@azure/msal-browser 5.16.0 → 5.17.0

package/lib/popup-relay/msal-popup-relay.cjs

@@ -0,0 +1,278 @@
+/*! @azure/msal-browser v5.17.0 2026-07-07 */
+'use strict';
+'use strict';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * postMessage envelope type used to relay an auth response from a popup-relay
+ * page (see `runPopupRelay`) back to the embedded frame that opened it. See
+ * {@link BrowserAuthOptions.popupRelayUri}.
+ *
+ * Kept dependency-free so both the relay-page entry (`./index.js`) and the
+ * client-side helpers (`./relayClient.js`) can import it without either bundle
+ * pulling in the other's dependencies.
+ *
+ * @internal
+ */
+const POPUP_RELAY_RESPONSE_TYPE = "msal:popup-relay-response:v1";
+
+/*! @azure/msal-common v16.11.1 2026-07-07 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getDefaultErrorMessage$1(code) {
+    return `See https://aka.ms/msal.js.errors#${code} for details`;
+}
+/**
+ * General error class thrown by the MSAL.js library.
+ */
+class AuthError extends Error {
+    constructor(errorCode, correlationId, errorMessage, suberror) {
+        const message = errorMessage ||
+            (errorCode ? getDefaultErrorMessage$1(errorCode) : "");
+        const errorString = message ? `${errorCode}: ${message}` : errorCode;
+        super(errorString);
+        Object.setPrototypeOf(this, AuthError.prototype);
+        this.errorCode = errorCode || "";
+        this.errorMessage = message || "";
+        this.subError = suberror || "";
+        this.correlationId = correlationId;
+        this.name = "AuthError";
+    }
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const popupWindowError = "popup_window_error";
+const userCancelled = "user_cancelled";
+const popupRelayUnsupportedFlow = "popup_relay_unsupported_flow";
+const timedOut = "timed_out";
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function getDefaultErrorMessage(code) {
+    return `See https://aka.ms/msal.js.errors#${code} for details`;
+}
+/**
+ * Browser library error class thrown by the MSAL.js library for SPAs
+ */
+class BrowserAuthError extends AuthError {
+    constructor(errorCode, correlationId, subError) {
+        super(errorCode, correlationId, getDefaultErrorMessage(errorCode), subError);
+        Object.setPrototypeOf(this, BrowserAuthError.prototype);
+        this.name = "BrowserAuthError";
+    }
+}
+function createBrowserAuthError(errorCode, correlationId, subError) {
+    return new BrowserAuthError(errorCode, correlationId, subError);
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/*
+ * Interaction type of the API - used for state and telemetry
+ */
+var InteractionType;
+(function (InteractionType) {
+    InteractionType["Redirect"] = "redirect";
+    InteractionType["Popup"] = "popup";
+    InteractionType["Silent"] = "silent";
+    InteractionType["None"] = "none";
+})(InteractionType || (InteractionType = {}));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Creates a POST `<form>` in the provided document with the given auth
+ * parameters as hidden inputs, targeting `action`. Shared by the popup auth
+ * flows (`getEARForm` / `getCodeForm`) and the popup-relay page
+ * (`runPopupRelay`) so the form is built one way only.
+ *
+ * @param frame - document to create the form in
+ * @param action - form action (the /authorize URL)
+ * @param fields - POST-body fields
+ * @internal
+ */
+function createForm(frame, action, fields) {
+    const form = frame.createElement("form");
+    form.method = "post";
+    form.action = action;
+    Object.keys(fields).forEach((name) => {
+        const input = frame.createElement("input");
+        input.hidden = true;
+        input.name = name;
+        input.value = fields[name];
+        form.appendChild(input);
+    });
+    frame.body.appendChild(form);
+    return form;
+}
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_POPUP_RELAY_TIMEOUT_MS = 300000;
+const DEFAULT_POPUP_RELAY_WIDTH = 520;
+const DEFAULT_POPUP_RELAY_HEIGHT = 640;
+/**
+ * Builds the `window.open` features string for the IdP child popup from a
+ * {@link PopupWindowAttributes}, mirroring the shape used by
+ * `PopupRequest.popupWindowAttributes`.
+ */
+function buildChildPopupFeatures(attributes) {
+    const width = attributes?.popupSize?.width || DEFAULT_POPUP_RELAY_WIDTH;
+    const height = attributes?.popupSize?.height || DEFAULT_POPUP_RELAY_HEIGHT;
+    const features = [`width=${width}`, `height=${height}`];
+    if (attributes?.popupPosition?.top !== undefined) {
+        features.push(`top=${attributes.popupPosition.top}`);
+    }
+    if (attributes?.popupPosition?.left !== undefined) {
+        features.push(`left=${attributes.popupPosition.left}`);
+    }
+    features.push("scrollbars=yes");
+    return features.join(",");
+}
+/**
+ * Entry point for the top-level "popup-relay" page referenced by
+ * `auth.popupRelayUri`. Call this from the relay page (which MSAL opens as a
+ * top-level popup from inside an embedded, cross-origin iframe). It:
+ *
+ *   1. Reads the IdP navigation MSAL passed in this page's hash (a GET URL, or a
+ *      POST form for the form_post / EAR response modes), then scrubs the hash.
+ *   2. Opens the IdP child popup and performs that navigation (the relay page
+ *      stays put, so its `window.opener` link back to the embedded frame
+ *      survives COOP).
+ *   3. Waits for the child's redirect URI page (which must run the redirect
+ *      bridge, `broadcastResponseToMainFrame`) to broadcast the raw auth
+ *      response over a same-origin `BroadcastChannel`.
