@azure/msal-common 15.2.0 → 15.3.0

package/dist/account/AccountInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/account/AuthToken.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { tokenParsingError, nullOrEmptyToken, maxAgeTranspired } from '../error/ClientAuthErrorCodes.mjs';

package/dist/account/CcsCredential.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/account/ClientInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { Separators, Constants } from '../utils/Constants.mjs';

package/dist/account/TokenClaims.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/Authority.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { AuthorityType } from './AuthorityType.mjs';
 import { isOpenIdConfigResponse } from './OpenIdConfigResponse.mjs';

package/dist/authority/AuthorityFactory.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { Authority, formatAuthorityUri } from './Authority.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist/authority/AuthorityMetadata.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { UrlString } from '../url/UrlString.mjs';
 import { AuthorityMetadataSource } from '../utils/Constants.mjs';

package/dist/authority/AuthorityOptions.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/AuthorityType.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/CloudInstanceDiscoveryErrorResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/CloudInstanceDiscoveryResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/OpenIdConfigResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/ProtocolMode.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/authority/RegionDiscovery.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { Constants, ResponseCodes, RegionDiscoverySources } from '../utils/Constants.mjs';
 import { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';

package/dist/cache/CacheManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { Separators, CredentialType, AuthenticationScheme, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.mjs';
 import { generateCredentialKey } from './utils/CacheHelpers.mjs';

package/dist/cache/entities/AccountEntity.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { Separators, CacheAccountType } from '../../utils/Constants.mjs';
 import { buildClientInfo } from '../../account/ClientInfo.mjs';

package/dist/cache/persistence/TokenCacheContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/cache/utils/CacheHelpers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { extractTokenClaims } from '../../account/AuthToken.mjs';
 import { createClientAuthError } from '../../error/ClientAuthError.mjs';

package/dist/client/AuthorizationCodeClient.d.ts

@@ -1,9 +1,7 @@
 import { BaseClient } from "./BaseClient.js";
-import { CommonAuthorizationUrlRequest } from "../request/CommonAuthorizationUrlRequest.js";
 import { CommonAuthorizationCodeRequest } from "../request/CommonAuthorizationCodeRequest.js";
 import { ClientConfiguration } from "../config/ClientConfiguration.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { ServerAuthorizationCodeResponse } from "../response/ServerAuthorizationCodeResponse.js";
 import { CommonEndSessionRequest } from "../request/CommonEndSessionRequest.js";
 import { AuthorizationCodePayload } from "../response/AuthorizationCodePayload.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
@@ -15,29 +13,12 @@ export declare class AuthorizationCodeClient extends BaseClient {
     protected includeRedirectUri: boolean;
     private oidcDefaultScopes;
     constructor(configuration: ClientConfiguration, performanceClient?: IPerformanceClient);
-    /**
-     * Creates the URL of the authorization request letting the user input credentials and consent to the
-     * application. The URL target the /authorize endpoint of the authority configured in the
-     * application object.
-     *
-     * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
-     * sent in the request and should contain an authorization code, which can then be used to acquire tokens via
-     * acquireToken(AuthorizationCodeRequest)
-     * @param request
-     */
-    getAuthCodeUrl(request: CommonAuthorizationUrlRequest): Promise<string>;
     /**
      * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
      * authorization_code_grant
      * @param request
      */
     acquireToken(request: CommonAuthorizationCodeRequest, authCodePayload?: AuthorizationCodePayload): Promise<AuthenticationResult>;
-    /**
-     * Handles the hash fragment response from public client code request. Returns a code response used by
-     * the client to exchange for a token in acquireToken.
-     * @param hashFragment
-     */
-    handleFragmentResponse(serverParams: ServerAuthorizationCodeResponse, cachedState: string): AuthorizationCodePayload;
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
      * Default behaviour is to redirect the user to `window.location.href`.
@@ -55,22 +36,10 @@ export declare class AuthorizationCodeClient extends BaseClient {
      * @param request
      */
     private createTokenRequestBody;
-    /**
-     * This API validates the `AuthorizationCodeUrlRequest` and creates a URL
-     * @param request
-     */
-    private createAuthCodeUrlQueryString;
     /**
      * This API validates the `EndSessionRequest` and creates a URL
      * @param request
      */
     private createLogoutUrlQueryString;
-    private addExtraQueryParams;
-    /**
-     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
-     * @param account
-     */
-    private extractAccountSid;
-    private extractLoginHint;
 }
 //# sourceMappingURL=AuthorizationCodeClient.d.ts.map

