Estructura inicial del proyecto

backend/node_modules/@azure/msal-common/dist/account/AccountInfo.mjs

@@ -0,0 +1,86 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns true if tenantId matches the utid portion of homeAccountId
+ * @param tenantId
+ * @param homeAccountId
+ * @returns
+ */
+function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
+    return (!!tenantId &&
+        !!homeAccountId &&
+        tenantId === homeAccountId.split(".")[1]);
+}
+/**
+ * Build tenant profile
+ * @param homeAccountId - Home account identifier for this account object
+ * @param localAccountId - Local account identifer for this account object
+ * @param tenantId - Full tenant or organizational id that this account belongs to
+ * @param idTokenClaims - Claims from the ID token
+ * @returns
+ */
+function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+    if (idTokenClaims) {
+        const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
+        /**
+         * Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
+         * tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
+         * tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
+         * acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
+         */
+        const tenantId = tid || tfp || acr || "";
+        return {
+            tenantId: tenantId,
+            localAccountId: oid || sub || "",
+            name: name,
+            username: preferred_username || upn || "",
+            loginHint: login_hint,
+            isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
+        };
+    }
+    else {
+        return {
+            tenantId,
+            localAccountId,
+            username: "",
+            isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+        };
+    }
+}
+/**
+ * Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
+ * @param baseAccountInfo
+ * @param idTokenClaims
+ * @returns
+ */
+function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims, idTokenSecret) {
+    let updatedAccountInfo = baseAccountInfo;
+    // Tenant Profile overrides passed in account info
+    if (tenantProfile) {
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
+        updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
+    }
+    // ID token claims override passed in account info and tenant profile
+    if (idTokenClaims) {
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+        updatedAccountInfo = {
+            ...updatedAccountInfo,
+            ...claimsSourcedTenantProfile,
+            idTokenClaims: idTokenClaims,
+            idToken: idTokenSecret,
+        };
+        return updatedAccountInfo;
+    }
+    return updatedAccountInfo;
+}
+
+export { buildTenantProfile, tenantIdMatchesHomeTenant, updateAccountTenantProfileData };
+//# sourceMappingURL=AccountInfo.mjs.map

backend/node_modules/@azure/msal-common/dist/account/AccountInfo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountInfo.mjs","sources":["../../src/account/AccountInfo.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAiEH;;;;;AAKG;AACa,SAAA,yBAAyB,CACrC,QAAiB,EACjB,aAAsB,EAAA;IAEtB,QACI,CAAC,CAAC,QAAQ;AACV,QAAA,CAAC,CAAC,aAAa;QACf,QAAQ,KAAK,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAC1C;AACN,CAAC;AAED;;;;;;;AAOG;AACG,SAAU,kBAAkB,CAC9B,aAAqB,EACrB,cAAsB,EACtB,QAAgB,EAChB,aAA2B,EAAA;AAE3B,IAAA,IAAI,aAAa,EAAE;QACf,MAAM,EACF,GAAG,EACH,GAAG,EACH,GAAG,EACH,IAAI,EACJ,GAAG,EACH,GAAG,EACH,kBAAkB,EAClB,GAAG,EACH,UAAU,GACb,GAAG,aAAa,CAAC;AAElB;;;;;AAKG;QACH,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAEzC,OAAO;AACH,YAAA,QAAQ,EAAE,QAAQ;AAClB,YAAA,cAAc,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE;AAChC,YAAA,IAAI,EAAE,IAAI;AACV,YAAA,QAAQ,EAAE,kBAAkB,IAAI,GAAG,IAAI,EAAE;AACzC,YAAA,SAAS,EAAE,UAAU;AACrB,YAAA,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC;AAChE,YAAA,GAAG,EAAE,GAAG;SACX,CAAC;AACL,KAAA;AAAM,SAAA;QACH,OAAO;YACH,QAAQ;YACR,cAAc;AACd,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC;SACnE,CAAC;AACL,KAAA;AACL,CAAC;AAED;;;;;AAKG;AACG,SAAU,8BAA8B,CAC1C,eAA4B,EAC5B,aAA6B,EAC7B,aAA2B,EAC3B,aAAsB,EAAA;IAEtB,IAAI,kBAAkB,GAAG,eAAe,CAAC;;AAEzC,IAAA,IAAI,aAAa,EAAE;;QAEf,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,EAAE,GAAG,aAAa,CAAC;QACjE,kBAAkB,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACzE,KAAA;;AAGD,IAAA,IAAI,aAAa,EAAE;;;QAGf,MAAM,EAAE,YAAY,EAAE,GAAG,0BAA0B,EAAE,GACjD,kBAAkB,CACd,eAAe,CAAC,aAAa,EAC7B,eAAe,CAAC,cAAc,EAC9B,eAAe,CAAC,QAAQ,EACxB,aAAa,CAChB,CAAC;AAEN,QAAA,kBAAkB,GAAG;AACjB,YAAA,GAAG,kBAAkB;AACrB,YAAA,GAAG,0BAA0B;AAC7B,YAAA,aAAa,EAAE,aAAa;AAC5B,YAAA,OAAO,EAAE,aAAa;SACzB,CAAC;AAEF,QAAA,OAAO,kBAAkB,CAAC;AAC7B,KAAA;AAED,IAAA,OAAO,kBAAkB,CAAC;AAC9B;;;;"}

backend/node_modules/@azure/msal-common/dist/account/AuthToken.mjs

@@ -0,0 +1,85 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { tokenParsingError, nullOrEmptyToken, maxAgeTranspired } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Extract token by decoding the rawToken
+ *
+ * @param encodedToken
+ */
+function extractTokenClaims(encodedToken, base64Decode) {
+    const jswPayload = getJWSPayload(encodedToken);
+    // token will be decoded to get the username
+    try {
+        // base64Decode() should throw an error if there is an issue
+        const base64Decoded = base64Decode(jswPayload);
+        return JSON.parse(base64Decoded);
+    }
+    catch (err) {
+        throw createClientAuthError(tokenParsingError);
+    }
+}
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+}
+/**
+ * decode a JWT
+ *
+ * @param authToken
+ */
+function getJWSPayload(authToken) {
+    if (!authToken) {
+        throw createClientAuthError(nullOrEmptyToken);
+    }
+    const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+    const matches = tokenPartsRegex.exec(authToken);
+    if (!matches || matches.length < 4) {
+        throw createClientAuthError(tokenParsingError);
+    }
+    /**
+     * const crackedToken = {
+     *  header: matches[1],
+     *  JWSPayload: matches[2],
+     *  JWSSig: matches[3],
+     * };
+     */
+    return matches[2];
+}
+/**
+ * Determine if the token's max_age has transpired
+ */
+function checkMaxAge(authTime, maxAge) {
+    /*
+     * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+     * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+     * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+     */
+    const fiveMinuteSkew = 300000; // five minutes in milliseconds
+    if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
+        throw createClientAuthError(maxAgeTranspired);
+    }
+}
+
+export { checkMaxAge, extractTokenClaims, getJWSPayload, isKmsi };
+//# sourceMappingURL=AuthToken.mjs.map

backend/node_modules/@azure/msal-common/dist/account/AuthToken.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthToken.mjs","sources":["../../src/account/AuthToken.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.tokenParsingError","ClientAuthErrorCodes.nullOrEmptyToken","ClientAuthErrorCodes.maxAgeTranspired"],"mappings":";;;;;AAAA;;;AAGG;AAQH;;;;AAIG;AACa,SAAA,kBAAkB,CAC9B,YAAoB,EACpB,YAAuC,EAAA;AAEvC,IAAA,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;;IAG/C,IAAI;;AAEA,QAAA,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAC/C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;AACnD,KAAA;AAAC,IAAA,OAAO,GAAG,EAAE;AACV,QAAA,MAAM,qBAAqB,CAACA,iBAAsC,CAAC,CAAC;AACvE,KAAA;AACL,CAAC;AAED;;;;AAIG;AACG,SAAU,MAAM,CAAC,aAA0B,EAAA;AAC7C,IAAA,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE;AAC7B,QAAA,OAAO,KAAK,CAAC;AAChB,KAAA;AACD;;;;;;AAMG;IACH,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,KACzC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAClD,CAAC;AACN,CAAC;AAED;;;;AAIG;AACG,SAAU,aAAa,CAAC,SAAiB,EAAA;IAC3C,IAAI,CAAC,SAAS,EAAE;AACZ,QAAA,MAAM,qBAAqB,CAACC,gBAAqC,CAAC,CAAC;AACtE,KAAA;IACD,MAAM,eAAe,GAAG,sCAAsC,CAAC;IAC/D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;AAChC,QAAA,MAAM,qBAAqB,CAACD,iBAAsC,CAAC,CAAC;AACvE,KAAA;AACD;;;;;;AAMG;AAEH,IAAA,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;;AAEG;AACa,SAAA,WAAW,CAAC,QAAgB,EAAE,MAAc,EAAA;AACxD;;;;AAIG;AACH,IAAA,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,IAAA,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,QAAQ,GAAG,MAAM,EAAE;AACjE,QAAA,MAAM,qBAAqB,CAACE,gBAAqC,CAAC,CAAC;AACtE,KAAA;AACL;;;;"}

backend/node_modules/@azure/msal-common/dist/account/CcsCredential.mjs

@@ -0,0 +1,13 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+export { CcsCredentialType };
+//# sourceMappingURL=CcsCredential.mjs.map

backend/node_modules/@azure/msal-common/dist/account/CcsCredential.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CcsCredential.mjs","sources":["../../src/account/CcsCredential.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAOU,MAAA,iBAAiB,GAAG;AAC7B,IAAA,eAAe,EAAE,iBAAiB;AAClC,IAAA,GAAG,EAAE,KAAK;;;;;"}

backend/node_modules/@azure/msal-common/dist/account/ClientInfo.mjs

@@ -0,0 +1,44 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { CLIENT_INFO_SEPARATOR } from '../utils/Constants.mjs';
+import { clientInfoEmptyError, clientInfoDecodingError } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2 ? "" : clientInfoParts[1],
+    };
+}
+
+export { buildClientInfo, buildClientInfoFromHomeAccountId };
+//# sourceMappingURL=ClientInfo.mjs.map

backend/node_modules/@azure/msal-common/dist/account/ClientInfo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientInfo.mjs","sources":["../../src/account/ClientInfo.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.clientInfoEmptyError","ClientAuthErrorCodes.clientInfoDecodingError","Constants.CLIENT_INFO_SEPARATOR"],"mappings":";;;;;;AAAA;;;AAGG;AAoBH;;;;AAIG;AACa,SAAA,eAAe,CAC3B,aAAqB,EACrB,YAAuC,EAAA;IAEvC,IAAI,CAAC,aAAa,EAAE;AAChB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;AAC1E,KAAA;IAED,IAAI;AACA,QAAA,MAAM,iBAAiB,GAAW,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAe,CAAC;AACtD,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CACvBC,uBAA4C,CAC/C,CAAC;AACL,KAAA;AACL,CAAC;AAED;;;AAGG;AACG,SAAU,gCAAgC,CAC5C,aAAqB,EAAA;IAErB,IAAI,CAAC,aAAa,EAAE;AAChB,QAAA,MAAM,qBAAqB,CACvBA,uBAA4C,CAC/C,CAAC;AACL,KAAA;AACD,IAAA,MAAM,eAAe,GAAa,aAAa,CAAC,KAAK,CACjDC,qBAA+B,EAC/B,CAAC,CACJ,CAAC;IACF,OAAO;AACH,QAAA,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACvB,QAAA,IAAI,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;KAC7D,CAAC;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/account/TokenClaims.mjs

@@ -0,0 +1,25 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}
+
+export { getTenantIdFromIdTokenClaims };
+//# sourceMappingURL=TokenClaims.mjs.map

backend/node_modules/@azure/msal-common/dist/account/TokenClaims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenClaims.mjs","sources":["../../src/account/TokenClaims.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAgFH;;;;;;;;AAQG;AACG,SAAU,4BAA4B,CACxC,aAA2B,EAAA;AAE3B,IAAA,IAAI,aAAa,EAAE;AACf,QAAA,MAAM,QAAQ,GACV,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;QAChE,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC3B,KAAA;AACD,IAAA,OAAO,IAAI,CAAC;AAChB;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/Authority.mjs

