Estructura inicial del proyecto

backend/node_modules/@azure/msal-browser/dist/utils/BrowserConstants.mjs

@@ -0,0 +1,221 @@
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
+'use strict';
+import { Constants } from '@azure/msal-common/browser';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Constants
+ */
+const BrowserConstants = {
+    /**
+     * Invalid grant error code
+     */
+    INVALID_GRANT_ERROR: "invalid_grant",
+    /**
+     * Default popup window width
+     */
+    POPUP_WIDTH: 483,
+    /**
+     * Default popup window height
+     */
+    POPUP_HEIGHT: 600,
+    /**
+     * Name of the popup window starts with
+     */
+    POPUP_NAME_PREFIX: "msal",
+    /**
+     * Msal-browser SKU
+     */
+    MSAL_SKU: "msal.js.browser",
+};
+const PlatformAuthConstants = {
+    CHANNEL_ID: "53ee284d-920a-4b59-9d30-a60315b26836",
+    PREFERRED_EXTENSION_ID: "ppnbnpeolgkicgegkbkbjmhlideopiji",
+    MATS_TELEMETRY: "MATS",
+    MICROSOFT_ENTRA_BROKERID: "MicrosoftEntra",
+    DOM_API_NAME: "DOM API",
+    PLATFORM_DOM_APIS: "get-token-and-sign-out",
+    PLATFORM_DOM_PROVIDER: "PlatformAuthDOMHandler",
+    PLATFORM_EXTENSION_PROVIDER: "PlatformAuthExtensionHandler",
+};
+const NativeExtensionMethod = {
+    HandshakeRequest: "Handshake",
+    HandshakeResponse: "HandshakeResponse",
+    GetToken: "GetToken",
+    Response: "Response",
+};
+const BrowserCacheLocation = {
+    LocalStorage: "localStorage",
+    SessionStorage: "sessionStorage",
+    MemoryStorage: "memoryStorage",
+};
+/**
+ * HTTP Request types supported by MSAL.
+ */
+const HTTP_REQUEST_TYPE = {
+    GET: "GET",
+    POST: "POST",
+};
+const INTERACTION_TYPE = {
+    SIGNIN: "signin",
+    SIGNOUT: "signout",
+};
+/**
+ * Temporary cache keys for MSAL, deleted after any request.
+ */
+const TemporaryCacheKeys = {
+    ORIGIN_URI: "request.origin",
+    URL_HASH: "urlHash",
+    REQUEST_PARAMS: "request.params",
+    VERIFIER: "code.verifier",
+    INTERACTION_STATUS_KEY: "interaction.status",
+    NATIVE_REQUEST: "request.native",
+};
+/**
+ * Cache keys stored in-memory
+ */
+const InMemoryCacheKeys = {
+    WRAPPER_SKU: "wrapper.sku",
+    WRAPPER_VER: "wrapper.version",
+};
+/**
+ * API Codes for Telemetry purposes.
+ * Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
+ * 0-99 Silent Flow
+ * 800-899 Auth Code Flow
+ * 900-999 Misc
+ */
+const ApiId = {
+    acquireTokenRedirect: 861,
+    acquireTokenPopup: 862,
+    ssoSilent: 863,
+    acquireTokenSilent_authCode: 864,
+    handleRedirectPromise: 865,
+    acquireTokenByCode: 866,
+    acquireTokenSilent_silentFlow: 61,
+    logout: 961,
+    logoutPopup: 962,
+    hydrateCache: 963,
+    loadExternalTokens: 964,
+};
+/**
+ * API Names for Telemetry purposes.
+ */
+const ApiName = {
+    861: "acquireTokenRedirect",
+    862: "acquireTokenPopup",
+    863: "ssoSilent",
+    864: "acquireTokenSilent_authCode",
+    865: "handleRedirectPromise",
+    866: "acquireTokenByCode",
+    61: "acquireTokenSilent_silentFlow",
+    961: "logout",
+    962: "logoutPopup",
+    963: "hydrateCache",
+    964: "loadExternalTokens",
+};
+const apiIdToName = (id) => {
+    if (typeof id === "number" && id in ApiName) {
+        return ApiName[id];
+    }
+    return "unknown";
+};
+/*
+ * Interaction type of the API - used for state and telemetry
+ */
+var InteractionType;
+(function (InteractionType) {
+    InteractionType["Redirect"] = "redirect";
+    InteractionType["Popup"] = "popup";
+    InteractionType["Silent"] = "silent";
+    InteractionType["None"] = "none";
+})(InteractionType || (InteractionType = {}));
+/**
+ * Types of interaction currently in progress.