package/dist/client/AuthorizationCodeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeClient.d.ts","sourceRoot":"","sources":["../../src/client/AuthorizationCodeClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAW9F,OAAO,EACH,mBAAmB,EAEtB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAO3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAanF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IAEnD,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAQ;IAC7C,OAAO,CAAC,iBAAiB,CAAC;gBAGtB,aAAa,EAAE,mBAAmB,EAClC,iBAAiB,CAAC,EAAE,kBAAkB;IAO1C;;;;;;;;;OASG;IACG,cAAc,CAChB,OAAO,EAAE,6BAA6B,GACvC,OAAO,CAAC,MAAM,CAAC;IAoBlB;;;;OAIG;IACG,YAAY,CACd,OAAO,EAAE,8BAA8B,EACvC,eAAe,CAAC,EAAE,wBAAwB,GAC3C,OAAO,CAAC,oBAAoB,CAAC;IAwDhC;;;;OAIG;IACH,sBAAsB,CAClB,YAAY,EAAE,+BAA+B,EAC7C,WAAW,EAAE,MAAM,GACpB,wBAAwB;IA2B3B;;;;OAIG;IACH,YAAY,CAAC,aAAa,EAAE,uBAAuB,GAAG,MAAM;IAgB5D;;;;OAIG;YACW,mBAAmB;IA0EjC;;;OAGG;YACW,sBAAsB;IAoMpC;;;OAGG;YACW,4BAA4B;IA4P1C;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAmClC,OAAO,CAAC,mBAAmB;IAqB3B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;CAG3B"}
+{"version":3,"file":"AuthorizationCodeClient.d.ts","sourceRoot":"","sources":["../../src/client/AuthorizationCodeClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,8CAA8C,CAAC;AAW9F,OAAO,EACH,mBAAmB,EAEtB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAO3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAYnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAOpF;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IAEnD,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAQ;IAC7C,OAAO,CAAC,iBAAiB,CAAC;gBAGtB,aAAa,EAAE,mBAAmB,EAClC,iBAAiB,CAAC,EAAE,kBAAkB;IAO1C;;;;OAIG;IACG,YAAY,CACd,OAAO,EAAE,8BAA8B,EACvC,eAAe,CAAC,EAAE,wBAAwB,GAC3C,OAAO,CAAC,oBAAoB,CAAC;IAwDhC;;;;OAIG;IACH,YAAY,CAAC,aAAa,EAAE,uBAAuB,GAAG,MAAM;IAgB5D;;;;OAIG;YACW,mBAAmB;IAiEjC;;;OAGG;YACW,sBAAsB;IAoOpC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;CAkDrC"}

package/dist/client/AuthorizationCodeClient.mjs

@@ -1,8 +1,9 @@
-/*! @azure/msal-common v15.2.0 2025-02-18 */
+/*! @azure/msal-common v15.3.0 2025-03-20 */
 'use strict';
 import { BaseClient } from './BaseClient.mjs';
-import { RequestParameterBuilder } from '../request/RequestParameterBuilder.mjs';
-import { Separators, GrantType, AuthenticationScheme, PromptValue, HeaderNames } from '../utils/Constants.mjs';
+import { addClientId, addRedirectUri, addScopes, addAuthorizationCode, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addCodeVerifier, addClientSecret, addClientAssertion, addClientAssertionType, addGrantType, addClientInfo, addPopToken, addSshJwk, addClaims, addCcsUpn, addCcsOid, addBrokerParameters, addExtraQueryParameters, instrumentBrokerParams, addPostLogoutRedirectUri, addCorrelationId, addIdTokenHint, addState, addLogoutHint, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { Separators, GrantType, AuthenticationScheme, HeaderNames } from '../utils/Constants.mjs';
 import { CLIENT_ID, RETURN_SPA_CODE } from '../constants/AADServerParamKeys.mjs';
 import { isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
 import { ResponseHandler } from '../response/ResponseHandler.mjs';
@@ -18,7 +19,8 @@ import { RequestValidator } from '../request/RequestValidator.mjs';
 import { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';
 import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';
-import { requestCannotBeMade, authorizationCodeMissingFromServerResponse } from '../error/ClientAuthErrorCodes.mjs';
+import { getRequestThumbprint } from '../network/RequestThumbprint.mjs';
+import { requestCannotBeMade } from '../error/ClientAuthErrorCodes.mjs';
 import { logoutRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
 