@@ -0,0 +1,979 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthorityType } from './AuthorityType.mjs';
+import { isOpenIdConfigResponse } from './OpenIdConfigResponse.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { CIAM_AUTH_URL, DSTS, ADFS, AuthorityMetadataSource, AZURE_REGION_AUTO_DISCOVER_FLAG, RegionDiscoveryOutcomes, NOT_APPLICABLE, AAD_INSTANCE_DISCOVERY_ENDPT, INVALID_INSTANCE, DEFAULT_AUTHORITY_HOST, AAD_TENANT_DOMAIN_SUFFIX, KNOWN_PUBLIC_CLOUDS, FORWARD_SLASH, AADAuthority, DEFAULT_COMMON_TENANT, REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX } from '../utils/Constants.mjs';
+import { EndpointMetadata, getCloudDiscoveryMetadataFromHardcodedValues, getCloudDiscoveryMetadataFromNetworkResponse, InstanceDiscoveryMetadataAliases } from './AuthorityMetadata.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { ProtocolMode } from './ProtocolMode.mjs';
+import { AzureCloudInstance } from './AuthorityOptions.mjs';
+import { isCloudInstanceDiscoveryResponse } from './CloudInstanceDiscoveryResponse.mjs';
+import { isCloudInstanceDiscoveryErrorResponse } from './CloudInstanceDiscoveryErrorResponse.mjs';
+import { RegionDiscovery } from './RegionDiscovery.mjs';
+import { AuthError } from '../error/AuthError.mjs';
+import { AuthorityUpdateCloudDiscoveryMetadata, AuthorityUpdateEndpointMetadata, AuthorityUpdateMetadataWithRegionalInformation, AuthorityGetEndpointMetadataFromNetwork, RegionDiscoveryDetectRegion, AuthorityGetCloudDiscoveryMetadataFromNetwork } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { generateAuthorityMetadataExpiresAt, updateAuthorityEndpointMetadata, isAuthorityMetadataExpired, updateCloudDiscoveryMetadata } from '../cache/utils/CacheHelpers.mjs';
+import { endpointResolutionError, endSessionEndpointNotSupported, openIdConfigError } from '../error/ClientAuthErrorCodes.mjs';
+import { invalidAuthorityMetadata, untrustedAuthority, invalidCloudDiscoveryMetadata, issuerValidationFailed } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
+ * endpoint. It will store the pertinent config data in this object for use during token calls.
+ * @internal
+ */
+class Authority {
+    constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient, managedIdentity) {
+        this.canonicalAuthority = authority;
+        this._canonicalAuthority.validateAsUri();
+        this.networkInterface = networkInterface;
+        this.cacheManager = cacheManager;
+        this.authorityOptions = authorityOptions;
+        this.regionDiscoveryMetadata = {
+            region_used: undefined,
+            region_source: undefined,
+            region_outcome: undefined,
+        };
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
+        this.managedIdentity = managedIdentity || false;
+        this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
+    }
+    /**
+     * Get {@link AuthorityType}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    getAuthorityType(authorityUri) {
+        // CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
+        if (authorityUri.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
+            return AuthorityType.Ciam;
+        }
+        const pathSegments = authorityUri.PathSegments;
+        if (pathSegments.length) {
+            switch (pathSegments[0].toLowerCase()) {
+                case ADFS:
+                    return AuthorityType.Adfs;
+                case DSTS:
+                    return AuthorityType.Dsts;
+            }
+        }
+        return AuthorityType.Default;
+    }
+    // See above for AuthorityType
+    get authorityType() {
+        return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
+    }
+    /**
+     * ProtocolMode enum representing the way endpoints are constructed.
+     */
+    get protocolMode() {
+        return this.authorityOptions.protocolMode;
+    }
+    /**
+     * Returns authorityOptions which can be used to reinstantiate a new authority instance
+     */
+    get options() {
+        return this.authorityOptions;
+    }
+    /**
+     * A URL that is the authority set by the developer
+     */
+    get canonicalAuthority() {
+        return this._canonicalAuthority.urlString;
+    }
+    /**
+     * Sets canonical authority.
+     */
+    set canonicalAuthority(url) {
+        this._canonicalAuthority = new UrlString(url);
+        this._canonicalAuthority.validateAsUri();
+        this._canonicalAuthorityUrlComponents = null;
+    }
+    /**
+     * Get authority components.
+     */
+    get canonicalAuthorityUrlComponents() {
+        if (!this._canonicalAuthorityUrlComponents) {
+            this._canonicalAuthorityUrlComponents =
+                this._canonicalAuthority.getUrlComponents();
+        }
+        return this._canonicalAuthorityUrlComponents;
+    }
+    /**
+     * Get hostname and port i.e. login.microsoftonline.com
+     */
+    get hostnameAndPort() {
+        return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();
+    }
+    /**
+     * Get tenant for authority.
+     */
+    get tenant() {
+        return this.canonicalAuthorityUrlComponents.PathSegments[0];
+    }
+    /**
+     * OAuth /authorize endpoint for requests
+     */
+    get authorizationEndpoint() {
+        if (this.discoveryComplete()) {
+            return this.replacePath(this.metadata.authorization_endpoint);
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * OAuth /token endpoint for requests
+     */
+    get tokenEndpoint() {
+        if (this.discoveryComplete()) {
+            return this.replacePath(this.metadata.token_endpoint);
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    get deviceCodeEndpoint() {
+        if (this.discoveryComplete()) {
+            return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * OAuth logout endpoint for requests
+     */
+    get endSessionEndpoint() {
+        if (this.discoveryComplete()) {
+            // ROPC policies may not have end_session_endpoint set
+            if (!this.metadata.end_session_endpoint) {
+                throw createClientAuthError(endSessionEndpointNotSupported);
+            }
+            return this.replacePath(this.metadata.end_session_endpoint);
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * OAuth issuer for requests
+     */
+    get selfSignedJwtAudience() {
+        if (this.discoveryComplete()) {
+            return this.replacePath(this.metadata.issuer);
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * Jwks_uri for token signing keys
+     */
+    get jwksUri() {
+        if (this.discoveryComplete()) {
+            return this.replacePath(this.metadata.jwks_uri);
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    canReplaceTenant(authorityUri) {
+        return (authorityUri.PathSegments.length === 1 &&
+            !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0]) &&
+            this.getAuthorityType(authorityUri) === AuthorityType.Default &&
+            this.protocolMode !== ProtocolMode.OIDC);
+    }
+    /**
+     * Replaces tenant in url path with current tenant. Defaults to common.
+     * @param urlString
+     */
+    replaceTenant(urlString) {
+        return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);
+    }
+    /**
+     * Replaces path such as tenant or policy with the current tenant or policy.
+     * @param urlString
+     */
+    replacePath(urlString) {
+        let endpoint = urlString;
+        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+        const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
+        const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
+        const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
+        currentAuthorityParts.forEach((currentPart, index) => {
+            let cachedPart = cachedAuthorityParts[index];
+            if (index === 0 &&
+                this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
+                /**
+                 * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
+                 * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
+                 * always resolved with tenant id by OIDC.
+                 */
+                if (cachedPart !== tenantId) {
+                    this.logger.verbose(`Replacing tenant domain name '${cachedPart}' with id '${tenantId}'`, this.correlationId);
+                    cachedPart = tenantId;
+                }
+            }
+            if (currentPart !== cachedPart) {
+                endpoint = endpoint.replace(`/${cachedPart}/`, `/${currentPart}/`);
+            }
+        });
+        return this.replaceTenant(endpoint);
+    }
+    /**
+     * The default open id configuration endpoint for any canonical authority.
+     */
+    get defaultOpenIdConfigurationEndpoint() {
+        const canonicalAuthorityHost = this.hostnameAndPort;
+        if (this.canonicalAuthority.endsWith("v2.0/") ||
+            this.authorityType === AuthorityType.Adfs ||
+            (this.protocolMode === ProtocolMode.OIDC &&
+                !this.isAliasOfKnownMicrosoftAuthority(canonicalAuthorityHost))) {
+            return `${this.canonicalAuthority}.well-known/openid-configuration`;
+        }
+        return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
+    }
+    /**
+     * Boolean that returns whether or not tenant discovery has been completed.
+     */
+    discoveryComplete() {
+        return !!this.metadata;
+    }
+    /**
+     * Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
+     * and the /authorize, /token and logout endpoints.
+     */
+    async resolveEndpointsAsync() {
+        const metadataEntity = this.getCurrentMetadataEntity();
+        const cloudDiscoverySource = await invokeAsync(this.updateCloudDiscoveryMetadata.bind(this), AuthorityUpdateCloudDiscoveryMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
+        this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
+        const endpointSource = await invokeAsync(this.updateEndpointMetadata.bind(this), AuthorityUpdateEndpointMetadata, this.logger, this.performanceClient, this.correlationId)(metadataEntity);
+        this.updateCachedMetadata(metadataEntity, cloudDiscoverySource, {
+            source: endpointSource,
+        });
+        this.performanceClient?.addFields({
+            cloudDiscoverySource: cloudDiscoverySource,
+            authorityEndpointSource: endpointSource,
+        }, this.correlationId);
+    }
+    /**
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
+     * from the configured canonical authority
+     * @returns
+     */
+    getCurrentMetadataEntity() {
+        let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort, this.correlationId);
+        if (!metadataEntity) {
+            metadataEntity = {
+                aliases: [],
+                preferred_cache: this.hostnameAndPort,
+                preferred_network: this.hostnameAndPort,
+                canonical_authority: this.canonicalAuthority,
+                authorization_endpoint: "",
+                token_endpoint: "",
+                end_session_endpoint: "",
+                issuer: "",
+                aliasesFromNetwork: false,
+                endpointsFromNetwork: false,
+                expiresAt: generateAuthorityMetadataExpiresAt(),
+                jwks_uri: "",
+            };
+        }
+        return metadataEntity;
+    }
+    /**
+     * Updates cached metadata based on metadata source and sets the instance's metadata
+     * property to the same value
+     * @param metadataEntity
+     * @param cloudDiscoverySource
+     * @param endpointMetadataResult
+     */
+    updateCachedMetadata(metadataEntity, cloudDiscoverySource, endpointMetadataResult) {
+        if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE &&
+            endpointMetadataResult?.source !==
+                AuthorityMetadataSource.CACHE) {
+            // Reset the expiration time unless both values came from a successful cache lookup
+            metadataEntity.expiresAt =
+                generateAuthorityMetadataExpiresAt();
+            metadataEntity.canonical_authority = this.canonicalAuthority;
+        }
+        const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache, this.correlationId);
+        this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity, this.correlationId);
+        this.metadata = metadataEntity;
+    }
+    /**
+     * Update AuthorityMetadataEntity with new endpoints and return where the information came from
+     * @param metadataEntity
+     */
+    async updateEndpointMetadata(metadataEntity) {
+        const localMetadata = this.updateEndpointMetadataFromLocalSources(metadataEntity);
+        // Further update may be required for hardcoded metadata if regional metadata is preferred
+        if (localMetadata) {
+            if (localMetadata.source ===
+                AuthorityMetadataSource.HARDCODED_VALUES) {
+                // If the user prefers to use an azure region replace the global endpoints with regional information.
+                if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                    if (localMetadata.metadata) {
+                        const hardcodedMetadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(localMetadata.metadata);
+                        updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
+                        metadataEntity.canonical_authority =
+                            this.canonicalAuthority;
+                    }
+                }
+            }
+            return localMetadata.source;
+        }
+        // Get metadata from network if local sources aren't available
+        let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
+        if (metadata) {
+            // Validate the issuer returned by the OIDC discovery document.
+            this.validateIssuer(metadata.issuer);
+            // If the user prefers to use an azure region replace the global endpoints with regional information.
+            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
+                metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
+            }
+            updateAuthorityEndpointMetadata(metadataEntity, metadata, true);
+            return AuthorityMetadataSource.NETWORK;
+        }
+        else {
+            // Metadata could not be obtained from the config, cache, network or hardcoded values
+            throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
+        }
+    }
+    /**
+     * Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
+     * response if the source is hardcoded metadata
+     * @param metadataEntity
+     * @returns
+     */
+    updateEndpointMetadataFromLocalSources(metadataEntity) {
+        this.logger.verbose("Attempting to get endpoint metadata from authority configuration", this.correlationId);
+        const configMetadata = this.getEndpointMetadataFromConfig();
+        if (configMetadata) {
+            this.logger.verbose("Found endpoint metadata in authority configuration", this.correlationId);
+            updateAuthorityEndpointMetadata(metadataEntity, configMetadata, false);
+            return {
+                source: AuthorityMetadataSource.CONFIG,
+            };
+        }
+        this.logger.verbose("Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.", this.correlationId);
+        const hardcodedMetadata = this.getEndpointMetadataFromHardcodedValues();
+        if (hardcodedMetadata) {
+            updateAuthorityEndpointMetadata(metadataEntity, hardcodedMetadata, false);
+            return {
+                source: AuthorityMetadataSource.HARDCODED_VALUES,
+                metadata: hardcodedMetadata,
+            };
+        }
+        else {
+            this.logger.verbose("Did not find endpoint metadata in hardcoded values... Attempting to get endpoint metadata from the network metadata cache.", this.correlationId);
+        }
+        // Check cached metadata entity expiration status
+        const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
+        if (this.isAuthoritySameType(metadataEntity) &&
+            metadataEntity.endpointsFromNetwork &&
+            !metadataEntityExpired) {
+            // No need to update
+            this.logger.verbose("Found endpoint metadata in the cache.", "");
+            return { source: AuthorityMetadataSource.CACHE };
+        }
+        else if (metadataEntityExpired) {
+            this.logger.verbose("The metadata entity is expired.", "");
+        }
+        return null;
+    }
+    /**
+     * Compares the number of url components after the domain to determine if the cached
+     * authority metadata can be used for the requested authority. Protects against same domain different
+     * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * @param metadataEntity
+     */
+    isAuthoritySameType(metadataEntity) {
+        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+        const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
+        return (cachedParts.length ===
+            this.canonicalAuthorityUrlComponents.PathSegments.length);
+    }
+    /**
+     * Parse authorityMetadata config option
+     */
+    getEndpointMetadataFromConfig() {
+        if (this.authorityOptions.authorityMetadata) {
+            try {
+                return JSON.parse(this.authorityOptions.authorityMetadata);
+            }
+            catch (e) {
+                throw createClientConfigurationError(invalidAuthorityMetadata);
+            }
+        }
+        return null;
+    }
+    /**
+     * Gets OAuth endpoints from the given OpenID configuration endpoint.
+     *
+     * @param hasHardcodedMetadata boolean
+     */
+    async getEndpointMetadataFromNetwork() {
+        const options = {};
+        /*
+         * TODO: Add a timeout if the authority exists in our library's
+         * hardcoded list of metadata
+         */
+        const openIdConfigurationEndpoint = this.defaultOpenIdConfigurationEndpoint;
+        this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: attempting to retrieve OAuth endpoints from '${openIdConfigurationEndpoint}'`, this.correlationId);
+        try {
+            const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
+            const isValidResponse = isOpenIdConfigResponse(response.body);
+            if (isValidResponse) {
+                return response.body;
+            }
+            else {
+                this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: could not parse response as OpenID configuration`, this.correlationId);
+                return null;
+            }
+        }
+        catch (e) {
+            this.logger.verbose(`Authority.getEndpointMetadataFromNetwork: '${e}'`, this.correlationId);
+            return null;
+        }
+    }
+    /**
+     * Get OAuth endpoints for common authorities.
+     */
+    getEndpointMetadataFromHardcodedValues() {
+        if (this.hostnameAndPort in EndpointMetadata) {
+            return EndpointMetadata[this.hostnameAndPort];
+        }
+        return null;
+    }
+    /**
+     * Update the retrieved metadata with regional information.
+     * User selected Azure region will be used if configured.
+     */
+    async updateMetadataWithRegionalInformation(metadata) {
+        const userConfiguredAzureRegion = this.authorityOptions.azureRegionConfiguration?.azureRegion;
+        if (userConfiguredAzureRegion) {
+            if (userConfiguredAzureRegion !==
+                AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                this.regionDiscoveryMetadata.region_outcome =
+                    RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                this.regionDiscoveryMetadata.region_used =
+                    userConfiguredAzureRegion;
+                return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
+            }
+            const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
+                ?.environmentRegion, this.regionDiscoveryMetadata);
+            if (autodetectedRegionName) {
+                this.regionDiscoveryMetadata.region_outcome =
+                    RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
+                this.regionDiscoveryMetadata.region_used =
+                    autodetectedRegionName;
+                return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
+            }
+            this.regionDiscoveryMetadata.region_outcome =
+                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+        }
+        return metadata;
+    }
+    /**
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+     * and returns where the information was retrieved from
+     * @param metadataEntity
+     * @returns AuthorityMetadataSource
+     */
+    async updateCloudDiscoveryMetadata(metadataEntity) {
+        const localMetadataSource = this.updateCloudDiscoveryMetadataFromLocalSources(metadataEntity);
+        if (localMetadataSource) {
+            return localMetadataSource;
+        }
+        // Fallback to network as metadata source
+        const metadata = await invokeAsync(this.getCloudDiscoveryMetadataFromNetwork.bind(this), AuthorityGetCloudDiscoveryMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
+        if (metadata) {
+            updateCloudDiscoveryMetadata(metadataEntity, metadata, true);
+            return AuthorityMetadataSource.NETWORK;
+        }
+        // Metadata could not be obtained from the config, cache, network or hardcoded values
+        throw createClientConfigurationError(untrustedAuthority);
+    }
+    updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
+        this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
+        this.logger.verbosePii(`Known Authorities: '${this.authorityOptions.knownAuthorities ||
+            NOT_APPLICABLE}'`, this.correlationId);
+        this.logger.verbosePii(`Authority Metadata: '${this.authorityOptions.authorityMetadata ||
+            NOT_APPLICABLE}'`, this.correlationId);
+        this.logger.verbosePii(`Canonical Authority: '${metadataEntity.canonical_authority || NOT_APPLICABLE}'`, this.correlationId);
+        const metadata = this.getCloudDiscoveryMetadataFromConfig();
+        if (metadata) {
+            this.logger.verbose("Found cloud discovery metadata in authority configuration", this.correlationId);
+            updateCloudDiscoveryMetadata(metadataEntity, metadata, false);
+            return AuthorityMetadataSource.CONFIG;
+        }
+        // If the cached metadata came from config but that config was not passed to this instance, we must go to hardcoded values
+        this.logger.verbose("Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.", this.correlationId);
+        const hardcodedMetadata = getCloudDiscoveryMetadataFromHardcodedValues(this.hostnameAndPort);
+        if (hardcodedMetadata) {
+            this.logger.verbose("Found cloud discovery metadata from hardcoded values.", this.correlationId);
+            updateCloudDiscoveryMetadata(metadataEntity, hardcodedMetadata, false);
+            return AuthorityMetadataSource.HARDCODED_VALUES;
+        }
+        this.logger.verbose("Did not find cloud discovery metadata in hardcoded values... Attempting to get cloud discovery metadata from the network metadata cache.", this.correlationId);
+        const metadataEntityExpired = isAuthorityMetadataExpired(metadataEntity);
+        if (this.isAuthoritySameType(metadataEntity) &&
+            metadataEntity.aliasesFromNetwork &&
+            !metadataEntityExpired) {
+            this.logger.verbose("Found cloud discovery metadata in the cache.", "");
+            // No need to update
+            return AuthorityMetadataSource.CACHE;
+        }
+        else if (metadataEntityExpired) {
+            this.logger.verbose("The metadata entity is expired.", "");
+        }
+        return null;
+    }
+    /**
+     * Parse cloudDiscoveryMetadata config or check knownAuthorities
+     */
+    getCloudDiscoveryMetadataFromConfig() {
+        // CIAM does not support cloud discovery metadata
+        if (this.authorityType === AuthorityType.Ciam) {
+            this.logger.verbose("CIAM authorities do not support cloud discovery metadata, generate the aliases from authority host.", this.correlationId);
+            return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
+        }
+        // Check if network response was provided in config
+        if (this.authorityOptions.cloudDiscoveryMetadata) {
+            this.logger.verbose("The cloud discovery metadata has been provided as a network response, in the config.", this.correlationId);
+            try {
+                this.logger.verbose("Attempting to parse the cloud discovery metadata.", this.correlationId);
+                const parsedResponse = JSON.parse(this.authorityOptions.cloudDiscoveryMetadata);
+                const metadata = getCloudDiscoveryMetadataFromNetworkResponse(parsedResponse.metadata, this.hostnameAndPort);
+                this.logger.verbose("Parsed the cloud discovery metadata.", "");
+                if (metadata) {
+                    this.logger.verbose("There is returnable metadata attached to the parsed cloud discovery metadata.", this.correlationId);
+                    return metadata;
+                }
+                else {
+                    this.logger.verbose("There is no metadata attached to the parsed cloud discovery metadata.", this.correlationId);
+                }
+            }
+            catch (e) {
+                this.logger.verbose("Unable to parse the cloud discovery metadata. Throwing Invalid Cloud Discovery Metadata Error.", this.correlationId);
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+            }
+        }
+        // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
+        if (this.isInKnownAuthorities()) {
+            this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.", this.correlationId);
+            return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
+        }
+        return null;
+    }
+    /**
+     * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
+     *
+     * @param hasHardcodedMetadata boolean
+     */
+    async getCloudDiscoveryMetadataFromNetwork() {
+        const instanceDiscoveryEndpoint = `${AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`;
+        const options = {};
+        /*
+         * TODO: Add a timeout if the authority exists in our library's
+         * hardcoded list of metadata
+         */
+        let match = null;
+        try {
+            const response = await this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options);
+            let typedResponseBody;
+            let metadata;
+            if (isCloudInstanceDiscoveryResponse(response.body)) {
+                typedResponseBody =
+                    response.body;
+                metadata = typedResponseBody.metadata;
+                this.logger.verbosePii(`tenant_discovery_endpoint is: '${typedResponseBody.tenant_discovery_endpoint}'`, this.correlationId);
+            }
+            else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
+                this.logger.warning(`A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: '${response.status}'`, this.correlationId);
+                typedResponseBody =
+                    response.body;
+                if (typedResponseBody.error === INVALID_INSTANCE) {
+                    this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance.", this.correlationId);
+                    return null;
+                }
+                this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error is '${typedResponseBody.error}'`, this.correlationId);
+                this.logger.warning(`The CloudInstanceDiscoveryErrorResponse error description is '${typedResponseBody.error_description}'`, this.correlationId);
+                this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network, correlationId) to []", this.correlationId);
+                metadata = [];
+            }
+            else {
+                this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse", this.correlationId);
+                return null;
+            }
+            this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
+            match = getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
+        }
+        catch (error) {
+            if (error instanceof AuthError) {
+                this.logger.error(`There was a network error while attempting to get the cloud discovery instance metadata.\nError: '${error.errorCode}'\nError Description: '${error.errorMessage}'`, this.correlationId);
+            }
+            else {
+                const typedError = error;
+                this.logger.error(`A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.\nError: '${typedError.name}'\nError Description: '${typedError.message}'`, this.correlationId);
+            }
+            return null;
+        }
+        // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
+        if (!match) {
+            this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.", this.correlationId);
+            this.logger.verbose("Creating custom Authority for custom domain scenario.", this.correlationId);
+            match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
+        }
+        return match;
+    }
+    /**
+     * Helper function to determine if this host is included in the knownAuthorities config option
+     */
+    isInKnownAuthorities() {
+        const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
+            return (authority &&
+                UrlString.getDomainFromUrl(authority).toLowerCase() ===
+                    this.hostnameAndPort);
+        });
+        return matches.length > 0;
+    }
+    /**
+     * helper function to populate the authority based on azureCloudOptions
+     * @param authorityString
+     * @param azureCloudOptions
+     */
+    static generateAuthority(authorityString, azureCloudOptions) {
+        let authorityAzureCloudInstance;
+        if (azureCloudOptions &&
+            azureCloudOptions.azureCloudInstance !== AzureCloudInstance.None) {
+            const tenant = azureCloudOptions.tenant
+                ? azureCloudOptions.tenant
+                : DEFAULT_COMMON_TENANT;
+            authorityAzureCloudInstance = `${azureCloudOptions.azureCloudInstance}/${tenant}/`;
+        }
+        return authorityAzureCloudInstance
+            ? authorityAzureCloudInstance
+            : authorityString;
+    }
+    /**
+     * Creates cloud discovery metadata object from a given host
+     * @param host
+     */
+    static createCloudDiscoveryMetadataFromHost(host) {
+        return {
+            preferred_network: host,
+            preferred_cache: host,
+            aliases: [host],
+        };
+    }
+    /**
+     * helper function to generate environment from authority object
+     */
+    getPreferredCache() {
+        if (this.managedIdentity) {
+            return DEFAULT_AUTHORITY_HOST;
+        }
+        else if (this.discoveryComplete()) {
+            return this.metadata.preferred_cache;
+        }
+        else {
+            throw createClientAuthError(endpointResolutionError);
+        }
+    }
+    /**
+     * Returns whether or not the provided host is an alias of this authority instance
+     * @param host
+     */
+    isAlias(host) {
+        return this.metadata.aliases.indexOf(host) > -1;
+    }
+    /**
+     * Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
+     * @param host
+     */
+    isAliasOfKnownMicrosoftAuthority(host) {
+        return InstanceDiscoveryMetadataAliases.has(host);
+    }
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    validateIssuer(issuer) {
+        if (!issuer) {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+        let issuerUrl;
+        try {
+            issuerUrl = new URL(issuer);
+        }
+        catch {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        const issuerScheme = issuerUrl.protocol;
+        const issuerHost = issuerUrl.host;
+        const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
+        const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
+        // Rule 1: Same scheme and host
+        const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
+        // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+        const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
+            this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+        /*
+         * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+         * (HTTPS only). E.g. westus2.login.microsoft.com
+         */
+        const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
+            this.matchesRegionalMicrosoftHost(issuerHost);
+        /*
+         * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+         * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+         */
+        const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+        if (matchesAuthorityOrigin ||
+            matchesKnownMicrosoftHost ||
+            matchesRegionalMicrosoftHost ||
+            matchesCiamTenantPattern) {
+            return;
+        }
+        // issuer validation fails if none of the above rules are satisfied
+        throw createClientConfigurationError(issuerValidationFailed);
+    }
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
+        return issuerScheme === authorityScheme && issuerHost === authorityHost;
+    }
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    matchesRegionalMicrosoftHost(issuerHost) {
+        const firstDot = issuerHost.indexOf(".");
+        if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+            const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+            return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+        }
+        return false;
+    }
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
+        /*
+         * authorityPathSegments[0] is the first path segment of the *authority
+         * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+         * Additional CIAM issuer path segments such as "/v2.0" are part of the
+         * issuer string, not the authority URL's PathSegments.
+         */
+        const pathSegment = authorityPathSegments[0];
+        /*
+         * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+         * present (introduced by transformCIAMAuthority), or fall back to the
+         * first label of the authority hostname for non-transformed/custom-domain
+         * CIAM authorities.
+         */
+        const tenantName = pathSegment
+            ? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
+                ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
+                : pathSegment
+            : authorityHost.split(".")[0];
+        if (!tenantName) {
+            return false;
+        }
+        const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
+        const validCiamPatterns = [
+            ciamBaseURL,
+            `${ciamBaseURL}/${tenantName}`,
+            `${ciamBaseURL}/${tenantName}/v2.0`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+        ];
+        /*
+         * Compose the canonical issuer string from URL components and strip any
+         * trailing slashes from the path so it can be compared to the pattern set.
+         */
+        const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+        const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+        return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
+    }
+    /**
+     * Checks whether the provided host is that of a public cloud authority
+     *
+     * @param authority string
+     * @returns bool
+     */
+    static isPublicCloudAuthority(host) {
+        return KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;
+    }
+    /**
+     * Rebuild the authority string with the region
+     *
+     * @param host string
+     * @param region string
+     */
+    static buildRegionalAuthorityString(host, region, queryString) {
+        // Create and validate a Url string object with the initial authority string
+        const authorityUrlInstance = new UrlString(host);
+        authorityUrlInstance.validateAsUri();
+        const authorityUrlParts = authorityUrlInstance.getUrlComponents();
+        let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
+        if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) {
+            hostNameAndPort = `${region}.${REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`;
+        }
+        // Include the query string portion of the url
+        const url = UrlString.constructAuthorityUriFromObject({
+            ...authorityUrlInstance.getUrlComponents(),
+            HostNameAndPort: hostNameAndPort,
+        }).urlString;
+        // Add the query string if a query string was provided
+        if (queryString)
+            return `${url}?${queryString}`;
+        return url;
+    }
+    /**
+     * Replace the endpoints in the metadata object with their regional equivalents.
+     *
+     * @param metadata OpenIdConfigResponse
+     * @param azureRegion string
+     */
+    static replaceWithRegionalInformation(metadata, azureRegion) {
+        const regionalMetadata = { ...metadata };
+        regionalMetadata.authorization_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
+        regionalMetadata.token_endpoint =
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
+        if (regionalMetadata.end_session_endpoint) {
+            regionalMetadata.end_session_endpoint =
+                Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
+        }
+        return regionalMetadata;
+    }
+    /**
+     * Transform CIAM_AUTHORIY as per the below rules:
+     * If no path segments found and it is a CIAM authority (hostname ends with .ciamlogin.com), then transform it
+     *
+     * NOTE: The transformation path should go away once STS supports CIAM with the format: `tenantIdorDomain.ciamlogin.com`
+     * `ciamlogin.com` can also change in the future and we should accommodate the same
+     *
+     * @param authority
+     */
+    static transformCIAMAuthority(authority) {
+        let ciamAuthority = authority;
+        const authorityUrl = new UrlString(authority);
+        const authorityUrlComponents = authorityUrl.getUrlComponents();
+        // check if transformation is needed
+        if (authorityUrlComponents.PathSegments.length === 0 &&
+            authorityUrlComponents.HostNameAndPort.endsWith(CIAM_AUTH_URL)) {
+            const tenantIdOrDomain = authorityUrlComponents.HostNameAndPort.split(".")[0];
+            ciamAuthority = `${ciamAuthority}${tenantIdOrDomain}${AAD_TENANT_DOMAIN_SUFFIX}`;
+        }
+        return ciamAuthority;
+    }
+}
+// Reserved tenant domain names that will not be replaced with tenant id
+Authority.reservedTenantDomains = new Set([
+    "{tenant}",
+    "{tenantid}",
+    AADAuthority.COMMON,
+    AADAuthority.CONSUMERS,
+    AADAuthority.ORGANIZATIONS,
+]);
+/**
+ * Extract tenantId from authority
+ */
+function getTenantFromAuthorityString(authority) {
+    const authorityUrl = new UrlString(authority);
+    const authorityUrlComponents = authorityUrl.getUrlComponents();
+    /**
+     * For credential matching purposes, tenantId is the last path segment of the authority URL:
+     *  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
+     *  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
+     *  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
+     *
+     * Note that we may not have any path segments in certain OIDC scenarios.
+     */
+    const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0]?.toLowerCase();
+    switch (tenantId) {
+        case AADAuthority.COMMON:
+        case AADAuthority.ORGANIZATIONS:
+        case AADAuthority.CONSUMERS:
+            return undefined;
+        default:
+            return tenantId;
+    }
+}
+function formatAuthorityUri(authorityUri) {
+    return authorityUri.endsWith(FORWARD_SLASH)
+        ? authorityUri
+        : `${authorityUri}${FORWARD_SLASH}`;
+}
+function buildStaticAuthorityOptions(authOptions) {
+    const rawCloudDiscoveryMetadata = authOptions.cloudDiscoveryMetadata;
+    let cloudDiscoveryMetadata = undefined;
+    if (rawCloudDiscoveryMetadata) {
+        try {
+            cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+        }
+    }
+    return {
+        canonicalAuthority: authOptions.authority
+            ? formatAuthorityUri(authOptions.authority)
+            : undefined,
+        knownAuthorities: authOptions.knownAuthorities,
+        cloudDiscoveryMetadata: cloudDiscoveryMetadata,
+    };
+}
+
+export { Authority, buildStaticAuthorityOptions, formatAuthorityUri, getTenantFromAuthorityString };
+//# sourceMappingURL=Authority.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/AuthorityFactory.mjs

@@ -0,0 +1,42 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { Authority, formatAuthorityUri } from './Authority.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { AuthorityResolveEndpointsAsync } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { endpointResolutionError } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Create an authority object of the correct type based on the url
+ * Performs basic authority validation - checks to see if the authority is of a valid type (i.e. aad, b2c, adfs)
+ *
+ * Also performs endpoint discovery.
+ *
+ * @param authorityUri
+ * @param networkClient
+ * @param cacheManager
+ * @param authorityOptions
+ * @param logger
+ * @param correlationId
+ * @param performanceClient
+ * @internal
+ */
+async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
+    const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
+    // Initialize authority and perform discovery endpoint check.
+    const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
+    try {
+        await invokeAsync(acquireTokenAuthority.resolveEndpointsAsync.bind(acquireTokenAuthority), AuthorityResolveEndpointsAsync, logger, performanceClient, correlationId)();
+        return acquireTokenAuthority;
+    }
+    catch (e) {
+        throw createClientAuthError(endpointResolutionError);
+    }
+}
+
+export { createDiscoveredInstance };
+//# sourceMappingURL=AuthorityFactory.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/AuthorityFactory.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityFactory.mjs","sources":["../../src/authority/AuthorityFactory.ts"],"sourcesContent":[null],"names":["PerformanceEvents.AuthorityResolveEndpointsAsync","ClientAuthErrorCodes.endpointResolutionError"],"mappings":";;;;;;;;AAAA;;;AAGG;AAeH;;;;;;;;;;;;;;AAcG;AACI,eAAe,wBAAwB,CAC1C,YAAoB,EACpB,aAA6B,EAC7B,YAA2B,EAC3B,gBAAkC,EAClC,MAAc,EACd,aAAqB,EACrB,iBAAqC,EAAA;IAErC,MAAM,iBAAiB,GAAG,SAAS,CAAC,sBAAsB,CACtD,kBAAkB,CAAC,YAAY,CAAC,CACnC,CAAC;;AAGF,IAAA,MAAM,qBAAqB,GAAc,IAAI,SAAS,CAClD,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,iBAAiB,CACpB,CAAC;IAEF,IAAI;QACA,MAAM,WAAW,CACb,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAC5C,qBAAqB,CACxB,EACDA,8BAAgD,EAChD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,EAAE,CAAC;AACJ,QAAA,OAAO,qBAAqB,CAAC;AAChC,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CACvBC,uBAA4C,CAC/C,CAAC;AACL,KAAA;AACL;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/AuthorityMetadata.mjs