+ * Used in events in wrapper libraries to invoke functions when certain interaction is in progress or all interactions are complete.
+ */
+const InteractionStatus = {
+    /**
+     * Initial status before interaction occurs
+     */
+    Startup: "startup",
+    /**
+     * Status set when logout call occuring
+     */
+    Logout: "logout",
+    /**
+     * Status set for acquireToken calls
+     */
+    AcquireToken: "acquireToken",
+    /**
+     * Status set when handleRedirect in progress
+     */
+    HandleRedirect: "handleRedirect",
+    /**
+     * Status set when interaction is complete
+     */
+    None: "none",
+};
+const DEFAULT_REQUEST = {
+    scopes: Constants.OIDC_DEFAULT_SCOPES,
+};
+/**
+ * JWK Key Format string (Type MUST be defined for window crypto APIs)
+ */
+const KEY_FORMAT_JWK = "jwk";
+// Supported wrapper SKUs
+const WrapperSKU = {
+    React: "@azure/msal-react",
+    Angular: "@azure/msal-angular",
+};
+// DatabaseStorage Constants
+const DB_NAME = "msal.db";
+const DB_VERSION = 1;
+const DB_TABLE_NAME = `${DB_NAME}.keys`;
+const CacheLookupPolicy = {
+    /*
+     * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired
+     * or cannot be found the refresh token will be used to acquire a new one. Finally, if the refresh token
+     * is expired acquireTokenSilent will attempt to acquire new access and refresh tokens.
+     */
+    Default: 0,
+    /*
+     * acquireTokenSilent will only look for access tokens in the cache. It will not attempt to renew access or
+     * refresh tokens.
+     */
+    AccessToken: 1,
+    /*
+     * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired or
+     * cannot be found, the refresh token will be used to acquire a new one. If the refresh token is expired, it
+     * will not be renewed and acquireTokenSilent will fail.
+     */
+    AccessTokenAndRefreshToken: 2,
+    /*
+     * acquireTokenSilent will not attempt to retrieve access tokens from the cache and will instead attempt to
+     * exchange the cached refresh token for a new access token. If the refresh token is expired, it will not be
+     * renewed and acquireTokenSilent will fail.
+     */
+    RefreshToken: 3,
+    /*
+     * acquireTokenSilent will not look in the cache for the access token. It will go directly to network with the
+     * cached refresh token. If the refresh token is expired an attempt will be made to renew it. This is equivalent to
+     * setting "forceRefresh: true".
+     */
+    RefreshTokenAndNetwork: 4,
+    /*
+     * acquireTokenSilent will attempt to renew both access and refresh tokens. It will not look in the cache. This will
+     * always fail if 3rd party cookies are blocked by the browser.
