@azure/msal-common 14.1.0 → 14.2.0-alpha.0

package/dist/utils/Constants.mjs

@@ -1,381 +1,384 @@
-/*! @azure/msal-common v14.1.0 2023-10-05 */
+/*! @azure/msal-common v14.2.0-alpha.0 2023-12-07 */
 'use strict';
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const Constants = {
-    LIBRARY_NAME: "MSAL.JS",
-    SKU: "msal.js.common",
-    // Prefix for all library cache entries
-    CACHE_PREFIX: "msal",
-    // default authority
-    DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
-    DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
-    DEFAULT_COMMON_TENANT: "common",
-    // ADFS String
-    ADFS: "adfs",
-    DSTS: "dstsv2",
-    // Default AAD Instance Discovery Endpoint
-    AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
-    // CIAM URL
-    CIAM_AUTH_URL: ".ciamlogin.com",
-    AAD_TENANT_DOMAIN_SUFFIX: ".onmicrosoft.com",
-    // Resource delimiter - used for certain cache entries
-    RESOURCE_DELIM: "|",
-    // Placeholder for non-existent account ids/objects
-    NO_ACCOUNT: "NO_ACCOUNT",
-    // Claims
-    CLAIMS: "claims",
-    // Consumer UTID
-    CONSUMER_UTID: "9188040d-6c67-4c5b-b112-36a304b66dad",
-    // Default scopes
-    OPENID_SCOPE: "openid",
-    PROFILE_SCOPE: "profile",
-    OFFLINE_ACCESS_SCOPE: "offline_access",
-    EMAIL_SCOPE: "email",
-    // Default response type for authorization code flow
-    CODE_RESPONSE_TYPE: "code",
-    CODE_GRANT_TYPE: "authorization_code",
-    RT_GRANT_TYPE: "refresh_token",
-    FRAGMENT_RESPONSE_MODE: "fragment",
-    S256_CODE_CHALLENGE_METHOD: "S256",
-    URL_FORM_CONTENT_TYPE: "application/x-www-form-urlencoded;charset=utf-8",
-    AUTHORIZATION_PENDING: "authorization_pending",
-    NOT_DEFINED: "not_defined",
-    EMPTY_STRING: "",
-    NOT_APPLICABLE: "N/A",
-    FORWARD_SLASH: "/",
-    IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
-    IMDS_VERSION: "2020-06-01",
-    IMDS_TIMEOUT: 2000,
-    AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
-    REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
-    KNOWN_PUBLIC_CLOUDS: [
-        "login.microsoftonline.com",
-        "login.windows.net",
-        "login.microsoft.com",
-        "sts.windows.net",
-    ],
-    TOKEN_RESPONSE_TYPE: "token",
-    ID_TOKEN_RESPONSE_TYPE: "id_token",
-    SHR_NONCE_VALIDITY: 240,
-    INVALID_INSTANCE: "invalid_instance",
-};
-const HttpStatus = {
-    SUCCESS_RANGE_START: 200,
-    SUCCESS_RANGE_END: 299,
-    REDIRECT: 302,
-    CLIENT_ERROR_RANGE_START: 400,
-    CLIENT_ERROR_RANGE_END: 499,
-    SERVER_ERROR_RANGE_START: 500,
-    SERVER_ERROR_RANGE_END: 599,
-};
-const OIDC_DEFAULT_SCOPES = [
-    Constants.OPENID_SCOPE,
-    Constants.PROFILE_SCOPE,
-    Constants.OFFLINE_ACCESS_SCOPE,
-];
-const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
-/**
- * Request header names
- */
-const HeaderNames = {
-    CONTENT_TYPE: "Content-Type",
-    RETRY_AFTER: "Retry-After",
-    CCS_HEADER: "X-AnchorMailbox",
-    WWWAuthenticate: "WWW-Authenticate",
-    AuthenticationInfo: "Authentication-Info",
-    X_MS_REQUEST_ID: "x-ms-request-id",
-    X_MS_HTTP_VERSION: "x-ms-httpver",
-};
-/**
- * Persistent cache keys MSAL which stay while user is logged in.