@@ -0,0 +1,171 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { UrlString } from '../url/UrlString.mjs';
+import { AuthorityMetadataSource } from '../utils/Constants.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Build endpoint metadata dynamically to avoid string duplication
+const endpointHosts = [
+    { host: "login.microsoftonline.com" },
+    {
+        host: "login.chinacloudapi.cn",
+        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
+    },
+    { host: "login.microsoftonline.us" },
+    { host: "login.sovcloud-identity.fr" },
+    { host: "login.sovcloud-identity.de" },
+    { host: "login.sovcloud-identity.sg" },
+];
+function buildOpenIdConfig(host, issuerHost) {
+    return {
+        token_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/token`,
+        jwks_uri: `https://${host}/{tenantid}/discovery/v2.0/keys`,
+        issuer: `https://${issuerHost}/{tenantid}/v2.0`,
+        authorization_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/authorize`,
+        end_session_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/logout`,
+    };
+}
+const dynamicEndpointMetadata = endpointHosts.reduce((acc, { host, issuerHost }) => {
+    acc[host] = buildOpenIdConfig(host, issuerHost || host);
+    return acc;
+}, {});
+const rawMetdataJSON = {
+    endpointMetadata: dynamicEndpointMetadata,
+    instanceDiscoveryMetadata: {
+        metadata: [
+            {
+                preferred_network: "login.microsoftonline.com",
+                preferred_cache: "login.windows.net",
+                aliases: [
+                    "login.microsoftonline.com",
+                    "login.windows.net",
+                    "login.microsoft.com",
+                    "sts.windows.net",
+                ],
+            },
+            {
+                preferred_network: "login.partner.microsoftonline.cn",
+                preferred_cache: "login.partner.microsoftonline.cn",
+                aliases: [
+                    "login.partner.microsoftonline.cn",
+                    "login.chinacloudapi.cn",
+                ],
+            },
+            {
+                preferred_network: "login.microsoftonline.de",
+                preferred_cache: "login.microsoftonline.de",
+                aliases: ["login.microsoftonline.de"],
+            },
+            {
+                preferred_network: "login.microsoftonline.us",
+                preferred_cache: "login.microsoftonline.us",
+                aliases: [
+                    "login.microsoftonline.us",
+                    "login.usgovcloudapi.net",
+                ],
+            },
+            {
+                preferred_network: "login-us.microsoftonline.com",
+                preferred_cache: "login-us.microsoftonline.com",
+                aliases: ["login-us.microsoftonline.com"],
+            },
+            {
+                preferred_network: "login.sovcloud-identity.fr",
+                preferred_cache: "login.sovcloud-identity.fr",
+                aliases: ["login.sovcloud-identity.fr"],
+            },
+            {
+                preferred_network: "login.sovcloud-identity.de",
+                preferred_cache: "login.sovcloud-identity.de",
+                aliases: ["login.sovcloud-identity.de"],
+            },
+            {
+                preferred_network: "login.sovcloud-identity.sg",
+                preferred_cache: "login.sovcloud-identity.sg",
+                aliases: ["login.sovcloud-identity.sg"],
+            },
+            {
+                preferred_network: "login.windows-ppe.net",
+                preferred_cache: "login.windows-ppe.net",
+                aliases: [
+                    "login.windows-ppe.net",
+                    "sts.windows-ppe.net",
+                    "login.microsoft-ppe.com",
+                ],
+            },
+        ],
+    },
+};
+const EndpointMetadata = rawMetdataJSON.endpointMetadata;
+const InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
+const InstanceDiscoveryMetadataAliases = new Set();
+InstanceDiscoveryMetadata.metadata.forEach((metadataEntry) => {
+    metadataEntry.aliases.forEach((alias) => {
+        InstanceDiscoveryMetadataAliases.add(alias);
+    });
+});
+/**
+ * Attempts to get an aliases array from the static authority metadata sources based on the canonical authority host
+ * @param staticAuthorityOptions
+ * @param logger
+ * @returns
+ */
+function getAliasesFromStaticSources(staticAuthorityOptions, logger, correlationId) {
+    let staticAliases;
+    const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
+    if (canonicalAuthority) {
+        const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
+        staticAliases =
+            getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
+                getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
+                staticAuthorityOptions.knownAuthorities;
+    }
+    return staticAliases || [];
+}
+/**
+ * Returns aliases for from the raw cloud discovery metadata passed in
+ * @param authorityHost
+ * @param rawCloudDiscoveryMetadata
+ * @returns
+ */
+function getAliasesFromMetadata(logger, correlationId, authorityHost, cloudDiscoveryMetadata, source) {
+    logger.trace(`getAliasesFromMetadata called with source: '${source}'`, correlationId);
+    if (authorityHost && cloudDiscoveryMetadata) {
+        const metadata = getCloudDiscoveryMetadataFromNetworkResponse(cloudDiscoveryMetadata, authorityHost);
+        if (metadata) {
+            logger.trace(`getAliasesFromMetadata: found cloud discovery metadata in '${source}', returning aliases`, correlationId);
+            return metadata.aliases;
+        }
+        else {
+            logger.trace(`getAliasesFromMetadata: did not find cloud discovery metadata in '${source}'`, correlationId);
+        }
+    }
+    return null;
+}
+/**
+ * Get cloud discovery metadata for common authorities
+ */
+function getCloudDiscoveryMetadataFromHardcodedValues(authorityHost) {
+    const metadata = getCloudDiscoveryMetadataFromNetworkResponse(InstanceDiscoveryMetadata.metadata, authorityHost);
+    return metadata;
+}
+/**
+ * Searches instance discovery network response for the entry that contains the host in the aliases list
+ * @param response
+ * @param authority
+ */
+function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
+    for (let i = 0; i < response.length; i++) {
+        const metadata = response[i];
+        if (metadata.aliases.includes(authorityHost)) {
+            return metadata;
+        }
+    }
+    return null;
+}
+
+export { EndpointMetadata, InstanceDiscoveryMetadata, InstanceDiscoveryMetadataAliases, getAliasesFromMetadata, getAliasesFromStaticSources, getCloudDiscoveryMetadataFromHardcodedValues, getCloudDiscoveryMetadataFromNetworkResponse, rawMetdataJSON };
+//# sourceMappingURL=AuthorityMetadata.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/AuthorityMetadata.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityMetadata.mjs","sources":["../../src/authority/AuthorityMetadata.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAAA;;;AAGG;AAeH;AACA,MAAM,aAAa,GAAiD;IAChE,EAAE,IAAI,EAAE,2BAA2B,EAAE;AACrC,IAAA;AACI,QAAA,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,kCAAkC;AACjD,KAAA;IACD,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACzC,CAAC;AAEF,SAAS,iBAAiB,CACtB,IAAY,EACZ,UAAkB,EAAA;IAElB,OAAO;QACH,cAAc,EAAE,CAAW,QAAA,EAAA,IAAI,CAA+B,6BAAA,CAAA;QAC9D,QAAQ,EAAE,CAAW,QAAA,EAAA,IAAI,CAAiC,+BAAA,CAAA;QAC1D,MAAM,EAAE,CAAW,QAAA,EAAA,UAAU,CAAkB,gBAAA,CAAA;QAC/C,sBAAsB,EAAE,CAAW,QAAA,EAAA,IAAI,CAAmC,iCAAA,CAAA;QAC1E,oBAAoB,EAAE,CAAW,QAAA,EAAA,IAAI,CAAgC,8BAAA,CAAA;KACxE,CAAC;AACN,CAAC;AAED,MAAM,uBAAuB,GACzB,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAI;AAC/C,IAAA,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC;AACxD,IAAA,OAAO,GAAG,CAAC;AACf,CAAC,EAAE,EAA0C,CAAC,CAAC;AAEtC,MAAA,cAAc,GAAgB;AACvC,IAAA,gBAAgB,EAAE,uBAAuB;AACzC,IAAA,yBAAyB,EAAE;AACvB,QAEA,QAAQ,EAAE;AACN,YAAA;AACI,gBAAA,iBAAiB,EAAE,2BAA2B;AAC9C,gBAAA,eAAe,EAAE,mBAAmB;AACpC,gBAAA,OAAO,EAAE;oBACL,2BAA2B;oBAC3B,mBAAmB;oBACnB,qBAAqB;oBACrB,iBAAiB;AACpB,iBAAA;AACJ,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,kCAAkC;AACrD,gBAAA,eAAe,EAAE,kCAAkC;AACnD,gBAAA,OAAO,EAAE;oBACL,kCAAkC;oBAClC,wBAAwB;AAC3B,iBAAA;AACJ,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,0BAA0B;AAC7C,gBAAA,eAAe,EAAE,0BAA0B;gBAC3C,OAAO,EAAE,CAAC,0BAA0B,CAAC;AACxC,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,0BAA0B;AAC7C,gBAAA,eAAe,EAAE,0BAA0B;AAC3C,gBAAA,OAAO,EAAE;oBACL,0BAA0B;oBAC1B,yBAAyB;AAC5B,iBAAA;AACJ,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,8BAA8B;AACjD,gBAAA,eAAe,EAAE,8BAA8B;gBAC/C,OAAO,EAAE,CAAC,8BAA8B,CAAC;AAC5C,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,4BAA4B;AAC/C,gBAAA,eAAe,EAAE,4BAA4B;gBAC7C,OAAO,EAAE,CAAC,4BAA4B,CAAC;AAC1C,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,4BAA4B;AAC/C,gBAAA,eAAe,EAAE,4BAA4B;gBAC7C,OAAO,EAAE,CAAC,4BAA4B,CAAC;AAC1C,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,4BAA4B;AAC/C,gBAAA,eAAe,EAAE,4BAA4B;gBAC7C,OAAO,EAAE,CAAC,4BAA4B,CAAC;AAC1C,aAAA;AACD,YAAA;AACI,gBAAA,iBAAiB,EAAE,uBAAuB;AAC1C,gBAAA,eAAe,EAAE,uBAAuB;AACxC,gBAAA,OAAO,EAAE;oBACL,uBAAuB;oBACvB,qBAAqB;oBACrB,yBAAyB;AAC5B,iBAAA;AACJ,aAAA;AACJ,SAAA;AACJ,KAAA;EACH;AAEW,MAAA,gBAAgB,GAAG,cAAc,CAAC,iBAAiB;AACnD,MAAA,yBAAyB,GAClC,cAAc,CAAC,0BAA0B;AAEhC,MAAA,gCAAgC,GAAgB,IAAI,GAAG,GAAG;AACvE,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CACtC,CAAC,aAAqC,KAAI;IACtC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAa,KAAI;AAC5C,QAAA,gCAAgC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAChD,KAAC,CAAC,CAAC;AACP,CAAC,CACJ,CAAC;AAEF;;;;;AAKG;SACa,2BAA2B,CACvC,sBAA8C,EAC9C,MAAc,EACd,aAAqB,EAAA;AAErB,IAAA,IAAI,aAAmC,CAAC;AACxC,IAAA,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,kBAAkB,CAAC;AACrE,IAAA,IAAI,kBAAkB,EAAE;AACpB,QAAA,MAAM,aAAa,GAAG,IAAI,SAAS,CAC/B,kBAAkB,CACrB,CAAC,gBAAgB,EAAE,CAAC,eAAe,CAAC;QACrC,aAAa;AACT,YAAA,sBAAsB,CAClB,MAAM,EACN,aAAa,EACb,aAAa,EACb,sBAAsB,CAAC,sBAAsB,EAAE,QAAQ,EACvD,uBAAuB,CAAC,MAAM,CACjC;AACD,gBAAA,sBAAsB,CAClB,MAAM,EACN,aAAa,EACb,aAAa,EACb,yBAAyB,CAAC,QAAQ,EAClC,uBAAuB,CAAC,gBAAgB,CAC3C;gBACD,sBAAsB,CAAC,gBAAgB,CAAC;AAC/C,KAAA;IAED,OAAO,aAAa,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;AAKG;AACG,SAAU,sBAAsB,CAClC,MAAc,EACd,aAAqB,EACrB,aAAsB,EACtB,sBAAiD,EACjD,MAAgC,EAAA;IAEhC,MAAM,CAAC,KAAK,CACR,CAAA,4CAAA,EAA+C,MAAM,CAAG,CAAA,CAAA,EACxD,aAAa,CAChB,CAAC;IACF,IAAI,aAAa,IAAI,sBAAsB,EAAE;QACzC,MAAM,QAAQ,GAAG,4CAA4C,CACzD,sBAAsB,EACtB,aAAa,CAChB,CAAC;AAEF,QAAA,IAAI,QAAQ,EAAE;YACV,MAAM,CAAC,KAAK,CACR,CAAA,2DAAA,EAA8D,MAAM,CAAsB,oBAAA,CAAA,EAC1F,aAAa,CAChB,CAAC;YACF,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC3B,SAAA;AAAM,aAAA;YACH,MAAM,CAAC,KAAK,CACR,CAAA,kEAAA,EAAqE,MAAM,CAAG,CAAA,CAAA,EAC9E,aAAa,CAChB,CAAC;AACL,SAAA;AACJ,KAAA;AAED,IAAA,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;AAEG;AACG,SAAU,4CAA4C,CACxD,aAAqB,EAAA;IAErB,MAAM,QAAQ,GAAG,4CAA4C,CACzD,yBAAyB,CAAC,QAAQ,EAClC,aAAa,CAChB,CAAC;AACF,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;AAIG;AACa,SAAA,4CAA4C,CACxD,QAAkC,EAClC,aAAqB,EAAA;AAErB,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACtC,QAAA,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;AAC1C,YAAA,OAAO,QAAQ,CAAC;AACnB,SAAA;AACJ,KAAA;AAED,IAAA,OAAO,IAAI,CAAC;AAChB;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/AuthorityOptions.mjs

@@ -0,0 +1,23 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const AzureCloudInstance = {
+    // AzureCloudInstance is not specified.
+    None: "none",
+    // Microsoft Azure public cloud
+    AzurePublic: "https://login.microsoftonline.com",
+    // Microsoft PPE
+    AzurePpe: "https://login.windows-ppe.net",
+    // Microsoft Chinese national/regional cloud
+    AzureChina: "https://login.chinacloudapi.cn",
+    // Microsoft German national/regional cloud ("Black Forest")
+    AzureGermany: "https://login.microsoftonline.de",
+    // US Government cloud
+    AzureUsGovernment: "https://login.microsoftonline.us",
+};
+
+export { AzureCloudInstance };
+//# sourceMappingURL=AuthorityOptions.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/AuthorityOptions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityOptions.mjs","sources":["../../src/authority/AuthorityOptions.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAwBU,MAAA,kBAAkB,GAAG;;AAE9B,IAAA,IAAI,EAAE,MAAM;;AAGZ,IAAA,WAAW,EAAE,mCAAmC;;AAGhD,IAAA,QAAQ,EAAE,+BAA+B;;AAGzC,IAAA,UAAU,EAAE,gCAAgC;;AAG5C,IAAA,YAAY,EAAE,kCAAkC;;AAGhD,IAAA,iBAAiB,EAAE,kCAAkC;;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/AuthorityType.mjs

@@ -0,0 +1,18 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Authority types supported by MSAL.
+ */
+const AuthorityType = {
+    Default: 0,
+    Adfs: 1,
+    Dsts: 2,
+    Ciam: 3,
+};
+
+export { AuthorityType };
+//# sourceMappingURL=AuthorityType.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/AuthorityType.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityType.mjs","sources":["../../src/authority/AuthorityType.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEH;;AAEG;AACU,MAAA,aAAa,GAAG;AACzB,IAAA,OAAO,EAAE,CAAC;AACV,IAAA,IAAI,EAAE,CAAC;AACP,IAAA,IAAI,EAAE,CAAC;AACP,IAAA,IAAI,EAAE,CAAC;;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/CloudInstanceDiscoveryErrorResponse.mjs

@@ -0,0 +1,13 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryErrorResponse(response) {
+    return (response.hasOwnProperty("error") &&
+        response.hasOwnProperty("error_description"));
+}
+
+export { isCloudInstanceDiscoveryErrorResponse };
+//# sourceMappingURL=CloudInstanceDiscoveryErrorResponse.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/CloudInstanceDiscoveryErrorResponse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudInstanceDiscoveryErrorResponse.mjs","sources":["../../src/authority/CloudInstanceDiscoveryErrorResponse.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAeG,SAAU,qCAAqC,CACjD,QAAgB,EAAA;AAEhB,IAAA,QACI,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;AAChC,QAAA,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC9C;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/CloudInstanceDiscoveryResponse.mjs

@@ -0,0 +1,13 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryResponse(response) {
+    return (response.hasOwnProperty("tenant_discovery_endpoint") &&
+        response.hasOwnProperty("metadata"));
+}
+
+export { isCloudInstanceDiscoveryResponse };
+//# sourceMappingURL=CloudInstanceDiscoveryResponse.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/CloudInstanceDiscoveryResponse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudInstanceDiscoveryResponse.mjs","sources":["../../src/authority/CloudInstanceDiscoveryResponse.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAYG,SAAU,gCAAgC,CAAC,QAAgB,EAAA;AAC7D,IAAA,QACI,QAAQ,CAAC,cAAc,CAAC,2BAA2B,CAAC;AACpD,QAAA,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,EACrC;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/OpenIdConfigResponse.mjs

@@ -0,0 +1,15 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isOpenIdConfigResponse(response) {
+    return (response.hasOwnProperty("authorization_endpoint") &&
+        response.hasOwnProperty("token_endpoint") &&
+        response.hasOwnProperty("issuer") &&
+        response.hasOwnProperty("jwks_uri"));
+}
+
+export { isOpenIdConfigResponse };
+//# sourceMappingURL=OpenIdConfigResponse.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/OpenIdConfigResponse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenIdConfigResponse.mjs","sources":["../../src/authority/OpenIdConfigResponse.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAaG,SAAU,sBAAsB,CAAC,QAAgB,EAAA;AACnD,IAAA,QACI,QAAQ,CAAC,cAAc,CAAC,wBAAwB,CAAC;AACjD,QAAA,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC;AACzC,QAAA,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;AACjC,QAAA,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,EACrC;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/ProtocolMode.mjs

@@ -0,0 +1,27 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Protocol modes supported by MSAL.
+ */
+const ProtocolMode = {
+    /**
+     * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
+     */
+    AAD: "AAD",
+    /**
+     * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
+     * Support is limited for this mode.
+     */
+    OIDC: "OIDC",
+    /**
+     * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
+     */
+    EAR: "EAR",
+};
+
+export { ProtocolMode };
+//# sourceMappingURL=ProtocolMode.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/ProtocolMode.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtocolMode.mjs","sources":["../../src/authority/ProtocolMode.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEH;;AAEG;AACU,MAAA,YAAY,GAAG;AACxB;;AAEG;AACH,IAAA,GAAG,EAAE,KAAK;AACV;;;AAGG;AACH,IAAA,IAAI,EAAE,MAAM;AACZ;;AAEG;AACH,IAAA,GAAG,EAAE,KAAK;;;;;"}

backend/node_modules/@azure/msal-common/dist/authority/RegionDiscovery.mjs

@@ -0,0 +1,111 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { IMDS_VERSION, HTTP_SUCCESS, RegionDiscoverySources, HTTP_BAD_REQUEST, IMDS_ENDPOINT, IMDS_TIMEOUT } from '../utils/Constants.mjs';
+import { RegionDiscoveryGetRegionFromIMDS, RegionDiscoveryGetCurrentVersion } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class RegionDiscovery {
+    constructor(networkInterface, logger, performanceClient, correlationId) {
+        this.networkInterface = networkInterface;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
+    }
+    /**
+     * Detect the region from the application's environment.
+     *
+     * @returns Promise<string | null>
+     */
+    async detectRegion(environmentRegion, regionDiscoveryMetadata) {
+        // Initialize auto detected region with the region from the envrionment
+        let autodetectedRegionName = environmentRegion;
+        // Check if a region was detected from the environment, if not, attempt to get the region from IMDS
+        if (!autodetectedRegionName) {
+            const options = RegionDiscovery.IMDS_OPTIONS;
+            try {
+                const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
+                if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
+                    autodetectedRegionName = localIMDSVersionResponse.body;
+                    regionDiscoveryMetadata.region_source =
+                        RegionDiscoverySources.IMDS;
+                }
+                // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
+                if (localIMDSVersionResponse.status ===
+                    HTTP_BAD_REQUEST) {
+                    const currentIMDSVersion = await invokeAsync(this.getCurrentVersion.bind(this), RegionDiscoveryGetCurrentVersion, this.logger, this.performanceClient, this.correlationId)(options);
+                    if (!currentIMDSVersion) {
+                        regionDiscoveryMetadata.region_source =
+                            RegionDiscoverySources.FAILED_AUTO_DETECTION;
+                        return null;
+                    }
+                    const currentIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(currentIMDSVersion, options);
+                    if (currentIMDSVersionResponse.status ===
+                        HTTP_SUCCESS) {
+                        autodetectedRegionName =
+                            currentIMDSVersionResponse.body;
+                        regionDiscoveryMetadata.region_source =
+                            RegionDiscoverySources.IMDS;
+                    }
+                }
+            }
+            catch (e) {
+                regionDiscoveryMetadata.region_source =
+                    RegionDiscoverySources.FAILED_AUTO_DETECTION;
+                return null;
+            }
+        }
+        else {
+            regionDiscoveryMetadata.region_source =
+                RegionDiscoverySources.ENVIRONMENT_VARIABLE;
+        }
+        // If no region was auto detected from the environment or from the IMDS endpoint, mark the attempt as a FAILED_AUTO_DETECTION
+        if (!autodetectedRegionName) {
+            regionDiscoveryMetadata.region_source =
+                RegionDiscoverySources.FAILED_AUTO_DETECTION;
+        }
+        return autodetectedRegionName || null;
+    }
+    /**
+     * Make the call to the IMDS endpoint
+     *
+     * @param imdsEndpointUrl
+     * @returns Promise<NetworkResponse<string>>
+     */
+    async getRegionFromIMDS(version, options) {
+        return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
+    }
+    /**
+     * Get the most recent version of the IMDS endpoint available
+     *
+     * @returns Promise<string | null>
+     */
+    async getCurrentVersion(options) {
+        try {
+            const response = await this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?format=json`, options);
+            // When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
+            if (response.status === HTTP_BAD_REQUEST &&
+                response.body &&
+                response.body["newest-versions"] &&
+                response.body["newest-versions"].length > 0) {
+                return response.body["newest-versions"][0];
+            }
+            return null;
+        }
+        catch (e) {
+            return null;
+        }
+    }
+}
+// Options for the IMDS endpoint request
+RegionDiscovery.IMDS_OPTIONS = {
+    headers: {
+        Metadata: "true",
+    },
+};
+
+export { RegionDiscovery };
+//# sourceMappingURL=RegionDiscovery.mjs.map