+     */
+    Skip: 5,
+};
+const iFrameRenewalPolicies = [
+    CacheLookupPolicy.Default,
+    CacheLookupPolicy.Skip,
+    CacheLookupPolicy.RefreshTokenAndNetwork,
+];
+
+export { ApiId, ApiName, BrowserCacheLocation, BrowserConstants, CacheLookupPolicy, DB_NAME, DB_TABLE_NAME, DB_VERSION, DEFAULT_REQUEST, HTTP_REQUEST_TYPE, INTERACTION_TYPE, InMemoryCacheKeys, InteractionStatus, InteractionType, KEY_FORMAT_JWK, NativeExtensionMethod, PlatformAuthConstants, TemporaryCacheKeys, WrapperSKU, apiIdToName, iFrameRenewalPolicies };
+//# sourceMappingURL=BrowserConstants.mjs.map

backend/node_modules/@azure/msal-browser/dist/utils/BrowserConstants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserConstants.mjs","sources":["../../src/utils/BrowserConstants.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAMH;;AAEG;AACU,MAAA,gBAAgB,GAAG;AAC5B,IAIA;;AAEG;AACH,IAAA,mBAAmB,EAAE,eAAe;AACpC;;AAEG;AACH,IAAA,WAAW,EAAE,GAAG;AAChB;;AAEG;AACH,IAAA,YAAY,EAAE,GAAG;AACjB;;AAEG;AACH,IAAA,iBAAiB,EAAE,MAAM;AACzB;;AAEG;AACH,IAAA,QAAQ,EAAE,iBAAiB;EAC7B;AAEW,MAAA,qBAAqB,GAAG;AACjC,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,sBAAsB,EAAE,kCAAkC;AAC1D,IAAA,cAAc,EAAE,MAAM;AACtB,IAAA,wBAAwB,EAAE,gBAAgB;AAC1C,IAAA,YAAY,EAAE,SAAS;AACvB,IAAA,iBAAiB,EAAE,wBAAwB;AAC3C,IAAA,qBAAqB,EAAE,wBAAwB;AAC/C,IAAA,2BAA2B,EAAE,8BAA8B;EAC7D;AAEW,MAAA,qBAAqB,GAAG;AACjC,IAAA,gBAAgB,EAAE,WAAW;AAC7B,IAAA,iBAAiB,EAAE,mBAAmB;AACtC,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,QAAQ,EAAE,UAAU;EACb;AAIE,MAAA,oBAAoB,GAAG;AAChC,IAAA,YAAY,EAAE,cAAc;AAC5B,IAAA,cAAc,EAAE,gBAAgB;AAChC,IAAA,aAAa,EAAE,eAAe;EACvB;AAIX;;AAEG;AACU,MAAA,iBAAiB,GAAG;AAC7B,IAAA,GAAG,EAAE,KAAK;AACV,IAAA,IAAI,EAAE,MAAM;EACL;AAIE,MAAA,gBAAgB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,OAAO,EAAE,SAAS;EACX;AAIX;;AAEG;AACU,MAAA,kBAAkB,GAAG;AAC9B,IAAA,UAAU,EAAE,gBAAgB;AAC5B,IAAA,QAAQ,EAAE,SAAS;AACnB,IAAA,cAAc,EAAE,gBAAgB;AAChC,IAAA,QAAQ,EAAE,eAAe;AACzB,IAAA,sBAAsB,EAAE,oBAAoB;AAC5C,IAAA,cAAc,EAAE,gBAAgB;EACzB;AAIX;;AAEG;AACU,MAAA,iBAAiB,GAAG;AAC7B,IAAA,WAAW,EAAE,aAAa;AAC1B,IAAA,WAAW,EAAE,iBAAiB;EACvB;AAIX;;;;;;AAMG;AACU,MAAA,KAAK,GAAG;AACjB,IAAA,oBAAoB,EAAE,GAAG;AACzB,IAAA,iBAAiB,EAAE,GAAG;AACtB,IAAA,SAAS,EAAE,GAAG;AACd,IAAA,2BAA2B,EAAE,GAAG;AAChC,IAAA,qBAAqB,EAAE,GAAG;AAC1B,IAAA,kBAAkB,EAAE,GAAG;AACvB,IAAA,6BAA6B,EAAE,EAAE;AACjC,IAAA,MAAM,EAAE,GAAG;AACX,IAAA,WAAW,EAAE,GAAG;AAChB,IAAA,YAAY,EAAE,GAAG;AACjB,IAAA,kBAAkB,EAAE,GAAG;EAChB;AAGX;;AAEG;AACU,MAAA,OAAO,GAAG;AACnB,IAAA,GAAG,EAAE,sBAAsB;AAC3B,IAAA,GAAG,EAAE,mBAAmB;AACxB,IAAA,GAAG,EAAE,WAAW;AAChB,IAAA,GAAG,EAAE,6BAA6B;AAClC,IAAA,GAAG,EAAE,uBAAuB;AAC5B,IAAA,GAAG,EAAE,oBAAoB;AACzB,IAAA,EAAE,EAAE,+BAA+B;AACnC,IAAA,GAAG,EAAE,QAAQ;AACb,IAAA,GAAG,EAAE,aAAa;AAClB,IAAA,GAAG,EAAE,cAAc;AACnB,IAAA,GAAG,EAAE,oBAAoB;EACc;AAE9B,MAAA,WAAW,GAAG,CAAC,EAAsB,KAAY;IAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,IAAI,OAAO,EAAE;AACzC,QAAA,OAAO,OAAO,CAAC,EAAW,CAAC,CAAC;AAC/B,KAAA;AACD,IAAA,OAAO,SAAS,CAAC;AACrB,EAAE;AAEF;;AAEG;IACS,gBAKX;AALD,CAAA,UAAY,eAAe,EAAA;AACvB,IAAA,eAAA,CAAA,UAAA,CAAA,GAAA,UAAqB,CAAA;AACrB,IAAA,eAAA,CAAA,OAAA,CAAA,GAAA,OAAe,CAAA;AACf,IAAA,eAAA,CAAA,QAAA,CAAA,GAAA,QAAiB,CAAA;AACjB,IAAA,eAAA,CAAA,MAAA,CAAA,GAAA,MAAa,CAAA;AACjB,CAAC,EALW,eAAe,KAAf,eAAe,GAK1B,EAAA,CAAA,CAAA,CAAA;AAED;;;AAGG;AACU,MAAA,iBAAiB,GAAG;