+ *   4. Relays that raw response back to the embedded frame via
+ *      `opener.postMessage`, posting only to its own (same) origin, then closes.
+ *
+ * The embedded frame keeps the PKCE verifier (and EAR private key) and exchanges
+ * the relayed response itself — no token, verifier, or private key ever crosses
+ * a window boundary.
+ *
+ * Note: the child popup is opened when this function runs, so call it from a
+ * user gesture (e.g. a "Continue" button click) to avoid popup blockers.
+ *
+ * @param options - {@link PopupRelayOptions}
+ */
+function runPopupRelay(options) {
+    const opener = window.opener;
+    const targetOrigin = window.location.origin;
+    const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ""));
+    const rawReq = hashParams.get("req") || "";
+    // Scrub the relayed request out of the relay page's own URL immediately.
+    if (typeof window.history.replaceState === "function") {
+        window.history.replaceState(null, "", window.location.origin + window.location.pathname);
+    }
+    if (!opener) {
+        throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_no_opener");
+    }
+    let request;
+    try {
+        request = JSON.parse(rawReq);
+    }
+    catch (e) {
+        throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_bad_request");
+    }
+    if (!request || !request.id) {
+        throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_bad_request");
+    }
+    const id = request.id;
+    const channel = new BroadcastChannel(id);
+    let settled = false;
+    /*
+     * Timer handles are kept on a const holder so relay() (declared before the
+     * timers are created) can clear them — `let` handles trip prefer-const, and
+     * `const` handles can't be referenced before assignment (TDZ).
+     */
+    const timers = {};
+    const relay = (message) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        try {
+            channel.close();
+        }
+        catch (e) {
+            /* ignore */
+        }
+        clearInterval(timers.closedPoll);
+        clearTimeout(timers.timeoutId);
+        opener.postMessage({ type: POPUP_RELAY_RESPONSE_TYPE, id, ...message }, targetOrigin);
+        setTimeout(() => {
+            try {
+                window.close();
+            }
+            catch (e) {
+                /* ignore */
+            }
+        }, 0);
+    };
+    // The redirect bridge broadcasts the raw auth response payload here.
+    channel.onmessage = (event) => {
+        const payload = event.data && event.data.payload;
+        if (payload) {
+            relay({ payload });
+        }
+    };
+    const features = buildChildPopupFeatures(options?.popupWindowAttributes);
+    const childPopup = request.method === "POST"
+        ? window.open("about:blank", "msalPopupRelayChild", features)
+        : window.open(request.url, "msalPopupRelayChild", features);
+    if (!childPopup) {
+        relay({ error: popupWindowError });
+        return;
+    }
+    if (request.method === "POST") {
+        createForm(childPopup.document, request.action, request.fields).submit();
+    }
+    timers.closedPoll = window.setInterval(() => {
+        if (childPopup.closed && !settled) {
+            /*
+             * The popup is gone, so the overall timeout no longer applies —
+             * drop it and report cancellation. A successful sign-in settles
+             * first: the redirect bridge broadcasts the response before it
+             * closes the popup, so onmessage runs on the
+             * next event-loop turn, well before this 500ms poll observes the
+             * close — the `!settled` guard then skips cancellation.
+             */
+            clearTimeout(timers.timeoutId);
+            relay({ error: userCancelled });
+        }
+    }, 500);
+    timers.timeoutId = window.setTimeout(() => {
+        if (!settled) {
+            /*
+             * Stop the close poll before we close the popup ourselves, so it
+             * can't observe the close and report user_cancelled instead.
+             */
+            clearInterval(timers.closedPoll);
+            try {
+                childPopup.close();
+            }
+            catch (e) {
+                /* ignore */
+            }
+            relay({ error: timedOut });
+        }
+    }, options?.timeoutMs || DEFAULT_POPUP_RELAY_TIMEOUT_MS);
+}
+
+exports.runPopupRelay = runPopupRelay;
+//# sourceMappingURL=msal-popup-relay.cjs.map