backend/node_modules/@azure/msal-common/dist/authority/RegionDiscovery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegionDiscovery.mjs","sources":["../../src/authority/RegionDiscovery.ts"],"sourcesContent":[null],"names":["PerformanceEvents.RegionDiscoveryGetRegionFromIMDS","Constants.IMDS_VERSION","Constants.HTTP_SUCCESS","Constants.RegionDiscoverySources","Constants.HTTP_BAD_REQUEST","PerformanceEvents.RegionDiscoveryGetCurrentVersion","Constants.IMDS_ENDPOINT","Constants.IMDS_TIMEOUT"],"mappings":";;;;;;AAAA;;;AAGG;MAaU,eAAe,CAAA;AAgBxB,IAAA,WAAA,CACI,gBAAgC,EAChC,MAAc,EACd,iBAAqC,EACrC,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;AACzC,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;AAC3C,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;KACtC;AAED;;;;AAIG;AACI,IAAA,MAAM,YAAY,CACrB,iBAAqC,EACrC,uBAAgD,EAAA;;QAGhD,IAAI,sBAAsB,GAAG,iBAAiB,CAAC;;QAG/C,IAAI,CAAC,sBAAsB,EAAE;AACzB,YAAA,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC;YAE7C,IAAI;AACA,gBAAA,MAAM,wBAAwB,GAAG,MAAM,WAAW,CAC9C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EACjCA,gCAAkD,EAClD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,aAAa,CACrB,CAACC,YAAsB,EAAE,OAAO,CAAC,CAAC;AACnC,gBAAA,IACI,wBAAwB,CAAC,MAAM,KAAKC,YAAsB,EAC5D;AACE,oBAAA,sBAAsB,GAAG,wBAAwB,CAAC,IAAI,CAAC;AACvD,oBAAA,uBAAuB,CAAC,aAAa;AACjC,wBAAAC,sBAAgC,CAAC,IAAI,CAAC;AAC7C,iBAAA;;gBAGD,IACI,wBAAwB,CAAC,MAAM;oBAC/BC,gBAA0B,EAC5B;AACE,oBAAA,MAAM,kBAAkB,GAAG,MAAM,WAAW,CACxC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EACjCC,gCAAkD,EAClD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,aAAa,CACrB,CAAC,OAAO,CAAC,CAAC;oBACX,IAAI,CAAC,kBAAkB,EAAE;AACrB,wBAAA,uBAAuB,CAAC,aAAa;AACjC,4BAAAF,sBAAgC,CAAC,qBAAqB,CAAC;AAC3D,wBAAA,OAAO,IAAI,CAAC;AACf,qBAAA;AAED,oBAAA,MAAM,0BAA0B,GAAG,MAAM,WAAW,CAChD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EACjCH,gCAAkD,EAClD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,aAAa,CACrB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;oBAC/B,IACI,0BAA0B,CAAC,MAAM;wBACjCE,YAAsB,EACxB;wBACE,sBAAsB;4BAClB,0BAA0B,CAAC,IAAI,CAAC;AACpC,wBAAA,uBAAuB,CAAC,aAAa;AACjC,4BAAAC,sBAAgC,CAAC,IAAI,CAAC;AAC7C,qBAAA;AACJ,iBAAA;AACJ,aAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,uBAAuB,CAAC,aAAa;AACjC,oBAAAA,sBAAgC,CAAC,qBAAqB,CAAC;AAC3D,gBAAA,OAAO,IAAI,CAAC;AACf,aAAA;AACJ,SAAA;AAAM,aAAA;AACH,YAAA,uBAAuB,CAAC,aAAa;AACjC,gBAAAA,sBAAgC,CAAC,oBAAoB,CAAC;AAC7D,SAAA;;QAGD,IAAI,CAAC,sBAAsB,EAAE;AACzB,YAAA,uBAAuB,CAAC,aAAa;AACjC,gBAAAA,sBAAgC,CAAC,qBAAqB,CAAC;AAC9D,SAAA;QAED,OAAO,sBAAsB,IAAI,IAAI,CAAC;KACzC;AAED;;;;;AAKG;AACK,IAAA,MAAM,iBAAiB,CAC3B,OAAe,EACf,OAAoB,EAAA;QAEpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAC5C,CAAA,EAAGG,aAAuB,gBAAgB,OAAO,CAAA,YAAA,CAAc,EAC/D,OAAO,EACPC,YAAsB,CACzB,CAAC;KACL;AAED;;;;AAIG;IACK,MAAM,iBAAiB,CAC3B,OAAoB,EAAA;QAEpB,IAAI;AACA,YAAA,MAAM,QAAQ,GACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAC3C,CAAA,EAAGD,aAAuB,cAAc,EACxC,OAAO,CACV,CAAC;;AAGN,YAAA,IACI,QAAQ,CAAC,MAAM,KAAKF,gBAA0B;AAC9C,gBAAA,QAAQ,CAAC,IAAI;AACb,gBAAA,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAC7C;gBACE,OAAO,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,aAAA;AAED,YAAA,OAAO,IAAI,CAAC;AACf,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;AACR,YAAA,OAAO,IAAI,CAAC;AACf,SAAA;KACJ;;AAvJD;AACiB,eAAA,CAAA,YAAY,GAAgB;AACzC,IAAA,OAAO,EAAE;AACL,QAAA,QAAQ,EAAE,MAAM;AACnB,KAAA;CACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/cache/persistence/TokenCacheContext.mjs

@@ -0,0 +1,30 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This class instance helps track the memory changes facilitating
+ * decisions to read from and write to the persistent cache
+ */ class TokenCacheContext {
+    constructor(tokenCache, hasChanged) {
+        this.cache = tokenCache;
+        this.hasChanged = hasChanged;
+    }
+    /**
+     * boolean which indicates the changes in cache
+     */
+    get cacheHasChanged() {
+        return this.hasChanged;
+    }
+    /**
+     * function to retrieve the token cache
+     */
+    get tokenCache() {
+        return this.cache;
+    }
+}
+
+export { TokenCacheContext };
+//# sourceMappingURL=TokenCacheContext.mjs.map

backend/node_modules/@azure/msal-common/dist/cache/persistence/TokenCacheContext.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenCacheContext.mjs","sources":["../../../src/cache/persistence/TokenCacheContext.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAIH;;;UAGiB,iBAAiB,CAAA;IAU9B,WAAY,CAAA,UAAmC,EAAE,UAAmB,EAAA;AAChE,QAAA,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;AACxB,QAAA,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;KAChC;AAED;;AAEG;AACH,IAAA,IAAI,eAAe,GAAA;QACf,OAAO,IAAI,CAAC,UAAU,CAAC;KAC1B;AAED;;AAEG;AACH,IAAA,IAAI,UAAU,GAAA;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;KACrB;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/cache/utils/AccountEntityUtils.mjs

@@ -0,0 +1,207 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { CACHE_KEY_SEPARATOR, CACHE_ACCOUNT_TYPE_GENERIC, CACHE_ACCOUNT_TYPE_ADFS, CACHE_ACCOUNT_TYPE_MSSTS } from '../../utils/Constants.mjs';
+import { buildClientInfo } from '../../account/ClientInfo.mjs';
+import { buildTenantProfile } from '../../account/AccountInfo.mjs';
+import { createClientAuthError } from '../../error/ClientAuthError.mjs';
+import { AuthorityType } from '../../authority/AuthorityType.mjs';
+import { getTenantIdFromIdTokenClaims } from '../../account/TokenClaims.mjs';
+import { ProtocolMode } from '../../authority/ProtocolMode.mjs';
+import { invalidCacheEnvironment } from '../../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ */
+function generateAccountId(accountEntity) {
+    const accountId = [
+        accountEntity.homeAccountId,
+        accountEntity.environment,
+    ];
+    return accountId.join(CACHE_KEY_SEPARATOR).toLowerCase();
+}
+/**
+ * Returns the AccountInfo interface for this account.
+ */
+function getAccountInfo(accountEntity) {
+    const tenantProfiles = accountEntity.tenantProfiles || [];
+    // Ensure at least the home tenant profile exists
+    if (tenantProfiles.length === 0 &&
+        accountEntity.realm &&
+        accountEntity.localAccountId) {
+        tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+    }
+    return {
+        homeAccountId: accountEntity.homeAccountId,
+        environment: accountEntity.environment,
+        tenantId: accountEntity.realm,
+        username: accountEntity.username,
+        localAccountId: accountEntity.localAccountId,
+        loginHint: accountEntity.loginHint,
+        name: accountEntity.name,
+        nativeAccountId: accountEntity.nativeAccountId,
+        authorityType: accountEntity.authorityType,
+        // Deserialize tenant profiles array into a Map
+        tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
+            return [tenantProfile.tenantId, tenantProfile];
+        })),
+        dataBoundary: accountEntity.dataBoundary,
+    };
+}
+/**
+ * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ */
+function isSingleTenant(accountEntity) {
+    return !accountEntity.tenantProfiles;
+}
+/**
+ * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+ * @param accountDetails
+ */
+function createAccountEntity(accountDetails, authority, base64Decode) {
+    let authorityType;
+    if (authority.authorityType === AuthorityType.Adfs) {
+        authorityType = CACHE_ACCOUNT_TYPE_ADFS;
+    }
+    else if (authority.protocolMode === ProtocolMode.OIDC) {
+        authorityType = CACHE_ACCOUNT_TYPE_GENERIC;
+    }
+    else {
+        authorityType = CACHE_ACCOUNT_TYPE_MSSTS;
+    }
+    let clientInfo;
+    let dataBoundary;
+    if (accountDetails.clientInfo && base64Decode) {
+        clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        if (clientInfo.xms_tdbr) {
+            dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+        }
+    }
+    const env = accountDetails.environment ||
+        (authority && authority.getPreferredCache());
+    if (!env) {
+        throw createClientAuthError(invalidCacheEnvironment);
+    }
+    /*
+     * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+     * In most cases it will contain a single email. This field should not be relied upon if a custom
+     * policy is configured to return more than 1 email.
+     */
+    const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+        accountDetails.idTokenClaims?.upn;
+    const email = accountDetails.idTokenClaims?.emails
+        ? accountDetails.idTokenClaims.emails[0]
+        : null;
+    const username = preferredUsername || email || "";
+    const loginHint = accountDetails.idTokenClaims?.login_hint;
+    const realm = clientInfo?.utid ||
+        getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+        ""; // non-AAD scenarios can have empty realm
+    // How do you account for MSA CID here?
+    const localAccountId = clientInfo?.uid ||
+        accountDetails.idTokenClaims?.oid ||
+        accountDetails.idTokenClaims?.sub ||
+        "";
+    let tenantProfiles;
+    if (accountDetails.tenantProfiles) {
+        tenantProfiles = accountDetails.tenantProfiles;
+    }
+    else {
+        const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
+        tenantProfiles = [tenantProfile];
+    }
+    return {
+        homeAccountId: accountDetails.homeAccountId,
+        environment: env,
+        realm: realm,
+        localAccountId: localAccountId,
+        username: username,
+        authorityType: authorityType,
+        loginHint: loginHint,
+        clientInfo: accountDetails.clientInfo,
+        name: accountDetails.idTokenClaims?.name || "",
+        lastModificationTime: undefined,
+        lastModificationApp: undefined,
+        cloudGraphHostName: accountDetails.cloudGraphHostName,
+        msGraphHost: accountDetails.msGraphHost,
+        nativeAccountId: accountDetails.nativeAccountId,
+        tenantProfiles: tenantProfiles,
+        dataBoundary,
+    };
+}
+/**
+ * Creates an AccountEntity object from AccountInfo
+ * @param accountInfo
+ * @param cloudGraphHostName
+ * @param msGraphHost
+ * @returns
+ */
+function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+    // Serialize tenant profiles map into an array
+    const tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+    // Ensure at least the home tenant profile exists
+    if (tenantProfiles.length === 0 &&
+        accountInfo.tenantId &&
+        accountInfo.localAccountId) {
+        tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
+    }
+    return {
+        authorityType: accountInfo.authorityType || CACHE_ACCOUNT_TYPE_GENERIC,
+        homeAccountId: accountInfo.homeAccountId,
+        localAccountId: accountInfo.localAccountId,
+        nativeAccountId: accountInfo.nativeAccountId,
+        realm: accountInfo.tenantId,
+        environment: accountInfo.environment,
+        username: accountInfo.username,
+        loginHint: accountInfo.loginHint,
+        name: accountInfo.name,
+        cloudGraphHostName: cloudGraphHostName,
+        msGraphHost: msGraphHost,
+        tenantProfiles: tenantProfiles,
+        dataBoundary: accountInfo.dataBoundary,
+    };
+}
+/**
+ * Generate HomeAccountId from server response
+ * @param serverClientInfo
+ * @param authType
+ */
+function generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, correlationId, idTokenClaims) {
+    // since ADFS/DSTS do not have tid and does not set client_info
+    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+        // for cases where there is clientInfo
+        if (serverClientInfo) {
+            try {
+                const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                if (clientInfo.uid && clientInfo.utid) {
+                    return `${clientInfo.uid}.${clientInfo.utid}`;
+                }
+            }
+            catch (e) { }
+        }
+        logger.warning("No client info in response", correlationId);
+    }
+    // default to "sub" claim
+    return idTokenClaims?.sub || "";
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAccountEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("localAccountId") &&
+        entity.hasOwnProperty("username") &&
+        entity.hasOwnProperty("authorityType"));
+}
+
+export { createAccountEntity, createAccountEntityFromAccountInfo, generateAccountId, generateHomeAccountId, getAccountInfo, isAccountEntity, isSingleTenant };
+//# sourceMappingURL=AccountEntityUtils.mjs.map

backend/node_modules/@azure/msal-common/dist/cache/utils/CacheHelpers.mjs

@@ -0,0 +1,267 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { extractTokenClaims } from '../../account/AuthToken.mjs';
+import { createClientAuthError } from '../../error/ClientAuthError.mjs';
+import { CredentialType, AuthenticationScheme, SERVER_TELEM_CACHE_KEY, THROTTLING_PREFIX, APP_METADATA, CACHE_KEY_SEPARATOR, AUTHORITY_METADATA_CACHE_KEY, AUTHORITY_METADATA_REFRESH_TIME_SECONDS } from '../../utils/Constants.mjs';
+import { nowSeconds } from '../../utils/TimeUtils.mjs';
+import { tokenClaimsCnfRequiredForSignedJwt } from '../../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+function createIdTokenEntity(homeAccountId, environment, idToken, clientId, tenantId) {
+    const idTokenEntity = {
+        credentialType: CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    return idTokenEntity;
+}
+/**
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
+ */
+function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+    const atEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
+    }
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (atEntity.tokenType?.toLowerCase() !==
+        AuthenticationScheme.BEARER.toLowerCase()) {
+        atEntity.credentialType =
+            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case AuthenticationScheme.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case AuthenticationScheme.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+    return atEntity;
+}
+/**
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash, expiresOn) {
+    const rtEntity = {
+        credentialType: CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
+    };
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
+    }
+    if (familyId) {
+        rtEntity.familyId = familyId;
+    }
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
+    }
+    return rtEntity;
+}
+function isCredentialEntity(entity) {
+    return (entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAccessTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isIdTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === CredentialType.ID_TOKEN);
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isRefreshTokenEntity(entity) {
+    if (!entity) {
+        return false;
+    }
+    return (isCredentialEntity(entity) &&
+        entity["credentialType"] === CredentialType.REFRESH_TOKEN);
+}
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isServerTelemetryEntity(key, entity) {
+    const validateKey = key.indexOf(SERVER_TELEM_CACHE_KEY) === 0;
+    let validateEntity = true;
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+                entity.hasOwnProperty("errors") &&
+                entity.hasOwnProperty("cacheHits");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isThrottlingEntity(key, entity) {
+    let validateKey = false;
+    if (key) {
+        validateKey = key.indexOf(THROTTLING_PREFIX) === 0;
+    }
+    let validateEntity = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+    return validateKey && validateEntity;
+}
+/**
+ * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ */
+function generateAppMetadataKey({ environment, clientId, }) {
+    const appMetaDataKeyArray = [
+        APP_METADATA,
+        environment,
+        clientId,
+    ];
+    return appMetaDataKeyArray
+        .join(CACHE_KEY_SEPARATOR)
+        .toLowerCase();
+}
+/*
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAppMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(APP_METADATA) === 0 &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("environment"));
+}
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+function isAuthorityMetadataEntity(key, entity) {
+    if (!entity) {
+        return false;
+    }
+    return (key.indexOf(AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+        entity.hasOwnProperty("aliases") &&
+        entity.hasOwnProperty("preferred_cache") &&
+        entity.hasOwnProperty("preferred_network") &&
+        entity.hasOwnProperty("canonical_authority") &&
+        entity.hasOwnProperty("authorization_endpoint") &&
+        entity.hasOwnProperty("token_endpoint") &&
+        entity.hasOwnProperty("issuer") &&
+        entity.hasOwnProperty("aliasesFromNetwork") &&
+        entity.hasOwnProperty("endpointsFromNetwork") &&
+        entity.hasOwnProperty("expiresAt") &&
+        entity.hasOwnProperty("jwks_uri"));
+}
+/**
+ * Reset the exiresAt value
+ */
+function generateAuthorityMetadataExpiresAt() {
+    return (nowSeconds() +
+        AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
+}
+function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.authorization_endpoint =
+        updatedValues.authorization_endpoint;
+    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+    authorityMetadata.issuer = updatedValues.issuer;
+    authorityMetadata.endpointsFromNetwork = fromNetwork;
+    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+}
+function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
+    authorityMetadata.aliases = updatedValues.aliases;
+    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+    authorityMetadata.preferred_network = updatedValues.preferred_network;
+    authorityMetadata.aliasesFromNetwork = fromNetwork;
+}
+/**
+ * Returns whether or not the data needs to be refreshed
+ */
+function isAuthorityMetadataExpired(metadata) {
+    return metadata.expiresAt <= nowSeconds();
+}
+
+export { createAccessTokenEntity, createIdTokenEntity, createRefreshTokenEntity, generateAppMetadataKey, generateAuthorityMetadataExpiresAt, isAccessTokenEntity, isAppMetadataEntity, isAuthorityMetadataEntity, isAuthorityMetadataExpired, isCredentialEntity, isIdTokenEntity, isRefreshTokenEntity, isServerTelemetryEntity, isThrottlingEntity, updateAuthorityEndpointMetadata, updateCloudDiscoveryMetadata };
+//# sourceMappingURL=CacheHelpers.mjs.map

backend/node_modules/@azure/msal-common/dist/client/AuthorizationCodeClient.mjs

@@ -0,0 +1,283 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { addClientId, addRedirectUri, addScopes, addResource, addAuthorizationCode, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addCodeVerifier, addClientSecret, addClientAssertion, addClientAssertionType, addGrantType, addClientInfo, addPopToken, addSshJwk, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams, addClaims, addPostLogoutRedirectUri, addCorrelationId, addIdTokenHint, addState, addLogoutHint, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { CLIENT_INFO_SEPARATOR, AuthenticationScheme, HeaderNames, GrantType } from '../utils/Constants.mjs';
+import { RETURN_SPA_CODE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
+import { buildClientConfiguration, isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
+import { ResponseHandler } from '../response/ResponseHandler.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';
+import { nowSeconds } from '../utils/TimeUtils.mjs';
+import { buildClientInfo, buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { CcsCredentialType } from '../account/CcsCredential.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { UpdateTokenEndpointAuthority, AuthClientExecuteTokenRequest, HandleServerTokenResponse, AuthClientCreateTokenRequestBody, AuthorizationCodeClientExecutePostToTokenEndpoint, PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';
+import { getRequestThumbprint } from '../network/RequestThumbprint.mjs';
+import { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint } from '../protocol/Token.mjs';
+import { createDiscoveredInstance } from '../authority/AuthorityFactory.mjs';
+import { Logger } from '../logger/Logger.mjs';
+import { name, version } from '../packageMetadata.mjs';
+import { requestCannotBeMade } from '../error/ClientAuthErrorCodes.mjs';
+import { logoutRequestEmpty, redirectUriEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Oauth2.0 Authorization Code client
+ * @internal
+ */
+class AuthorizationCodeClient {
+    constructor(configuration, performanceClient) {
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        this.includeRedirectUri = true;
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+        this.oidcDefaultScopes =
+            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
+    }
+    /**
+     * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
+     * authorization_code_grant
+     * @param request
+     */
+    async acquireToken(request, apiId, authCodePayload) {
+        if (!request.code) {
+            throw createClientAuthError(requestCannotBeMade);
+        }
+        // Check for new cloud instance
+        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+            await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
+        }
+        const reqTimestamp = nowSeconds();
+        const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
+        // Retrieve requestId from response headers
+        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        // Validate response. This function throws a server error if an error is returned by the server.
+        responseHandler.validateTokenResponse(response.body, request.correlationId);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
+    }
+    /**
+     * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
+     * Default behaviour is to redirect the user to `window.location.href`.
+     * @param authorityUri
+     */
+    getLogoutUri(logoutRequest) {
+        // Throw error if logoutRequest is null/undefined
+        if (!logoutRequest) {
+            throw createClientConfigurationError(logoutRequestEmpty);
+        }
+        const queryString = this.createLogoutUrlQueryString(logoutRequest);
+        // Construct logout URI
+        return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
+    }
+    /**
+     * Executes POST request to token endpoint
+     * @param authority
+     * @param request
+     */
+    async executeTokenRequest(authority, request, serverTelemetryManager) {
+        const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
+        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
+        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
+        let ccsCredential = undefined;
+        if (request.clientInfo) {
+            try {
+                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
+                ccsCredential = {
+                    credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    type: CcsCredentialType.HOME_ACCOUNT_ID,
+                };
+            }
+            catch (e) {
+                this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
+            }
+        }
+        const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
+        return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
+    }
+    /**
+     * Generates a map for all the params to be sent to the service
+     * @param request
+     */
+    async createTokenRequestBody(request) {
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
+            request.extraParameters?.[CLIENT_ID] ||
+            this.config.authOptions.clientId);
+        /*
+         * For hybrid spa flow, there will be a code but no verifier
+         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+         */
+        if (!this.includeRedirectUri) {
+            // Just validate
+            if (!request.redirectUri) {
+                throw createClientConfigurationError(redirectUriEmpty);
+            }
+        }
+        else {
+            // Validate and include redirect uri
+            addRedirectUri(parameters, request.redirectUri);
+        }
+        // Add scope array, parameter builder will add default scopes and dedupe
+        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
+        // add code: user set, not validated
+        addAuthorizationCode(parameters, request.code);
+        // Add library metadata
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
+            addServerTelemetry(parameters, this.serverTelemetryManager);
+        }
+        // add code_verifier if passed
+        if (request.codeVerifier) {
+            addCodeVerifier(parameters, request.codeVerifier);
+        }
+        if (this.config.clientCredentials.clientSecret) {
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
+        }
+        if (this.config.clientCredentials.clientAssertion) {
+            const clientAssertion = this.config.clientCredentials.clientAssertion;
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
+        }
+        addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
+        addClientInfo(parameters);
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+            addPopToken(parameters, reqCnfData);
+        }
+        else if (request.authenticationScheme === AuthenticationScheme.SSH) {
+            if (request.sshJwk) {
+                addSshJwk(parameters, request.sshJwk);
+            }
+            else {
+                throw createClientConfigurationError(missingSshJwk);
+            }
+        }
+        let ccsCred = undefined;
+        if (request.clientInfo) {
+            try {
+                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
+                ccsCred = {
+                    credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    type: CcsCredentialType.HOME_ACCOUNT_ID,
+                };
+            }
+            catch (e) {
+                this.logger.verbose(`Could not parse client info for CCS Header: '${e}'`, request.correlationId);
+            }
+        }
+        else {
+            ccsCred = request.ccsCredential;
+        }
+        // Adds these as parameters in the request instead of headers to prevent CORS preflight request
+        if (this.config.systemOptions.preventCorsPreflight && ccsCred) {
+            switch (ccsCred.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    addCcsUpn(parameters, ccsCred.credential);
+                    break;
+            }
+        }
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
+        }
+        if (request.extraParameters) {
+            addExtraParameters(parameters, request.extraParameters);
+        }
+        // Add hybrid spa parameters if not already provided
+        if (request.enableSpaAuthorizationCode &&
+            (!request.extraParameters ||
+                !request.extraParameters[RETURN_SPA_CODE])) {
+            addExtraParameters(parameters, {
+                [RETURN_SPA_CODE]: "1",
+            });
+        }
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        return mapToQueryString(parameters);
+    }
+    /**
+     * This API validates the `EndSessionRequest` and creates a URL
+     * @param request
+     */
+    createLogoutUrlQueryString(request) {
+        const parameters = new Map();
+        if (request.postLogoutRedirectUri) {
+            addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
+        }
+        if (request.correlationId) {
+            addCorrelationId(parameters, request.correlationId);
+        }
+        if (request.idTokenHint) {
+            addIdTokenHint(parameters, request.idTokenHint);
+        }
+        if (request.state) {
+            addState(parameters, request.state);
+        }
+        if (request.logoutHint) {
+            addLogoutHint(parameters, request.logoutHint);
+        }
+        if (request.extraQueryParameters) {
+            addExtraParameters(parameters, request.extraQueryParameters);
+        }
+        if (this.config.authOptions.instanceAware) {
+            addInstanceAware(parameters);
+        }
+        return mapToQueryString(parameters);
+    }
+    /**
+     * Updates the authority to the cloud instance provided in the authorization response
+     * @param cloudInstanceHostName - cloud instance host name from authorization code payload
+     * @param correlationId - request correlation id
+     */
+    async updateTokenEndpointAuthority(cloudInstanceHostName, correlationId) {
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
+        this.authority = cloudInstanceAuthority;
+    }
+}
+
+export { AuthorizationCodeClient };
+//# sourceMappingURL=AuthorizationCodeClient.mjs.map