AAC7B;;AAEG;AACH,IAAA,OAAO,EAAE,SAAS;AAClB;;AAEG;AACH,IAAA,MAAM,EAAE,QAAQ;AAChB;;AAEG;AACH,IAAA,YAAY,EAAE,cAAc;AAC5B;;AAEG;AACH,IAAA,cAAc,EAAE,gBAAgB;AAChC;;AAEG;AACH,IAAA,IAAI,EAAE,MAAM;EACL;AAIE,MAAA,eAAe,GAAmC;IAC3D,MAAM,EAAE,SAAS,CAAC,mBAAmB;EACvC;AAEF;;AAEG;AACI,MAAM,cAAc,GAAG,MAAM;AAEpC;AACa,MAAA,UAAU,GAAG;AACtB,IAAA,KAAK,EAAE,mBAAmB;AAC1B,IAAA,OAAO,EAAE,qBAAqB;EACvB;AAGX;AACO,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,UAAU,GAAG,EAAE;AACf,MAAA,aAAa,GAAG,CAAG,EAAA,OAAO,QAAQ;AAElC,MAAA,iBAAiB,GAAG;AAC7B;;;;AAIG;AACH,IAAA,OAAO,EAAE,CAAC;AACV;;;AAGG;AACH,IAAA,WAAW,EAAE,CAAC;AACd;;;;AAIG;AACH,IAAA,0BAA0B,EAAE,CAAC;AAC7B;;;;AAIG;AACH,IAAA,YAAY,EAAE,CAAC;AACf;;;;AAIG;AACH,IAAA,sBAAsB,EAAE,CAAC;AACzB;;;AAGG;AACH,IAAA,IAAI,EAAE,CAAC;EACA;AAIE,MAAA,qBAAqB,GAAwB;AACtD,IAAA,iBAAiB,CAAC,OAAO;AACzB,IAAA,iBAAiB,CAAC,IAAI;AACtB,IAAA,iBAAiB,CAAC,sBAAsB;;;;;"}

backend/node_modules/@azure/msal-browser/dist/utils/BrowserProtocolUtils.mjs

@@ -0,0 +1,28 @@
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
+'use strict';
+import { ProtocolUtils, createClientAuthError, ClientAuthErrorCodes } from '@azure/msal-common/browser';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+function extractBrowserRequestState(browserCrypto, state) {
+    if (!state) {
+        return null;
+    }
+    try {
+        const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto.base64Decode, state);
+        return requestStateObj.libraryState.meta;
+    }
+    catch (e) {
+        throw createClientAuthError(ClientAuthErrorCodes.invalidState);
+    }
+}
+
+export { extractBrowserRequestState };
+//# sourceMappingURL=BrowserProtocolUtils.mjs.map

backend/node_modules/@azure/msal-browser/dist/utils/BrowserProtocolUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserProtocolUtils.mjs","sources":["../../src/utils/BrowserProtocolUtils.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAeH;;;;AAIG;AACa,SAAA,0BAA0B,CACtC,aAAsB,EACtB,KAAa,EAAA;IAEb,IAAI,CAAC,KAAK,EAAE;AACR,QAAA,OAAO,IAAI,CAAC;AACf,KAAA;IAED,IAAI;AACA,QAAA,MAAM,eAAe,GACjB,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACvE,QAAA,OAAO,eAAe,CAAC,YAAY,CAAC,IAA0B,CAAC;AAClE,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAClE,KAAA;AACL;;;;"}

backend/node_modules/@azure/msal-browser/dist/utils/BrowserUtils.mjs

@@ -0,0 +1,349 @@
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
+'use strict';
+import { RequestParameterBuilder, ProtocolUtils, UrlString, UrlUtils } from '@azure/msal-common/browser';
+export { invoke, invokeAsync } from '@azure/msal-common/browser';
+import { WaitForBridgeLateResponse } from '../telemetry/BrowserPerformanceEvents.mjs';
+import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
+import { InteractionType, BrowserCacheLocation } from './BrowserConstants.mjs';
+import { createNewGuid } from '../crypto/BrowserCrypto.mjs';
+import { createBrowserConfigurationAuthError } from '../error/BrowserConfigurationAuthError.mjs';
+import { timedOut, emptyResponse, noStateInHash, unableToParseState, interactionInProgressCancelled, redirectBridgeEmptyResponse, blockIframeReload, redirectInIframe, blockNestedPopups, nonBrowserEnvironment, uninitializedPublicClientApplication } from '../error/BrowserAuthErrorCodes.mjs';
