\n *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt\r\n *      authorityType: Accounts authority type as a string\r\n *      name: Full name for the account, including given name and family name,\r\n *      lastModificationTime: last time this entity was modified in the cache\r\n *      lastModificationApp:\r\n *      nativeAccountId: Account identifier on the native device\r\n *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser\r\n * }\r\n * @internal\r\n */\r\nclass AccountEntity {\r\n    /**\r\n     * Generate Account Id key component as per the schema: <home_account_id>-<environment>\r\n     */\r\n    generateAccountId() {\r\n        const accountId = [this.homeAccountId, this.environment];\r\n        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();\r\n    }\r\n    /**\r\n     * Generate Account Cache Key as per the schema: <home_account_id>-<environment>-<realm*>\r\n     */\r\n    generateAccountKey() {\r\n        return AccountEntity.generateAccountCacheKey({\r\n            homeAccountId: this.homeAccountId,\r\n            environment: this.environment,\r\n            tenantId: this.realm,\r\n            username: this.username,\r\n            localAccountId: this.localAccountId,\r\n        });\r\n    }\r\n    /**\r\n     * Returns the AccountInfo interface for this account.\r\n     */\r\n    getAccountInfo() {\r\n        return {\r\n            homeAccountId: this.homeAccountId,\r\n            environment: this.environment,\r\n            tenantId: this.realm,\r\n            username: this.username,\r\n            localAccountId: this.localAccountId,\r\n            name: this.name,\r\n            nativeAccountId: this.nativeAccountId,\r\n            authorityType: this.authorityType,\r\n            // Deserialize tenant profiles array into a Map\r\n            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {\r\n                return [tenantProfile.tenantId, tenantProfile];\r\n            })),\r\n        };\r\n    }\r\n    /**\r\n     * Returns true if the account entity is in single tenant format (outdated), false otherwise\r\n     */\r\n    isSingleTenant() {\r\n        return !this.tenantProfiles;\r\n    }\r\n    /**\r\n     * Generates account key from interface\r\n     * @param accountInterface\r\n     */\r\n    static generateAccountCacheKey(accountInterface) {\r\n        const homeTenantId = accountInterface.homeAccountId.split(\".\")[1];\r\n        const accountKey = [\r\n            accountInterface.homeAccountId,\r\n            accountInterface.environment || \"\",\r\n            homeTenantId || accountInterface.tenantId || \"\",\r\n        ];\r\n        return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();\r\n    }\r\n    /**\r\n     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.\r\n     * @param accountDetails\r\n     */\r\n    static createAccount(accountDetails, authority, base64Decode) {\r\n        const account = new AccountEntity();\r\n        if (authority.authorityType === AuthorityType.Adfs) {\r\n            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;\r\n        }\r\n        else if (authority.protocolMode === ProtocolMode.AAD) {\r\n            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;\r\n        }\r\n        else {\r\n            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;\r\n        }\r\n        let clientInfo;\r\n        if (accountDetails.clientInfo && base64Decode) {\r\n            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);\r\n        }\r\n        account.clientInfo = accountDetails.clientInfo;\r\n        account.homeAccountId = accountDetails.homeAccountId;\r\n        account.nativeAccountId = accountDetails.nativeAccountId;\r\n        const env = accountDetails.environment ||\r\n            (authority && authority.getPreferredCache());\r\n        if (!env) {\r\n            throw createClientAuthError(invalidCacheEnvironment);\r\n        }\r\n        account.environment = env;\r\n        // non AAD scenarios can have empty realm\r\n        account.realm =\r\n            clientInfo?.utid ||\r\n                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||\r\n                \"\";\r\n        // How do you account for MSA CID here?\r\n        account.localAccountId =\r\n            clientInfo?.uid ||\r\n                accountDetails.idTokenClaims?.oid ||\r\n                accountDetails.idTokenClaims?.sub ||\r\n                \"\";\r\n        /*\r\n         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.\r\n         * In most cases it will contain a single email. This field should not be relied upon if a custom\r\n         * policy is configured to return more than 1 email.\r\n         */\r\n        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||\r\n            accountDetails.idTokenClaims?.upn;\r\n        const email = accountDetails.idTokenClaims?.emails\r\n            ? accountDetails.idTokenClaims.emails[0]\r\n            : null;\r\n        account.username = preferredUsername || email || \"\";\r\n        account.name = accountDetails.idTokenClaims?.name || \"\";\r\n        account.cloudGraphHostName = accountDetails.cloudGraphHostName;\r\n        account.msGraphHost = accountDetails.msGraphHost;\r\n        if (accountDetails.tenantProfiles) {\r\n            account.tenantProfiles = accountDetails.tenantProfiles;\r\n        }\r\n        else {\r\n            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);\r\n            account.tenantProfiles = [tenantProfile];\r\n        }\r\n        return account;\r\n    }\r\n    /**\r\n     * Creates an AccountEntity object from AccountInfo\r\n     * @param accountInfo\r\n     * @param cloudGraphHostName\r\n     * @param msGraphHost\r\n     * @returns\r\n     */\r\n    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {\r\n        const account = new AccountEntity();\r\n        account.authorityType =\r\n            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;\r\n        account.homeAccountId = accountInfo.homeAccountId;\r\n        account.localAccountId = accountInfo.localAccountId;\r\n        account.nativeAccountId = accountInfo.nativeAccountId;\r\n        account.realm = accountInfo.tenantId;\r\n        account.environment = accountInfo.environment;\r\n        account.username = accountInfo.username;\r\n        account.name = accountInfo.name;\r\n        account.cloudGraphHostName = cloudGraphHostName;\r\n        account.msGraphHost = msGraphHost;\r\n        // Serialize tenant profiles map into an array\r\n        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);\r\n        return account;\r\n    }\r\n    /**\r\n     * Generate HomeAccountId from server response\r\n     * @param serverClientInfo\r\n     * @param authType\r\n     */\r\n    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {\r\n        // since ADFS/DSTS do not have tid and does not set client_info\r\n        if (!(authType === AuthorityType.Adfs ||\r\n            authType === AuthorityType.Dsts)) {\r\n            // for cases where there is clientInfo\r\n            if (serverClientInfo) {\r\n                try {\r\n                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);\r\n                    if (clientInfo.uid && clientInfo.utid) {\r\n                        return `${clientInfo.uid}.${clientInfo.utid}`;\r\n                    }\r\n                }\r\n                catch (e) { }\r\n            }\r\n            logger.warning(\"No client info in response\");\r\n        }\r\n        // default to \"sub\" claim\r\n        return idTokenClaims?.sub || \"\";\r\n    }\r\n    /**\r\n     * Validates an entity: checks for all expected params\r\n     * @param entity\r\n     */\r\n    static isAccountEntity(entity) {\r\n        if (!entity) {\r\n            return false;\r\n        }\r\n        return (entity.hasOwnProperty(\"homeAccountId\") &&\r\n            entity.hasOwnProperty(\"environment\") &&\r\n            entity.hasOwnProperty(\"realm\") &&\r\n            entity.hasOwnProperty(\"localAccountId\") &&\r\n            entity.hasOwnProperty(\"username\") &&\r\n            entity.hasOwnProperty(\"authorityType\"));\r\n    }\r\n    /**\r\n     * Helper function to determine whether 2 accountInfo objects represent the same account\r\n     * @param accountA\r\n     * @param accountB\r\n     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality\r\n     */\r\n    static accountInfoIsEqual(accountA, accountB, compareClaims) {\r\n        if (!accountA || !accountB) {\r\n            return false;\r\n        }\r\n        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false\r\n        if (compareClaims) {\r\n            const accountAClaims = (accountA.idTokenClaims ||\r\n                {});\r\n            const accountBClaims = (accountB.idTokenClaims ||\r\n                {});\r\n            // issued at timestamp and nonce are expected to change each time a new id token is acquired\r\n            claimsMatch =\r\n                accountAClaims.iat === accountBClaims.iat &&\r\n                    accountAClaims.nonce === accountBClaims.nonce;\r\n        }\r\n        return (accountA.homeAccountId === accountB.homeAccountId &&\r\n            accountA.localAccountId === accountB.localAccountId &&\r\n            accountA.username === accountB.username &&\r\n            accountA.tenantId === accountB.tenantId &&\r\n            accountA.environment === accountB.environment &&\r\n            accountA.nativeAccountId === accountB.nativeAccountId &&\r\n            claimsMatch);\r\n    }\r\n}\n\nexport { AccountEntity };\n//# sourceMappingURL=AccountEntity.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * This class instance helps track the memory changes facilitating\r\n * decisions to read from and write to the persistent cache\r\n */ class TokenCacheContext {\r\n    constructor(tokenCache, hasChanged) {\r\n        this.cache = tokenCache;\r\n        this.hasChanged = hasChanged;\r\n    }\r\n    /**\r\n     * boolean which indicates the changes in cache\r\n     */\r\n    get cacheHasChanged() {\r\n        return this.hasChanged;\r\n    }\r\n    /**\r\n     * function to retrieve the token cache\r\n     */\r\n    get tokenCache() {\r\n        return this.cache;\r\n    }\r\n}\n\nexport { TokenCacheContext };\n//# sourceMappingURL=TokenCacheContext.