package/lib/popup-relay/msal-popup-relay.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-popup-relay.cjs","sources":["../../../../src/popup_relay/constants.ts","../../../msal-common/dist-browser/error/AuthError.mjs","../../../../src/error/BrowserAuthErrorCodes.ts","../../../../src/error/BrowserAuthError.ts","../../../../src/utils/BrowserConstants.ts","../../../../src/protocol/Authorize.ts","../../../../src/popup_relay/index.ts"],"sourcesContent":[null,"/*! @azure/msal-common v16.11.1 2026-07-07 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\nfunction getDefaultErrorMessage(code) {\r\n    return `See https://aka.ms/msal.js.errors#${code} for details`;\r\n}\r\n/**\r\n * General error class thrown by the MSAL.js library.\r\n */\r\nclass AuthError extends Error {\r\n    constructor(errorCode, correlationId, errorMessage, suberror) {\r\n        const message = errorMessage ||\r\n            (errorCode ? getDefaultErrorMessage(errorCode) : \"\");\r\n        const errorString = message ? `${errorCode}: ${message}` : errorCode;\r\n        super(errorString);\r\n        Object.setPrototypeOf(this, AuthError.prototype);\r\n        this.errorCode = errorCode || \"\";\r\n        this.errorMessage = message || \"\";\r\n        this.subError = suberror || \"\";\r\n        this.correlationId = correlationId;\r\n        this.name = \"AuthError\";\r\n    }\r\n}\r\nfunction createAuthError(code, correlationId, additionalMessage) {\r\n    return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));\r\n}\n\nexport { AuthError, createAuthError, getDefaultErrorMessage };\n//# sourceMappingURL=AuthError.mjs.map\n",null,null,null,null,null],"names":["getDefaultErrorMessage","BrowserAuthErrorCodes.popupRelayUnsupportedFlow","BrowserAuthErrorCodes.popupWindowError","BrowserAuthErrorCodes.userCancelled","BrowserAuthErrorCodes.timedOut"],"mappings":";;;;AAAA;;;AAGG;AAEH;;;;;;;;;;AAUG;AACI,MAAM,yBAAyB,GAAG,8BAA8B;;AChBvE;AAEA;AACA;AACA;AACA;AACA,SAASA,wBAAsB,CAAC,IAAI,EAAE;AACtC,IAAI,OAAO,CAAC,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;AACnE,CAAC;AACD;AACA;AACA;AACA,MAAM,SAAS,SAAS,KAAK,CAAC;AAC9B,IAAI,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAG,YAAY;AACpC,aAAa,SAAS,GAAGA,wBAAsB,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;AACjE,QAAQ,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;AAC7E,QAAQ,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3B,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;AACzD,QAAQ,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;AACzC,QAAQ,IAAI,CAAC,YAAY,GAAG,OAAO,IAAI,EAAE,CAAC;AAC1C,QAAQ,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;AACvC,QAAQ,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;AAC3C,QAAQ,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;AAChC,IAAI,CAAC;AACL;;ACzBA;;;AAGG;AAgBI,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAKvC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAsCjE,MAAM,QAAQ,GAAG,WAAW;;AChEnC;;;AAGG;AAMG,SAAU,sBAAsB,CAAC,IAAY,EAAA;IAC/C,OAAO,CAAA,kCAAA,EAAqC,IAAI,CAAA,YAAA,CAAc,CAAC;AACnE,CAAC;AAED;;AAEG;AACG,MAAO,gBAAiB,SAAQ,SAAS,CAAA;AAC3C,IAAA,WAAA,CAAY,SAAiB,EAAE,aAAqB,EAAE,QAAiB,EAAA;AACnE,QAAA,KAAK,CACD,SAAS,EACT,aAAa,EACb,sBAAsB,CAAC,SAAS,CAAC,EACjC,QAAQ,CACX,CAAC;QAEF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACxD,QAAA,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACnC,CAAC;AACJ,CAAA;SAEe,sBAAsB,CAClC,SAAiB,EACjB,aAAqB,EACrB,QAAiB,EAAA;IAEjB,OAAO,IAAI,gBAAgB,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AACpE;;ACpCA;;;AAGG;AAuJH;;AAEG;AACH,IAAY,eAKX,CAAA;AALD,CAAA,UAAY,eAAe,EAAA;AACvB,IAAA,eAAA,CAAA,UAAA,CAAA,GAAA,UAAqB,CAAA;AACrB,IAAA,eAAA,CAAA,OAAA,CAAA,GAAA,OAAe,CAAA;AACf,IAAA,eAAA,CAAA,QAAA,CAAA,GAAA,QAAiB,CAAA;AACjB,IAAA,eAAA,CAAA,MAAA,CAAA,GAAA,MAAa,CAAA;AACjB,CAAC,EALW,eAAe,KAAf,eAAe,GAAA,EAAA,CAAA,CAAA;;AC7J3B;;;AAGG;AA6aH;;;;;;;;;;AAUG;SACa,UAAU,CACtB,KAAe,EACf,MAAc,EACd,MAA8B,EAAA;IAE9B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AACzC,IAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,IAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAErB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAI;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAC3C,QAAA,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;AACpB,QAAA,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,QAAA,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3B,QAAA,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,IAAA,CAAC,CAAC,CAAC;AAEH,IAAA,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAC7B,IAAA,OAAO,IAAI,CAAC;AAChB;;AC9cA;;;AAGG;AA8BH,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;;AAIG;AACH,SAAS,uBAAuB,CAAC,UAAkC,EAAA;IAC/D,MAAM,KAAK,GAAG,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,yBAAyB,CAAC;IACxE,MAAM,MAAM,GAAG,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,0BAA0B,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE,EAAE,CAAA,OAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAC;AACxD,IAAA,IAAI,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,SAAS,EAAE;QAC9C,QAAQ,CAAC,IAAI,CAAC,CAAA,IAAA,EAAO,UAAU,CAAC,aAAa,CAAC,GAAG,CAAA,CAAE,CAAC,CAAC;AACxD,IAAA,CAAA;AACD,IAAA,IAAI,UAAU,EAAE,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE;QAC/C,QAAQ,CAAC,IAAI,CAAC,CAAA,KAAA,EAAQ,UAAU,CAAC,aAAa,CAAC,IAAI,CAAA,CAAE,CAAC,CAAC;AAC1D,IAAA,CAAA;AACD,IAAA,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAChC,IAAA,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;AAwBG;AACG,SAAU,aAAa,CAAC,OAA2B,EAAA;AACrD,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAuB,CAAC;AAC9C,IAAA,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AAE5C,IAAA,MAAM,UAAU,GAAG,IAAI,eAAe,CAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACzC,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;;IAG3C,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,EAAE;QACnD,MAAM,CAAC,OAAO,CAAC,YAAY,CACvB,IAAI,EACJ,EAAE,EACF,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CACpD,CAAC;AACL,IAAA,CAAA;IAED,IAAI,CAAC,MAAM,EAAE;QACT,MAAM,sBAAsB,CACxBC,yBAA+C,EAC/C,EAAE,EACF,uBAAuB,CAC1B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,IAAI,OAA0B,CAAC;IAC/B,IAAI;AACA,QAAA,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;AACrD,IAAA,CAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,MAAM,sBAAsB,CACxBA,yBAA+C,EAC/C,EAAE,EACF,yBAAyB,CAC5B,CAAC;AACL,IAAA,CAAA;AACD,IAAA,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;QACzB,MAAM,sBAAsB,CACxBA,yBAA+C,EAC/C,EAAE,EACF,yBAAyB,CAC5B,CAAC;AACL,IAAA,CAAA;AAED,IAAA,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;AACtB,IAAA,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB;;;;AAIG;IACH,MAAM,MAAM,GAGR,EAAE,CAAC;AAEP,IAAA,MAAM,KAAK,GAAG,CAAC,OAA6C,KAAU;AAClE,QAAA,IAAI,OAAO,EAAE;YACT,OAAO;AACV,QAAA,CAAA;QACD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI;YACA,OAAO,CAAC,KAAK,EAAE,CAAC;AACnB,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;;AAEX,QAAA,CAAA;AACD,QAAA,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACjC,QAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC/B,QAAA,MAAM,CAAC,WAAW,CACd,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,EACnD,YAAY,CACf,CAAC;QACF,UAAU,CAAC,MAAK;YACZ,IAAI;gBACA,MAAM,CAAC,KAAK,EAAE,CAAC;AAClB,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;;AAEX,YAAA,CAAA;QACL,CAAC,EAAE,CAAC,CAAC,CAAC;AACV,IAAA,CAAC,CAAC;;AAGF,IAAA,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,KAAU;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;AACjD,QAAA,IAAI,OAAO,EAAE;AACT,YAAA,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AACtB,QAAA,CAAA;AACL,IAAA,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACzE,IAAA,MAAM,UAAU,GACZ,OAAO,CAAC,MAAM,KAAK,MAAM;UACnB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,qBAAqB,EAAE,QAAQ,CAAC;AAC7D,UAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,CAAC,UAAU,EAAE;QACb,KAAK,CAAC,EAAE,KAAK,EAAEC,gBAAsC,EAAE,CAAC,CAAC;QACzD,OAAO;AACV,IAAA,CAAA;AAED,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;AAC3B,QAAA,UAAU,CACN,UAAU,CAAC,QAAQ,EACnB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACjB,CAAC,MAAM,EAAE,CAAC;AACd,IAAA,CAAA;IAED,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAK;AACxC,QAAA,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE;AAC/B;;;;;;;AAOG;AACH,YAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,KAAK,CAAC,EAAE,KAAK,EAAEC,aAAmC,EAAE,CAAC,CAAC;AACzD,QAAA,CAAA;IACL,CAAC,EAAE,GAAG,CAAC,CAAC;IAER,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAK;QACtC,IAAI,CAAC,OAAO,EAAE;AACV;;;AAGG;AACH,YAAA,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI;gBACA,UAAU,CAAC,KAAK,EAAE,CAAC;AACtB,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;;AAEX,YAAA,CAAA;YACD,KAAK,CAAC,EAAE,KAAK,EAAEC,QAA8B,EAAE,CAAC,CAAC;AACpD,QAAA,CAAA;AACL,IAAA,CAAC,EAAE,OAAO,EAAE,SAAS,IAAI,8BAA8B,CAAC,CAAC;AAC7D;;;;"}

package/lib/popup-relay/msal-popup-relay.js

@@ -0,0 +1,284 @@
+/*! @azure/msal-browser v5.17.0 2026-07-07 */
+'use strict';
+(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+    typeof define === 'function' && define.amd ? define(['exports'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msalPopupRelay = {}));
+})(this, (function (exports) { 'use strict';
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * postMessage envelope type used to relay an auth response from a popup-relay
+     * page (see `runPopupRelay`) back to the embedded frame that opened it. See
+     * {@link BrowserAuthOptions.popupRelayUri}.
+     *
+     * Kept dependency-free so both the relay-page entry (`./index.js`) and the
+     * client-side helpers (`./relayClient.js`) can import it without either bundle
+     * pulling in the other's dependencies.
+     *
+     * @internal
+     */
+    const POPUP_RELAY_RESPONSE_TYPE = "msal:popup-relay-response:v1";
+
+    /*! @azure/msal-common v16.11.1 2026-07-07 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function getDefaultErrorMessage$1(code) {
+        return `See https://aka.ms/msal.js.errors#${code} for details`;
+    }
+    /**
+     * General error class thrown by the MSAL.js library.