- */
-const PersistentCacheKeys = {
-    ID_TOKEN: "idtoken",
-    CLIENT_INFO: "client.info",
-    ADAL_ID_TOKEN: "adal.idtoken",
-    ERROR: "error",
-    ERROR_DESC: "error.description",
-    ACTIVE_ACCOUNT: "active-account",
-    ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
-};
-/**
- * String constants related to AAD Authority
- */
-const AADAuthorityConstants = {
-    COMMON: "common",
-    ORGANIZATIONS: "organizations",
-    CONSUMERS: "consumers",
-};
-/**
- * Keys in the hashParams sent by AAD Server
- */
-const AADServerParamKeys = {
-    CLIENT_ID: "client_id",
-    REDIRECT_URI: "redirect_uri",
-    RESPONSE_TYPE: "response_type",
-    RESPONSE_MODE: "response_mode",
-    GRANT_TYPE: "grant_type",
-    CLAIMS: "claims",
-    SCOPE: "scope",
-    ERROR: "error",
-    ERROR_DESCRIPTION: "error_description",
-    ACCESS_TOKEN: "access_token",
-    ID_TOKEN: "id_token",
-    REFRESH_TOKEN: "refresh_token",
-    EXPIRES_IN: "expires_in",
-    STATE: "state",
-    NONCE: "nonce",
-    PROMPT: "prompt",
-    SESSION_STATE: "session_state",
-    CLIENT_INFO: "client_info",
-    CODE: "code",
-    CODE_CHALLENGE: "code_challenge",
-    CODE_CHALLENGE_METHOD: "code_challenge_method",
-    CODE_VERIFIER: "code_verifier",
-    CLIENT_REQUEST_ID: "client-request-id",
-    X_CLIENT_SKU: "x-client-SKU",
-    X_CLIENT_VER: "x-client-VER",
-    X_CLIENT_OS: "x-client-OS",
-    X_CLIENT_CPU: "x-client-CPU",
-    X_CLIENT_CURR_TELEM: "x-client-current-telemetry",
-    X_CLIENT_LAST_TELEM: "x-client-last-telemetry",
-    X_MS_LIB_CAPABILITY: "x-ms-lib-capability",
-    X_APP_NAME: "x-app-name",
-    X_APP_VER: "x-app-ver",
-    POST_LOGOUT_URI: "post_logout_redirect_uri",
-    ID_TOKEN_HINT: "id_token_hint",
-    DEVICE_CODE: "device_code",
-    CLIENT_SECRET: "client_secret",
-    CLIENT_ASSERTION: "client_assertion",
-    CLIENT_ASSERTION_TYPE: "client_assertion_type",
-    TOKEN_TYPE: "token_type",
-    REQ_CNF: "req_cnf",
-    OBO_ASSERTION: "assertion",
-    REQUESTED_TOKEN_USE: "requested_token_use",
-    ON_BEHALF_OF: "on_behalf_of",
-    FOCI: "foci",
-    CCS_HEADER: "X-AnchorMailbox",
-    RETURN_SPA_CODE: "return_spa_code",
-    NATIVE_BROKER: "nativebroker",
-    LOGOUT_HINT: "logout_hint",
-};
-/**
- * Claims request keys
- */
-const ClaimsRequestKeys = {
-    ACCESS_TOKEN: "access_token",
-    XMS_CC: "xms_cc",
-};
-/**
- * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
- * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
- * internal partners too, hence the choice of generic "string" type instead of the "enum"
- */
-const PromptValue = {
-    LOGIN: "login",
-    SELECT_ACCOUNT: "select_account",
-    CONSENT: "consent",
-    NONE: "none",
-    CREATE: "create",
-    NO_SESSION: "no_session",
-};
-/**
- * SSO Types - generated to populate hints
- */
-const SSOTypes = {
-    ACCOUNT: "account",
-    SID: "sid",
-    LOGIN_HINT: "login_hint",
-    ID_TOKEN: "id_token",
-    DOMAIN_HINT: "domain_hint",
-    ORGANIZATIONS: "organizations",
-    CONSUMERS: "consumers",
-    ACCOUNT_ID: "accountIdentifier",
-    HOMEACCOUNT_ID: "homeAccountIdentifier",
-};
-/**
- * allowed values for codeVerifier
- */
-const CodeChallengeMethodValues = {
-    PLAIN: "plain",
-    S256: "S256",
-};
-/**
- * allowed values for server response type
- */
-const ServerResponseType = {
-    QUERY: "query",
-    FRAGMENT: "fragment",
-};
-/**
- * allowed values for response_mode
- */
-const ResponseMode = {
-    ...ServerResponseType,
-    FORM_POST: "form_post",
-};
-/**
- * allowed grant_type
- */
-const GrantType = {
-    IMPLICIT_GRANT: "implicit",
-    AUTHORIZATION_CODE_GRANT: "authorization_code",