backend/node_modules/@azure/msal-common/dist/client/RefreshTokenClient.mjs

@@ -0,0 +1,249 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { buildClientConfiguration, isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
+import { addClientId, addRedirectUri, addScopes, addGrantType, addClientInfo, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addRefreshToken, addClientSecret, addClientAssertion, addClientAssertionType, addPopToken, addSshJwk, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams, addClaims } from '../request/RequestParameterBuilder.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { AuthenticationScheme, HeaderNames, INVALID_GRANT_ERROR, CLIENT_MISMATCH_ERROR, GrantType } from '../utils/Constants.mjs';
+import { CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
+import { ResponseHandler } from '../response/ResponseHandler.mjs';
+import { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { ServerError } from '../error/ServerError.mjs';
+import { nowSeconds, isTokenExpired } from '../utils/TimeUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { CcsCredentialType } from '../account/CcsCredential.mjs';
+import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { createInteractionRequiredAuthError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';
+import { RefreshTokenClientAcquireTokenWithCachedRefreshToken, RefreshTokenClientAcquireToken, RefreshTokenClientExecuteTokenRequest, HandleServerTokenResponse, CacheManagerGetRefreshToken, RefreshTokenClientCreateTokenRequestBody, RefreshTokenClientExecutePostToTokenEndpoint, PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync, invoke } from '../utils/FunctionWrappers.mjs';
+import { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';
+import { getRequestThumbprint } from '../network/RequestThumbprint.mjs';
+import { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint } from '../protocol/Token.mjs';
+import { Logger } from '../logger/Logger.mjs';
+import { name, version } from '../packageMetadata.mjs';
+import { badToken, noTokensFound, refreshTokenExpired } from '../error/InteractionRequiredAuthErrorCodes.mjs';
+import { tokenRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
+import { noAccountInSilentRequest } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
+/**
+ * OAuth2.0 refresh token client
+ * @internal
+ */
+class RefreshTokenClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+    }
+    async acquireToken(request, apiId) {
+        const reqTimestamp = nowSeconds();
+        const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
+        // Retrieve requestId from response headers
+        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        responseHandler.validateTokenResponse(response.body, request.correlationId);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, undefined, undefined, true, request.forceCache, requestId);
+    }
+    /**
+     * Gets cached refresh token and attaches to request, then calls acquireToken API
+     * @param request
+     */
+    async acquireTokenByRefreshToken(request, apiId) {
+        // Cannot renew token if no request object is given.
+        if (!request) {
+            throw createClientConfigurationError(tokenRequestEmpty);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        // try checking if FOCI is enabled for the given application
+        const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
+        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
+        if (isFOCI) {
+            try {
+                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true, apiId);
+            }
+            catch (e) {
+                const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
+                    e.errorCode ===
+                        noTokensFound;
+                const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
+                    e.errorCode === INVALID_GRANT_ERROR &&
+                    e.subError === CLIENT_MISMATCH_ERROR;
+                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
+                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
+                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
+                    // throw in all other cases
+                }
+                else {
+                    throw e;
+                }
+            }
+        }
+        // fall back to application refresh token acquisition
+        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false, apiId);
+    }
+    /**
+     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
+     * @param request
+     */
+    async acquireTokenWithCachedRefreshToken(request, foci, apiId) {
+        // fetches family RT or application RT based on FOCI value
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
+        if (!refreshToken) {
+            throw createInteractionRequiredAuthError(noTokensFound);
+        }
+        if (refreshToken.expiresOn) {
+            const offset = request.refreshTokenExpirationOffsetSeconds ||
+                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
+            this.performanceClient?.addFields({
+                cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
+                rtOffsetSeconds: offset,
+            }, request.correlationId);
+            if (isTokenExpired(refreshToken.expiresOn, offset)) {
+                throw createInteractionRequiredAuthError(refreshTokenExpired);
+            }
+        }
+        // attach cached RT size to the current measurement
+        const refreshTokenRequest = {
+            ...request,
+            refreshToken: refreshToken.secret,
+            authenticationScheme: request.authenticationScheme ||
+                AuthenticationScheme.BEARER,
+            ccsCredential: {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            },
+        };
+        try {
+            return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest, apiId);
+        }
+        catch (e) {
+            if (e instanceof InteractionRequiredAuthError) {
+                if (e.subError === badToken) {
+                    // Remove bad refresh token from cache
+                    this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache", request.correlationId);
+                    const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
+                    this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
+                }
+            }
+            throw e;
+        }
+    }
+    /**
+     * Constructs the network message and makes a NW call to the underlying secure token service
+     * @param request
+     * @param authority
+     */
+    async executeTokenRequest(request, authority) {
+        const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
+        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
+        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
+        const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
+        return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
+    }
+    /**
+     * Helper function to create the token request body
+     * @param request
+     */
+    async createTokenRequestBody(request) {
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
+            request.extraParameters?.[CLIENT_ID] ||
+            this.config.authOptions.clientId);
+        if (request.redirectUri) {
+            addRedirectUri(parameters, request.redirectUri);
+        }
+        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
+        addClientInfo(parameters);
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
+            addServerTelemetry(parameters, this.serverTelemetryManager);
+        }
+        addRefreshToken(parameters, request.refreshToken);
+        if (this.config.clientCredentials.clientSecret) {
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
+        }
+        if (this.config.clientCredentials.clientAssertion) {
+            const clientAssertion = this.config.clientCredentials.clientAssertion;
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
+        }
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+            addPopToken(parameters, reqCnfData);
+        }
+        else if (request.authenticationScheme === AuthenticationScheme.SSH) {
+            if (request.sshJwk) {
+                addSshJwk(parameters, request.sshJwk);
+            }
+            else {
+                throw createClientConfigurationError(missingSshJwk);
+            }
+        }
+        if (this.config.systemOptions.preventCorsPreflight &&
+            request.ccsCredential) {
+            switch (request.ccsCredential.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        this.logger.verbose(`Could not parse home account ID for CCS Header: '${e}'`, request.correlationId);
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    addCcsUpn(parameters, request.ccsCredential.credential);
+                    break;
+            }
+        }
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
+        }
+        if (request.extraParameters) {
+            addExtraParameters(parameters, {
+                ...request.extraParameters,
+            });
+        }
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+        return mapToQueryString(parameters);
+    }
+}
+
+export { RefreshTokenClient };
+//# sourceMappingURL=RefreshTokenClient.mjs.map

backend/node_modules/@azure/msal-common/dist/client/SilentFlowClient.mjs

@@ -0,0 +1,132 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { buildClientConfiguration } from '../config/ClientConfiguration.mjs';
+import { wasClockTurnedBack, isTokenExpired } from '../utils/TimeUtils.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { ResponseHandler } from '../response/ResponseHandler.mjs';
+import { CacheOutcome } from '../utils/Constants.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { extractTokenClaims, checkMaxAge } from '../account/AuthToken.mjs';
+import { SilentFlowClientGenerateResultFromCacheRecord } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { getTenantFromAuthorityString } from '../authority/Authority.mjs';
+import { Logger } from '../logger/Logger.mjs';
+import { name, version } from '../packageMetadata.mjs';
+import { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class SilentFlowClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(request) {
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
+        if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
+            // Must refresh due to present force_refresh flag.
+            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        const requestTenantId = request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
+        if (!cachedAccessToken) {
+            // must refresh due to non-existent access_token
+            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
+            isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+            // must refresh due to the expires_in value
+            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
+        else if (cachedAccessToken.refreshOn &&
+            isTokenExpired(cachedAccessToken.refreshOn, 0)) {
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
+        }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = {
+            account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId),
+            refreshToken: null,
+            appMetadata: this.cacheManager.readAppMetadataFromCache(environment, request.correlationId),
+        };
+        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+        return [
+            await invokeAsync(this.generateResultFromCacheRecord.bind(this), SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
+            lastCacheOutcome,
+        ];
+    }
+    setCacheOutcome(cacheOutcome, correlationId) {
+        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
+        this.performanceClient?.addFields({
+            cacheOutcome: cacheOutcome,
+        }, correlationId);
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(`Token refresh is required due to cache outcome: '${cacheOutcome}'`, correlationId);
+        }
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
+    }
+}
+
+export { SilentFlowClient };
+//# sourceMappingURL=SilentFlowClient.mjs.map

backend/node_modules/@azure/msal-common/dist/client/SilentFlowClient.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.tokenRefreshRequired","ClientAuthErrorCodes.noAccountInSilentRequest","TimeUtils.wasClockTurnedBack","TimeUtils.isTokenExpired","PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord","ClientAuthErrorCodes.authTimeNotFound"],"mappings":";;;;;;;;;;;;;;;;AAAA;;;AAGG;AAkCH;MACa,gBAAgB,CAAA;IAyBzB,WACI,CAAA,aAAkC,EAClC,iBAAqC,EAAA;;AAGrC,QAAA,IAAI,CAAC,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;;AAGtD,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;;QAGnE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;;QAG/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGjD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGlD,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;;QAGjE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;;AAGnD,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;AAGG;IACH,MAAM,kBAAkB,CACpB,OAAgC,EAAA;AAEhC,QAAA,IAAI,gBAAgB,GAAiB,YAAY,CAAC,cAAc,CAAC;AAEjE,QAAA,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;;YAEjE,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,uBAAuB,EACpC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBA,oBAAyC,CAC5C,CAAC;AACL,SAAA;;AAGD,QAAA,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;AAClB,YAAA,MAAM,qBAAqB,CACvBC,wBAA6C,CAChD,CAAC;AACL,SAAA;AAED,QAAA,MAAM,eAAe,GACjB,OAAO,CAAC,OAAO,CAAC,QAAQ;AACxB,YAAA,4BAA4B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;AACnD,QAAA,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CACtD,OAAO,CAAC,OAAO,EACf,OAAO,EACP,SAAS,EACT,eAAe,CAClB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE;;YAEpB,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,sBAAsB,EACnC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBD,oBAAyC,CAC5C,CAAC;AACL,SAAA;AAAM,aAAA,IACHE,kBAA4B,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AACxD,YAAAC,cAAwB,CACpB,iBAAiB,CAAC,SAAS,EAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CACtD,EACH;;YAEE,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,2BAA2B,EACxC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBH,oBAAyC,CAC5C,CAAC;AACL,SAAA;aAAM,IAAI,OAAO,CAAC,QAAQ,EAAE;;AAEzB,YAAA,IAAI,iBAAiB,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE;gBACjD,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,sBAAsB,EACnC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,gBAAA,MAAM,qBAAqB,CACvBA,oBAAyC,CAC5C,CAAC;AACL,aAAA;AACJ,SAAA;aAAM,IACH,iBAAiB,CAAC,SAAS;YAC3BG,cAAwB,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAC1D;;AAEE,YAAA,gBAAgB,GAAG,YAAY,CAAC,qBAAqB,CAAC;;AAGzD,SAAA;AAED,QAAA,MAAM,WAAW,GACb,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;AAC5D,QAAA,MAAM,WAAW,GAAgB;YAC7B,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EACrD,OAAO,CAAC,aAAa,CACxB;AACD,YAAA,WAAW,EAAE,iBAAiB;AAC9B,YAAA,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,SAAS,EACT,eAAe,CAClB;AACD,YAAA,YAAY,EAAE,IAAI;AAClB,YAAA,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,wBAAwB,CACnD,WAAW,EACX,OAAO,CAAC,aAAa,CACxB;SACJ,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;AAE9D,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;AACpC,YAAA,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,CAAC;AAC3D,SAAA;QAED,OAAO;AACH,YAAA,MAAM,WAAW,CACb,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7CC,6CAA+D,EAC/D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,WAAW,EAAE,OAAO,CAAC;YACvB,gBAAgB;SACnB,CAAC;KACL;IAEO,eAAe,CACnB,YAA0B,EAC1B,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,sBAAsB,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;AAC3D,QAAA,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAC7B;AACI,YAAA,YAAY,EAAE,YAAY;SAC7B,EACD,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,YAAY,KAAK,YAAY,CAAC,cAAc,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,CAAoD,iDAAA,EAAA,YAAY,CAAG,CAAA,CAAA,EACnE,aAAa,CAChB,CAAC;AACL,SAAA;KACJ;AAED;;;AAGG;AACK,IAAA,MAAM,6BAA6B,CACvC,WAAwB,EACxB,OAAgC,EAAA;AAEhC,QAAA,IAAI,aAAsC,CAAC;QAC3C,IAAI,WAAW,CAAC,OAAO,EAAE;AACrB,YAAA,aAAa,GAAG,kBAAkB,CAC9B,WAAW,CAAC,OAAO,CAAC,MAAM,EAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,CAC3C,CAAC;AACL,SAAA;;QAGD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AACxC,YAAA,MAAM,QAAQ,GAAG,aAAa,EAAE,SAAS,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE;AACX,gBAAA,MAAM,qBAAqB,CACvBC,gBAAqC,CACxC,CAAC;AACL,aAAA;AAED,YAAA,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACzC,SAAA;QAED,OAAO,eAAe,CAAC,4BAA4B,CAC/C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,WAAW,EACX,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,iBAAiB,EACtB,aAAa,CAChB,CAAC;KACL;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/config/ClientConfiguration.mjs

@@ -0,0 +1,108 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.mjs';
+import { LogLevel, Logger } from '../logger/Logger.mjs';
+import { DEFAULT_TOKEN_RENEWAL_OFFSET_SEC, SKU, DEFAULT_COMMON_TENANT } from '../utils/Constants.mjs';
+import { version } from '../packageMetadata.mjs';
+import { AzureCloudInstance } from '../authority/AuthorityOptions.mjs';
+import { DefaultStorageClass } from '../cache/CacheManager.mjs';
+import { ProtocolMode } from '../authority/ProtocolMode.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { StubPerformanceClient } from '../telemetry/performance/StubPerformanceClient.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_SYSTEM_OPTIONS = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+const DEFAULT_LOGGER_IMPLEMENTATION = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: LogLevel.Info,
+    correlationId: "",
+};
+const DEFAULT_NETWORK_IMPLEMENTATION = {
+    async sendGetRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async sendPostRequestAsync() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+const DEFAULT_LIBRARY_INFO = {
+    sku: SKU,
+    version: version,
+    cpu: "",
+    os: "",
+};
+const DEFAULT_CLIENT_CREDENTIALS = {
+    clientSecret: "",
+    clientAssertion: undefined,
+};
+const DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${DEFAULT_COMMON_TENANT}`,
+};
+const DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        storageInterface: storageImplementation ||
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions) {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        instanceAware: false,
+        isMcp: false,
+        ...authOptions,
+    };
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
+}
+
+export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration, isOidcProtocolMode };
+//# sourceMappingURL=ClientConfiguration.mjs.map

backend/node_modules/@azure/msal-common/dist/config/ClientConfiguration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientConfiguration.mjs","sources":["../../src/config/ClientConfiguration.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;;;;;;;;;AAAA;;;AAGG;AA0JU,MAAA,sBAAsB,GAA4B;AAC3D,IAAA,yBAAyB,EAAE,gCAAgC;AAC3D,IAAA,oBAAoB,EAAE,KAAK;EAC7B;AAEF,MAAM,6BAA6B,GAA4B;IAC3D,cAAc,EAAE,MAAK;;KAEpB;AACD,IAAA,iBAAiB,EAAE,KAAK;IACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;AACvB,IAAA,aAAa,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,8BAA8B,GAAmB;AACnD,IAAA,MAAM,mBAAmB,GAAA;AACrB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,oBAAoB,GAAA;AACtB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAgB;AACtC,IAAA,GAAG,EAAE,GAAG;AACR,IAAA,OAAO,EAAE,OAAO;AAChB,IAAA,GAAG,EAAE,EAAE;AACP,IAAA,EAAE,EAAE,EAAE;CACT,CAAC;AAEF,MAAM,0BAA0B,GAAsB;AAClD,IAAA,YAAY,EAAE,EAAE;AAChB,IAAA,eAAe,EAAE,SAAS;CAC7B,CAAC;AAEF,MAAM,2BAA2B,GAAsB;IACnD,kBAAkB,EAAE,kBAAkB,CAAC,IAAI;IAC3C,MAAM,EAAE,CAAG,EAAA,qBAAqB,CAAE,CAAA;CACrC,CAAC;AAEF,MAAM,yBAAyB,GAA+B;AAC1D,IAAA,WAAW,EAAE;AACT,QAAA,OAAO,EAAE,EAAE;AACX,QAAA,UAAU,EAAE,EAAE;AACjB,KAAA;CACJ,CAAC;AAEF;;;;;;AAMG;AACG,SAAU,wBAAwB,CAAC,EACrC,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,iBAAiB,EAChC,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,qBAAqB,EACvC,gBAAgB,EAAE,qBAAqB,EACvC,eAAe,EAAE,oBAAoB,EACrC,iBAAiB,EAAE,iBAAiB,EACpC,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,iBAAiB,EAAE,iBAAiB,EACpC,iBAAiB,EAAE,iBAAiB,GAClB,EAAA;AAClB,IAAA,MAAM,aAAa,GAAG;AAClB,QAAA,GAAG,6BAA6B;AAChC,QAAA,GAAG,gBAAgB;KACtB,CAAC;IAEF,OAAO;AACH,QAAA,WAAW,EAAE,gBAAgB,CAAC,eAAe,CAAC;AAC9C,QAAA,aAAa,EAAE,EAAE,GAAG,sBAAsB,EAAE,GAAG,iBAAiB,EAAE;AAClE,QAAA,aAAa,EAAE,aAAa;AAC5B,QAAA,gBAAgB,EACZ,qBAAqB;AACrB,YAAA,IAAI,mBAAmB,CACnB,eAAe,CAAC,QAAQ,EACxB,6BAA6B,EAC7B,IAAI,MAAM,CAAC,aAAa,CAAC,EACzB,IAAI,qBAAqB,EAAE,CAC9B;QACL,gBAAgB,EACZ,qBAAqB,IAAI,8BAA8B;QAC3D,eAAe,EAAE,oBAAoB,IAAI,6BAA6B;QACtE,iBAAiB,EAAE,iBAAiB,IAAI,0BAA0B;AAClE,QAAA,WAAW,EAAE,EAAE,GAAG,oBAAoB,EAAE,GAAG,WAAW,EAAE;AACxD,QAAA,SAAS,EAAE,EAAE,GAAG,yBAAyB,EAAE,GAAG,SAAS,EAAE;QACzD,sBAAsB,EAAE,sBAAsB,IAAI,IAAI;QACtD,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;QAC5C,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;KAC/C,CAAC;AACN,CAAC;AAED;;;AAGG;AACH,SAAS,gBAAgB,CAAC,WAAwB,EAAA;IAC9C,OAAO;AACH,QAAA,kBAAkB,EAAE,EAAE;AACtB,QAAA,iBAAiB,EAAE,2BAA2B;AAC9C,QAAA,aAAa,EAAE,KAAK;AACpB,QAAA,KAAK,EAAE,KAAK;AACZ,QAAA,GAAG,WAAW;KACjB,CAAC;AACN,CAAC;AAED;;;AAGG;AACG,SAAU,kBAAkB,CAAC,MAA2B,EAAA;AAC1D,IAAA,QACI,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,CAAC,IAAI,EACzE;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/constants/AADServerParamKeys.mjs

@@ -0,0 +1,69 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CLIENT_ID = "client_id";
+const REDIRECT_URI = "redirect_uri";
+const RESPONSE_TYPE = "response_type";
+const RESPONSE_MODE = "response_mode";
+const GRANT_TYPE = "grant_type";
+const CLAIMS = "claims";
+const SCOPE = "scope";
+const ERROR = "error";
+const ERROR_DESCRIPTION = "error_description";
+const ACCESS_TOKEN = "access_token";
+const ID_TOKEN = "id_token";
+const REFRESH_TOKEN = "refresh_token";
+const EXPIRES_IN = "expires_in";
+const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
+const STATE = "state";
+const NONCE = "nonce";
+const PROMPT = "prompt";
+const SESSION_STATE = "session_state";
+const CLIENT_INFO = "client_info";
+const CODE = "code";
+const CODE_CHALLENGE = "code_challenge";
+const CODE_CHALLENGE_METHOD = "code_challenge_method";
+const CODE_VERIFIER = "code_verifier";
+const CLIENT_REQUEST_ID = "client-request-id";
+const X_CLIENT_SKU = "x-client-SKU";
+const X_CLIENT_VER = "x-client-VER";
+const X_CLIENT_OS = "x-client-OS";
+const X_CLIENT_CPU = "x-client-CPU";
+const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+const X_APP_NAME = "x-app-name";
+const X_APP_VER = "x-app-ver";
+const POST_LOGOUT_URI = "post_logout_redirect_uri";
+const ID_TOKEN_HINT = "id_token_hint";
+const DEVICE_CODE = "device_code";
+const CLIENT_SECRET = "client_secret";
+const CLIENT_ASSERTION = "client_assertion";
+const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+const TOKEN_TYPE = "token_type";
+const REQ_CNF = "req_cnf";
+const OBO_ASSERTION = "assertion";
+const REQUESTED_TOKEN_USE = "requested_token_use";
+const ON_BEHALF_OF = "on_behalf_of";
+const FOCI = "foci";
+const CCS_HEADER = "X-AnchorMailbox";
+const RETURN_SPA_CODE = "return_spa_code";
+const NATIVE_BROKER = "nativebroker";
+const LOGOUT_HINT = "logout_hint";
+const SID = "sid";
+const LOGIN_HINT = "login_hint";
+const DOMAIN_HINT = "domain_hint";
+const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+const BROKER_CLIENT_ID = "brk_client_id";
+const BROKER_REDIRECT_URI = "brk_redirect_uri";
+const INSTANCE_AWARE = "instance_aware";
+const EAR_JWK = "ear_jwk";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
+const CLI_DATA = "clidata";
+
+export { ACCESS_TOKEN, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CCS_HEADER, CLAIMS, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_INFO, CLIENT_REQUEST_ID, CLIENT_SECRET, CLI_DATA, CODE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, DEVICE_CODE, DOMAIN_HINT, EAR_JWE_CRYPTO, EAR_JWK, ERROR, ERROR_DESCRIPTION, EXPIRES_IN, FOCI, GRANT_TYPE, ID_TOKEN, ID_TOKEN_HINT, INSTANCE_AWARE, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, ON_BEHALF_OF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REFRESH_TOKEN_EXPIRES_IN, REQUESTED_TOKEN_USE, REQ_CNF, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, RETURN_SPA_CODE, SCOPE, SESSION_STATE, SID, STATE, TOKEN_TYPE, X_APP_NAME, X_APP_VER, X_CLIENT_CPU, X_CLIENT_CURR_TELEM, X_CLIENT_EXTRA_SKU, X_CLIENT_LAST_TELEM, X_CLIENT_OS, X_CLIENT_SKU, X_CLIENT_VER, X_MS_LIB_CAPABILITY };
+//# sourceMappingURL=AADServerParamKeys.mjs.map

backend/node_modules/@azure/msal-common/dist/constants/AADServerParamKeys.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AADServerParamKeys.mjs","sources":["../../src/constants/AADServerParamKeys.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,wBAAwB,GAAG,2BAA2B;AAC5D,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,KAAK,GAAG,QAAQ;AACtB,MAAM,MAAM,GAAG,SAAS;AACxB,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,iBAAiB,GAAG,oBAAoB;AAC9C,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,mBAAmB,GAAG,6BAA6B;AACzD,MAAM,mBAAmB,GAAG,0BAA0B;AACtD,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,SAAS,GAAG,YAAY;AAC9B,MAAM,eAAe,GAAG,2BAA2B;AACnD,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,aAAa,GAAG,gBAAgB;AACtC,MAAM,gBAAgB,GAAG,mBAAmB;AAC5C,MAAM,qBAAqB,GAAG,wBAAwB;AACtD,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,aAAa,GAAG,YAAY;AAClC,MAAM,mBAAmB,GAAG,sBAAsB;AAClD,MAAM,YAAY,GAAG,eAAe;AACpC,MAAM,IAAI,GAAG,OAAO;AACpB,MAAM,UAAU,GAAG,kBAAkB;AACrC,MAAM,eAAe,GAAG,kBAAkB;AAC1C,MAAM,aAAa,GAAG,eAAe;AACrC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,GAAG,GAAG,MAAM;AAClB,MAAM,UAAU,GAAG,aAAa;AAChC,MAAM,WAAW,GAAG,cAAc;AAClC,MAAM,kBAAkB,GAAG,oBAAoB;AAC/C,MAAM,gBAAgB,GAAG,gBAAgB;AACzC,MAAM,mBAAmB,GAAG,mBAAmB;AAC/C,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,OAAO,GAAG,UAAU;AAC1B,MAAM,cAAc,GAAG,iBAAiB;AACxC,MAAM,QAAQ,GAAG,WAAW;AAC5B,MAAM,QAAQ,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/crypto/ICrypto.mjs