+     */
+    class AuthError extends Error {
+        constructor(errorCode, correlationId, errorMessage, suberror) {
+            const message = errorMessage ||
+                (errorCode ? getDefaultErrorMessage$1(errorCode) : "");
+            const errorString = message ? `${errorCode}: ${message}` : errorCode;
+            super(errorString);
+            Object.setPrototypeOf(this, AuthError.prototype);
+            this.errorCode = errorCode || "";
+            this.errorMessage = message || "";
+            this.subError = suberror || "";
+            this.correlationId = correlationId;
+            this.name = "AuthError";
+        }
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const popupWindowError = "popup_window_error";
+    const userCancelled = "user_cancelled";
+    const popupRelayUnsupportedFlow = "popup_relay_unsupported_flow";
+    const timedOut = "timed_out";
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function getDefaultErrorMessage(code) {
+        return `See https://aka.ms/msal.js.errors#${code} for details`;
+    }
+    /**
+     * Browser library error class thrown by the MSAL.js library for SPAs
+     */
+    class BrowserAuthError extends AuthError {
+        constructor(errorCode, correlationId, subError) {
+            super(errorCode, correlationId, getDefaultErrorMessage(errorCode), subError);
+            Object.setPrototypeOf(this, BrowserAuthError.prototype);
+            this.name = "BrowserAuthError";
+        }
+    }
+    function createBrowserAuthError(errorCode, correlationId, subError) {
+        return new BrowserAuthError(errorCode, correlationId, subError);
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /*
+     * Interaction type of the API - used for state and telemetry
+     */
+    var InteractionType;
+    (function (InteractionType) {
+        InteractionType["Redirect"] = "redirect";
+        InteractionType["Popup"] = "popup";
+        InteractionType["Silent"] = "silent";
+        InteractionType["None"] = "none";
+    })(InteractionType || (InteractionType = {}));
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Creates a POST `<form>` in the provided document with the given auth
+     * parameters as hidden inputs, targeting `action`. Shared by the popup auth
+     * flows (`getEARForm` / `getCodeForm`) and the popup-relay page
+     * (`runPopupRelay`) so the form is built one way only.
+     *
+     * @param frame - document to create the form in
+     * @param action - form action (the /authorize URL)
+     * @param fields - POST-body fields
+     * @internal
+     */
+    function createForm(frame, action, fields) {
+        const form = frame.createElement("form");
+        form.method = "post";
+        form.action = action;
+        Object.keys(fields).forEach((name) => {
+            const input = frame.createElement("input");
+            input.hidden = true;
+            input.name = name;
+            input.value = fields[name];
+            form.appendChild(input);
+        });
+        frame.body.appendChild(form);
+        return form;
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const DEFAULT_POPUP_RELAY_TIMEOUT_MS = 300000;
+    const DEFAULT_POPUP_RELAY_WIDTH = 520;
+    const DEFAULT_POPUP_RELAY_HEIGHT = 640;
+    /**
+     * Builds the `window.open` features string for the IdP child popup from a
+     * {@link PopupWindowAttributes}, mirroring the shape used by
+     * `PopupRequest.popupWindowAttributes`.
+     */
+    function buildChildPopupFeatures(attributes) {
+        const width = attributes?.popupSize?.width || DEFAULT_POPUP_RELAY_WIDTH;
+        const height = attributes?.popupSize?.height || DEFAULT_POPUP_RELAY_HEIGHT;
+        const features = [`width=${width}`, `height=${height}`];
+        if (attributes?.popupPosition?.top !== undefined) {
+            features.push(`top=${attributes.popupPosition.top}`);
+        }
+        if (attributes?.popupPosition?.left !== undefined) {
+            features.push(`left=${attributes.popupPosition.left}`);
+        }
+        features.push("scrollbars=yes");
+        return features.join(",");
+    }
+    /**
+     * Entry point for the top-level "popup-relay" page referenced by
+     * `auth.popupRelayUri`. Call this from the relay page (which MSAL opens as a
+     * top-level popup from inside an embedded, cross-origin iframe). It:
+     *
+     *   1. Reads the IdP navigation MSAL passed in this page's hash (a GET URL, or a
+     *      POST form for the form_post / EAR response modes), then scrubs the hash.
+     *   2. Opens the IdP child popup and performs that navigation (the relay page
+     *      stays put, so its `window.opener` link back to the embedded frame
+     *      survives COOP).
+     *   3. Waits for the child's redirect URI page (which must run the redirect
+     *      bridge, `broadcastResponseToMainFrame`) to broadcast the raw auth
+     *      response over a same-origin `BroadcastChannel`.
+     *   4. Relays that raw response back to the embedded frame via
+     *      `opener.postMessage`, posting only to its own (same) origin, then closes.
+     *
+     * The embedded frame keeps the PKCE verifier (and EAR private key) and exchanges
+     * the relayed response itself — no token, verifier, or private key ever crosses
+     * a window boundary.
+     *
+     * Note: the child popup is opened when this function runs, so call it from a
+     * user gesture (e.g. a "Continue" button click) to avoid popup blockers.
+     *
+     * @param options - {@link PopupRelayOptions}
+     */
+    function runPopupRelay(options) {
+        const opener = window.opener;
+        const targetOrigin = window.location.origin;
+        const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ""));
+        const rawReq = hashParams.get("req") || "";
+        // Scrub the relayed request out of the relay page's own URL immediately.
+        if (typeof window.history.replaceState === "function") {
+            window.history.replaceState(null, "", window.location.origin + window.location.pathname);
+        }
+        if (!opener) {
+            throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_no_opener");
+        }
+        let request;
+        try {
+            request = JSON.parse(rawReq);
+        }
+        catch (e) {
+            throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_bad_request");
+        }
+        if (!request || !request.id) {
+            throw createBrowserAuthError(popupRelayUnsupportedFlow, "", "popup_relay_bad_request");
+        }
+        const id = request.id;
+        const channel = new BroadcastChannel(id);
+        let settled = false;
+        /*
+         * Timer handles are kept on a const holder so relay() (declared before the
+         * timers are created) can clear them — `let` handles trip prefer-const, and
+         * `const` handles can't be referenced before assignment (TDZ).
+         */
+        const timers = {};
+        const relay = (message) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            try {
+                channel.close();
+            }
+            catch (e) {
+                /* ignore */
+            }
+            clearInterval(timers.closedPoll);
+            clearTimeout(timers.timeoutId);
+            opener.postMessage({ type: POPUP_RELAY_RESPONSE_TYPE, id, ...message }, targetOrigin);
+            setTimeout(() => {
+                try {
+                    window.close();
+                }
+                catch (e) {
+                    /* ignore */
+                }
+            }, 0);
+        };
+        // The redirect bridge broadcasts the raw auth response payload here.