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { extractTokenClaims } from '../../account/AuthToken.mjs';\nimport { createClientAuthError } from '../../error/ClientAuthError.mjs';\nimport { Separators, CredentialType, AuthenticationScheme, SERVER_TELEM_CONSTANTS, ThrottlingConstants, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../../utils/Constants.mjs';\nimport { nowSeconds } from '../../utils/TimeUtils.mjs';\nimport { tokenClaimsCnfRequiredForSignedJwt } from '../../error/ClientAuthErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Cache Key: <home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>\r\n * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com\r\n * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop\r\n * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com\r\n * @param credentialEntity\r\n * @returns\r\n */\r\nfunction generateCredentialKey(credentialEntity) {\r\n    const credentialKey = [\r\n        generateAccountId(credentialEntity),\r\n        generateCredentialId(credentialEntity),\r\n        generateTarget(credentialEntity),\r\n        generateClaimsHash(credentialEntity),\r\n        generateScheme(credentialEntity),\r\n    ];\r\n    return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();\r\n}\r\n/**\r\n * Create IdTokenEntity\r\n * @param homeAccountId\r\n * @param authenticationResult\r\n * @param clientId\r\n * @param authority\r\n */\r\nfunction createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {\r\n    const idTokenEntity = {\r\n        credentialType: CredentialType.ID_TOKEN,\r\n        homeAccountId: homeAccountId,\r\n        environment: environment,\r\n        clientId: clientId,\r\n        secret: idToken,\r\n        realm: tenantId,\r\n    };\r\n    return idTokenEntity;\r\n}\r\n/**\r\n * Create AccessTokenEntity\r\n * @param homeAccountId\r\n * @param environment\r\n * @param accessToken\r\n * @param clientId\r\n * @param tenantId\r\n * @param scopes\r\n * @param expiresOn\r\n * @param extExpiresOn\r\n */\r\nfunction createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {\r\n    const atEntity = {\r\n        homeAccountId: homeAccountId,\r\n        credentialType: CredentialType.ACCESS_TOKEN,\r\n        secret: accessToken,\r\n        cachedAt: nowSeconds().toString(),\r\n        expiresOn: expiresOn.toString(),\r\n        extendedExpiresOn: extExpiresOn.toString(),\r\n        environment: environment,\r\n        clientId: clientId,\r\n        realm: tenantId,\r\n        target: scopes,\r\n        tokenType: tokenType || AuthenticationScheme.BEARER,\r\n    };\r\n    if (userAssertionHash) {\r\n        atEntity.userAssertionHash = userAssertionHash;\r\n    }\r\n    if (refreshOn) {\r\n        atEntity.refreshOn = refreshOn.toString();\r\n    }\r\n    if (requestedClaims) {\r\n        atEntity.requestedClaims = requestedClaims;\r\n        atEntity.requestedClaimsHash = requestedClaimsHash;\r\n    }\r\n    /*\r\n     * Create Access Token With Auth Scheme instead of regular access token\r\n     * Cast to lower to handle \"bearer\" from ADFS\r\n     */\r\n    if (atEntity.tokenType?.toLowerCase() !==\r\n        AuthenticationScheme.BEARER.toLowerCase()) {\r\n        atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;\r\n        switch (atEntity.tokenType) {\r\n            case AuthenticationScheme.POP:\r\n                // Make sure keyId is present and add it to credential\r\n                const tokenClaims = extractTokenClaims(accessToken, base64Decode);\r\n                if (!tokenClaims?.cnf?.kid) {\r\n                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);\r\n                }\r\n                atEntity.keyId = tokenClaims.cnf.kid;\r\n                break;\r\n            case AuthenticationScheme.SSH:\r\n                atEntity.keyId = keyId;\r\n        }\r\n    }\r\n    return atEntity;\r\n}\r\n/**\r\n * Create RefreshTokenEntity\r\n * @param homeAccountId\r\n * @param authenticationResult\r\n * @param clientId\r\n * @param authority\r\n */\r\nfunction createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {\r\n    const rtEntity = {\r\n        credentialType: CredentialType.REFRESH_TOKEN,\r\n        homeAccountId: homeAccountId,\r\n        environment: environment,\r\n        clientId: clientId,\r\n        secret: refreshToken,\r\n    };\r\n    if (userAssertionHash) {\r\n        rtEntity.userAssertionHash = userAssertionHash;\r\n    }\r\n    if (familyId) {\r\n        rtEntity.familyId = familyId;\r\n    }\r\n    if (expiresOn) {\r\n        rtEntity.expiresOn = expiresOn.toString();\r\n    }\r\n    return rtEntity;\r\n}\r\nfunction isCredentialEntity(entity) {\r\n    return (entity.hasOwnProperty(\"homeAccountId\") &&\r\n        entity.hasOwnProperty(\"environment\") &&\r\n        entity.hasOwnProperty(\"credentialType\") &&\r\n        entity.hasOwnProperty(\"clientId\") &&\r\n        entity.hasOwnProperty(\"secret\"));\r\n}\r\n/**\r\n * Validates an entity: checks for all expected params\r\n * @param entity\r\n */\r\nfunction isAccessTokenEntity(entity) {\r\n    if (!entity) {\r\n        return false;\r\n    }\r\n    return (isCredentialEntity(entity) &&\r\n        entity.hasOwnProperty(\"realm\") &&\r\n        entity.hasOwnProperty(\"target\") &&\r\n        (entity[\"credentialType\"] === CredentialType.ACCESS_TOKEN ||\r\n            entity[\"credentialType\"] ===\r\n                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));\r\n}\r\n/**\r\n * Validates an entity: checks for all expected params\r\n * @param entity\r\n */\r\nfunction isIdTokenEntity(entity) {\r\n    if (!entity) {\r\n        return false;\r\n    }\r\n    return (isCredentialEntity(entity) &&\r\n        entity.hasOwnProperty(\"realm\") &&\r\n        entity[\"credentialType\"] === CredentialType.ID_TOKEN);\r\n}\r\n/**\r\n * Validates an entity: checks for all expected params\r\n * @param entity\r\n */\r\nfunction isRefreshTokenEntity(entity) {\r\n    if (!entity) {\r\n        return false;\r\n    }\r\n    return (isCredentialEntity(entity) &&\r\n        entity[\"credentialType\"] === CredentialType.REFRESH_TOKEN);\r\n}\r\n/**\r\n * Generate Account Id key component as per the schema: <home_account_id>-<environment>\r\n */\r\nfunction generateAccountId(credentialEntity) {\r\n    const accountId = [\r\n        credentialEntity.homeAccountId,\r\n        credentialEntity.environment,\r\n    ];\r\n    return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();\r\n}\r\n/**\r\n * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>\r\n */\r\nfunction generateCredentialId(credentialEntity) {\r\n    const clientOrFamilyId = credentialEntity.credentialType === CredentialType.REFRESH_TOKEN\r\n        ? credentialEntity.familyId || credentialEntity.clientId\r\n        : credentialEntity.clientId;\r\n    const credentialId = [\r\n        credentialEntity.credentialType,\r\n        clientOrFamilyId,\r\n        credentialEntity.realm || \"\",\r\n    ];\r\n    return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();\r\n}\r\n/**\r\n * Generate target key component as per schema: <target>\r\n */\r\nfunction generateTarget(credentialEntity) {\r\n    return (credentialEntity.target || \"\").toLowerCase();\r\n}\r\n/**\r\n * Generate requested claims key component as per schema: <requestedClaims>\r\n */\r\nfunction generateClaimsHash(credentialEntity) {\r\n    return (credentialEntity.requestedClaimsHash || \"\").toLowerCase();\r\n}\r\n/**\r\n * Generate scheme key componenet as per schema: <scheme>\r\n */\r\nfunction generateScheme(credentialEntity) {\r\n    /*\r\n     * PoP Tokens and SSH certs include scheme in cache key\r\n     * Cast to lowercase to handle \"bearer\" from ADFS\r\n     */\r\n    return credentialEntity.tokenType &&\r\n        credentialEntity.tokenType.toLowerCase() !==\r\n            AuthenticationScheme.BEARER.toLowerCase()\r\n        ? credentialEntity.tokenType.toLowerCase()\r\n        : \"\";\r\n}\r\n/**\r\n * validates if a given cache entry is \"Telemetry\", parses <key,value>\r\n * @param key\r\n * @param entity\r\n */\r\nfunction isServerTelemetryEntity(key, entity) {\r\n    const validateKey = key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;\r\n    let validateEntity = true;\r\n    if (entity) {\r\n        validateEntity =\r\n            entity.hasOwnProperty(\"failedRequests\") &&\r\n                entity.hasOwnProperty(\"errors\") &&\r\n                entity.hasOwnProperty(\"cacheHits\");\r\n    }\r\n    return validateKey && validateEntity;\r\n}\r\n/**\r\n * validates if a given cache entry is \"Throttling\", parses <key,value>\r\n * @param key\r\n * @param entity\r\n */\r\nfunction isThrottlingEntity(key, entity) {\r\n    let validateKey = false;\r\n    if (key) {\r\n        validateKey = key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;\r\n    }\r\n    let validateEntity = true;\r\n    if (entity) {\r\n        validateEntity = entity.hasOwnProperty(\"throttleTime\");\r\n    }\r\n    return validateKey && validateEntity;\r\n}\r\n/**\r\n * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>\r\n */\r\nfunction generateAppMetadataKey({ environment, clientId, }) {\r\n    const appMetaDataKeyArray = [\r\n        APP_METADATA,\r\n        environment,\r\n        clientId,\r\n    ];\r\n    return appMetaDataKeyArray\r\n        .join(Separators.CACHE_KEY_SEPARATOR)\r\n        .toLowerCase();\r\n}\r\n/*\r\n * Validates an entity: checks for all expected params\r\n * @param entity\r\n */\r\nfunction isAppMetadataEntity(key, entity) {\r\n    if (!entity) {\r\n        return false;\r\n    }\r\n    return (key.indexOf(APP_METADATA) === 0 &&\r\n        entity.hasOwnProperty(\"clientId\") &&\r\n        entity.hasOwnProperty(\"environment\"));\r\n}\r\n/**\r\n * Validates an entity: checks for all expected params\r\n * @param entity\r\n */\r\nfunction isAuthorityMetadataEntity(key, entity) {\r\n    if (!entity) {\r\n        