-    CLIENT_CREDENTIALS_GRANT: "client_credentials",
-    RESOURCE_OWNER_PASSWORD_GRANT: "password",
-    REFRESH_TOKEN_GRANT: "refresh_token",
-    DEVICE_CODE_GRANT: "device_code",
-    JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-};
-/**
- * Account types in Cache
- */
-const CacheAccountType = {
-    MSSTS_ACCOUNT_TYPE: "MSSTS",
-    ADFS_ACCOUNT_TYPE: "ADFS",
-    MSAV1_ACCOUNT_TYPE: "MSA",
-    GENERIC_ACCOUNT_TYPE: "Generic", // NTLM, Kerberos, FBA, Basic etc
-};
-/**
- * Separators used in cache
- */
-const Separators = {
-    CACHE_KEY_SEPARATOR: "-",
-    CLIENT_INFO_SEPARATOR: ".",
-};
-/**
- * Credential Type stored in the cache
- */
-const CredentialType = {
-    ID_TOKEN: "IdToken",
-    ACCESS_TOKEN: "AccessToken",
-    ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
-    REFRESH_TOKEN: "RefreshToken",
-};
-/**
- * Combine all cache types
- */
-const CacheType = {
-    ADFS: 1001,
-    MSA: 1002,
-    MSSTS: 1003,
-    GENERIC: 1004,
-    ACCESS_TOKEN: 2001,
-    REFRESH_TOKEN: 2002,
-    ID_TOKEN: 2003,
-    APP_METADATA: 3001,
-    UNDEFINED: 9999,
-};
-/**
- * More Cache related constants
- */
-const APP_METADATA = "appmetadata";
-const CLIENT_INFO = "client_info";
-const THE_FAMILY_ID = "1";
-const AUTHORITY_METADATA_CONSTANTS = {
-    CACHE_KEY: "authority-metadata",
-    REFRESH_TIME_SECONDS: 3600 * 24, // 24 Hours
-};
-const AuthorityMetadataSource = {
-    CONFIG: "config",
-    CACHE: "cache",
-    NETWORK: "network",
-    HARDCODED_VALUES: "hardcoded_values",
-};
-const SERVER_TELEM_CONSTANTS = {
-    SCHEMA_VERSION: 5,
-    MAX_CUR_HEADER_BYTES: 80,
-    MAX_LAST_HEADER_BYTES: 330,
-    MAX_CACHED_ERRORS: 50,
-    CACHE_KEY: "server-telemetry",
-    CATEGORY_SEPARATOR: "|",
-    VALUE_SEPARATOR: ",",
-    OVERFLOW_TRUE: "1",
-    OVERFLOW_FALSE: "0",
-    UNKNOWN_ERROR: "unknown_error",
-};
-/**
- * Type of the authentication request
- */
-const AuthenticationScheme = {
-    BEARER: "Bearer",
-    POP: "pop",
-    SSH: "ssh-cert",
-};
-/**
- * Constants related to throttling
- */
-const ThrottlingConstants = {
-    // Default time to throttle RequestThumbprint in seconds
-    DEFAULT_THROTTLE_TIME_SECONDS: 60,
-    // Default maximum time to throttle in seconds, overrides what the server sends back
-    DEFAULT_MAX_THROTTLE_TIME_SECONDS: 3600,
-    // Prefix for storing throttling entries
-    THROTTLING_PREFIX: "throttling",
-    // Value assigned to the x-ms-lib-capability header to indicate to the server the library supports throttling
-    X_MS_LIB_CAPABILITY_VALUE: "retry-after, h429",
-};
-const Errors = {
-    INVALID_GRANT_ERROR: "invalid_grant",
-    CLIENT_MISMATCH_ERROR: "client_mismatch",
-};
-/**
- * Password grant parameters
- */
-const PasswordGrantConstants = {
-    username: "username",
-    password: "password",
-};
-/**
- * Response codes
- */
-const ResponseCodes = {
-    httpSuccess: 200,
-    httpBadRequest: 400,
-};
-/**
- * Region Discovery Sources
- */
-const RegionDiscoverySources = {
-    FAILED_AUTO_DETECTION: "1",
-    INTERNAL_CACHE: "2",
-    ENVIRONMENT_VARIABLE: "3",
-    IMDS: "4",
-};
-/**
- * Region Discovery Outcomes
- */
-const RegionDiscoveryOutcomes = {
-    CONFIGURED_MATCHES_DETECTED: "1",
-    CONFIGURED_NO_AUTO_DETECTION: "2",
-    CONFIGURED_NOT_DETECTED: "3",
-    AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
-    AUTO_DETECTION_REQUESTED_FAILED: "5",
-};
-/**
- * Specifies the reason for fetching the access token from the identity provider
- */
-const CacheOutcome = {
-    // When a token is found in the cache or the cache is not supposed to be hit when making the request