@@ -0,0 +1,44 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_CRYPTO_IMPLEMENTATION = {
+    createNewGuid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64Decode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64Encode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async getPublicKeyThumbprint() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async removeTokenBindingKey() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async clearKeystore() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async signJwt() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    async hashString() {
+        throw createClientAuthError(methodNotImplemented);
+    },
+};
+
+export { DEFAULT_CRYPTO_IMPLEMENTATION };
+//# sourceMappingURL=ICrypto.mjs.map

backend/node_modules/@azure/msal-common/dist/crypto/ICrypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ICrypto.mjs","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AA6FU,MAAA,6BAA6B,GAAY;IAClD,aAAa,EAAE,MAAa;AACxB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,YAAY,EAAE,MAAa;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,YAAY,EAAE,MAAa;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,eAAe,EAAE,MAAa;AAC1B,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;IACD,SAAS,EAAE,MAAa;AACpB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,sBAAsB,GAAA;AACxB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,qBAAqB,GAAA;AACvB,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,aAAa,GAAA;AACf,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,OAAO,GAAA;AACT,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;AACD,IAAA,MAAM,UAAU,GAAA;AACZ,QAAA,MAAM,qBAAqB,CAACA,oBAAyC,CAAC,CAAC;KAC1E;;;;;"}

backend/node_modules/@azure/msal-common/dist/crypto/JoseHeader.mjs

@@ -0,0 +1,46 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createJoseHeaderError } from '../error/JoseHeaderError.mjs';
+import { JsonWebTokenTypes } from '../utils/Constants.mjs';
+import { missingKidError, missingAlgError } from '../error/JoseHeaderErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class JoseHeader {
+    constructor(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw createJoseHeaderError(missingKidError);
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw createJoseHeaderError(missingAlgError);
+        }
+        const shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        });
+        return JSON.stringify(shrHeader);
+    }
+}
+
+export { JoseHeader };
+//# sourceMappingURL=JoseHeader.mjs.map

backend/node_modules/@azure/msal-common/dist/crypto/JoseHeader.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseHeader.mjs","sources":["../../src/crypto/JoseHeader.ts"],"sourcesContent":[null],"names":["JoseHeaderErrorCodes.missingKidError","JoseHeaderErrorCodes.missingAlgError"],"mappings":";;;;;;AAAA;;;AAGG;AAcH;MACa,UAAU,CAAA;AAKnB,IAAA,WAAA,CAAY,OAA0B,EAAA;AAClC,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;AACvB,QAAA,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;KAC1B;AAED;;;;;;;AAOG;IACH,OAAO,kBAAkB,CAAC,gBAAmC,EAAA;;AAEzD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;AACvB,YAAA,MAAM,qBAAqB,CAACA,eAAoC,CAAC,CAAC;AACrE,SAAA;;AAGD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;AACvB,YAAA,MAAM,qBAAqB,CAACC,eAAoC,CAAC,CAAC;AACrE,SAAA;AAED,QAAA,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC;;AAE7B,YAAA,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG;YAClD,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC5B,SAAA,CAAC,CAAC;AAEH,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;KACpC;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/crypto/PopTokenGenerator.mjs

@@ -0,0 +1,87 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { nowSeconds } from '../utils/TimeUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const KeyLocation = {
+    SW: "sw"};
+/** @internal */
+class PopTokenGenerator {
+    constructor(cryptoUtils, performanceClient) {
+        this.cryptoUtils = cryptoUtils;
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
+    async generateCnf(request, logger) {
+        const reqCnf = await invokeAsync(this.generateKid.bind(this), PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
+        return {
+            kid: reqCnf.kid,
+            reqCnfString,
+        };
+    }
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
+    async generateKid(request) {
+        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);
+        return {
+            kid: kidThumbprint,
+            xms_ksl: KeyLocation.SW,
+        };
+    }
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    async signPopToken(accessToken, keyId, request) {
+        return this.signPayload(accessToken, keyId, request);
+    }
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    async signPayload(payload, keyId, request, claims) {
+        // Deconstruct request to extract SHR parameters
+        const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
+        const resourceUrlString = resourceRequestUri
+            ? new UrlString(resourceRequestUri)
+            : undefined;
+        const resourceUrlComponents = resourceUrlString?.getUrlComponents();
+        return this.cryptoUtils.signJwt({
+            at: payload,
+            ts: nowSeconds(),
+            m: resourceRequestMethod?.toUpperCase(),
+            u: resourceUrlComponents?.HostNameAndPort,
+            nonce: shrNonce || this.cryptoUtils.createNewGuid(),
+            p: resourceUrlComponents?.AbsolutePath,
+            q: resourceUrlComponents?.QueryString
+                ? [[], resourceUrlComponents.QueryString]
+                : undefined,
+            client_claims: shrClaims || undefined,
+            ...claims,
+        }, keyId, shrOptions, request.correlationId);
+    }
+}
+
+export { PopTokenGenerator };
+//# sourceMappingURL=PopTokenGenerator.mjs.map

backend/node_modules/@azure/msal-common/dist/crypto/PopTokenGenerator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["PerformanceEvents.PopTokenGenerateCnf","TimeUtils.nowSeconds"],"mappings":";;;;;;;AAAA;;;AAGG;AA2BH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,KAEE,CAAC;AAGX;MACa,iBAAiB,CAAA;IAI1B,WAAY,CAAA,WAAoB,EAAE,iBAAqC,EAAA;AACnE,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3BA,mBAAqC,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,eAAe,CACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;SACf,CAAC;KACL;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;QAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC/D,OAAO,CACV,CAAC;QAEF,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;KACL;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;KACxD;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;AACxC,cAAE,IAAI,SAAS,CAAC,kBAAkB,CAAC;cACjC,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3B;AACI,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEC,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;SACZ,EACD,KAAK,EACL,UAAU,EACV,OAAO,CAAC,aAAa,CACxB,CAAC;KACL;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/error/AuthError.mjs

@@ -0,0 +1,34 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getDefaultErrorMessage(code) {
+    return `See https://aka.ms/msal.js.errors#${code} for details`;
+}
+/**
+ * General error class thrown by the MSAL.js library.
+ */
+class AuthError extends Error {
+    constructor(errorCode, errorMessage, suberror) {
+        const message = errorMessage ||
+            (errorCode ? getDefaultErrorMessage(errorCode) : "");
+        const errorString = message ? `${errorCode}: ${message}` : errorCode;
+        super(errorString);
+        Object.setPrototypeOf(this, AuthError.prototype);
+        this.errorCode = errorCode || "";
+        this.errorMessage = message || "";
+        this.subError = suberror || "";
+        this.name = "AuthError";
+    }
+    setCorrelationId(correlationId) {
+        this.correlationId = correlationId;
+    }
+}
+function createAuthError(code, additionalMessage) {
+    return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
+}
+
+export { AuthError, createAuthError, getDefaultErrorMessage };
+//# sourceMappingURL=AuthError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/AuthError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthError.mjs","sources":["../../src/error/AuthError.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAMG,SAAU,sBAAsB,CAAC,IAAY,EAAA;IAC/C,OAAO,CAAA,kCAAA,EAAqC,IAAI,CAAA,YAAA,CAAc,CAAC;AACnE,CAAC;AAED;;AAEG;AACG,MAAO,SAAU,SAAQ,KAAK,CAAA;AA0BhC,IAAA,WAAA,CAAY,SAAkB,EAAE,YAAqB,EAAE,QAAiB,EAAA;QACpE,MAAM,OAAO,GACT,YAAY;AACZ,aAAC,SAAS,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;AACzD,QAAA,MAAM,WAAW,GAAG,OAAO,GAAG,CAAA,EAAG,SAAS,CAAA,EAAA,EAAK,OAAO,CAAE,CAAA,GAAG,SAAS,CAAC;QACrE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;AAEjD,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;AACjC,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,IAAI,EAAE,CAAC;AAClC,QAAA,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;AAC/B,QAAA,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;KAC3B;AAED,IAAA,gBAAgB,CAAC,aAAqB,EAAA;AAClC,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;KACtC;AACJ,CAAA;AAEe,SAAA,eAAe,CAC3B,IAAY,EACZ,iBAA0B,EAAA;AAE1B,IAAA,OAAO,IAAI,SAAS,CAChB,IAAI,EACJ,iBAAiB,IAAI,sBAAsB,CAAC,IAAI,CAAC,CACpD,CAAC;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/error/AuthErrorCodes.mjs

@@ -0,0 +1,14 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * AuthErrorMessage class containing string constants used by error codes and messages.
+ */
+const unexpectedError = "unexpected_error";
+const postRequestFailed = "post_request_failed";
+
+export { postRequestFailed, unexpectedError };
+//# sourceMappingURL=AuthErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/AuthErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthErrorCodes.mjs","sources":["../../src/error/AuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEH;;AAEG;AACI,MAAM,eAAe,GAAG,mBAAmB;AAC3C,MAAM,iBAAiB,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/CacheError.mjs

@@ -0,0 +1,45 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { cacheErrorUnknown, cacheQuotaExceeded } from './CacheErrorCodes.mjs';
+import * as CacheErrorCodes from './CacheErrorCodes.mjs';
+export { CacheErrorCodes };
+import { getDefaultErrorMessage } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error with the cache
+ */
+class CacheError extends Error {
+    constructor(errorCode, errorMessage) {
+        const message = errorMessage || getDefaultErrorMessage(errorCode);
+        super(message);
+        Object.setPrototypeOf(this, CacheError.prototype);
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
+}
+
+export { CacheError, createCacheError };
+//# sourceMappingURL=CacheError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/CacheError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheError.mjs","sources":["../../src/error/CacheError.ts"],"sourcesContent":[null],"names":["CacheErrorCodes.cacheErrorUnknown","CacheErrorCodes.cacheQuotaExceeded"],"mappings":";;;;;;;AAAA;;;AAGG;AAMH;;AAEG;AACG,MAAO,UAAW,SAAQ,KAAK,CAAA;IAWjC,WAAY,CAAA,SAAiB,EAAE,YAAqB,EAAA;QAChD,MAAM,OAAO,GAAG,YAAY,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;AAElD,QAAA,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;AACzB,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;AAC3B,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;KAC/B;AACJ,CAAA;AAED;;;;AAIG;AACG,SAAU,gBAAgB,CAAC,CAAU,EAAA;AACvC,IAAA,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,EAAE;AACvB,QAAA,OAAO,IAAI,UAAU,CAACA,iBAAiC,CAAC,CAAC;AAC5D,KAAA;AAED,IAAA,IACI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAC/B,CAAC,CAAC,IAAI,KAAK,4BAA4B;AACvC,QAAA,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAC1C;AACE,QAAA,OAAO,IAAI,UAAU,CAACC,kBAAkC,CAAC,CAAC;AAC7D,KAAA;AAAM,SAAA;QACH,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5C,KAAA;AACL;;;;"}

backend/node_modules/@azure/msal-common/dist/error/CacheErrorCodes.mjs

@@ -0,0 +1,11 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
+
+export { cacheErrorUnknown, cacheQuotaExceeded };
+//# sourceMappingURL=CacheErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/CacheErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheErrorCodes.mjs","sources":["../../src/error/CacheErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,iBAAiB,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/ClientAuthError.mjs

@@ -0,0 +1,27 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+class ClientAuthError extends AuthError {
+    constructor(errorCode, additionalMessage) {
+        super(errorCode, additionalMessage);
+        this.name = "ClientAuthError";
+        Object.setPrototypeOf(this, ClientAuthError.prototype);
+    }
+}
+function createClientAuthError(errorCode, additionalMessage) {
+    return new ClientAuthError(errorCode, additionalMessage);
+}
+
+export { ClientAuthError, createClientAuthError };
+//# sourceMappingURL=ClientAuthError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/ClientAuthError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAuthError.mjs","sources":["../../src/error/ClientAuthError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAMH;;AAEG;AAEH;;AAEG;AACG,MAAO,eAAgB,SAAQ,SAAS,CAAA;IAC1C,WAAY,CAAA,SAAiB,EAAE,iBAA0B,EAAA;AACrD,QAAA,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AACpC,QAAA,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAE9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;KAC1D;AACJ,CAAA;AAEe,SAAA,qBAAqB,CACjC,SAAiB,EACjB,iBAA0B,EAAA;AAE1B,IAAA,OAAO,IAAI,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC7D;;;;"}

backend/node_modules/@azure/msal-common/dist/error/ClientAuthErrorCodes.mjs

@@ -0,0 +1,48 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const clientInfoDecodingError = "client_info_decoding_error";
+const clientInfoEmptyError = "client_info_empty_error";
+const tokenParsingError = "token_parsing_error";
+const nullOrEmptyToken = "null_or_empty_token";
+const endpointResolutionError = "endpoints_resolution_error";
+const networkError = "network_error";
+const openIdConfigError = "openid_config_error";
+const hashNotDeserialized = "hash_not_deserialized";
+const invalidState = "invalid_state";
+const stateMismatch = "state_mismatch";
+const stateNotFound = "state_not_found";
+const nonceMismatch = "nonce_mismatch";
+const authTimeNotFound = "auth_time_not_found";
+const maxAgeTranspired = "max_age_transpired";
+const multipleMatchingTokens = "multiple_matching_tokens";
+const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
+const requestCannotBeMade = "request_cannot_be_made";
+const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
+const cannotAppendScopeSet = "cannot_append_scopeset";
+const emptyInputScopeSet = "empty_input_scopeset";
+const noAccountInSilentRequest = "no_account_in_silent_request";
+const invalidCacheRecord = "invalid_cache_record";
+const invalidCacheEnvironment = "invalid_cache_environment";
+const noAccountFound = "no_account_found";
+const noCryptoObject = "no_crypto_object";
+const unexpectedCredentialType = "unexpected_credential_type";
+const tokenRefreshRequired = "token_refresh_required";
+const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
+const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
+const bindingKeyNotRemoved = "binding_key_not_removed";
+const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
+const keyIdMissing = "key_id_missing";
+const noNetworkConnectivity = "no_network_connectivity";
+const userCanceled = "user_canceled";
+const methodNotImplemented = "method_not_implemented";
+const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+const platformBrokerError = "platform_broker_error";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
+
+export { authTimeNotFound, authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, cannotAppendScopeSet, cannotRemoveEmptyScope, clientInfoDecodingError, clientInfoEmptyError, emptyInputScopeSet, endSessionEndpointNotSupported, endpointResolutionError, hashNotDeserialized, invalidCacheEnvironment, invalidCacheRecord, invalidState, keyIdMissing, maxAgeTranspired, methodNotImplemented, misplacedResourceParam, multipleMatchingAppMetadata, multipleMatchingTokens, nestedAppAuthBridgeDisabled, networkError, noAccountFound, noAccountInSilentRequest, noCryptoObject, noNetworkConnectivity, nonceMismatch, nullOrEmptyToken, openIdConfigError, platformBrokerError, requestCannotBeMade, resourceParameterRequired, stateMismatch, stateNotFound, tokenClaimsCnfRequiredForSignedJwt, tokenParsingError, tokenRefreshRequired, unexpectedCredentialType, userCanceled };
+//# sourceMappingURL=ClientAuthErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/ClientAuthErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAuthErrorCodes.mjs","sources":["../../src/error/ClientAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,uBAAuB,GAAG,6BAA6B;AAC7D,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,gBAAgB,GAAG,sBAAsB;AAC/C,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,sBAAsB,GAAG,2BAA2B;AAC1D,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,mBAAmB,GAAG,yBAAyB;AACrD,MAAM,sBAAsB,GAAG,4BAA4B;AAC3D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,wBAAwB,GAAG,+BAA+B;AAChE,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,uBAAuB,GAAG,4BAA4B;AAC5D,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,cAAc,GAAG,mBAAmB;AAC1C,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,kCAAkC,GAC3C,0CAA0C;AACvC,MAAM,0CAA0C,GACnD,kDAAkD;AAC/C,MAAM,oBAAoB,GAAG,0BAA0B;AACvD,MAAM,8BAA8B,GACvC,qCAAqC;AAClC,MAAM,YAAY,GAAG,iBAAiB;AACtC,MAAM,qBAAqB,GAAG,0BAA0B;AACxD,MAAM,YAAY,GAAG,gBAAgB;AACrC,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,2BAA2B,GAAG,kCAAkC;AACtE,MAAM,mBAAmB,GAAG,wBAAwB;AACpD,MAAM,yBAAyB,GAAG,8BAA8B;AAChE,MAAM,sBAAsB,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/ClientConfigurationError.mjs

@@ -0,0 +1,24 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error in configuration of the MSAL.js library.
+ */
+class ClientConfigurationError extends AuthError {
+    constructor(errorCode) {
+        super(errorCode);
+        this.name = "ClientConfigurationError";
+        Object.setPrototypeOf(this, ClientConfigurationError.prototype);
+    }
+}
+function createClientConfigurationError(errorCode) {
+    return new ClientConfigurationError(errorCode);
+}
+
+export { ClientConfigurationError, createClientConfigurationError };
+//# sourceMappingURL=ClientConfigurationError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/ClientConfigurationError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientConfigurationError.mjs","sources":["../../src/error/ClientConfigurationError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAMH;;AAEG;AACG,MAAO,wBAAyB,SAAQ,SAAS,CAAA;AACnD,IAAA,WAAA,CAAY,SAAiB,EAAA;QACzB,KAAK,CAAC,SAAS,CAAC,CAAC;AACjB,QAAA,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;KACnE;AACJ,CAAA;AAEK,SAAU,8BAA8B,CAC1C,SAAiB,EAAA;AAEjB,IAAA,OAAO,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;AACnD;;;;"}

backend/node_modules/@azure/msal-common/dist/error/ClientConfigurationErrorCodes.mjs

@@ -0,0 +1,33 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const redirectUriEmpty = "redirect_uri_empty";
+const claimsRequestParsingError = "claims_request_parsing_error";
+const authorityUriInsecure = "authority_uri_insecure";
+const urlParseError = "url_parse_error";
+const urlEmptyError = "empty_url_error";
+const emptyInputScopesError = "empty_input_scopes_error";
+const invalidClaims = "invalid_claims";
+const tokenRequestEmpty = "token_request_empty";
+const logoutRequestEmpty = "logout_request_empty";
+const invalidCodeChallengeMethod = "invalid_code_challenge_method";
+const pkceParamsMissing = "pkce_params_missing";
+const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
+const invalidAuthorityMetadata = "invalid_authority_metadata";
+const untrustedAuthority = "untrusted_authority";
+const missingSshJwk = "missing_ssh_jwk";
+const missingSshKid = "missing_ssh_kid";
+const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
+const invalidAuthenticationHeader = "invalid_authentication_header";
+const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
+const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
+const authorityMismatch = "authority_mismatch";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
+const issuerValidationFailed = "issuer_validation_failed";
+
+export { authorityMismatch, authorityUriInsecure, cannotAllowPlatformBroker, cannotSetOIDCOptions, claimsRequestParsingError, emptyInputScopesError, invalidAuthenticationHeader, invalidAuthorityMetadata, invalidClaims, invalidCloudDiscoveryMetadata, invalidCodeChallengeMethod, invalidPlatformBrokerConfiguration, invalidRequestMethodForEAR, issuerValidationFailed, logoutRequestEmpty, missingNonceAuthenticationHeader, missingSshJwk, missingSshKid, pkceParamsMissing, redirectUriEmpty, tokenRequestEmpty, untrustedAuthority, urlEmptyError, urlParseError };
+//# sourceMappingURL=ClientConfigurationErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/ClientConfigurationErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientConfigurationErrorCodes.mjs","sources":["../../src/error/ClientConfigurationErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,gBAAgB,GAAG,qBAAqB;AAC9C,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,qBAAqB,GAAG,2BAA2B;AACzD,MAAM,aAAa,GAAG,iBAAiB;AACvC,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,kBAAkB,GAAG,uBAAuB;AAClD,MAAM,0BAA0B,GAAG,gCAAgC;AACnE,MAAM,iBAAiB,GAAG,sBAAsB;AAChD,MAAM,6BAA6B,GAAG,mCAAmC;AACzE,MAAM,wBAAwB,GAAG,6BAA6B;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB;AACjD,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,aAAa,GAAG,kBAAkB;AACxC,MAAM,gCAAgC,GACzC,sCAAsC;AACnC,MAAM,2BAA2B,GAAG,gCAAgC;AACpE,MAAM,oBAAoB,GAAG,yBAAyB;AACtD,MAAM,yBAAyB,GAAG,+BAA+B;AACjE,MAAM,iBAAiB,GAAG,qBAAqB;AAC/C,MAAM,0BAA0B,GAAG,iCAAiC;AACpE,MAAM,kCAAkC,GAC3C,wCAAwC;AACrC,MAAM,sBAAsB,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/InteractionRequiredAuthError.mjs