return false;\r\n    }\r\n    return (key.indexOf(AUTHORITY_METADATA_CONSTANTS.CACHE_KEY) === 0 &&\r\n        entity.hasOwnProperty(\"aliases\") &&\r\n        entity.hasOwnProperty(\"preferred_cache\") &&\r\n        entity.hasOwnProperty(\"preferred_network\") &&\r\n        entity.hasOwnProperty(\"canonical_authority\") &&\r\n        entity.hasOwnProperty(\"authorization_endpoint\") &&\r\n        entity.hasOwnProperty(\"token_endpoint\") &&\r\n        entity.hasOwnProperty(\"issuer\") &&\r\n        entity.hasOwnProperty(\"aliasesFromNetwork\") &&\r\n        entity.hasOwnProperty(\"endpointsFromNetwork\") &&\r\n        entity.hasOwnProperty(\"expiresAt\") &&\r\n        entity.hasOwnProperty(\"jwks_uri\"));\r\n}\r\n/**\r\n * Reset the exiresAt value\r\n */\r\nfunction generateAuthorityMetadataExpiresAt() {\r\n    return (nowSeconds() +\r\n        AUTHORITY_METADATA_CONSTANTS.REFRESH_TIME_SECONDS);\r\n}\r\nfunction updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {\r\n    authorityMetadata.authorization_endpoint =\r\n        updatedValues.authorization_endpoint;\r\n    authorityMetadata.token_endpoint = updatedValues.token_endpoint;\r\n    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;\r\n    authorityMetadata.issuer = updatedValues.issuer;\r\n    authorityMetadata.endpointsFromNetwork = fromNetwork;\r\n    authorityMetadata.jwks_uri = updatedValues.jwks_uri;\r\n}\r\nfunction updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {\r\n    authorityMetadata.aliases = updatedValues.aliases;\r\n    authorityMetadata.preferred_cache = updatedValues.preferred_cache;\r\n    authorityMetadata.preferred_network = updatedValues.preferred_network;\r\n    authorityMetadata.aliasesFromNetwork = fromNetwork;\r\n}\r\n/**\r\n * Returns whether or not the data needs to be refreshed\r\n */\r\nfunction isAuthorityMetadataExpired(metadata) {\r\n    return metadata.expiresAt <= nowSeconds();\r\n}\n\nexport { createAccessTokenEntity, createIdTokenEntity, createRefreshTokenEntity, generateAppMetadataKey, generateAuthorityMetadataExpiresAt, generateCredentialKey, isAccessTokenEntity, isAppMetadataEntity, isAuthorityMetadataEntity, isAuthorityMetadataExpired, isCredentialEntity, isIdTokenEntity, isRefreshTokenEntity, isServerTelemetryEntity, isThrottlingEntity, updateAuthorityEndpointMetadata, updateCloudDiscoveryMetadata };\n//# sourceMappingURL=CacheHelpers.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { BaseClient } from './BaseClient.mjs';\nimport { RequestParameterBuilder } from '../request/RequestParameterBuilder.mjs';\nimport { Separators, GrantType, AuthenticationScheme, PromptValue, HeaderNames } from '../utils/Constants.mjs';\nimport { CLIENT_ID, RETURN_SPA_CODE } from '../constants/AADServerParamKeys.mjs';\nimport { isOidcProtocolMode } from '../config/ClientConfiguration.mjs';\nimport { ResponseHandler } from '../response/ResponseHandler.mjs';\nimport { StringUtils } from '../utils/StringUtils.mjs';\nimport { createClientAuthError } from '../error/ClientAuthError.mjs';\nimport { UrlString } from '../url/UrlString.mjs';\nimport { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';\nimport { nowSeconds } from '../utils/TimeUtils.mjs';\nimport { buildClientInfo, buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';\nimport { CcsCredentialType } from '../account/CcsCredential.mjs';\nimport { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';\nimport { RequestValidator } from '../request/RequestValidator.mjs';\nimport { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';\nimport { invokeAsync } from '../utils/FunctionWrappers.mjs';\nimport { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';\nimport { requestCannotBeMade, authorizationCodeMissingFromServerResponse } from '../error/ClientAuthErrorCodes.mjs';\nimport { logoutRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Oauth2.0 Authorization Code client\r\n * @internal\r\n */\r\nclass AuthorizationCodeClient extends BaseClient {\r\n    constructor(configuration, performanceClient) {\r\n        super(configuration, performanceClient);\r\n        // Flag to indicate if client is for hybrid spa auth code redemption\r\n        this.includeRedirectUri = true;\r\n        this.oidcDefaultScopes =\r\n            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;\r\n    }\r\n    /**\r\n     * Creates the URL of the authorization request letting the user input credentials and consent to the\r\n     * application. The URL target the /authorize endpoint of the authority configured in the\r\n     * application object.\r\n     *\r\n     * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI\r\n     * sent in the request and should contain an authorization code, which can then be used to acquire tokens via\r\n     * acquireToken(AuthorizationCodeRequest)\r\n     * @param request\r\n     */\r\n    async getAuthCodeUrl(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);\r\n        const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);\r\n        return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);\r\n    }\r\n    /**\r\n     * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the\r\n     * authorization_code_grant\r\n     * @param request\r\n     */\r\n    async acquireToken(request, authCodePayload) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientAcquireToken, request.correlationId);\r\n        if (!request.code) {\r\n            throw createClientAuthError(requestCannotBeMade);\r\n        }\r\n        const reqTimestamp = nowSeconds();\r\n        const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request);\r\n        // Retrieve requestId from response headers\r\n        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];\r\n        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin, this.performanceClient);\r\n        // Validate response. This function throws a server error if an error is returned by the server.\r\n        responseHandler.validateTokenResponse(response.body);\r\n        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);\r\n    }\r\n    /**\r\n     * Handles the hash fragment response from public client code request. Returns a code response used by\r\n     * the client to exchange for a token in acquireToken.\r\n     * @param hashFragment\r\n     */\r\n    handleFragmentResponse(serverParams, cachedState) {\r\n        // Handle responses.\r\n        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);\r\n        // Get code response\r\n        responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);\r\n        // throw when there is no auth code in the response\r\n        if (!serverParams.code) {\r\n            throw createClientAuthError(authorizationCodeMissingFromServerResponse);\r\n        }\r\n        return serverParams;\r\n    }\r\n    /**\r\n     * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.\r\n     * Default behaviour is to redirect the user to `window.location.href`.\r\n     * @param authorityUri\r\n     */\r\n    getLogoutUri(logoutRequest) {\r\n        // Throw error if logoutRequest is null/undefined\r\n        if (!logoutRequest) {\r\n            throw createClientConfigurationError(logoutRequestEmpty);\r\n        }\r\n        const queryString = this.createLogoutUrlQueryString(logoutRequest);\r\n        // Construct logout URI\r\n        return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);\r\n    }\r\n    /**\r\n     * Executes POST request to token endpoint\r\n     * @param authority\r\n     * @param request\r\n     */\r\n    async executeTokenRequest(authority, request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientExecuteTokenRequest, request.correlationId);\r\n        const queryParametersString = this.createTokenQueryParameters(request);\r\n        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);\r\n        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);\r\n        let ccsCredential = undefined;\r\n        if (request.clientInfo) {\r\n            try {\r\n                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);\r\n                ccsCredential = {\r\n                    credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,\r\n                    type: CcsCredentialType.HOME_ACCOUNT_ID,\r\n                };\r\n            }\r\n            catch (e) {\r\n                this.logger.verbose(\"Could not parse client info for CCS Header: \" + e);\r\n            }\r\n        }\r\n        const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);\r\n        const thumbprint = {\r\n            clientId: request.tokenBodyParameters?.clientId ||\r\n                this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            claims: request.claims,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims,\r\n            sshKid: request.sshKid,\r\n        };\r\n        return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);\r\n    }\r\n    /**\r\n     * Generates a map for all the params to be sent to the service\r\n     * @param request\r\n     */\r\n    async createTokenRequestBody(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||\r\n            this.config.authOptions.clientId);\r\n        /*\r\n         * For hybrid spa flow, there will be a code but no verifier\r\n         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI\r\n         */\r\n        if (!this.includeRedirectUri) {\r\n            // Just validate\r\n            RequestValidator.validateRedirectUri(request.redirectUri);\r\n        }\r\n        else {\r\n            // Validate and include redirect uri\r\n            parameterBuilder.addRedirectUri(request.redirectUri);\r\n        }\r\n        // Add scope array, parameter builder will add default scopes and dedupe\r\n        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);\r\n        // add code: user set, not validated\r\n        parameterBuilder.addAuthorizationCode(request.code);\r\n        // Add library metadata\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);\r\n        parameterBuilder.addThrottling();\r\n        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n        // add code_verifier if passed\r\n        if (request.codeVerifier) {\r\n            parameterBuilder.addCodeVerifier(request.codeVerifier);\r\n        }\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n        parameterBuilder.addGrantType(GrantType.AUTHORIZATION_CODE_GRANT);\r\n        parameterBuilder.addClientInfo();\r\n        if (request.authenticationScheme === AuthenticationScheme.POP) {\r\n            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);\r\n            let reqCnfData;\r\n            if (!request.popKid) {\r\n                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);\r\n                reqCnfData = generatedReqCnfData.reqCnfString;\r\n            }\r\n            else {\r\n                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);\r\n            }\r\n            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)\r\n            parameterBuilder.addPopToken(reqCnfData);\r\n        }\r\n        else if (request.authenticationScheme === AuthenticationScheme.SSH) {\r\n            if (request.sshJwk) {\r\n                parameterBuilder.addSshJwk(request.sshJwk);\r\n            }\r\n            else {\r\n                throw createClientConfigurationError(missingSshJwk);\r\n            }\r\n        }\r\n        const correlationId = request.correlationId ||\r\n            this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n        if (!StringUtils.isEmptyObj(request.claims) ||\r\n            (this.config.authOptions.clientCapabilities &&\r\n                this.config.authOptions.clientCapabilities.length > 0)) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n        let ccsCred = undefined;\r\n        if (request.clientInfo) {\r\n            try {\r\n                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);\r\n                ccsCred = {\r\n                    credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,\r\n                    type: CcsCredentialType.HOME_ACCOUNT_ID,\r\n                };\r\n            }\r\n            catch (e) {\r\n                this.logger.verbose(\"Could not parse client info for CCS Header: \" + e);\r\n            }\r\n        }\r\n        else {\r\n            ccsCred = request.ccsCredential;\r\n        }\r\n        // Adds these as parameters in the request instead of headers to prevent CORS preflight request\r\n        if (this.config.systemOptions.preventCorsPreflight && ccsCred) {\r\n            switch (ccsCred.type) {\r\n                case CcsCredentialType.HOME_ACCOUNT_ID:\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"Could not parse home account ID for CCS Header: \" +\r\n                            e);\r\n                    }\r\n                    break;\r\n                case CcsCredentialType.UPN:\r\n                    parameterBuilder.addCcsUpn(ccsCred.credential);\r\n                    break;\r\n            }\r\n        }\r\n        if (request.tokenBodyParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);\r\n        }\r\n        // Add hybrid spa parameters if not already provided\r\n        if (request.enableSpaAuthorizationCode &&\r\n            (!request.tokenBodyParameters ||\r\n                !request.tokenBodyParameters[RETURN_SPA_CODE])) {\r\n            parameterBuilder.addExtraQueryParameters({\r\n                [RETURN_SPA_CODE]: \"1\",\r\n            });\r\n        }\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n    /**\r\n     * This API validates the `AuthorizationCodeUrlRequest` and creates a URL\r\n     * @param request\r\n     */\r\n    async createAuthCodeUrlQueryString(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n        parameterBuilder.addClientId(request.extraQueryParameters?.[CLIENT_ID] ||\r\n            this.config.authOptions.clientId);\r\n        const requestScopes = [\r\n            ...(request.scopes || []),\r\n            ...(request.extraScopesToConsent || []),\r\n        ];\r\n        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);\r\n        // validate the redirectUri (to be a non null value)\r\n        parameterBuilder.addRedirectUri(request.redirectUri);\r\n        // generate the correlationId if not set by the user and add\r\n        const correlationId = request.correlationId ||\r\n            this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n        // add response_mode. If not passed in it defaults to query.\r\n        parameterBuilder.addResponseMode(request.responseMode);\r\n        // add response_type = code\r\n        parameterBuilder.addResponseTypeCode();\r\n        // add library info parameters\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n        if (!isOidcProtocolMode(this.config)) {\r\n            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);\r\n        }\r\n        // add client_info=1\r\n        parameterBuilder.addClientInfo();\r\n        if (request.codeChallenge && request.codeChallengeMethod) {\r\n            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);\r\n        }\r\n        if (request.prompt) {\r\n            parameterBuilder.addPrompt(request.prompt);\r\n        }\r\n        if (request.domainHint) {\r\n            parameterBuilder.addDomainHint(request.domainHint);\r\n        }\r\n        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object\r\n        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {\r\n            // AAD will throw if prompt=select_account is passed with an account hint\r\n            if (request.sid && request.prompt === PromptValue.NONE) {\r\n                // SessionID is only used in silent calls\r\n                this.logger.verbose(\"createAuthCodeUrlQueryString: Prompt is none, adding sid from request\");\r\n                parameterBuilder.addSid(request.sid);\r\n            }\r\n            else if (request.account) {\r\n                const accountSid = this.extractAccountSid(request.account);\r\n                let accountLoginHintClaim = this.extractLoginHint(request.account);\r\n                if (accountLoginHintClaim && request.domainHint) {\r\n                    this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: \"domainHint\" param is set, skipping opaque \"login_hint\" claim. Please consider not passing domainHint`);\r\n                    accountLoginHintClaim = null;\r\n                }\r\n                // If login_hint claim is present, use it over sid/username\r\n                if (accountLoginHintClaim) {\r\n                    this.logger.verbose(\"createAuthCodeUrlQueryString: login_hint claim present on account\");\r\n                    parameterBuilder.addLoginHint(accountLoginHintClaim);\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header\");\r\n                    }\r\n                }\r\n                else if (accountSid && request.prompt === PromptValue.NONE) {\r\n                    /*\r\n                     * If account and loginHint are provided, we will check account first for sid before adding loginHint\r\n                     * SessionId is only used in silent calls\r\n                     */\r\n                    this.logger.verbose(\"createAuthCodeUrlQueryString: Prompt is none, adding sid from account\");\r\n                    parameterBuilder.addSid(accountSid);\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header\");\r\n                    }\r\n                }\r\n                else if (request.loginHint) {\r\n                    this.logger.verbose(\"createAuthCodeUrlQueryString: Adding login_hint from request\");\r\n                    parameterBuilder.addLoginHint(request.loginHint);\r\n                    parameterBuilder.addCcsUpn(request.loginHint);\r\n                }\r\n                else if (request.account.username) {\r\n                    // Fallback to account username if provided\r\n                    this.logger.verbose(\"createAuthCodeUrlQueryString: Adding login_hint from account\");\r\n                    parameterBuilder.addLoginHint(request.account.username);\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header\");\r\n                    }\r\n                }\r\n            }\r\n            else if (request.loginHint) {\r\n                this.logger.verbose(\"createAuthCodeUrlQueryString: No account, adding login_hint from request\");\r\n                parameterBuilder.addLoginHint(request.loginHint);\r\n                parameterBuilder.addCcsUpn(request.loginHint);\r\n            }\r\n        }\r\n        else {\r\n            this.logger.verbose(\"createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints\");\r\n        }\r\n        if (request.nonce) {\r\n            parameterBuilder.addNonce(request.nonce);\r\n        }\r\n        if (request.state) {\r\n            parameterBuilder.addState(request.state);\r\n        }\r\n        if (request.claims ||\r\n            (this.config.authOptions.clientCapabilities &&\r\n                this.config.authOptions.clientCapabilities.length > 0)) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n        if (request.extraQueryParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);\r\n        }\r\n        if (request.nativeBroker) {\r\n            // signal ests that this is a WAM call\r\n            parameterBuilder.addNativeBroker();\r\n            // pass the req_cnf for POP\r\n            if (request.authenticationScheme === AuthenticationScheme.POP) {\r\n                const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);\r\n                // req_cnf is always sent as a string for SPAs\r\n                let reqCnfData;\r\n                if (!request.popKid) {\r\n                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);\r\n                    reqCnfData = generatedReqCnfData.reqCnfString;\r\n                }\r\n                else {\r\n                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);\r\n                }\r\n                parameterBuilder.addPopToken(reqCnfData);\r\n            }\r\n        }\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n    /**\r\n     * This API validates the `EndSessionRequest` and creates a URL\r\n     * @param request\r\n     */\r\n    createLogoutUrlQueryString(request) {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n        if (request.postLogoutRedirectUri) {\r\n            parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);\r\n        }\r\n        if (request.correlationId) {\r\n            parameterBuilder.addCorrelationId(request.correlationId);\r\n        }\r\n        if (request.idTokenHint) {\r\n            parameterBuilder.addIdTokenHint(request.idTokenHint);\r\n        }\r\n        if (request.state) {\r\n            parameterBuilder.addState(request.state);\r\n        }\r\n        if (request.logoutHint) {\r\n            parameterBuilder.addLogoutHint(request.logoutHint);\r\n        }\r\n        if (request.extraQueryParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);\r\n        }\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n    /**\r\n     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.