+import { base64Decode } from '../encode/Base64Decode.mjs';
+import { inMemRedirectUnavailable } from '../error/BrowserConfigurationAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extracts and parses the authentication response from URL (hash and/or query string).
+ * This is a shared utility used across multiple components in msal-browser.
+ *
+ * @returns {Object} An object containing the parsed state information and URL parameters.
+ * @returns {URLSearchParams} params - The parsed URL parameters from the payload.
+ * @returns {string} payload - The combined query string and hash content.
+ * @returns {string} urlHash - The original URL hash.
+ * @returns {string} urlQuery - The original URL query string.
+ * @returns {LibraryStateObject} libraryState - The decoded library state from the state parameter.
+ *
+ * @throws {AuthError} If no authentication payload is found in the URL.
+ * @throws {AuthError} If the state parameter is missing.
+ * @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
+ */
+function parseAuthResponseFromUrl() {
+    // Extract both hash and query string to support hybrid response format
+    const urlHash = window.location.hash;
+    const urlQuery = window.location.search;
+    // Determine which part contains the auth response by checking for 'state' parameter
+    let hasResponseInHash = false;
+    let hasResponseInQuery = false;
+    let payload = "";
+    let params = undefined;
+    if (urlHash && urlHash.length > 1) {
+        const hashContent = urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash;
+        const hashParams = new URLSearchParams(hashContent);
+        if (hashParams.has("state")) {
+            hasResponseInHash = true;
+            payload = hashContent;
+            params = hashParams;
+        }
+    }
+    if (urlQuery && urlQuery.length > 1) {
+        const queryContent = urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery;
+        const queryParams = new URLSearchParams(queryContent);
+        if (queryParams.has("state")) {
+            hasResponseInQuery = true;
+            payload = queryContent;
+            params = queryParams;
+        }
+    }
+    // If response is in both, combine them (hybrid format)
+    if (hasResponseInHash && hasResponseInQuery) {
+        const queryContent = urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery;
+        const hashContent = urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash;
+        payload = `${queryContent}${hashContent}`;
+        params = new URLSearchParams(payload);
+    }
+    if (!payload || !params) {
+        throw createBrowserAuthError(emptyResponse);
+    }
+    const state = params.get("state");
+    if (!state) {
+        throw createBrowserAuthError(noStateInHash);
+    }
+    const { libraryState } = ProtocolUtils.parseRequestState(base64Decode, state);
+    const { id, meta } = libraryState;
+    if (!id || !meta) {
+        throw createBrowserAuthError(unableToParseState, "missing_library_state");
+    }
+    return {
+        params,
+        payload,
+        urlHash,
+        urlQuery,
+        hasResponseInHash,
+        hasResponseInQuery,
+        libraryState: {
+            id,
+            meta,
+        },
+    };
+}
+/**
+ * Clears hash from window url.