+        channel.onmessage = (event) => {
+            const payload = event.data && event.data.payload;
+            if (payload) {
+                relay({ payload });
+            }
+        };
+        const features = buildChildPopupFeatures(options?.popupWindowAttributes);
+        const childPopup = request.method === "POST"
+            ? window.open("about:blank", "msalPopupRelayChild", features)
+            : window.open(request.url, "msalPopupRelayChild", features);
+        if (!childPopup) {
+            relay({ error: popupWindowError });
+            return;
+        }
+        if (request.method === "POST") {
+            createForm(childPopup.document, request.action, request.fields).submit();
+        }
+        timers.closedPoll = window.setInterval(() => {
+            if (childPopup.closed && !settled) {
+                /*
+                 * The popup is gone, so the overall timeout no longer applies —
+                 * drop it and report cancellation. A successful sign-in settles
+                 * first: the redirect bridge broadcasts the response before it
+                 * closes the popup, so onmessage runs on the
+                 * next event-loop turn, well before this 500ms poll observes the
+                 * close — the `!settled` guard then skips cancellation.
+                 */
+                clearTimeout(timers.timeoutId);
+                relay({ error: userCancelled });
+            }
+        }, 500);
+        timers.timeoutId = window.setTimeout(() => {
+            if (!settled) {
+                /*
+                 * Stop the close poll before we close the popup ourselves, so it
+                 * can't observe the close and report user_cancelled instead.
+                 */
+                clearInterval(timers.closedPoll);
+                try {
+                    childPopup.close();
+                }
+                catch (e) {
+                    /* ignore */
+                }
+                relay({ error: timedOut });
+            }
+        }, options?.timeoutMs || DEFAULT_POPUP_RELAY_TIMEOUT_MS);
+    }
+
+    exports.runPopupRelay = runPopupRelay;
+
+}));
+//# sourceMappingURL=msal-popup-relay.js.map

package/lib/popup-relay/msal-popup-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-popup-relay.js","sources":["../../../../src/popup_relay/constants.ts","../../../msal-common/dist-browser/error/AuthError.mjs","../../../../src/error/BrowserAuthErrorCodes.ts","../../../../src/error/BrowserAuthError.ts","../../../../src/utils/BrowserConstants.ts","../../../../src/protocol/Authorize.ts","../../../../src/popup_relay/index.ts"],"sourcesContent":[null,"/*! @azure/msal-common v16.11.1 2026-07-07 */\n'use strict';\n/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\nfunction getDefaultErrorMessage(code) {\r\n    return `See https://aka.ms/msal.js.errors#${code} for details`;\r\n}\r\n/**\r\n * General error class thrown by the MSAL.js library.\r\n */\r\nclass AuthError extends Error {\r\n    constructor(errorCode, correlationId, errorMessage, suberror) {\r\n        const message = errorMessage ||\r\n            (errorCode ? getDefaultErrorMessage(errorCode) : \"\");\r\n        const errorString = message ? `${errorCode}: ${message}` : errorCode;\r\n        super(errorString);\r\n        Object.setPrototypeOf(this, AuthError.prototype);\r\n        this.errorCode = errorCode || \"\";\r\n        this.errorMessage = message || \"\";\r\n        this.subError = suberror || \"\";\r\n        this.correlationId = correlationId;\r\n        this.name = \"AuthError\";\r\n    }\r\n}\r\nfunction createAuthError(code, correlationId, additionalMessage) {\r\n    return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage(code));\r\n}\n\nexport { AuthError, createAuthError, getDefaultErrorMessage };\n//# sourceMappingURL=AuthError.mjs.map\n",null,null,null,null,null],"names":["getDefaultErrorMessage","BrowserAuthErrorCodes.popupRelayUnsupportedFlow","BrowserAuthErrorCodes.popupWindowError","BrowserAuthErrorCodes.userCancelled","BrowserAuthErrorCodes.timedOut"],"mappings":";;;;;;;;IAAA;;;IAGG;IAEH;;;;;;;;;;IAUG;IACI,MAAM,yBAAyB,GAAG,8BAA8B;;IChBvE;IAEA;IACA;IACA;IACA;IACA,SAASA,wBAAsB,CAAC,IAAI,EAAE;IACtC,IAAI,OAAO,CAAC,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IACD;IACA;IACA;IACA,MAAM,SAAS,SAAS,KAAK,CAAC;IAC9B,IAAI,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE;IAClE,QAAQ,MAAM,OAAO,GAAG,YAAY;IACpC,aAAa,SAAS,GAAGA,wBAAsB,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