@azure/msal-common 14.0.0-alpha.1 → 14.0.0-beta.0

package/dist/config/ClientConfiguration.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.0.0-alpha.1 2023-05-08 */
+/*! @azure/msal-common v14.0.0-beta.0 2023-06-19 */
 'use strict';
 import { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.js';
 import { AuthError } from '../error/AuthError.js';
@@ -8,93 +8,93 @@ import { version } from '../packageMetadata.js';
 import { AzureCloudInstance } from '../authority/AuthorityOptions.js';
 import { DefaultStorageClass } from '../cache/CacheManager.js';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-const DEFAULT_SYSTEM_OPTIONS = {
-    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-    preventCorsPreflight: false,
-};
-const DEFAULT_LOGGER_IMPLEMENTATION = {
-    loggerCallback: () => {
-        // allow users to not set loggerCallback
-    },
-    piiLoggingEnabled: false,
-    logLevel: LogLevel.Info,
-    correlationId: Constants.EMPTY_STRING,
-};
-const DEFAULT_NETWORK_IMPLEMENTATION = {
-    async sendGetRequestAsync() {
-        const notImplErr = "Network interface - sendGetRequestAsync() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async sendPostRequestAsync() {
-        const notImplErr = "Network interface - sendPostRequestAsync() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-};
-const DEFAULT_LIBRARY_INFO = {
-    sku: Constants.SKU,
-    version: version,
-    cpu: Constants.EMPTY_STRING,
-    os: Constants.EMPTY_STRING,
-};
-const DEFAULT_CLIENT_CREDENTIALS = {
-    clientSecret: Constants.EMPTY_STRING,
-    clientAssertion: undefined,
-};
-const DEFAULT_AZURE_CLOUD_OPTIONS = {
-    azureCloudInstance: AzureCloudInstance.None,
-    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
-};
-const DEFAULT_TELEMETRY_OPTIONS = {
-    application: {
-        appName: "",
-        appVersion: "",
-    },
-};
-/**
- * Function that sets the default options when not explicitly configured from app developer
- *
- * @param Configuration
- *
- * @returns Configuration
- */
-function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
-    const loggerOptions = {
-        ...DEFAULT_LOGGER_IMPLEMENTATION,
-        ...userLoggerOption,
-    };
-    return {
-        authOptions: buildAuthOptions(userAuthOptions),
-        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
-        loggerOptions: loggerOptions,
-        storageInterface: storageImplementation ||
-            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
-        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
-        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
-        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
-        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
-        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
-        serverTelemetryManager: serverTelemetryManager || null,
-        persistencePlugin: persistencePlugin || null,
-        serializableCache: serializableCache || null,
-    };
-}
-/**
- * Construct authoptions from the client and platform passed values
- * @param authOptions
- */
-function buildAuthOptions(authOptions) {
-    return {
-        clientCapabilities: [],
-        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-        skipAuthorityMetadataCache: false,
-        ...authOptions,
-    };
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Token renewal offset default in seconds
+const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
+const DEFAULT_SYSTEM_OPTIONS = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+const DEFAULT_LOGGER_IMPLEMENTATION = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: LogLevel.Info,
+    correlationId: Constants.EMPTY_STRING,
+};
+const DEFAULT_NETWORK_IMPLEMENTATION = {
+    async sendGetRequestAsync() {
+        const notImplErr = "Network interface - sendGetRequestAsync() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async sendPostRequestAsync() {
+        const notImplErr = "Network interface - sendPostRequestAsync() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+};
+const DEFAULT_LIBRARY_INFO = {
+    sku: Constants.SKU,
+    version: version,
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING,
+};
+const DEFAULT_CLIENT_CREDENTIALS = {
+    clientSecret: Constants.EMPTY_STRING,
+    clientAssertion: undefined,
+};
+const DEFAULT_AZURE_CLOUD_OPTIONS = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
+};
+const DEFAULT_TELEMETRY_OPTIONS = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        storageInterface: storageImplementation ||
+            new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
+        networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions) {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        skipAuthorityMetadataCache: false,
+        ...authOptions,
+    };
 }
 