+ */
+function clearHash(contentWindow) {
+    // Office.js sets history.replaceState to null
+    contentWindow.location.hash = "";
+    if (typeof contentWindow.history.replaceState === "function") {
+        // Full removes "#" from url
+        contentWindow.history.replaceState(null, "", `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`);
+    }
+}
+/**
+ * Replaces current hash with hash from provided url
+ */
+function replaceHash(url) {
+    const urlParts = url.split("#");
+    urlParts.shift(); // Remove part before the hash
+    window.location.hash = urlParts.length > 0 ? urlParts.join("#") : "";
+}
+/**
+ * Returns boolean of whether the current window is in an iframe or not.
+ */
+function isInIframe() {
+    return window.parent !== window;
+}
+/**
+ * Returns boolean of whether or not the current window is a popup opened by msal
+ */
+function isInPopup() {
+    if (isInIframe()) {
+        return false;
+    }
+    try {
+        const { libraryState } = parseAuthResponseFromUrl();
+        const { meta } = libraryState;
+        return meta["interactionType"] === InteractionType.Popup;
+    }
+    catch (e) {
+        // If parsing fails (no state, invalid URL, etc.), we're not in a popup
+        return false;
+    }
+}
+/**
+ * Await a response from a redirect bridge using BroadcastChannel.
+ * This unified function works for both popup and iframe scenarios by listening on a
+ * BroadcastChannel for the server payload.
+ *
+ * @param timeoutMs - Timeout in milliseconds.
+ * @param logger - Logger instance for logging monitoring events.
+ * @param browserCrypto - Browser crypto instance for decoding state.
+ * @param request - The authorization or end session request.
+ * @returns Promise<string> - Resolves with the response string (query or hash) from the window.
+ */
+// Track the active bridge monitor to allow cancellation when overriding interactions
+let activeBridgeMonitor = null;
+/**
+ * Cancels the pending bridge response monitor if one exists.
+ * This is called when overrideInteractionInProgress is used to cancel
+ * any pending popup interaction before starting a new one.
+ */
+function cancelPendingBridgeResponse(logger, correlationId) {
+    if (activeBridgeMonitor) {
+        logger.verbose("18y01k", correlationId);
+        clearTimeout(activeBridgeMonitor.timeoutId);
+        activeBridgeMonitor.channel.close();
+        activeBridgeMonitor.reject(createBrowserAuthError(interactionInProgressCancelled));
+        activeBridgeMonitor = null;
+    }
+}
+async function waitForBridgeResponse(timeoutMs, logger, browserCrypto, request, performanceClient, experimentalConfig) {
+    return new Promise((resolve, reject) => {
+        logger.verbose("1rf6em", request.correlationId);
+        const correlationId = request.correlationId;
+        performanceClient.addFields({
+            redirectBridgeTimeoutMs: timeoutMs,
+            lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
+        }, correlationId);
+        const { libraryState } = ProtocolUtils.parseRequestState(browserCrypto.base64Decode, request.state || "");
+        const channel = new BroadcastChannel(libraryState.id);
+        let responseString = undefined;
+        let timedOut$1 = false;
+        let lateTimeoutId;
+        let lateMeasurement;
+        const timeoutId = window.setTimeout(() => {
+            // Clear the active monitor
+            activeBridgeMonitor = null;
+            if (experimentalConfig?.iframeTimeoutTelemetry) {
+                lateMeasurement = performanceClient.startMeasurement(WaitForBridgeLateResponse, correlationId);
+                timedOut$1 = true;
+                lateTimeoutId = window.setTimeout(() => {
+                    lateMeasurement?.end({ success: false });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                }, 60000); // 60s late response timeout to allow for telemetry of late responses
+            }
+            else {
+                channel.close();
+            }
+            reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
+        }, timeoutMs);
+        // Track this monitor so it can be cancelled if needed
+        activeBridgeMonitor = {
+            timeoutId,
+            channel,
+            reject,
+        };
+        channel.onmessage = (event) => {
+            responseString = event.data.payload;
+            const messageVersion = event?.data && typeof event.data.v === "number"
+                ? event.data.v
+                : undefined;
+            if (timedOut$1) {
+                lateMeasurement?.end({
+                    success: responseString ? true : false,
+                });
+                clearTimeout(lateTimeoutId);
+                channel.close();
+                return;
+            }
+            performanceClient.addFields({
+                redirectBridgeMessageVersion: messageVersion,
+            }, correlationId);
+            // Clear the active monitor
+            activeBridgeMonitor = null;
+            clearTimeout(timeoutId);
+            channel.close();
+            if (responseString) {
+                resolve(responseString);
+            }
+            else {
+                reject(createBrowserAuthError(redirectBridgeEmptyResponse));
+            }
+        };
+    });
+}
+// #endregion
+/**
+ * Returns current window URL as redirect uri
+ */
+function getCurrentUri() {
+    return typeof window !== "undefined" && window.location
+        ? window.location.href.split("?")[0].split("#")[0]
+        : "";
+}
+/**
+ * Gets the homepage url for the current window location.