-    NOT_APPLICABLE: "0",
-    // When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
-    FORCE_REFRESH_OR_CLAIMS: "1",
-    // When the token request goes to the identity provider because no cached access token exists
-    NO_CACHED_ACCESS_TOKEN: "2",
-    // When the token request goes to the identity provider because cached access token expired
-    CACHED_ACCESS_TOKEN_EXPIRED: "3",
-    // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
-    PROACTIVELY_REFRESHED: "4",
-};
-const JsonTypes = {
-    Jwt: "JWT",
-    Jwk: "JWK",
-    Pop: "pop",
-};
-const ONE_DAY_IN_MS = 86400000;
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const Constants = {
+    LIBRARY_NAME: "MSAL.JS",
+    SKU: "msal.js.common",
+    // Prefix for all library cache entries
+    CACHE_PREFIX: "msal",
+    // default authority
+    DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
+    DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
+    DEFAULT_COMMON_TENANT: "common",
+    // ADFS String
+    ADFS: "adfs",
+    DSTS: "dstsv2",
+    // Default AAD Instance Discovery Endpoint
+    AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
+    // CIAM URL
+    CIAM_AUTH_URL: ".ciamlogin.com",
+    AAD_TENANT_DOMAIN_SUFFIX: ".onmicrosoft.com",
+    // Resource delimiter - used for certain cache entries
+    RESOURCE_DELIM: "|",
+    // Placeholder for non-existent account ids/objects
+    NO_ACCOUNT: "NO_ACCOUNT",
+    // Claims
+    CLAIMS: "claims",
+    // Consumer UTID
+    CONSUMER_UTID: "9188040d-6c67-4c5b-b112-36a304b66dad",
+    // Default scopes
+    OPENID_SCOPE: "openid",
+    PROFILE_SCOPE: "profile",
+    OFFLINE_ACCESS_SCOPE: "offline_access",
+    EMAIL_SCOPE: "email",
+    // Default response type for authorization code flow
+    CODE_RESPONSE_TYPE: "code",
+    CODE_GRANT_TYPE: "authorization_code",
+    RT_GRANT_TYPE: "refresh_token",
+    FRAGMENT_RESPONSE_MODE: "fragment",
+    S256_CODE_CHALLENGE_METHOD: "S256",
+    URL_FORM_CONTENT_TYPE: "application/x-www-form-urlencoded;charset=utf-8",
+    AUTHORIZATION_PENDING: "authorization_pending",
+    NOT_DEFINED: "not_defined",
+    EMPTY_STRING: "",
+    NOT_APPLICABLE: "N/A",
+    FORWARD_SLASH: "/",
+    IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
+    IMDS_VERSION: "2020-06-01",
+    IMDS_TIMEOUT: 2000,
+    AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
+    REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
+    KNOWN_PUBLIC_CLOUDS: [
+        "login.microsoftonline.com",
+        "login.windows.net",
+        "login.microsoft.com",
+        "sts.windows.net",
+    ],
+    TOKEN_RESPONSE_TYPE: "token",
+    ID_TOKEN_RESPONSE_TYPE: "id_token",
+    SHR_NONCE_VALIDITY: 240,
+    INVALID_INSTANCE: "invalid_instance",
+};
+const HttpStatus = {
+    SUCCESS_RANGE_START: 200,
+    SUCCESS_RANGE_END: 299,
+    REDIRECT: 302,
+    CLIENT_ERROR_RANGE_START: 400,
+    UNAUTHORIZED: 401,
+    CLIENT_ERROR_RANGE_END: 499,
+    SERVER_ERROR_RANGE_START: 500,
+    SERVER_ERROR_RANGE_END: 599,
+};
+const OIDC_DEFAULT_SCOPES = [
+    Constants.OPENID_SCOPE,
+    Constants.PROFILE_SCOPE,
+    Constants.OFFLINE_ACCESS_SCOPE,
+];
+const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
+/**
+ * Request header names
+ */
+const HeaderNames = {
+    CONTENT_TYPE: "Content-Type",
+    RETRY_AFTER: "Retry-After",
+    CCS_HEADER: "X-AnchorMailbox",
+    WWWAuthenticate: "WWW-Authenticate",
+    AuthenticationInfo: "Authentication-Info",
+    X_MS_REQUEST_ID: "x-ms-request-id",
+    X_MS_HTTP_VERSION: "x-ms-httpver",
+};
+/**
+ * Persistent cache keys MSAL which stay while user is logged in.