@@ -0,0 +1,75 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+import { interactionRequired, consentRequired, loginRequired, badToken, uxNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';
+import * as InteractionRequiredAuthErrorCodes from './InteractionRequiredAuthErrorCodes.mjs';
+export { InteractionRequiredAuthErrorCodes };
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+ */
+const InteractionRequiredServerErrorMessage = [
+    interactionRequired,
+    consentRequired,
+    loginRequired,
+    badToken,
+    uxNotAllowed,
+    interruptedUser,
+];
+const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+    "bad_token",
+    "ux_not_allowed",
+    "interrupted_user",
+];
+/**
+ * Error thrown when user interaction is required.
+ */
+class InteractionRequiredAuthError extends AuthError {
+    constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+        this.timestamp = timestamp || "";
+        this.traceId = traceId || "";
+        this.correlationId = correlationId || "";
+        this.claims = claims || "";
+        this.name = "InteractionRequiredAuthError";
+        this.errorNo = errorNo;
+    }
+}
+/**
+ * Helper function used to determine if an error thrown by the server requires interaction to resolve
+ * @param errorCode
+ * @param errorString
+ * @param subError
+ */
+function isInteractionRequiredError(errorCode, errorString, subError) {
+    const isInteractionRequiredErrorCode = !!errorCode &&
+        InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+    const isInteractionRequiredSubError = !!subError &&
+        InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+    const isInteractionRequiredErrorDesc = !!errorString &&
+        InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+            return errorString.indexOf(irErrorCode) > -1;
+        });
+    return (isInteractionRequiredErrorCode ||
+        isInteractionRequiredErrorDesc ||
+        isInteractionRequiredSubError);
+}
+/**
+ * Creates an InteractionRequiredAuthError
+ */
+function createInteractionRequiredAuthError(errorCode, errorMessage) {
+    return new InteractionRequiredAuthError(errorCode, errorMessage);
+}
+
+export { InteractionRequiredAuthError, InteractionRequiredAuthSubErrorMessage, InteractionRequiredServerErrorMessage, createInteractionRequiredAuthError, isInteractionRequiredError };
+//# sourceMappingURL=InteractionRequiredAuthError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/InteractionRequiredAuthError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InteractionRequiredAuthError.mjs","sources":["../../src/error/InteractionRequiredAuthError.ts"],"sourcesContent":[null],"names":["InteractionRequiredAuthErrorCodes.interactionRequired","InteractionRequiredAuthErrorCodes.consentRequired","InteractionRequiredAuthErrorCodes.loginRequired","InteractionRequiredAuthErrorCodes.badToken","InteractionRequiredAuthErrorCodes.uxNotAllowed","InteractionRequiredAuthErrorCodes.interruptedUser"],"mappings":";;;;;;;AAAA;;;AAGG;AAMH;;AAEG;AACU,MAAA,qCAAqC,GAAG;AACjD,IAAAA,mBAAqD;AACrD,IAAAC,eAAiD;AACjD,IAAAC,aAA+C;AAC/C,IAAAC,QAA0C;AAC1C,IAAAC,YAA8C;AAC9C,IAAAC,eAAiD;EACnD;AAEW,MAAA,sCAAsC,GAAG;IAClD,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,WAAW;IACX,gBAAgB;IAChB,kBAAkB;EACpB;AAEF;;AAEG;AACG,MAAO,4BAA6B,SAAQ,SAAS,CAAA;AA2BvD,IAAA,WAAA,CACI,SAAkB,EAClB,YAAqB,EACrB,QAAiB,EACjB,SAAkB,EAClB,OAAgB,EAChB,aAAsB,EACtB,MAAe,EACf,OAAgB,EAAA;AAEhB,QAAA,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC;AAEpE,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;AACjC,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;AAC7B,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,EAAE,CAAC;AACzC,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;AAC3B,QAAA,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;AAC3C,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;KAC1B;AACJ,CAAA;AAED;;;;;AAKG;SACa,0BAA0B,CACtC,SAAkB,EAClB,WAAoB,EACpB,QAAiB,EAAA;AAEjB,IAAA,MAAM,8BAA8B,GAChC,CAAC,CAAC,SAAS;QACX,qCAAqC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;AAClE,IAAA,MAAM,6BAA6B,GAC/B,CAAC,CAAC,QAAQ;QACV,sCAAsC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;AAClE,IAAA,MAAM,8BAA8B,GAChC,CAAC,CAAC,WAAW;AACb,QAAA,qCAAqC,CAAC,IAAI,CAAC,CAAC,WAAW,KAAI;YACvD,OAAO,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;AACjD,SAAC,CAAC,CAAC;AAEP,IAAA,QACI,8BAA8B;QAC9B,8BAA8B;AAC9B,QAAA,6BAA6B,EAC/B;AACN,CAAC;AAED;;AAEG;AACa,SAAA,kCAAkC,CAC9C,SAAiB,EACjB,YAAqB,EAAA;AAErB,IAAA,OAAO,IAAI,4BAA4B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACrE;;;;"}

backend/node_modules/@azure/msal-common/dist/error/InteractionRequiredAuthErrorCodes.mjs

@@ -0,0 +1,54 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * MSAL-defined interaction required error code indicating no tokens are found in cache.
+ * @public
+ */
+const noTokensFound = "no_tokens_found";
+/**
+ * MSAL-defined error code indicating a native account is unavailable on the platform.
+ * @public
+ */
+const nativeAccountUnavailable = "native_account_unavailable";
+/**
+ * MSAL-defined error code indicating the refresh token has expired and user interaction is needed.
+ * @public
+ */
+const refreshTokenExpired = "refresh_token_expired";
+/**
+ * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
+ * @public
+ */
+const uxNotAllowed = "ux_not_allowed";
+/**
+ * Server-originated error code indicating interaction is required to complete the request.
+ * @public
+ */
+const interactionRequired = "interaction_required";
+/**
+ * Server-originated error code indicating user consent is required.
+ * @public
+ */
+const consentRequired = "consent_required";
+/**
+ * Server-originated error code indicating user login is required.
+ * @public
+ */
+const loginRequired = "login_required";
+/**
+ * Server-originated error code indicating the token is invalid or corrupted.
+ * @public
+ */
+const badToken = "bad_token";
+/**
+ * Server-originated error code indicating the user is in an interrupted state and interaction is required.
+ * @public
+ */
+const interruptedUser = "interrupted_user";
+
+export { badToken, consentRequired, interactionRequired, interruptedUser, loginRequired, nativeAccountUnavailable, noTokensFound, refreshTokenExpired, uxNotAllowed };
+//# sourceMappingURL=InteractionRequiredAuthErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/InteractionRequiredAuthErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InteractionRequiredAuthErrorCodes.mjs","sources":["../../src/error/InteractionRequiredAuthErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEH;;;AAGG;AACI,MAAM,aAAa,GAAG,kBAAkB;AAC/C;;;AAGG;AACI,MAAM,wBAAwB,GAAG,6BAA6B;AACrE;;;AAGG;AACI,MAAM,mBAAmB,GAAG,wBAAwB;AAC3D;;;AAGG;AACI,MAAM,YAAY,GAAG,iBAAiB;AAE7C;;;AAGG;AACI,MAAM,mBAAmB,GAAG,uBAAuB;AAC1D;;;AAGG;AACI,MAAM,eAAe,GAAG,mBAAmB;AAClD;;;AAGG;AACI,MAAM,aAAa,GAAG,iBAAiB;AAC9C;;;AAGG;AACI,MAAM,QAAQ,GAAG,YAAY;AACpC;;;AAGG;AACI,MAAM,eAAe,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/JoseHeaderError.mjs

@@ -0,0 +1,25 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+class JoseHeaderError extends AuthError {
+    constructor(errorCode, errorMessage) {
+        super(errorCode, errorMessage);
+        this.name = "JoseHeaderError";
+        Object.setPrototypeOf(this, JoseHeaderError.prototype);
+    }
+}
+/** Returns JoseHeaderError object */
+function createJoseHeaderError(code) {
+    return new JoseHeaderError(code);
+}
+
+export { JoseHeaderError, createJoseHeaderError };
+//# sourceMappingURL=JoseHeaderError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/JoseHeaderError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseHeaderError.mjs","sources":["../../src/error/JoseHeaderError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAMH;;AAEG;AACG,MAAO,eAAgB,SAAQ,SAAS,CAAA;IAC1C,WAAY,CAAA,SAAiB,EAAE,YAAqB,EAAA;AAChD,QAAA,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC/B,QAAA,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAE9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;KAC1D;AACJ,CAAA;AAED;AACM,SAAU,qBAAqB,CAAC,IAAY,EAAA;AAC9C,IAAA,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACrC;;;;"}

backend/node_modules/@azure/msal-common/dist/error/JoseHeaderErrorCodes.mjs

@@ -0,0 +1,11 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const missingKidError = "missing_kid_error";
+const missingAlgError = "missing_alg_error";
+
+export { missingAlgError, missingKidError };
+//# sourceMappingURL=JoseHeaderErrorCodes.mjs.map

backend/node_modules/@azure/msal-common/dist/error/JoseHeaderErrorCodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseHeaderErrorCodes.mjs","sources":["../../src/error/JoseHeaderErrorCodes.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAEI,MAAM,eAAe,GAAG,oBAAoB;AAC5C,MAAM,eAAe,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/error/NetworkError.mjs

@@ -0,0 +1,35 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Represents network related errors
+ */
+class NetworkError extends AuthError {
+    constructor(error, httpStatus, responseHeaders) {
+        super(error.errorCode, error.errorMessage, error.subError);
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+function createNetworkError(error, httpStatus, responseHeaders, additionalError) {
+    error.errorMessage = `${error.errorMessage}, additionalErrorInfo: error.name:${additionalError?.name}, error.message:${additionalError?.message}`;
+    return new NetworkError(error, httpStatus, responseHeaders);
+}
+
+export { NetworkError, createNetworkError };
+//# sourceMappingURL=NetworkError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/NetworkError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetworkError.mjs","sources":["../../src/error/NetworkError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAIH;;AAEG;AACG,MAAO,YAAa,SAAQ,SAAS,CAAA;AAKvC,IAAA,WAAA,CACI,KAAgB,EAChB,UAAmB,EACnB,eAAwC,EAAA;AAExC,QAAA,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE3D,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;AACpD,QAAA,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;AAC3B,QAAA,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;AACnB,QAAA,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;AAC7B,QAAA,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;KAC1C;AACJ,CAAA;AAED;;;;;;AAMG;AACG,SAAU,kBAAkB,CAC9B,KAAgB,EAChB,UAAmB,EACnB,eAAwC,EACxC,eAAuB,EAAA;AAEvB,IAAA,KAAK,CAAC,YAAY,GAAG,CAAG,EAAA,KAAK,CAAC,YAAY,CAAA,kCAAA,EAAqC,eAAe,EAAE,IAAI,CAAmB,gBAAA,EAAA,eAAe,EAAE,OAAO,EAAE,CAAC;IAClJ,OAAO,IAAI,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAChE;;;;"}

backend/node_modules/@azure/msal-common/dist/error/PlatformBrokerError.mjs

@@ -0,0 +1,49 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Converts a numeric tag from MSAL Runtime to a 5-character string representation.
+ * Tags are encoded as 30-bit values (6 bits per character) using a custom symbol space.
+ * @param tag - The numeric tag to convert
+ * @returns The string representation of the tag
+ */
+function tagToString(tag) {
+    if (tag === 0) {
+        return "UNTAG";
+    }
+    const tagSymbolSpace = "abcdefghijklmnopqrstuvwxyz0123456789****************************";
+    let tagBuffer = "*****";
+    const chars = [
+        tagSymbolSpace[(tag >> 24) & 0x3f],
+        tagSymbolSpace[(tag >> 18) & 0x3f],
+        tagSymbolSpace[(tag >> 12) & 0x3f],
+        tagSymbolSpace[(tag >> 6) & 0x3f],
+        tagSymbolSpace[(tag >> 0) & 0x3f],
+    ];
+    tagBuffer = chars.join("");
+    return tagBuffer;
+}
+/**
+ * Error class for MSAL Runtime errors that preserves detailed broker information
+ */
+class PlatformBrokerError extends AuthError {
+    constructor(errorStatus, errorContext, errorCode, errorTag) {
+        const tagString = tagToString(errorTag);
+        const enhancedErrorContext = errorContext
+            ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
+            : `(Error Code: ${errorCode}, Tag: ${tagString})`;
+        super(errorStatus, enhancedErrorContext);
+        this.name = "PlatformBrokerError";
+        this.statusCode = errorCode;
+        this.tag = tagString;
+        Object.setPrototypeOf(this, PlatformBrokerError.prototype);
+    }
+}
+
+export { PlatformBrokerError };
+//# sourceMappingURL=PlatformBrokerError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/PlatformBrokerError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlatformBrokerError.mjs","sources":["../../src/error/PlatformBrokerError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAIH;;;;;AAKG;AACH,SAAS,WAAW,CAAC,GAAW,EAAA;IAC5B,IAAI,GAAG,KAAK,CAAC,EAAE;AACX,QAAA,OAAO,OAAO,CAAC;AAClB,KAAA;IAED,MAAM,cAAc,GAChB,kEAAkE,CAAC;IACvE,IAAI,SAAS,GAAG,OAAO,CAAC;AAExB,IAAA,MAAM,KAAK,GAAG;QACV,cAAc,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;QAClC,cAAc,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;QAClC,cAAc,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC;QAClC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC;KACpC,CAAC;AAEF,IAAA,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3B,IAAA,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;AAEG;AACG,MAAO,mBAAoB,SAAQ,SAAS,CAAA;AAW9C,IAAA,WAAA,CACI,WAAmB,EACnB,YAAoB,EACpB,SAAiB,EACjB,QAAgB,EAAA;AAEhB,QAAA,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,oBAAoB,GAAG,YAAY;AACrC,cAAE,CAAG,EAAA,YAAY,iBAAiB,SAAS,CAAA,OAAA,EAAU,SAAS,CAAG,CAAA,CAAA;AACjE,cAAE,CAAgB,aAAA,EAAA,SAAS,CAAU,OAAA,EAAA,SAAS,GAAG,CAAC;AAEtD,QAAA,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AACzC,QAAA,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;AAClC,QAAA,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;AAC5B,QAAA,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;QACrB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;KAC9D;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/error/ServerError.mjs

@@ -0,0 +1,23 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { AuthError } from './AuthError.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Error thrown when there is an error with the server code, for example, unavailability.
+ */
+class ServerError extends AuthError {
+    constructor(errorCode, errorMessage, subError, errorNo, status) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+        this.errorNo = errorNo;
+        this.status = status;
+        Object.setPrototypeOf(this, ServerError.prototype);
+    }
+}
+
+export { ServerError };
+//# sourceMappingURL=ServerError.mjs.map

backend/node_modules/@azure/msal-common/dist/error/ServerError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerError.mjs","sources":["../../src/error/ServerError.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAIH;;AAEG;AACG,MAAO,WAAY,SAAQ,SAAS,CAAA;IAWtC,WACI,CAAA,SAAkB,EAClB,YAAqB,EACrB,QAAiB,EACjB,OAAgB,EAChB,MAAe,EAAA;AAEf,QAAA,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACzC,QAAA,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;AAC1B,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;AACvB,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;KACtD;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/index-node.mjs

@@ -0,0 +1,77 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
+export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';
+export { SilentFlowClient } from './client/SilentFlowClient.mjs';
+export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration } from './config/ClientConfiguration.mjs';
+export { buildTenantProfile, tenantIdMatchesHomeTenant, updateAccountTenantProfileData } from './account/AccountInfo.mjs';
+export { getTenantIdFromIdTokenClaims } from './account/TokenClaims.mjs';
+export { CcsCredentialType } from './account/CcsCredential.mjs';
+export { buildClientInfo, buildClientInfoFromHomeAccountId } from './account/ClientInfo.mjs';
+export { Authority, buildStaticAuthorityOptions, formatAuthorityUri } from './authority/Authority.mjs';
+export { AzureCloudInstance } from './authority/AuthorityOptions.mjs';
+export { AuthorityType } from './authority/AuthorityType.mjs';
+export { ProtocolMode } from './authority/ProtocolMode.mjs';
+export { CacheManager, DefaultStorageClass } from './cache/CacheManager.mjs';
+export { StubbedNetworkModule } from './network/INetworkModule.mjs';
+export { ThrottlingUtils } from './network/ThrottlingUtils.mjs';
+export { getRequestThumbprint } from './network/RequestThumbprint.mjs';
+export { UrlString } from './url/UrlString.mjs';
+export { DEFAULT_CRYPTO_IMPLEMENTATION } from './crypto/ICrypto.mjs';
+import * as Authorize from './protocol/Authorize.mjs';
+export { Authorize as AuthorizeProtocol };
+import * as Token from './protocol/Token.mjs';
+export { Token as TokenProtocol };
+export { enforceResourceParameter } from './request/BaseAuthRequest.mjs';
+import * as RequestParameterBuilder from './request/RequestParameterBuilder.mjs';
+export { RequestParameterBuilder };
+export { ResponseHandler, buildAccountToCache } from './response/ResponseHandler.mjs';
+export { ScopeSet } from './request/ScopeSet.mjs';
+export { AuthenticationHeaderParser } from './request/AuthenticationHeaderParser.mjs';
+export { LogLevel, Logger } from './logger/Logger.mjs';
+export { InteractionRequiredAuthError, createInteractionRequiredAuthError } from './error/InteractionRequiredAuthError.mjs';
+import * as InteractionRequiredAuthErrorCodes from './error/InteractionRequiredAuthErrorCodes.mjs';
+export { InteractionRequiredAuthErrorCodes };
+export { AuthError, createAuthError } from './error/AuthError.mjs';
+import * as AuthErrorCodes from './error/AuthErrorCodes.mjs';
+export { AuthErrorCodes };
+export { PlatformBrokerError } from './error/PlatformBrokerError.mjs';
+export { ServerError } from './error/ServerError.mjs';
+export { NetworkError, createNetworkError } from './error/NetworkError.mjs';
+export { CacheError, createCacheError } from './error/CacheError.mjs';
+import * as CacheErrorCodes from './error/CacheErrorCodes.mjs';
+export { CacheErrorCodes };
+export { ClientAuthError, createClientAuthError } from './error/ClientAuthError.mjs';
+import * as ClientAuthErrorCodes from './error/ClientAuthErrorCodes.mjs';
+export { ClientAuthErrorCodes };
+export { ClientConfigurationError, createClientConfigurationError } from './error/ClientConfigurationError.mjs';
+import * as ClientConfigurationErrorCodes from './error/ClientConfigurationErrorCodes.mjs';
+export { ClientConfigurationErrorCodes };
+import * as Constants from './utils/Constants.mjs';
+export { Constants };
+export { StringUtils } from './utils/StringUtils.mjs';
+import * as ProtocolUtils from './utils/ProtocolUtils.mjs';
+export { ProtocolUtils };
+export { ServerTelemetryManager } from './telemetry/server/ServerTelemetryManager.mjs';
+export { version } from './packageMetadata.mjs';
+export { invoke, invokeAsync } from './utils/FunctionWrappers.mjs';
+import * as AuthToken from './account/AuthToken.mjs';
+export { AuthToken };
+import * as AuthorityFactory from './authority/AuthorityFactory.mjs';
+export { AuthorityFactory };
+import * as CacheHelpers from './cache/utils/CacheHelpers.mjs';
+export { CacheHelpers };
+import * as TimeUtils from './utils/TimeUtils.mjs';
+export { TimeUtils };
+import * as UrlUtils from './utils/UrlUtils.mjs';
+export { UrlUtils };
+import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
+export { AADServerParamKeys };
+import * as AccountEntityUtils from './cache/utils/AccountEntityUtils.mjs';
+export { AccountEntityUtils };
+export { TokenCacheContext } from './cache/persistence/TokenCacheContext.mjs';
+import * as ClientAssertionUtils from './utils/ClientAssertionUtils.mjs';
+export { ClientAssertionUtils };
+export { getClientAssertion } from './utils/ClientAssertionUtils.mjs';
+export { StubPerformanceClient } from './telemetry/performance/StubPerformanceClient.mjs';
+//# sourceMappingURL=index-node.mjs.map

backend/node_modules/@azure/msal-common/dist/index-node.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-node.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

backend/node_modules/@azure/msal-common/dist/index.mjs

@@ -0,0 +1,83 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+export { AuthorizationCodeClient } from './client/AuthorizationCodeClient.mjs';
+export { RefreshTokenClient } from './client/RefreshTokenClient.mjs';
+export { SilentFlowClient } from './client/SilentFlowClient.mjs';
+export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration } from './config/ClientConfiguration.mjs';
+export { buildTenantProfile, tenantIdMatchesHomeTenant, updateAccountTenantProfileData } from './account/AccountInfo.mjs';
+export { getTenantIdFromIdTokenClaims } from './account/TokenClaims.mjs';
+export { CcsCredentialType } from './account/CcsCredential.mjs';
+export { buildClientInfo, buildClientInfoFromHomeAccountId } from './account/ClientInfo.mjs';
+export { Authority, buildStaticAuthorityOptions, formatAuthorityUri } from './authority/Authority.mjs';
+export { AzureCloudInstance } from './authority/AuthorityOptions.mjs';
+export { AuthorityType } from './authority/AuthorityType.mjs';
+export { ProtocolMode } from './authority/ProtocolMode.mjs';
+export { CacheManager, DefaultStorageClass } from './cache/CacheManager.mjs';
+export { StubbedNetworkModule } from './network/INetworkModule.mjs';
+export { ThrottlingUtils } from './network/ThrottlingUtils.mjs';
+export { getRequestThumbprint } from './network/RequestThumbprint.mjs';
+export { UrlString } from './url/UrlString.mjs';
+export { DEFAULT_CRYPTO_IMPLEMENTATION } from './crypto/ICrypto.mjs';
+import * as Authorize from './protocol/Authorize.mjs';
+export { Authorize as AuthorizeProtocol };
+import * as Token from './protocol/Token.mjs';
+export { Token as TokenProtocol };
+export { enforceResourceParameter } from './request/BaseAuthRequest.mjs';
+import * as RequestParameterBuilder from './request/RequestParameterBuilder.mjs';
+export { RequestParameterBuilder };
+export { ResponseHandler, buildAccountToCache } from './response/ResponseHandler.mjs';
+export { ScopeSet } from './request/ScopeSet.mjs';
+export { AuthenticationHeaderParser } from './request/AuthenticationHeaderParser.mjs';
+export { LogLevel, Logger } from './logger/Logger.mjs';
+export { InteractionRequiredAuthError, createInteractionRequiredAuthError } from './error/InteractionRequiredAuthError.mjs';
+import * as InteractionRequiredAuthErrorCodes from './error/InteractionRequiredAuthErrorCodes.mjs';
+export { InteractionRequiredAuthErrorCodes };
+export { AuthError, createAuthError } from './error/AuthError.mjs';
+import * as AuthErrorCodes from './error/AuthErrorCodes.mjs';
+export { AuthErrorCodes };
+export { PlatformBrokerError } from './error/PlatformBrokerError.mjs';
+export { ServerError } from './error/ServerError.mjs';
+export { NetworkError, createNetworkError } from './error/NetworkError.mjs';
+export { CacheError, createCacheError } from './error/CacheError.mjs';
+import * as CacheErrorCodes from './error/CacheErrorCodes.mjs';
+export { CacheErrorCodes };
+export { ClientAuthError, createClientAuthError } from './error/ClientAuthError.mjs';
+import * as ClientAuthErrorCodes from './error/ClientAuthErrorCodes.mjs';
+export { ClientAuthErrorCodes };
+export { ClientConfigurationError, createClientConfigurationError } from './error/ClientConfigurationError.mjs';
+import * as ClientConfigurationErrorCodes from './error/ClientConfigurationErrorCodes.mjs';
+export { ClientConfigurationErrorCodes };
+import * as Constants from './utils/Constants.mjs';
+export { Constants };
+export { StringUtils } from './utils/StringUtils.mjs';
+import * as ProtocolUtils from './utils/ProtocolUtils.mjs';
+export { ProtocolUtils };
+export { ServerTelemetryManager } from './telemetry/server/ServerTelemetryManager.mjs';
+export { version } from './packageMetadata.mjs';
+export { invoke, invokeAsync } from './utils/FunctionWrappers.mjs';
+import * as AuthToken from './account/AuthToken.mjs';
+export { AuthToken };
+import * as AuthorityFactory from './authority/AuthorityFactory.mjs';
+export { AuthorityFactory };
+import * as CacheHelpers from './cache/utils/CacheHelpers.mjs';
+export { CacheHelpers };
+import * as TimeUtils from './utils/TimeUtils.mjs';
+export { TimeUtils };
+import * as UrlUtils from './utils/UrlUtils.mjs';
+export { UrlUtils };
+import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
+export { AADServerParamKeys };
+import * as AccountEntityUtils from './cache/utils/AccountEntityUtils.mjs';
+export { AccountEntityUtils };
+export { JoseHeader } from './crypto/JoseHeader.mjs';
+export { IntFields, PerformanceEventStatus } from './telemetry/performance/PerformanceEvent.mjs';
+import * as PerformanceEvents from './telemetry/performance/PerformanceEvents.mjs';
+export { PerformanceEvents };
+export { PerformanceClient } from './telemetry/performance/PerformanceClient.mjs';
+export { StubPerformanceClient } from './telemetry/performance/StubPerformanceClient.mjs';
+export { PopTokenGenerator } from './crypto/PopTokenGenerator.mjs';
+export { TokenCacheContext } from './cache/persistence/TokenCacheContext.mjs';
+import * as ClientAssertionUtils from './utils/ClientAssertionUtils.mjs';
+export { ClientAssertionUtils };
+export { getClientAssertion } from './utils/ClientAssertionUtils.mjs';
+//# sourceMappingURL=index.mjs.map