+ */
+function getHomepage() {
+    const currentUrl = new UrlString(window.location.href);
+    const urlComponents = currentUrl.getUrlComponents();
+    return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
+}
+/**
+ * Throws error if we have completed an auth and are
+ * attempting another auth request inside an iframe.
+ */
+function blockReloadInHiddenIframes() {
+    const isResponseHash = UrlUtils.getDeserializedResponse(window.location.hash);
+    // return an error if called from the hidden iframe created by the msal js silent calls
+    if (isResponseHash && isInIframe()) {
+        throw createBrowserAuthError(blockIframeReload);
+    }
+}
+/**
+ * Block redirect operations in iframes unless explicitly allowed
+ * @param interactionType Interaction type for the request
+ * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
+ */
+function blockRedirectInIframe(allowRedirectInIframe) {
+    if (isInIframe() && !allowRedirectInIframe) {
+        // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
+        throw createBrowserAuthError(redirectInIframe);
+    }
+}
+/**
+ * Block redirectUri loaded in popup from calling AcquireToken APIs
+ */
+function blockAcquireTokenInPopups() {
+    // Popups opened by msal popup APIs are given a name that starts with "msal."
+    if (isInPopup()) {
+        throw createBrowserAuthError(blockNestedPopups);
+    }
+}
+/**
+ * Throws error if token requests are made in non-browser environment
+ * @param isBrowserEnvironment Flag indicating if environment is a browser.
+ */
+function blockNonBrowserEnvironment() {
+    if (typeof window === "undefined") {
+        throw createBrowserAuthError(nonBrowserEnvironment);
+    }
+}
+/**
+ * Throws error if initialize hasn't been called
+ * @param initialized
+ */
+function blockAPICallsBeforeInitialize(initialized) {
+    if (!initialized) {
+        throw createBrowserAuthError(uninitializedPublicClientApplication);
+    }
+}
+/**
+ * Helper to validate app environment before making an auth request
+ * @param initialized
+ */
+function preflightCheck(initialized) {
+    // Block request if not in browser environment
+    blockNonBrowserEnvironment();
+    // Block auth requests inside a hidden iframe
+    blockReloadInHiddenIframes();
+    // Block redirectUri opened in a popup from calling MSAL APIs
+    blockAcquireTokenInPopups();
+    // Block token acquisition before initialize has been called
+    blockAPICallsBeforeInitialize(initialized);
+}
+/**
+ * Helper to validate app enviornment before making redirect request
+ * @param initialized
+ * @param config
+ */
+function redirectPreflightCheck(initialized, config) {
+    preflightCheck(initialized);
+    blockRedirectInIframe(config.system.allowRedirectInIframe);
+    // Block redirects if memory storage is enabled
+    if (config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage) {
+        throw createBrowserConfigurationAuthError(inMemRedirectUnavailable);
+    }
+}
+/**
+ * Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
+ * @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
+ * @returns
+ */
+function preconnect(authority) {
+    const link = document.createElement("link");
+    link.rel = "preconnect";
+    link.href = new URL(authority).origin;
+    link.crossOrigin = "anonymous";
+    document.head.appendChild(link);
+    // The browser will close connection if not used within a few seconds, remove element from the header after 10s
+    window.setTimeout(() => {
+        try {
+            document.head.removeChild(link);
+        }
+        catch { }
+    }, 10000); // 10s Timeout
+}
+/**
+ * Wrapper function that creates a UUID v7 from the current timestamp.