+ */
+const PersistentCacheKeys = {
+    ID_TOKEN: "idtoken",
+    CLIENT_INFO: "client.info",
+    ADAL_ID_TOKEN: "adal.idtoken",
+    ERROR: "error",
+    ERROR_DESC: "error.description",
+    ACTIVE_ACCOUNT: "active-account",
+    ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
+};
+/**
+ * String constants related to AAD Authority
+ */
+const AADAuthorityConstants = {
+    COMMON: "common",
+    ORGANIZATIONS: "organizations",
+    CONSUMERS: "consumers",
+};
+/**
+ * Keys in the hashParams sent by AAD Server
+ */
+const AADServerParamKeys = {
+    CLIENT_ID: "client_id",
+    REDIRECT_URI: "redirect_uri",
+    RESPONSE_TYPE: "response_type",
+    RESPONSE_MODE: "response_mode",
+    GRANT_TYPE: "grant_type",
+    CLAIMS: "claims",
+    SCOPE: "scope",
+    ERROR: "error",
+    ERROR_DESCRIPTION: "error_description",
+    ACCESS_TOKEN: "access_token",
+    ID_TOKEN: "id_token",
+    REFRESH_TOKEN: "refresh_token",
+    EXPIRES_IN: "expires_in",
+    STATE: "state",
+    NONCE: "nonce",
+    PROMPT: "prompt",
+    SESSION_STATE: "session_state",
+    CLIENT_INFO: "client_info",
+    CODE: "code",
+    CODE_CHALLENGE: "code_challenge",
+    CODE_CHALLENGE_METHOD: "code_challenge_method",
+    CODE_VERIFIER: "code_verifier",
+    CLIENT_REQUEST_ID: "client-request-id",
+    X_CLIENT_SKU: "x-client-SKU",
+    X_CLIENT_VER: "x-client-VER",
+    X_CLIENT_OS: "x-client-OS",
+    X_CLIENT_CPU: "x-client-CPU",
+    X_CLIENT_CURR_TELEM: "x-client-current-telemetry",
+    X_CLIENT_LAST_TELEM: "x-client-last-telemetry",
+    X_MS_LIB_CAPABILITY: "x-ms-lib-capability",
+    X_APP_NAME: "x-app-name",
+    X_APP_VER: "x-app-ver",
+    POST_LOGOUT_URI: "post_logout_redirect_uri",
+    ID_TOKEN_HINT: "id_token_hint",
+    DEVICE_CODE: "device_code",
+    CLIENT_SECRET: "client_secret",
+    CLIENT_ASSERTION: "client_assertion",
+    CLIENT_ASSERTION_TYPE: "client_assertion_type",
+    TOKEN_TYPE: "token_type",
+    REQ_CNF: "req_cnf",
+    OBO_ASSERTION: "assertion",
+    REQUESTED_TOKEN_USE: "requested_token_use",
+    ON_BEHALF_OF: "on_behalf_of",
+    FOCI: "foci",
+    CCS_HEADER: "X-AnchorMailbox",
+    RETURN_SPA_CODE: "return_spa_code",
+    NATIVE_BROKER: "nativebroker",
+    LOGOUT_HINT: "logout_hint",
+};
+/**
+ * Claims request keys
+ */
+const ClaimsRequestKeys = {
+    ACCESS_TOKEN: "access_token",
+    XMS_CC: "xms_cc",
+};
+/**
+ * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
+ * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
+ * internal partners too, hence the choice of generic "string" type instead of the "enum"
+ */
+const PromptValue = {
+    LOGIN: "login",
+    SELECT_ACCOUNT: "select_account",
+    CONSENT: "consent",
+    NONE: "none",
+    CREATE: "create",
+    NO_SESSION: "no_session",
+};
+/**
+ * SSO Types - generated to populate hints
+ */
+const SSOTypes = {
+    ACCOUNT: "account",
+    SID: "sid",
+    LOGIN_HINT: "login_hint",
+    ID_TOKEN: "id_token",
+    DOMAIN_HINT: "domain_hint",
+    ORGANIZATIONS: "organizations",
+    CONSUMERS: "consumers",
+    ACCOUNT_ID: "accountIdentifier",
+    HOMEACCOUNT_ID: "homeAccountIdentifier",