backend/node_modules/@azure/msal-common/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

backend/node_modules/@azure/msal-common/dist/logger/Logger.mjs

@@ -0,0 +1,278 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Log message level.
+ */
+var LogLevel;
+(function (LogLevel) {
+    LogLevel[LogLevel["Error"] = 0] = "Error";
+    LogLevel[LogLevel["Warning"] = 1] = "Warning";
+    LogLevel[LogLevel["Info"] = 2] = "Info";
+    LogLevel[LogLevel["Verbose"] = 3] = "Verbose";
+    LogLevel[LogLevel["Trace"] = 4] = "Trace";
+})(LogLevel || (LogLevel = {}));
+// Shared cache state for better minification - using Map's insertion order for LRU
+const CACHE_CAPACITY = 50;
+const MAX_LOGS_PER_CORRELATION = 500;
+const correlationCache = new Map();
+/**
+ * Mark correlation ID as recently used by moving it to end of Map
+ * @param correlationId
+ * @param {CorrelationLogData} data
+ */
+function markAsRecentlyUsed(correlationId, data) {
+    correlationCache.delete(correlationId);
+    correlationCache.set(correlationId, data);
+}
+/**
+ * Add log message to cache for specific correlation ID
+ * @param correlationId
+ * @param {LoggedMessage} loggedMessage
+ */
+function addLogToCache(correlationId, loggedMessage) {
+    const currentTime = Date.now();
+    let data = correlationCache.get(correlationId);
+    if (data) {
+        // Mark as recently used
+        markAsRecentlyUsed(correlationId, data);
+    }
+    else {
+        // Create new entry
+        data = { logs: [], firstEventTime: currentTime };
+        correlationCache.set(correlationId, data);
+        // Remove LRU (first entry) if capacity exceeded
+        if (correlationCache.size > CACHE_CAPACITY) {
+            const firstKey = correlationCache.keys().next().value;
+            if (firstKey) {
+                correlationCache.delete(firstKey);
+            }
+        }
+    }
+    // Add log to the data, maintaining max logs per correlation
+    data.logs.push({
+        ...loggedMessage,
+        milliseconds: currentTime - data.firstEventTime,
+    });
+    if (data.logs.length > MAX_LOGS_PER_CORRELATION) {
+        data.logs.shift(); // Remove oldest log
+    }
+}
+/**
+ * Get logs for correlation ID and flush them from cache
+ * Attaches logs with empty correlation id to the requested correlation logs
+ * @param correlationId
+ */
+function getAndFlushLogsFromCache(correlationId) {
+    const res = [];
+    for (const id of ["", correlationId]) {
+        const data = correlationCache.get(id);
+        res.push(...(data?.logs ?? []));
+        correlationCache.delete(id); // Remove the correlation ID completely from cache
+    }
+    return res;
+}
+/**
+ * Checks if a string is already a hashed logging string (6 alphanumeric characters)
+ */
+function isHashedString(str) {
+    if (str.length !== 6) {
+        return false;
+    }
+    for (let i = 0; i < str.length; i++) {
+        const char = str[i];
+        const isAlphaNumeric = (char >= "a" && char <= "z") ||
+            (char >= "A" && char <= "Z") ||
+            (char >= "0" && char <= "9");
+        if (!isAlphaNumeric) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Class which facilitates logging of messages to a specific place.
+ */
+class Logger {
+    constructor(loggerOptions, packageName, packageVersion) {
+        // Current log level, defaults to info.
+        this.level = LogLevel.Info;
+        const defaultLoggerCallback = () => {
+            return;
+        };
+        const setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
+        this.localCallback =
+            setLoggerOptions.loggerCallback || defaultLoggerCallback;
+        this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
+        this.level =
+            typeof setLoggerOptions.logLevel === "number"
+                ? setLoggerOptions.logLevel
+                : LogLevel.Info;
+        this.packageName = packageName || "";
+        this.packageVersion = packageVersion || "";
+    }
+    static createDefaultLoggerOptions() {
+        return {
+            loggerCallback: () => {
+                // allow users to not set loggerCallback
+            },
+            piiLoggingEnabled: false,
+            logLevel: LogLevel.Info,
+        };
+    }
+    /**
+     * Create new Logger with existing configurations.
+     */
+    clone(packageName, packageVersion) {
+        return new Logger({
+            loggerCallback: this.localCallback,
+            piiLoggingEnabled: this.piiLoggingEnabled,
+            logLevel: this.level,
+        }, packageName, packageVersion);
+    }
+    /**
+     * Log message with required options.
+     */
+    logMessage(logMessage, options) {
+        const correlationId = options.correlationId;
+        const isHashedInput = isHashedString(logMessage);
+        if (isHashedInput) {
+            const loggedMessage = {
+                hash: logMessage,
+                level: options.logLevel,
+                containsPii: options.containsPii || false,
+                milliseconds: 0, // Will be calculated in addLogToCache
+            };
+            addLogToCache(correlationId, loggedMessage);
+        }
+        if (options.logLevel > this.level ||
+            (!this.piiLoggingEnabled && options.containsPii)) {
+            return;
+        }
+        const timestamp = new Date().toUTCString();
+        // Add correlationId to logs if set, correlationId provided on log messages take precedence
+        const logHeader = `[${timestamp}] : [${correlationId}]`;
+        const log = `${logHeader} : ${this.packageName}@${this.packageVersion} : ${LogLevel[options.logLevel]} - ${logMessage}`;
+        this.executeCallback(options.logLevel, log, options.containsPii || false);
+    }
+    /**
+     * Execute callback with message.
+     */
+    executeCallback(level, message, containsPii) {
+        if (this.localCallback) {
+            this.localCallback(level, message, containsPii);
+        }
+    }
+    /**
+     * Logs error messages.
+     */
+    error(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Error,
+            containsPii: false,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs error messages with PII.
+     */
+    errorPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Error,
+            containsPii: true,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs warning messages.
+     */
+    warning(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Warning,
+            containsPii: false,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs warning messages with PII.
+     */
+    warningPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Warning,
+            containsPii: true,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs info messages.
+     */
+    info(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Info,
+            containsPii: false,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs info messages with PII.
+     */
+    infoPii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Info,
+            containsPii: true,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs verbose messages.
+     */
+    verbose(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Verbose,
+            containsPii: false,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs verbose messages with PII.
+     */
+    verbosePii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Verbose,
+            containsPii: true,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs trace messages.
+     */
+    trace(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Trace,
+            containsPii: false,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Logs trace messages with PII.
+     */
+    tracePii(message, correlationId) {
+        this.logMessage(message, {
+            logLevel: LogLevel.Trace,
+            containsPii: true,
+            correlationId: correlationId,
+        });
+    }
+    /**
+     * Returns whether PII Logging is enabled or not.
+     */
+    isPiiLoggingEnabled() {
+        return this.piiLoggingEnabled || false;
+    }
+}
+
+export { LogLevel, Logger, getAndFlushLogsFromCache };
+//# sourceMappingURL=Logger.mjs.map

backend/node_modules/@azure/msal-common/dist/network/INetworkModule.mjs

@@ -0,0 +1,20 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const StubbedNetworkModule = {
+    sendGetRequestAsync: () => {
+        return Promise.reject(createClientAuthError(methodNotImplemented));
+    },
+    sendPostRequestAsync: () => {
+        return Promise.reject(createClientAuthError(methodNotImplemented));
+    },
+};
+
+export { StubbedNetworkModule };
+//# sourceMappingURL=INetworkModule.mjs.map

backend/node_modules/@azure/msal-common/dist/network/INetworkModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"INetworkModule.mjs","sources":["../../src/network/INetworkModule.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.methodNotImplemented"],"mappings":";;;;;AAAA;;;AAGG;AA4CU,MAAA,oBAAoB,GAAmB;IAChD,mBAAmB,EAAE,MAAK;QACtB,OAAO,OAAO,CAAC,MAAM,CACjB,qBAAqB,CAACA,oBAAyC,CAAC,CACnE,CAAC;KACL;IACD,oBAAoB,EAAE,MAAK;QACvB,OAAO,OAAO,CAAC,MAAM,CACjB,qBAAqB,CAACA,oBAAyC,CAAC,CACnE,CAAC;KACL;;;;;"}

backend/node_modules/@azure/msal-common/dist/network/RequestThumbprint.mjs

@@ -0,0 +1,24 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getRequestThumbprint(clientId, request, homeAccountId) {
+    return {
+        clientId: clientId,
+        authority: request.authority,
+        scopes: request.scopes,
+        homeAccountIdentifier: homeAccountId,
+        claims: request.claims,
+        authenticationScheme: request.authenticationScheme,
+        resourceRequestMethod: request.resourceRequestMethod,
+        resourceRequestUri: request.resourceRequestUri,
+        shrClaims: request.shrClaims,
+        sshKid: request.sshKid,
+        embeddedClientId: request.embeddedClientId || request.extraParameters?.clientId,
+    };
+}
+
+export { getRequestThumbprint };
+//# sourceMappingURL=RequestThumbprint.mjs.map

backend/node_modules/@azure/msal-common/dist/network/RequestThumbprint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestThumbprint.mjs","sources":["../../src/network/RequestThumbprint.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;SAwBa,oBAAoB,CAChC,QAAgB,EAChB,OAAwB,EACxB,aAAsB,EAAA;IAEtB,OAAO;AACH,QAAA,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;AACtB,QAAA,qBAAqB,EAAE,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EACZ,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ;KACpE,CAAC;AACN;;;;"}

backend/node_modules/@azure/msal-common/dist/network/ThrottlingUtils.mjs

@@ -0,0 +1,92 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
+import { ServerError } from '../error/ServerError.mjs';
+import { getRequestThumbprint } from './RequestThumbprint.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class ThrottlingUtils {
+    /**
+     * Prepares a RequestThumbprint to be stored as a key.
+     * @param thumbprint
+     */
+    static generateThrottlingStorageKey(thumbprint) {
+        return `${THROTTLING_PREFIX}.${JSON.stringify(thumbprint)}`;
+    }
+    /**
+     * Performs necessary throttling checks before a network request.
+     * @param cacheManager
+     * @param thumbprint
+     */
+    static preProcess(cacheManager, thumbprint, correlationId) {
+        const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
+        const value = cacheManager.getThrottlingCache(key, correlationId);
+        if (value) {
+            if (value.throttleTime < Date.now()) {
+                cacheManager.removeItem(key, correlationId);
+                return;
+            }
+            throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
+        }
+    }
+    /**
+     * Performs necessary throttling checks after a network request.
+     * @param cacheManager
+     * @param thumbprint
+     * @param response
+     */
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
+        if (ThrottlingUtils.checkResponseStatus(response) ||
+            ThrottlingUtils.checkResponseForRetryAfter(response)) {
+            const thumbprintValue = {
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                error: response.body.error,
+                errorCodes: response.body.error_codes,
+                errorMessage: response.body.error_description,
+                subError: response.body.suberror,
+            };
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
+        }
+    }
+    /**
+     * Checks a NetworkResponse object's status codes against 429 or 5xx
+     * @param response
+     */
+    static checkResponseStatus(response) {
+        return (response.status === 429 ||
+            (response.status >= 500 && response.status < 600));
+    }
+    /**
+     * Checks a NetworkResponse object's RetryAfter header
+     * @param response
+     */
+    static checkResponseForRetryAfter(response) {
+        if (response.headers) {
+            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
+                (response.status < 200 || response.status >= 300));
+        }
+        return false;
+    }
+    /**
+     * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
+     * @param throttleTime
+     */
+    static calculateThrottleTime(throttleTime) {
+        const time = throttleTime <= 0 ? 0 : throttleTime;
+        const currentSeconds = Date.now() / 1000;
+        return Math.floor(Math.min(currentSeconds +
+            (time || DEFAULT_THROTTLE_TIME_SECONDS), currentSeconds + DEFAULT_MAX_THROTTLE_TIME_SECONDS) * 1000);
+    }
+    static removeThrottle(cacheManager, clientId, request, homeAccountIdentifier) {
+        const thumbprint = getRequestThumbprint(clientId, request, homeAccountIdentifier);
+        const key = this.generateThrottlingStorageKey(thumbprint);
+        cacheManager.removeItem(key, request.correlationId);
+    }
+}
+
+export { ThrottlingUtils };
+//# sourceMappingURL=ThrottlingUtils.mjs.map

backend/node_modules/@azure/msal-common/dist/network/ThrottlingUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThrottlingUtils.mjs","sources":["../../src/network/ThrottlingUtils.ts"],"sourcesContent":[null],"names":["Constants.THROTTLING_PREFIX","Constants.HeaderNames","Constants.DEFAULT_THROTTLE_TIME_SECONDS","Constants.DEFAULT_MAX_THROTTLE_TIME_SECONDS"],"mappings":";;;;;;AAAA;;;AAGG;AAcH;MACa,eAAe,CAAA;AACxB;;;AAGG;IACH,OAAO,4BAA4B,CAAC,UAA6B,EAAA;AAC7D,QAAA,OAAO,CAAG,EAAAA,iBAA2B,CAAI,CAAA,EAAA,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA,CAAE,CAAC;KACzE;AAED;;;;AAIG;AACH,IAAA,OAAO,UAAU,CACb,YAA0B,EAC1B,UAA6B,EAC7B,aAAqB,EAAA;QAErB,MAAM,GAAG,GAAG,eAAe,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAElE,QAAA,IAAI,KAAK,EAAE;YACP,IAAI,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE;AACjC,gBAAA,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBAC5C,OAAO;AACV,aAAA;YACD,MAAM,IAAI,WAAW,CACjB,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EACjC,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,QAAQ,CACjB,CAAC;AACL,SAAA;KACJ;AAED;;;;;AAKG;IACH,OAAO,WAAW,CACd,YAA0B,EAC1B,UAA6B,EAC7B,QAA2D,EAC3D,aAAqB,EAAA;AAErB,QAAA,IACI,eAAe,CAAC,mBAAmB,CAAC,QAAQ,CAAC;AAC7C,YAAA,eAAe,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EACtD;AACE,YAAA,MAAM,eAAe,GAAqB;AACtC,gBAAA,YAAY,EAAE,eAAe,CAAC,qBAAqB,CAC/C,QAAQ,CACJ,QAAQ,CAAC,OAAO,CAACC,WAAqB,CAAC,WAAW,CAAC,CACtD,CACJ;AACD,gBAAA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;AAC1B,gBAAA,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW;AACrC,gBAAA,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB;AAC7C,gBAAA,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;aACnC,CAAC;AACF,YAAA,YAAY,CAAC,kBAAkB,CAC3B,eAAe,CAAC,4BAA4B,CAAC,UAAU,CAAC,EACxD,eAAe,EACf,aAAa,CAChB,CAAC;AACL,SAAA;KACJ;AAED;;;AAGG;IACH,OAAO,mBAAmB,CACtB,QAA2D,EAAA;AAE3D,QAAA,QACI,QAAQ,CAAC,MAAM,KAAK,GAAG;AACvB,aAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACnD;KACL;AAED;;;AAGG;IACH,OAAO,0BAA0B,CAC7B,QAA2D,EAAA;QAE3D,IAAI,QAAQ,CAAC,OAAO,EAAE;AAClB,YAAA,QACI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAC3BA,WAAqB,CAAC,WAAW,CACpC;AACD,iBAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,EACnD;AACL,SAAA;AACD,QAAA,OAAO,KAAK,CAAC;KAChB;AAED;;;AAGG;IACH,OAAO,qBAAqB,CAAC,YAAoB,EAAA;AAC7C,QAAA,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAElD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CACb,IAAI,CAAC,GAAG,CACJ,cAAc;AACV,aAAC,IAAI,IAAIC,6BAAuC,CAAC,EACrD,cAAc,GAAGC,iCAA2C,CAC/D,GAAG,IAAI,CACX,CAAC;KACL;IAED,OAAO,cAAc,CACjB,YAA0B,EAC1B,QAAgB,EAChB,OAAwB,EACxB,qBAA8B,EAAA;QAE9B,MAAM,UAAU,GAAG,oBAAoB,CACnC,QAAQ,EACR,OAAO,EACP,qBAAqB,CACxB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC1D,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;KACvD;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/packageMetadata.mjs

@@ -0,0 +1,8 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+/* eslint-disable header/header */
+const name = "@azure/msal-common";
+const version = "16.6.2";
+
+export { name, version };
+//# sourceMappingURL=packageMetadata.mjs.map

backend/node_modules/@azure/msal-common/dist/packageMetadata.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageMetadata.mjs","sources":["../src/packageMetadata.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;AACO,MAAM,IAAI,GAAG,qBAAqB;AAClC,MAAM,OAAO,GAAG;;;;"}

backend/node_modules/@azure/msal-common/dist/protocol/Authorize.mjs

@@ -0,0 +1,236 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
+import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
+import { PromptValue } from '../utils/Constants.mjs';
+import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { isInteractionRequiredError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';
+import { ServerError } from '../error/ServerError.mjs';
+import { authorizationCodeMissingFromServerResponse, stateNotFound, invalidState, stateMismatch } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
+    // generate the correlationId if not set by the user and add
+    const correlationId = request.correlationId;
+    const parameters = new Map();
+    addClientId(parameters, request.embeddedClientId ||
+        request.extraQueryParameters?.[CLIENT_ID] ||
+        authOptions.clientId);
+    const requestScopes = [
+        ...(request.scopes || []),
+        ...(request.extraScopesToConsent || []),
+    ];
+    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
+    addRedirectUri(parameters, request.redirectUri);
+    addCorrelationId(parameters, correlationId);
+    // add response_mode. If not passed in it defaults to query.
+    addResponseMode(parameters, request.responseMode);
+    // add client_info=1
+    addClientInfo(parameters);
+    // add clidata=1
+    addCliData(parameters);
+    if (request.prompt) {
+        addPrompt(parameters, request.prompt);
+        performanceClient?.addFields({ prompt: request.prompt }, correlationId);
+    }
+    if (request.domainHint) {
+        addDomainHint(parameters, request.domainHint);
+        performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
+    }
+    // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
+    if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+        // AAD will throw if prompt=select_account is passed with an account hint
+        if (request.sid && request.prompt === PromptValue.NONE) {
+            // SessionID is only used in silent calls
+            logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request", request.correlationId);
+            addSid(parameters, request.sid);
+            performanceClient?.addFields({ sidFromRequest: true }, correlationId);
+        }
+        else if (request.account) {
+            const accountSid = extractAccountSid(request.account);
+            let accountLoginHintClaim = extractLoginHint(request.account);
+            if (accountLoginHintClaim && request.domainHint) {
+                logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`, request.correlationId);
+                accountLoginHintClaim = null;
+            }
+            // If login_hint claim is present, use it over sid/username
+            if (accountLoginHintClaim) {
+                logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account", request.correlationId);
+                addLoginHint(parameters, accountLoginHintClaim);
+                performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
+                }
+            }
+            else if (accountSid && request.prompt === PromptValue.NONE) {
+                /*
+                 * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                 * SessionId is only used in silent calls
+                 */
+                logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account", request.correlationId);
+                addSid(parameters, accountSid);
+                performanceClient?.addFields({ sidFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
+                }
+            }
+            else if (request.loginHint) {
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request", request.correlationId);
+                addLoginHint(parameters, request.loginHint);
+                addCcsUpn(parameters, request.loginHint);
+                performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+            }
+            else if (request.account.username) {
+                // Fallback to account username if provided
+                logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account", request.correlationId);
+                addLoginHint(parameters, request.account.username);
+                performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header", request.correlationId);
+                }
+            }
+        }
+        else if (request.loginHint) {
+            logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request", request.correlationId);
+            addLoginHint(parameters, request.loginHint);
+            addCcsUpn(parameters, request.loginHint);
+            performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+        }
+    }
+    else {
+        logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints", request.correlationId);
+    }
+    if (request.nonce) {
+        addNonce(parameters, request.nonce);
+    }
+    if (request.state) {
+        addState(parameters, request.state);
+    }
+    if (request.embeddedClientId) {
+        addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
+    }
+    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
+    // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
+    if (authOptions.instanceAware &&
+        (!request.extraQueryParameters ||
+            !Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
+        addInstanceAware(parameters);
+    }
+    return parameters;
+}
+/**
+ * Returns authorize endpoint with given request parameters in the query string
+ * @param authority
+ * @param requestParameters
+ * @returns
+ */
+function getAuthorizeUrl(authority, requestParameters) {
+    const queryString = mapToQueryString(requestParameters);
+    return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
+}
+/**
+ * Handles the hash fragment response from public client code request. Returns a code response used by
+ * the client to exchange for a token in acquireToken.
+ * @param serverParams
+ * @param cachedState
+ */
+function getAuthorizationCodePayload(serverParams, cachedState) {
+    // Get code response
+    validateAuthorizationResponse(serverParams, cachedState);
+    // throw when there is no auth code in the response
+    if (!serverParams.code) {
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+    }
+    return serverParams;
+}
+/**
+ * Function which validates server authorization code response.
+ * @param serverResponseHash
+ * @param requestState
+ */
+function validateAuthorizationResponse(serverResponse, requestState) {
+    if (!serverResponse.state || !requestState) {
+        throw serverResponse.state
+            ? createClientAuthError(stateNotFound, "Cached State")
+            : createClientAuthError(stateNotFound, "Server State");
+    }
+    let decodedServerResponseState;
+    let decodedRequestState;
+    try {
+        decodedServerResponseState = decodeURIComponent(serverResponse.state);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    try {
+        decodedRequestState = decodeURIComponent(requestState);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    if (decodedServerResponseState !== decodedRequestState) {
+        throw createClientAuthError(stateMismatch);
+    }
+    // Check for error
+    if (serverResponse.error ||
+        serverResponse.error_description ||
+        serverResponse.suberror) {
+        const serverErrorNo = parseServerErrorNo(serverResponse);
+        if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+        }
+        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+    }
+}
+/**
+ * Get server error No from the error_uri
+ * @param serverResponse
+ * @returns
+ */
+function parseServerErrorNo(serverResponse) {
+    const errorCodePrefix = "code=";
+    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
+        : undefined;
+}
+/**
+ * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
+ * @param account
+ */
+function extractAccountSid(account) {
+    return account.idTokenClaims?.sid || null;
+}
+function extractLoginHint(account) {
+    return account.loginHint || account.idTokenClaims?.login_hint || null;
+}
+
+export { getAuthorizationCodePayload, getAuthorizeUrl, getStandardAuthorizeRequestParameters, validateAuthorizationResponse };
+//# sourceMappingURL=Authorize.mjs.map