 /*
@@ -37,21 +39,6 @@ class AuthorizationCodeClient extends BaseClient {
         this.oidcDefaultScopes =
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
-    /**
-     * Creates the URL of the authorization request letting the user input credentials and consent to the
-     * application. The URL target the /authorize endpoint of the authority configured in the
-     * application object.
-     *
-     * Once the user inputs their credentials and consents, the authority will send a response to the redirect URI
-     * sent in the request and should contain an authorization code, which can then be used to acquire tokens via
-     * acquireToken(AuthorizationCodeRequest)
-     * @param request
-     */
-    async getAuthCodeUrl(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.GetAuthCodeUrl, request.correlationId);
-        const queryString = await invokeAsync(this.createAuthCodeUrlQueryString.bind(this), PerformanceEvents.AuthClientCreateQueryString, this.logger, this.performanceClient, request.correlationId)(request);
-        return UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString);
-    }
     /**
      * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
      * authorization_code_grant
@@ -71,22 +58,6 @@ class AuthorizationCodeClient extends BaseClient {
         responseHandler.validateTokenResponse(response.body);
         return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
     }
-    /**
-     * Handles the hash fragment response from public client code request. Returns a code response used by
-     * the client to exchange for a token in acquireToken.
-     * @param hashFragment
-     */
-    handleFragmentResponse(serverParams, cachedState) {
-        // Handle responses.
-        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        // Get code response
-        responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
-        // throw when there is no auth code in the response
-        if (!serverParams.code) {
-            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
-        }
-        return serverParams;
-    }
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
      * Default behaviour is to redirect the user to `window.location.href`.
@@ -125,18 +96,7 @@ class AuthorizationCodeClient extends BaseClient {
             }
         }
         const headers = this.createTokenRequestHeaders(ccsCredential || request.ccsCredential);
-        const thumbprint = {
-            clientId: request.tokenBodyParameters?.clientId ||
-                this.config.authOptions.clientId,
-            authority: authority.canonicalAuthority,
-            scopes: request.scopes,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-        };
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
         return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint);
     }
     /**
@@ -145,8 +105,8 @@ class AuthorizationCodeClient extends BaseClient {
      */
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
             request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
@@ -159,33 +119,33 @@ class AuthorizationCodeClient extends BaseClient {
         }
         else {
             // Validate and include redirect uri
-            parameterBuilder.addRedirectUri(request.redirectUri);
+            addRedirectUri(parameters, request.redirectUri);
         }
         // Add scope array, parameter builder will add default scopes and dedupe
-        parameterBuilder.addScopes(request.scopes, true, this.oidcDefaultScopes);
+        addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
         // add code: user set, not validated
-        parameterBuilder.addAuthorizationCode(request.code);
+        addAuthorizationCode(parameters, request.code);
         // Add library metadata
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        parameterBuilder.addThrottling();
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
         if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
-            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+            addServerTelemetry(parameters, this.serverTelemetryManager);
         }
         // add code_verifier if passed
         if (request.codeVerifier) {
-            parameterBuilder.addCodeVerifier(request.codeVerifier);
+            addCodeVerifier(parameters, request.codeVerifier);
         }
         if (this.config.clientCredentials.clientSecret) {
-            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
         }
         if (this.config.clientCredentials.clientAssertion) {
             const clientAssertion = this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
-            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
         }
-        parameterBuilder.addGrantType(GrantType.AUTHORIZATION_CODE_GRANT);
-        parameterBuilder.addClientInfo();
+        addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
+        addClientInfo(parameters);
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
             let reqCnfData;
@@ -197,11 +157,11 @@ class AuthorizationCodeClient extends BaseClient {
                 reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
             }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData);
+            addPopToken(parameters, reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
-                parameterBuilder.addSshJwk(request.sshJwk);
+                addSshJwk(parameters, request.sshJwk);
             }
             else {
                 throw createClientConfigurationError(missingSshJwk);
@@ -210,7 +170,7 @@ class AuthorizationCodeClient extends BaseClient {
         if (!StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
                 this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
         }
         let ccsCred = undefined;
         if (request.clientInfo) {
@@ -234,7 +194,7 @@ class AuthorizationCodeClient extends BaseClient {
                 case CcsCredentialType.HOME_ACCOUNT_ID:
                     try {
                         const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
-                        parameterBuilder.addCcsOid(clientInfo);
+                        addCcsOid(parameters, clientInfo);
                     }
                     catch (e) {
                         this.logger.verbose("Could not parse home account ID for CCS Header: " +
@@ -242,230 +202,55 @@ class AuthorizationCodeClient extends BaseClient {
                     }
                     break;
                 case CcsCredentialType.UPN:
-                    parameterBuilder.addCcsUpn(ccsCred.credential);
+                    addCcsUpn(parameters, ccsCred.credential);
                     break;
             }
         }
         if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
         if (request.tokenBodyParameters) {
-            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+            addExtraQueryParameters(parameters, request.tokenBodyParameters);
         }
         // Add hybrid spa parameters if not already provided
         if (request.enableSpaAuthorizationCode &&