 export { DEFAULT_SYSTEM_OPTIONS, buildClientConfiguration };

package/dist/crypto/ICrypto.d.ts

@@ -1,63 +1,63 @@
-import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { SignedHttpRequest } from "./SignedHttpRequest";
-/**
- * The PkceCodes type describes the structure
- * of objects that contain PKCE code
- * challenge and verifier pairs
- */
-export type PkceCodes = {
-    verifier: string;
-    challenge: string;
-};
-export type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"> & {
-    correlationId?: string;
-};
-/**
- * Interface for crypto functions used by library
- */
-export interface ICrypto {
-    /**
-     * Creates a guid randomly.
-     */
-    createNewGuid(): string;
-    /**
-     * base64 Encode string
-     * @param input
-     */
-    base64Encode(input: string): string;
-    /**
-     * base64 decode string
-     * @param input
-     */
-    base64Decode(input: string): string;
-    /**
-     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636
-     */
-    generatePkceCodes(): Promise<PkceCodes>;
-    /**
-     * Generates an JWK RSA S256 Thumbprint
-     * @param request
-     */
-    getPublicKeyThumbprint(request: SignedHttpRequestParameters): Promise<string>;
-    /**
-     * Removes cryptographic keypair from key store matching the keyId passed in
-     * @param kid
-     */
-    removeTokenBindingKey(kid: string): Promise<boolean>;
-    /**
-     * Removes all cryptographic keys from IndexedDB storage
-     */
-    clearKeystore(): Promise<boolean>;
-    /**
-     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.
-     * @param accessToken
-     */
-    signJwt(payload: SignedHttpRequest, kid: string, correlationId?: string): Promise<string>;
-    /**
-     * Returns the SHA-256 hash of an input string
-     * @param plainText
-     */
-    hashString(plainText: string): Promise<string>;
-}
-export declare const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto;
+import { BaseAuthRequest } from "../request/BaseAuthRequest";
+import { SignedHttpRequest } from "./SignedHttpRequest";
+/**
+ * The PkceCodes type describes the structure
+ * of objects that contain PKCE code
+ * challenge and verifier pairs
+ */
+export type PkceCodes = {
+    verifier: string;
+    challenge: string;
+};
+export type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"> & {
+    correlationId?: string;
+};
+/**
+ * Interface for crypto functions used by library
+ */
+export interface ICrypto {
+    /**
+     * Creates a guid randomly.
+     */
+    createNewGuid(): string;
+    /**
+     * base64 Encode string
+     * @param input
+     */
+    base64Encode(input: string): string;
+    /**
+     * base64 decode string
+     * @param input
+     */
+    base64Decode(input: string): string;
+    /**
+     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636
+     */
+    generatePkceCodes(): Promise<PkceCodes>;
+    /**
+     * Generates an JWK RSA S256 Thumbprint
+     * @param request
+     */
+    getPublicKeyThumbprint(request: SignedHttpRequestParameters): Promise<string>;
+    /**
+     * Removes cryptographic keypair from key store matching the keyId passed in
+     * @param kid
+     */
+    removeTokenBindingKey(kid: string): Promise<boolean>;
+    /**
+     * Removes all cryptographic keys from IndexedDB storage
+     */
+    clearKeystore(): Promise<boolean>;
+    /**
+     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.
+     * @param accessToken
+     */
+    signJwt(payload: SignedHttpRequest, kid: string, correlationId?: string): Promise<string>;
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    hashString(plainText: string): Promise<string>;
+}
+export declare const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto;
 //# sourceMappingURL=ICrypto.d.ts.map