+ * @returns {string}
+ */
+function createGuid() {
+    return createNewGuid();
+}
+const addClientCapabilitiesToClaims = RequestParameterBuilder.addClientCapabilitiesToClaims;
+
+export { addClientCapabilitiesToClaims, blockAPICallsBeforeInitialize, blockAcquireTokenInPopups, blockNonBrowserEnvironment, blockRedirectInIframe, blockReloadInHiddenIframes, cancelPendingBridgeResponse, clearHash, createGuid, getCurrentUri, getHomepage, isInIframe, isInPopup, parseAuthResponseFromUrl, preconnect, preflightCheck, redirectPreflightCheck, replaceHash, waitForBridgeResponse };
+//# sourceMappingURL=BrowserUtils.mjs.map

backend/node_modules/@azure/msal-browser/dist/utils/Helpers.mjs

@@ -0,0 +1,20 @@
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Utility function to remove an element from an array in place.
+ * @param array - The array from which to remove the element.
+ * @param element - The element to remove from the array.
+ */
+function removeElementFromArray(array, element) {
+    const index = array.indexOf(element);
+    if (index > -1) {
+        array.splice(index, 1);
+    }
+}
+
+export { removeElementFromArray };
+//# sourceMappingURL=Helpers.mjs.map

backend/node_modules/@azure/msal-browser/dist/utils/Helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Helpers.mjs","sources":["../../src/utils/Helpers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEH;;;;AAIG;AACa,SAAA,sBAAsB,CAClC,KAAoB,EACpB,OAAe,EAAA;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACrC,IAAA,IAAI,KAAK,GAAG,EAAE,EAAE;AACZ,QAAA,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1B,KAAA;AACL;;;;"}

backend/node_modules/@azure/msal-browser/dist/utils/MsalFrameStatsUtils.mjs

@@ -0,0 +1,39 @@
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+function getNetworkInfo() {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection = "connection" in window.navigator
+        ? window.navigator.connection
+        : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
+function collectInstanceStats(currentClientId, performanceEvent, logger, correlationId) {
+    const frameInstances = 
+    // @ts-ignore
+    window.msal?.clientIds || [];
+    const msalInstanceCount = frameInstances.length;
+    const sameClientIdInstanceCount = frameInstances.filter((i) => i === currentClientId).length;
+    if (sameClientIdInstanceCount > 1) {
+        logger.warning("1e88vg", correlationId);
+    }
+    performanceEvent.add({
+        msalInstanceCount: msalInstanceCount,
+        sameClientIdInstanceCount: sameClientIdInstanceCount,
+    });
+}
+
+export { collectInstanceStats, getNetworkInfo };
+//# sourceMappingURL=MsalFrameStatsUtils.mjs.map

backend/node_modules/@azure/msal-browser/dist/utils/MsalFrameStatsUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MsalFrameStatsUtils.mjs","sources":["../../src/utils/MsalFrameStatsUtils.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AASH;;;AAGG;SACa,cAAc,GAAA;IAC1B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;AACpD,QAAA,OAAO,EAAE,CAAC;AACb,KAAA;AACD,IAAA,MAAM,UAAU,GACZ,YAAY,IAAI,MAAM,CAAC,SAAS;AAC5B,UACM,MAAM,CAAC,SAGV,CAAC,UAAU;UACZ,SAAS,CAAC;IACpB,OAAO;QACH,aAAa,EAAE,UAAU,EAAE,aAAa;QACxC,GAAG,EAAE,UAAU,EAAE,GAAG;KACvB,CAAC;AACN,CAAC;AAEK,SAAU,oBAAoB,CAChC,eAAuB,EACvB,gBAA4C,EAC5C,MAAc,EACd,aAAqB,EAAA;AAErB,IAAA,MAAM,cAAc;;AAEhB,IAAA,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;AAEjC,IAAA,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC;AAEhD,IAAA,MAAM,yBAAyB,GAAG,cAAc,CAAC,MAAM,CACnD,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe,CAC/B,CAAC,MAAM,CAAC;IAET,IAAI,yBAAyB,GAAG,CAAC,EAAE;AAC/B,QAAA,MAAM,CAAC,OAAO,CACV;AAGP,KAAA;IACD,gBAAgB,CAAC,GAAG,CAAC;AACjB,QAAA,iBAAiB,EAAE,iBAAiB;AACpC,QAAA,yBAAyB,EAAE,yBAAyB;AACvD,KAAA,CAAC,CAAC;AACP;;;;"}