+};
+/**
+ * allowed values for codeVerifier
+ */
+const CodeChallengeMethodValues = {
+    PLAIN: "plain",
+    S256: "S256",
+};
+/**
+ * allowed values for server response type
+ */
+const ServerResponseType = {
+    QUERY: "query",
+    FRAGMENT: "fragment",
+};
+/**
+ * allowed values for response_mode
+ */
+const ResponseMode = {
+    ...ServerResponseType,
+    FORM_POST: "form_post",
+};
+/**
+ * allowed grant_type
+ */
+const GrantType = {
+    IMPLICIT_GRANT: "implicit",
+    AUTHORIZATION_CODE_GRANT: "authorization_code",
+    CLIENT_CREDENTIALS_GRANT: "client_credentials",
+    RESOURCE_OWNER_PASSWORD_GRANT: "password",
+    REFRESH_TOKEN_GRANT: "refresh_token",
+    DEVICE_CODE_GRANT: "device_code",
+    JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+};
+/**
+ * Account types in Cache
+ */
+const CacheAccountType = {
+    MSSTS_ACCOUNT_TYPE: "MSSTS",
+    ADFS_ACCOUNT_TYPE: "ADFS",
+    MSAV1_ACCOUNT_TYPE: "MSA",
+    GENERIC_ACCOUNT_TYPE: "Generic", // NTLM, Kerberos, FBA, Basic etc
+};
+/**
+ * Separators used in cache
+ */
+const Separators = {
+    CACHE_KEY_SEPARATOR: "-",
+    CLIENT_INFO_SEPARATOR: ".",
+};
+/**
+ * Credential Type stored in the cache
+ */
+const CredentialType = {
+    ID_TOKEN: "IdToken",
+    ACCESS_TOKEN: "AccessToken",
+    ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
+    REFRESH_TOKEN: "RefreshToken",
+};
+/**
+ * Combine all cache types
+ */
+const CacheType = {
+    ADFS: 1001,
+    MSA: 1002,
+    MSSTS: 1003,
+    GENERIC: 1004,
+    ACCESS_TOKEN: 2001,
+    REFRESH_TOKEN: 2002,
+    ID_TOKEN: 2003,
+    APP_METADATA: 3001,
+    UNDEFINED: 9999,
+};
+/**
+ * More Cache related constants
+ */
+const APP_METADATA = "appmetadata";
+const CLIENT_INFO = "client_info";
+const THE_FAMILY_ID = "1";
+const AUTHORITY_METADATA_CONSTANTS = {
+    CACHE_KEY: "authority-metadata",
+    REFRESH_TIME_SECONDS: 3600 * 24, // 24 Hours
+};
+const AuthorityMetadataSource = {
+    CONFIG: "config",
+    CACHE: "cache",
+    NETWORK: "network",
+    HARDCODED_VALUES: "hardcoded_values",
+};
+const SERVER_TELEM_CONSTANTS = {
+    SCHEMA_VERSION: 5,
+    MAX_CUR_HEADER_BYTES: 80,
+    MAX_LAST_HEADER_BYTES: 330,
+    MAX_CACHED_ERRORS: 50,
+    CACHE_KEY: "server-telemetry",
+    CATEGORY_SEPARATOR: "|",
+    VALUE_SEPARATOR: ",",
+    OVERFLOW_TRUE: "1",
+    OVERFLOW_FALSE: "0",
+    UNKNOWN_ERROR: "unknown_error",
+};
+/**
+ * Type of the authentication request
+ */
+const AuthenticationScheme = {
+    BEARER: "Bearer",
+    POP: "pop",
+    SSH: "ssh-cert",
+};
+/**
+ * Constants related to throttling
+ */
+const ThrottlingConstants = {
+    // Default time to throttle RequestThumbprint in seconds
+    DEFAULT_THROTTLE_TIME_SECONDS: 60,
+    // Default maximum time to throttle in seconds, overrides what the server sends back
+    DEFAULT_MAX_THROTTLE_TIME_SECONDS: 3600,
+    // Prefix for storing throttling entries
+    THROTTLING_PREFIX: "throttling",
+    // Value assigned to the x-ms-lib-capability header to indicate to the server the library supports throttling
+    X_MS_LIB_CAPABILITY_VALUE: "retry-after, h429",