\r\n     * @param account\r\n     */\r\n    extractAccountSid(account) {\r\n        return account.idTokenClaims?.sid || null;\r\n    }\r\n    extractLoginHint(account) {\r\n        return account.idTokenClaims?.login_hint || null;\r\n    }\r\n}\n\nexport { AuthorizationCodeClient };\n//# sourceMappingURL=AuthorizationCodeClient.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { buildClientConfiguration } from '../config/ClientConfiguration.mjs';\nimport { NetworkManager } from '../network/NetworkManager.mjs';\nimport { Logger } from '../logger/Logger.mjs';\nimport { HeaderNames, Constants } from '../utils/Constants.mjs';\nimport { name, version } from '../packageMetadata.mjs';\nimport { CcsCredentialType } from '../account/CcsCredential.mjs';\nimport { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';\nimport { RequestParameterBuilder } from '../request/RequestParameterBuilder.mjs';\nimport { createDiscoveredInstance } from '../authority/AuthorityFactory.mjs';\nimport { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/**\r\n * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.\r\n * @internal\r\n */\r\nclass BaseClient {\r\n    constructor(configuration, performanceClient) {\r\n        // Set the configuration\r\n        this.config = buildClientConfiguration(configuration);\r\n        // Initialize the logger\r\n        this.logger = new Logger(this.config.loggerOptions, name, version);\r\n        // Initialize crypto\r\n        this.cryptoUtils = this.config.cryptoInterface;\r\n        // Initialize storage interface\r\n        this.cacheManager = this.config.storageInterface;\r\n        // Set the network interface\r\n        this.networkClient = this.config.networkInterface;\r\n        // Set the NetworkManager\r\n        this.networkManager = new NetworkManager(this.networkClient, this.cacheManager);\r\n        // Set TelemetryManager\r\n        this.serverTelemetryManager = this.config.serverTelemetryManager;\r\n        // set Authority\r\n        this.authority = this.config.authOptions.authority;\r\n        // set performance telemetry client\r\n        this.performanceClient = performanceClient;\r\n    }\r\n    /**\r\n     * Creates default headers for requests to token endpoint\r\n     */\r\n    createTokenRequestHeaders(ccsCred) {\r\n        const headers = {};\r\n        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;\r\n        if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {\r\n            switch (ccsCred.type) {\r\n                case CcsCredentialType.HOME_ACCOUNT_ID:\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);\r\n                        headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"Could not parse home account ID for CCS Header: \" +\r\n                            e);\r\n                    }\r\n                    break;\r\n                case CcsCredentialType.UPN:\r\n                    headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;\r\n                    break;\r\n            }\r\n        }\r\n        return headers;\r\n    }\r\n    /**\r\n     * Http post to token endpoint\r\n     * @param tokenEndpoint\r\n     * @param queryString\r\n     * @param headers\r\n     * @param thumbprint\r\n     */\r\n    async executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, queuedEvent) {\r\n        if (queuedEvent) {\r\n            this.performanceClient?.addQueueMeasurement(queuedEvent, correlationId);\r\n        }\r\n        const response = await this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers });\r\n        this.performanceClient?.addFields({\r\n            refreshTokenSize: response.body.refresh_token?.length || 0,\r\n            httpVerToken: response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || \"\",\r\n        }, correlationId);\r\n        if (this.config.serverTelemetryManager &&\r\n            response.status < 500 &&\r\n            response.status !== 429) {\r\n            // Telemetry data successfully logged by server, clear Telemetry cache\r\n            this.config.serverTelemetryManager.clearTelemetryCache();\r\n        }\r\n        return response;\r\n    }\r\n    /**\r\n     * Updates the authority object of the client. Endpoint discovery must be completed.\r\n     * @param updatedAuthority\r\n     */\r\n    async updateAuthority(cloudInstanceHostname, correlationId) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);\r\n        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;\r\n        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);\r\n        this.authority = cloudInstanceAuthority;\r\n    }\r\n    /**\r\n     * Creates query string for the /token request\r\n     * @param request\r\n     */\r\n    createTokenQueryParameters(request) {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n        if (request.tokenQueryParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);\r\n        }\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\n\nexport { BaseClient };\n//# sourceMappingURL=BaseClient.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { isOidcProtocolMode } from '../config/ClientConfiguration.mjs';\nimport { BaseClient } from './BaseClient.mjs';\nimport { RequestParameterBuilder } from '../request/RequestParameterBuilder.mjs';\nimport { GrantType, AuthenticationScheme, HeaderNames, Errors } from '../utils/Constants.mjs';\nimport { CLIENT_ID } from '../constants/AADServerParamKeys.mjs';\nimport { ResponseHandler } from '../response/ResponseHandler.mjs';\nimport { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';\nimport { StringUtils } from '../utils/StringUtils.mjs';\nimport { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';\nimport { createClientAuthError } from '../error/ClientAuthError.mjs';\nimport { ServerError } from '../error/ServerError.mjs';\nimport { nowSeconds, isTokenExpired } from '../utils/TimeUtils.mjs';\nimport { UrlString } from '../url/UrlString.mjs';\nimport { CcsCredentialType } from '../account/CcsCredential.mjs';\nimport { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';\nimport { createInteractionRequiredAuthError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';\nimport { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';\nimport { invokeAsync, invoke } from '../utils/FunctionWrappers.mjs';\nimport { generateCredentialKey } from '../cache/utils/CacheHelpers.mjs';\nimport { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';\nimport { tokenRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';\nimport { noAccountInSilentRequest } from '../error/ClientAuthErrorCodes.mjs';\nimport { noTokensFound, refreshTokenExpired, badToken } from '../error/InteractionRequiredAuthErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\nconst DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes\r\n/**\r\n * OAuth2.0 refresh token client\r\n * @internal\r\n */\r\nclass RefreshTokenClient extends BaseClient {\r\n    constructor(configuration, performanceClient) {\r\n        super(configuration, performanceClient);\r\n    }\r\n    async acquireToken(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);\r\n        const reqTimestamp = nowSeconds();\r\n        const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);\r\n        // Retrieve requestId from response headers\r\n        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];\r\n        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);\r\n        responseHandler.validateTokenResponse(response.body);\r\n        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);\r\n    }\r\n    /**\r\n     * Gets cached refresh token and attaches to request, then calls acquireToken API\r\n     * @param request\r\n     */\r\n    async acquireTokenByRefreshToken(request) {\r\n        // Cannot renew token if no request object is given.