package/dist/crypto/ICrypto.js

@@ -1,48 +1,48 @@
-/*! @azure/msal-common v14.0.0-alpha.1 2023-05-08 */
+/*! @azure/msal-common v14.0.0-beta.0 2023-06-19 */
 'use strict';
 import { AuthError } from '../error/AuthError.js';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const DEFAULT_CRYPTO_IMPLEMENTATION = {
-    createNewGuid: () => {
-        const notImplErr = "Crypto interface - createNewGuid() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    base64Decode: () => {
-        const notImplErr = "Crypto interface - base64Decode() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    base64Encode: () => {
-        const notImplErr = "Crypto interface - base64Encode() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async generatePkceCodes() {
-        const notImplErr = "Crypto interface - generatePkceCodes() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async getPublicKeyThumbprint() {
-        const notImplErr = "Crypto interface - getPublicKeyThumbprint() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async removeTokenBindingKey() {
-        const notImplErr = "Crypto interface - removeTokenBindingKey() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async clearKeystore() {
-        const notImplErr = "Crypto interface - clearKeystore() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async signJwt() {
-        const notImplErr = "Crypto interface - signJwt() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
-    async hashString() {
-        const notImplErr = "Crypto interface - hashString() has not been implemented";
-        throw AuthError.createUnexpectedError(notImplErr);
-    },
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_CRYPTO_IMPLEMENTATION = {
+    createNewGuid: () => {
+        const notImplErr = "Crypto interface - createNewGuid() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    base64Decode: () => {
+        const notImplErr = "Crypto interface - base64Decode() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    base64Encode: () => {
+        const notImplErr = "Crypto interface - base64Encode() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async generatePkceCodes() {
+        const notImplErr = "Crypto interface - generatePkceCodes() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async getPublicKeyThumbprint() {
+        const notImplErr = "Crypto interface - getPublicKeyThumbprint() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async removeTokenBindingKey() {
+        const notImplErr = "Crypto interface - removeTokenBindingKey() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async clearKeystore() {
+        const notImplErr = "Crypto interface - clearKeystore() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async signJwt() {
+        const notImplErr = "Crypto interface - signJwt() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async hashString() {
+        const notImplErr = "Crypto interface - hashString() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
 };
 
 export { DEFAULT_CRYPTO_IMPLEMENTATION };

package/dist/crypto/IGuidGenerator.d.ts

@@ -1,5 +1,5 @@
-export interface IGuidGenerator {
-    generateGuid(): string;
-    isGuid(guid: string): boolean;
-}
+export interface IGuidGenerator {
+    generateGuid(): string;
+    isGuid(guid: string): boolean;
+}
 //# sourceMappingURL=IGuidGenerator.d.ts.map

package/dist/crypto/JoseHeader.d.ts

@@ -1,22 +1,22 @@
-import { JsonTypes } from "../utils/Constants";
-export type JoseHeaderOptions = {
-    typ?: JsonTypes;
-    alg?: string;
-    kid?: string;
-};
-export declare class JoseHeader {
-    typ?: JsonTypes;
-    alg?: string;
-    kid?: string;
-    constructor(options: JoseHeaderOptions);
-    /**
-     * Builds SignedHttpRequest formatted JOSE Header from the
-     * JOSE Header options provided or previously set on the object and returns
-     * the stringified header object.
-     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
-     * @param shrHeaderOptions
-     * @returns
-     */
-    static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string;
-}
+import { JsonTypes } from "../utils/Constants";
+export type JoseHeaderOptions = {
+    typ?: JsonTypes;
+    alg?: string;
+    kid?: string;
+};
+export declare class JoseHeader {
+    typ?: JsonTypes;
+    alg?: string;
+    kid?: string;
+    constructor(options: JoseHeaderOptions);
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string;
+}
 //# sourceMappingURL=JoseHeader.d.ts.map