+};
+const Errors = {
+    INVALID_GRANT_ERROR: "invalid_grant",
+    CLIENT_MISMATCH_ERROR: "client_mismatch",
+};
+/**
+ * Password grant parameters
+ */
+const PasswordGrantConstants = {
+    username: "username",
+    password: "password",
+};
+/**
+ * Response codes
+ */
+const ResponseCodes = {
+    httpSuccess: 200,
+    httpBadRequest: 400,
+};
+/**
+ * Region Discovery Sources
+ */
+const RegionDiscoverySources = {
+    FAILED_AUTO_DETECTION: "1",
+    INTERNAL_CACHE: "2",
+    ENVIRONMENT_VARIABLE: "3",
+    IMDS: "4",
+};
+/**
+ * Region Discovery Outcomes
+ */
+const RegionDiscoveryOutcomes = {
+    CONFIGURED_MATCHES_DETECTED: "1",
+    CONFIGURED_NO_AUTO_DETECTION: "2",
+    CONFIGURED_NOT_DETECTED: "3",
+    AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
+    AUTO_DETECTION_REQUESTED_FAILED: "5",
+};
+/**
+ * Specifies the reason for fetching the access token from the identity provider
+ */
+const CacheOutcome = {
+    // When a token is found in the cache or the cache is not supposed to be hit when making the request
+    NOT_APPLICABLE: "0",
+    // When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
+    FORCE_REFRESH_OR_CLAIMS: "1",
+    // When the token request goes to the identity provider because no cached access token exists
+    NO_CACHED_ACCESS_TOKEN: "2",
+    // When the token request goes to the identity provider because cached access token expired
+    CACHED_ACCESS_TOKEN_EXPIRED: "3",
+    // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
+    PROACTIVELY_REFRESHED: "4",
+};
+const JsonTypes = {
+    Jwt: "JWT",
+    Jwk: "JWK",
+    Pop: "pop",
+};
+const ONE_DAY_IN_MS = 86400000;
+// Token renewal offset default in seconds
+const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-export { AADAuthorityConstants, AADServerParamKeys, APP_METADATA, AUTHORITY_METADATA_CONSTANTS, AuthenticationScheme, AuthorityMetadataSource, CLIENT_INFO, CacheAccountType, CacheOutcome, CacheType, ClaimsRequestKeys, CodeChallengeMethodValues, Constants, CredentialType, Errors, GrantType, HeaderNames, HttpStatus, JsonTypes, OIDC_DEFAULT_SCOPES, OIDC_SCOPES, ONE_DAY_IN_MS, PasswordGrantConstants, PersistentCacheKeys, PromptValue, RegionDiscoveryOutcomes, RegionDiscoverySources, ResponseCodes, ResponseMode, SERVER_TELEM_CONSTANTS, SSOTypes, Separators, ServerResponseType, THE_FAMILY_ID, ThrottlingConstants };
+export { AADAuthorityConstants, AADServerParamKeys, APP_METADATA, AUTHORITY_METADATA_CONSTANTS, AuthenticationScheme, AuthorityMetadataSource, CLIENT_INFO, CacheAccountType, CacheOutcome, CacheType, ClaimsRequestKeys, CodeChallengeMethodValues, Constants, CredentialType, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC, Errors, GrantType, HeaderNames, HttpStatus, JsonTypes, OIDC_DEFAULT_SCOPES, OIDC_SCOPES, ONE_DAY_IN_MS, PasswordGrantConstants, PersistentCacheKeys, PromptValue, RegionDiscoveryOutcomes, RegionDiscoverySources, ResponseCodes, ResponseMode, SERVER_TELEM_CONSTANTS, SSOTypes, Separators, ServerResponseType, THE_FAMILY_ID, ThrottlingConstants };
 //# sourceMappingURL=Constants.mjs.map