\r\n        if (!request) {\r\n            throw createClientConfigurationError(tokenRequestEmpty);\r\n        }\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, request.correlationId);\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw createClientAuthError(noAccountInSilentRequest);\r\n        }\r\n        // try checking if FOCI is enabled for the given application\r\n        const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);\r\n        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest\r\n        if (isFOCI) {\r\n            try {\r\n                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);\r\n            }\r\n            catch (e) {\r\n                const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&\r\n                    e.errorCode ===\r\n                        noTokensFound;\r\n                const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&\r\n                    e.errorCode === Errors.INVALID_GRANT_ERROR &&\r\n                    e.subError === Errors.CLIENT_MISMATCH_ERROR;\r\n                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)\r\n                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {\r\n                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);\r\n                    // throw in all other cases\r\n                }\r\n                else {\r\n                    throw e;\r\n                }\r\n            }\r\n        }\r\n        // fall back to application refresh token acquisition\r\n        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);\r\n    }\r\n    /**\r\n     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached\r\n     * @param request\r\n     */\r\n    async acquireTokenWithCachedRefreshToken(request, foci) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);\r\n        // fetches family RT or application RT based on FOCI value\r\n        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);\r\n        if (!refreshToken) {\r\n            throw createInteractionRequiredAuthError(noTokensFound);\r\n        }\r\n        if (refreshToken.expiresOn &&\r\n            isTokenExpired(refreshToken.expiresOn, request.refreshTokenExpirationOffsetSeconds ||\r\n                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS)) {\r\n            throw createInteractionRequiredAuthError(refreshTokenExpired);\r\n        }\r\n        // attach cached RT size to the current measurement\r\n        const refreshTokenRequest = {\r\n            ...request,\r\n            refreshToken: refreshToken.secret,\r\n            authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,\r\n            ccsCredential: {\r\n                credential: request.account.homeAccountId,\r\n                type: CcsCredentialType.HOME_ACCOUNT_ID,\r\n            },\r\n        };\r\n        try {\r\n            return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);\r\n        }\r\n        catch (e) {\r\n            if (e instanceof InteractionRequiredAuthError &&\r\n                e.subError === badToken) {\r\n                // Remove bad refresh token from cache\r\n                this.logger.verbose(\"acquireTokenWithRefreshToken: bad refresh token, removing from cache\");\r\n                const badRefreshTokenKey = generateCredentialKey(refreshToken);\r\n                this.cacheManager.removeRefreshToken(badRefreshTokenKey);\r\n            }\r\n            throw e;\r\n        }\r\n    }\r\n    /**\r\n     * Constructs the network message and makes a NW call to the underlying secure token service\r\n     * @param request\r\n     * @param authority\r\n     */\r\n    async executeTokenRequest(request, authority) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);\r\n        const queryParametersString = this.createTokenQueryParameters(request);\r\n        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);\r\n        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);\r\n        const headers = this.createTokenRequestHeaders(request.ccsCredential);\r\n        const thumbprint = {\r\n            clientId: request.tokenBodyParameters?.clientId ||\r\n                this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            claims: request.claims,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims,\r\n            sshKid: request.sshKid,\r\n        };\r\n        return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);\r\n    }\r\n    /**\r\n     * Helper function to create the token request body\r\n     * @param request\r\n     */\r\n    async createTokenRequestBody(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);\r\n        const correlationId = request.correlationId;\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||\r\n            this.config.authOptions.clientId);\r\n        if (request.redirectUri) {\r\n            parameterBuilder.addRedirectUri(request.redirectUri);\r\n        }\r\n        parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);\r\n        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);\r\n        parameterBuilder.addClientInfo();\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);\r\n        parameterBuilder.addThrottling();\r\n        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n        parameterBuilder.addRefreshToken(request.refreshToken);\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n        if (request.authenticationScheme === AuthenticationScheme.POP) {\r\n            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);\r\n            let reqCnfData;\r\n            if (!request.popKid) {\r\n                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);\r\n                reqCnfData = generatedReqCnfData.reqCnfString;\r\n            }\r\n            else {\r\n                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);\r\n            }\r\n            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)\r\n            parameterBuilder.addPopToken(reqCnfData);\r\n        }\r\n        else if (request.authenticationScheme === AuthenticationScheme.SSH) {\r\n            if (request.sshJwk) {\r\n                parameterBuilder.addSshJwk(request.sshJwk);\r\n            }\r\n            else {\r\n                throw createClientConfigurationError(missingSshJwk);\r\n            }\r\n        }\r\n        if (!StringUtils.isEmptyObj(request.claims) ||\r\n            (this.config.authOptions.clientCapabilities &&\r\n                this.config.authOptions.clientCapabilities.length > 0)) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n        if (this.config.systemOptions.preventCorsPreflight &&\r\n            request.ccsCredential) {\r\n            switch (request.ccsCredential.type) {\r\n                case CcsCredentialType.HOME_ACCOUNT_ID:\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    }\r\n                    catch (e) {\r\n                        this.logger.verbose(\"Could not parse home account ID for CCS Header: \" +\r\n                            e);\r\n                    }\r\n                    break;\r\n                case CcsCredentialType.UPN:\r\n                    parameterBuilder.addCcsUpn(request.ccsCredential.credential);\r\n                    break;\r\n            }\r\n        }\r\n        if (request.tokenBodyParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);\r\n        }\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\n\nexport { RefreshTokenClient };\n//# sourceMappingURL=RefreshTokenClient.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { BaseClient } from './BaseClient.mjs';\nimport { wasClockTurnedBack, isTokenExpired } from '../utils/TimeUtils.mjs';\nimport { RefreshTokenClient } from './RefreshTokenClient.mjs';\nimport { ClientAuthError, createClientAuthError } from '../error/ClientAuthError.mjs';\nimport { ResponseHandler } from '../response/ResponseHandler.mjs';\nimport { OIDC_DEFAULT_SCOPES, CacheOutcome } from '../utils/Constants.mjs';\nimport { StringUtils } from '../utils/StringUtils.mjs';\nimport { extractTokenClaims, checkMaxAge } from '../account/AuthToken.mjs';\nimport { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';\nimport { invokeAsync } from '../utils/FunctionWrappers.mjs';\nimport { getTenantFromAuthorityString } from '../authority/Authority.mjs';\nimport { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n/** @internal */\r\nclass SilentFlowClient extends BaseClient {\r\n    constructor(configuration, performanceClient) {\r\n        super(configuration, performanceClient);\r\n    }\r\n    /**\r\n     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew\r\n     * the given token and returns the renewed token\r\n     * @param request\r\n     */\r\n    async acquireToken(request) {\r\n        try {\r\n            const [authResponse, cacheOutcome] = await this.acquireCachedToken({\r\n                ...request,\r\n                scopes: request.scopes?.length\r\n                    ? request.scopes\r\n                    : [...OIDC_DEFAULT_SCOPES],\r\n            });\r\n            // if the token is not expired but must be refreshed; get a new one in the background\r\n            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {\r\n                this.logger.info(\"SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.\");\r\n                // refresh the access token in the background\r\n                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);\r\n                refreshTokenClient\r\n                    .acquireTokenByRefreshToken(request)\r\n                    .catch(() => {\r\n                    // do nothing, this is running in the background and no action is to be taken upon success or failure\r\n                });\r\n            }\r\n            // return the cached token\r\n            return authResponse;\r\n        }\r\n        catch (e) {\r\n            if (e instanceof ClientAuthError &&\r\n                e.errorCode === tokenRefreshRequired) {\r\n                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);\r\n                return refreshTokenClient.acquireTokenByRefreshToken(request);\r\n            }\r\n            else {\r\n                throw e;\r\n            }\r\n        }\r\n    }\r\n    /**\r\n     * Retrieves token from cache or throws an error if it must be refreshed.\r\n     * @param request\r\n     */\r\n    async acquireCachedToken(request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientAcquireCachedToken, request.correlationId);\r\n        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;\r\n        if (request.forceRefresh ||\r\n            (!this.config.cacheOptions.claimsBasedCachingEnabled &&\r\n                !StringUtils.isEmptyObj(request.claims))) {\r\n            // Must refresh due to present force_refresh flag.