package/dist/crypto/JoseHeader.js

@@ -1,43 +1,43 @@
-/*! @azure/msal-common v14.0.0-alpha.1 2023-05-08 */
+/*! @azure/msal-common v14.0.0-beta.0 2023-06-19 */
 'use strict';
 import { JoseHeaderError } from '../error/JoseHeaderError.js';
 import { JsonTypes } from '../utils/Constants.js';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class JoseHeader {
-    constructor(options) {
-        this.typ = options.typ;
-        this.alg = options.alg;
-        this.kid = options.kid;
-    }
-    /**
-     * Builds SignedHttpRequest formatted JOSE Header from the
-     * JOSE Header options provided or previously set on the object and returns
-     * the stringified header object.
-     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
-     * @param shrHeaderOptions
-     * @returns
-     */
-    static getShrHeaderString(shrHeaderOptions) {
-        // KeyID is required on the SHR header
-        if (!shrHeaderOptions.kid) {
-            throw JoseHeaderError.createMissingKidError();
-        }
-        // Alg is required on the SHR header
-        if (!shrHeaderOptions.alg) {
-            throw JoseHeaderError.createMissingAlgError();
-        }
-        const shrHeader = new JoseHeader({
-            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-            typ: shrHeaderOptions.typ || JsonTypes.Pop,
-            kid: shrHeaderOptions.kid,
-            alg: shrHeaderOptions.alg,
-        });
-        return JSON.stringify(shrHeader);
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class JoseHeader {
+    constructor(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw JoseHeaderError.createMissingKidError();
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw JoseHeaderError.createMissingAlgError();
+        }
+        const shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        });
+        return JSON.stringify(shrHeader);
+    }
 }
 
 export { JoseHeader };

package/dist/crypto/PopTokenGenerator.d.ts

@@ -1,58 +1,59 @@
-import { ICrypto, SignedHttpRequestParameters } from "./ICrypto";
-import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
-/**
- * See eSTS docs for more info.
- * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.
- * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:
- *      - sw: software storage
- *      - uhw: hardware storage
- */
-type ReqCnf = {
-    kid: string;
-    xms_ksl: KeyLocation;
-};
-export type ReqCnfData = {
-    kid: string;
-    reqCnfString: string;
-    reqCnfHash: string;
-};
-declare enum KeyLocation {
-    SW = "sw",
-    UHW = "uhw"
-}
-export declare class PopTokenGenerator {
-    private cryptoUtils;
-    private performanceClient?;
-    constructor(cryptoUtils: ICrypto, performanceClient?: IPerformanceClient);
-    /**
-     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
-     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
-     * @param request
-     * @returns
-     */
-    generateCnf(request: SignedHttpRequestParameters): Promise<ReqCnfData>;
-    /**
-     * Generates key_id for a SHR token request
-     * @param request
-     * @returns
-     */
-    generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf>;
-    /**
-     * Signs the POP access_token with the local generated key-pair
-     * @param accessToken
-     * @param request
-     * @returns
-     */
-    signPopToken(accessToken: string, keyId: string, request: SignedHttpRequestParameters): Promise<string>;
-    /**
-     * Utility function to generate the signed JWT for an access_token
-     * @param payload
-     * @param kid
-     * @param request
-     * @param claims
-     * @returns
-     */
-    signPayload(payload: string, keyId: string, request: SignedHttpRequestParameters, claims?: object): Promise<string>;
-}
-export {};
+import { ICrypto, SignedHttpRequestParameters } from "./ICrypto";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
+/**
+ * See eSTS docs for more info.
+ * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.
+ * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:
+ *      - sw: software storage
+ *      - uhw: hardware storage
+ */
+type ReqCnf = {
+    kid: string;
+    xms_ksl: KeyLocation;
+};
+export type ReqCnfData = {
+    kid: string;
+    reqCnfString: string;
+    reqCnfHash: string;
+};
+declare const KeyLocation: {
+    readonly SW: "sw";
+    readonly UHW: "uhw";
+};
+export type KeyLocation = typeof KeyLocation[keyof typeof KeyLocation];
+export declare class PopTokenGenerator {
+    private cryptoUtils;
+    private performanceClient?;
+    constructor(cryptoUtils: ICrypto, performanceClient?: IPerformanceClient);
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
+    generateCnf(request: SignedHttpRequestParameters): Promise<ReqCnfData>;
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
+    generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf>;
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    signPopToken(accessToken: string, keyId: string, request: SignedHttpRequestParameters): Promise<string>;
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    signPayload(payload: string, keyId: string, request: SignedHttpRequestParameters, claims?: object): Promise<string>;
+}
+export {};
 //# sourceMappingURL=PopTokenGenerator.d.ts.map