             (!request.tokenBodyParameters ||
                 !request.tokenBodyParameters[RETURN_SPA_CODE])) {
-            parameterBuilder.addExtraQueryParameters({
+            addExtraQueryParameters(parameters, {
                 [RETURN_SPA_CODE]: "1",
             });
         }
-        return parameterBuilder.createQueryString();
-    }
-    /**
-     * This API validates the `AuthorizationCodeUrlRequest` and creates a URL
-     * @param request
-     */
-    async createAuthCodeUrlQueryString(request) {
-        // generate the correlationId if not set by the user and add
-        const correlationId = request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, correlationId);
-        const parameterBuilder = new RequestParameterBuilder(correlationId, this.performanceClient);
-        parameterBuilder.addClientId(request.embeddedClientId ||
-            request.extraQueryParameters?.[CLIENT_ID] ||
-            this.config.authOptions.clientId);
-        const requestScopes = [
-            ...(request.scopes || []),
-            ...(request.extraScopesToConsent || []),
-        ];
-        parameterBuilder.addScopes(requestScopes, true, this.oidcDefaultScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        if (!isOidcProtocolMode(this.config)) {
-            parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        }
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-            this.performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
-        }
-        this.performanceClient?.addFields({ prompt: request.prompt }, correlationId);
-        // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-                this.performanceClient?.addFields({ sidFromRequest: true }, correlationId);
-            }
-            else if (request.account) {
-                const accountSid = this.extractAccountSid(request.account);
-                let accountLoginHintClaim = this.extractLoginHint(request.account);
-                if (accountLoginHintClaim && request.domainHint) {
-                    this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
-                    accountLoginHintClaim = null;
-                }
-                // If login_hint claim is present, use it over sid/username
-                if (accountLoginHintClaim) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
-                    parameterBuilder.addLoginHint(accountLoginHintClaim);
-                    this.performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (accountSid && request.prompt === PromptValue.NONE) {
-                    /*
-                     * If account and loginHint are provided, we will check account first for sid before adding loginHint
-                     * SessionId is only used in silent calls
-                     */
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    this.performanceClient?.addFields({ sidFromClaim: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                    this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    this.performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
-                    try {
-                        const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("createAuthCodeUrlQueryString: Could not parse home account ID for CCS Header");
-                    }
-                }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-                this.performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (request.claims ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.embeddedClientId) {
-            parameterBuilder.addBrokerParameters({
-                brokerClientId: this.config.authOptions.clientId,
-                brokerRedirectUri: this.config.authOptions.redirectUri,
-            });
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        if (request.platformBroker) {
-            // signal ests that this is a WAM call
-            parameterBuilder.addNativeBroker();
-            // pass the req_cnf for POP
-            if (request.authenticationScheme === AuthenticationScheme.POP) {
-                const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // req_cnf is always sent as a string for SPAs
-                let reqCnfData;
-                if (!request.popKid) {
-                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                    reqCnfData = generatedReqCnfData.reqCnfString;
-                }
-                else {
-                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
-                }
-                parameterBuilder.addPopToken(reqCnfData);
-            }
-        }
-        return parameterBuilder.createQueryString();
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
     /**
      * This API validates the `EndSessionRequest` and creates a URL
      * @param request
      */
     createLogoutUrlQueryString(request) {
-        const parameterBuilder = new RequestParameterBuilder(request.correlationId, this.performanceClient);
+        const parameters = new Map();
         if (request.postLogoutRedirectUri) {
-            parameterBuilder.addPostLogoutRedirectUri(request.postLogoutRedirectUri);
+            addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
         }
         if (request.correlationId) {
-            parameterBuilder.addCorrelationId(request.correlationId);
+            addCorrelationId(parameters, request.correlationId);
         }
         if (request.idTokenHint) {
-            parameterBuilder.addIdTokenHint(request.idTokenHint);
+            addIdTokenHint(parameters, request.idTokenHint);
         }
         if (request.state) {
-            parameterBuilder.addState(request.state);
+            addState(parameters, request.state);
         }
         if (request.logoutHint) {
-            parameterBuilder.addLogoutHint(request.logoutHint);
-        }
-        this.addExtraQueryParams(request, parameterBuilder);
-        return parameterBuilder.createQueryString();
-    }
-    addExtraQueryParams(request, parameterBuilder) {
-        const hasRequestInstanceAware = request.extraQueryParameters &&
-            request.extraQueryParameters.hasOwnProperty("instance_aware");
-        // Set instance_aware flag if config auth param is set
-        if (!hasRequestInstanceAware && this.config.authOptions.instanceAware) {
-            request.extraQueryParameters = request.extraQueryParameters || {};
-            request.extraQueryParameters["instance_aware"] = "true";
+            addLogoutHint(parameters, request.logoutHint);
         }
         if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+            addExtraQueryParameters(parameters, request.extraQueryParameters);
         }
-    }
-    /**
-     * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
-     * @param account
-     */
-    extractAccountSid(account) {
-        return account.idTokenClaims?.sid || null;
-    }
-    extractLoginHint(account) {
-        return account.idTokenClaims?.login_hint || null;
+        if (this.config.authOptions.instanceAware) {
+            addInstanceAware(parameters);
+        }
+        return mapToQueryString(parameters);
     }
 }