\r\n            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);\r\n            throw createClientAuthError(tokenRefreshRequired);\r\n        }\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw createClientAuthError(noAccountInSilentRequest);\r\n        }\r\n        const requestTenantId = request.account.tenantId ||\r\n            getTenantFromAuthorityString(request.authority);\r\n        const tokenKeys = this.cacheManager.getTokenKeys();\r\n        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);\r\n        if (!cachedAccessToken) {\r\n            // must refresh due to non-existent access_token\r\n            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);\r\n            throw createClientAuthError(tokenRefreshRequired);\r\n        }\r\n        else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||\r\n            isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {\r\n            // must refresh due to the expires_in value\r\n            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);\r\n            throw createClientAuthError(tokenRefreshRequired);\r\n        }\r\n        else if (cachedAccessToken.refreshOn &&\r\n            isTokenExpired(cachedAccessToken.refreshOn, 0)) {\r\n            // must refresh (in the background) due to the refresh_in value\r\n            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;\r\n            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead\r\n        }\r\n        const environment = request.authority || this.authority.getPreferredCache();\r\n        const cacheRecord = {\r\n            account: this.cacheManager.readAccountFromCache(request.account),\r\n            accessToken: cachedAccessToken,\r\n            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),\r\n            refreshToken: null,\r\n            appMetadata: this.cacheManager.readAppMetadataFromCache(environment),\r\n        };\r\n        this.setCacheOutcome(lastCacheOutcome, request.correlationId);\r\n        if (this.config.serverTelemetryManager) {\r\n            this.config.serverTelemetryManager.incrementCacheHits();\r\n        }\r\n        return [\r\n            await invokeAsync(this.generateResultFromCacheRecord.bind(this), PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),\r\n            lastCacheOutcome,\r\n        ];\r\n    }\r\n    setCacheOutcome(cacheOutcome, correlationId) {\r\n        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);\r\n        this.performanceClient?.addFields({\r\n            cacheOutcome: cacheOutcome,\r\n        }, correlationId);\r\n        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {\r\n            this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);\r\n        }\r\n    }\r\n    /**\r\n     * Helper function to build response object from the CacheRecord\r\n     * @param cacheRecord\r\n     */\r\n    async generateResultFromCacheRecord(cacheRecord, request) {\r\n        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);\r\n        let idTokenClaims;\r\n        if (cacheRecord.idToken) {\r\n            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);\r\n        }\r\n        // token max_age check\r\n        if (request.maxAge || request.maxAge === 0) {\r\n            const authTime = idTokenClaims?.auth_time;\r\n            if (!authTime) {\r\n                throw createClientAuthError(authTimeNotFound);\r\n            }\r\n            checkMaxAge(authTime, request.maxAge);\r\n        }\r\n        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);\r\n    }\r\n}\n\nexport { SilentFlowClient };\n//# sourceMappingURL=SilentFlowClient.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\nimport { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.mjs';\nimport { Logger, LogLevel } from '../logger/Logger.mjs';\nimport { DEFAULT_TOKEN_RENEWAL_OFFSET_SEC, Constants } from '../utils/Constants.mjs';\nimport { version } from '../packageMetadata.mjs';\nimport { AzureCloudInstance } from '../authority/AuthorityOptions.mjs';\nimport { DefaultStorageClass } from '../cache/CacheManager.mjs';\nimport { ProtocolMode } from '../authority/ProtocolMode.mjs';\nimport { createClientAuthError } from '../error/ClientAuthError.mjs';\nimport { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';\n\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\nconst DEFAULT_SYSTEM_OPTIONS = {\r\n    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,\r\n    preventCorsPreflight: false,\r\n};\r\nconst DEFAULT_LOGGER_IMPLEMENTATION = {\r\n    loggerCallback: () => {\r\n        // allow users to not set loggerCallback\r\n    },\r\n    piiLoggingEnabled: false,\r\n    logLevel: LogLevel.Info,\r\n    correlationId: Constants.EMPTY_STRING,\r\n};\r\nconst DEFAULT_CACHE_OPTIONS = {\r\n    claimsBasedCachingEnabled: false,\r\n};\r\nconst DEFAULT_NETWORK_IMPLEMENTATION = {\r\n    async sendGetRequestAsync() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    },\r\n    async sendPostRequestAsync() {\r\n        throw createClientAuthError(methodNotImplemented);\r\n    },\r\n};\r\nconst DEFAULT_LIBRARY_INFO = {\r\n    sku: Constants.SKU,\r\n    version: version,\r\n    cpu: Constants.EMPTY_STRING,\r\n    os: Constants.EMPTY_STRING,\r\n};\r\nconst DEFAULT_CLIENT_CREDENTIALS = {\r\n    clientSecret: Constants.EMPTY_STRING,\r\n    clientAssertion: undefined,\r\n};\r\nconst DEFAULT_AZURE_CLOUD_OPTIONS = {\r\n    azureCloudInstance: AzureCloudInstance.None,\r\n    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,\r\n};\r\nconst DEFAULT_TELEMETRY_OPTIONS = {\r\n    application: {\r\n        appName: \"\",\r\n        appVersion: \"\",\r\n    },\r\n};\r\n/**\r\n * Function that sets the default options when not explicitly configured from app developer\r\n *\r\n * @param Configuration\r\n *\r\n * @returns Configuration\r\n */\r\nfunction buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, cacheOptions: userCacheOptions, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {\r\n    const loggerOptions = {\r\n        ...DEFAULT_LOGGER_IMPLEMENTATION,\r\n        ...userLoggerOption,\r\n    };\r\n    return {\r\n        authOptions: buildAuthOptions(userAuthOptions),\r\n        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },\r\n        loggerOptions: loggerOptions,\r\n        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },\r\n        storageInterface: storageImplementation ||\r\n            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),\r\n        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,\r\n        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,\r\n        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,\r\n        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },\r\n        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },\r\n        serverTelemetryManager: serverTelemetryManager || null,\r\n        persistencePlugin: persistencePlugin || null,\r\n        serializableCache: serializableCache || null,\r\n    };\r\n}\r\n/**\r\n * Construct authoptions from the client and platform passed values\r\n * @param authOptions\r\n */\r\nfunction buildAuthOptions(authOptions) {\r\n    return {\r\n        clientCapabilities: [],\r\n        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,\r\n        skipAuthorityMetadataCache: false,\r\n        ...authOptions,\r\n    };\r\n}\r\n/**\r\n * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise\r\n * @param ClientConfiguration\r\n */\r\nfunction isOidcProtocolMode(config) {\r\n    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);\r\n}\n\nexport { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration, isOidcProtocolMode };\n//# sourceMappingURL=ClientConfiguration.mjs.map\n","/*! @azure/msal-common v14.14.2 2024-08-28 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\nconst CLIENT_ID = \"client_id\";\r\nconst REDIRECT_URI = \"redirect_uri\";\r\nconst RESPONSE_TYPE = \"response_type\";\r\nconst RESPONSE_MODE = \"response_mode\";\r\nconst GRANT_TYPE = \"grant_type\";\r\nconst CLAIMS = \"claims\";\r\nconst SCOPE = \"scope\";\r\nconst ERROR = \"error\";\r\nconst ERROR_DESCRIPTION = \"error_description\";\r\nconst ACCESS_TOKEN = \"access_token\";\r\nconst ID_TOKEN = \"id_token\";\r\nconst REFRESH_TOKEN = \"refresh_token\";\r\nconst EXPIRES_IN = \"expires_in\";\r\nconst REFRESH_TOKEN_EXPIRES_IN = \"refresh_token_expires_in\";\r\nconst STATE = \"state\";\r\nconst NONCE = \"nonce\";\r\nconst PROMPT = \"prompt\";\r\nconst SESSION_STATE = \"session_state\";\r\nconst CLIENT_INFO = \"client_info\";\r\nconst CODE = \"code\";\r\nconst CODE_CHALLENGE = \"code_challenge\";\r\nconst CODE_CHALLENGE_METHOD = \"code_challenge_method\";\r\nconst CODE_VERIFIER = \"code_verifier\";\r\nconst CLIENT_REQUEST_ID = \"client-request-id\";\r\nconst X_CLIENT_SKU = \"x-client-SKU\";\r\nconst X_CLIENT_VER = \"x-client-VER\";\r\nconst X_CLIENT_OS = \"x-client-OS\";\r\nconst X_CLIENT_CPU = \"x-client-CPU\";\r\nconst X_CLIENT_CURR_TELEM = \"x-client-current-telemetry\";\r\nconst X_CLIENT_LAST_TELEM = \"x-client-last-telemetry\";\r\nconst X_MS_LIB_CAPABILITY = \"x-ms-lib-capability\";\r\nconst X_APP_NAME = \"x-app-name\";\r\nconst X_APP_VER = \"x-app-ver\";\r\nconst POST_LOGOUT_URI = \"post_logout_redirect_uri\";\r\nconst ID_TOKEN_HINT = \"id_token_hint\";\r\nconst DEVICE_CODE = \"device_code\";\r\nconst CLIENT_SECRET = \"client_secret\";\r\nconst CLIENT_ASSERTION = \"client_assertion\";\r\nconst CLIENT_ASSERTION_TYPE = \"client_assertion_type\";\r\nconst TOKEN_TYPE = \"token_type\";\r\nconst REQ_CNF = \"req_cnf\";\r\nconst OBO_ASSERTION = \"assertion\";\r\nconst REQUESTED_TOKEN_USE = \"requested_token_use\";\r\nconst ON_BEHALF_OF = \"on_behalf_of\";\r\nconst FOCI = \"foci\";\r\nconst CCS_HEADER = \"X-AnchorMailbox\";\r\nconst RETURN_SPA_CODE = \"return_spa_code\";\r\nconst NATIVE_BROKER = \"nativebroker\";\r\nconst LOGOUT_HINT = \"logout_hint\";\r\nconst SID = \"sid\";\r\nconst LOGIN_HINT = \"login_hint\";\r\nconst DOMAIN_HINT = \"domain_hint\";\r\nconst X_CLIENT_EXTRA_SKU = \"x-client-xtra-sku\";\n\nexport { ACCESS_TOKEN, CCS_HEADER, CLAIMS, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_INFO, CLIENT_REQUEST_ID, CLIENT_SECRET, CODE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, DEVICE_CODE, DOMAIN_HINT, ERROR, ERROR_DESCRIPTION, EXPIRES_IN, FOCI, GRANT_TYPE, ID_TOKEN, ID_TOKEN_HINT, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, ON_BEHALF_OF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REFRESH_TOKEN_EXPIRES_IN, REQUESTED_TOKEN_USE, REQ_CNF, RESPONSE_MODE, RESPONSE_TYPE, RETURN_SPA_CODE, SCOPE, SESSION_STATE, SID, STATE, TOKEN_TYPE, X_APP_NAME, X_APP_VER, X_CLIENT_CPU, X_CLIENT_CURR_TELEM, X_CLIENT_EXTRA_SKU, X_CLIENT_LAST_TELEM, X_CLIENT_OS, X_CLIENT_SKU, X_CLIENT_VER, X_MS_LIB_CAPABILITY };\n//# sourceMappingURL=AADServerParamKeys.mjs.map\n"],"names":["CacheManager","constructor","clientId","cryptoImpl","logger","staticAuthorityOptions","this","commonLogger","clone","getAllAccounts","accountFilter","buildTenantProfiles","getAccountsFilteredBy","getAccountInfoFilteredBy","allAccounts","length","sort","account","idTokenClaims","getBaseAccountInfo","accountEntities","getAccountInfo","cachedAccounts","flatMap","accountEntity","getTenantProfilesFromAccountEntity","tenantId","getTenantedAccountInfoByFilter","accountInfo","tokenKeys","tenantProfile","tenantProfileFilter","tenantedAccountInfo","tenantProfileMatchesFilter","idToken","getIdToken","secret","base64Decode","idTokenClaimsMatchTenantProfileFilter","targetTenantId","searchTenantProfiles","tenantProfiles","Map","getTokenKeys","get","matchingTenantProfiles","forEach","push","localAccountId","matchLocalAccountIdFromTenantProfile","name","undefined","isHomeTenant","matchLocalAccountIdFromTokenClaims","loginHint","matchLoginHintFromTokenClaims","username","matchUsername","preferred_username","matchName","sid","matchSid","async","cacheRecord","storeInCache","correlationId","setAccount","setIdTokenCredential","accessToken","saveAccessToken","refreshToken","setRefreshTokenCredential","appMetadata","setAppMetadata","e","error","Error","errorPii","message","includes","credential","accessTokenFilter","credentialType","environment","homeAccountId","realm","tokenType","requestedClaimsHash","currentScopes","target","removedAccessTokens","key","accessTokenKeyMatchesFilter","tokenEntity","getAccessTokenCredential","credentialMatchesFilter","intersectingScopeSets","removeAccessToken","Promise","all","setAccessTokenCredential","allAccountKeys","getAccountKeys","matchingAccounts","cacheKey","isAccountKey","entity","getAccount","matchHomeAccountId","matchEnvironment","matchRealm","nativeAccountId","matchNativeAccountId","authorityType","matchAuthorityType","filter","split","toLowerCase","isCredentialKey","lowerCaseKey","indexOf","clientIdValidation","familyIdValidation","matchClientId","userAssertionHash","matchUserAssertionHash","matchCredentialType","familyId","matchFamilyId","matchTarget","matchTokenType","keyId","matchKeyId","getAppMetadataFilteredBy","allCacheKeys","getKeys","matchingAppMetadata","isAppMetadata","getAppMetadata","getAuthorityMetadataByAlias","host","getAuthorityMetadataKeys","matchedEntity","isAuthorityMetadata","getAuthorityMetadata","aliases","removedAccounts","removeAccount","accountKey","removeAccountContext","removeItem","allTokenKeys","accountId","generateAccountId","removedCredentials","removeIdToken","removeRefreshToken","updateOutdatedCachedAccount","isSingleTenant","verbose","matchingAccountKeys","startsWith","accountsToMerge","getCachedAccountEntity","baseAccount","find","map","updatedAccount","toObject","newAccountKey","generateAccountKey","removeOutdatedAccount","kid","removeTokenBindingKey","removeAppMetadata","readAccountFromCache","targetRealm","performanceClient","trace","idTokenFilter","idTokenMap","getIdTokensByFilter","numIdTokens","size","info","tokensToBeRemoved","homeIdTokenMap","set","numHomeIdTokens","values","next","value","addFields","multiMatchedID","idTokenKeys","idTokens","idTokenKeyMatchesFilter","getIdTokenCredential","inputKey","getAccessToken","request","scopes","authScheme","authenticationScheme","sshKid","accessTokenKeys","accessTokens","numAccessTokens","multiMatchedAT","keyMustContainAllScopes","asArray","i","getAccessTokensByFilter","getRefreshToken","familyRT","id","refreshTokenFilter","refreshTokenKeys","refreshTokens","refreshTokenKeyMatchesFilter","getRefreshTokenCredential","numRefreshTokens","multiMatchedRT","readAppMetadataFromCache","appMetadataFilter","appMetadataEntries","Object","keys","numAppMetadata","isAppMetadataFOCI","tokenClaims","oid","sub","claims","cachedUsername","filterUsername","staticAliases","cloudMetadata","login_hint","upn","containsScopeSet","generateAuthorityMetadataCacheKey","authority","static","obj","json","propertyName","DefaultStorageClass","setServerTelemetry","getServerTelemetry","setAuthorityMetadata","setThrottlingCache","getThrottlingCache","updateCredentialCacheKey","AccountEntity","join","generateAccountCacheKey","accountInterface","homeTenantId","accountDetails","clientInfo","protocolMode","env","getPreferredCache","utid","uid","preferredUsername","email","emails","cloudGraphHostName","msGraphHost","Array","from","serverClientInfo","authType","cryptoObj","warning","hasOwnProperty","accountA","accountB","compareClaims","claimsMatch","accountAClaims","accountBClaims","iat","nonce","TokenCacheContext","tokenCache","hasChanged","cache","cacheHasChanged","generateCredentialKey","credentialEntity","generateCredentialId","generateTarget","generateClaimsHash","generateScheme","createIdTokenEntity","createAccessTokenEntity","expiresOn","extExpiresOn","refreshOn","requestedClaims","atEntity","cachedAt","toString","extendedExpiresOn","cnf","createRefreshTokenEntity","rtEntity","isCredentialEntity","isAccessTokenEntity","isIdTokenEntity","isRefreshTokenEntity","clientOrFamilyId","isServerTelemetryEntity","validateKey","validateEntity","isThrottlingEntity","generateAppMetadataKey","isAppMetadataEntity","isAuthorityMetadataEntity","generateAuthorityMetadataExpiresAt","updateAuthorityEndpointMetadata","authorityMetadata","updatedValues","fromNetwork","authorization_endpoint","token_endpoint","end_session_endpoint","issuer","endpointsFromNetwork","jwks_uri","updateCloudDiscoveryMetadata","preferred_cache","preferred_network","aliasesFromNetwork","isAuthorityMetadataExpired","metadata","expiresAt","AuthorizationCodeClient","configuration","super","includeRedirectUri","oidcDefaultScopes","config","authOptions","options","OIDCOptions","defaultScopes","addQueueMeasurement","queryString","createAuthCodeUrlQueryString","bind","authorizationEndpoint","authCodePayload","code","reqTimestamp","response","executeTokenRequest","requestId","headers","responseHandler","cacheManager","cryptoUtils","serializableCache","persistencePlugin","validateTokenResponse","body","handleServerTokenResponse","handleFragmentResponse","serverParams","cachedState","validateServerAuthorizationCodeResponse","getLogoutUri","logoutRequest","createLogoutUrlQueryString","endSessionEndpoint","queryParametersString","createTokenQueryParameters","endpoint","tokenEndpoint","requestBody","createTokenRequestBody","ccsCredential","type","createTokenRequestHeaders","thumbprint","tokenBodyParameters","canonicalAuthority","resourceRequestMethod","resourceRequestUri","shrClaims","executePostToTokenEndpoint","parameterBuilder","addClientId","addRedirectUri","redirectUri","addScopes","addAuthorizationCode","addLibraryInfo","libraryInfo","addApplicationTelemetry","telemetry","application","addThrottling","serverTelemetryManager","addServerTelemetry","codeVerifier","addCodeVerifier","clientCredentials","clientSecret","addClientSecret","clientAssertion","addClientAssertion","assertion","addClientAssertionType","assertionType","addGrantType","addClientInfo","popTokenGenerator","reqCnfData","popKid","encodeKid","generateCnf","reqCnfString","addPopToken","sshJwk","addSshJwk","cryptoInterface","createNewGuid","ccsCred","addCorrelationId","clientCapabilities","addClaims","systemOptions","preventCorsPreflight","addCcsOid","addCcsUpn","addExtraQueryParameters","enableSpaAuthorizationCode","createQueryString","extraQueryParameters","requestScopes","extraScopesToConsent","addResponseMode","responseMode","addResponseTypeCode","codeChallenge","codeChallengeMethod","addCodeChallengeParams","prompt","addPrompt","domainHint","addDomainHint","addSid","accountSid","extractAccountSid","accountLoginHintClaim","extractLoginHint","addLoginHint","addNonce","state","addState","nativeBroker","addNativeBroker","postLogoutRedirectUri","addPostLogoutRedirectUri","idTokenHint","addIdTokenHint","logoutHint","addLogoutHint","BaseClient","loggerOptions","storageInterface","networkClient","networkInterface","networkManager","queuedEvent","sendPostRequest","refreshTokenSize","refresh_token","httpVerToken","status","clearTelemetryCache","cloudInstanceHostname","cloudInstanceAuthorityUri","tenant","cloudInstanceAuthority","tokenQueryParameters","RefreshTokenClient","forceCache","acquireTokenWithCachedRefreshToken","noFamilyRTInCache","errorCode","clientMismatchErrorWithFamilyRT","subError","foci","refreshTokenExpirationOffsetSeconds","refreshTokenRequest","acquireToken","badRefreshTokenKey","addRefreshToken","SilentFlowClient","authResponse","cacheOutcome","acquireCachedToken","acquireTokenByRefreshToken","catch","lastCacheOutcome","forceRefresh","cacheOptions","claimsBasedCachingEnabled","setCacheOutcome","requestTenantId","cachedAccessToken","tokenRenewalOffsetSeconds","incrementCacheHits","generateResultFromCacheRecord","maxAge","authTime","auth_time","DEFAULT_SYSTEM_OPTIONS","DEFAULT_LOGGER_IMPLEMENTATION","loggerCallback","piiLoggingEnabled","logLevel","DEFAULT_CACHE_OPTIONS","DEFAULT_NETWORK_IMPLEMENTATION","DEFAULT_LIBRARY_INFO","sku","version","cpu","os","DEFAULT_CLIENT_CREDENTIALS","DEFAULT_AZURE_CLOUD_OPTIONS","azureCloudInstance","DEFAULT_TELEMETRY_OPTIONS","appName","appVersion","buildClientConfiguration","userAuthOptions","userSystemOptions","userLoggerOption","userCacheOptions","storageImplementation","networkImplementation","cryptoImplementation","azureCloudOptions","skipAuthorityMetadataCache","isOidcProtocolMode","CLIENT_ID","REDIRECT_URI","RESPONSE_TYPE","RESPONSE_MODE","GRANT_TYPE","CLAIMS","SCOPE","REFRESH_TOKEN","STATE","NONCE","PROMPT","CODE","CODE_CHALLENGE","CODE_CHALLENGE_METHOD","CODE_VERIFIER","CLIENT_REQUEST_ID","X_CLIENT_SKU","X_CLIENT_VER","X_CLIENT_OS","X_CLIENT_CPU","X_CLIENT_CURR_TELEM","X_CLIENT_LAST_TELEM","X_MS_LIB_CAPABILITY","X_APP_NAME","X_APP_VER","POST_LOGOUT_URI","ID_TOKEN_HINT","DEVICE_CODE","CLIENT_SECRET","CLIENT_ASSERTION","CLIENT_ASSERTION_TYPE","TOKEN_TYPE","REQ_CNF","OBO_ASSERTION","REQUESTED_TOKEN_USE","RETURN_SPA_CODE","NATIVE_BROKER","LOGOUT_HINT","SID","LOGIN_HINT","DOMAIN_HINT","X_CLIENT_EXTRA_SKU"],"sourceRoot":""}