,QAAQ,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7E,QAAQ,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;IACzC,QAAQ,IAAI,CAAC,YAAY,GAAG,OAAO,IAAI,EAAE,CAAC;IAC1C,QAAQ,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;IACvC,QAAQ,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IAC3C,QAAQ,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAChC,IAAI,CAAC;IACL;;ICzBA;;;IAGG;IAgBI,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;IAE9C,MAAM,aAAa,GAAG,gBAAgB,CAAC;IAKvC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;IAsCjE,MAAM,QAAQ,GAAG,WAAW;;IChEnC;;;IAGG;IAMG,SAAU,sBAAsB,CAAC,IAAY,EAAA;QAC/C,OAAO,CAAA,kCAAA,EAAqC,IAAI,CAAA,YAAA,CAAc,CAAC;IACnE,CAAC;IAED;;IAEG;IACG,MAAO,gBAAiB,SAAQ,SAAS,CAAA;IAC3C,IAAA,WAAA,CAAY,SAAiB,EAAE,aAAqB,EAAE,QAAiB,EAAA;IACnE,QAAA,KAAK,CACD,SAAS,EACT,aAAa,EACb,sBAAsB,CAAC,SAAS,CAAC,EACjC,QAAQ,CACX,CAAC;YAEF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxD,QAAA,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QACnC,CAAC;IACJ,CAAA;aAEe,sBAAsB,CAClC,SAAiB,EACjB,aAAqB,EACrB,QAAiB,EAAA;QAEjB,OAAO,IAAI,gBAAgB,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpE;;ICpCA;;;IAGG;IAuJH;;IAEG;IACH,IAAY,eAKX,CAAA;IALD,CAAA,UAAY,eAAe,EAAA;IACvB,IAAA,eAAA,CAAA,UAAA,CAAA,GAAA,UAAqB,CAAA;IACrB,IAAA,eAAA,CAAA,OAAA,CAAA,GAAA,OAAe,CAAA;IACf,IAAA,eAAA,CAAA,QAAA,CAAA,GAAA,QAAiB,CAAA;IACjB,IAAA,eAAA,CAAA,MAAA,CAAA,GAAA,MAAa,CAAA;IACjB,CAAC,EALW,eAAe,KAAf,eAAe,GAAA,EAAA,CAAA,CAAA;;IC7J3B;;;IAGG;IA6aH;;;;;;;;;;IAUG;aACa,UAAU,CACtB,KAAe,EACf,MAAc,EACd,MAA8B,EAAA;QAE9B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,IAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACrB,IAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAI;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,QAAA,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACpB,QAAA,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,QAAA,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,QAAA,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAA,CAAC,CAAC,CAAC;IAEH,IAAA,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAA,OAAO,IAAI,CAAC;IAChB;;IC9cA;;;IAGG;IA8BH,MAAM,8BAA8B,GAAG,MAAM,CAAC;IAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;IACtC,MAAM,0BAA0B,GAAG,GAAG,CAAC;IAEvC;;;;IAIG;IACH,SAAS,uBAAuB,CAAC,UAAkC,EAAA;QAC/D,MAAM,KAAK,GAAG,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,yBAAyB,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,0BAA0B,CAAC;QAC3E,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE,EAAE,CAAA,OAAA,EAAU,MAAM,CAAA,CAAE,CAAC,CAAC;IACxD,IAAA,IAAI,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,SAAS,EAAE;YAC9C,QAAQ,CAAC,IAAI,CAAC,CAAA,IAAA,EAAO,UAAU,CAAC,aAAa,CAAC,GAAG,CAAA,CAAE,CAAC,CAAC;IACxD,IAAA,CAAA;IACD,IAAA,IAAI,UAAU,EAAE,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE;YAC/C,QAAQ,CAAC,IAAI,CAAC,CAAA,KAAA,EAAQ,UAAU,CAAC,aAAa,CAAC,IAAI,CAAA,CAAE,CAAC,CAAC;IAC1D,IAAA,CAAA;IACD,IAAA,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChC,IAAA,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;IAwBG;IACG,SAAU,aAAa,CAAC,OAA2B,EAAA;IACrD,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAuB,CAAC;IAC9C,IAAA,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE5C,IAAA,MAAM,UAAU,GAAG,IAAI,eAAe,CAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACzC,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;;QAG3C,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,EAAE;YACnD,MAAM,CAAC,OAAO,CAAC,YAAY,CACvB,IAAI,EACJ,EAAE,EACF,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CACpD,CAAC;IACL,IAAA,CAAA;QAED,IAAI,CAAC,MAAM,EAAE;YACT,MAAM,sBAAsB,CACxBC,yBAA+C,EAC/C,EAAE,EACF,uBAAuB,CAC1B,CAAC;IACL,IAAA,CAAA;IAED,IAAA,IAAI,OAA0B,CAAC;QAC/B,IAAI;IACA,QAAA,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACrD,IAAA,CAAA;IAAC,IAAA,OAAO,CAAC,EAAE;YACR,MAAM,sBAAsB,CACxBA,yBAA+C,EAC/C,EAAE,EACF,yBAAyB,CAC5B,CAAC;IACL,IAAA,CAAA;IACD,IAAA,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;YACzB,MAAM,sBAAsB,CACxBA,yBAA+C,EAC/C,EAAE,EACF,yBAAyB,CAC5B,CAAC;IACL,IAAA,CAAA;IAED,IAAA,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IACtB,IAAA,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB;;;;IAIG;QACH,MAAM,MAAM,GAGR,EAAE,CAAC;IAEP,IAAA,MAAM,KAAK,GAAG,CAAC,OAA6C,KAAU;IAClE,QAAA,IAAI,OAAO,EAAE;gBACT,OAAO;IACV,QAAA,CAAA;YACD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI;gBACA,OAAO,CAAC,KAAK,EAAE,CAAC;IACnB,QAAA,CAAA;IAAC,QAAA,OAAO,CAAC,EAAE;;IAEX,QAAA,CAAA;IACD,QAAA,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,QAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,QAAA,MAAM,CAAC,WAAW,CACd,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,EACnD,YAAY,CACf,CAAC;YACF,UAAU,CAAC,MAAK;gBACZ,IAAI;oBACA,MAAM,CAAC,KAAK,EAAE,CAAC;IAClB,YAAA,CAAA;IAAC,YAAA,OAAO,CAAC,EAAE;;IAEX,YAAA,CAAA;YACL,CAAC,EAAE,CAAC,CAAC,CAAC;IACV,IAAA,CAAC,CAAC;;IAGF,IAAA,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,KAAU;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;IACjD,QAAA,IAAI,OAAO,EAAE;IACT,YAAA,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtB,QAAA,CAAA;IACL,IAAA,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACzE,IAAA,MAAM,UAAU,GACZ,OAAO,CAAC,MAAM,KAAK,MAAM;cACnB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,qBAAqB,EAAE,QAAQ,CAAC;IAC7D,UAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,EAAE;YACb,KAAK,CAAC,EAAE,KAAK,EAAEC,gBAAsC,EAAE,CAAC,CAAC;YACzD,OAAO;IACV,IAAA,CAAA;IAED,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;IAC3B,QAAA,UAAU,CACN,UAAU,CAAC,QAAQ,EACnB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACjB,CAAC,MAAM,EAAE,CAAC;IACd,IAAA,CAAA;QAED,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAK;IACxC,QAAA,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE;IAC/B;;;;;;;IAOG;IACH,YAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,KAAK,CAAC,EAAE,KAAK,EAAEC,aAAmC,EAAE,CAAC,CAAC;IACzD,QAAA,CAAA;QACL,CAAC,EAAE,GAAG,CAAC,CAAC;QAER,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAK;YACtC,IAAI,CAAC,OAAO,EAAE;IACV;;;IAGG;IACH,YAAA,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjC,IAAI;oBACA,UAAU,CAAC,KAAK,EAAE,CAAC;IACtB,YAAA,CAAA;IAAC,YAAA,OAAO,CAAC,EAAE;;IAEX,YAAA,CAAA;gBACD,KAAK,CAAC,EAAE,KAAK,EAAEC,QAA8B,EAAE,CAAC,CAAC;IACpD,QAAA,CAAA;IACL,IAAA,CAAC,EAAE,OAAO,EAAE,SAAS,IAAI,8BAA8B,CAAC,CAAC;IAC7D;;;;;;;;"}

package/lib/popup-relay/msal-popup-relay.min.js

@@ -0,0 +1,2 @@
+/*! @azure/msal-browser v5.17.0 2026-07-07 */
+"use strict";!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?o(exports):"function"==typeof define&&define.amd?define(["exports"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).msalPopupRelay={})}(this,function(e){class o extends Error{constructor(e,t,r,n){const s=r||(e?`See https://aka.ms/msal.js.errors#${e} for details`:"");super(s?`${e}: ${s}`:e),Object.setPrototypeOf(this,o.prototype),this.errorCode=e||"",this.errorMessage=s||"",this.subError=n||"",this.correlationId=t,this.name="AuthError"}}const t="popup_relay_unsupported_flow";class r extends o{constructor(e,o,t){super(e,o,`See https://aka.ms/msal.js.errors#${e} for details`,t),Object.setPrototypeOf(this,r.prototype),this.name="BrowserAuthError"}}function n(e,o,t){return new r(e,o,t)}var s;!function(e){e.Redirect="redirect",e.Popup="popup",e.Silent="silent",e.None="none"}(s||(s={}));e.runPopupRelay=function(e){const o=window.opener,r=window.location.origin,s=new URLSearchParams(window.location.hash.replace(/^#/,"")).get("req")||"";if("function"==typeof window.history.replaceState&&window.history.replaceState(null,"",window.location.origin+window.location.pathname),!o)throw n(t,"","popup_relay_no_opener");let i;try{i=JSON.parse(s)}catch(e){throw n(t,"","popup_relay_bad_request")}if(!i||!i.id)throw n(t,"","popup_relay_bad_request");const p=i.id,a=new BroadcastChannel(p);let l=!1;const c={},d=e=>{if(!l){l=!0;try{a.close()}catch(e){}clearInterval(c.closedPoll),clearTimeout(c.timeoutId),o.postMessage({type:"msal:popup-relay-response:v1",id:p,...e},r),setTimeout(()=>{try{window.close()}catch(e){}},0)}};a.onmessage=e=>{const o=e.data&&e.data.payload;o&&d({payload:o})};const u=function(e){const o=[`width=${e?.popupSize?.width||520}`,`height=${e?.popupSize?.height||640}`];return void 0!==e?.popupPosition?.top&&o.push(`top=${e.popupPosition.top}`),void 0!==e?.popupPosition?.left&&o.push(`left=${e.popupPosition.left}`),o.push("scrollbars=yes"),o.join(",")}(e?.popupWindowAttributes),h="POST"===i.method?window.open("about:blank","msalPopupRelayChild",u):window.open(i.url,"msalPopupRelayChild",u);h?("POST"===i.method&&function(e,o,t){const r=e.createElement("form");return r.method="post",r.action=o,Object.keys(t).forEach(o=>{const n=e.createElement("input");n.hidden=!0,n.name=o,n.value=t[o],r.appendChild(n)}),e.body.appendChild(r),r}(h.document,i.action,i.fields).submit(),c.closedPoll=window.setInterval(()=>{h.closed&&!l&&(clearTimeout(c.timeoutId),d({error:"user_cancelled"}))},500),c.timeoutId=window.setTimeout(()=>{if(!l){clearInterval(c.closedPoll);try{h.close()}catch(e){}d({error:"timed_out"})}},e?.timeoutMs||3e5)):d({error:"popup_window_error"})}});